Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
http://kitces.emlnk1.com

Overview

General Information

Sample URL:http://kitces.emlnk1.com
Analysis ID:1569522

Detection

Score:48
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

AI detected phishing page
HTML body contains low number of good links
Stores files to the Windows start menu directory
Suspicious form URL found

Classification

  • System is w10x64_ra
  • chrome.exe (PID: 4812 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • chrome.exe (PID: 6636 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=1896,i,18075148534868740546,2266543650392773339,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • chrome.exe (PID: 6236 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://kitces.emlnk1.com" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • cleanup
No yara matches
No Sigma rule has matched
No Suricata rule has matched

Click to jump to signature section

Show All Signature Results

Phishing

barindex
Source: https://kitces.activehosted.com/admin/Joe Sandbox AI: Score: 7 Reasons: The brand 'Nerd's Eye View KITCES' is associated with financial planning and is known in the financial advisory community., The URL 'kitces.activehosted.com' uses a subdomain of 'activehosted.com', which is a service provider domain, not the primary domain of the brand., The legitimate domain for KITCES is 'kitces.com'., The use of a service provider domain with a subdomain for a brand can be legitimate if the service is used for specific purposes like email marketing or hosting., The presence of input fields for 'Username / Email' and 'Password' on a non-primary domain raises suspicion, as it could be a phishing attempt to capture credentials. DOM: 0.7.pages.csv
Source: https://kitces.activehosted.com/admin/HTTP Parser: Number of links: 0
Source: https://kitces.activehosted.com/admin/HTTP Parser: Form action: login.php
Source: https://kitces.activehosted.com/admin/HTTP Parser: Form action: login.php
Source: https://kitces.activehosted.com/admin/HTTP Parser: Form action: login.php
Source: https://kitces.activehosted.com/admin/HTTP Parser: Form action: login.php
Source: https://kitces.activehosted.com/admin/HTTP Parser: Iframe src: https://solve-widget.forethought.ai/?v=2#src=https%3A%2F%2Fsolve-widget.forethought.ai%2Fembed.js&id=forethought-widget-embed-script&async=&offset-y=90px&offset-x=20px&data-api-key=2310ff96-9b16-4a77-9601-827429c9507c&data-ft-workflow-tag=login&data-ft-originatingdomain=kitces.activehosted.com&data-ft-randomizer=1&config-ft-ignore-persistence-parameters=async%7Cdata-ft-originatingDomain%7Cdata-ft-randomizer
Source: https://kitces.activehosted.com/admin/HTTP Parser: Iframe src: https://solve-widget.forethought.ai/?v=2#src=https%3A%2F%2Fsolve-widget.forethought.ai%2Fembed.js&id=forethought-widget-embed-script&async=&offset-y=90px&offset-x=20px&data-api-key=2310ff96-9b16-4a77-9601-827429c9507c&data-ft-workflow-tag=login&data-ft-originatingdomain=kitces.activehosted.com&data-ft-randomizer=1&config-ft-ignore-persistence-parameters=async%7Cdata-ft-originatingDomain%7Cdata-ft-randomizer
Source: https://kitces.activehosted.com/admin/HTTP Parser: Iframe src: https://solve-widget.forethought.ai/?v=2#src=https%3A%2F%2Fsolve-widget.forethought.ai%2Fembed.js&id=forethought-widget-embed-script&async=&offset-y=90px&offset-x=20px&data-api-key=2310ff96-9b16-4a77-9601-827429c9507c&data-ft-workflow-tag=login&data-ft-originatingdomain=kitces.activehosted.com&data-ft-randomizer=1&config-ft-ignore-persistence-parameters=async%7Cdata-ft-originatingDomain%7Cdata-ft-randomizer
Source: https://kitces.activehosted.com/admin/HTTP Parser: <input type="password" .../> found
Source: https://kitces.activehosted.com/admin/HTTP Parser: No favicon
Source: https://kitces.activehosted.com/admin/HTTP Parser: No favicon
Source: https://kitces.activehosted.com/admin/HTTP Parser: No favicon
Source: https://kitces.activehosted.com/admin/HTTP Parser: No favicon
Source: https://kitces.activehosted.com/admin/HTTP Parser: No <meta name="author".. found
Source: https://kitces.activehosted.com/admin/HTTP Parser: No <meta name="author".. found
Source: https://kitces.activehosted.com/admin/HTTP Parser: No <meta name="author".. found
Source: https://kitces.activehosted.com/admin/HTTP Parser: No <meta name="author".. found
Source: https://kitces.activehosted.com/admin/HTTP Parser: No <meta name="copyright".. found
Source: https://kitces.activehosted.com/admin/HTTP Parser: No <meta name="copyright".. found
Source: https://kitces.activehosted.com/admin/HTTP Parser: No <meta name="copyright".. found
Source: https://kitces.activehosted.com/admin/HTTP Parser: No <meta name="copyright".. found
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: kitces.emlnk1.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global trafficDNS traffic detected: DNS query: kitces.emlnk1.com
Source: global trafficDNS traffic detected: DNS query: kitces.activehosted.com
Source: global trafficDNS traffic detected: DNS query: www.google.com
Source: global trafficDNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global trafficDNS traffic detected: DNS query: platform-cdn.app-us1.com
Source: global trafficDNS traffic detected: DNS query: kitces.com
Source: global trafficDNS traffic detected: DNS query: d226aj4ao1t61q.cloudfront.net
Source: global trafficDNS traffic detected: DNS query: www.kitces.com
Source: global trafficDNS traffic detected: DNS query: static.zdassets.com
Source: global trafficDNS traffic detected: DNS query: cdn.pendo.io
Source: global trafficDNS traffic detected: DNS query: ekr.zdassets.com
Source: global trafficDNS traffic detected: DNS query: solve-widget.forethought.ai
Source: global trafficDNS traffic detected: DNS query: prodhostedtest.zendesk.com
Source: global trafficDNS traffic detected: DNS query: solve-api.forethought.ai
Source: global trafficDNS traffic detected: DNS query: static.cloudflareinsights.com
Source: global trafficDNS traffic detected: DNS query: cloudflareinsights.com
Source: global trafficDNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global trafficDNS traffic detected: DNS query: o185886.ingest.sentry.io
Source: global trafficDNS traffic detected: DNS query: data.pendo.io
Source: global trafficDNS traffic detected: DNS query: d3rxaij56vjege.cloudfront.net
Source: global trafficDNS traffic detected: DNS query: d3tnn7lar6ozas.cloudfront.net
Source: global trafficDNS traffic detected: DNS query: stageac.wpengine.com
Source: global trafficDNS traffic detected: DNS query: www.activecampaign.com
Source: unknownNetwork traffic detected: HTTP traffic on port 49708 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49744
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49865
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49743
Source: unknownNetwork traffic detected: HTTP traffic on port 49817 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49742
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49741
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49862
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49740
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49861
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49860
Source: unknownNetwork traffic detected: HTTP traffic on port 49789 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49800 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49743 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49720 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49852 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49795 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49739
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49859
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49737
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49858
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49736
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49857
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49856
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49734
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49733
Source: unknownNetwork traffic detected: HTTP traffic on port 49841 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49854
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49732
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49853
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49852
Source: unknownNetwork traffic detected: HTTP traffic on port 49732 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49851
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49850
