Edit tour

Windows Analysis Report
http://constructivesoftware.com.au

Overview

General Information

Sample URL:	http://constructivesoftware.com.au
Analysis ID:	1499537

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 2940 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://constructivesoftware.com.au/ MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6964 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=1988,i,5118178039003629432,4360773024062026730,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

HTTP traffic detected: GET / HTTP/1.1Host: constructivesoftware.com.auConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: constructivesoftware.com.au
Source: global traffic	DNS traffic detected: DNS query: www.constructivesoftware.com.au
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: fw-cdn.com
Source: global traffic	DNS traffic detected: DNS query: assets.freshsales.io
Source: global traffic	DNS traffic detected: DNS query: analytics.google.com
Source: global traffic	DNS traffic detected: DNS query: td.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: stats.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: www.auth.constructivesoftware.com.au
Source: global traffic	DNS traffic detected: DNS query: google.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.11.168.232:443 -> 192.168.2.16:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.160.20:443 -> 192.168.2.16:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.11.168.232:443 -> 192.168.2.16:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.11.168.232:443 -> 192.168.2.16:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.11.168.232:443 -> 192.168.2.16:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.240.158:443 -> 192.168.2.16:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.240.158:443 -> 192.168.2.16:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:49809 version: TLS 1.2

Source: classification engine

Classification label: mal56.win@19/59@36/210

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://constructivesoftware.com.au/
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=1988,i,5118178039003629432,4360773024062026730,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=1988,i,5118178039003629432,4360773024062026730,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
http://constructivesoftware.com.au	100%	Avira URL Cloud	malware
http://constructivesoftware.com.au	1%	Virustotal		Browse

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
constructivesoftware.com.au	1%	Virustotal	Browse
www.google.com	0%	Virustotal	Browse
www.constructivesoftware.com.au	0%	Virustotal	Browse
fw-cdn.com	0%	Virustotal	Browse
analytics-alv.google.com	0%	Virustotal	Browse
assets.freshsales.io	0%	Virustotal	Browse
analytics.google.com	0%	Virustotal	Browse
td.doubleclick.net	1%	Virustotal	Browse
stats.g.doubleclick.net	0%	Virustotal	Browse
google.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://constructivesoftware.com.au/	100%	Avira URL Cloud	malware
http://constructivesoftware.com.au/	1%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
analytics-alv.google.com	216.239.34.181	true	false	0%, Virustotal, Browse	unknown
google.com	142.251.36.78	true	false	0%, Virustotal, Browse	unknown
constructivesoftware.com.au	122.201.127.17	true	false	1%, Virustotal, Browse	unknown
www.google.com	216.58.212.164	true	false	0%, Virustotal, Browse	unknown
td.doubleclick.net	142.250.184.194	true	false	1%, Virustotal, Browse	unknown
fw-cdn.com	18.66.122.128	true	false	0%, Virustotal, Browse	unknown
assets.freshsales.io	13.35.58.117	true	false	0%, Virustotal, Browse	unknown
stats.g.doubleclick.net	108.177.15.156	true	false	0%, Virustotal, Browse	unknown
www.auth.constructivesoftware.com.au	unknown	unknown	false		unknown
analytics.google.com	unknown	unknown	false	0%, Virustotal, Browse	unknown
www.constructivesoftware.com.au	unknown	unknown	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://constructivesoftware.com.au/	true	1%, Virustotal, Browse Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.217.16.202	unknown	United States	15169	GOOGLEUS	false
108.177.15.156	stats.g.doubleclick.net	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
142.250.74.200	unknown	United States	15169	GOOGLEUS	false
122.201.127.17	constructivesoftware.com.au	Australia	38719	DREAMSCAPE-AS-APDreamscapeNetworksLimitedAU	false
216.58.212.164	www.google.com	United States	15169	GOOGLEUS	false
216.239.34.181	analytics-alv.google.com	United States	15169	GOOGLEUS	false
142.250.186.163	unknown	United States	15169	GOOGLEUS	false
142.250.184.194	td.doubleclick.net	United States	15169	GOOGLEUS	false
173.194.219.97	unknown	United States	15169	GOOGLEUS	false
216.239.38.181	unknown	United States	15169	GOOGLEUS	false
173.194.219.99	unknown	United States	15169	GOOGLEUS	false
18.66.122.8	unknown	United States	3	MIT-GATEWAYSUS	false
8.8.8.8	unknown	United States	15169	GOOGLEUS	false
13.35.58.117	assets.freshsales.io	United States	16509	AMAZON-02US	false
142.250.181.238	unknown	United States	15169	GOOGLEUS	false
64.233.167.84	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.185.163	unknown	United States	15169	GOOGLEUS	false
18.66.122.128	fw-cdn.com	United States	3	MIT-GATEWAYSUS	false
142.250.186.142	unknown	United States	15169	GOOGLEUS	false
142.250.186.99	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1499537
Start date and time:	2024-08-27 07:26:12 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	http://constructivesoftware.com.au
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal56.win@19/59@36/210

Warnings

Exclude process from analysis (whitelisted): svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.163, 142.250.186.142, 64.233.167.84
Excluded domains from analysis (whitelisted): clients2.google.com, accounts.google.com, clientservices.googleapis.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information

LLM Input / Output

Input	Output
URL: https://td.doubleclick.net/td/ga/rul?tid=G-1EZS5MF5GX&gacid=1404008011.1724736437&gtm=45Pe48q0v9126913785za200&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=0&z=1710535996 Model: jbxai	{ "brand":["constructive"], "contains_trigger_text":false, "prominent_button_name":"unknown", "text_input_field_labels":["unknown"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

Input

Output

URL: https://td.doubleclick.net/td/ga/rul?tid=G-1EZS5MF5GX&gacid=1404008011.1724736437&gtm=45Pe48q0v9126913785za200&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=0&z=1710535996 Model: jbxai

{
"brand":["constructive"],
"contains_trigger_text":false,
"prominent_button_name":"unknown",
"text_input_field_labels":["unknown"],
"pdf_icon_visible":false,
"has_visible_captcha":false,
"has_urgent_text":false,
"has_visible_qrcode":false}

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Aug 27 04:26:44 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9854180157220642
Encrypted:	false
SSDEEP:
MD5:	5BEF8BB7614580CEA18807DE25407E71
SHA1:	D156AEA7A0DA6D246865A6BD39712744CC94A074
SHA-256:	53A0339D4CDBCE960CF13BF682786319D92734588EAA0FD55653A2337A98F061
SHA-512:	603D73A4D286E3223CC6D5EBA2484DA704535C8E9D6AEA07AEBFB5B41AE947D67C258CB219EFC6C65D85908986C8F8D894D48E0BC853360F93947CE2B24AB66D
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....e.A...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.YM+....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.YU+....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.YU+....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.YU+..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.YW+...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............>O.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.010066009072733
Encrypted:	false
SSDEEP:
MD5:	D86A003DE76B682D5001FB93B27ACFB6
SHA1:	851B864349859A97DF82F72D67E0F1A3A167907F
SHA-256:	132E57612E743F3E9C449FB6C4D2A17392268A72B24BB380FE6A51813E11E770
SHA-512:	EE27AA008E1B18962DBC1F9914BDA93F931D61E947EC1E61F16765FCC14433F1A4840EB0CAEB719EB2832B2656DF067D06EF54AFAC7556EF7C78042DE42F3327
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.YM+....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.YU+....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.YU+....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.YU+..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............>O.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 78196, version 331.-31261
Category:	downloaded
Size (bytes):	78196
Entropy (8bit):	7.997039463361104
Encrypted:	true
SSDEEP:
MD5:	E8A427E15CC502BEF99CFD722B37EA98
SHA1:	A9922842A120A7F1EACED667480C5E185A106D69
SHA-256:	D0B4256ABED72481585662971262EABEE345C19F837AF00D7CE24239D3B40EEF
SHA-512:	113775748A4166C07E58C26CF6DB7FED473732DC6124B8EE0F0DCC0D6439EB2AB2C5D9E01C67324FDF9DE4105349CF30CC5796A0B0E0CE9A08F337B9D4E10B7B
Malicious:	false
Reputation:	unknown
URL:	https://www.constructivesoftware.com.au/wp-content/plugins/elementor/assets/lib/font-awesome/webfonts/fa-solid-900.woff2
Preview:	wOF2......1t..........1..K......................?FFTM....`..N.....h..B.6.$..0..4.. ..+...[.u..p.(..U.d..{-.n.Pn...._=V2.e..vp.~........U..1...=..B..b....mvS....w.C.+.$...(..MMI.iH}..O...4.7.s...Y.)......}..^...{^...R.z....f..h4dD7.:1...Cj..l.8M..T...]}.]?Z..v....g.yV...^..\.?.wM\|......Ws..yf%..PL.....~.z.w.S.uQw..........EY.!.........j.O.....c...>T\|....W...Zk...9.......XJ...../I`x.R....c.h..w...?tm..l...LQ......hMg...x...1.F...cU.b\|.3....v.Kr.f.H ..9 @....... ......'..j...Vq.:.Q..+....._..(...J.....~../..Y<."......GB..:..P.B...7q...K.{...F"..3....6?.C,..B..P.V.......C.C..\....+....a...X.z..Tzdn.P.M....li...l2);.!..wX..xh.o.u!.........O.......Ew.$b7X..8d..H...s...z#d..&...J.G...Q.M.....rV?.....&....#...t]........+..............v...$X.P............ h.z.{...../F.-Y..!.a.1...&.;.^^.U.U.E....!O......./+~.........Q.\|.n@.W..P.tc.l.--....]6..........u..[.SN....i....4-......"...fC...`........@.......l=..g...-..C8...B.X.........g.~..p.1%..x.A.X..

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 173x115, components 3
Category:	dropped
Size (bytes):	8743
Entropy (8bit):	7.911050792243728
Encrypted:	false
SSDEEP:
MD5:	120C1E776CE370FDCC1069549266DEA7
SHA1:	D222DB9D56857C19B19725F4BB79D5D50282CACD
SHA-256:	5C43ED0983AEB2B19F644B25A944B67486F654AC04A7AAFFB553F3503702B69F
SHA-512:	A7670B45D92B02774F89CC934172B7D3015F8D6D7DA8AF0ED2A960CCC0B08E5D012660AF6CABF33F5232297AFD6866E37E4FE9C36E6B9AF87FA1BCC8689D3930
Malicious:	false
Reputation:	unknown
Preview:	......Exif..II*.................Ducky.......Q.....-http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.dabacbb, 2021/04/14-00:39:44 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.5 (Windows)" xmpMM:InstanceID="xmp.iid:9905A60AF87E11ED9CE8826D1907DB28" xmpMM:DocumentID="xmp.did:9905A60BF87E11ED9CE8826D1907DB28"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:9905A608F87E11ED9CE8826D1907DB28" stRef:documentID="xmp.did:9905A609F87E11ED9CE8826D1907DB28"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d...............................................................................................................................

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 111339
Category:	dropped
Size (bytes):	38103
Entropy (8bit):	7.993754126979023
Encrypted:	true
SSDEEP:
MD5:	A1853CE1EEBA5445E8129D1B503DF39D
SHA1:	7BC3BC398D0EF1B80D9048CE8FBB8E11248B1031
SHA-256:	207D7CE11B2EA8405656CBBB8E6EB5E4C4148EB79CA55E55850886839F937B8C
SHA-512:	69ECE16614AB40B2487D9BF65E9652ADB3AD685FCA863186DBFA35D3BDE0EF88EA8CFCED0FDA4F7A17B18FA8088E1F335BE3472FA720257ADBD5C5FB9226A004
Malicious:	false
Reputation:	unknown
Preview:	.............v.6.0..Oa...Y.d...9M.J+.!.t...t...,Z.l.$R!)...o...H...... )W..sn....b....>}.;:~t.....;.2.N..tS...^..<..h..p.e..jS.....e..\|}....l...Ty.&......Z..Kz.k.~.,.....Uu..Fe_.9~.o.ER.yv.d..R..<."..VyA5.V+..jq.e.5.9.....U:WY.:......[,.<.T\|.x.x<.}4.=~;..x....W.G.r.....Ut.lKu\B..Up.........\|y....:99.b.n7yQ...V..".o..&.4..Eq.jt...^]$.....8S7./."/.@.S.~..Lxr\|.f.(s.VWpg....BU.";.V.}L..0..[..Z.=._.`.?qu....N..LNg.............v)R..K.t...r.T.w..[.f8OV+.`g.X.9.J6..].MBAQB..my%...>.[hs+..b%.........n.......QEu'.r^...%7........~..Q....v}..z..0...-..K...:..z/.;Z8..UO.JJ..^..X;."..=V..F.,.....(.......G...;\<.E..b.Ha9.Lf..:.......Ja.aP.........$... .8N...(Le5-f..-...oK....Qtr..K.H..lx.........."..&)..........y...h..L.D.. nm<..u..d;].8....b.~..s+..s...>.a.....riEo..~.}.j.....TvY].0u..C..........%..AR...t.Wh.?.tU..K...t...c\....%y3..'.....6......g\|#...HT...R....S.%....`Y;7.^..p...&x5U}.....l...a.T...W%...p..KEU..N..P5..!.k..pT..*._u..f.o.BB..d.U...=....&l.?

