Edit tour

Windows Analysis Report
http://www.mynylgbs.com

Overview

General Information

Sample URL:	http://www.mynylgbs.com
Analysis ID:	1577472

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

AI detected suspicious URL

HTML body contains low number of good links

HTML body contains password input but no form action

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6184 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5400 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1948,i,7578235759507348259,16080462130510690529,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5636 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://www.mynylgbs.com" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected phishing page

Source: https://www.mynylgbs.com/auth/employee-benefits/login	Joe Sandbox AI: Score: 7 Reasons: The brand 'New York Life' is a well-known insurance company., The legitimate domain for New York Life is 'newyorklife.com'., The provided URL 'www.mynylgbs.com' does not match the legitimate domain., The URL contains unusual elements and does not resemble the legitimate domain., The presence of login fields (Username, Password) on a suspicious URL is a common phishing tactic. DOM: 2.6.pages.csv
Source: https://www.mynylgbs.com/auth/employee-benefits/login	Joe Sandbox AI: Score: 7 Reasons: The brand 'New York Life' is a well-known insurance company., The legitimate domain for New York Life is 'newyorklife.com'., The provided URL 'www.mynylgbs.com' does not match the legitimate domain., The URL contains unusual elements and does not clearly relate to the brand., The presence of login fields (Username, Password) on a suspicious URL is a common phishing tactic. DOM: 2.9.pages.csv

AI detected suspicious URL

Source: Email	Joe Sandbox AI: AI detected Brand spoofing attempt in URL: https://www.mynylgbs.com
Source: Email	Joe Sandbox AI: AI detected Typosquatting in URL: https://www.mynylgbs.com

Source: https://www.mynylgbs.com/auth/employee-benefits/login

HTTP Parser: Number of links: 1

Source: https://www.mynylgbs.com/auth/employee-benefits/login

HTTP Parser: <input type="password" .../> found but no <form action="...

Source: https://www.mynylgbs.com/auth/employee-benefits/login	HTTP Parser: Iframe src: javascript:void(0)
Source: https://www.mynylgbs.com/auth/employee-benefits/login	HTTP Parser: Iframe src: javascript:void(0)

Source: https://www.mynylgbs.com/auth/employee-benefits/login

HTTP Parser: <input type="password" .../> found

Source: https://www.mynylgbs.com/auth	HTTP Parser: No favicon
Source: https://www.mynylgbs.com/auth	HTTP Parser: No favicon
Source: https://www.mynylgbs.com/auth/employee-benefits/login	HTTP Parser: No favicon
Source: https://www.mynylgbs.com/auth/employee-benefits/login	HTTP Parser: No favicon

Source: https://www.mynylgbs.com/auth/employee-benefits/login	HTTP Parser: No <meta name="author".. found
Source: https://www.mynylgbs.com/auth/employee-benefits/login	HTTP Parser: No <meta name="author".. found

Source: https://www.mynylgbs.com/auth/employee-benefits/login	HTTP Parser: No <meta name="copyright".. found
Source: https://www.mynylgbs.com/auth/employee-benefits/login	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 92.122.16.236:443 -> 192.168.2.16:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49793 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.16.236
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.16.236
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.16.236
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.16.236
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.16.236
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.16.236
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: www.mynylgbs.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: assets.adobedtm.com
Source: global traffic	DNS traffic detected: DNS query: cdn.appdynamics.com
Source: global traffic	DNS traffic detected: DNS query: s2.go-mpulse.net
Source: global traffic	DNS traffic detected: DNS query: c.go-mpulse.net
Source: global traffic	DNS traffic detected: DNS query: st.newyorklife.com
Source: global traffic	DNS traffic detected: DNS query: t.contentsquare.net
Source: global traffic	DNS traffic detected: DNS query: csxd.contentsquare.net
Source: global traffic	DNS traffic detected: DNS query: ct.contentsquare.net
Source: global traffic	DNS traffic detected: DNS query: 684d0d4c.akstat.io
Source: global traffic	DNS traffic detected: DNS query: c.contentsquare.net
Source: global traffic	DNS traffic detected: DNS query: q-aus1.contentsquare.net
Source: global traffic	DNS traffic detected: DNS query: srm.bf.contentsquare.net
Source: global traffic	DNS traffic detected: DNS query: baxhxpiccrce6z3cxs6a-f-fe8d06862-clientnsv4-s.akamaihd.net
Source: global traffic	DNS traffic detected: DNS query: 684d0d42.akstat.io
Source: global traffic	DNS traffic detected: DNS query: k-aus1.contentsquare.net
Source: global traffic	DNS traffic detected: DNS query: pdx-col.eum-appdynamics.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49696
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443

Source: unknown	HTTPS traffic detected: 92.122.16.236:443 -> 192.168.2.16:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49793 version: TLS 1.2

Source: classification engine

Classification label: mal52.phis.win@22/33@73/295

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1948,i,7578235759507348259,16080462130510690529,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://www.mynylgbs.com"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1948,i,7578235759507348259,16080462130510690529,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Drive-by Compromise	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
http://www.mynylgbs.com	0%	Avira URL Cloud	safe

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
srm.bf.contentsquare.net	52.207.135.202	true	false	high
cdn.appdynamics.com	18.66.161.97	true	false	high
c.ba.contentsquare.net	34.249.87.52	true	false	high
newyorklife.com.ssl.d1.sc.omtrdc.net	63.140.62.27	true	false	unknown
www.google.com	172.217.19.228	true	false	high
col.eum-appdynamics.com	54.189.174.176	true	false	high
k.bf.contentsquare.net	23.21.147.114	true	false	unknown
t.contentsquare.net	108.139.60.60	true	false	high
d1lq7gghpl2sd6.cloudfront.net	13.227.8.112	true	false	unknown
d1xbuscas8tetl.cloudfront.net	3.160.77.84	true	false	unknown
q-aus1.contentsquare.net	52.0.173.180	true	false	high
s2.go-mpulse.net	unknown	unknown	false	unknown
684d0d4c.akstat.io	unknown	unknown	false	unknown
assets.adobedtm.com	unknown	unknown	false	high
st.newyorklife.com	unknown	unknown	false	unknown
csxd.contentsquare.net	unknown	unknown	false	unknown
baxhxpiccrce6z3cxs6a-f-fe8d06862-clientnsv4-s.akamaihd.net	unknown	unknown	false	unknown
pdx-col.eum-appdynamics.com	unknown	unknown	false	unknown
ct.contentsquare.net	unknown	unknown	false	unknown
k-aus1.contentsquare.net	unknown	unknown	false	high
www.mynylgbs.com	unknown	unknown	true	unknown
c.contentsquare.net	unknown	unknown	false	high
c.go-mpulse.net	unknown	unknown	false	high
684d0d42.akstat.io	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.mynylgbs.com/auth/employee-benefits/login	true		unknown
https://www.mynylgbs.com/auth	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.217.19.228	www.google.com	United States	15169	GOOGLEUS	false
2.20.68.79	unknown	European Union	37457	Telkom-InternetZA	false
108.139.60.60	t.contentsquare.net	United States	16509	AMAZON-02US	false
3.160.77.3	unknown	United States	16509	AMAZON-02US	false
172.217.19.206	unknown	United States	15169	GOOGLEUS	false
104.121.2.245	unknown	United States	16625	AKAMAI-ASUS	false
172.217.17.67	unknown	United States	15169	GOOGLEUS	false
52.0.173.180	q-aus1.contentsquare.net	United States	14618	AMAZON-AESUS	false
52.222.144.85	unknown	United States	16509	AMAZON-02US	false
172.217.19.202	unknown	United States	15169	GOOGLEUS	false
142.250.181.132	unknown	United States	15169	GOOGLEUS	false
63.140.62.27	newyorklife.com.ssl.d1.sc.omtrdc.net	United States	15224	OMNITUREUS	false
64.233.164.84	unknown	United States	15169	GOOGLEUS	false
23.218.208.236	unknown	United States	6453	AS6453US	false
63.140.62.222	unknown	United States	15224	OMNITUREUS	false
3.225.182.165	unknown	United States	14618	AMAZON-AESUS	false
23.195.38.175	unknown	United States	20940	AKAMAI-ASN1EU	false
23.21.147.114	k.bf.contentsquare.net	United States	14618	AMAZON-AESUS	false
13.227.8.112	d1lq7gghpl2sd6.cloudfront.net	United States	16509	AMAZON-02US	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
172.217.17.78	unknown	United States	15169	GOOGLEUS	false
172.217.17.35	unknown	United States	15169	GOOGLEUS	false
3.160.77.84	d1xbuscas8tetl.cloudfront.net	United States	16509	AMAZON-02US	false
18.66.161.97	cdn.appdynamics.com	United States	3	MIT-GATEWAYSUS	false
52.207.135.202	srm.bf.contentsquare.net	United States	14618	AMAZON-AESUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
34.194.6.158	unknown	United States	14618	AMAZON-AESUS	false
142.250.181.99	unknown	United States	15169	GOOGLEUS	false
34.249.87.52	c.ba.contentsquare.net	United States	16509	AMAZON-02US	false
54.189.174.176	col.eum-appdynamics.com	United States	16509	AMAZON-02US	false
100.20.173.79	unknown	United States	16509	AMAZON-02US	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1577472
Start date and time:	2024-12-18 13:13:35 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	http://www.mynylgbs.com
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal52.phis.win@22/33@73/295

Warnings

Exclude process from analysis (whitelisted): SgrmBroker.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.181.99, 172.217.17.78, 64.233.164.84, 2.20.68.79, 2.20.68.69, 172.217.17.46, 23.218.208.236
Excluded domains from analysis (whitelisted): fs.microsoft.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: http://www.mynylgbs.com