Source: unknownNetwork traffic detected: HTTP traffic on port 49812 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49703 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49858 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49784 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49749 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49806 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49823 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49729
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49849
Source: unknownNetwork traffic detected: HTTP traffic on port 49714 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49727
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49848
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49726
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49847
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49725
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49846
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49724
Source: unknownNetwork traffic detected: HTTP traffic on port 49790 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49845
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49723
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49844
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49722
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49843
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49721
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49842
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49720
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49841
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49840
Source: unknownNetwork traffic detected: HTTP traffic on port 49834 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49748 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49760 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49828 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49805 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49839
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49717
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49838
Source: unknownNetwork traffic detected: HTTP traffic on port 49715 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49837
Source: unknownNetwork traffic detected: HTTP traffic on port 49847 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49715
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49836
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49714
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49835
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49713
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49834
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49712
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49833
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49711
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49832
Source: unknownNetwork traffic detected: HTTP traffic on port 49709 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49710
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49831
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49830
Source: unknownNetwork traffic detected: HTTP traffic on port 49839 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49822 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49726 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49870 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49765 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49853 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49796 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49709
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49708
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49829
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49707
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49828
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49706
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49827
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49826
Source: unknownNetwork traffic detected: HTTP traffic on port 49754 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49825
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49703
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49824
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49702
Source: unknownNetwork traffic detected: HTTP traffic on port 49737 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49823
Source: unknownNetwork traffic detected: HTTP traffic on port 49771 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49701
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49822
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49788
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49787
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49786
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49785
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49784
Source: unknownNetwork traffic detected: HTTP traffic on port 49813 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49783
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49782
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49781
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49780
Source: unknownNetwork traffic detected: HTTP traffic on port 49836 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49785 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49807 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49701 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49713 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49845 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49736 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49791 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49868 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49759 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49779
Source: unknownNetwork traffic detected: HTTP traffic on port 49753 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49778
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49775
Source: unknownNetwork traffic detected: HTTP traffic on port 49707 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49774
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49773
Source: unknownNetwork traffic detected: HTTP traffic on port 49862 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49771
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49770
Source: unknownNetwork traffic detected: HTTP traffic on port 49724 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49742 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49780 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49802 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49851 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49830 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49769
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49768
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49767
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49765
Source: unknownNetwork traffic detected: HTTP traffic on port 49758 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49764
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49763
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49762
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49761
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49760
Source: unknownNetwork traffic detected: HTTP traffic on port 49840 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49702 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49725 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49741 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49857 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49764 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49770 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49797 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49801 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49824 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49759
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49758
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49757
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49756
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49755
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49876
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49754
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49753
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49874
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49752
