Edit tour

Windows Analysis Report
https://pass-ga.com/

Overview

General Information

Sample URL:	https://pass-ga.com/
Analysis ID:	1578681

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

AI detected suspicious Javascript

HTML body contains low number of good links

HTML title does not match URL

Invalid T&C link found

Stores files to the Windows start menu directory

Suspicious form URL found

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 5520 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6592 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1900,i,14711971775938418366,1057140092108745353,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6252 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://pass-ga.com/" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected phishing page

Source: https://pass-ga.com/connexion.php?sslchannel=true&sessionid=6jWhZMY3iSVuXRGSJQla6pY84kQfas88wkIjxdIctxGJWkZlUg2mR90HEjORonCTKy9kszjuHM1AenwTRLkOKEewcYObO5DEG5QuhydEd2dC2klgnsKsPQ0YQ1kO32Fyxk

Joe Sandbox AI: Score: 8 Reasons: The legitimate domain for Peach Pass is peachpass.com., The URL 'pass-ga.com' does not match the legitimate domain and includes a hyphen, which is often used in phishing attempts., The domain 'pass-ga.com' is not commonly associated with Peach Pass., The brand 'Peach Pass' is a known brand associated with toll services in Georgia. DOM: 2.9.pages.csv

AI detected suspicious Javascript

Source: 0.4.id.script.csv

Joe Sandbox AI: Detected suspicious JavaScript with source url: https://www.google.com/recaptcha/api2/anchor?ar=1&... The provided JavaScript snippet exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code/URLs. While the script may have a legitimate purpose, the combination of these factors suggests a medium to high risk level that requires further investigation.

Source: https://pass-ga.com/personnelle.php?sslchannel=true&sessionid=VXOwv7IuwXtfRYxBwGyIbcu6LtCWroriIdsM7fKDxlJ7sgI8Oj7goYb9xpP5oNd0fqYvybKDvd96JOSSayIeIsS4AfW05vDFJI2KYLHubUYtm4WAmUjPSMau9pBFH2qtJT

HTTP Parser: Number of links: 0

HTTP Parser: Title: SRTA does not match URL

HTTP Parser: Invalid link: Privacy Policy

HTTP Parser: Form action: paiement.php?sslchannel=true&sessionid=r38pwWmZlBvIKmFPX9NdpiIvsefPAcuWGjTwV01DH4CjlE8rpYdoQvfazxG7mR5HBfLPWebeV09X6u7Ta2p8KCyfle1qiE1p1NfgiquprrpbrYbDoJ7aIHnoXZaWK1dQMn

Source: https://pass-ga.com/	HTTP Parser: No favicon
Source: https://pass-ga.com/	HTTP Parser: No favicon
Source: https://pass-ga.com/	HTTP Parser: No favicon
Source: https://pass-ga.com/	HTTP Parser: No favicon
Source: https://pass-ga.com/	HTTP Parser: No favicon
Source: https://pass-ga.com/	HTTP Parser: No favicon
Source: https://pass-ga.com/	HTTP Parser: No favicon
Source: https://pass-ga.com/	HTTP Parser: No favicon

HTTP Parser: No <meta name="author".. found

HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries

Source: unknown	HTTPS traffic detected: 2.20.62.163:443 -> 192.168.2.16:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.20.62.163:443 -> 192.168.2.16:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49783 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 2.20.62.163
Source: unknown	TCP traffic detected without corresponding DNS query: 2.20.62.163
Source: unknown	TCP traffic detected without corresponding DNS query: 2.20.62.163
Source: unknown	TCP traffic detected without corresponding DNS query: 2.20.62.163
Source: unknown	TCP traffic detected without corresponding DNS query: 2.20.62.163
Source: unknown	TCP traffic detected without corresponding DNS query: 2.20.62.163
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 2.20.62.163
Source: unknown	TCP traffic detected without corresponding DNS query: 2.20.62.163
Source: unknown	TCP traffic detected without corresponding DNS query: 2.20.62.163
Source: unknown	TCP traffic detected without corresponding DNS query: 2.20.62.163
Source: unknown	TCP traffic detected without corresponding DNS query: 2.20.62.163
Source: unknown	TCP traffic detected without corresponding DNS query: 2.20.62.163
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 2.20.62.163
Source: unknown	TCP traffic detected without corresponding DNS query: 2.20.62.163
Source: unknown	TCP traffic detected without corresponding DNS query: 2.20.62.163
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 2.20.62.163
Source: unknown	TCP traffic detected without corresponding DNS query: 2.20.62.163
Source: unknown	TCP traffic detected without corresponding DNS query: 2.20.62.163
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197