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (59158)
Category:	downloaded
Size (bytes):	59344
Entropy (8bit):	4.717040228413791
Encrypted:	false
SSDEEP:
MD5:	74BAB4578692993514E7F882CC15C218
SHA1:	B6293BCFD851F963EDBE859498570C4C0C7EAAE4
SHA-256:	D87DDF917B7A1449AB45E2B8E3C98354629BDD65B6659C37E6023BBEA1CE1386
SHA-512:	8810579BC7D6F74FA7B8B7122A56E6ACF70B6B4393F76C4ED4122C67ECB00D6642BEAB1681C715DE0168441BF4CFEF1D2C9832007221477E5565CDA833F808D7
Malicious:	false
Reputation:	unknown
URL:	https://www.constructivesoftware.com.au/wp-content/plugins/elementor/assets/lib/font-awesome/css/all.min.css?ver=3.10.1
Preview:	/!. Font Awesome Free 5.15.3 by @fontawesome - https://fontawesome.com. * License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License). */..fa,.fab,.fad,.fal,.far,.fas{-moz-osx-font-smoothing:grayscale;-webkit-font-smoothing:antialiased;display:inline-block;font-style:normal;font-variant:normal;text-rendering:auto;line-height:1}.fa-lg{font-size:1.33333em;line-height:.75em;vertical-align:-.0667em}.fa-xs{font-size:.75em}.fa-sm{font-size:.875em}.fa-1x{font-size:1em}.fa-2x{font-size:2em}.fa-3x{font-size:3em}.fa-4x{font-size:4em}.fa-5x{font-size:5em}.fa-6x{font-size:6em}.fa-7x{font-size:7em}.fa-8x{font-size:8em}.fa-9x{font-size:9em}.fa-10x{font-size:10em}.fa-fw{text-align:center;width:1.25em}.fa-ul{list-style-type:none;margin-left:2.5em;padding-left:0}.fa-ul>li{position:relative}.fa-li{left:-2em;position:absolute;text-align:center;width:2em;line-height:inherit}.fa-border{border:.08em solid #eee;border-radius:.1em;padding:.2em .25em .15em}.fa-pu

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 173x115, components 3
Category:	downloaded
Size (bytes):	8637
Entropy (8bit):	7.903163429607823
Encrypted:	false
SSDEEP:
MD5:	52FA0CFC33FE17092C8664060C5770D1
SHA1:	D31AD8E4B40872F32D789729EA9D29E12A96A893
SHA-256:	2214D786AE659BB13242EACCBF2ED55F41E9D2B2946767D3CF0BE03DF53CC925
SHA-512:	85D2969D7A1BFB03016FE95D252180E3FC8B8928990BA25A09522B4C6C751F324A9E3591BD705C220C7F79DBEEE9820333C3DC95543DB2CD7E7B175A29A74C84
Malicious:	false
Reputation:	unknown
URL:	https://www.constructivesoftware.com.au/wp-content/uploads/2023/05/client-kingswood.jpg
Preview:	......Exif..II*.................Ducky.......Q.....-http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.dabacbb, 2021/04/14-00:39:44 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.5 (Windows)" xmpMM:InstanceID="xmp.iid:396A7291F87E11EDBFCBBB2ED4390E71" xmpMM:DocumentID="xmp.did:396A7292F87E11EDBFCBBB2ED4390E71"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:396A728FF87E11EDBFCBBB2ED4390E71" stRef:documentID="xmp.did:396A7290F87E11EDBFCBBB2ED4390E71"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d...............................................................................................................................

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (30837)
Category:	downloaded
Size (bytes):	30999
Entropy (8bit):	4.745873351091104
Encrypted:	false
SSDEEP:
MD5:	008E0BB5EBFA7BC298A042F95944DF25
SHA1:	93897EBC560B38A1D2BFF43C22DD6A3B7EE90C0C
SHA-256:	C4047043368AFB4BAF1AED25D358A5C2A333842A3B436B58491AB36AEEE65B9D
SHA-512:	3F43F1A813B8188E7F8D296999491F99AFF9010060F3E26B20EC32502FA76926361EDA0644CDD20995661119206376C74516EA2A63EC4087FE88443AA3304022
Malicious:	false
Reputation:	unknown
URL:	https://www.constructivesoftware.com.au/wp-content/plugins/elementor/assets/lib/font-awesome/css/font-awesome.min.css?ver=4.7.0
Preview:	/!. Font Awesome 4.7.0 by @davegandy - http://fontawesome.io - @fontawesome. * License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License). */@font-face{font-family:'FontAwesome';src:url('../fonts/fontawesome-webfont.eot?v=4.7.0');src:url('../fonts/fontawesome-webfont.eot?#iefix&v=4.7.0') format('embedded-opentype'),url('../fonts/fontawesome-webfont.woff2?v=4.7.0') format('woff2'),url('../fonts/fontawesome-webfont.woff?v=4.7.0') format('woff'),url('../fonts/fontawesome-webfont.ttf?v=4.7.0') format('truetype'),url('../fonts/fontawesome-webfont.svg?v=4.7.0#fontawesomeregular') format('svg');font-weight:normal;font-style:normal}.fa{display:inline-block;font:normal normal normal 14px/1 FontAwesome;font-size:inherit;text-rendering:auto;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale}.fa-lg{font-size:1.33333333em;line-height:.75em;vertical-align:-15%}.fa-2x{font-size:2em}.fa-3x{font-size:3em}.fa-4x{font-size:4em}.fa-5x{font-size:5em}.fa-fw{width:1.

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1200 x 800, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	151647
Entropy (8bit):	7.985645370207524
Encrypted:	false
SSDEEP:
MD5:	C40E24875BCD404D963EA0E7237E8342
SHA1:	E570A5D60C4C5B0245019BC99ECEA46A062FE52F
SHA-256:	314DA31BE740E7DEF4CE7001E1B04018720361A438A07A88434EFB5CD5E34443
SHA-512:	2D04C34D3C77A3F58E96EE5F2BABA6396D2A6B1665AAA0C80EFDC81B2D8E5E71FA59D69437FF4305BCDAFA79EEADFADB82D8AB60892AAB768D60AC825C97058C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR....... ......>k0....PLTE..........................................................................................}}}...................................................................H\|.....xyw*,............,/:.Dy"..NU.36A...YXS...TZ.{.....GGH213...JQ..-0...kgc(7dfd...$$&...@;8!!#9<G!R....(!.Y`.AAB...............QZ.}}y879...-...#..........`\X..............-$.<?Jgb^3) <<>LQR....#!...8-&F...'DL.yto...%2.lmhLt.S#.......]j-&1.2`.Zabdk0KUAnrp<F.-9....0.J'2"R[KF;)uoi/:*...:..IR.a).o0.6@8AK<,:7...NC.?4$...]eR5@%@MO...>G....\|;._h.Ye-6ECEO0iW=VJ2x..p{.bjo@0.{.._Q8.....WNIKX\}.jLV$....~.D"PF>.....6A..yu.7nhoYH:5cs{......QZ4\dA>e.qbB;4-yXA....gLz..gF2G).go8......ovG...q.....uW8'...f{.Sgo.........!x7a..}.W.{Y...J._..imz..kK.....l(e.a..@..q.....DPyp..n...,tRNS..(..:.[;..{...+.`..........J./h.....x.$.8.8x....M.IDATx.........................................................................`..........n......................"w@.'...]....8....4R.y.:.A..s#..3...BB...L.

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (483)
Category:	downloaded
Size (bytes):	669
Entropy (8bit):	5.102774065720726
Encrypted:	false
SSDEEP:
MD5:	9EB2D3C87FEB6BB2FFA63B70532B1477
SHA1:	38F226335A05AB0E30497BC7419EB5E243A9E26C
SHA-256:	37BAB6CD583982E8EFF58501A99D7C5C4D63664C1CA34F9E3B7CF526C5B73AE2
SHA-512:	8D0AB38F6BC757103FC82A234FCA5566328639EF549A862F9CEB8CFF6B10D75D2FC626A3054FB85A4C91B3538332677801F9EDC14115E09F957CCE8391F8CB46
Malicious:	false
Reputation:	unknown
URL:	https://www.constructivesoftware.com.au/wp-content/plugins/elementor/assets/lib/font-awesome/css/solid.min.css?ver=5.15.3
Preview:	/!. Font Awesome Free 5.15.3 by @fontawesome - https://fontawesome.com. * License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License). */.@font-face{font-family:"Font Awesome 5 Free";font-style:normal;font-weight:900;font-display:block;src:url(../webfonts/fa-solid-900.eot);src:url(../webfonts/fa-solid-900.eot?#iefix) format("embedded-opentype"),url(../webfonts/fa-solid-900.woff2) format("woff2"),url(../webfonts/fa-solid-900.woff) format("woff"),url(../webfonts/fa-solid-900.ttf) format("truetype"),url(../webfonts/fa-solid-900.svg#fontawesome) format("svg")}.fa,.fas{font-family:"Font Awesome 5 Free";font-weight:900}

Chrome Cache Entry: 114

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	361
Entropy (8bit):	4.281891956828539
Encrypted:	false
SSDEEP:
MD5:	D50F942D17DE1170BBD017CD25DA74C4
SHA1:	36702F87B3EA5737AFC2288A2F693FE4CEC9B5DE
SHA-256:	B17FB67214E0B38D727FD0762243FA48965697166FED086B13779EC7955AE92B
SHA-512:	C61DDFB6B0C5FE0A5C9712498877D8F9914B74F8210CB4D8D08B708E94721B0D58C6075D9E2B027185063B5D18ABF6818808C42202A1EF36B00B4DCC9F44C133
Malicious:	false
Reputation:	unknown
URL:	https://www.constructivesoftware.com.au/wp-content/themes/stratusx-child/style.css?ver=6.6.1
Preview:	/.Theme Name: Stratus - Child Theme.Theme URI: http://themovation.com/stratus.Template: stratusx.Author: Themovation.Author URI: http://themovation.com.Version: 4.0.Text Domain: stratus.Domain Path: /languages/./.../* = Theme customization starts here.-------------------------------------------------------------- */..

Chrome Cache Entry: 116

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format, TrueType, length 17452, version 1.1
Category:	downloaded
Size (bytes):	17452
Entropy (8bit):	7.975368453966958
Encrypted:	false
SSDEEP:
MD5:	3E04694C1313D375108B37AB50B21B68
SHA1:	70A33CCEBE9B4300FF6E0B3887264F8D4B34AD43
SHA-256:	F55ABC76E10CC86D799A7189E64E3C6E4CC6CED19B2474B1852A808BE46232A8
SHA-512:	FAA3BEBF4781B0EF0AAB8023906F322C87C191B3E843A2CE64DDDA0BF0177703CF9D68A7CEADDBC5E1668FB5231C11B9B29415D2D4884D3CA05F738E1DF1AF7C
Malicious:	false
Reputation:	unknown
URL:	https://www.constructivesoftware.com.au/wp-content/fonts/lato/S6uyw4BMUTPHjx4wWCWtFCc.woff
Preview:	wOFF......D,......nP........................GPOS...0.......zqt..GSUB.......T...p.<.zOS/2...P...Z...`y$aycmap...............gasp...8............glyf...D..1...N.lk.head..= ...6...6...#hhea..=X.......$...whmtx..=x.......v}.O7loca..?.........x.e.maxp..AH....... ....name..Ad........6.S.post..B........EW..xx.T..l%..E... X.k.m.m.7X....q.X...e........#GO.I...vn..2@ ..P...U...........x...&V....0V..z.>Z...G...........G...T..9...S....^J....^......"T..E...X.........j.q..s....>.O...:.^K.........N.e..@..*:.&.6-hIk..Nt....AOz....?... .3...b,..d.2...`........lb.[..Nv.......9.INq.3..:7..m.p..<...y.S....5ox.{>.O\|.+....~..bH .$.I!.4.. .l.0......N@.J.8..@S....n.6......MbS.`.+eI.$..n.e..(..f...Q.@./.l..s)..A.C.u<.aXJ)..rC....6..@`.?....w...y.P.u....{.Z...~..0.6_.E...#...1.'j.!F.r)...Z.h N..^..'...,:..2+...:.l..6).d.w...g......f.Y.g..=../.j...8.,.........l.M.4...P@!E.oC.f.6..........'..<.H9/..NE3.....C....>T)W...5.k.&y.q.6m$.c.....3.v(..F=.F..[O.m..A.....C.\.g

Chrome Cache Entry: 117

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (413), with no line terminators
Category:	downloaded
Size (bytes):	413
Entropy (8bit):	4.388084632528324
Encrypted:	false
SSDEEP:
MD5:	CB17D4E4C3FD00800B0F561B8A057149
SHA1:	638201B94E04BD2082788A774DDE22696AD7402E
SHA-256:	5ECB54F91384AF7226CB4F18F87588EDD49CEFF5BDD4A3010336E1C22CCC390D
SHA-512:	E297C755125BC5F41927C53C22B676ECEBD0A96F41DD1998C85DC90AE1CCE1082EA6CF207146FCBA49CC56A0B86270EBF0DF38CFF31CC68078ED1842A11F7293
Malicious:	false
Reputation:	unknown
URL:	https://www.constructivesoftware.com.au/wp-content/plugins/elementor/assets/css/modules/lazyload/frontend.min.css?ver=3.10.1
Preview:	.lazyloaded:not(.elementor-motion-effects-element-type-background),.lazyloaded>.elementor-motion-effects-container>.elementor-motion-effects-layer,.lazyloaded>[class*=-wrap]>.elementor-motion-effects-container>.elementor-motion-effects-layer,body.e-lazyload .e-con.lazyloaded:before,body.e-lazyload .lazyloaded,body.e-lazyload .lazyloaded .elementor-background-overlay{--e-bg-lazyload-loaded:var(--e-bg-lazyload)}