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49751
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49750
Source: unknownNetwork traffic detected: HTTP traffic on port 49818 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49871
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49870
Source: unknownNetwork traffic detected: HTTP traffic on port 49835 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49786 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49874 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49747 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49829 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49775 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49749
Source: unknownNetwork traffic detected: HTTP traffic on port 49846 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49748
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49747
Source: unknownNetwork traffic detected: HTTP traffic on port 49792 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49868
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49867
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49745
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49866
Source: unknownNetwork traffic detected: HTTP traffic on port 49781 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49769 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49803 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49826 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49717 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49849 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49866 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49820 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49837 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49711 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49763 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49700 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49752 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49798 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49861 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49706 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49712 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49819 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49844 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49787 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49729 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49745 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49793 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49850 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49831 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49751 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49774 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49757 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49782 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49799
Source: unknownNetwork traffic detected: HTTP traffic on port 49734 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49798
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49797
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49796
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49795
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49794
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49793
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49792
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49791
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49790
Source: unknownNetwork traffic detected: HTTP traffic on port 49740 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49856 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49768 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49723 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49825 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49808 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49867 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49789
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49700
Source: unknownNetwork traffic detected: HTTP traffic on port 49733 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49821
Source: unknownNetwork traffic detected: HTTP traffic on port 49865 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49710 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49820
Source: unknownNetwork traffic detected: HTTP traffic on port 49842 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49779 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49727 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49859 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49871 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49762 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49833 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49819
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49818
Source: unknownNetwork traffic detected: HTTP traffic on port 49799 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49817
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49816
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49815
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49813
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49812
Source: unknownNetwork traffic detected: HTTP traffic on port 49816 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49788 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49767 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49721 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49794 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49827 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49876 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49808
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49807
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49806
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49805
Source: unknownNetwork traffic detected: HTTP traffic on port 49848 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49804
Source: unknownNetwork traffic detected: HTTP traffic on port 49773 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49803
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49802
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49801
Source: unknownNetwork traffic detected: HTTP traffic on port 49756 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49739 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49800
Source: unknownNetwork traffic detected: HTTP traffic on port 49783 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49838 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49821 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49815 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49722 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49854 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49860 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49778 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49755 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49843 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49761 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49804 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49744 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49832 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49750 -> 443
Source: classification engineClassification label: mal48.phis.win@19/14@82/363
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=1896,i,18075148534868740546,2266543650392773339,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://kitces.emlnk1.com"
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=1896,i,18075148534868740546,2266543650392773339,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire Infrastructure1
Drive-by Compromise
Windows Management Instrumentation1
Registry Run Keys / Startup Folder
1
Process Injection
1
Masquerading
OS Credential DumpingSystem Service DiscoveryRemote ServicesData from Local System2
Encrypted Channel
Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
Registry Run Keys / Startup Folder
1
Process Injection
LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media2
Non-Application Layer Protocol
Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
Obfuscated Files or Information
Security Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive3
Application Layer Protocol
Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
Ingress Tool Transfer
Traffic DuplicationData Destruction