LLM Input / Output

Input	Output
URL: http://www.mynylgbs.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: http://www.mynylgbs.com
URL: https://www.mynylgbs.com/auth... Model: Joe Sandbox AI	{ "risk_score": 3, "reasoning": "The provided JavaScript snippet appears to be a legitimate script for the Boomerang performance monitoring service. It sets up the necessary configuration and initializes the Boomerang library. While it uses some legacy APIs like `XDomainRequest`, the overall behavior is consistent with a performance monitoring tool and does not exhibit any high-risk indicators. The script is likely benign, with some minor outdated practices that pose a low risk." }
!function(a){var e="https://s.go-mpulse.net/boomerang/",t="addEventListener";if("True"=="True")a.BOOMR_config=a.BOOMR_config\|\|{},a.BOOMR_config.PageParams=a.BOOMR_config.PageParams\|\|{},a.BOOMR_config.PageParams.pci=!0,e="https://s2.go-mpulse.net/boomerang/";if(window.BOOMR_API_key="259HB-23ACQ-K5LRV-AJYKV-5VUWF",function(){function n(e){a.BOOMR_onload=e&&e.timeStamp\|\|(new Date).getTime()}if(!a.BOOMR\|\|!a.BOOMR.version&&!a.BOOMR.snippetExecuted){a.BOOMR=a.BOOMR\|\|{},a.BOOMR.snippetExecuted=!0;var i,_,o,r=document.createElement("iframe");if(a[t])a[t]("load",n,!1);else if(a.attachEvent)a.attachEvent("onload",n);r.src="javascript:void(0)",r.title="",r.role="presentation",(r.frameElement\|\|r).style.cssText="width:0;height:0;border:0;display:none;",o=document.getElementsByTagName("script")[0],o.parentNode.insertBefore(r,o);try{_=r.contentWindow.document}catch(O){i=document.domain,r.src="javascript:var d=document.open();d.domain='"+i+"';void(0);",_=r.contentWindow.document}_.open()._l=function(){var a=this.createElement("script");if(i)this.domain=i;a.id="boomr-if-as",a.src=e+"259HB-23ACQ-K5LRV-AJYKV-5VUWF",BOOMR_lstart=(new Date).getTime(),this.body.appendChild(a)},_.write("<bo"+'dy onload="document._l();">'),_.close()}}(),"".length>0)if(a&&"performance"in a&&a.performance&&"function"==typeof a.performance.setResourceTimingBufferSize)a.performance.setResourceTimingBufferSize();!function(){if(BOOMR=a.BOOMR\|\|{},BOOMR.plugins=BOOMR.plugins\|\|{},!BOOMR.plugins.AK){var e=""=="true"?1:0,t="",n="baxhxpiccrce6z3cxsqa-f-302d7ff62-clientnsv4-s.akamaihd.net",i="false"=="true"?2:1,_={"ak.v":"39","ak.cp":"1192893","ak.ai":parseInt("712878",10),"ak.ol":"0","ak.cr":91,"ak.ipv":4,"ak.proto":"http/1.1","ak.rid":"d0f97399","ak.r":49982,"ak.a2":e,"ak.m":"a","ak.n":"essl","ak.bpcip":"8.46.123.0","ak.cport":11826,"ak.gh":"2.17.216.143","ak.quicv":"","ak.tlsv":"tls1.3","ak.0rtt":"","ak.0rtt.ed":"","ak.csrc":"-","ak.acc":"reno","ak.t":"1734524064","ak.ak":"hOBiQwZUYzCg5VSAfCLimQ==GeqNNOTALdE0sbn8aYi9W86U6z2v0vnPeCn9cYlhObo42lzzaW/xp6ncveu4D2NBzUAyqJafjOsXwN7HlKxShO6C7iMV1Qg8rKkCL2BDwfUPfS08CUISWJkO8U3CtdG6vWg+UgJeyc9ecv6cgIN7DU9gTR9syLIiGByQxliA9j2TabcG7P9BUMBcsSC42MSbUyHGiLsK2DKdNyNLomqWgNiO4PRONcxKOWbHLTzYt3KC0UVdm+zf372rA3iyYYUkCGaWa1c+iO2v7PXbNYyvdUW7SnvJI0werUJaMyhZyYDxRYd/BCjK4iFfUXi1V2QdmG4xvtVR3qLiFQ4LRZw1VVezQbNvUnjSyJC+8Eplh9jOtMW20ae2/OJBgF8IwAAkFzI/omTOk3PxMS2OMTOlKkfOOSJBySY1guUisC8VLaY=","ak.pv":"27","ak.dpoabenc":"","ak.tf":i};if(""!==t)_["ak.ruds"]=t;var o={i:!1,av:function(e){var t="http.initiator";if(e&&(!e[t]\|\|"spa_hard"===e[t]))_["ak.feo"]=void 0!==a.aFeoApplied?1:0,BOOMR.addVar(_)},rv:function(){var a=["ak.bpcip","ak.cport","ak.cr","ak.csrc","ak.gh","ak.ipv","ak.m","ak.n","ak.ol","ak.proto","ak.quicv","ak.tlsv","ak.0rtt","ak.0rtt.ed","ak.r","ak.acc","ak.t","ak.tf"];BOOMR.removeVar(a)}};BOOMR.plugins.AK={akVars:_,akDNSPreFetchDomain:n,init:function(){if(!o.i){var a=BOOMR.subscribe;a("before_beacon",o.av,null,null),a("onbeacon",o.rv,null,null),o.i=!0}return this},is_complete:function(){return!0}}}}()}(window);
URL: https://www.mynylgbs.com/auth... Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "The provided JavaScript snippet appears to be a data layer object used for analytics or tracking purposes. It contains common page information like the page name, URL, and channel, which is typical for web analytics implementations. There are no high-risk indicators like dynamic code execution, data exfiltration, or suspicious redirects. The script seems to be a legitimate implementation of a data layer, which is a common practice for web analytics and tag management." }
nylDataLayer = { "pageInfo": { "pageName": 'gbs:signin', "siteSection": 'registration', "pageUrl": window.location.href, "category": '', "pageProductType": '', "pageTemplate": '', "channel": 'gbs-prelogin', "language": "en", "clientId":"NA", "role":"POLICYOWNER", } };
URL: https://cdn.appdynamics.com/adrum/adrum-20.8.0.323... Model: Joe Sandbox AI	{ "risk_score": 3, "reasoning": "The provided JavaScript snippet appears to be a part of a web analytics or performance monitoring library. While it contains some legacy practices and external data transmission, the overall behavior is likely benign and aligned with typical analytics functionality. The script does not exhibit any high-risk indicators like dynamic code execution, data exfiltration, or redirects to malicious domains. Some contextual adjustments have been made to account for the legitimate analytics purpose, resulting in a low-risk score." }
;/* Version 97655c10e7b91050c0196f6fd1b25fa5 v:20.8.0.3230, c:692d4851d7887364796526ff8188edb96177eaf3, b:20.8.0.3230 /(function(){new function(){if(!window.ADRUM&&!0!==window["adrum-disable"]){var k=window.ADRUM={},y=window.console,A=y&&"function"==typeof y.log?y:{log:function(){}};window["adrum-start-time"]=window["adrum-start-time"]\|\|(new Date).getTime();var u=this&&this.Bc\|\|function(){var a=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(a,l){a.__proto__=l}\|\|function(a,l){for(var e in l)l.hasOwnProperty(e)&&(a[e]=l[e])};return function(b,l){function e(){this.constructor=b}a(b,l);b.prototype=null===l?Object.create(l): (e.prototype=l.prototype,new e)}}();(function(a){(function(a){a.setUpMonitors=function(){for(var a=[],b=0;b<arguments.length;b++)a[b]=arguments[b];for(b=0;b<a.length;b++){var c=a[b];c&&c.setUp()}}})(a.monitor\|\|(a.monitor={}))})(k\|\|(k={}));(function(a){(function(b){function l(a){return b.refs.slice.apply(a,b.refs.slice.call(arguments,1))}function e(a,m){return c(b.refs.setTimeout.apply)?b.refs.setTimeout.apply(window,arguments):b.refs.setTimeout(a,m)}function c(a){return"undefined"!==typeof a&&null!== a}function f(a){return"object"==typeof a&&!b.isArray(a)&&null!==a}function g(a){return"function"==typeof a\|\|!1}function n(a){return"string"==typeof a}function m(a){return"number"==typeof a}function p(a,c){for(var m in c){var g=c[m];if(s(c,m)){var n=a[m];f(g)&&f(n)?p(n,g):b.isArray(n)&&b.isArray(g)?a[m]=n.concat(g):a[m]=g}}return a}function s(a,b){return Object.prototype.hasOwnProperty.call(a,b)&&c(a[b])}function q(a){return n(a)?a.replace(/^\s/,"").replace(/\s*$/,""):a}function r(){return b.refs.la&& g(b.refs.la.now)}function k(){return r()?b.refs.round(b.refs.la.now()+x()):(new Date).getTime()}function x(){var a=b.refs.la,a=a&&a.timing&&m(a.timing.navigationStart)?a.timing.navigationStart:window["adrum-start-time"];c(a)\|\|(a=k());return a}function t(a,b){var c=Array.prototype[a];return c?v(c):B(a,b)}function v(a){return function(c){return a.apply(c,b.refs.slice.call(arguments,1))}}function B(a,b){return function(m,f){if(!c(m))throw new TypeError(a+" called on null or undefined");if(!g(f))throw new TypeError(f+ " is not a function");return b.apply(null,arguments)}}function C(a,b,c){var m=Object(a),f=m.length>>>0,g=0;if(3>arguments.length){for(;g<f&&!(g in m);)g++;if(g>=f)throw new TypeError("Reduce of empty array with no initial value");c=m[g++]}for(;g<f;g++)g in m&&(c=b(c,m[g],g,m));return c}function z(a,c,m){return b.reduce(a,function(a,b,g,f){a[g]=c.call(m,b,g,f);return a},Array(a.length>>>0))}function D(a,c,m){return b.reduce(a,function(a,b,g,f){c.call(m,b,g,f)&&a.push(b);return a},[])}function E(a, b,c){a=Object(a);for(var m=a.length>>>0,g=0;g<m;g++)if(g in a&&b.call(c,a[g],g,a))return!0;return!1}function F(a,c,m){return!b.some(a,function(a){return!c.call(m,a)})}function N(a,c,m){b.reduce(a,function(a,b,g,f){c.call(m,b,g,f)},void 0)}b.refs={isArray:Array.isArray,toString:Object.prototype.toString,slice:Array.prototype.slice,setTimeout:window.setTimeout,setInterval:window.setInterval,la:window.performance\|\|window.mozPerformance\|\|window.msPerformance\|\|window.webkitPerformance,assign:Object.assign, round:Math.round};b.xa=l;b.oSTO=e;b.isCORSSupported=function(){var a=window.JSON&&g(JSON.stringify);return c(window.XMLHttpRequest)&&"withCredentials"in new XMLHttpRequest&&a};b.isDefined=c;b.fl=function(a){return"number"===typeof a&&!window.isNaN(a)};b.isArray=g(b.refs.isArray)&&g(b.refs.isArray.bind)?b.refs.isArray.bind(Array):function(a){return b.refs.toString.call(a)===b.refs.toString.call([])};b.isObject=f;b.isFunction=g;b.isString=n;b.isNumber=m;b.isBoolean=function(a){return"boolean"==typeof a}; b.max=function(a,b){return Math.max(isNaN(a)?Number.NEGATIVE_INFINITY:a,isNaN(b)?Number.NEGATIVE_INFINITY:b)};b.hc=e;b.so=function(a,b){e(a,b\|\|1E4)};b.addEventListener=function(b,c,m,g){function f(){try{return m.apply(this,l(arguments))}catch(g){a.exception(g,"M1",c,b,g)}}void 0===g&&(g=!1);a.isDebug&&a.log
URL: https://assets.adobedtm.com/e7dc5c5ab342/24ce288a0... Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "This script appears to be a legitimate Adobe Launch script used for analytics and data collection purposes. It does not exhibit any high-risk behaviors like dynamic code execution, data exfiltration, or redirects to suspicious domains. The script primarily interacts with known, reputable domains and performs common analytics and tracking functions. While it uses some legacy APIs like `XDomainRequest`, these pose minor risks and are not inherently malicious. Overall, this script is likely benign with no clear intent to cause harm." }
// For license information, see `https://assets.adobedtm.com/e7dc5c5ab342/24ce288a0743/launch-e5777f8ccf55.js`. window._satellite=window._satellite\|\|{},window._satellite.container={buildInfo:{minified:!0,buildDate:"2021-08-09T17:57:12Z",environment:"production",turbineBuildDate:"2021-04-26T16:54:28Z",turbineVersion:"27.1.3"},dataElements:{cleanUrl:{modulePath:"core/src/lib/dataElements/javascriptVariable.js",settings:{path:"window.location.pathname"}},channel:{storageDuration:"pageview",modulePath:"core/src/lib/dataElements/javascriptVariable.js",settings:{path:"nylDataLayer.pageInfo.channel"}},role:{storageDuration:"pageview",modulePath:"core/src/lib/dataElements/javascriptVariable.js",settings:{path:"nylDataLayer.pageInfo.role"}},pageName:{storageDuration:"pageview",modulePath:"core/src/lib/dataElements/javascriptVariable.js",settings:{path:"nylDataLayer.pageInfo.pageName"}},pageUrl:{storageDuration:"pageview",modulePath:"core/src/lib/dataElements/javascriptVariable.js",settings:{path:"window.location.href"}},server:{modulePath:"core/src/lib/dataElements/javascriptVariable.js",settings:{path:"window.location.host"}},siteSection:{storageDuration:"pageview",modulePath:"core/src/lib/dataElements/javascriptVariable.js",settings:{path:"nylDataLayer.pageInfo.siteSection"}},clientSessionId:{storageDuration:"pageview",modulePath:"core/src/lib/dataElements/javascriptVariable.js",settings:{path:"nylDataLayer.pageInfo.clientSessionId"}},previousPage:{defaultValue:"",storageDuration:"pageview",modulePath:"core/src/lib/dataElements/javascriptVariable.js",settings:{path:"nylDataLayer.pageInfo.previousPage"}}},extensions:{core:{displayName:"Core",modules:{"core/src/lib/dataElements/javascriptVariable.js":{name:"javascript-variable",displayName:"JavaScript Variable",script:function(e,t,n){"use strict";var r=n("../helpers/getObjectProperty.js");e.exports=function(e){return r(window,e.path)}}},"core/src/lib/events/pageBottom.js":{name:"page-bottom",displayName:"Page Bottom",script:function(e,t,n){"use strict";var r=n("./helpers/pageLifecycleEvents");e.exports=function(e,t){r.registerPageBottomTrigger(t)}}},"core/src/lib/events/domReady.js":{name:"dom-ready",displayName:"DOM Ready",script:function(e,t,n){"use strict";var r=n("./helpers/pageLifecycleEvents");e.exports=function(e,t){r.registerDomReadyTrigger(t)}}},"core/src/lib/actions/customCode.js":{name:"custom-code",displayName:"Custom Code",script:function(e,t,n,i){"use strict";var a,r,o,s,c=n("@adobe/reactor-document"),u=n("@adobe/reactor-promise"),l=n("./helpers/decorateCode"),f=n("./helpers/loadCodeSequentially"),p=n("../../../node_modules/postscribe/dist/postscribe"),d=n("./helpers/unescapeHtmlCode"),g=(r=function(e){p(c.body,e,{beforeWriteToken:function(t){var e=t.tagName&&t.tagName.toLowerCase();return a&&"script"===e&&(t.attrs.nonce=a),"script"!==e&&"style"!==e\|\|(Object.keys(t.attrs\|\|{}).forEach(function(e){t.attrs[e]=d(t.attrs[e])}),t.src&&(t.src=d(t.src))),t},error:function(e){i.logger.error(e.msg)}})},o=[],s=function(){if(c.body)for(;o.length;)r(o.shift());else setTimeout(s,20)},function(e){o.push(e),s()}),h=function(){if(c.currentScript)return c.currentScript.async;for(var e=c.querySelectorAll("script"),t=0;t<e.length;t++){var n=e[t];if(/(launch\|satelliteLib)-[^\/]+.js(\?.*)?$/.test(n.src))return n.async}return!0}();e.exports=function(e,t){var n;a=i.getExtensionSettings().cspNonce;var r={settings:e,event:t},o=r.settings.source;if(o)return r.settings.isExternal?f(o).then(function(e){return e?(n=l(r,e),g(n.code),n.promise):u.resolve()}):(n=l(r,o),h\|\|"loading"!==c.readyState?g(n.code):c.write&&!1===i.propertySettings.ruleComponentSequencingEnabled?c.write(n.code):g(n.code),n.promise)}}},"core/src/lib/events/customEvent.js":{name:"custom-event",displayName:"Custom Event",script:function(e,t,n){"use strict";var r=n("./helpers/createBubbly")(),o=[];e.exports=function(e,t){var n=e.type;-1===o.indexOf(n)&&(o.push(n),window.addEventListener(n,r.evaluateEvent,!0)),r.addListener(e,function(e){e
URL: https://assets.adobedtm.com/extensions/EPbde2f7ca1... Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "The provided JavaScript snippet appears to be a part of the Adobe Analytics (formerly SiteCatalyst) library, which is a widely used web analytics solution. The code does not contain any high-risk indicators, such as dynamic code execution, data exfiltration, or redirects to malicious domains. The behaviors observed are mostly related to cookie handling, configuration, and utility functions, which are common in web analytics implementations. While the code uses some legacy practices like `XDomainRequest`, these pose minor risks and are not inherently malicious. Overall, the script seems to be a legitimate part of a web analytics solution and does not exhibit any suspicious or malicious behavior." }
// For license information, see `https://assets.adobedtm.com/extensions/EPbde2f7ca14e540399dcc1f8208860b7b/AppMeasurement.js`. function AppMeasurement(f){var g=this;g.version="2.22.0";var p=window;p.s_c_in\|\|(p.s_c_il=[],p.s_c_in=0),g._il=p.s_c_il,g._in=p.s_c_in,g._il[g._in]=g,p.s_c_in++,g._c="s_c";var d=p.AppMeasurement.ic;d\|\|(d=null);var l,b,k,m=p;try{for(l=m.parent,b=m.location;l&&l.location&&b&&""+l.location!=""+b&&m.location&&""+l.location!=""+m.location&&l.location.host===b.host;)l=(m=l).parent}catch(e){}g.C=function(e){try{console.log(e)}catch(t){}},g.Ra=function(e){return""+parseInt(e)==""+e},g.replace=function(e,t,a){return!e\|\|e.indexOf(t)<0?e:e.split(t).join(a)},g.escape=function(e){var t,a;if(!e)return e;for(e=encodeURIComponent(e),t=0;t<7;t++)a="+~!()'".substring(t,t+1),0<=e.indexOf(a)&&(e=g.replace(e,a,"%"+a.charCodeAt(0).toString(16).toUpperCase()));return e},g.unescape=function(e){if(!e)return e;e=0<=e.indexOf("+")?g.replace(e,"+"," "):e;try{return decodeURIComponent(e)}catch(t){}return unescape(e)},g.Nb=function(){var e,t=p.location.hostname,a=g.fpCookieDomainPeriods;if(a\|\|(a=g.cookieDomainPeriods),t&&!g.Ka&&!/^[0-9.]+$/.test(t)&&(a=2<(a=a?parseInt(a):2)?a:2,0<=(e=t.lastIndexOf(".")))){for(;0<=e&&1<a;)e=t.lastIndexOf(".",e-1),a--;g.Ka=0<e?t.substring(e):t}return g.Ka},g.c_r=g.cookieRead=function(e){e=g.escape(e);var t=" "+g.d.cookie,a=t.indexOf(" "+e+"="),n=a<0?a:t.indexOf(";",a);return"[[B]]"!=(e=a<0?"":g.unescape(t.substring(a+2+e.length,n<0?t.length:n)))?e:""},g.c_w=g.cookieWrite=function(e,t,a){var n,i=g.Nb(),r=g.cookieLifetime;return t=""+t,r=r?(""+r).toUpperCase():"",a&&"SESSION"!=r&&"NONE"!=r&&((n=""!=t?parseInt(r\|\|0):-60)?(a=new Date).setTime(a.getTime()+1e3n):1===a&&(n=(a=new Date).getYear(),a.setYear(n+2+(n<1900?1900:0)))),e&&"NONE"!=r?(g.d.cookie=g.escape(e)+"="+g.escape(""!=t?t:"[[B]]")+"; path=/;"+(a&&"SESSION"!=r?" expires="+a.toUTCString()+";":"")+(i?" domain="+i+";":"")+(g.writeSecureCookies?" secure;":""),g.cookieRead(e)==t):0},g.Kb=function(){var e=g.Util.getIeVersion();"number"==typeof e&&e<10&&(g.unsupportedBrowser=!0,g.xb(g,function(){}))},g.ya=function(){var e=navigator.userAgent;return"Microsoft Internet Explorer"===navigator.appName\|\|0<=e.indexOf("MSIE ")\|\|0<=e.indexOf("Trident/")&&0<=e.indexOf("Windows NT 6")},g.xb=function(e,t){for(var a in e)Object.prototype.hasOwnProperty.call(e,a)&&"function"==typeof e[a]&&(e[a]=t)},g.K=[],g.fa=function(e,t,a){if(g.La)return 0;g.maxDelay\|\|(g.maxDelay=250);var n=0,i=(new Date).getTime()+g.maxDelay,r=g.d.visibilityState,o=["webkitvisibilitychange","visibilitychange"];if(r\|\|(r=g.d.webkitVisibilityState),r&&"prerender"==r){if(!g.ga)for(g.ga=1,a=0;a<o.length;a++)g.d.addEventListener(o[a],function(){var e=g.d.visibilityState;e\|\|(e=g.d.webkitVisibilityState),"visible"==e&&(g.ga=0,g.delayReady())});n=1,i=0}else a\|\|g.u("_d")&&(n=1);return n&&(g.K.push({m:e,a:t,t:i}),g.ga\|\|setTimeout(g.delayReady,g.maxDelay)),n},g.delayReady=function(){var e,t=(new Date).getTime(),a=0;for(g.u("_d")?a=1:g.Aa();0<g.K.length;){if(e=g.K.shift(),a&&!e.t&&e.t>t){g.K.unshift(e),setTimeout(g.delayReady,parseInt(g.maxDelay/2));break}g.La=1,g[e.m].apply(g,e.a),g.La=0}},g.setAccount=g.sa=function(e){var t,a;if(!g.fa("setAccount",arguments))if(g.account=e,g.allAccounts)for(t=g.allAccounts.concat(e.split(",")),g.allAccounts=[],t.sort(),a=0;a<t.length;a++)0!=a&&t[a-1]==t[a]\|\|g.allAccounts.push(t[a]);else g.allAccounts=e.split(",")},g.foreachVar=function(e,t){var a,n,i,r,o="";for(i=n="",g.lightProfileID?(a=g.O,(o=g.lightTrackVars)&&(o=","+o+","+g.la.join(",")+",")):(a=g.g,(g.pe\|\|g.linkType)&&(o=g.linkTrackVars,n=g.linkTrackEvents,g.pe&&(i=g.pe.substring(0,1).toUpperCase()+g.pe.substring(1),g[i]&&(o=g[i].ec,n=g[i].cc))),o&&(o=","+o+","+g.F.join(",")+","),n&&o&&(o+=",events,")),t&&(t=","+t+","),n=0;n<a.length;n++)i=a[n],(r=g[i])&&(!o\|\|0<=o.indexOf(","+i+","))&&(!t\|\|0<=t.indexOf(","+i+","))&&e(i,r)},g.o=function(e,t,a,n,i){var r,o,c,s,l="",u=0;if("contextData"==e&&(e="c"),t){for(r in t)if(!(Objec