Chrome Cache Entry: 118

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (49823)
Category:	downloaded
Size (bytes):	49923
Entropy (8bit):	4.970288279459143
Encrypted:	false
SSDEEP:
MD5:	CF2106460E13C7308B1BA2FD51A048C0
SHA1:	13AE56C27BD7B4875038B0E4BE0DC92AA367AB76
SHA-256:	ACA485F03404C4C4007B08C8937F83A03CCCC955C3F38D2361297500D6F02D55
SHA-512:	8C2A6017A3C3ED8035755B030586C67DA375B61C6CCA253FF28AD5D896F5CD7CAAC8F14D5224C38F1208FFCACD93FD1F06385604421784CFAA58CFDE4D2929FF
Malicious:	false
Reputation:	unknown
URL:	https://www.constructivesoftware.com.au/wp-content/plugins/formidable/css/formidableforms.css?ver=716150
Preview:	/* WARNING: Any changes made to this file will be lost when your Formidable settings are updated */..with_frm_style{--form-width:100%;--form-align:left;--direction:ltr;--fieldset:0px;--fieldset-color:#000000;--fieldset-padding:0 0 15px 0;--fieldset-bg-color:transparent;--title-size:40px;--title-color:#444444;--title-margin-top:10px;--title-margin-bottom:60px;--form-desc-size:14px;--form-desc-color:#666666;--form-desc-margin-top:10px;--form-desc-margin-bottom:25px;--form-desc-padding:0;--font-size:15px;--label-color:#3f4b5b;--weight:normal;--position:none;--align:left;--width:150px;--required-color:#B94A48;--required-weight:bold;--label-padding:0 0 3px 0;--description-font-size:12px;--description-color:#666666;--description-weight:normal;--description-style:normal;--description-align:left;--description-margin:0;--field-font-size:14px;--field-height:32px;--line-height:32px;--field-width:100%;--auto-width:100%;--field-pad:6px 10px;--field-margin:20px;--field-weight:normal;--text-color:#55

Chrome Cache Entry: 120

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (64824)
Category:	downloaded
Size (bytes):	290506
Entropy (8bit):	5.12510889239091
Encrypted:	false
SSDEEP:
MD5:	70206BA80307CB65BF1C07FF5C80F97D
SHA1:	E383662053007B7F5532F97A6BBD68B0A88D4F13
SHA-256:	27D83D036E0DA52CBC99818F3B60E5D96C9D127F2D35894995B5E2AA8741BF20
SHA-512:	B0300C59F8E6EDD762221BF8FF06C27C4C3A13B3BEF7E00C02CD99165FC460F4C0FC80CD855E966BE9F81044734976261D13A73B7B813B85A58B19A4BFCEE46A
Malicious:	false
Reputation:	unknown
URL:	https://www.constructivesoftware.com.au/wp-content/themes/stratusx/assets/css/app.css?ver=1
Preview:	./..Contents..- Vendor.- Base.- Header.- General.- Primary Content.- Preloader.- Audio, Video, Media.- Typography.- Buttons.- Forms.- Blog.- Portfolio Grid.- Booked Plugin.- WooCommerce Plugin.- Widgets (Alphabetical).- Sidebar.- Footer.- Shortcodes.- Scroll Up.- Headhesive.- Animation Adjustments.- Navigation & Header Additions.- Groovy Menu.- Misc.- Media Queries../..../* ==========================================================================. Vendor. ========================================================================== /../!.* Bootstrap v3.1.1 (http://getbootstrap.com).* Copyright 2011-2014 Twitter, Inc..* Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE)./../! normalize.css v3.0.0 \| MIT License \| git.io/normalize */html{font-family:sans-serif;-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}body{margin:0}article,aside,details,figcaption,figure,footer,header,hgroup,main,nav,section,summary{display:block}audio,canvas,progress,video{di

Chrome Cache Entry: 121

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	assembler source, Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	78008
Entropy (8bit):	5.0141548787819
Encrypted:	false
SSDEEP:
MD5:	13B3BC4AA0B47C0A8E6890CB327A1324
SHA1:	89C6299EDB3E20AF8957B694F4439FF85078D828
SHA-256:	225A9DA24E4AB81B00141036B3DA481F082398091509D5BAEA4AA3E8B588857C
SHA-512:	9D111612EEE5A760A6D2285C3D19D9EE5800C34A37A154E4F9DE57A3E91E17D6A0FC3E7951BF2EA1E80E390029AE2A5CC40C80F51CD4004DF3515A2680DA47C1
Malicious:	false
Reputation:	unknown
URL:	https://www.constructivesoftware.com.au/wp-content/plugins/groovy-menu/assets/style/frontend.css?ver=2.6.3
Preview:	@charset "UTF-8";./* rtl:begin:ignore */..gm-badge {. overflow: hidden;. line-height: 1; }. .gm-badge > span {. display: flex;. align-items: center;. justify-content: center;. text-transform: none;. white-space: nowrap; }...gm-thumb-menu-item-wrapper {. width: 100%; }. .gm-thumb-menu-item-wrapper .gm-thumb-menu-item {. max-height: inherit;. max-width: inherit; }...gm-navbar--has-shadow-sticky.gm-navbar-sticky-toggle .gm-inner {. box-shadow: 0 0 10px rgba(0, 0, 0, 0.1); }...gm-navbar-sticky.gm-navbar-sticky-toggle .gm-wrapper,..gm-navbar-fixed-sticky.gm-navbar-sticky-toggle .gm-wrapper {. position: fixed; }...gm-navbar-sticky.gm-navbar-sticky-toggle .gm-wrapper {. transition-property: transform;. transition-duration: 0.2s; }...gm-navbar.gm-navbar-fixed-sticky .gm-toolbar .gm-container,..gm-navbar.gm-navbar-sticky .gm-toolbar .gm-container {. transition: all 0.2s ease-out; }...gm-navbar.gm-navbar-fixed-sticky.gm-navbar-sticky-toggle .gm-toolbar .gm-containe

Chrome Cache Entry: 123

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (14869)
Category:	dropped
Size (bytes):	15055
Entropy (8bit):	4.548869590540711
Encrypted:	false
SSDEEP:
MD5:	7A5DEA0A705CC2F4CD87DBAAA6666BC6
SHA1:	678BC6F750F13ADB29BBC158EB0D9CD813B736FA
SHA-256:	97CF1307C16A437B77B5F7F5C9BC0B985D0745A14BE5A279019ACA5A3432E264
SHA-512:	7C19D0EDC28FE8733075534DE6176483416BB3535F37B7607536AEA2DDF9C5591D864225049C9A74735C1DAF44C72688D91C1133BB018683ADE11F16EA596807
Malicious:	false
Reputation:	unknown
Preview:	/!. Font Awesome Free 5.15.1 by @fontawesome - https://fontawesome.com. * License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License). */.var l,a;l=this,a=function(){"use strict";var l={},a={};try{"undefined"!=typeof window&&(l=window),"undefined"!=typeof document&&(a=document)}catch(l){}var e=(l.navigator\|\|{}).userAgent,r=void 0===e?"":e,n=l,o=a,u=(n.document,!!o.documentElement&&!!o.head&&"function"==typeof o.addEventListener&&o.createElement,~r.indexOf("MSIE")\|\|r.indexOf("Trident/"),"___FONT_AWESOME___"),t=function(){try{return"production"===process.env.NODE_ENV}catch(l){return!1}}();var f=n\|\|{};f[u]\|\|(f[u]={}),f[u].styles\|\|(f[u].styles={}),f[u].hooks\|\|(f[u].hooks={}),f[u].shims\|\|(f[u].shims=[]);var i=f[u],s=[["glass",null,"glass-martini"],["meetup","fab",null],["star-o","far","star"],["remove",null,"times"],["close",null,"times"],["gear",null,"cog"],["trash-o","far","trash-alt"],["file-o","far","file"],["clock-o","far","clock"],["arro

Chrome Cache Entry: 125

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (10019)
Category:	downloaded
Size (bytes):	18468
Entropy (8bit):	4.942984129844562
Encrypted:	false
SSDEEP:
MD5:	4601BA55044413706C2022CB6C1C3D05
SHA1:	5103EC2FBB389568EBF5CFE4FD721F3DF2FF7AEC
SHA-256:	FE513EF974B767510D0A2B9F1B4D3AFA53185B89AB617C869E5E3D6DB960192C
SHA-512:	8DAB2D19378E34B40043621AAC57B418E56486DCFEBD1A5991BE8A02EE6B071D07EC6BFD9408DEA8FF0198995DE9D42A46E66513D68B40B68056707E4E691E01
Malicious:	false
Reputation:	unknown
URL:	https://www.constructivesoftware.com.au/wp-content/plugins/elementor/assets/lib/animations/animations.min.css?ver=3.10.1
Preview:	@keyframes bounce{20%,53%,80%,from,to{animation-timing-function:cubic-bezier(.215,.61,.355,1);transform:translate3d(0,0,0)}40%,43%{animation-timing-function:cubic-bezier(.755,.050,.855,.060);transform:translate3d(0,-30px,0)}70%{animation-timing-function:cubic-bezier(.755,.050,.855,.060);transform:translate3d(0,-15px,0)}90%{transform:translate3d(0,-4px,0)}}.bounce{animation-name:bounce;transform-origin:center bottom}@keyframes flash{50%,from,to{opacity:1}25%,75%{opacity:0}}.flash{animation-name:flash}@keyframes pulse{from,to{transform:scale3d(1,1,1)}50%{transform:scale3d(1.05,1.05,1.05)}}.pulse{animation-name:pulse}@keyframes rubberBand{from,to{transform:scale3d(1,1,1)}30%{transform:scale3d(1.25,.75,1)}40%{transform:scale3d(.75,1.25,1)}50%{transform:scale3d(1.15,.85,1)}65%{transform:scale3d(.95,1.05,1)}75%{transform:scale3d(1.05,.95,1)}}.rubberBand{animation-name:rubberBand}@keyframes shake{from,to{transform:translate3d(0,0,0)}10%,30%,50%,70%,90%{transform:translate3d(-10px,0,0)}20%,40%

Chrome Cache Entry: 127

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	dropped
Size (bytes):	87553
Entropy (8bit):	5.262620498676155
Encrypted:	false
SSDEEP:
MD5:	826EB77E86B02AB7724FE3D0141FF87C
SHA1:	79CD3587D565AFE290076A8D36C31C305A573D18
SHA-256:	CB6F2D32C49D1C2B25E9FFC9AAAFA3F83075346C01BCD4AE6EB187392A4292CF
SHA-512:	FC79FDB76763025DC39FAC045A215FF155EF2F492A0E9640079D6F089FA6218AF2B3AB7C6EAF636827DEE9294E6939A95AB24554E870C976679C25567AD6374C
Malicious:	false
Reputation:	unknown
Preview:	/! jQuery v3.7.1 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(ie,e){"use strict";var oe=[],r=Object.getPrototypeOf,ae=oe.slice,g=oe.flat?function(e){return oe.flat.call(e)}:function(e){return oe.concat.apply([],e)},s=oe.push,se=oe.indexOf,n={},i=n.toString,ue=n.hasOwnProperty,o=ue.toString,a=o.call(Object),le={},v=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},y=function(e){return null!=e&&e===e.window},C=ie.document,u={type:!0,src:!0,nonce:!0,noModule:!0};function m(e,t,n){var r,i,o=(n=n\|\|C).createElement("script");if(o.text=e,t)for(r in u)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.remove

Chrome Cache Entry: 128

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (800)
Category:	downloaded
Size (bytes):	805
Entropy (8bit):	5.172123707460438
Encrypted:	false
SSDEEP:
MD5:	89CBB2613853D1C9BA8D2A78839553BB
SHA1:	94ABC8F9EF4295D6118FC4CE7912A7207884E37B
SHA-256:	209894707910FC49553462E575F31F83A490C102CEB750201694F1E9235D4310
SHA-512:	365C68F5AF0B7F4DA0EE9172B4B1755A16FB38F78C057232240115A32B051F1E5A4AF061295B9D1E19739A6EDBC991774E966BB6022515ED2166B3469F0FEBFC
Malicious:	false
Reputation:	unknown
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["chick fil banana pudding milkshake","grand canyon flash flooding","wordle today august 26","mauricio dubon injury update","apple iphone 16 pro max","lisbon portugal earthquake today","florida state parks golf courses","le bruun coin collection"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 129

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format, TrueType, length 17624, version 1.1
Category:	downloaded
Size (bytes):	17624
Entropy (8bit):	7.975882797762389
Encrypted:	false
SSDEEP:
MD5:	31F05B7A6500633996B4A2C2EA136237
SHA1:	A9C3BFF8BBFCCB6BF598FD0FA0A8B04F0F26B6BF
SHA-256:	98149DD994189AF57B3867D308874C7ACB05EDD3351663CCCA860B87044479DB
SHA-512:	3C5A783F75AC0133E078006247C81DC363715E7F9B5DD41DCA27D01728C77478D5BF6B095CDBA0657D39E26FD9FEDC5E20B22ECBED1EA7DFE2EDAD20605ED38A
Malicious:	false
Reputation:	unknown
URL:	https://www.constructivesoftware.com.au/wp-content/fonts/lato/S6u9w4BMUTPHh6UVSwiPHw3q5d0.woff
Preview:	wOFF......D.......o0........................GPOS...0...g...B....GSUB.......T...p.<.zOS/2.......Z...`z]d.cmap...H...........gasp................glyf......1...N...,head..=....6...6...Ghhea..>........$....hmtx..>$.......v..BWloca..@<........}.k.maxp..A........ ....name..B........3.P.post..C@.......EW...x.L..n.Q...yk.,.".m.m.1z..{.^.FP.u..};.\|..........5D......F..?.ID...\| ...P@...o..G...<I.<On.[s..5............[..b...8..5..j.3.=.._.aA.k8.7R.5q.U.x..".jn..+..[S...Y?.....c.S_d...a".D......../.J].....;.T\...%.$RH%.lr..B.(..2...*....&.i..Nz....f..&.b.M..f.=.8... x.q.....g...ldf0.6>..CG.].t..[..={...O_....._@PHXDTLBRJZVN^AQIESK[.............:...:..\|....u...34...vh#....:...2.8....RJQQD;....R...f1..P.<}.Y..+<....%..B[vZv....a.......s..e....OC..\...R...C....^..g.A&..F.>...9..U.n.%O^@E.PI......^..g.A.]_b..V..g.u.l.I....8...W...)..a.9.Y...y...TQM..,.......:.6.$I...E69Qo.A.Bkx'..A......9..9.g....B.g..C.x%.....\\|M].{~.u.=..mZ.dK.6{.}.8$....YdS.....b...Zi.