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand
SourceDetectionScannerLabelLink
http://kitces.emlnk1.com0%Avira URL Cloudsafe
No Antivirus matches
No Antivirus matches
No Antivirus matches
SourceDetectionScannerLabelLink
http://kitces.emlnk1.com/0%Avira URL Cloudsafe
NameIPActiveMaliciousAntivirus DetectionReputation
solve-ui.pages.dev
172.66.47.81
truefalse
    unknown
    prodhostedtest.zendesk.com
    216.198.54.1
    truefalse
      high
      cloudflareinsights.com
      104.16.80.73
      truefalse
        high
        a.nel.cloudflare.com
        35.190.80.1
        truefalse
          high
          www.kitces.com
          104.26.15.50
          truefalse
            high
            static.cloudflareinsights.com
            104.16.79.73
            truefalse
              high
              o185886.ingest.sentry.io
              34.120.195.249
              truefalse
                high
                d3rxaij56vjege.cloudfront.net
                13.227.9.185
                truefalse
                  high
                  www.activecampaign.com
                  104.20.1.15
                  truefalse
                    high
                    d226aj4ao1t61q.cloudfront.net
                    13.227.9.180
                    truefalse
                      high
                      stageac.wpengine.com
                      34.68.147.250
                      truefalse
                        unknown
                        kitces.emlnk1.com
                        54.225.69.136
                        truefalse
                          high
                          static.zdassets.com
                          216.198.54.3
                          truefalse
                            high
                            cdn.pendo.io
                            34.36.213.229
                            truefalse
                              unknown
                              kitces.activehosted.com
                              104.17.206.31
                              truefalse
                                high
                                data.pendo.io
                                34.107.204.85
                                truefalse
                                  unknown
                                  cdnjs.cloudflare.com
                                  104.17.24.14
                                  truefalse
                                    high
                                    kitces.com
                                    104.26.15.50
                                    truetrue
                                      unknown
                                      solve-api.forethought.ai
                                      104.17.255.3
                                      truefalse
                                        high
                                        ekr.zdassets.com
                                        216.198.54.3
                                        truefalse
                                          high
                                          www.google.com
                                          142.250.181.68
                                          truefalse
                                            high
                                            d3r4ionp7m7mlj.cloudfront.net
                                            52.84.45.17
                                            truefalse
                                              unknown
                                              d3tnn7lar6ozas.cloudfront.net
                                              18.165.213.148
                                              truefalse
                                                high
                                                solve-widget.forethought.ai
                                                unknown
                                                unknownfalse
                                                  high
                                                  platform-cdn.app-us1.com
                                                  unknown
                                                  unknownfalse
                                                    unknown
                                                    NameMaliciousAntivirus DetectionReputation
                                                    https://kitces.activehosted.com/admin/true
                                                      unknown
                                                      http://kitces.emlnk1.com/false
                                                      • Avira URL Cloud: safe
                                                      unknown
                                                      • No. of IPs < 25%
                                                      • 25% < No. of IPs < 50%
                                                      • 50% < No. of IPs < 75%
                                                      • 75% < No. of IPs
                                                      IPDomainCountryFlagASNASN NameMalicious
                                                      172.217.19.206
                                                      unknownUnited States
                                                      15169GOOGLEUSfalse
                                                      172.217.19.227
                                                      unknownUnited States
                                                      15169GOOGLEUSfalse
                                                      52.84.45.17
                                                      d3r4ionp7m7mlj.cloudfront.netUnited States
                                                      55960BJ-GUANGHUAN-APBeijingGuanghuanXinwangDigitalCNfalse
                                                      34.36.213.229
                                                      cdn.pendo.ioUnited States
                                                      2686ATGS-MMD-ASUSfalse
                                                      34.68.147.250
                                                      stageac.wpengine.comUnited States
                                                      15169GOOGLEUSfalse
                                                      104.16.80.73
                                                      cloudflareinsights.comUnited States
                                                      13335CLOUDFLARENETUSfalse
                                                      104.17.206.31
                                                      kitces.activehosted.comUnited States
                                                      13335CLOUDFLARENETUSfalse
                                                      142.250.181.68
                                                      www.google.comUnited States
                                                      15169GOOGLEUSfalse
                                                      35.190.80.1
                                                      a.nel.cloudflare.comUnited States
                                                      15169GOOGLEUSfalse
                                                      104.26.14.50
                                                      unknownUnited States
                                                      13335CLOUDFLARENETUSfalse
                                                      104.16.79.73
                                                      static.cloudflareinsights.comUnited States
                                                      13335CLOUDFLARENETUSfalse
                                                      142.250.181.42
                                                      unknownUnited States
                                                      15169GOOGLEUSfalse
                                                      104.20.1.15
                                                      www.activecampaign.comUnited States
                                                      13335CLOUDFLARENETUSfalse
                                                      104.17.24.14
                                                      cdnjs.cloudflare.comUnited States
                                                      13335CLOUDFLARENETUSfalse
                                                      34.107.204.85
                                                      data.pendo.ioUnited States
                                                      15169GOOGLEUSfalse
                                                      1.1.1.1