Source: global traffic	DNS traffic detected: DNS query: pass-ga.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 2.20.62.163:443 -> 192.168.2.16:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.20.62.163:443 -> 192.168.2.16:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49783 version: TLS 1.2

Source: classification engine

Classification label: mal52.phis.win@18/44@12/160

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\Chrome\Application\Dictionaries

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1900,i,14711971775938418366,1057140092108745353,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://pass-ga.com/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1900,i,14711971775938418366,1057140092108745353,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	3 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Name	IP	Active	Malicious	Antivirus Detection	Reputation
pass-ga.com	185.31.200.249	true	true		unknown
www.google.com	142.250.181.132	true	false		high

Contacted URLs

Name	Malicious	Reputation
https://pass-ga.com/	false	unknown
https://pass-ga.com/note.php	false	unknown
https://pass-ga.com/connexion.php?sslchannel=true&sessionid=6jWhZMY3iSVuXRGSJQla6pY84kQfas88wkIjxdIctxGJWkZlUg2mR90HEjORonCTKy9kszjuHM1AenwTRLkOKEewcYObO5DEG5QuhydEd2dC2klgnsKsPQ0YQ1kO32Fyxk	true	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.217.19.228	unknown	United States	15169	GOOGLEUS	false
172.217.19.206	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
172.217.17.78	unknown	United States	15169	GOOGLEUS	false
172.217.17.67	unknown	United States	15169	GOOGLEUS	false
172.217.17.35	unknown	United States	15169	GOOGLEUS	false
216.58.208.227	unknown	United States	15169	GOOGLEUS	false
185.31.200.249	pass-ga.com	Netherlands	28685	ASN-ROUTITNL	true
142.250.181.132	www.google.com	United States	15169	GOOGLEUS	false
172.217.19.234	unknown	United States	15169	GOOGLEUS	false
216.58.208.234	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.217.19.170	unknown	United States	15169	GOOGLEUS	false
64.233.162.84	unknown	United States	15169	GOOGLEUS	false
142.250.181.99	unknown	United States	15169	GOOGLEUS	false
142.250.181.10	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1578681
Start date and time:	2024-12-20 03:51:03 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://pass-ga.com/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal52.phis.win@18/44@12/160

Warnings

Exclude process from analysis (whitelisted): svchost.exe
Excluded IPs from analysis (whitelisted): 216.58.208.227, 172.217.17.78, 64.233.162.84, 142.250.181.142, 172.217.19.170, 172.217.17.67, 216.58.208.234, 88.221.134.40
Excluded domains from analysis (whitelisted): clients2.google.com, accounts.google.com, redirector.gvt1.com, ajax.googleapis.com, ctldl.windowsupdate.com, clientservices.googleapis.com, clients.l.google.com, www.gstatic.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: https://pass-ga.com/