Chrome Cache Entry: 130

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (19277)
Category:	downloaded
Size (bytes):	19323
Entropy (8bit):	4.564375801560129
Encrypted:	false
SSDEEP:
MD5:	9EF46264D70F8D2F683A02D7884D414D
SHA1:	F6CEF797FBA728B7BBD150B8C9F18227F518E2D1
SHA-256:	D47E448996AFD78F0DEE27F6AD7CE7DE8D00CDAFD57B78071267649F35FC46DD
SHA-512:	30D84324365648BAEF5415FA57DC659B3B44D375EBBAA412F827209DB07ACFE80923455DF4793D9F999ED31BEBB1D8A8E989A18A9116877FA1A1F024969F624B
Malicious:	false
Reputation:	unknown
URL:	https://www.constructivesoftware.com.au/wp-content/plugins/elementor/assets/lib/eicons/css/elementor-icons.min.css?ver=5.17.0
Preview:	/! elementor-icons - v5.17.0 - 28-11-2022 /.@font-face{font-family:eicons;src:url(../fonts/eicons.eot?5.17.0);src:url(../fonts/eicons.eot?5.17.0#iefix) format("embedded-opentype"),url(../fonts/eicons.woff2?5.17.0) format("woff2"),url(../fonts/eicons.woff?5.17.0) format("woff"),url(../fonts/eicons.ttf?5.17.0) format("truetype"),url(../fonts/eicons.svg?5.17.0#eicon) format("svg");font-weight:400;font-style:normal}[class*=" eicon-"],[class^=eicon]{display:inline-block;font-family:eicons;font-size:inherit;font-weight:400;font-style:normal;font-variant:normal;line-height:1;text-rendering:auto;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale}@keyframes a{0%{transform:rotate(0deg)}to{transform:rotate(359deg)}}.eicon-animation-spin{animation:a 2s infinite linear}.eicon-editor-link:before{content:'\e800'}.eicon-editor-unlink:before{content:'\e801'}.eicon-editor-external-link:before{content:'\e802'}.eicon-editor-close:before{content:'\e803'}.eicon-editor-list-ol:before{cont

Chrome Cache Entry: 132

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65496)
Category:	downloaded
Size (bytes):	146877
Entropy (8bit):	4.774475528240743
Encrypted:	false
SSDEEP:
MD5:	39B6C639EE3097CB0D934F1CCDC16851
SHA1:	FCEE306E4C5DAE21C017CB48A9130B76864E4749
SHA-256:	F06CE878CC6F6FFDA8AB31093A9846DCE86798A8E64359E8FBDE826687B98A00
SHA-512:	2C3E5642EC8C1415B43C775964AA286F5843D3D99460D51A5A5D74EA09EC522181242F87950E78E8D1F10F3A03AAD4FADF8898E9C7B83C56F69ECD641BC48475
Malicious:	false
Reputation:	unknown
URL:	https://www.constructivesoftware.com.au/wp-content/plugins/elementor/assets/css/frontend.min.css?ver=3.10.1
Preview:	/! elementor - v3.10.1 - 17-01-2023 /.@charset "UTF-8";.dialog-widget-content{background-color:#fff;position:absolute;border-radius:3px;box-shadow:2px 8px 23px 3px rgba(0,0,0,.2);overflow:hidden}.dialog-message{font-size:12px;line-height:1.5;box-sizing:border-box}.dialog-type-lightbox{position:fixed;height:100%;width:100%;bottom:0;left:0;background-color:rgba(0,0,0,.8);z-index:9999;-webkit-user-select:none;-moz-user-select:none;user-select:none}.dialog-type-lightbox .dialog-widget-content{margin:auto;width:375px}.dialog-type-lightbox .dialog-header{font-size:15px;color:#495157;padding:30px 0 10px;font-weight:500}.dialog-type-lightbox .dialog-message{padding:0 30px 30px;min-height:50px}.dialog-type-lightbox:not(.elementor-popup-modal) .dialog-header,.dialog-type-lightbox:not(.elementor-popup-modal) .dialog-message{text-align:center}.dialog-type-lightbox .dialog-buttons-wrapper{border-top:1px solid #e6e9ec;text-align:center}.dialog-type-lightbox .dialog-buttons-wrapper>.dialog-button{f

Chrome Cache Entry: 133

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1024 x 682, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	160789
Entropy (8bit):	7.932207749220941
Encrypted:	false
SSDEEP:
MD5:	500912604BDA49635FD1543641D7D6FA
SHA1:	224E4178B3588152B726CFC688AFF0EDCBD967F2
SHA-256:	BECF16965A7391792FA77C043EAE22E3ACB968E75705F620E85A7852EDAEF0C0
SHA-512:	D3A7E39CAA77E4128BB08230A73C14EE1BFBA2117BF98F620ECE315260E1AF5DF4AB86A34A03E5270B25353178177ABCCE779C121EE6168B120648803C2F4DAA
Malicious:	false
Reputation:	unknown
URL:	https://www.constructivesoftware.com.au/wp-content/uploads/2023/07/home-3d-multidevice.png
Preview:	.PNG........IHDR.....................PLTE..................................................................................................................tsv...\\^......jjl87:a`d......................."b.................................DDEIIJ........mu)...iqdMMN??@;::...RRS9t....rx)...,j.555....hr-.....kr&...nx/)'0/0.............\|w...$#![VQen'..........x.....uPG>...............JB9..{v\|,\|xq...C<5...WMF."!qdTjiij]L......~WWX<5/fff............bVK...\\]...nmn..._TBuoj.......+&t~3.Z.4-(a`a..._i(......{mW..qWM=......P2%#1..K.oyjtwu8D..~.:#...+:6{.D...\|.1.....3B>..na8-IV;>K7`j\S_CETN:KHm@2EQ'WbRH&...\|H\|.gr8)4.\|.m.x`x; .K(..^jF.E'K\YhsR..y.......r:H....bl.u.[8..S`-v..b/...L..u...Q^..aK...r}D...{c.U,Tfd.nWwS?Z..._4...^ppn.........^...\|.....e\|...]z......1.....M.k...i?2.R..s.?.R.....3tRNS.......-.#*0..9@9VfKaG.kwX..Tr~z}t....i.....u.....&....p.IDATx..=..@...$.D@..H..fu.]C......h........l....Y+.W#.ebbbbbbbbbbb.........._.. ..^&...-.lBm.?j...c.t.........r~

Chrome Cache Entry: 134

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	troff or preprocessor input, Unicode text, UTF-8 text, with very long lines (372)
Category:	downloaded
Size (bytes):	36273
Entropy (8bit):	4.88832534095585
Encrypted:	false
SSDEEP:
MD5:	D04B1CF6AC5B54772C5465C0600EA77D
SHA1:	3462C6F792847D950F22878729D7191D66FFABDC
SHA-256:	6DC4D2FF233255C8A11048EB95600D21E390D204B460953F487B031350192283
SHA-512:	93D2E0F4681945BFE65ACA640A8DB5E76236D0C1C5321BA707986820F4890FB9B41795A6E6B781ADF10A958B0DF5827F065978EE881505AD4A6A635DE19ADDBF
Malicious:	false
Reputation:	unknown
URL:	https://www.constructivesoftware.com.au/wp-content/plugins/groovy-menu/assets/style/fontawesome.css?ver=2.6.3
Preview:	@charset "UTF-8";./!. Font Awesome 4.7.0 by @davegandy - http://fontawesome.io - @fontawesome. * License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License). /./ FONT PATH. * -------------------------- /.@font-face {. font-family: 'FontAwesome';. src: url("../fonts/fontawesome-webfont.eot?v=4.7.0");. src: url("../fonts/fontawesome-webfont.eot?#iefix&v=4.7.0") format("embedded-opentype"), url("../fonts/fontawesome-webfont.woff2?v=4.7.0") format("woff2"), url("../fonts/fontawesome-webfont.woff?v=4.7.0") format("woff"), url("../fonts/fontawesome-webfont.ttf?v=4.7.0") format("truetype"), url("../fonts/fontawesome-webfont.svg?v=4.7.0#fontawesomeregular") format("svg");. font-weight: normal;. font-style: normal; }...fa {. display: inline-block;. font: normal normal normal 14px/1 FontAwesome;. font-size: inherit;. text-rendering: auto;. -webkit-font-smoothing: antialiased;. -moz-osx-font-smoothing: grayscale; }../ makes the font 33% larger relative to the

Chrome Cache Entry: 136

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format, TrueType, length 1516, version 1.0
Category:	downloaded
Size (bytes):	1516
Entropy (8bit):	4.751990812601864
Encrypted:	false
SSDEEP:
MD5:	A7D4D795CA26E6A9A371D592B271C015
SHA1:	7006CB8199BFC6B76FCA27CC480B456518B8CC4B
SHA-256:	6153D00B79B60A4562A0DFDBBC6A46B042FE79E27978983D436EE575B05F3EB3
SHA-512:	DB19EB6F8A51AADE62C5B780E6ECB8E34EC98F41AD21BD7634970C82DBD2B1F4F2C26060C841347E9FB6B1FD6E4F63AB34A7F1A8BB723DB19CF60157EC85074C
Malicious:	false
Reputation:	unknown
URL:	https://www.constructivesoftware.com.au/wp-content/plugins/groovy-menu/assets/fonts/crane-font.woff?hhxb42
Preview:	wOFF........................................OS/2.......`...`...Rcmap...h...T...T.V.gasp................glyf............`...head...\|...6...6..V?hhea.......$...$....hmtx.............t..loca...............~maxp....... ... ...Wname... ........nZ.+post....... ... .......'.......................3...................................@.........@...@............... .................................8............. ........... ................................................79..................79..................79...........u.........".....!.!..!.3>.32..'"..3..#.2....#"&546!2....#"&546....?...@..?..kNOj..4E...E5..%%..%%.V.&&..%%...@.....@OqqO.L44L..&..%%..&&..%%..&.............,.T...2................#"&/...#0"9."'..'&5147>.763.......38.9.27>.7654'..'&#8.1"......8.9...XMMr!!$!...D.......2{C.WNMs!!!!sMNW....R77?>77R....R77>?77R....!!rMMWAv2....D.....$("!sMMXWMMr!!.Y?77R....R77?>77R....R77>.............K._.<...........................................................................................

Chrome Cache Entry: 140

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 173x115, components 3
Category:	downloaded
Size (bytes):	5204
Entropy (8bit):	7.768208423737279
Encrypted:	false
SSDEEP:
MD5:	36EE47A980BD7CCF77E9EC23FA4FB982
SHA1:	D4461C8CCB2AECEC34881C09ADDBB9902504CEEC
SHA-256:	F2D1E8333CFCFA50DDE4A85A58299110CB605007335818F37F19C28DAFBABDF6
SHA-512:	3965173BDF73BD58A1E5A64A26EEC07D2603C043A90B9E22CEF9F8164D6AA62798D1880203478233DE21EF8E8EC88865C1DEB824EDD5612F7E7FFF5C6EC4D5DB
Malicious:	false
Reputation:	unknown
URL:	https://www.constructivesoftware.com.au/wp-content/uploads/2023/05/client-henley.jpg
Preview:	......Exif..II*.................Ducky.......Q.....-http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.dabacbb, 2021/04/14-00:39:44 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.5 (Windows)" xmpMM:InstanceID="xmp.iid:36A34D1BF87D11ED873CAD7398B301BF" xmpMM:DocumentID="xmp.did:36A34D1CF87D11ED873CAD7398B301BF"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:36A34D19F87D11ED873CAD7398B301BF" stRef:documentID="xmp.did:36A34D1AF87D11ED873CAD7398B301BF"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d...............................................................................................................................

Chrome Cache Entry: 141

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (62898)
Category:	dropped
Size (bytes):	361810
Entropy (8bit):	5.364728414630705
Encrypted:	false
SSDEEP:
MD5:	879555822E7140CD909CF92F38BB5317
SHA1:	6A7DDE19050945E896D457759B776BCB7CC647FB
SHA-256:	4A17F3DC728F6476D791EF5781A5F9ACAD2F7D564B4FBE5F60FC8BF03E9DF9D3
SHA-512:	E21663E9C8CF2A79DCA5C0BFDAB64C061A8CD1F464C796298286B8FACFADE1C7B25A815EF464791C04EAB07ECE26F6A53DECB64ACA6A09BEF8226379C8223017
Malicious:	false
Reputation:	unknown
Preview:	(function(){var fw={};(function(fw,$){if($){window.freshsales=window.freshsales\|\|{};window.freshsales.$=window.freshsales.$\|\|jQuery}var chatSelector=document.querySelector("[chat]");window.hideChatWidget=chatSelector&&chatSelector.hasAttribute("chat")&&chatSelector.getAttribute("chat")==="false";var widgetSelector=document.querySelector("script[widgetId]");window.custWidgetId=widgetSelector&&widgetSelector.hasAttribute("widgetId")?widgetSelector.getAttribute("widgetId"):"";var FreshworksCRM=(function(){let eventListeners={};function FreshworksCRM(){}FreshworksCRM.prototype.identify=function(){let event={name:"identify",args:arguments,origin:window.location.origin,created_by:"fwcrm"};let customEvent=new CustomEvent("fwcrm_event",{detail:event});window.dispatchEvent(customEvent)};FreshworksCRM.prototype.trackCustomEvent=function(){let event={name:"trackCustomEvent",args:arguments,origin:window.location.origin,created_by:"fwcrm"};let customEvent=new CustomEvent("fwcrm_event",{detail:event