                                                      unknownAustralia
                                                      13335CLOUDFLARENETUSfalse
                                                      172.217.17.35
                                                      unknownUnited States
                                                      15169GOOGLEUSfalse
                                                      142.250.181.142
                                                      unknownUnited States
                                                      15169GOOGLEUSfalse
                                                      104.17.255.3
                                                      solve-api.forethought.aiUnited States
                                                      13335CLOUDFLARENETUSfalse
                                                      142.250.181.123
                                                      unknownUnited States
                                                      15169GOOGLEUSfalse
                                                      54.225.69.136
                                                      kitces.emlnk1.comUnited States
                                                      14618AMAZON-AESUSfalse
                                                      172.217.19.234
                                                      unknownUnited States
                                                      15169GOOGLEUSfalse
                                                      104.17.1.4
                                                      unknownUnited States
                                                      13335CLOUDFLARENETUSfalse
                                                      18.165.213.148
                                                      d3tnn7lar6ozas.cloudfront.netUnited States
                                                      3MIT-GATEWAYSUSfalse
                                                      18.165.213.147
                                                      unknownUnited States
                                                      3MIT-GATEWAYSUSfalse
                                                      239.255.255.250
                                                      unknownReserved
                                                      unknownunknownfalse
                                                      172.66.47.81
                                                      solve-ui.pages.devUnited States
                                                      13335CLOUDFLARENETUSfalse
                                                      216.198.54.3
                                                      static.zdassets.comUnited States
                                                      7321LNET-ASNUSfalse
                                                      13.227.9.180
                                                      d226aj4ao1t61q.cloudfront.netUnited States
                                                      16509AMAZON-02USfalse
                                                      216.198.54.1
                                                      prodhostedtest.zendesk.comUnited States
                                                      7321LNET-ASNUSfalse
                                                      104.26.15.50
                                                      www.kitces.comUnited States
                                                      13335CLOUDFLARENETUStrue
                                                      172.66.44.175
                                                      unknownUnited States
                                                      13335CLOUDFLARENETUSfalse
                                                      173.194.220.84
                                                      unknownUnited States
                                                      15169GOOGLEUSfalse
                                                      142.250.181.99
                                                      unknownUnited States
                                                      15169GOOGLEUSfalse
                                                      34.120.195.249
                                                      o185886.ingest.sentry.ioUnited States
                                                      15169GOOGLEUSfalse
                                                      104.17.25.14
                                                      unknownUnited States
                                                      13335CLOUDFLARENETUSfalse
                                                      13.227.9.185
                                                      d3rxaij56vjege.cloudfront.netUnited States
                                                      16509AMAZON-02USfalse
                                                      104.20.0.15
                                                      unknownUnited States
                                                      13335CLOUDFLARENETUSfalse
                                                      IP
                                                      192.168.2.17
                                                      Joe Sandbox version:41.0.0 Charoite
                                                      Analysis ID:1569522
                                                      Start date and time:2024-12-05 20:06:34 +01:00
                                                      Joe Sandbox product:CloudBasic
                                                      Overall analysis duration:
                                                      Hypervisor based Inspection enabled:false
                                                      Report type:full
                                                      Cookbook file name:defaultwindowsinteractivecookbook.jbs
                                                      Sample URL:http://kitces.emlnk1.com
                                                      Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                      Number of analysed new started processes analysed:13
                                                      Number of new started drivers analysed:0
                                                      Number of existing processes analysed:0
                                                      Number of existing drivers analysed:0
                                                      Number of injected processes analysed:0
                                                      Technologies:
                                                      • EGA enabled
                                                      Analysis Mode:stream
                                                      Analysis stop reason:Timeout
                                                      Detection:MAL
                                                      Classification:mal48.phis.win@19/14@82/363
                                                      • Exclude process from analysis (whitelisted): svchost.exe
                                                      • Excluded IPs from analysis (whitelisted): 172.217.19.227, 173.194.220.84, 142.250.181.142, 172.217.17.78
                                                      • Excluded domains from analysis (whitelisted): clients2.google.com, accounts.google.com, redirector.gvt1.com, clientservices.googleapis.com, clients.l.google.com
                                                      • Not all processes where analyzed, report is missing behavior information
                                                      • VT rate limit hit for: http://kitces.emlnk1.com
                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Dec 5 18:07:05 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                                      Category:dropped
                                                      Size (bytes):2673
                                                      Entropy (8bit):3.991365576056972
                                                      Encrypted:false
                                                      SSDEEP:
                                                      MD5:8929A610E270805419970FDE8C0EB0E7
                                                      SHA1:F3DEBFFC892C9262C34DD20B4BA250C5C3D77183
                                                      SHA-256:15467F947E46A09EEEF9B814B7AD8DF971CA8632366E3409E6F638FE9D6F5782