URL: https://assets.adobedtm.com/extensions/EPbde2f7ca1... Model: Joe Sandbox AI	{ "risk_score": 3, "reasoning": "The provided JavaScript snippet appears to be a part of the Adobe Analytics (formerly SiteCatalyst) library, which is a legitimate and widely-used web analytics tool. While the code contains some behaviors that could be considered risky, such as the use of the `XDomainRequest` API and aggressive DOM manipulation, these are likely part of the normal functionality of the analytics library and not indicative of malicious intent. Additionally, the script is hosted on a trusted Adobe domain, which further reduces the risk. Overall, this script is likely benign and used for legitimate analytics purposes, with some outdated practices that pose a low risk." }
// For license information, see `https://assets.adobedtm.com/extensions/EPbde2f7ca14e540399dcc1f8208860b7b/AppMeasurement_Module_ActivityMap.js`. function AppMeasurement_Module_ActivityMap(o){function e(){var e=t.pageYOffset+(t.innerHeight\|\|0);e&&+g<e&&(g=e)}function n(){if(f.scrollReachSelector){var t=o.d.querySelector&&o.d.querySelector(f.scrollReachSelector);t?(g=t.scrollTop\|\|0,t.addEventListener("scroll",function(){var e;(e=t&&t.scrollTop+t.clientHeight\|\|0)>g&&(g=e)})):0<i--&&setTimeout(n,1e3)}}function a(e,t){var n,r,i;if(e&&t&&(n=f.c[t]\|\|(f.c[t]=t.split(","))))for(i=0;i<n.length&&(r=n[i++]);)if(-1<e.indexOf(r))return null;return e}function c(e,t,n,r,i){var a,c;if(e.dataset&&(c=e.dataset[t])?a=c:e.getAttribute&&((c=e.getAttribute("data-"+n))?a=c:(c=e.getAttribute(n))&&(a=c)),!a&&o.useForcedLinkTracking&&i){var l;if(e=e.onclick?""+e.onclick:"",varValue="",r&&e&&0<=(t=e.indexOf(r))){for(t+=r.length;t<e.length;)if(n=e.charAt(t++),0<="'\"".indexOf(n)){l=n;break}for(c=!1;t<e.length&&l&&(n=e.charAt(t),c\|\|n!==l);)"\\"===n?c=!0:(varValue+=n,c=!1),t++}(l=varValue)&&(o.w[r]=l)}return a\|\|i&&o.w[r]}function l(e,t,n){var r;return(r=f[t](e,n))&&a(u(r),f[t+"Exclusions"])}function s(e,t,n){var r;if(e&&!(1===(r=e.nodeType)&&(r=e.nodeName)&&(r=r.toUpperCase())&&p[r])&&(1===e.nodeType&&(r=e.nodeValue)&&(t[t.length]=r),n.a\|\|n.t\|\|n.s\|\|!e.getAttribute\|\|((r=e.getAttribute("alt"))?n.a=r:(r=e.getAttribute("title"))?n.t=r:"IMG"==(""+e.nodeName).toUpperCase()&&(r=e.getAttribute("src")\|\|e.src)&&(n.s=r)),(r=e.childNodes)&&r.length))for(e=0;e<r.length;e++)s(r[e],t,n)}function u(e){if(null==e\|\|null==e)return e;try{return e.replace(RegExp("^[\\s\\n\\f\\r\\t\t-\r \xa0\u1680\u180e\u2000-\u200a\u2028\u2029\u205f\u3000\ufeff]+","mg"),"").replace(RegExp("[\\s\\n\\f\\r\\t\t-\r \xa0\u1680\u180e\u2000-\u200a\u2028\u2029\u205f\u3000\ufeff]+$","mg"),"").replace(RegExp("[\\s\\n\\f\\r\\t\t-\r \xa0\u1680\u180e\u2000-\u200a\u2028\u2029\u205f\u3000\ufeff]{1,}","mg")," ").substring(0,254)}catch(t){}}var f=this;f.s=o;var t=window;t.s_c_in\|\|(t.s_c_il=[],t.s_c_in=0),f._il=t.s_c_il,f._in=t.s_c_in,f._il[f._in]=f,t.s_c_in++,f._c="s_m";var r,g=0,i=60;f.c={};var p={SCRIPT:1,STYLE:1,LINK:1,CANVAS:1};f._g=function(){var e,t,n,r=o.contextData,i=o.linkObject;(e=o.pageName\|\|o.pageURL)&&(t=l(i,"link",o.linkName))&&(n=l(i,"region"))&&(r["a.activitymap.page"]=e.substring(0,255),r["a.activitymap.link"]=128<t.length?t.substring(0,128):t,r["a.activitymap.region"]=127<n.length?n.substring(0,127):n,0<g&&(r["a.activitymap.xy"]=10*Math.floor(g/10)),r["a.activitymap.pageIDType"]=o.pageName?1:0)},f._d=function(){f.trackScrollReach&&!r&&(f.scrollReachSelector?n():(e(),t.addEventListener&&t.addEventListener("scroll",e,!1)),r=!0)},f.link=function(e,t){var n;if(t)n=a(u(t),f.linkExclusions);else if((n=e)&&!(n=c(e,"sObjectId","s-object-id","s_objectID",1))){var r,i;(i=a(u(e.innerText\|\|e.textContent),f.linkExclusions))\|\|(s(e,r=[],n={a:void 0,t:void 0,s:void 0}),(i=a(u(r.join(""))))\|\|(i=a(u(n.a?n.a:n.t?n.t:n.s?n.s:void 0)))\|\|!(r=(r=e.tagName)&&r.toUpperCase?r.toUpperCase():"")\|\|("INPUT"==r\|\|"SUBMIT"==r&&e.value?i=a(u(e.value)):"IMAGE"==r&&e.src&&(i=a(u(e.src))))),n=i}return n},f.region=function(e){for(var t,n=f.regionIDAttribute\|\|"id";e&&(e=e.parentNode);){if(t=c(e,n,n,n))return t;if("BODY"==e.nodeName)return"BODY"}}}
URL: https://www.mynylgbs.com/auth/public/js/app.js?t=t... Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": "The provided JavaScript snippet appears to be a standard Webpack bootstrap code, which is commonly used in modern web development. It does not contain any high-risk indicators, such as dynamic code execution, data exfiltration, or redirects to malicious domains. The code is responsible for managing the loading and execution of modules, which is a common practice in modular JavaScript applications. Overall, this script is likely benign and does not pose a significant security risk." }
/****/ (function(modules) { // webpackBootstrap /**/ // install a JSONP callback for chunk loading /**/ function webpackJsonpCallback(data) { /**/ var chunkIds = data[0]; /**/ var moreModules = data[1]; /**/ var executeModules = data[2]; /**/ /**/ // add "moreModules" to the modules object, /**/ // then flag all "chunkIds" as loaded and fire callback /**/ var moduleId, chunkId, i = 0, resolves = []; /**/ for(;i < chunkIds.length; i++) { /**/ chunkId = chunkIds[i]; /**/ if(Object.prototype.hasOwnProperty.call(installedChunks, chunkId) && installedChunks[chunkId]) { /**/ resolves.push(installedChunks[chunkId][0]); /**/ } /**/ installedChunks[chunkId] = 0; /**/ } /**/ for(moduleId in moreModules) { /**/ if(Object.prototype.hasOwnProperty.call(moreModules, moduleId)) { /**/ modules[moduleId] = moreModules[moduleId]; /**/ } /**/ } /**/ if(parentJsonpFunction) parentJsonpFunction(data); /**/ /**/ while(resolves.length) { /**/ resolves.shift()(); /**/ } /**/ /**/ // add entry modules from loaded chunk to deferred list /**/ deferredModules.push.apply(deferredModules, executeModules \|\| []); /**/ /**/ // run deferred modules when all chunks ready /**/ return checkDeferredModules(); /**/ }; /**/ function checkDeferredModules() { /**/ var result; /**/ for(var i = 0; i < deferredModules.length; i++) { /**/ var deferredModule = deferredModules[i]; /**/ var fulfilled = true; /**/ for(var j = 1; j < deferredModule.length; j++) { /**/ var depId = deferredModule[j]; /**/ if(installedChunks[depId] !== 0) fulfilled = false; /**/ } /**/ if(fulfilled) { /**/ deferredModules.splice(i--, 1); /**/ result = __webpack_require__(__webpack_require__.s = deferredModule[0]); /**/ } /**/ } /**/ /**/ return result; /**/ } /**/ /**/ // The module cache /**/ var installedModules = {}; /**/ /**/ // object to store loaded and loading chunks /**/ // undefined = chunk not loaded, null = chunk preloaded/prefetched /**/ // Promise = chunk loading, 0 = chunk loaded /**/ var installedChunks = { /**/ "app": 0 /**/ }; /**/ /**/ var deferredModules = []; /**/ /**/ // The require function /**/ function __webpack_require__(moduleId) { /**/ /**/ // Check if module is in cache /**/ if(installedModules[moduleId]) { /**/ return installedModules[moduleId].exports; /**/ } /**/ // Create a new module (and put it into the cache) /**/ var module = installedModules[moduleId] = { /**/ i: moduleId, /**/ l: false, /**/ exports: {} /**/ }; /**/ /**/ // Execute the module function /**/ modules[moduleId].call(module.exports, module, module.exports, __webpack_require__); /**/ /**/ // Flag the module as loaded /**/ module.l = true; /**/ /**/ // Return the exports of the module /**/ return module.exports; /**/ } /**/ /**/ /**/ // expose the modules object (__webpack_modules__) /**/ __webpack_require__.m = modules; /**/ /**/ // expose the module cache /**/ __webpack_require__.c = installedModules; /**/ /**/ // define getter function for harmony exports /**/ __webpack_require__.d = function(exports, name, getter) { /**/ if(!__webpack_require__.o(exports, name)) { /**/ Object.defineProperty(exports, name, { enumerable: true, get: getter }); /**/ } /**/ }; /**/ /**/ // define __esModule on exports /**/ __webpack_require__.r = function(exports) { /**/ if(typeof Symbol !== 'undefined' && Symbol.toStringTag) { /**/ Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' }); /**/ } /****/ Ob
URL: https://www.mynylgbs.com Model: Joe Sandbox AI	{ "typosquatting": true, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": true, "third_party_hosting": true }
URL: https://www.mynylgbs.com
URL: https://www.mynylgbs.com/auth Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "File a claim or family medical leave", "prominent_button_name": "Employee Login", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://s2.go-mpulse.net/boomerang/259HB-23ACQ-K5L... Model: Joe Sandbox AI	```json { "risk_score": 2, "reasoning": "The script appears to be part of a legitimate performance monitoring tool (Boomerang) used by reputable companies like Akamai. It includes some legacy practices and aggressive DOM manipulation, but there are no high-risk indicators such as dynamic code execution or data exfiltration. The script's intent aligns with analytics/telemetry functionality, which reduces the risk score." }
/* * Copyright (c) 2011, Yahoo! Inc. All rights reserved. * Copyright (c) 2011-2012, Log-Normal, Inc. All rights reserved. * Copyright (c) 2012-2017, SOASTA, Inc. All rights reserved. * Copyright (c) 2017, Akamai Technologies, Inc. All rights reserved. * Copyrights licensed under the BSD License. See the accompanying LICENSE.txt file for terms. / / Boomerang Version: 1.720.0 b17966bb92f8ac2ddcda4ac1d9c0aaea6d2eda7b / BOOMR_start=(new Date).getTime();function BOOMR_check_doc_domain(e){if(window){if(!e){if(window.parent===window\|\|!document.getElementById("boomr-if-as"))return;if(window.BOOMR&&BOOMR.boomerang_frame&&BOOMR.window)try{BOOMR.boomerang_frame.document.domain!==BOOMR.window.document.domain&&(BOOMR.boomerang_frame.document.domain=BOOMR.window.document.domain)}catch(t){BOOMR.isCrossOriginError(t)\|\|BOOMR.addError(t,"BOOMR_check_doc_domain.domainFix")}e=document.domain}if(e&&-1!==e.indexOf(".")&&window.parent){try{window.parent.document;return}catch(t){try{document.domain=e}catch(n){return}}try{window.parent.document;return}catch(t){e=e.replace(/^[\w\-]+\./,"")}BOOMR_check_doc_domain(e)}}}BOOMR_check_doc_domain();!function(c){var d,t,l,o,s,e,a,n=c;c.parent!==c&&document.getElementById("boomr-if-as")&&"script"===document.getElementById("boomr-if-as").nodeName.toLowerCase()&&(c=c.parent);l=c.document;c.BOOMR\|\|(c.BOOMR={});BOOMR=c.BOOMR;if(!BOOMR.version){BOOMR.version="1.720.0";BOOMR.window=c;BOOMR.boomerang_frame=n;BOOMR.plugins\|\|(BOOMR.plugins={});!function(){try{new c.CustomEvent("CustomEvent")!==undefined&&(o=function(e,t){return new c.CustomEvent(e,t)})}catch(e){}try{!o&&l.createEvent&&l.createEvent("CustomEvent")&&(o=function(e,t){var n=l.createEvent("CustomEvent");t=t\|\|{cancelable:!1,bubbles:!1};n.initCustomEvent(e,t.bubbles,t.cancelable,t.detail);return n})}catch(e){}!o&&l.createEventObject&&(o=function(e,t){var n=l.createEventObject();n.type=n.propertyName=e;n.detail=t.detail;return n});o=o\|\|function(){return undefined}}();s=function(e,t,n){var r=o(e,{detail:t});r&&(n?BOOMR.setImmediate(i):i());function i(){try{l.dispatchEvent?l.dispatchEvent(r):l.fireEvent&&l.fireEvent("onpropertychange",r)}catch(e){}}};if("undefined"!=typeof l.hidden){e="visibilityState";a="visibilitychange"}else if("undefined"!=typeof l.mozHidden){e="mozVisibilityState";a="mozvisibilitychange"}else if("undefined"!=typeof l.msHidden){e="msVisibilityState";a="msvisibilitychange"}else if("undefined"!=typeof l.webkitHidden){e="webkitVisibilityState";a="webkitvisibilitychange"}d={beacon_url:"",beacon_url_force_https:!0,beacon_urls_allowed:["^//[a-z0-9]+\\.akstat\\.io/?$"],beacon_type:"AUTO",beacon_auth_key:"Authorization",beacon_auth_token:undefined,beacon_with_credentials:!1,beacon_disable_sendbeacon:!1,site_domain:c.location.hostname.replace(/.?([^.]+\.[^.]+)\.?$/,"$1").toLowerCase(),user_ip:"",autorun:!0,hasSentPageLoadBeacon:!1,r:undefined,same_site_cookie:"Lax",secure_cookie:!1,forced_same_site_cookie_none:!1,events:{page_ready:[],page_unload:[],before_unload:[],dom_loaded:[],visibility_changed:[],prerender_to_visible:[],before_beacon:[],beacon:[],page_load_beacon:[],xhr_load:[],click:[],form_submit:[],config:[],xhr_init:[],spa_init:[],spa_navigation:[],spa_cancel:[],xhr_send:[],xhr_error:[],error:[],netinfo:[],rage_click:[],before_early_beacon:[]},public_events:{before_beacon:"onBeforeBoomerangBeacon",beacon:"onBoomerangBeacon",onboomerangloaded:"onBoomerangLoaded"},translate_events:{onbeacon:"beacon",onconfig:"config",onerror:"error",onxhrerror:"xhr_error"},unloadEventsCount:0,unloadEventCalled:0,listenerCallbacks:{},vars:{},singleBeaconVars:{},varPriority:{"-1":{},1:{}},errors:{},disabled_plugins:{},localStorageSupported:!1,LOCAL_STORAGE_PREFIX:"_boomr_",nativeOverwrites:[],xb_handler:function(n){return function(e){var t;(e=e\|\|c.event).target?t=e.target:e.srcElement&&(t=e.srcElement);3===t.nodeType&&(t=t.parentNode);t&&t.nodeName&&"OBJECT"===t.nodeName.toUpperCase()&&"application/x-shockwave-flash"===t.type\|\|d.fireEvent(n,t)}},clearEv
URL: https://www.mynylgbs.com/auth Model: Joe Sandbox AI	{ "brands": [ "New York Life" ] }
	{ "brands": [ "New York Life" ] }
URL: https://www.mynylgbs.com/auth... Model: Joe Sandbox AI	{ "risk_score": 4, "reasoning": "The script appears to be related to analytics and tracking functionality, which is a moderate-risk indicator. It sends data to the ContentSquare domain, which is a known analytics provider. However, the script also uses some obfuscation techniques, which raises the risk level. Overall, the script requires further review due to the combination of moderate-risk behaviors and potential obfuscation." }
_satellite["_runScript1"](function(event, target, Promise) { !function(){if(window._uxa=window._uxa\|\|[],"undefined"==typeof CS_CONF){window._uxa.push(["setPath",window.location.pathname+window.location.hash.replace("#","?__")]);var a=document.createElement("script");a.type="text/javascript",a.async=!0,-1<window.location.href.indexOf("www.")?a.src="//t.contentsquare.net/uxa/ae271083-6516-4b08-b34e-985a911c3822.js":a.src="//t.contentsquare.net/uxa/dab2aa66-a5b7-44f2-bb19-11e81872c772.js",document.getElementsByTagName("head")[0].appendChild(a)}else window._uxa.push(["trackPageview",window.location.pathname+window.location.hash.replace("#","?__")])}(); });
URL: https://csxd.contentsquare.net/uxa/xdframe-single-... Model: Joe Sandbox AI	{ "risk_score": 6, "reasoning": "The script demonstrates several behaviors that raise moderate security concerns, including external data transmission, the use of legacy APIs, and potential cookie manipulation. While the script appears to have some legitimate functionality, such as analytics or telemetry, the lack of transparency and the potential for cookie-related activities warrant further review." }
!function(){var i=["_cs_id","_cs_s","_cs_cvars","_cs_ex"];function c(e,n){return n+"___"+e}function s(e){window.parent.postMessage({error:e},"")}function d(e){e=new RegExp("(^\|;)[ ]"+e+"=([^;])").exec(document.cookie);return e?decodeURIComponent(e[2]):null}function u(e,n,o,t,a,r,i){n=encodeURIComponent(n),o=o?";expires="+new Date(o).toUTCString():"",t=t\|\|document.domain;document.cookie=e+"="+n+o+(";path="+(a\|\|"/"))+(";domain="+t)+(r&&"X"!==r?";SameSite="+r:"")+(i?";Secure":"")}window.parent.postMessage(function(){var e=function(){var o={};location.search&&1<location.search.length&&location.search.substr(1).split("&").forEach(function(e){var e=e.split("="),n=e[0]&&decodeURIComponent(e[0]),e=e[1]&&decodeURIComponent(e[1]);o[n]=e});return o}();if(!e.pid)return s("bad query param:"+location.search),{};e=parseInt(e.pid,10);if(isNaN(e))return s("bad query param:"+location.search),{};return function(n){return i.map(function(e){return c(n,e)}).reduce(function(e,n){var o=d(n);return o&&(e[n.split("___")[0]]=o),e},{})}(e)}(),""),window.addEventListener("message",function(e){if(e.data){var n=e.data;if(function(e){return e&&!!(e.command&&e.pid&&e.cookies)&&!(!function(e){return e===parseInt(e,10)}(e.pid)\|\|!Array.isArray(e.cookies))}(n))switch(n.command){case"set":!function(n,e,o){e.forEach(function(e){0<=i.indexOf(e.name)?u(c(n,e.name),e.value,e.expires,o,e.path,e.samesite,e.secure):s("bad cookie to set:"+e.name)})}(n.pid,n.cookies,n.domain);break;case"remove":!function(a,e,r){e.forEach(function(e){var n,o,t;0<=i.indexOf(e)?(o=c(a,e),t=r,d(o)&&(n=Date.now()-1,u(o,"",n,t),d(o))&&u(o,"",n,t,"/","None",!0)):s("bad cookie to remove:"+e)})}(n.pid,n.cookies,n.domain);break;default:return void s("bad command:"+n.command)}}},!1)}()
URL: https://www.mynylgbs.com/auth Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "File a claim or family medical leave", "prominent_button_name": "Employee Login", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://www.mynylgbs.com/auth Model: Joe Sandbox AI	{ "brands": [ "New York Life Group Benefit Solutions" ] }
	{ "brands": [ "New York Life Group Benefit Solutions" ] }
URL: https://www.mynylgbs.com/auth/employee-benefits/login Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Register your account online.", "prominent_button_name": "Register here", "text_input_field_labels": [ "Username", "Password" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://www.mynylgbs.com/auth/employee-benefits/login Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Can't access your account?", "prominent_button_name": "Log in", "text_input_field_labels": [ "Username", "Password" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://www.mynylgbs.com/auth/employee-benefits/login Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "Log in", "text_input_field_labels": [ "Username", "Password" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://www.mynylgbs.com/auth/employee-benefits/login Model: Joe Sandbox AI	{ "brands": [ "New York Life" ] }
	{ "brands": [ "New York Life" ] }
URL: https://www.mynylgbs.com/auth/employee-benefits/login Model: Joe Sandbox AI	{ "brands": [ "New York Life" ] }
	{ "brands": [ "New York Life" ] }
URL: https://www.mynylgbs.com/auth/employee-benefits/login Model: Joe Sandbox AI	{ "brands": [ "New York Life" ] }
	{ "brands": [ "New York Life" ] }
URL: https://www.mynylgbs.com/auth/employee-benefits/login Model: Joe Sandbox AI	```json{ "legit_domain": "newyorklife.com", "classification": "wellknown", "reasons": [ "The brand 'New York Life' is a well-known insurance company.", "The legitimate domain for New York Life is 'newyorklife.com'.", "The provided URL 'www.mynylgbs.com' does not match the legitimate domain.", "The URL contains unusual elements and does not resemble the legitimate domain.", "The presence of login fields (Username, Password) on a suspicious URL is a common phishing tactic." ], "riskscore": 9} Google indexed: True
URL: www.mynylgbs.com Brands: New York Life Input Fields: Username, Password
URL: https://www.mynylgbs.com/auth/employee-benefits/login Model: Joe Sandbox AI	```json{ "legit_domain": "newyorklife.com", "classification": "wellknown", "reasons": [ "The brand 'New York Life' is a well-known insurance company.", "The legitimate domain for New York Life is 'newyorklife.com'.", "The provided URL 'www.mynylgbs.com' does not match the legitimate domain.", "The URL contains unusual elements and does not clearly relate to the brand.", "The presence of login fields (Username, Password) on a suspicious URL is a common phishing tactic." ], "riskscore": 9} Google indexed: True
URL: www.mynylgbs.com Brands: New York Life Input Fields: Username, Password