Chrome Cache Entry: 142

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (13479)
Category:	downloaded
Size (bytes):	13577
Entropy (8bit):	5.272065782731947
Encrypted:	false
SSDEEP:
MD5:	9FFEB32E2D9EFBF8F70CAABDED242267
SHA1:	3AD0C10E501AC2A9BFA18F9CD7E700219B378738
SHA-256:	5274F11E6FB32AE0CF2DFB9F8043272865C397A7C4223B4CFA7D50EA52FBDE89
SHA-512:	8D6BE545508A1C38278B8AD780C3758AE48A25E4E12EEE443375AA56031D9B356F8C90F22D4F251140FA3F65603AF40523165E33CAE2E2D62FC78EC106E3D731
Malicious:	false
Reputation:	unknown
URL:	https://www.constructivesoftware.com.au/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1
Preview:	/! jQuery Migrate v3.4.1 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /."undefined"==typeof jQuery.migrateMute&&(jQuery.migrateMute=!0),function(t){"use strict";"function"==typeof define&&define.amd?define(["jquery"],function(e){return t(e,window)}):"object"==typeof module&&module.exports?module.exports=t(require("jquery"),window):t(jQuery,window)}(function(s,n){"use strict";function e(e){return 0<=function(e,t){for(var r=/^(\d+)\.(\d+)\.(\d+)/,n=r.exec(e)\|\|[],o=r.exec(t)\|\|[],a=1;a<=3;a++){if(+o[a]<+n[a])return 1;if(+n[a]<+o[a])return-1}return 0}(s.fn.jquery,e)}s.migrateVersion="3.4.1";var t=Object.create(null);s.migrateDisablePatches=function(){for(var e=0;e<arguments.length;e++)t[arguments[e]]=!0},s.migrateEnablePatches=function(){for(var e=0;e<arguments.length;e++)delete t[arguments[e]]},s.migrateIsPatchEnabled=function(e){return!t[e]},n.console&&n.console.log&&(s&&e("3.0.0")&&!e("5.0.0")\|\|n.console.log("JQMIGRATE: jQuery 3.x-4.x REQUIRED"),s.migrateWarnings

Chrome Cache Entry: 144

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1024x682, components 3
Category:	dropped
Size (bytes):	125888
Entropy (8bit):	7.853010689598296
Encrypted:	false
SSDEEP:
MD5:	382DDFE7810F7535745265B61A769433
SHA1:	4D95822D2CB30C6293B4C98B427AF92D49E036B1
SHA-256:	FDC47FF551F80D948932E6A7E66E0DB05DA0E79A4EC9AB76EFD3C46DCD2C219B
SHA-512:	E16B4EC5C53351E8FC3C3F486F3AE5B65DA5269B3E51AB45582F8567A3312470D4D41309DE21CF032309565A432736E31C61CEDD6B2ACE84BC2883C32C0941DA
Malicious:	false
Reputation:	unknown
Preview:	......Exif..II*.................Ducky.......Q.....-http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.dabacbb, 2021/04/14-00:39:44 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.5 (Windows)" xmpMM:InstanceID="xmp.iid:0A50B271521311EE802EB7D93A6B69D6" xmpMM:DocumentID="xmp.did:0A50B272521311EE802EB7D93A6B69D6"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:0A50B26F521311EE802EB7D93A6B69D6" stRef:documentID="xmp.did:0A50B270521311EE802EB7D93A6B69D6"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d...............................................................................................................................

Chrome Cache Entry: 145

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 179 x 54, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	3443
Entropy (8bit):	7.909676165568597
Encrypted:	false
SSDEEP:
MD5:	024246D6642AC8F4AE16D863FE59D5F0
SHA1:	08E2F29D37883D9B3BB2535698369F16AEAB3045
SHA-256:	FE298C840BEEF4F6C6B46E43B5A33C5F0E880C609AA830F72BBF96012417E9D0
SHA-512:	D4AD8FE7790A893E127CAF4B95C8A2D207E66A0E9CF9773E8D4AD7E60F6CA62D7D458F11D2B83E5653315D649090A00705B71D8C541EB7791C4BCC66B6E07662
Malicious:	false
Reputation:	unknown
URL:	https://www.constructivesoftware.com.au/wp-content/uploads/2023/08/constructive-logo-header-1-179x54.png
Preview:	.PNG........IHDR.......6......i......pHYs..........+.....%IDATx..}......n....Dc.EB^Zj...........UK..?b.Z..i....U.{...z......DJ.m,.6..Wb..RJ.!..f..?...73o..}.._.}....{..s.<8H.\.=.z...z..G...H..N.>.^...q...F.<.z....Q..f..`{.s.y..&.a.9.z........`..{`.....A...8i..r..!Z...\.t.=..M..tu.#..\...a4.%....).......s.....=y.=P.K3.G....^;p?.6...`:..`.ev.....w...jo....s... B\|w.9..........2j...1.t:.:".q..Sb:..h.(..<......ve4'5k...?..%^...j..n.{.}.,`WB{f..Q.@.h>j..........,@..........=..8..8..cjm[F.2 ...9..,..K(..\.<....?....x.d[:##5...,.nCL.\B.u.Y.>)..........mGFF...9.z..E..B-.~.....v.9o.s.y.]...lOQ.3.y3...A...M..........]..[...,....d}.Y.e.d47..l.p..I.....=7_oc.)s+..lO(....{n.W$......u.?..Er..i`.`....z...... J.d4.e.l.i.bV..Po/p3....i.1.....E{....%+59Ea6.t...9*....<7.[...\|.........yE..#..{. p............m...L...E..W.%.7-G.\o<.v;.J.[.g....v.@.........{n..i2Z..WM....C...=.z..s..u..g>....h...l6...M.M..nG..%.[..H./#c..,.~...,.k.Q.d.6.....N5H..Z

Chrome Cache Entry: 146

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1024 x 682, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	126004
Entropy (8bit):	7.885172292331983
Encrypted:	false
SSDEEP:
MD5:	199260DAA9E4618038E0384BAC1BDA52
SHA1:	7B687EB207BDCA7D8F761ECD7A68CE9BE78268ED
SHA-256:	B25278624A3AC512DF138F907AB6C3BD29E5D78378D372E171A11AB8C5125709
SHA-512:	E399C8B8D2C839645526C66DBBF9A36AB25B57BE4AB058BAE3C632396967D2BE3124EC9EEA3EADCA6AD7C1832EC7BED19B2CEDDBD03562CF7012E0941F50B66D
Malicious:	false
Reputation:	unknown
URL:	https://www.constructivesoftware.com.au/wp-content/uploads/2023/08/home-selections-multidevice-2.png
Preview:	.PNG........IHDR.....................PLTE....................................779......546:9;..................113?>@{{\|.........\|\|}..............XXY..........................................................jjm.......................................=<>546.........9=I.........LP[.......^.@DPEHR...SW`Z[c...aci.....?>@S..'g.oqv%$$....\|m/05F3,26Btx.......0m.878...YH?OMO...?.].--}..ikp@..7r....xx{.ufWUV.....u4".O;7yiY.......o` ..=,%.K9)..U- .........rFraR...gXJyA-.......zJ............Cy..i@^...O..{..~4...I..TA...sSI.......E3N..m;)b2$.]R......S.....F#..g]jLAT.m.............H.i......$0..u.b<...a@6...a9..j.S0.....J..f.[6.........a^<N.vG.wYoJ^r..}Vk..t....V............I..........y...r.JP/......rMl.n.....P.}F.....`x.&.G....az..Qczfj9.7...........e\|..ASmS.qK.`Gh[O.h.,N....MtRNS..... +7 ,NC.cZ..d.6qBR.~.x..tX...y.h..$....[...n....................n..[...#...IDATx.......................-..a ..-.E.Y.].BQ.7.=..%..mt....../.. '.. F.Y!.{3.....R.T*...^..k

Chrome Cache Entry: 147

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (25135)
Category:	downloaded
Size (bytes):	26749
Entropy (8bit):	5.029755160025927
Encrypted:	false
SSDEEP:
MD5:	E8EB1646FBF58AB8B1FE601EF188CCB7
SHA1:	872015C04826CF3C85E4589557A7EBA164B65371
SHA-256:	5C88873A5077BEF297E987DBE8111399BF2AFDD833A187F23BFA858EFD17F8D1
SHA-512:	07CB034795BFD1817416101254FC8BC83A61E126ADCE75F6DCE61DE5A24A770418E30D03D637BACFE976DC8F80A5AA7D071561D1BE57AC11D889E5D1E4C37D0B
Malicious:	false
Reputation:	unknown
URL:	https://www.constructivesoftware.com.au/wp-content/uploads/groovy/preset_760.css?ver=383b2a682ba1fcee97811d9d9d074f35
Preview:	.gm-navbar {z-index: 9999 !important}.gm-main-menu-wrapper {z-index: 9999 !important}.gm-navigation-drawer, gm-second-nav-drawer {z-index: 10023 !important}.gm-navbar--style-3 .gm-toolbar {z-index: 10011 !important}.gm-navbar--style-5 .gm-toolbar {z-index: 10011 !important}.gm-navbar .gm-toolbar .wpml-ls {z-index: 10011 !important}@media (min-width: 1024px) {.gm-navbar .gm-logo {z-index: 10011 !important}}@media (min-width: 1024px) {.gm-navbar .gm-menu-btn--expanded, .gm-burger {z-index: 10017 !important}}.gm-search__fullscreen-container {z-index: 10023 !important}.gm-dropdown-overlay {z-index: 9996 !important}@media (min-width: 1024px) {.gm-main-menu-wrapper .gm-navbar-nav .gm-dropdown-menu .gm-menu-item__link, .gm-main-menu-wrapper .gm-mega-menu__item__title {border-bottom: 1px solid rgba(234, 234, 234, 1);}}@media (min-width: 1024px) {.gm-inner .gm-container {height: 100px;}.gm-navbar:not(.gm-navbar-sticky-toggle) .gm-inner {min-height: 100px;}}.gm-container {max-width: 1200px}@medi

Chrome Cache Entry: 148

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (7711)
Category:	downloaded
Size (bytes):	330248
Entropy (8bit):	5.596647271126331
Encrypted:	false
SSDEEP:
MD5:	09BC91E86266C80E866CEE602DC40228
SHA1:	CD55F828E0E81C58FAC88CA8CC805966686E8817
SHA-256:	E364B41C6517AC6429FC117BDF03EAF05521DA010762036076AE0C003B0691CA
SHA-512:	100B49A2588D99D420D0C41764EFE593F32F00F495EEDC03593502D3416C7B5C28125FC6F5C9431E09669631D22178F9FA3CE05E15907FD6D33432DA46873FF7
Malicious:	false
Reputation:	unknown
URL:	https://www.googletagmanager.com/gtag/js?id=GT-NFR3B58
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"2",. . "macros":[{"function":"__e"},{"vtp_signal":1,"function":"__c","vtp_value":1},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0},{"vtp_signal":1,"function":"__c","vtp_value":1},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0}],. "tags":[{"function":"__ogt_ga_send","priority":16,"vtp_value":true,"tag_id":16},{"function":"__ogt_referral_exclusion","priority":16,"vtp_includeConditions":["list","constructivesoftware\\.com\\.au","blog\\.constructivesoftware\\.com\\.au"],"tag_id":18},{"function":"__ogt_session_timeout","priority":16,"vtp_sessionMinutes":30,"vtp_sessionHours":0,"tag_id":19},{"function":"__ogt_1p_data_v2","priority":16,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELEC

Chrome Cache Entry: 149

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
Reputation:	unknown
URL:	https://td.doubleclick.net/td/ga/rul?tid=G-1EZS5MF5GX&gacid=1404008011.1724736437&gtm=45Pe48q0v9126913785za200&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=0&z=1710535996
Preview:	<html></html>

Chrome Cache Entry: 150

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 77160, version 4.459
Category:	downloaded
Size (bytes):	77160
Entropy (8bit):	7.996509451516447
Encrypted:	true
SSDEEP:
MD5:	AF7AE505A9EED503F8B8E6982036873E
SHA1:	D6F48CBA7D076FB6F2FD6BA993A75B9DC1ECBF0C
SHA-256:	2ADEFCBC041E7D18FCF2D417879DC5A09997AA64D675B7A3C4B6CE33DA13F3FE
SHA-512:	838FEFDBC14901F41EDF995A78FDAC55764CD4912CCB734B8BEA4909194582904D8F2AFDF2B6C428667912CE4D65681A1044D045D1BC6DE2B14113F0315FC892
Malicious:	false
Reputation:	unknown
URL:	https://www.constructivesoftware.com.au/wp-content/plugins/groovy-menu/assets/fonts/fontawesome-webfont.woff2?v=4.7.0
Preview:	wOF2......-h..........-.........................?FFTM.. .`..r.....(..X.6.$..p..... .....u[R.rGa......'.=.:..&..=r........].t..E.n.......1F...@....\|....f.m.`.$..@d[BQ.$([U<+(..@P.5..`....>.P..;.(..1..l..h...)..Yy..Ji......\|%..^..G..3..n........D..p\Yr .L.P.....t.)......6R.^"S.L~.YR.CXR...4...F.y\[..7n..\|.s.q..M..%K......,.....L.t.'....M.,..c..+b....O.s.^.$...z...m...h&gb...v.....'..6.:....s.m.b.1.m0"....*V.....c.$,0ATPT.1.....<..;...`..'.H.?.s.:..ND.....I..$..T..[..b4........,....bl6...IL.i}.&.4.m,'....#....Rw..bu..,K......v....m_-...\H....HH.......?...m..9P...)9.J..$.....8......~.;.r..n.=$.....Nddn.!'....;...8..'.N...!.-..J.........X.=.,......"`:....... {......K!'...-FH....#$~.Z_.......N5VU8F....%.P..........Cp..$.Q.......r.....k.k...3...:R.%....2{.....h%.)8..........ILK.6v.#......,;.6..N.2.hv...........OO..t#....xT..Bf....q^.#....?{.5b.I..%-WZ..b.A...^.1..n5.....NQ.Y'.........S.....!t" .`b3..%....35....fv;....l..9.:jgf?gr..p.x. ..\|.. $. e.