                                                      SHA-512:607D34353AB0D2EAB1122EBC4E04CFA5DC36CD8A5CAAB605457A163A490A0B9A62447464E73C61F2A55ABF547967DC1D462E1384947257E8EDDB9F8EFFA9BE07
                                                      Malicious:false
                                                      Reputation:unknown
                                                      Preview:L..................F.@.. ...$+.,.....\..HG..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Dec 5 18:07:04 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                                      Category:dropped
                                                      Size (bytes):2675
                                                      Entropy (8bit):4.010072005013525
                                                      Encrypted:false
                                                      SSDEEP:
                                                      MD5:4C05476538A20A691D7A8E47F528295A
                                                      SHA1:B5A109EBE4DE25BEED8518C1E4FCBDAEF1385C34
                                                      SHA-256:A23150C311BD0168B96B57F63E14FE2AD21D0298085383BC2AB4330BBF5FAD8D
                                                      SHA-512:22CC2F2EEDDEDF98D724246E42BDB509C9BC4D2D37E12B964908526432A17AA90CA21901269836DDBA891C4821F293204FFBA152887F1534D8901E738E75D5F8
                                                      Malicious:false
                                                      Reputation:unknown
                                                      Preview:L..................F.@.. ...$+.,......v.HG..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                                      Category:dropped
                                                      Size (bytes):2689
                                                      Entropy (8bit):4.014816221307741
                                                      Encrypted:false
                                                      SSDEEP:
                                                      MD5:45675EEB2CAEE9041F665BDF56EB399F
                                                      SHA1:B33F74317CAA3303B9C6D471CC1B397ED8429E4F
                                                      SHA-256:AD312A7D789C0B7230C81C95627CB3A459A767455102005CAC84C8B339608033
                                                      SHA-512:F3BFE3B5B6EFAAEAE9040660BDA2D5FE33D3617E539EDDDFEB4E8F2C55844CDCC88F1760830DABBE4FF9B227F86AAA7A3838704058B0E66CB5573936133397E2
                                                      Malicious:false
                                                      Reputation:unknown
                                                      Preview:L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Dec 5 18:07:04 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                                      Category:dropped
                                                      Size (bytes):2677
                                                      Entropy (8bit):4.007347027699564
                                                      Encrypted:false
                                                      SSDEEP:
                                                      MD5:B5CEA4E24E92A34638381C12971A362A
                                                      SHA1:1AC564EF89C5FC1A754556EF2105241362C4DD0C
                                                      SHA-256:8892D720E5222B9BBED9B7172D029E79A136AEC32499916835F44651E65CE732
                                                      SHA-512:715AD59A135D13F119F78B0859E52F94C478B899897F48EEC108F31CF7C2203CC1CF22EB5BECB3D690965EB600675B02A22B58DB036FA29CE7A3D4AD90066A7C
                                                      Malicious:false
                                                      Reputation:unknown
                                                      Preview:L..................F.@.. ...$+.,.....q.HG..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Dec 5 18:07:05 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                                      Category:dropped
                                                      Size (bytes):2677
                                                      Entropy (8bit):3.9948492678370213
                                                      Encrypted:false
                                                      SSDEEP:
                                                      MD5:F59A9D6A1E50B1110CEE34521AA22818
                                                      SHA1:7790ABFF5D49EE9371A0DBCA3C9B5817067F9EF0
                                                      SHA-256:DE5DCDF566E1BB95899452268BB9011FE90CFE65A5AAACC018372CE13B3C0C2D
                                                      SHA-512:9F1544C32B08D52CFDDB9EC8A40B87954161C0F20148C1A9D2E0EB34478C3751AAB4A1916FD6DFC4F6C9F175A96330CFFC6C4CAEDC37D11B76ADC5E738E4AA48
                                                      Malicious:false
                                                      Reputation:unknown
                                                      Preview:L..................F.@.. ...$+.,....f.|.HG..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Dec 5 18:07:04 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                                      Category:dropped
                                                      Size (bytes):2679
                                                      Entropy (8bit):4.001933730434463
                                                      Encrypted:false
                                                      SSDEEP:
                                                      MD5:B2E837B5BAA3F556E1BB6D90E5C4A213
                                                      SHA1:BBA546164998626BAFEB52B23CBCAA7062D6BD6F
                                                      SHA-256:14EEA09B18E7F4BC66D3B4E9CCC05D8B12CED5AC4A9B88877344F28CF9282E74
                                                      SHA-512:8370AE1B014CD9C24A91DADE9DB3ED74097FC962AC8C4BE6B309108DAD5475ADED431C89E2E80B64DD02C0EF5A2BE2E1983404EF3C0C82998B720501E6C1830D
                                                      Malicious:false
                                                      Reputation:unknown
                                                      Preview:L..................F.@.. ...$+.,....K.h.HG..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      File Type:ASCII text, with very long lines (10277), with no line terminators
                                                      Category:dropped
                                                      Size (bytes):10277
                                                      Entropy (8bit):5.352878238195692
                                                      Encrypted:false
                                                      SSDEEP:
                                                      MD5:6EE6BAFD5311611F1980BB49422BBFC9
                                                      SHA1:78DA648B4412D84FE6A7CBC399770AD42F84ECB2
                                                      SHA-256:2B6BA0E6EED66AB5345210B7D09665AD5AB7E8B737B6F6CB0AE65D267372CC44
                                                      SHA-512:84CFC5756833756FCBC4B1BACA0567E5F134C16B9AA39B25E3F88D01C3E569848B0A5C06AA0FAD217ECBBED24AA1DC722500724C217707DD976D33226DEFB30D
                                                      Malicious:false
                                                      Reputation:unknown
                                                      Preview:"use strict";(globalThis.webpackChunk_zendesk_web_widget_messenger=globalThis.webpackChunk_zendesk_web_widget_messenger||[]).push([[8173],{66515:(e,t,n)=>{n.d(t,{A:()=>o});var r=n(88910);const o=()=>{const[e,t]=(0,r.useState)(Math.round(100*window.devicePixelRatio)),n=()=>{t(Math.round(100*window.devicePixelRatio))};return(0,r.useEffect)((()=>(window.addEventListener("resize",n),()=>{window.removeEventListener("resize",n)})),[]),{scale:e>=400?.5:1,isZoomedIn:e>=400}}},99317:(e,t,n)=>{n.d(t,{A:()=>h});var r=n(20912),o=n(70069),i=n(26436),s=n(66515),a=n(7533),c=n(32731),d=n(7087),l=n(52295),m=n(86222);const h=({children:e,ariaLabel:t})=>{const n=(0,r.d4)(l.E9),h=(0,r.d4)(l.fl),u=(0,r.d4)(c.iG),{vertical:g,horizontal:f}=(0,r.d4)(l.XI),p=g>i.G1,x=a.A.isRTL()?"rtl":"ltr",{isZoomedIn:y}=(0,s.A)();return(0,m.jsx)("div",{"aria-label":t,style:{display:"flex",flexDirection:"column",zIndex:h,bottom:u===o.Fe.none?g:(0,d.Uc)(Number(g)),position:"fixed",[n]:f,direction:x,alignItems:"end",gap:i.x5,..