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Dec 18 11:14:18 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9804024992596974
Encrypted:	false
SSDEEP:
MD5:	8A3731F3B5CAFF99AC20B30F6345EAAD
SHA1:	4FB164D6B1764F458898AD7774D727DC86EECCD4
SHA-256:	DBC358AD263E0290E8BBAF749A77C6BA65C7B252479761B9B04BF12E735EFE39
SHA-512:	37F09863B92A631EDCD1E4983BF6D27038398B5AAA81F6E8B529BF6C7FF57DE2DEDE0C4FED15F038A99F9901828C59EE85FC51B78D554945E9FD950FF65BD009
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......\FQ..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y.a....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.a....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.a....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.a..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.a...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........9. ......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Dec 18 11:14:18 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	3.994884909123029
Encrypted:	false
SSDEEP:
MD5:	4E82893F4F92F0586FDB9E4F1CCD4EE3
SHA1:	4DD5C33A7CC9CCE19D23745CAE4940F4E1529103
SHA-256:	9BC80DA4F10909214E2B6B9C2900538909FC7361BBF76DE623B66BE0A2D8D595
SHA-512:	6D524E94477894B58E2EC2CB300F9E42F9B6FDC12358BE6FF41D7B0E8F73E0D8D9B5206D86AEA79BAAC93C89CCC0BCB12ADE2DB96DF748653BE4929EE4B27A3D
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....6.\FQ..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y.a....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.a....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.a....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.a..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.a...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........9. ......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.004718086790944
Encrypted:	false
SSDEEP:
MD5:	F33620CCEFA554FF642280CEF5A1D56C
SHA1:	7B76CD4C70898B1E1F9E7F72C18F9C8EAE7E1FD0
SHA-256:	4BF4F888FAC84B8F43A58F32D96F9D4D8A2614DB1A31344EBDBD518AE53D32A8
SHA-512:	4E16875B85A0CBF456FCD3E1236773441432589C870B2B1AC77CD1B9B66DAA4C9008E5F3ABF6A55F3B316D3C7052EEBC3D5DE825FFE83C67BFA90EFD40211F73
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y.a....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.a....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.a....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.a..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........9. ......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Dec 18 11:14:18 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9937268472633947
Encrypted:	false
SSDEEP:
MD5:	90810C5011DA0FB86213618DFF5BA61B
SHA1:	36B5BB591E2E7D7344B41694CFE4E32FE0DBCE68
SHA-256:	4D226184A808A7FC323A03EA4D8CD06C7FEBC97EAEB79CD49AEDE822E4748E3C
SHA-512:	C5E129AF52443A26922AA25F838C9CA946E94747F81224C4FC13225C7F43F2A9054E57930CE9BDB1E47BE61929B381FF796846A765EB53B1D6A4B6ADDF181635
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......\FQ..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y.a....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.a....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.a....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.a..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.a...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........9. ......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Dec 18 11:14:18 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9808341618105896
Encrypted:	false
SSDEEP:
MD5:	EEE085F80EAC781B3D50618B937A1950
SHA1:	B9599F716AA92C4F3402F14EC2366A02B7A562C5
SHA-256:	5696F90F2C92AC00872810814BFD0B1DA2F4E495F12B03D2C03F8FB4EE2FB7CA
SHA-512:	323143F73308D9E045EC7F0335A5DECDE83E7F0414CD0F053B9ED1554F004B81A89D2D0B5A3A2382AC6F461E270E157B6F5F2C4159FBAF9037A94F5162489335
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....:D.\FQ..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y.a....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.a....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.a....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.a..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.a...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........9. ......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Dec 18 11:14:18 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.988622235499981
Encrypted:	false
SSDEEP:
MD5:	1183A1AAB7F9DCCAC4CE536446A38D85
SHA1:	A45FEDCA2E7B3D0A3BC2E628E07AA15B1280A680
SHA-256:	87AD048CBBE69FD96D4E09E1271F879A6C6DCED85E3D56D3C79B405181706683
SHA-512:	28ACF665B0D92C8C1578BF91FD3FD2BB47A4ECB0E0227112A365CCAF8062F9C56BBFCA8F694EB32A36949EF743F1EB70A514C52FC4776844290D8B216C03765D
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....>.\FQ..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y.a....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.a....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.a....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.a..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.a...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........9. ......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (1876), with no line terminators
Category:	downloaded
Size (bytes):	1876
Entropy (8bit):	5.190929383295803
Encrypted:	false
SSDEEP:
MD5:	17303EED7F8AFE41B1523CA58723426B
SHA1:	91D994A22E1C32BB51B5638BBC918DA29C1F580C
SHA-256:	535FEB1335A0A42ED2CD06F68CB63002DBDA9D385ECD00FBBC0697AE98C6B32F
SHA-512:	883C8501484A631A88CEED2177B46C09C78FAA11B7639D5BC1C361D49FFE94E2095D0D27480FCC6C5A35DB213EAD00A03DCCE01F4E0FF04D25317522902D72DC
Malicious:	false
Reputation:	unknown
URL:	https://csxd.contentsquare.net/uxa/xdframe-single-domain-1.2.0.html?pid=5403
Preview:	<!DOCTYPE html><html><head><meta charset="UTF-8"><meta name="robots" content="noindex"><script>!function(){var i=["_cs_id","_cs_s","_cs_cvars","_cs_ex"];function c(e,n){return n+"___"+e}function s(e){window.parent.postMessage({error:e},"")}function d(e){e=new RegExp("(^\|;)[ ]"+e+"=([^;]*)").exec(document.cookie);return e?decodeURIComponent(e[2]):null}function u(e,n,o,t,a,r,i){n=encodeURIComponent(n),o=o?";expires="+new Date(o).toUTCString():"",t=t\|\|document.domain;document.cookie=e+"="+n+o+(";path="+(a\|\|"/"))+(";domain="+t)+(r&&"X"!==r?";SameSite="+r:"")+(i?";Secure":"")}window.parent.postMessage(function(){var e=function(){var o={};location.search&&1<location.search.length&&location.search.substr(1).split("&").forEach(function(e){var e=e.split("="),n=e[0]&&decodeURIComponent(e[0]),e=e[1]&&decodeURIComponent(e[1]);o[n]=e});return o}();if(!e.pid)return s("bad query param:"+location.search),{};e=parseInt(e.pid,10);if(isNaN(e))return s("bad query param:"+location.search),{};return funct