LLM Input / Output

Input	Output
URL: https://pass-ga.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://pass-ga.com
URL: https://pass-ga.com/... Model: Joe Sandbox AI	{ "risk_score": 4, "reasoning": "The script exhibits moderate-risk behaviors, including external data transmission and potential redirects to unknown domains. However, the intent appears to be related to form validation and redirection, which are common web application behaviors. Further review may be needed to ensure the script is not being used for malicious purposes." }
var onReturnCallback = function (response) { var url = 'valider.php'; $.ajax({ url: url, type: 'post', dataType: 'json', data: { response: response }, success: function (data) { var res = data.success.toString(); var red = data.redirect.toString(); if (res == 'true') { window.location.reload(); }else{ window.location.replace(red); } }, }); };
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&... Model: Joe Sandbox AI	{ "risk_score": 7, "reasoning": "The provided JavaScript snippet exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code/URLs. While the script may have a legitimate purpose, the combination of these factors suggests a medium to high risk level that requires further investigation." }
recaptcha.anchor.Main.init("[\x22ainput\x22,[\x22bgdata\x22,\x22Ly93d3cuZ29vZ2xlLmNvbS9qcy9iZy9YZTdBYmhoUGZaY0Vpa29ObWhnaEJYQUVoT3VzRElCS1dLU19yb1M0UTdFLmpz\x22,\x22\x22,\x22bFVab3NrWnJJNzU5cnJZcWxlUU0zZmdQNzFmQ3FVMXA0RmZhZ1JaS1JpZmxPMmIrQ0dXajJSUVhpSFdWUGV0RXhJQ0ZTc01xUVpPUGpxUGZRc2dZY01TWSthTzFxdVExTVZjcHRKSnJNZmxxUlNvSFhkcHJxc0NNVkJPNEFpTlgyb05ZWFhwWFhpTnEvTkx3L3ZMUVFBR2RrSk9iam5QMkJIYUVITFdIdUU0bnFEUTBpWWV3WGVBNkh1U29IakMwd0tYNHEvbVpNYy9qRjhvTjN6bzVPOTdSRTYxUllDYm82cUlXWjFpS3VobytJNCtQWmt2SkFrRzZVUnJuSW1NdkRYRVpRaVNORGc4U0VqcklUNmhrc25WWWRFNjFwTUNxVkM2VnR1Mmk4RHUxdHRRNVozeFdHYWYrUFFsb3liM1BMdXE3dDBUaUdlNzFGNFJIVEpReFBUYTlyWmpXQUlXQzZpRUp1ZnFYcWlYeUhxZEtnRkkvb0xPUXNLQzVZa3hUU3NCM0w2TUo4OEtYcm0rRXhQL2dYZnVQbE1zaE9zUTY4TXZYN0FlWW5DMjlGYVBYb2hqSG4rWGxKSDFUbkpxTkZ4REgyZVN5bUFoUHJrUndWUk1NMmpzVW1SNDZmVlpyK3h0RThBdVY1WUMrcUtmZHhFbzhjb05nV2tGMFZBUUlkTnhHQkhMRFZCa1E1QVIyS2J1MWVmZVdDek0xQWdkTlVIMXdWbWdycGNUVVJhVndpVXFRTG5CL2JabU5jTE1qYkN5YkIweVI4STAzeUFjbFJkUjlHOWlEZnpYc2hjUEZqUmJESVE0QmRqRTdOYzVJazNSK1JxMjZZK1EreVVDNTBHSkNVV2pKRVRoWjVzTzFrSDJKczdiZW9DOVZIZmRZanRsaitXYlg0MHN4aFFCcklvOFN0QXFjOUpYcUtOUXhhR0pkdjJnWEg4bG5MNGV5VERKTnQ0SGpuWlVmdjMyUVBrd2ZiT2hVZnhmU0dvcE5PSTdYUGE4TlQzSXZqVFV0UE9LNjRlUEpVdDdWQVhyOHI3SFhDSmNhMTFodmhGMW45dmxleWJFYmJZeUJkZWpjclEzd3phL0FhdVhpdnBqUGpsMmJEd3o1d3VSWllKOE5hSSsrY2VYWjZFYWM4dHFHS3dmT3VtVzFMWE5ONFhWMjF6VHljQTlHUjlobFI2dWpiOU5xZ0tJTWZZdnkrTjFPdWR3bTFHbzNkTy92YlFDMWorMG5YK1h0NFIwOFhCRmJiNjh1WnVEUlVOckhyaTU1eFMwWnFQb3ovU01Xc29GSWQwblpjR1BuLzU4L1BEYnB3WXQyOHg5ZGsyTk5YS0prQVZUTWdvblBSMGxFaFlVUytoZkYvekRtWnNlZGJpYWI4U3FZL2l2U3NSL1Izb3JsOHdTSU5WZDFHeis5NFZQNjZxNUlhWk9BcGp5QW51YUpZMjdteHRVMmtjMENzVnZDdkt5Nkh0RzU0N2ZLM3g5Q2xVd2QzbXZIVDVlNkN4a2VkUFJsRG05NExNNHRITS9idkNiSVUrRERXYkhROHFaWVUwaVBobHM4QVBkRnZSLzlLMS92TVh0ejJXZDBzdEluZDdyb2YxTFNBaG5hQUh5eXliUWdyQlRkU0hNNGJXKzhqTWhGbkJyU0RmaVRBRWZMWXU1eGlMODdtN1VsY0YvM3RPK0o5WlBRMjllcS9RbnFKOFQza09Fdlhjd0dVVGFxcmZYb3pORE1XM