                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      File Type:ASCII text, with very long lines (737)
                                                      Category:downloaded
                                                      Size (bytes):787
                                                      Entropy (8bit):5.272099286351133
                                                      Encrypted:false
                                                      SSDEEP:
                                                      MD5:B8AA01718BCC94EDB98CDB82B501DB8D
                                                      SHA1:399DDCE83E431E355AF429B05B96E13D19365A57
                                                      SHA-256:B62FB1AB438254E57BBA0E4A2D866F53CB2C6AA8AB25031CC3580A636AD32D9B
                                                      SHA-512:AD79E6DC40B31AA14C16A1CA15A119C471AE7899C63A5B962949309EE2BDC2FDFF93C8327931CCE0BC55DF10E27D06CB856FF3056B04763C61CA5174E8623A73
                                                      Malicious:false
                                                      Reputation:unknown
                                                      URL:https://solve-widget.forethought.ai/static/css/192.9941203c.chunk.css
                                                      Preview:@font-face{font-display:swap;font-family:Plus Jakarta Sans;font-style:normal;font-weight:200 800;src:url(/static/media/PlusJakartaSans[wght].892556e07963b2d4849a.woff2) format("woff2") tech("variations"),url(/static/media/PlusJakartaSans[wght].892556e07963b2d4849a.woff2) format("woff2-variations")}@font-face{font-display:swap;font-family:Plus Jakarta Sans Italic;font-style:italic;font-weight:200 800;src:url(/static/media/PlusJakartaSans-Italic[wght].084b925b159dbb6c76b1.woff2) format("woff2") tech("variations"),url(/static/media/PlusJakartaSans-Italic[wght].084b925b159dbb6c76b1.woff2) format("woff2-variations")}em,i{font-family:"Plus Jakarta Sans Italic",var(--font-fallback);font-synthesis:none;font-variation-settings:"ital" 1}./*# sourceMappingURL=192.9941203c.chunk.css.map*/
                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      File Type:JSON data
                                                      Category:dropped
                                                      Size (bytes):927
                                                      Entropy (8bit):4.930306964658535
                                                      Encrypted:false
                                                      SSDEEP:
                                                      MD5:44211C7CCF112FC5AA029C1A9BC8C7E7
                                                      SHA1:C3E9165E16301A21EEA18FAE3610A402EDC23A68
                                                      SHA-256:8FD196D41A7288306E0B643E011034F4CDBC491510407951290658555AD311C3
                                                      SHA-512:30629587CC6C64BEFFF951BC901EA7B02D108BD49366F8E194AE48D9BBF1BC1E5764E209051D811B784CC3B7DE6BCEF5263E2398AC3A249930BBA368A13E6F20
                                                      Malicious:false
                                                      Reputation:unknown
                                                      Preview:{"features":{"conversationTicketMetadata":true,"fastLoad":true,"multiConvoEnabled":true},"messenger":{"integrationId":"651edd8f5f5e9b98d7077f4f","appId":"6185c3c6587c5300e119773e","position":"right","conversationHistory":"forget","color":{"primary":"#000cff","action":"#000cff","message":"#00363d"},"title":"ActiveCampaign","description":"How can we help?","avatar":"https://prodhostedtest.zendesk.com/embeddable/avatars/10718314379804","launcher":{"text":"","showTextInMobile":false,"shape":"circle","shapeSettings":null},"baseUrl":"https://prodhostedtest.zendesk.com/sc/sdk","channelLinkingEnabled":false,"showZendeskLogo":false,"attachmentsEnabled":true,"canUserCreateMoreConversations":true,"canUserSeeConversationList":true,"frameBorderRadius":"16","proactiveMessagingEnabled":false,"soundNotificationEnabled":true,"positionOffset":{"web":{"vertical":"16","horizontal":"16"},"mobile":{"vertical":"16","horizontal":"16"}}}}
                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      File Type:ASCII text
                                                      Category:downloaded
                                                      Size (bytes):12840
                                                      Entropy (8bit):5.588954395447791
                                                      Encrypted:false
                                                      SSDEEP:
                                                      MD5:7CFA080356587BA8FD518EB778675ADB
                                                      SHA1:103FD0FEA56F49C60F4A7B40984ACCCC77FF944E
                                                      SHA-256:43C5D69A8FE2E1956C1954B8E24A99AF2130E9273C4868F1F89E86F078FF55AE
                                                      SHA-512:5F7E1795FCBF2DB56FD4C01A533EA009A49B976B21B4F2C94E6EFF59198FC0D465C38CC176F0FEE27700941CBF46D0C06152F8964B92B24B577A1B2CE50A2CAB
                                                      Malicious:false
                                                      Reputation:unknown
                                                      URL:"https://fonts.googleapis.com/css?family=IBM+Plex+Sans:200,300,400,500,600,700"
                                                      Preview:/* cyrillic-ext */.@font-face {. font-family: 'IBM Plex Sans';. font-style: normal;. font-weight: 200;. src: url(https://fonts.gstatic.com/s/ibmplexsans/v19/zYX9KVElMYYaJe8bpLHnCwDKjR7_AIxsdO_q.woff2) format('woff2');. unicode-range: U+0460-052F, U+1C80-1C8A, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;.}./* cyrillic */.@font-face {. font-family: 'IBM Plex Sans';. font-style: normal;. font-weight: 200;. src: url(https://fonts.gstatic.com/s/ibmplexsans/v19/zYX9KVElMYYaJe8bpLHnCwDKjR7_AIVsdO_q.woff2) format('woff2');. unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;.}./* greek */.@font-face {. font-family: 'IBM Plex Sans';. font-style: normal;. font-weight: 200;. src: url(https://fonts.gstatic.com/s/ibmplexsans/v19/zYX9KVElMYYaJe8bpLHnCwDKjR7_AIJsdO_q.woff2) format('woff2');. unicode-range: U+0370-0377, U+037A-037F, U+0384-038A, U+038C, U+038E-03A1, U+03A3-03FF;.}./* vietnamese */.@font-face {. font-family: 'IBM Plex Sans';. font-style: normal;. f
                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      File Type:ASCII text, with no line terminators
                                                      Category:downloaded
                                                      Size (bytes):28
                                                      Entropy (8bit):4.066108939837481
                                                      Encrypted:false