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (572)
Category:	downloaded
Size (bytes):	51749
Entropy (8bit):	5.394520825350691
Encrypted:	false
SSDEEP:
MD5:	34FD3855A63E93F20C7FEF4CDD336543
SHA1:	190BFDED8254A8687130225EC556EEEA509B515B
SHA-256:	8A1EF9CCAE1278947889E0B3B1BD0F72C2E2C94F8C1ABEE8422056D12622F7F2
SHA-512:	5EBD94028E1EA75AF270F9F8C4B71CD8BFFD4ED1891A24FFDFE7ECCC1D04F4CD3D44B6BA3F56C883ACA0D1AFC4ABF32F3BCB978D6790366614FFCAB1FB81FC69
Malicious:	false
Reputation:	unknown
URL:	https://cdn.appdynamics.com/adrum-ext.97655c10e7b91050c0196f6fd1b25fa5.js
Preview:	;/* Version 97655c10e7b91050c0196f6fd1b25fa5 v:20.8.0.3237, c:692d4851d7887364796526ff8188edb96177eaf3, b:20.8.0.3237 /(function(){/... Copyright (c) 2013, AppDynamics, Inc. All rights reserved... Derivative of Google Episodes:.. Copyright 2010 Google Inc... Licensed under the Apache License, Version 2.0 (the "License");. you may not use this file except in compliance with the License.. You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0.. Unless required by applicable law or agreed to in writing, software. distributed under the License is distributed on an "AS IS" BASIS,. WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.. See the License for the specific language governing permissions and. limitations under the License... See the source code here:. http://code.google.com/p/episodes/.*/.new function(){var k=window.ADRUM;if(k&&k.q&&!0!==window["adrum-disable"]){var y=window.console,A=y&&"function"==typeof y.log?y:{log:function(){

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (645)
Category:	dropped
Size (bytes):	98703
Entropy (8bit):	5.394878830947131
Encrypted:	false
SSDEEP:
MD5:	23EFDBE366CF9E0C0E7A6DBA23AACF9B
SHA1:	E7E0FCD08B82BFAB5DC38394F446456821D0E4E5
SHA-256:	C499A30801658DF43DB5CBABE35676A78C8E3DF349D533A3116434B70C3F0F16
SHA-512:	92EB34ABB459896ED625325CF148AF478B9D75AAB988BAD605D66FC887DB902F5C24B233AE05B2A18C639C5346999EF3E033DA2A855169E841F66EDEFDC9D1D2
Malicious:	false
Reputation:	unknown
Preview:	;/* Version 97655c10e7b91050c0196f6fd1b25fa5 v:20.8.0.3230, c:692d4851d7887364796526ff8188edb96177eaf3, b:20.8.0.3230 */(function(){new function(){if(!window.ADRUM&&!0!==window["adrum-disable"]){var k=window.ADRUM={},y=window.console,A=y&&"function"==typeof y.log?y:{log:function(){}};window["adrum-start-time"]=window["adrum-start-time"]\|\|(new Date).getTime();var u=this&&this.Bc\|\|function(){var a=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(a,l){a.__proto__=l}\|\|function(a,l){for(var e in l)l.hasOwnProperty(e)&&(a[e]=l[e])};return function(b,l){function e(){this.constructor=b}a(b,l);b.prototype=null===l?Object.create(l):.(e.prototype=l.prototype,new e)}}();(function(a){(function(a){a.setUpMonitors=function(){for(var a=[],b=0;b<arguments.length;b++)a[b]=arguments[b];for(b=0;b<a.length;b++){var c=a[b];c&&c.setUp()}}})(a.monitor\|\|(a.monitor={}))})(k\|\|(k={}));(function(a){(function(b){function l(a){return b.refs.slice.apply(a,b.refs.slice.call(arguments,1))}function e(a,m)

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 487540
Category:	dropped
Size (bytes):	126051
Entropy (8bit):	7.9974462228546255
Encrypted:	true
SSDEEP:
MD5:	9C1BD41A09B46F05BFA4E06DE0F14265
SHA1:	808FDEA6428C53A7BB02F63A6129C82CF2BC6849
SHA-256:	0E3B9A83B34BE18740FC440D00C037216958D2F3A91CCFD21EB27D84F29AFB25
SHA-512:	872EAD0B0975B67A799C023962091855E95CE1D6425CBA90454147A229677502361E5C23618A0FEEBD31C6AD489C50287CABF70D93DE6211DFAB257E46B682AE
Malicious:	false
Reputation:	unknown
Preview:	............z.F.(..=......DI.%!.pdI....Q...6D.$..@.......G;Or...@...d}...\|...{WWWWUWU_...f.t.`.yt.%Eo..>.....I..'C.3..O..=....,..z.]f.M.+._}.c.....'y..[W7....h..+/......O.>UK...4..S..&.?..s";+.1.!/=..yV.[....8.....M.H.A...0..L..$.G.c..d....8..+.F...uR$4.7..CB..+...k?z.............QL.....L.....f...3r..q2.i..21..qA......>}......~...sH.g.!L........VJ..=..T..Y.,.^<...&.2NR.........b..9.zd....8..4..4>.c-..U.mf..%..U<Qy..f;i.\\......,/....U=.}...V.I..........@..0.....m9...q2\|En.vZ......f.2,s.q..+.....{.(p..~..D..g....vd2..Y......XP2...YI..=.r. .D<I.......c....o.M..{.Z...?.'...B.S.;%....!+g$%..-dJ^<.?..w..S.[O.\|...&...c;.l.Y.}U9..8....`.p.......@....[..s.P..F.u....] .....;...O>OH.`.x,{L..)4...&..k.Kg.8.7..3.9...n......m..L...r3........[..8.R=.a.dM@.L..%.PH.n..Uz.0,n.a.&...w.........C.\....\|.he<.".W.....X.x2.P#qb...\|rB..P.';<"EV.C.si.[J...q..C$.P.m_..O...u....ur..'.g..6..y&7.....qo.u2......h{L.9.a........N...\$.9I..<......'.e..o.v.M2.....t..#..