0Erb3E0ZHA5WmNVbys0MEVlb1JKRWhUdkorWVh2aVJPd3JsUHVXWU9acklpUVZEZkNkcE9CWnZBSjRkaEc3ZUFScHJ6c3F2V2RRbXgwZVRMREh4LzJYdVEya0Zmc0dQVW1LVWptczBuNHlnNTVNQkxQTXJoQzQwck5WOVFCRWxHTTk4a2NDY3BWN3dpNzM4RUNpa1EzeHJEWDQ2ZDlja3J5UlFsTkZHL3l2OHgwY29EVzZFRUhuWGpONmNsVnJYek9oUGJPWDdYNzZ5WXdjTHN5eTMwck9VUHU5c1B1Vk9ka05vT2VianZtM3dBckkrcmtncjZNd01OM2o0MlpJbElFVnhyTGtBLzRydEtVMWhYbW1vVUF0c21nSHY1ZElDeGVJUGx0eEp3Y3Y2VmhsL1lmbmQzc2liTk5aNmp5KytnMldSdGhhZXZwZXc4MEp2SmhzalNFMGhEL01UVEhYRFgxdXorRHFqUjg5bDYwZzl0RDUrNGZqcThSNTJ6bHZjcEFKMjY5MXhZNDROeXhTcVNQY044OFpBNUN6QmF6bVlCem5vbDBML05vRW9FRW1YQVBadkJudi80dEZXRjFFK1lWYzdEWFdTQTNncWpTZGVyRGVPZE9OWFRpdVcyUlBNd2xYQjVhVlJvNzh6R1NaT1ZrVEMzOEc1dzVlSEpSdEY0UlRyeG14VG1JR3R0cTN2VHdsTngxb0JPNGVJSkVZSTdKbnNpakJPTHc3RUl5ZmV1TXlQcmFabWxBemJRc2JNdEV1akhnMzFiNnkva2dvRXlzTm9kMk5PcXg0SEtvWVlnVElBcWIvR2QwRWtzWjZiOXBIa3d6VHZubVVEZEVZUEtCUU1DeXhsNEJVaHYyU3dNRDRBM1RzQjdxVFVVenZNdkZUcWh6ZE1pWEpMWjUwQlhPWjc4NStpeS9WcEZIbklvUmljZ25LUDRUYlRBU0w0d0hJMUorejlpK2IzSzFRWWhXSzkyZXpSbExENFRockdFcm9FWG93MGpXb0VVeG5OZWkrYmw1OU5mMk9tNEowNnBjY2lzcVRiVzlEQ2NYR2xXOUFKYWFMaGFxYTQyQ1BkalQ5MlhNWHcwNWppM1lnMVF3eE9uYWFORXpleTdwUHVGeGpkWUY1U3VjNm5KaitkNWRxNWp4N2RKM1dUYmxtQjJuZll0Rnc5bThXcVpCVWdFcnNmVDZPRDh2Wmp6K3VxemVvSFRKQk1XeXVqNkl0eEppdXRYYXVBS0dXeXR5cmZwdmxQTU1kdjBkV1hkcTVmaEh5OXExR1NmZXV2NEhuaG1oQm9hMDlscWNhdEg0cFpQWGhOMlh6U0pueFpPaG5vQUtaWUtVREtEaHVkdHNqWloyMWFDRjlJM1ZrUWF0TG5IRjhBTXZLbmxzREZ5UGhlNEV3TlRRbG13ZlJMWWljd2VEY2pJbVI4NjM2UHBzUXNZSlF1aVp0SWpyRWtLNTBBVHdoakpYSHNKZml2TnZ2NzIySGZIcEhkN0VRb3I3cHF3dlBiYUc2OHp6d1l2VkM1Z1U0aytWMWhvVm4vcENKdElaYnVjRUxnak5HZGZrU0Rja1RDUlhLQkdQR0F6Ykd1bXM4VExUeHZOangydnpqY2MxUkRtWU1HNVJ5alZkMkNuM1RGV3VSdEd0cTJVQURXZU5ZMkFRUmdYd2V6Qkg1QlE0RjNpeFlMRENWZk1oV0s5MjROWGdyTVFiNUx2c1FiTHRVckVwcWFMM3ZOQnhBeG9tK3ptVjRBTjVDYy9rejl4VXFMK2hLNWplRVJWU3FqTkxQYmgyQmE3c1JCQWRlYkNIbTJtazRkQ2UvOG16b0hmNENxbExLUTBUZWhlTjZ6SHVMVm1UOVhkSGYzK0FoTU4rbStzOTEyUzNoY0s1WWFGRDV1TTIyZk4raHE2QVkrSDd3bEV3cFlocFQ3WThHclFLRFdHY0s2emZncFlyZFM3RHhVR0RaSlppd1lHMGlhRUc1UGFYYUZKV1hZQm8ycFhvWFZTZ1BKa2tsNU9wTzNXcW9LY3VkUEoyNjlmMndiOUFNbS8rTGQ2T1dzdzRuMXZYTHJZVUhvajN
URL: https://pass-ga.com/ Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "I'm not a robot", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://www.google.com/js/bg/Xe7AbhhPfZcEikoNmhghB... Model: Joe Sandbox AI	{ "risk_score": 3, "reasoning": "The provided JavaScript snippet appears to be a Google-authored script that is likely used for security and anti-spam purposes. While it contains some obfuscated code and dynamic behavior, the overall intent seems to be benign and focused on protecting users. The script does not exhibit any clear high-risk indicators, and the use of trusted Google domains and APIs suggests a legitimate purpose. Some moderate-risk behaviors, such as external data transmission and DOM manipulation, are present, but they are likely part of the script's security functionality. Overall, this script poses a low risk and can be considered safe for execution in a trusted environment." }