                                                      SSDEEP:
                                                      MD5:D59DE2F2B1F18AFAAB6EFBB5E8D7DB42
                                                      SHA1:77587B981A047955407905358D39950877368CC9
                                                      SHA-256:E5D91D35F7D93D22881F28575657D7928D6A63A6381EB58B9759935171CD6A0D
                                                      SHA-512:8D1BFAB6D22907F036BA0B8B5AF1B8FA1738C2F761B7373B93DBEF8790131844379206060CEA0CB059AA6D566A2FCDA102D391B0740F4618A573047BE660808A
                                                      Malicious:false
                                                      Reputation:unknown
                                                      URL:https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISFwl6sThT9smJaxIFDQiEZ_ESBQ3Fk8Qk?alt=proto
                                                      Preview:ChIKBw0IhGfxGgAKBw3Fk8QkGgA=
                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      File Type:ASCII text, with very long lines (581)
                                                      Category:downloaded
                                                      Size (bytes):39824
                                                      Entropy (8bit):5.045873983753402
                                                      Encrypted:false
                                                      SSDEEP:
                                                      MD5:28A95E36CEA25EAA2230E9E63E06BC22
                                                      SHA1:29E45B17A2C6C4C59B4A2F8EAFD64741BD44AF10
                                                      SHA-256:906CFBDA5764425918166E43023816EA52E998EC45C720E815083A78807DC925
                                                      SHA-512:C7C3E02FC2AE0A65817AC4716BB42420D858864B93566611E1CE6BD88A3E7FB5A0E0067D0F80A9CDA64DA5C50FFCD5AEE40A6BE2BBE27EC217C16BC1FF3EEA7A
                                                      Malicious:false
                                                      Reputation:unknown
                                                      URL:https://kitces.activehosted.com/admin/css/header.css?v=v1026811526959923
                                                      Preview:/*..Global admin header. */.../*------------------------------------*\. Framework.\*------------------------------------*/.#page_header {position:fixed; top:0; width:100%; margin:0; padding:0; background:#274C7C; height:64px; zoom:1; z-index:990;}.#page_header:after {position:relative; content:''; display:table; clear:both; zoom:1;}.#page_header .hdrwrap {position:relative; display:table; top:0; margin:0; padding:0; height:58px; width:100%; min-width:1024px; left:0!important; right:0!important;}.#page_header .hdrwrap .logo {position:absolute; display:table-cell; top:0; left:0; margin:0; padding:14px 14px 13px 14px; width:40px; height:36px; background: #508CD6;color:#fff;font-size: 29px;cursor:pointer;line-height:37px;text-decoration:none; z-index:100;}.#page_header .hdrwrap .logo.custom-logo { padding:0;background:none;}.#page_header .hdrwrap .logo:hover {background:#3F77BC;}.#page_header .hdrwrap .logo.custom-logo:hover {background:none;}../*------------------------------------*\.
                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      File Type:ASCII text, with very long lines (307)
                                                      Category:downloaded
                                                      Size (bytes):47585
                                                      Entropy (8bit):5.265462522776657
                                                      Encrypted:false
                                                      SSDEEP:
                                                      MD5:B18E0AE8A5E893AC4A0A627AAB0B1E77
                                                      SHA1:5F9A5AF4087A771960E2C0D48D9E8A1BED836A75
                                                      SHA-256:A8EF97C3C11D3D216259ACCFB864BD5360EF771AEF244922331993EBA0C35AA8
                                                      SHA-512:1CD2156699D2DDE75706FE1771CA0E3072ED9D9FF3011262B3A256457CF62A04414A99947CB9EC672FD16CF5E979E586235D0E51631E487A8853F09F66D85209
                                                      Malicious:false
                                                      Reputation:unknown
                                                      URL:https://kitces.activehosted.com/admin/js/functions.js?v=v1026811526959923
                                                      Preview:function console_log() {..// attempt to send a message to the console..try {...for(var i =0; i < arguments.length; i++) {....console.log(arguments[i]);...}..} catch(e) {} // fail gracefully if it does not exist..}..function form_branding_delete(plan, rsid, formid) {..if (!plan && !rsid ) {...alert(strFormUpgrade);..} else {...form_part_delete("branding",formid);..}.}..function jump(url) {..ac_loader_show();..window.location = url;.}..../*. CLONER FUNCTIONS.*/..function clone_1st_element(node, elem, clearInputs) {..return ac_dom_clone_node(node, elem, 0, clearInputs);.}..function clone_1st_div(node) {..return clone_1st_element(node, 'div', true);.}..function clone_1st_tr(node) {..return clone_1st_element(node, 'tr', false);.}..function clear_inputs(node) {..$J('input', node).each(function(i) {...var o = $J(this);...var t = o.attr('type');...if (t == 'text' || t == 'file') o.val('');..});.}..function clear_selects(node) {..$J('select', node).each(function(i) {...this.selectedIndex = -
                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      File Type:JSON data
                                                      Category:dropped
                                                      Size (bytes):31
                                                      Entropy (8bit):3.86469832616696
                                                      Encrypted:false
                                                      SSDEEP:
                                                      MD5:2D7D30EA1C6F925302D2C3ABED382951
                                                      SHA1:5BA6BBC5670C4AF1125CF9AC0AA1CA2811E744D1
                                                      SHA-256:83C09BA9A8DAEDB136F90B17A294CAA90AD471A016E430DF6E229ACB5A81E100
                                                      SHA-512:BCC7AAA8A6A27ADCBD1B3E0FCA73FC1BD727FECEAB34734E99863503D1D50936A8830C0A12D75D187614F318F46B1E67F046E89F5EB6CE727D8433A722E2C525
                                                      Malicious:false
                                                      Reputation:unknown
                                                      Preview:{"detail":"Method Not Allowed"}
                                                      No static file info