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1436), with no line terminators
Category:	downloaded
Size (bytes):	1436
Entropy (8bit):	5.765135622700701
Encrypted:	false
SSDEEP:
MD5:	8DCF92FD011F60C80E211A6B7950F311
SHA1:	AD0DAE42A982147C8587A8196E91039BD79B3A8B
SHA-256:	850C547C29D0D82F24882EC0E5B7A87D8F9A328D11C1266A2298B9103F8DDA47
SHA-512:	B2EDA33240FCB80DC467A4D63C0AA86241C23AB854080A8F59B65412A577EA89FD67F0026CBA472B7535F3BB4D30C0E6CD422235F3B2BC1952C8D3A4129385BB
Malicious:	false
Reputation:	unknown
URL:	https://www.google.com/recaptcha/api.js?render=explicit
Preview:	/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]\|\|{},N='grecaptcha';var gr=w[N]=w[N]\|\|{};gr.ready=gr.ready\|\|function(f){(cfg['fns']=cfg['fns']\|\|[]).push(f);};w['__recaptcha_api']='https://www.google.com/recaptcha/api2/';(cfg['render']=cfg['render']\|\|[]).push('explicit');w['__google_recaptcha_client']=true;var d=document,po=d.createElement('script');po.type='text/javascript';po.async=true; po.charset='utf-8';var v=w.navigator,m=d.createElement('meta');m.httpEquiv='origin-trial';m.content='A/kargTFyk8MR5ueravczef/wIlTkbVk1qXQesp39nV+xNECPdLBVeYffxrM8TmZT6RArWGQVCJ0LRivD7glcAUAAACQeyJvcmlnaW4iOiJodHRwczovL2dvb2dsZS5jb206NDQzIiwiZmVhdHVyZSI6IkRpc2FibGVUaGlyZFBhcnR5U3RvcmFnZVBhcnRpdGlvbmluZzIiLCJleHBpcnkiOjE3NDIzNDIzOTksImlzU3ViZG9tYWluIjp0cnVlLCJpc1RoaXJkUGFydHkiOnRydWV9';if(v&&v.cookieDeprecationLabel){v.cookieDeprecationLabel.getValue().then(function(l){if(l!=='treatment_1.1'&&l!=='treatment_1.2'&&l!=='control_1.1'){d.head.prepend(

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32745)
Category:	dropped
Size (bytes):	69187
Entropy (8bit):	5.334919500084237
Encrypted:	false
SSDEEP:
MD5:	C63B159DABE3234DF55A322047FAB562
SHA1:	363EBCABDDB3C98A542921C111566451C5FD62A2
SHA-256:	A6A57F692A62810C47F6803CE6F2554220B39CE9ADF1B009BB92C40E279E2688
SHA-512:	9D265FE15E5B74632A4D15C2B3248536874C5D089A402CECA5805D51294F417D887C5747317FA0EBE9FF6D2C065E44C6530E82096EEF07ED4A1F3AC3B825F61C
Malicious:	false
Reputation:	unknown
Preview:	// For license information, see `https://assets.adobedtm.com/e7dc5c5ab342/24ce288a0743/launch-e5777f8ccf55.js`..window._satellite=window._satellite\|\|{},window._satellite.container={buildInfo:{minified:!0,buildDate:"2021-08-09T17:57:12Z",environment:"production",turbineBuildDate:"2021-04-26T16:54:28Z",turbineVersion:"27.1.3"},dataElements:{cleanUrl:{modulePath:"core/src/lib/dataElements/javascriptVariable.js",settings:{path:"window.location.pathname"}},channel:{storageDuration:"pageview",modulePath:"core/src/lib/dataElements/javascriptVariable.js",settings:{path:"nylDataLayer.pageInfo.channel"}},role:{storageDuration:"pageview",modulePath:"core/src/lib/dataElements/javascriptVariable.js",settings:{path:"nylDataLayer.pageInfo.role"}},pageName:{storageDuration:"pageview",modulePath:"core/src/lib/dataElements/javascriptVariable.js",settings:{path:"nylDataLayer.pageInfo.pageName"}},pageUrl:{storageDuration:"pageview",modulePath:"core/src/lib/dataElements/javascriptVariable.js",settings:{pat

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 17153
Category:	downloaded
Size (bytes):	5831
Entropy (8bit):	7.965109092951501
Encrypted:	false
SSDEEP:
MD5:	071BD42FE00EDDF30D81CFB5249CCC90
SHA1:	DC94A6874C044B7B59FC8170D01B4D2156EEF8B6
SHA-256:	D605B730B15B354A5A27AA714F482BC92D5475AF74A3BAEFBA65BBF9175D55F5
SHA-512:	404977CEBCC49BEA75FC47CF3A47EF467E9520779C794DDF5BA6E3513B74F71969294D32E819E49233F066F4FC589314103AAD94A8AF3183D1586A7ABD6ABB9F
Malicious:	false
Reputation:	unknown
URL:	https://ct.contentsquare.net/pcc/ae271083-6516-4b08-b34e-985a911c3822.js?DeploymentConfigName=SUP9147_20221118&Version=5
Preview:	...........;kw........^.9BX....l'N...4..'k..D.@..G-.o.{..A ...IW-.........R....h.I[...VgkK.5.P.IG.......F..3..7.q..[..[-....M.J...c...b.:.E...kf.].....j..D0..9....Z.3..iY.......q#......H.p.Y..{.B....~....0.....q......Fc-...)......p$~.X4.<>..'<....f....-..X`.F..K..!.[..KC..88.?..L........w...<;..J.n#....?....Y.J..r.!.%.h..sC..v6.k.............=.5..e.E~..I..x....B.3e.*.....5I...%Ei....F.&!R.H.29..1...)...>.l6t<f....7....G.2;m....+...d.K..L..".#`)X+..z.D.'......+-u\|..D.....M.[..J.!...!.....I....L..b..~...q..p...`...?.{g.~e...a+.~..N..ER......H..<9.u..#..i .g?...L.....j..>Sj...d.H.....HK..,..\|F..{u....T5U.<8C...N..{..w.#......y#I.6..ymX.H..Yk..aR...j\.>.Q.:..h0v.f.xV.Z..lg...V.C...M.[.K g+\.C?P......Ts.7..z.e..l...H.VX....3....l...\.....J.S..#..j.kI).D.9@j.." .T,g.M...&..ti..iP-..N.......];G....V.0..m.pCa..E..0:......:.....k.fz.....D7...lzs.m.f.I.b.&<X.7tF...6:.m.D.3.........E......J.G.2"-cS.^.`4.......2Rm#.8.6..r.m.,.....^&.E]W.UF

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	329344
Entropy (8bit):	5.935404354107945
Encrypted:	false
SSDEEP:
MD5:	BA0BC3438B17741F7885C8442244B45F
SHA1:	A954D8B9E5A76FB84D690A9E3ED1C391D3F5EE48
SHA-256:	73CCE9C734BC3F31214C13E36751977B205784104ED8DE7CE45A1539374858FC
SHA-512:	B6427CBA2E96D47193D5FA3BB306DBC62464A083174727E3A01A9DBBF2ED23E8388414E63D7C9E06606600E791F47DEB07570A5C46D9BB834C62B149D7A118CC
Malicious:	false
Reputation:	unknown
Preview:	(function(){A1();WnM();KnM();var E9=function(){return UH.apply(this,[Zj,arguments]);};var UZ=function(zJ,gD){return zJ>>gD;};var zc=function(){vR=["1]..!-"," \n5>A.","Q\r.C$\x3f S.\r\'&",",..5","QX\v","\x3f O","=;..>.76","5>.;\x3fX\vRR8\'BO\x40._R\'z!B..),Y.\x3f.w:E\n\x00R.\x3fB.Y\x00\fR)41WYn.&Y.\".\x3f!.....6\x07KD\v\rG67.W\n\'&T.\"\n;.\x00.Y)0SQ..\nU<z:S..h)Y\'..71^.\\Z86UCD.\r{`sr_.. \'.R","D","\t.R\r67_.\n<\n\x0054","#=QMY\r.U+23\\..,","<X..V>\x07^RU",".&_\f.Z#=","F\\55GN[u D4Ayt<u5\\YT,AB,n!dEV(b","<2D","-l;6EFB\x07\tC:.!Q.\r8<&.%.9\'X\x00.","\v34_..\x40","P#=SG^.(O&>=E","),..5\v)",".-<0\b5.","DY.\fR","R\x00.V.<NLD/\v",">F\v","\x3f\'HPQ\t.","\n\x3f>^..","x}\\.\fR.;&[.4:\'.\f$","9W.","9\f.\".","\x3f6\\","..<..<_.\x3fV8!NAC","C","\n35{..","K[.","...<.>.A.3C.=S","A-..S.\r,",".","7\x3f..\'SRb\v.S-)&","8<RAX\v.B","dI","8;!F.",";\x3f<V5.)+..","..6t.\x00\\>",".+.,",")#P.","1\v2","../!..","\x00H..\\ ",".S.\r>-Y\x3f<.\x3f=E",";#<F..;!\n/ .\x3f0Y\'.\x40$","8&","..E","..U-.",")>..<0\x3f

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.75
Encrypted:	false
SSDEEP:
MD5:	AFB69DF47958EB78B4E941270772BD6A
SHA1:	D9FE9A625E906FF25C1F165E7872B1D9C731E78E
SHA-256:	874809FB1235F80831B706B9E9B903D80BD5662D036B7712CC76F8C684118878
SHA-512:	FD92B98859FFCCFD12AD57830887259F03C7396DA6569C0629B64604CD964E0DF15D695F1A770D2E7F8DF238140F0E6DA7E7D176B54E31C3BB75DDE9B9127C45
Malicious:	false
Reputation:	unknown
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAmqjyoFK6v85RIFDVNaR8U=?alt=proto
Preview:	CgkKBw1TWkfFGgA=

Chrome Cache Entry: 115

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 26239
Category:	dropped
Size (bytes):	7443
Entropy (8bit):	7.97124159750497
Encrypted:	false
SSDEEP:
MD5:	093DAB96EE900124E8A17AB62322E0D3
SHA1:	F26125208A1E69091553FC94506CBF9ED8BA43C7
SHA-256:	B70169F0C5EB9B46B10EB812B2A2525C2179774E4539B6FDB7E97A19C89F1054
SHA-512:	CC8FA688DB5A9428F48C58EF08A1B4356EFE48F118BCCBAF2DAE3E6D81C65EC86E7CE81E3B6DF1801F60E37E08772A2FEF32436B8140F44CC7EB9031984F62E5
Malicious:	false
Reputation:	unknown
Preview:	...........=m[......?(....l...C.Ih!....C8y...Ud.d......H+ie......$.vggggfggfw.FC;.F....Rm..\|..........p....]...;...0..H.....O~x2..n4.3.wAt.....T<<h...j..IS@.(ZfU...OJXm?.Sh.,.......4Q4.5...'$N.(D...4..~...>..\|.j5........a.K6_...[..wZ.7.o...7[.dcow..k.....Mh......l.l>........<.km...ri.Z...X......q...]S.......n4t.n..J2".....mm=...[..m.....im..Mk.e.t...d..V..?..g..@.&.....e-(kAY.......^......,.iZ...........#<X..x.7>... 5\|s.__7.WV._.gx/.....Nks..8.....3y...&.....\|...4.}k.......X..]l....?.[7...]..f..q.w(.N..8.z.%w...\|.4...qU....!......t..t.........9*.JEm?9..hJ..I.,.&I...DM../n...mr.......O...lx2...n.........~~..gn=.P#?...._.........8.P............A.#V[.\|.>qgg?.....N..~... ZRu...D....Gq.F^.........nj1I.q..\.5k"t..[..q....T>\.Y1....k.....I...T;'......T[gm.5..h5\|.S....0....'....{+U2..4.%..-j6.A..v.....nB.....\......t:5_}.....Y4....gqt7C...}>..7.7..E!....c7&vH..._'..j...n.......@{M.\L..S.....;..\/='^.wI\j.[.w.!....'.h......J..G......6.;.....3q...

Chrome Cache Entry: 118

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	3.7572927927059716
Encrypted:	false
SSDEEP:
MD5:	3BA83E5651FA69097B1F5BDDD9CF4334
SHA1:	0B7E734F76965C5533022971179EF8B072A1715B
SHA-256:	4A1643EF46E69EE61A1507BFD8356E6EF13BD3FDC1DE88B4176B7F8368213361
SHA-512:	1EA803CF1418C2726724A04007350958086962CA949DE42497DC351081128483FAA83547B7CC685F06C660B6446D3A6D44F1D0D4216A2636A5ECB73B6534D3E6
Malicious:	false
Reputation:	unknown
Preview:	The requested resource could not be found.

Chrome Cache Entry: 119

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (654)
Category:	downloaded
Size (bytes):	560258
Entropy (8bit):	5.668859512958225
Encrypted:	false
SSDEEP:
MD5:	19DDAC3BE88EDA2C8263C5D52FA7F6BD
SHA1:	C81720778F57C56244C72CE6EF402BB4DE5F9619
SHA-256:	B261530F05E272E18B5B5C86D860C4979C82B5B6C538E1643B3C94FC9BA76DD6
SHA-512:	393015B8C7F14D5D4BDB9CCEED7CD1477A7DB07BC7C40BAE7D0A48A2ADFA7D56F9D1C3E4EC05C92FDE152E72FFA6B75D8BF724E1F63F9BC21421125667AFB05C
Malicious:	false
Reputation:	unknown
URL:	https://www.gstatic.com/recaptcha/releases/zIriijn3uj5Vpknvt_LnfNbF/recaptcha__en.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././.. Copyright Google LLC. SPDX-License-Identifier: Apache-2.0././.. Copyright 2005, 2007 Bob Ippolito. All Rights Reserved.. Copyright The Closure Library Authors.. SPDX-License-Identifier: MIT././. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var X=function(){return[function(N,a,U,y,A,l,z){if((l=["toString",6,"constructor"],N&71)==N)if(typeof U==="string")z={buffer:Z[11](17,1,a,U),qH:!1};else if(Array.isArray(U))z={buffer:new Uint8Array(U),qH:!1};else if(U[l[2]]===Uint8Array)z={buffer:U,qH:!1};else if(U[l[2]]===ArrayBuffer)z={buffer:new Uint8Array(U),qH:!1};else if(U[l[2]]===WC)z={buffer:r[9](25,a,null,U)\|\|new Uint8Array(0),qH:!0};else if(U instanceof Uint8Array)z={buffer:new Uint8Array(U.buffer,U.byteOffset,U.byteLength),qH:!1};else throw Error("Type not convertible to a Uint8Array, expected a Uint8Array, an ArrayBuffer, a base64 encoded string, a Byt