/* Anti-spam. Want to say hello? Contact (base64) Ym90Z3VhcmQtY29udGFjdEBnb29nbGUuY29t / (function(){var U=function(p){return p},G=function(p,b){if(!(p=(b=null,B).trustedTypes,p)\|\|!p.createPolicy)return b;try{b=p.createPolicy("bg",{createHTML:U,createScript:U,createScriptURL:U})}catch(e){B.console&&B.console.error(e.message)}return b},B=this\|\|self;(0,eval)(function(p,b){return(b=G())&&p.eval(b.createScript("1"))===1?function(e){return b.createScript(e)}:function(e){return""+e}}(B)(Array(Math.random()7824\|0).join("\n")+['(function(){/', '', ' Copyright Google LLC', ' SPDX-License-Identifier: Apache-2.0', '/', 'var H=function(p,b){for(b=[];p--;)b.push(Math.random()255\|0);return b},C=function(p,b){b.J.splice(0,0,p)},e_=function(p,b,U,B,Y){function r(){}return B=(p=$q(p,function(v){r&&(b&&bb(b),Y=v,r(),r=void 0)},(Y=void 0,!!b)),p)[1],U=p[0],{invoke:function(v,W,E,e){function G(){Y(function(X){bb(function(){v(X)})},E)}if(!W)return W=U(E),v&&v(W),W;Y?G():(e=r,r=function(){bb((e(),G))})},pe:function(v){B&&B(v)}}},UG=function(p,b,U,B){try{B=p[((b\|0)+2)%3],p[b]=(p[b]\|0)-(p[((b\|0)+1)%3]\|0)-(B\|0)^(b==1?B<<U:B>>>U)}catch(Y){throw Y;}},D=function(p,b,U,B,Y,r,v,W,E,e,G,X,f,T){if((r=t(212,U),r)>=U.K)throw[x,31];for(v=(E=(W=U.DM.length,0),X=r,b);v>0;)e=X%8,f=X>>3,G=8-(e\|0),G=G<v?G:v,T=U.C[f],p&&(B=U,B.F!=X>>6&&(B.F=X>>6,Y=t(232,B),B.aU=BA(B.F,B.N,[0,0,Y[1],Y[2]])),T^=U.aU[f&W]),E\|=(T>>8-(e\|0)-(G\|0)&(1<<G)-1)<<(v\|0)-(G\|0),X+=G,v-=G;return L(U,212,((p=E,r)\|0)+(b\|0)),p},Yq=function(p,b,U,B,Y,r,v,W){return(W=(b=[-61,12,-79,24,32,(r=B&7,86),b,2,-34,(Y=GN,-25)],K[p.A](p.BE)),W)[p.A]=function(E){r+=6+7(v=E,B),r&=7},W.concat=function(E){return(E=(v=(E=+(E=U%16+1,Y()\|0)E-Ev+52vv+4UUE-208UUv- -4004v+b[r+43&7]UE+r-624U*v,void 0),b[E]),b)[(r+45&7)+(B&2)]=E,b[r+(B&2)]=12,E},W},Xc=function(p,b,U){return b.j2(function(B){U=B},false,p),U},P=function(p,b,U){(L(b,U,p),p)[j_]=2796},$q=function(p,b,U,B,Y,r,v,W){return(W=l[p.substring(0,3)+"_"])?W(p.substring(3),b,U,B,Y,r,v):oe(b,p)},fi=function(p,b){return b=0,function(){return b<p.length?{done:false,value:p[b++]}:{done:true}}},rj=function(p,b){return(b=d(p),b)&128&&(b=b&127\|d(p)<<7),b},vA=function(p,b){return p[b]<<24\|p[(b\|0)+1]<<16\|p[(b\|0)+2]<<8\|p[(b\|0)+3]},HA=function(p,b,U,B){q((U=J(b),B=J(b),z(t(U,b),p)),b,B)},TN=function(p){return p},WA=function(p,b,U){if((b=typeof p,b)=="object")if(p){if(p instanceof Array)return"array";if(p instanceof Object)return b;if((U=Object.prototype.toString.call(p),U)=="[object Window]")return"object";if(U=="[object Array]"\|\|typeof p.length=="number"&&typeof p.splice!="undefined"&&typeof p.propertyIsEnumerable!="undefined"&&!p.propertyIsEnumerable("splice"))return"array";if(U=="[object Function]"\|\|typeof p.call!="undefined"&&typeof p.propertyIsEnumerable!="undefined"&&!p.propertyIsEnumerable("call"))return"function"}else return"null";else if(b=="function"&&typeof p.call=="undefined")return"object";return b},oe=function(p,b){return[function(){return b},(p(function(U){U(b)}),function(){})]},Ci=function(p,b){if(b=(p=Q.trustedTypes,null),!p\|\|!p.createPolicy)return b;try{b=p.createPolicy("bg",{createHTML:TN,createScript:TN,createScriptURL:TN})}catch(U){Q.console&&Q.console.error(U.message)}return b},ni=function(p,b,U,B,Y){if(B=b[0],B==EG)p.D=true,p.Af=25,p.V(b);else if(B==A){Y=b[1];try{U=p.Y\|\|p.V(b)}catch(r){V(p,r),U=p.Y}(Y((b=p.j(),U)),p).B+=p.j()-b}else