Chrome Cache Entry: 151

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (19350), with no line terminators
Category:	dropped
Size (bytes):	19350
Entropy (8bit):	5.228718293507535
Encrypted:	false
SSDEEP:
MD5:	B8F69D1B6D8EA9165E53AD490AB46EE6
SHA1:	BC08F53731F762FBBD5CB574D1169A1C3067476F
SHA-256:	52239EC3B67FD72F324401D90A1ED08955D0A07C4CF0C7F376AEF11B1E75F952
SHA-512:	1FD8A52A5988BFECE480674B61156AF3205657B697E847CA37E698FC22A4829A5C262A28EF0CBD912B1E0933313D99BE6025170F5BBCB764A89215018EDCC563
Malicious:	false
Reputation:	unknown
Preview:	!function(e){var t={};function n(o){if(t[o])return t[o].exports;var c=t[o]={i:o,l:!1,exports:{}};return e[o].call(c.exports,c,c.exports,n),c.l=!0,c.exports}n.m=e,n.c=t,n.d=function(e,t,o){n.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:o})},n.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},n.t=function(e,t){if(1&t&&(e=n(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var o=Object.create(null);if(n.r(o),Object.defineProperty(o,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var c in e)n.d(o,c,function(t){return e[t]}.bind(null,c));return o},n.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return n.d(t,"a",t),t},n.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},n.p="",n(n.s=0)}([function(e,t){const n=window._ckyConfig,o=window._ckyStyles;n._backupNodes=[],n._resetCo

Chrome Cache Entry: 152

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	7694
Entropy (8bit):	5.345779550981522
Encrypted:	false
SSDEEP:
MD5:	DC0B50129621513116F86BB08164CAD5
SHA1:	0A394C608222EB3E5057D4BB266D56CE8357FEAA
SHA-256:	47814CED0CA59DF80342B2FD727F7E8F1D065A2A6DBC40DA8AB68450175FD0F3
SHA-512:	FB964DC66570E750DE1F892CA105A3E26F99F0BE2A9FA46E9C48A2DAEAAB518CEA81D0B428C95B5BF65F6594C1C6A5E9F97DEDFA9E6E793FBFF15D1E1A9F1072
Malicious:	false
Reputation:	unknown
URL:	https://fonts.googleapis.com/css?family=Lato%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic&display=swap&ver=6.6.1
Preview:	/* latin-ext /.@font-face {. font-family: 'Lato';. font-style: italic;. font-weight: 100;. font-display: swap;. src: url(https://fonts.gstatic.com/s/lato/v24/S6u-w4BMUTPHjxsIPx-mPCLQ7A.woff2) format('woff2');. unicode-range: U+0100-02AF, U+0304, U+0308, U+0329, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C0, U+2113, U+2C60-2C7F, U+A720-A7FF;.}./ latin /.@font-face {. font-family: 'Lato';. font-style: italic;. font-weight: 100;. font-display: swap;. src: url(https://fonts.gstatic.com/s/lato/v24/S6u-w4BMUTPHjxsIPx-oPCI.woff2) format('woff2');. unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+2074, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;.}./ latin-ext */.@font-face {. font-family: 'Lato';. font-style: italic;. font-weight: 300;. font-display: swap;. src: url(https://fonts.gstatic.com/s/lato/v24/S6u_w4BMUTPHjxsI9w2_FQft1dw.woff2) format('woff2');. unicode-ra

Chrome Cache Entry: 153

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	165
Entropy (8bit):	4.7663151303405344
Encrypted:	false
SSDEEP:
MD5:	4B70A5C3EF298ED81011D5967E355085
SHA1:	A11B95C92CE2E6B0710B6105C52463FD1CF7D136
SHA-256:	687E32DCDD94EA625153A75AA72229792914FF08F18A449DC702AF5DCBC9A045
SHA-512:	6B05E320121445878E8A5F7B2DB76D17FF4443F966B74F9784AD09B7079875FDD0B55EE8AD6565629B004D2757783939B5DF006E516A88C42A87869F07221A3C
Malicious:	false
Reputation:	unknown
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Fwww.auth.constructivesoftware.com.au&oit=3&cp=17&pgcl=4&gs_rn=42&psi=RFsKykg2bKHSct64&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["https://www.auth.constructivesoftware.com.au",[],[],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:suggesttype":[],"google:verbatimrelevance":851}]

Chrome Cache Entry: 155

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	644
Entropy (8bit):	4.8093178891182555
Encrypted:	false
SSDEEP:
MD5:	796B389C712793C95ADE32356F6D084B
SHA1:	744D141BA46A70F62A1D3C0EA28C83A28FB004C6
SHA-256:	FC8A49DCDD74EF560A8BA00E1BFEF071A53BC361C4B6BBAECB69930893C5589C
SHA-512:	E00E9F60AFB88418FA1C2EC1C316E98D7EC84539A0AED4ED188CB98DABFB124F474CA019DC5EAF92FE430ED29F386E19E5A90FC48271141F2F6347212F7B939B
Malicious:	false
Reputation:	unknown
URL:	https://www.constructivesoftware.com.au/wp-content/plugins/groovy-menu/assets/style/font-internal.css?ver=2.6.3
Preview:	@font-face {. font-family: 'crane-font';. src: url("../fonts/crane-font.woff?hhxb42") format("woff");. font-weight: normal;. font-style: normal;. font-display: block; }...gmi {. /* use !important to prevent issues with browser extensions that change fonts /. font-family: 'crane-font' !important;. speak: none;. font-style: normal;. font-weight: normal;. font-variant: normal;. text-transform: none;. line-height: 1;. / Better Font Rendering =========== */. -webkit-font-smoothing: antialiased;. -moz-osx-font-smoothing: grayscale; }...gmi-zoom-search::before {. content: "\e901"; }...gmi-bag::before {. content: "\e900"; }.

Chrome Cache Entry: 156

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (39368), with no line terminators
Category:	downloaded
Size (bytes):	39368
Entropy (8bit):	4.6390296562171125
Encrypted:	false
SSDEEP:
MD5:	3A20AB7A98A747AD5F7B718D58949338
SHA1:	17315E8367FD37C11E825F0197C7F95ED2F04076
SHA-256:	8469391403A1B60B4A6DAC6DCE12E75B0CE42C40B45A94082AC876406824E317
SHA-512:	7E2969CEDA49310FFFDDF4390215F1E111E38307C46608C39487BF7727FD873F0F46C8BA8A0BC469C92A51965A1B370B93FA1FF11678956FF46AAB6619DDB615
Malicious:	false
Reputation:	unknown
URL:	https://www.constructivesoftware.com.au/wp-content/uploads/elementor/css/post-5605.css?ver=1705976613
Preview:	.elementor-5605 .elementor-element.elementor-element-4b188c0:not(.elementor-motion-effects-element-type-background), .elementor-5605 .elementor-element.elementor-element-4b188c0 > .elementor-motion-effects-container > .elementor-motion-effects-layer{background-color:#ffffff;}.elementor-5605 .elementor-element.elementor-element-4b188c0{transition:background 0.3s, border 0.3s, border-radius 0.3s, box-shadow 0.3s;}.elementor-5605 .elementor-element.elementor-element-4b188c0 > .elementor-background-overlay{transition:background 0.3s, border-radius 0.3s, opacity 0.3s;}.elementor-5605 .elementor-element.elementor-element-5b533733{--spacer-size:15px;}.elementor-5605 .elementor-element.elementor-element-178add74{--spacer-size:50px;}.elementor-5605 .elementor-element.elementor-element-384bec8b > .elementor-container{max-width:1300px;min-height:46vh;}.elementor-5605 .elementor-element.elementor-element-384bec8b:not(.elementor-motion-effects-element-type-background), .elementor-5605 .elementor-el

Chrome Cache Entry: 157

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 179 x 54, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	3339
Entropy (8bit):	7.918217717675707
Encrypted:	false
SSDEEP:
MD5:	023C30C1A4BB7F54C12964E57A03ACEC
SHA1:	5ACA5E5DD5D7C2CFFD06387D79BEC3BDA974AF29
SHA-256:	C1CBA2F054A7D3BB35CA7D4734592DBE6605E9802EC712328B558C9DD05109EF
SHA-512:	549FAB115E1E2D22C263599D57310CF0F6124E173741BF43ECBEB36CE995EE25E528A45BA2E471215E8AD6485B67FCA040B7B15F837A96F347B18A9E52E90B13
Malicious:	false
Reputation:	unknown
URL:	https://www.constructivesoftware.com.au/wp-content/uploads/2023/08/constructive-logo-header-2-179x54.png
Preview:	.PNG........IHDR.......6......i......pHYs..........+......IDATx..{.....?.l.!.P..Rj......Rj.Z.k.9..Z<..Q.%Vic6h..UK.R...V......].],.H..H.......B.!d..l...\.{.q..;.d..3.3.7s~.;..9.r..$8.?:.t.p..........C..Vw..`...x......V..ch......D .&GN..K....ne.9..Z"....x...B..X\...V.c.....`...p'...._.....#..CS.........54;.,.L...t0..=.v}1.;..3..D[.n...r.9`L.MG...=..[.t.0../..# ....hX.=...._T.....`d....S=..o...C....<.......tA....?...vg.r...pQ#\|....[3{:......i...+.z.........v$.t`E.\|....Y3{:(x:..x.lA.....d...>..Cb.=...#G.j.fO.c.. .3M..."~1......+.....`_-<.......?.fg.}.\|...'...t.b.;.o..U.G..i..g.tP.n....e.v.7.SHd#"+......`A1.Gk.#..G.0{:.......^.A.b.{.e...".aZ..`..T...+..D.0{:........3.F..YEC....N. ;..T..kM.4.@L.....x.....}`~1.6.)[6...Q.Y..0....c.L.=..D....m....Km.%..."`%0<..-....?.1a.tp6R#.5..B..WZ.X....!\|M. ...GV...[9N@.b5..7*.v;.;.w....... +..[MX0..C.X......$~< ..b...s.vdv8.pt#Q.U.......m.@WJ..1..g.m..t.P..f..h...........G.r..P.t7R.s`.....D.........%}....Rc...s...(..`..34&

Chrome Cache Entry: 158

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1222
Entropy (8bit):	4.709722975725557
Encrypted:	false
SSDEEP:
MD5:	57346E7B554D152A073F2F356E72D2D8
SHA1:	CA0327CE8CDC26795BC9FDB1BE201E88035A7FAE
SHA-256:	B37EBD2524191BF943476446276026A92083FE5BC43571EEC11855C3872BD1AF
SHA-512:	3A53202458273D68A758BCC02E6869A329CD524CF8417F0D13A8C6976883B7340FEF6FA8F7B2E2085175EACD6AC2131BE6DE8302F97A96C7743C9AEA46F00084
Malicious:	false
Reputation:	unknown
URL:	https://www.constructivesoftware.com.au/wp-content/plugins/th-widget-pack/header-footer/assets/css/header-footer-elementor.css?ver=2.2.6
Preview:	...footer-width-fixer {. width: 100%;.}../* Container fix for genesis themes /...ehf-template-genesis.ehf-header .site-header .wrap,..ehf-template-genesis.ehf-footer .site-footer .wrap,..ehf-template-generatepress.ehf-header .site-header .inside-header {. width: 100%;. padding: 0;. max-width: 100%;.}../ Container fix for generatepress theme /...ehf-template-generatepress.ehf-header .site-header,..ehf-template-generatepress.ehf-footer .site-footer {. width: 100%;. padding: 0;. max-width: 100%;. background-color: transparent !important; / override generatepress default white color for header /.}...bhf-hidden {. display: none.}../ Sticky Header /..#thhf-masthead-sticky {. width: 100%;. left: 0;. display:none;. / transition:all 0.7s ease 0s;..-webkit-transition:all 0.7s ease 0s; */.}..#thhf-masthead.transparent-header {. position: absolute;. background: transparent;. overflow:visible;. width: 100%;.}...#thhf-masthead-sticky.transpa

Chrome Cache Entry: 159

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	53575
Entropy (8bit):	4.796430030949759
Encrypted:	false
SSDEEP:
MD5:	B949F99C72E38F201DAB7C9A733B2E3A
SHA1:	CA1A1B72767CE34809728E948E870E6867230CA6
SHA-256:	A48D01207DB36011A52BA50F8FDBEF2C589FC97692A7F5C93D182F846DC77164
SHA-512:	147A21A46785377DA03AF73DC0AD64E030CB04D3F3A6D5511938F96C202CF90F72F4771D8A2C3B38802A73D404FF0452B2ABAE41B7F727376F45466272372F28
Malicious:	false
Reputation:	unknown
URL:	https://www.constructivesoftware.com.au/wp-content/plugins/th-widget-pack/assets/icons/icons.css?ver=2.2.6
Preview:	/* Elementor Widget Icon Styling /..elementor-panel .elementor-element .icon .th-linea{. font-size: 23px;.}../ Linea Arrows /..@font-face {. font-family: "linea-arrows-10";. src:url("linea/linea-arrows-10.eot");. src:url("linea/linea-arrows-10.eot?#iefix") format("embedded-opentype"),. url("linea/linea-arrows-10.woff") format("woff"),. url("linea/linea-arrows-10.ttf") format("truetype"),. url("linea/linea-arrows-10.svg#linea-arrows-10") format("svg");. font-weight: normal;. font-style: normal;. font-display: swap;.}..[class^="icon-arrows-"]:before,.[class=" icon-arrows-"]:before {. font-family: "linea-arrows-10" !important;. font-style: normal !important;. font-weight: normal !important;. font-variant: normal !important;. text-transform: none !important;. speak: none;. line-height: 1;. -webkit-font-smoothing: antialiased;. -moz-osx-font-smoothing: grayscale;.}...icon-arrows-anticlockwise:before {. content: "\e000";.}..icon-arrows-anticlockwise-dashed:befor