Chrome Cache Entry: 121

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	1143
Entropy (8bit):	5.150043357036262
Encrypted:	false
SSDEEP:
MD5:	A00DB157AC8580ADBB954592535D60E8
SHA1:	C6F5F43D40E3B5BB7E598228DCB0008E22D818A8
SHA-256:	F539D88B1CE19530ACDDBF464DD2752D4EDFFC34FD7A49D8A3B026C0C810DD7C
SHA-512:	83FB7112BC9620BB33C2DC1F6752641B9892A191374C933A81B05929E273C76FAB6D0B990892A99CDF3C516E89ECCBFE105F7C802F0E473CA7C884049B30046C
Malicious:	false
Reputation:	unknown
URL:	"https://c.go-mpulse.net/api/config.json?key=259HB-23ACQ-K5LRV-AJYKV-5VUWF&d=www.mynylgbs.com&t=5781747&v=1.720.0&if=&sl=0&si=dd2bbbde-ef82-454c-bb1d-5fcce41ab8a1-soovcq&plugins=AK,ConfigOverride,Continuity,PageParams,IFrameDelay,AutoXHR,SPA,History,Angular,Backbone,Ember,RT,CrossDomain,BW,PaintTiming,NavigationTiming,ResourceTiming,Memory,CACHE_RELOAD,Errors,TPAnalytics,UserTiming,Akamai,Early,EventTiming,LOGN&acao=&ak.ai=712878"
Preview:	{"h.key":"259HB-23ACQ-K5LRV-AJYKV-5VUWF","h.d":"arlid:712878","h.t":1734524100699,"h.cr":"04ee4979e80ffbbccb2970227bb5721c6838365a-15b12faa-e6ade702","session_id":"840b1108-ba4e-4777-8cd2-3e492dfe9e1b","site_domain":"arlid:712878","beacon_url":"//684d0d42.akstat.io/","autorun":true,"BW":{"enabled":false},"RT":{"cookie":null,"session_exp":1800},"ResourceTiming":{"enabled":true,"splitAtPath":true},"PageParams":{"xhr":"none","pageGroups":[{"type":"Regexp","parameter1":"\\/.\\/clientreporting","parameter2":"clientreporting","on":["navigation"]},{"type":"Regexp","parameter1":"\\/.\\/employee-benefits","parameter2":"employee-benefits-2","on":["navigation"]},{"type":"Regexp","parameter1":"\\/auth\\/.+","parameter2":"auth","on":["navigation"]},{"type":"Regexp","parameter1":"\\/auth","parameter2":"auth-2","on":["navigation"]},{"type":"Regexp","parameter1":"\\^https\\?:\\/\\/\\[\\^\\/\\?#\\]\\+\$\\?:\\/\\*\\$\\\|\\[\\?#\\]\$","parameter2":"home","on":["navigation"]}],"customMetrics":[],"custo

Chrome Cache Entry: 122

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	48
Entropy (8bit):	4.170914521951841
Encrypted:	false
SSDEEP:
MD5:	9F23F2E42529DC6328DDB0515A9528B6
SHA1:	9F99006DBD946A1331D006C036EC15C8F107C767
SHA-256:	215DD330DBAC4B685D846B2851CA780649411B1883CAB7740A89750C7E072E64
SHA-512:	66DA9CAACBFD30C7E22B74855A58C15F00A72B96F2C2B358E3D71F8AB45682BC588BEED70C5DF3BD3C8E6DD3D2E6EE03320EA9BC2FD5DC09AAD75D38B0776EAA
Malicious:	false
Reputation:	unknown
Preview:	HTTP method not allowed, supported methods: POST

Chrome Cache Entry: 123

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (772)
Category:	downloaded
Size (bytes):	919
Entropy (8bit):	5.4529587922700475
Encrypted:	false
SSDEEP:
MD5:	A1801FDE2D56F4B7BB23AFA49B100496
SHA1:	8275462CD4F5EE28E5407ADF263DE024D02B19B5
SHA-256:	14957E389D7DF1E41E8DAF8A902A6E46E527C74061C452BE6799CCF6BB061873
SHA-512:	7D01E41D98DD41E6AB0CBB6F60E9F91F9CE46454487B0D5CBC02BA9AF0C7E38388F766D18B75DAF49EF1EDE4C40B288D6A5DA863FB3134081F20D6FE45AE957F
Malicious:	false
Reputation:	unknown
URL:	https://assets.adobedtm.com/e7dc5c5ab342/24ce288a0743/e2df1ac3069d/RCa0cb5b9e4d3d4186b10ff6624faa572c-source.min.js
Preview:	// For license information, see `https://assets.adobedtm.com/e7dc5c5ab342/24ce288a0743/e2df1ac3069d/RCa0cb5b9e4d3d4186b10ff6624faa572c-source.js`.._satellite.__registerScript('https://assets.adobedtm.com/e7dc5c5ab342/24ce288a0743/e2df1ac3069d/RCa0cb5b9e4d3d4186b10ff6624faa572c-source.min.js', "!function(){if(window._uxa=window._uxa\|\|[],\"undefined\"==typeof CS_CONF){window._uxa.push([\"setPath\",window.location.pathname+window.location.hash.replace(\"#\",\"?__\")]);var a=document.createElement(\"script\");a.type=\"text/javascript\",a.async=!0,-1<window.location.href.indexOf(\"www.\")?a.src=\"//t.contentsquare.net/uxa/ae271083-6516-4b08-b34e-985a911c3822.js\":a.src=\"//t.contentsquare.net/uxa/dab2aa66-a5b7-44f2-bb19-11e81872c772.js\",document.getElementsByTagName(\"head\")[0].appendChild(a)}else window._uxa.push([\"trackPageview\",window.location.pathname+window.location.hash.replace(\"#\",\"?__\")])}();");

Chrome Cache Entry: 127

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32766)
Category:	dropped
Size (bytes):	33462
Entropy (8bit):	5.357057188294372
Encrypted:	false
SSDEEP:
MD5:	F259EE6445C19C2CE3C64A1B117A4F35
SHA1:	A4C64554F653AB4E5BD5D2D03CE5685BB0A9DDB8
SHA-256:	D6B423C91328EEC9C218DD8B21AE1E676987D574E5432411A32806E5DD2BDE32
SHA-512:	8050C59A188BF36A920EE6BD90BA52F14967AD2085A32A37D9211C265803C962276146F8FD5F8487D42763CE9A68D3DC6CCD053322B57DE52FAF3A03962DBB99
Malicious:	false
Reputation:	unknown
Preview:	// For license information, see `https://assets.adobedtm.com/extensions/EPbde2f7ca14e540399dcc1f8208860b7b/AppMeasurement.js`..function AppMeasurement(f){var g=this;g.version="2.22.0";var p=window;p.s_c_in\|\|(p.s_c_il=[],p.s_c_in=0),g._il=p.s_c_il,g._in=p.s_c_in,g._il[g._in]=g,p.s_c_in++,g._c="s_c";var d=p.AppMeasurement.ic;d\|\|(d=null);var l,b,k,m=p;try{for(l=m.parent,b=m.location;l&&l.location&&b&&""+l.location!=""+b&&m.location&&""+l.location!=""+m.location&&l.location.host===b.host;)l=(m=l).parent}catch(e){}g.C=function(e){try{console.log(e)}catch(t){}},g.Ra=function(e){return""+parseInt(e)==""+e},g.replace=function(e,t,a){return!e\|\|e.indexOf(t)<0?e:e.split(t).join(a)},g.escape=function(e){var t,a;if(!e)return e;for(e=encodeURIComponent(e),t=0;t<7;t++)a="+~!*()'".substring(t,t+1),0<=e.indexOf(a)&&(e=g.replace(e,a,"%"+a.charCodeAt(0).toString(16).toUpperCase()));return e},g.unescape=function(e){if(!e)return e;e=0<=e.indexOf("+")?g.replace(e,"+"," "):e;try{return decodeURIComponent(e)}

Chrome Cache Entry: 128

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	C source, ASCII text, with very long lines (65103)
Category:	dropped
Size (bytes):	209939
Entropy (8bit):	5.366006952026174
Encrypted:	false
SSDEEP:
MD5:	FA4C76A7FDE62B18054CF7EB8E946012
SHA1:	B20150066A879D2B78DD3D4908F4ACD148EE66F8
SHA-256:	09EBD7F407439990AAC227E70DA23E1A819E8E30282928E324370805F480BEC4
SHA-512:	D72F5D078675C7ADBF6BFC1980712542A10668AEC9163137A2EC70A5E117F8FFDD0F06A6C4C6636E35C04F2754F33D40C65C59D452AFAA8EA4A382F24F200ABD
Malicious:	false
Reputation:	unknown
Preview:	/. Copyright (c) 2011, Yahoo! Inc. All rights reserved.. * Copyright (c) 2011-2012, Log-Normal, Inc. All rights reserved.. * Copyright (c) 2012-2017, SOASTA, Inc. All rights reserved.. * Copyright (c) 2017, Akamai Technologies, Inc. All rights reserved.. * Copyrights licensed under the BSD License. See the accompanying LICENSE.txt file for terms.. /./ Boomerang Version: 1.720.0 b17966bb92f8ac2ddcda4ac1d9c0aaea6d2eda7b */..BOOMR_start=(new Date).getTime();function BOOMR_check_doc_domain(e){if(window){if(!e){if(window.parent===window\|\|!document.getElementById("boomr-if-as"))return;if(window.BOOMR&&BOOMR.boomerang_frame&&BOOMR.window)try{BOOMR.boomerang_frame.document.domain!==BOOMR.window.document.domain&&(BOOMR.boomerang_frame.document.domain=BOOMR.window.document.domain)}catch(t){BOOMR.isCrossOriginError(t)\|\|BOOMR.addError(t,"BOOMR_check_doc_domain.domainFix")}e=document.domain}if(e&&-1!==e.indexOf(".")&&window.parent){try{window.parent.document;return}catch(t){try{document.doma

Chrome Cache Entry: 129

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (6089), with no line terminators
Category:	downloaded
Size (bytes):	6089
Entropy (8bit):	5.4927105223990536
Encrypted:	false
SSDEEP:
MD5:	59FA60456DB5679D15A03D811A40FE1F
SHA1:	93C70A005EA50B843040397E75E72D614C4447DA
SHA-256:	D3A62EDC0A5FDF2D6D0DA4BC51C5F6D52A7861D5322C42973F0B7F54D8711A4D
SHA-512:	6CD6D7438F52F98676E189D5F7A8C1D6186F5C4506DEF689F48CD6C639873D02D44E6CFBC13D6628D75C1F19F380ECDC43B835D5B4193FB82FE5758321F894E2
Malicious:	false
Reputation:	unknown
URL:	https://ct.contentsquare.net/www/bridge-WR110.js
Preview:	(function(){var t,v,a,z;function q(){a=false;z=ClickTaleGlobal.api\|\|{};t=A("ClickTaleSettings.Integration.ProjectType",0);v={clicktaleOnly:0,m1:1,m2:2,m2Prime:3};n();h();w();l();d()}function d(){if(!z.ClickTaleOnReadyInvoked){z.ClickTaleOnReadyInvoked=true;var E,C=ClickTaleGlobal.scripts,D=function(){if(typeof ClickTaleOnReady=="function"){ClickTaleOnReady()}p(window.ClickTaleOnReadyList)};if(C){E=C.dependencies;E&&E.onDependencyResolved(D);E.notifyScriptLoaded("wr")}else{D()}}}function B(){window._uxa&&_uxa.push(["afterPageView",function(){if(_uxa.push(["isRecording"])){(typeof ClickTaleOnRecording=="function")&&ClickTaleOnRecording();WRPubSub.publish("recording")}}])}function A(F,C){var E=F.split(".");var G=window;for(var D=0;D<E.length&&G;){G=G[E[D++]]}return G===undefined?C:G}function n(){var C=e();if(window.ClickTaleSettings&&ClickTaleSettings.CheckAgentSupport){ClickTaleSettings.CheckAgentSupport(function(D){return D},C)}}function p(J){if(typeof J==="object"&&"length" in J){var I

Chrome Cache Entry: 130

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1300
Entropy (8bit):	5.148383658710394
Encrypted:	false
SSDEEP:
MD5:	B1FCEF24125A17126E56F7D2A3C38ABC
SHA1:	E08C8EDC4EBC4FF7FD34B1A76DC6C8EE53892DA1
SHA-256:	B7D6F24A093A43E63845961F3E804DAB3749F8B117A4D4E647614DCF7F47DFAA
SHA-512:	7A39AFB0B1D5435125E9D48EF286233CA8522C4046233386AEA600EB38B7EB73196DC0B8357C0356EF7B4EDC92138B6B3C808D73A8254F8E9CEA41296CE8F79E
Malicious:	false
Reputation:	unknown
Preview:	{"h.key":"259HB-23ACQ-K5LRV-AJYKV-5VUWF","h.d":"arlid:712878","h.t":1734524103328,"h.cr":"e58a35ee3a2dcab343ee3630651bc2e16cd602cd-15b12faa-e6ade702","session_id":"ed3acb86-919f-4733-847e-efa8c69e20f3","site_domain":"arlid:712878","beacon_url":"//684d0d42.akstat.io/","autorun":true,"BW":{"enabled":false},"RT":{"cookie":null,"session_exp":1800},"ResourceTiming":{"enabled":true,"splitAtPath":true},"PageParams":{"xhr":"none","pageGroups":[{"type":"Regexp","parameter1":"\\/.\\/clientreporting","parameter2":"clientreporting","on":["navigation"]},{"type":"Regexp","parameter1":"\\/.\\/employee-benefits","parameter2":"employee-benefits-2","on":["navigation"]},{"type":"Regexp","parameter1":"\\/auth\\/.+","parameter2":"auth","on":["navigation"]},{"type":"Regexp","parameter1":"\\/auth","parameter2":"auth-2","on":["navigation"]},{"type":"Regexp","parameter1":"\\^https\\?:\\/\\/\\[\\^\\/\\?#\\]\\+\$\\?:\\/\\*\\$\\\|\\[\\?#\\]\$","parameter2":"home","on":["navigation"]}],"customMetrics":[],"custo