if(B==yd)b[3]&&(p.o=true),b[4]&&(p.D=true),p.V(b);else if(B==t4)p.o=true,p.V(b);else if(B==xq){try{for(U=0;U<p.T.length;U++)try{Y=p.T[U],Y[0][Y[1]](Y[2])}catch(r){}}catch(r){}((0,b[1])(function(r,v){p.j2(r,true,v)},function(r){(C((r=!p.J.length,[h4]),p),r)&&F(false,p,true)},(U=(p.T=[],p.j()),function(r){return p.Yi(r)}),function(r,v){return p.ki(r,v)}),p).B+=p.j()-U}else{if(B==Li)return U=b[2],L(p,388,b[6]),L(p,393,U),p.V(b);B==h4?(p.C=[],p.O3=[],p.O=null):B==j_&&Q.document.readyState==="loading"&&(p.W=function(r,v){function W(){v\|\|(v=true,r())}(Q.document.addEventListener("DOMContentLoaded",(v=false,W),Z),Q).addEven
URL: https://pass-ga.com/ Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: https://pass-ga.com/ Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://pass-ga.com/ Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://pass-ga.com/ Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: https://pass-ga.com/ Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: https://pass-ga.com/ Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://pass-ga.com/ Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: https://pass-ga.com/connexion.php?sslchannel=true&sessionid=6jWhZMY3iSVuXRGSJQla6pY84kQfas88wkIjxdIctxGJWkZlUg2mR90HEjORonCTKy9kszjuHM1AenwTRLkOKEewcYObO5DEG5QuhydEd2dC2klgnsKsPQ0YQ1kO32Fyxk Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Find my statement", "prominent_button_name": "Find Now", "text_input_field_labels": [ "Full Name", "Zip Code" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://pass-ga.com/connexion.php?sslchannel=true&sessionid=6jWhZMY3iSVuXRGSJQla6pY84kQfas88wkIjxdIctxGJWkZlUg2mR90HEjORonCTKy9kszjuHM1AenwTRLkOKEewcYObO5DEG5QuhydEd2dC2klgnsKsPQ0YQ1kO32Fyxk Model: Joe Sandbox AI	{ "brands": [ "Peach Pass" ] }
	{ "brands": [ "Peach Pass" ] }
URL: https://pass-ga.com/connexion.php?sslchannel=true&sessionid=6jWhZMY3iSVuXRGSJQla6pY84kQfas88wkIjxdIctxGJWkZlUg2mR90HEjORonCTKy9kszjuHM1AenwTRLkOKEewcYObO5DEG5QuhydEd2dC2klgnsKsPQ0YQ1kO32Fyxk Model: Joe Sandbox AI	```json{ "legit_domain": "peachpass.com", "classification": "known", "reasons": [ "The legitimate domain for Peach Pass is peachpass.com.", "The URL 'pass-ga.com' does not match the legitimate domain and includes a hyphen, which is often used in phishing attempts.", "The domain 'pass-ga.com' is not commonly associated with Peach Pass.", "The brand 'Peach Pass' is a known brand associated with toll services in Georgia." ], "riskscore": 8} Google indexed: False
URL: pass-ga.com Brands: Peach Pass Input Fields: Full Name, Zip Code
URL: https://pass-ga.com/note.php Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "To avoid a late fees of 35.00$, please settle your balance promptly", "prominent_button_name": "PAY NOW", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://pass-ga.com/note.php Model: Joe Sandbox AI	{ "brands": [ "Peach Pass" ] }
	{ "brands": [ "Peach Pass" ] }