Chrome Cache Entry: 160

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (57726)
Category:	downloaded
Size (bytes):	57912
Entropy (8bit):	4.690906492963222
Encrypted:	false
SSDEEP:
MD5:	EEB705D0BDCCFD645D3BBD46DD1FBAB3
SHA1:	066DEF290F42ED8C00860E573CC880BD46E9CED4
SHA-256:	D01A2BA2805C78957E15A2958135DE0F3CB88E95159DD0F6C0A032BD76B1B0E9
SHA-512:	39D11741808E95D8EA504B2E30AB19463F771EDDB741196121BF04FD7D2C6F066199EF1E530EA0F2AEC077118929A91C05BBFBFBF3D7D067366ED7FB46EF1C64
Malicious:	false
Reputation:	unknown
URL:	https://www.constructivesoftware.com.au/wp-content/plugins/elementor/assets/lib/font-awesome/css/fontawesome.min.css?ver=5.15.3
Preview:	/!. Font Awesome Free 5.15.3 by @fontawesome - https://fontawesome.com. * License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License). */..fa,.fab,.fad,.fal,.far,.fas{-moz-osx-font-smoothing:grayscale;-webkit-font-smoothing:antialiased;display:inline-block;font-style:normal;font-variant:normal;text-rendering:auto;line-height:1}.fa-lg{font-size:1.33333em;line-height:.75em;vertical-align:-.0667em}.fa-xs{font-size:.75em}.fa-sm{font-size:.875em}.fa-1x{font-size:1em}.fa-2x{font-size:2em}.fa-3x{font-size:3em}.fa-4x{font-size:4em}.fa-5x{font-size:5em}.fa-6x{font-size:6em}.fa-7x{font-size:7em}.fa-8x{font-size:8em}.fa-9x{font-size:9em}.fa-10x{font-size:10em}.fa-fw{text-align:center;width:1.25em}.fa-ul{list-style-type:none;margin-left:2.5em;padding-left:0}.fa-ul>li{position:relative}.fa-li{left:-2em;position:absolute;text-align:center;width:2em;line-height:inherit}.fa-border{border:.08em solid #eee;border-radius:.1em;padding:.2em .25em .15em}.fa-pu

Chrome Cache Entry: 162

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (54704)
Category:	downloaded
Size (bytes):	179999
Entropy (8bit):	5.350741409390655
Encrypted:	false
SSDEEP:
MD5:	4E49D9B52F038E2CF797EE30C3AAA101
SHA1:	5253942119E98FE6E70AF2797F41A0F0DDF068CA
SHA-256:	8CE9E34A0FD0AD30FF61EC6B87E26C59F321A02845777A30F116183E109186E7
SHA-512:	84E1E2931D9EE89A26A09C3575529B2E659CE9336BEDC7D1D16828E691D42287B0E38EAADD5E80AD3C1E4F3CB0E986EBD1ECF6FD06041EC9A12BCD5B0EBA3A86
Malicious:	false
Reputation:	unknown
URL:	https://www.constructivesoftware.com.au/wp-content/plugins/groovy-menu/assets/js/frontend.js?ver=2.6.3
Preview:	!function(t){var e={};function n(r){if(e[r])return e[r].exports;var o=e[r]={i:r,l:!1,exports:{}};return t[r].call(o.exports,o,o.exports,n),o.l=!0,o.exports}n.m=t,n.c=e,n.d=function(t,e,r){n.o(t,e)\|\|Object.defineProperty(t,e,{enumerable:!0,get:r})},n.r=function(t){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(t,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(t,"__esModule",{value:!0})},n.t=function(t,e){if(1&e&&(t=n(t)),8&e)return t;if(4&e&&"object"==typeof t&&t&&t.__esModule)return t;var r=Object.create(null);if(n.r(r),Object.defineProperty(r,"default",{enumerable:!0,value:t}),2&e&&"string"!=typeof t)for(var o in t)n.d(r,o,function(e){return t[e]}.bind(null,o));return r},n.n=function(t){var e=t&&t.__esModule?function(){return t.default}:function(){return t};return n.d(e,"a",e),e},n.o=function(t,e){return Object.prototype.hasOwnProperty.call(t,e)},n.p="",n(n.s=41)}({41:function(t,e,n){"use strict";n.r(e);n(42)},42:function(t,e){!function(t){var e={};fu

Chrome Cache Entry: 163

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (54704)
Category:	dropped
Size (bytes):	151922
Entropy (8bit):	5.35378033481439
Encrypted:	false
SSDEEP:
MD5:	2CB95B2E131134453CD4F7D4DB534E86
SHA1:	89B380D63D0C6A84886ADE83553E227603F0925E
SHA-256:	C2288279957D9E061D0B4556D389DC3EF78100560F2D6762FBA1108B78653450
SHA-512:	F7E07F63E892A29984C2A1EB9928A8DC5961AB055CAAE147E2A07C6FF34610081C65577C6D454A0F13CB18D669666EDD6FD3F0E7895D9FF5D0839161522E43F3
Malicious:	false
Reputation:	unknown
Preview:	!function(t){var e={};function n(r){if(e[r])return e[r].exports;var o=e[r]={i:r,l:!1,exports:{}};return t[r].call(o.exports,o,o.exports,n),o.l=!0,o.exports}n.m=t,n.c=e,n.d=function(t,e,r){n.o(t,e)\|\|Object.defineProperty(t,e,{enumerable:!0,get:r})},n.r=function(t){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(t,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(t,"__esModule",{value:!0})},n.t=function(t,e){if(1&e&&(t=n(t)),8&e)return t;if(4&e&&"object"==typeof t&&t&&t.__esModule)return t;var r=Object.create(null);if(n.r(r),Object.defineProperty(r,"default",{enumerable:!0,value:t}),2&e&&"string"!=typeof t)for(var o in t)n.d(r,o,function(e){return t[e]}.bind(null,o));return r},n.n=function(t){var e=t&&t.__esModule?function(){return t.default}:function(){return t};return n.d(e,"a",e),e},n.o=function(t,e){return Object.prototype.hasOwnProperty.call(t,e)},n.p="",n(n.s=41)}({41:function(t,e,n){"use strict";n.r(e);n(42)},42:function(t,e){!function(t){var e={};fu

Chrome Cache Entry: 164

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2583)
Category:	downloaded
Size (bytes):	2623
Entropy (8bit):	4.980016494313945
Encrypted:	false
SSDEEP:
MD5:	C3EA988EF355BBE942DE687B570795CC
SHA1:	980070D3F0B0009C37D55BB2677C7BABF4DBDA2C
SHA-256:	70F3CC852C9C3849B93AB403BFF853542DF94D4421891B4F50AEACB24F9AEEEF
SHA-512:	C0E6F8CD0F34A4D12ABE68BCFF63DF94368F9D822E9939583990B84DC29D6F010B11889D45596401564C7BDAB7A93A2F1BC25D8B51247F92A858501B8F57033F
Malicious:	false
Reputation:	unknown
URL:	https://www.constructivesoftware.com.au/wp-content/plugins/th-widget-pack/css/global.css?ver=1716261747
Preview:	@media (min-width: 576px){.thmv-column-20{width:20%!important;max-width:20%!important}}@media (min-width: 576px){.thmv-column-25{width:25%!important;max-width:25%!important}}@media (min-width: 576px){.thmv-column-33{width:33.33%!important;max-width:33.33%!important}}@media (min-width: 576px){.thmv-column-50{width:50%!important;max-width:50%!important}}@media (min-width: 576px){.thmv-column-100{width:100%!important;max-width:100%!important}}@media (max-width: 767px){.thmv-column-mobile-20{width:20%!important;max-width:20%!important}}@media (max-width: 767px){.thmv-column-mobile-25{width:25%!important;max-width:25%!important}}@media (max-width: 767px){.thmv-column-mobile-33{width:33.33%!important;max-width:33.33%!important}}@media (max-width: 767px){.thmv-column-mobile-50{width:50%!important;max-width:50%!important}}@media (max-width: 767px){.thmv-column-mobile-100{width:100%!important;max-width:100%!important}}@media (min-width: 768px) and (max-width: 991px){.thmv-column-tablet-20{width

Chrome Cache Entry: 165

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 173x115, components 3
Category:	downloaded
Size (bytes):	8821
Entropy (8bit):	7.878274846148879
Encrypted:	false
SSDEEP:
MD5:	24660401BE530A304271B7CC213C25B8
SHA1:	24223A72F33392CAFA1768DF90183F415C430F91
SHA-256:	1BED52CADF3EC1321DC69E1D73D45EF45A3F8C4BE27D2F15F4B8ED252AB15088
SHA-512:	E52FD784F0B853020B0E3CFB4F2144283FB1E76C6D677BAB955799F6CF56D738F669DA59BA98B6C45B4F66D201A7E855FA06931A834F37A7EDF81C5C39363FB1
Malicious:	false
Reputation:	unknown
URL:	https://www.constructivesoftware.com.au/wp-content/uploads/2023/08/client-cg.jpg
Preview:	......Exif..II*.................Ducky.......d......http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.dabacbb, 2021/04/14-00:39:44 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:C26D3521F87D11EDB460BE2F358DBEDC" xmpMM:DocumentID="xmp.did:639D5AAE35A311EEAE8B8C48907F5288" xmpMM:InstanceID="xmp.iid:639D5AAD35A311EEAE8B8C48907F5288" xmp:CreatorTool="Adobe Photoshop 22.5 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:84b5f3ac-5d61-f84c-97d5-ee81179d7146" stRef:documentID="adobe:docid:photoshop:df8797cf-bfe2-9547-b324-2f6cf4da9a56"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.....................................

Chrome Cache Entry: 166

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (26516)
Category:	downloaded
Size (bytes):	26702
Entropy (8bit):	4.830125836352143
Encrypted:	false
SSDEEP:
MD5:	C55205BCE667F5D812354FD1353E7389
SHA1:	F22DE0AF271EBA636A022C873C94FBCD81B4C89A
SHA-256:	C55902832FB84522D02EA1A60A30747403A140D8651FA748F13BA398B0C0DF3A
SHA-512:	89A2E11075B7A7E64D8240CA062E3311F1FE69600C189EC8EE78EA0F78CA9DB374BB1E0692E9AEDAF8EE23BD58528BF6D0E20F977477DAFF073BE57EE8E81BBD
Malicious:	false
Reputation:	unknown
URL:	https://www.constructivesoftware.com.au/wp-content/plugins/elementor/assets/lib/font-awesome/css/v4-shims.min.css?ver=3.10.1
Preview:	/!. Font Awesome Free 5.15.3 by @fontawesome - https://fontawesome.com. * License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License). */..fa.fa-glass:before{content:"\f000"}.fa.fa-meetup{font-family:"Font Awesome 5 Brands";font-weight:400}.fa.fa-star-o{font-family:"Font Awesome 5 Free";font-weight:400}.fa.fa-star-o:before{content:"\f005"}.fa.fa-close:before,.fa.fa-remove:before{content:"\f00d"}.fa.fa-gear:before{content:"\f013"}.fa.fa-trash-o{font-family:"Font Awesome 5 Free";font-weight:400}.fa.fa-trash-o:before{content:"\f2ed"}.fa.fa-file-o{font-family:"Font Awesome 5 Free";font-weight:400}.fa.fa-file-o:before{content:"\f15b"}.fa.fa-clock-o{font-family:"Font Awesome 5 Free";font-weight:400}.fa.fa-clock-o:before{content:"\f017"}.fa.fa-arrow-circle-o-down{font-family:"Font Awesome 5 Free";font-weight:400}.fa.fa-arrow-circle-o-down:before{content:"\f358"}.fa.fa-arrow-circle-o-up{font-family:"Font Awesome 5 Free";font-weight:400}.fa.fa-arr

Chrome Cache Entry: 167

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	164
Entropy (8bit):	4.761478490309944
Encrypted:	false
SSDEEP:
MD5:	DA4610E3A58BB2FE0069F3EE16E54F76
SHA1:	90ECDEF711ECF638C6A9CCBB0CBC5FC345D8A6E9
SHA-256:	9A2B72053F292767991E721F80448079541F97ABACB31046B3CAC26FC4655A8E
SHA-512:	F4856236508586158FF4F72C5FB35D371F0BFDBEE537DFA8C9DD2F74990474B4BF3A740B821AE55257F891958D2CC8104C0BB07BBCE33FC7C7096E4C09470B6B
Malicious:	false
Reputation:	unknown
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Fwww.authconstructivesoftware.com.au&oit=3&cp=16&pgcl=4&gs_rn=42&psi=RFsKykg2bKHSct64&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["https://www.authconstructivesoftware.com.au",[],[],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:suggesttype":[],"google:verbatimrelevance":851}]

Chrome Cache Entry: 170

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (7711)
Category:	dropped
Size (bytes):	330248
Entropy (8bit):	5.596693126750022
Encrypted:	false
SSDEEP:
MD5:	0D6EFCD82D2307102A4400795D7892CE
SHA1:	5682141067B5E5E2301019DEE3F8CB92C0062573
SHA-256:	4238024B4BBCC116B301734A1AFD16709FACBE26C9A2DD0F4672AB6EF3A5FC80
SHA-512:	40BB9C64DBFD3A0AC3D32CED0F4C7AE0571FABF44402B93EBC5B402A22DECF934C306518281FEBE492A79C47EEA1B385B2EFBCBB9E4CB8C2183B3BF2255B909B
Malicious:	false
Reputation:	unknown
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"2",. . "macros":[{"function":"__e"},{"vtp_signal":1,"function":"__c","vtp_value":1},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0},{"vtp_signal":1,"function":"__c","vtp_value":1},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0}],. "tags":[{"function":"__ogt_ga_send","priority":16,"vtp_value":true,"tag_id":16},{"function":"__ogt_referral_exclusion","priority":16,"vtp_includeConditions":["list","constructivesoftware\\.com\\.au","blog\\.constructivesoftware\\.com\\.au"],"tag_id":18},{"function":"__ogt_session_timeout","priority":16,"vtp_sessionMinutes":30,"vtp_sessionHours":0,"tag_id":19},{"function":"__ogt_1p_data_v2","priority":16,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELEC

Chrome Cache Entry: 171

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1279), with no line terminators
Category:	downloaded
Size (bytes):	1279
Entropy (8bit):	4.943813042856345
Encrypted:	false
SSDEEP:
MD5:	2BAB0CC882848D89E698CABDBFCA7B52
SHA1:	9FABE3DD9A6B3E0A3F1556087B393A1A4A10D290
SHA-256:	ADF52505C9E958C21A2AFB32119F54A2D0C436D122FAAB2DF3D990CCC4BD6D7C
SHA-512:	D64EB2675A11394737831B33B7FFD973E7113072094F9AD3E724546BD2CF686D4C4DC8CD09D9225B006A6246490991E8AAFBA20ADEE69E4ADF072881CFB849AC
Malicious:	false
Reputation:	unknown
URL:	https://www.constructivesoftware.com.au/wp-content/uploads/elementor/css/post-5.css?ver=1688355932
Preview:	.elementor-kit-5{--e-global-color-primary:#5669EC;--e-global-color-secondary:#54595F;--e-global-color-text:#7A7A7A;--e-global-color-accent:#5669EC;--e-global-color-357f9112:#4054B2;--e-global-color-5450a1ef:#23A455;--e-global-color-3dc0fe9a:#000;--e-global-color-62ec7c43:#FFF;--e-global-typography-primary-font-family:"Lato";--e-global-typography-primary-font-weight:600;--e-global-typography-secondary-font-family:"Lato";--e-global-typography-secondary-font-weight:400;--e-global-typography-text-font-family:"Lato";--e-global-typography-text-font-weight:400;--e-global-typography-accent-font-family:"Lato";--e-global-typography-accent-font-weight:500;}.elementor-kit-5 button,.elementor-kit-5 input[type="button"],.elementor-kit-5 input[type="submit"],.elementor-kit-5 .elementor-button{background-color:#5669EC;}.elementor-section.elementor-section-boxed > .elementor-container{max-width:1140px;}.e-con{--container-max-width:1140px;}{}h1.entry-title{display:var(--page-title-display);}@media(max-w

Chrome Cache Entry: 172

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (57765)
Category:	downloaded
Size (bytes):	112419
Entropy (8bit):	4.925253605526406
Encrypted:	false
SSDEEP:
MD5:	6C5989E44633F1E3F08AD845F9D9CE0B
SHA1:	2B24009FD37E79D4A601E6D53D615FD2CD0A606B
SHA-256:	885C89E82436CFA3D0A0A5A9B2F6BE6E1503457C810CC88ED2C09B4570AE9FD6
SHA-512:	1607A3F2AB27D377D5522BC5B7D0EBC5047E0B9352C7A49978D82D3128EBE13713AF4738D05AD1D32C5A3C54CE0EC787F94BFE25073FEAAF3D5D3BFF8B4DA2E5
Malicious:	false
Reputation:	unknown
URL:	https://www.constructivesoftware.com.au/wp-includes/css/dist/block-library/style.min.css?ver=6.6.1
Preview:	@charset "UTF-8";.wp-block-archives{box-sizing:border-box}.wp-block-archives-dropdown label{display:block}.wp-block-avatar{line-height:0}.wp-block-avatar,.wp-block-avatar img{box-sizing:border-box}.wp-block-avatar.aligncenter{text-align:center}.wp-block-audio{box-sizing:border-box}.wp-block-audio :where(figcaption){margin-bottom:1em;margin-top:.5em}.wp-block-audio audio{min-width:300px;width:100%}.wp-block-button__link{box-sizing:border-box;cursor:pointer;display:inline-block;text-align:center;word-break:break-word}.wp-block-button__link.aligncenter{text-align:center}.wp-block-button__link.alignright{text-align:right}:where(.wp-block-button__link){border-radius:9999px;box-shadow:none;padding:calc(.667em + 2px) calc(1.333em + 2px);text-decoration:none}.wp-block-button[style*=text-decoration] .wp-block-button__link{text-decoration:inherit}.wp-block-buttons>.wp-block-button.has-custom-width{max-width:none}.wp-block-buttons>.wp-block-button.has-custom-width .wp-block-button__link{width:100

Chrome Cache Entry: 173

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1024 x 682, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	116997
Entropy (8bit):	7.935809665230598
Encrypted:	false
SSDEEP:
MD5:	79775E977622D4B2BEA32FD7D8125055
SHA1:	C45288DF8A5F81B14901D91B69D29371E4AC4795
SHA-256:	F6781101FAD2143A5C88C5EF0593DCD00735525B5A8E1B6AB5EBF3F742E386D3
SHA-512:	855D460ECA2405414C5E8A20976B274814A3EE4B39C2117A10FCAF0A0841799E9C51E444D9D7F43B926E5982654DE0B2E3A9BADF9DDC946B915710503927C067
Malicious:	false
Reputation:	unknown
URL:	https://www.constructivesoftware.com.au/wp-content/uploads/2023/08/home-portal-multidevice-2.png
Preview:	.PNG........IHDR.....................PLTE..................................................................556668778...446.....435==>.........CCD@@D99=mlo...ttu...rqs.........ttv...ZZ]>>@...LLN....~~.............>>@...\|\|~.........==>...NNP}}~...ttv...98<...WWZ...}}.........................<?K...DHT.`.......6:E.........JNZ......TXbNR^...X\g+j....26A.........4p.......uux.....zz~__blt......dej>>@...opt.........jjn...=v.XX\H.fE\|._YSCCD......LD9::<...\.........O.E<1.D.KKJ......}......W...~SRR.....;4...vsj.{u..sy+fo(......+0=...P.m.....[O>6672+#............$)64.T...lha.........f..pt~.........Q.........Lp.\.v......i~....7a.'%$........./00y............!......p.....,Wc....v...............dt.....r`vbRUf{....@/....v.......~.....^dH...Z=%D(......~.VtK//5..Z8AJ%.kL...b...q........PtRNS.'/.6.=...C...."3*=GQZ[... .e0.xB.p....\|..wev.d.4a.N..M....V0C..r.%2.XP.......N+y....pIDATx..Q..0.D..D....mK..`...d.~pf$r.0..~.>._...H).q.)E..]p.5.+...D...=.i..p..H.1g..=V..g~.?...

Chrome Cache Entry: 175

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 173x115, components 3
Category:	dropped
Size (bytes):	7085
Entropy (8bit):	7.786781443235466
Encrypted:	false
SSDEEP:
MD5:	AE848B25D900C7239BDFBF520328FE6D
SHA1:	01D2E7EAE0648DD84F33C32187F65A156AEB3928
SHA-256:	8777AA539ABB8069C6D4AEE1D8F8B596F8C87DBAF70B83766FF53BA479B5D031
SHA-512:	4B294B298DEAAAC5665788EA0212F987BA017F65F7C603D66E98BED53622716BF748354F80F298708B20D0FAAB297CAA460486AAA4058FC4FCD5BA8BF4BC5BAC
Malicious:	false
Reputation:	unknown
Preview:	......Exif..II*.................Ducky.......Q.....-http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.dabacbb, 2021/04/14-00:39:44 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.5 (Windows)" xmpMM:InstanceID="xmp.iid:28AE193CF87C11ED9F2CD0DCDEC33338" xmpMM:DocumentID="xmp.did:28AE193DF87C11ED9F2CD0DCDEC33338"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:28AE193AF87C11ED9F2CD0DCDEC33338" stRef:documentID="xmp.did:28AE193BF87C11ED9F2CD0DCDEC33338"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d...............................................................................................................................

Chrome Cache Entry: 176

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 173x115, components 3
Category:	downloaded
Size (bytes):	7988
Entropy (8bit):	7.873998493636048
Encrypted:	false
SSDEEP:
MD5:	61A5A9A2EDCE97E0E2826C08BC9A0E96
SHA1:	24AF1563E5927EA2C4D66EA643220D535130004E
SHA-256:	807A1E946253AF8E645F774F84489D2441370BCC29FDCB811EC12B3497C987C3
SHA-512:	418B2C8509554BD0FB2BC27B40167A846985BF933F1C89D06FD40DE98CC8C4FB564BE5CE27D301230E2334721605958CCE2A5231044551FCBCB88FF338CD7FAA
Malicious:	false
Reputation:	unknown
URL:	https://www.constructivesoftware.com.au/wp-content/uploads/2023/05/client-bgc.jpg
Preview:	......Exif..II*.................Ducky.......Q.....-http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.dabacbb, 2021/04/14-00:39:44 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.5 (Windows)" xmpMM:InstanceID="xmp.iid:DE1756C7F87C11ED942F803FCA87B841" xmpMM:DocumentID="xmp.did:DE1756C8F87C11ED942F803FCA87B841"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:DE1756C5F87C11ED942F803FCA87B841" stRef:documentID="xmp.did:DE1756C6F87C11ED942F803FCA87B841"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d...............................................................................................................................

Chrome Cache Entry: 177

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (9895)
Category:	downloaded
Size (bytes):	9935
Entropy (8bit):	4.382219348182076
Encrypted:	false
SSDEEP:
MD5:	F8142E98AFC25AB630765F93DC31361E
SHA1:	8A0F8431B06D4CA51FADFE30426EE6AB4744C2FA
SHA-256:	1F0CC7656AAB0713BFC00FB362B6A6D917A44BB8FCBA527DA6CC85176D9B2E62
SHA-512:	D6C7B65358C4CD8036EBB6A86B45B79FEAA3B3F77EF35796EB90FBDC04F3C436ABCDA23BD9BF65BE53882DF2D1B7041A46D02C9261489AEBC1C1E35C36D3D820
Malicious:	false
Reputation:	unknown
URL:	https://www.constructivesoftware.com.au/wp-content/plugins/elementor/assets/css/frontend-legacy.min.css?ver=3.10.1
Preview:	/! elementor - v3.10.1 - 17-01-2023 /..elementor-bc-flex-widget .elementor-section-content-top>.elementor-container>.elementor-row>.elementor-column>.elementor-column-wrap{align-items:flex-start}.elementor-bc-flex-widget .elementor-section-content-middle>.elementor-container>.elementor-row>.elementor-column>.elementor-column-wrap{align-items:center}.elementor-bc-flex-widget .elementor-section-content-bottom>.elementor-container>.elementor-row>.elementor-column>.elementor-column-wrap{align-items:flex-end}.elementor-column-gap-narrow>.elementor-row>.elementor-column>.elementor-element-populated>.elementor-widget-wrap{padding:5px}.elementor-column-gap-default>.elementor-row>.elementor-column>.elementor-element-populated>.elementor-widget-wrap{padding:10px}.elementor-column-gap-extended>.elementor-row>.elementor-column>.elementor-element-populated>.elementor-widget-wrap{padding:15px}.elementor-column-gap-wide>.elementor-row>.elementor-column>.elementor-element-populated>.elementor-widget

Chrome Cache Entry: 178

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (1646)
Category:	downloaded
Size (bytes):	80920
Entropy (8bit):	4.802230932238805
Encrypted:	false
SSDEEP:
MD5:	16F7C4F270036B3CDC5A23193FDE69DF
SHA1:	729F63725F2838FA49CE3F2CA546DE5C59DC8503
SHA-256:	0B47C6F613BFF41662A4AF43E11DD7A291AD7A1FBB2346CBCF6260FC2895C911
SHA-512:	4058CB1B12DFA77C2123D1A127EB7DCF0D0DF33BEA8971A17C78D7E5029CAEC1FB064631A402B8FAFA848AD114FD431F9A63EE3B5556ACD5781D48708EBF82A7
Malicious:	false
Reputation:	unknown
URL:	https://www.constructivesoftware.com.au/wp-content/plugins/th-widget-pack/header-footer/inc/widgets-css/frontend.css?ver=2.2.6
Preview:	/* Navigation Menu CSS */..ul.hfe-nav-menu,..hfe-nav-menu li,..hfe-nav-menu ul {. list-style: none !important;. margin: 0;. padding: 0;.}...hfe-nav-menu li.menu-item {. position: relative;.}...hfe-flyout-container .hfe-nav-menu li.menu-item {. position: relative;. background: unset;.}...hfe-nav-menu .sub-menu li.menu-item {. position: relative;. background: inherit;.}..div.hfe-nav-menu,..elementor-widget-hfe-nav-menu .elementor-widget-container {. -js-display: flex;. display: -webkit-box;. display: -webkit-flex;. display: -moz-box;. display: -ms-flexbox;. display: flex;. -webkit-box-orient: vertical;. -webkit-box-direction: normal;. -webkit-flex-direction: column;. -moz-box-orient: vertical;. -moz-box-direction: normal;. -ms-flex-direction: column;. flex-direction: column;.}...hfe-nav-menu__layout-horizontal,..hfe-nav-menu__layout-horizontal .hfe-nav-menu {. -js-display: flex;. display: -webkit-box;. display: -webk

Static File Info

⊘No static file info

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 51.11.168.232
Source: unknown	TCP traffic detected without corresponding DNS query: 51.11.168.232
Source: unknown	TCP traffic detected without corresponding DNS query: 51.11.168.232
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://constructivesoftware.com.au

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 114

Chrome Cache Entry: 116

Chrome Cache Entry: 117

Chrome Cache Entry: 118

Chrome Cache Entry: 120

Chrome Cache Entry: 121

Chrome Cache Entry: 123

Chrome Cache Entry: 125

Chrome Cache Entry: 127

Chrome Cache Entry: 128

Chrome Cache Entry: 129

Chrome Cache Entry: 130

Chrome Cache Entry: 132

Chrome Cache Entry: 133

Chrome Cache Entry: 134

Chrome Cache Entry: 136

Chrome Cache Entry: 140

Chrome Cache Entry: 141

Chrome Cache Entry: 142

Chrome Cache Entry: 144

Chrome Cache Entry: 145

Chrome Cache Entry: 146

Chrome Cache Entry: 147

Chrome Cache Entry: 148

Chrome Cache Entry: 149

Chrome Cache Entry: 150

Chrome Cache Entry: 151

Chrome Cache Entry: 152

Windows Analysis Report
http://constructivesoftware.com.au