Chrome Cache Entry: 131

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	78685
Entropy (8bit):	6.020282308187139
Encrypted:	false
SSDEEP:
MD5:	6AEC8CFD5D3A790339DC627F9F1229B5
SHA1:	B6C8CFFE38E1015DD8595F2DD1A92435E2795874
SHA-256:	80583FA3C83831A9E036EBA0500D1B9C0D30892D0701F1617E0FAFAF5AEAA2CA
SHA-512:	4279E479C860007D04CD6FF0B8C45131C18D87420CD5CEB5C727A7DDBFB4206D007069102D643DA97C3BF01D0B756A2EF4662C8E39B6969FC154DE3C763B1EFC
Malicious:	false
Reputation:	unknown
URL:	https://www.gstatic.com/recaptcha/releases/zIriijn3uj5Vpknvt_LnfNbF/styles__ltr.css
Preview:	.goog-inline-block{position:relative;display:-moz-inline-box;display:inline-block}* html .goog-inline-block{display:inline}*:first-child+html .goog-inline-block{display:inline}.recaptcha-checkbox{border:none;font-size:1px;height:28px;margin:4px;width:28px;overflow:visible;outline:0;vertical-align:text-bottom}.recaptcha-checkbox-border{-webkit-border-radius:2px;-moz-border-radius:2px;border-radius:2px;background-color:#fff;border:2px solid #c1c1c1;font-size:1px;height:24px;position:absolute;width:24px;z-index:1}.recaptcha-checkbox-borderAnimation{background-image:url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAFQAAANICAYAAABZl8i8AAAAIGNIUk0AAHomAACAhAAA+gAAAIDoAAB1MAAA6mAAADqYAAAXcJy6UTwAAAAGYktHRAD/AP8A/6C9p5MAAHq9SURBVHja7Z15fFTl9f/fd9ZM9n1PgCyEXSSRNYKCgAuiIipuVSuudavV1tq6W/WrtnWrrZbWDZUqUqUoCoIEQhBI2JesELKvM9mTWe7c3x83d5xAlkky8fv92ft5vfKC19znOWfuZ571POc5B1SoUKFChQoVKlSoUKFChQoVKlSoUKFChQoVKlSoUKFChQoVKlSoUKFChQoVKlSoUKFChQoVKlSoUKHifwGCRqsTNFrdj6VPq9XqtNofT9+wvutQyEyad8t9IaPPntFUd

Chrome Cache Entry: 132

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	76
Entropy (8bit):	4.733023777297422
Encrypted:	false
SSDEEP:
MD5:	D125A7C03996AE38AB0166D08B4120B4
SHA1:	144DABF4D9E555659EF179B48FC65DABCCBCC1BE
SHA-256:	E985C1A52FED0ADF2D9745FBA3A9A087DE5D02DC2ACC4FB17C13D29915FFFF4F
SHA-512:	A61739954067B7A04A6B9AB672A51B2740207753716FB4FE650B0960A489AE4A84FBD59DC298CE2183ABF72E348ED9F35C3375A747DEF548E4C60ABC08EC451B
Malicious:	false
Reputation:	unknown
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISFwmHmN9SCZpUIBIFDQwfmVMSBQ0nJ4K4?alt=proto
Preview:	CjYKDQ0MH5lTGgQIVhgCIAEKJQ0nJ4K4GgQISxgCKhgIClIUCgohQCQjKi4tJj9fEAEY/////w8=

Chrome Cache Entry: 135

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3157)
Category:	dropped
Size (bytes):	3303
Entropy (8bit):	5.452973373664524
Encrypted:	false
SSDEEP:
MD5:	5DEDCDA2C8A6C3A51FD419D306427010
SHA1:	B5B77880EA73F4370C8B478FBF527D050CA1B650
SHA-256:	0486530F1E98818865754A08E1B5442AC5A6A36A6BF6042E3B3338A532E998D2
SHA-512:	20BE4D54AAD68CFD360A760D09CE7E22EFACBD793D91EFBB9F5871FDE686D7095C10502D11274A44A5999A50AF0D5C17780C178A408F4E3CF73B6D45360D1682
Malicious:	false
Reputation:	unknown
Preview:	// For license information, see `https://assets.adobedtm.com/extensions/EPbde2f7ca14e540399dcc1f8208860b7b/AppMeasurement_Module_ActivityMap.js`..function AppMeasurement_Module_ActivityMap(o){function e(){var e=t.pageYOffset+(t.innerHeight\|\|0);e&&+g<e&&(g=e)}function n(){if(f.scrollReachSelector){var t=o.d.querySelector&&o.d.querySelector(f.scrollReachSelector);t?(g=t.scrollTop\|\|0,t.addEventListener("scroll",function(){var e;(e=t&&t.scrollTop+t.clientHeight\|\|0)>g&&(g=e)})):0<i--&&setTimeout(n,1e3)}}function a(e,t){var n,r,i;if(e&&t&&(n=f.c[t]\|\|(f.c[t]=t.split(","))))for(i=0;i<n.length&&(r=n[i++]);)if(-1<e.indexOf(r))return null;return e}function c(e,t,n,r,i){var a,c;if(e.dataset&&(c=e.dataset[t])?a=c:e.getAttribute&&((c=e.getAttribute("data-"+n))?a=c:(c=e.getAttribute(n))&&(a=c)),!a&&o.useForcedLinkTracking&&i){var l;if(e=e.onclick?""+e.onclick:"",varValue="",r&&e&&0<=(t=e.indexOf(r))){for(t+=r.length;t<e.length;)if(n=e.charAt(t++),0<="'\"".indexOf(n)){l=n;break}for(c=!1;t<e.length&&l&

Chrome Cache Entry: 137

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	19
Entropy (8bit):	3.4713544870139303
Encrypted:	false
SSDEEP:
MD5:	34C520D87664032692C4315FFF455D18
SHA1:	978C8B03E97680EB62057A7000F6E7FD97FB9658
SHA-256:	C40AA69F0B306CEA296DD1193C334BC0781587ED51AAB579C0433698BA9E0C4B
SHA-512:	BC6ECF7B39E2C5882C693072A7F541A7C03117A28D14067FED6FDAB6BD455FD8E79C6FE9B81FDF327E64814B91ACEE6F9C1A62134C32CF39731477B712466F38
Malicious:	false
Reputation:	unknown
Preview:	Method Not Allowed.

Chrome Cache Entry: 139

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1300
Entropy (8bit):	5.1668242087889835
Encrypted:	false
SSDEEP:
MD5:	3FE1862F50DF9524639461EF98FD5951
SHA1:	3305C54A25845D7152691CC89B01D2DBDCD9574B
SHA-256:	77E9B9245672C9F73F80CE8830A172ADF9343FED5B46E17A58EEAB3D6BF6ABB0
SHA-512:	819E32B0C9D2038408D0F610068B02A1E0C0E66DE76D778AFC2F6EA40B5D4FB32DA8789353182ADDBB1E9E2CFA3A37C20D10D1EB36855885B3B4DDAFD88AAA5D
Malicious:	false
Reputation:	unknown
Preview:	{"h.key":"259HB-23ACQ-K5LRV-AJYKV-5VUWF","h.d":"arlid:712878","h.t":1734524079615,"h.cr":"310e15464ad3724de351884953f6cc9733396cfc-15b12faa-e6ade702","session_id":"94db6ab7-4daa-44a5-8977-44e5777184e9","site_domain":"arlid:712878","beacon_url":"//684d0d48.akstat.io/","autorun":true,"BW":{"enabled":false},"RT":{"cookie":null,"session_exp":1800},"ResourceTiming":{"enabled":true,"splitAtPath":true},"PageParams":{"xhr":"none","pageGroups":[{"type":"Regexp","parameter1":"\\/.\\/clientreporting","parameter2":"clientreporting","on":["navigation"]},{"type":"Regexp","parameter1":"\\/.\\/employee-benefits","parameter2":"employee-benefits-2","on":["navigation"]},{"type":"Regexp","parameter1":"\\/auth\\/.+","parameter2":"auth","on":["navigation"]},{"type":"Regexp","parameter1":"\\/auth","parameter2":"auth-2","on":["navigation"]},{"type":"Regexp","parameter1":"\\^https\\?:\\/\\/\\[\\^\\/\\?#\\]\\+\$\\?:\\/\\*\\$\\\|\\[\\?#\\]\$","parameter2":"home","on":["navigation"]}],"customMetrics":[],"custo

Chrome Cache Entry: 140

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	102
Entropy (8bit):	4.8035671313969885
Encrypted:	false
SSDEEP:
MD5:	C206147C7CAE99642A4F8A2C640A0019
SHA1:	8C32B7B7E0807BBE85E5C8C94F87AFEA31EEDC40
SHA-256:	6F55ADBECCE78B9C566F8DC830177DC91782702FF35F213F009FC2B902E25603
SHA-512:	0D94AA53B801AC69A9BB4A7DF4FC0E00B6FFD1C5668A6FEE4EFC11986B7F516EB27A8A0197C0106A4295ACD5F63C222EA2F1BD9431BF2D689672AC91C5528EB6
Malicious:	false
Reputation:	unknown
URL:	https://www.google.com/recaptcha/api2/webworker.js?hl=en&v=zIriijn3uj5Vpknvt_LnfNbF
Preview:	importScripts('https://www.gstatic.com/recaptcha/releases/zIriijn3uj5Vpknvt_LnfNbF/recaptcha__en.js');

Chrome Cache Entry: 144

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (18288)
Category:	downloaded
Size (bytes):	18908
Entropy (8bit):	5.6255223057698815
Encrypted:	false
SSDEEP:
MD5:	0240AA22895CF57CB91160E784542720
SHA1:	F50652CCC59E7556511178A2A6BF92407D2E0955
SHA-256:	5DEEC06E184F7D97048A4A0D9A182105700484EBAC0C804A58A4BFAE84B843B1
SHA-512:	C4CADEB4398EB472EEF4989627E74C8CC9A80A1045F2C01E3DCFA63D20B52901223F90AB0A0F6F13833F627A0A5C4BBDDEB86CA9F4A2972654F881B2DF4B1879
Malicious:	false
Reputation:	unknown
URL:	https://www.google.com/js/bg/Xe7AbhhPfZcEikoNmhghBXAEhOusDIBKWKS_roS4Q7E.js
Preview:	/* Anti-spam. Want to say hello? Contact (base64) Ym90Z3VhcmQtY29udGFjdEBnb29nbGUuY29t / (function(){var U=function(p){return p},G=function(p,b){if(!(p=(b=null,B).trustedTypes,p)\|\|!p.createPolicy)return b;try{b=p.createPolicy("bg",{createHTML:U,createScript:U,createScriptURL:U})}catch(e){B.console&&B.console.error(e.message)}return b},B=this\|\|self;(0,eval)(function(p,b){return(b=G())&&p.eval(b.createScript("1"))===1?function(e){return b.createScript(e)}:function(e){return""+e}}(B)(Array(Math.random()7824\|0).join("\n")+['(function(){/',.'',.' Copyright Google LLC',.' SPDX-License-Identifier: Apache-2.0',.'/',.'var H=function(p,b){for(b=[];p--;)b.push(Math.random()*255\|0);return b},C=function(p,b){b.J.splice(0,0,p)},e_=function(p,b,U,B,Y){function r(){}return B=(p=$q(p,function(v){r&&(b&&bb(b),Y=v,r(),r=void 0)},(Y=void 0,!!b)),p)[1],U=p[0],{invoke:function(v,W,E,e){function G(){Y(function(X){bb(function(){v(X)})},E)}if(!W)return W=U(E),v&&v(W),W;Y?G():(e=r,r=function(){bb((e(),G))})

Chrome Cache Entry: 145

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	1143
Entropy (8bit):	5.154821912697526
Encrypted:	false
SSDEEP:
MD5:	3B7D238B4F5797BE184585637B685995
SHA1:	30BCC6167FC49EC655A0C6D45311253A8E11DF67
SHA-256:	97A9E6259E1D5034B27085D72E4630C12EA3DEFB5EE6751B147E2CB4FD3AB328
SHA-512:	4471C74486A1BB0EE53551F3C12659DBB47CA578942A236FBC3BCC203D09E3E637625E300703E3E488BDCEE6D9FA554AB50C830439AD39A35B5AAA19209A6E20
Malicious:	false
Reputation:	unknown
URL:	"https://c.go-mpulse.net/api/config.json?key=259HB-23ACQ-K5LRV-AJYKV-5VUWF&d=www.mynylgbs.com&t=5781747&v=1.720.0&if=&sl=0&si=dc850f7d-a642-4995-b34e-6f5e9e00df63-soovbt&plugins=AK,ConfigOverride,Continuity,PageParams,IFrameDelay,AutoXHR,SPA,History,Angular,Backbone,Ember,RT,CrossDomain,BW,PaintTiming,NavigationTiming,ResourceTiming,Memory,CACHE_RELOAD,Errors,TPAnalytics,UserTiming,Akamai,Early,EventTiming,LOGN&acao=&ak.ai=712878"
Preview:	{"h.key":"259HB-23ACQ-K5LRV-AJYKV-5VUWF","h.d":"arlid:712878","h.t":1734524076790,"h.cr":"8982da84394d56fa158d357f1edbe3bcbd4f68ad-15b12faa-e6ade702","session_id":"97d2adcf-0833-4b31-962b-ba14223f8d4a","site_domain":"arlid:712878","beacon_url":"//684d0d4c.akstat.io/","autorun":true,"BW":{"enabled":false},"RT":{"cookie":null,"session_exp":1800},"ResourceTiming":{"enabled":true,"splitAtPath":true},"PageParams":{"xhr":"none","pageGroups":[{"type":"Regexp","parameter1":"\\/.\\/clientreporting","parameter2":"clientreporting","on":["navigation"]},{"type":"Regexp","parameter1":"\\/.\\/employee-benefits","parameter2":"employee-benefits-2","on":["navigation"]},{"type":"Regexp","parameter1":"\\/auth\\/.+","parameter2":"auth","on":["navigation"]},{"type":"Regexp","parameter1":"\\/auth","parameter2":"auth-2","on":["navigation"]},{"type":"Regexp","parameter1":"\\^https\\?:\\/\\/\\[\\^\\/\\?#\\]\\+\$\\?:\\/\\*\\$\\\|\\[\\?#\\]\$","parameter2":"home","on":["navigation"]}],"customMetrics":[],"custo

Static File Info

⊘No static file info

Description:	Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring Application Access Token .
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Process: Process Creation
Platforms:	Linux, macOS, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://www.mynylgbs.com

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 115

Chrome Cache Entry: 118

Chrome Cache Entry: 119

Chrome Cache Entry: 121

Chrome Cache Entry: 122

Chrome Cache Entry: 123

Chrome Cache Entry: 127

Chrome Cache Entry: 128

Chrome Cache Entry: 129

Chrome Cache Entry: 130

Chrome Cache Entry: 131

Chrome Cache Entry: 132

Chrome Cache Entry: 135

Chrome Cache Entry: 137

Chrome Cache Entry: 139

Chrome Cache Entry: 140

Chrome Cache Entry: 144

Chrome Cache Entry: 145

Static File Info

Windows Analysis Report
http://www.mynylgbs.com