URL: https://pass-ga.com/aca_assetz/js/misc.js... Model: Joe Sandbox AI	{ "risk_score": 3, "reasoning": "The provided JavaScript code appears to be a part of the jQuery Mask Plugin, which is a legitimate library used for input masking. The code does not contain any high-risk indicators, such as dynamic code execution, data exfiltration, or redirects to malicious domains. It primarily focuses on handling user input and updating the input field's value based on the defined mask. While the code uses some legacy practices like `XDomainRequest`, these are not inherently malicious and are commonly found in older libraries. Overall, the code seems to be a benign implementation of an input masking functionality, with a low risk score." }
// jQuery Mask Plugin v1.14.8 // github.com/igorescobar/jQuery-Mask-Plugin var $jscomp={scope:{},findInternal:function(a,f,c){a instanceof String&&(a=String(a));for(var l=a.length,g=0;g<l;g++){var b=a[g];if(f.call(c,b,g,a))return{i:g,v:b}}return{i:-1,v:void 0}}};$jscomp.defineProperty="function"==typeof Object.defineProperties?Object.defineProperty:function(a,f,c){if(c.get\|\|c.set)throw new TypeError("ES3 does not support getters and setters.");a!=Array.prototype&&a!=Object.prototype&&(a[f]=c.value)}; $jscomp.getGlobal=function(a){return"undefined"!=typeof window&&window===a?a:"undefined"!=typeof global&&null!=global?global:a};$jscomp.global=$jscomp.getGlobal(this);$jscomp.polyfill=function(a,f,c,l){if(f){c=$jscomp.global;a=a.split(".");for(l=0;l<a.length-1;l++){var g=a[l];g in c\|\|(c[g]={});c=c[g]}a=a[a.length-1];l=c[a];f=f(l);f!=l&&null!=f&&$jscomp.defineProperty(c,a,{configurable:!0,writable:!0,value:f})}}; $jscomp.polyfill("Array.prototype.find",function(a){return a?a:function(a,c){return $jscomp.findInternal(this,a,c).v}},"es6-impl","es3"); (function(a,f,c){"function"===typeof define&&define.amd?define(["jquery"],a):"object"===typeof exports?module.exports=a(require("jquery")):a(f\|\|c)})(function(a){var f=function(b,h,e){var d={invalid:[],getCaret:function(){try{var a,n=0,h=b.get(0),e=document.selection,k=h.selectionStart;if(e&&-1===navigator.appVersion.indexOf("MSIE 10"))a=e.createRange(),a.moveStart("character",-d.val().length),n=a.text.length;else if(k\|\|"0"===k)n=k;return n}catch(A){}},setCaret:function(a){try{if(b.is(":focus")){var p, d=b.get(0);d.setSelectionRange?d.setSelectionRange(a,a):(p=d.createTextRange(),p.collapse(!0),p.moveEnd("character",a),p.moveStart("character",a),p.select())}}catch(z){}},events:function(){b.on("keydown.mask",function(a){b.data("mask-keycode",a.keyCode\|\|a.which);b.data("mask-previus-value",b.val())}).on(a.jMaskGlobals.useInput?"input.mask":"keyup.mask",d.behaviour).on("paste.mask drop.mask",function(){setTimeout(function(){b.keydown().keyup()},100)}).on("change.mask",function(){b.data("changed",!0)}).on("blur.mask", function(){c===d.val()\|\|b.data("changed")\|\|b.trigger("change");b.data("changed",!1)}).on("blur.mask",function(){c=d.val()}).on("focus.mask",function(b){!0===e.selectOnFocus&&a(b.target).select()}).on("focusout.mask",function(){e.clearIfNotMatch&&!g.test(d.val())&&d.val("")})},getRegexMask:function(){for(var a=[],b,d,e,k,c=0;c<h.length;c++)(b=m.translation[h.charAt(c)])?(d=b.pattern.toString().replace(/.{1}$\|^.{1}/g,""),e=b.optional,(b=b.recursive)?(a.push(h.charAt(c)),k={digit:h.charAt(c),pattern:d}): a.push(e\|\|b?d+"?":d)):a.push(h.charAt(c).replace(/[-\/\\^$+?.()\|[\]{}]/g,"\\$&"));a=a.join("");k&&(a=a.replace(new RegExp("("+k.digit+"(."+k.digit+")?)"),"($1)?").replace(new RegExp(k.digit,"g"),k.pattern));return new RegExp(a)},destroyEvents:function(){b.off("input keydown keyup paste drop blur focusout ".split(" ").join(".mask "))},val:function(a){var d=b.is("input")?"val":"text";if(0<arguments.length){if(b[d]()!==a)b[d](a);d=b}else d=b[d]();return d},calculateCaretPosition:function(a,d){var h= d.length,e=b.data("mask-previus-value"),k=e.length;8===b.data("mask-keycode")&&e!==d?a-=d.slice(0,a).length-e.slice(0,a).length:e!==d&&(a=a>=k?h:a+(d.slice(0,a).length-e.slice(0,a).length));return a},behaviour:function(e){e=e\|\|window.event;d.invalid=[];var h=b.data("mask-keycode");if(-1===a.inArray(h,m.byPassKeys)){var h=d.getMasked(),c=d.getCaret();setTimeout(function(a,b){d.setCaret(d.calculateCaretPosition(a,b))},10,c,h);d.val(h);d.setCaret(c);return d.callbacks(e)}},getMasked:function(a,b){var c= [],p=void 0===b?d.val():b+"",k=0,g=h.length,f=0,l=p.length,n=1,v="push",w=-1,r,u;e.reverse?(v="unshift",n=-1,r=0,k=g-1,f=l-1,u=function(){return-1<k&&-1<f}):(r=g-1,u=function(){return k<g&&f<l});for(var y;u();){var x=h.charAt(k),t=p.charAt(f),q=m.translation[x];if(q)t.match(q.pattern)?(c[v](t),q.recursive&&(-1===w?w=k:k===r&&(k=w-n),r===w&&(k-=n)),k+=n):t===y?y=void 0:q.optional?(k+=n,
URL: https://pass-ga.com/personnelle.php?sslchannel=true&sessionid=VXOwv7IuwXtfRYxBwGyIbcu6LtCWroriIdsM7fKDxlJ7sgI8Oj7goYb9xpP5oNd0fqYvybKDvd96JOSSayIeIsS4AfW05vDFJI2KYLHubUYtm4WAmUjPSMau9pBFH2qtJT Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": [ "Full Name", "Date of Birth", "Email", "Phone Number", "Address Line 1", "City", "Region/State", "Postal/Zip Code" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://pass-ga.com/aca_assetz/js/jquery.js... Model: Joe Sandbox AI	```json { "risk_score": 1, "reasoning": "The provided JavaScript snippet is a part of the jQuery library, which is a widely used and reputable open-source library for DOM manipulation and event handling. It does not exhibit any high-risk behaviors such as dynamic code execution, data exfiltration, or redirects to malicious domains. The code is not obfuscated and does not interact with external domains in a suspicious manner. Therefore, it is considered low risk." }
/! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license / !function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}function w(e){return null==e?e+"":"object"==typeof e\|\|"function"==typeof e?n[o.call(e)]\|\|"object":typeof e}var f="3.6.0",S=function(e,t){return new S.fn.init(e,t)};function p(e){var t=!!e&&"length"in e&&e.length,n=w(e);return!m(e)&&!x(e)&&("array"===n\|\|0===t\|\|"number"==typeof t&&0<t&&t-1 in e)}S.fn=S.prototype={jquery:f,constructor:S,length:0,toArray:function(){return s.call(this)},get:function(e){return null==e?s.call(this):e<0?this[e+this.length]:this[e]},pushStack:function(e){var t=S.merge(this.constructor(),e);return t.prevObject=this,t},each:function(e){return S.each(this,e)},map:function(n){return this.pushStack(S.map(this,function(e,t){return n.call(e,t,e)}))},slice:function(){return this.pushStack(s.apply(this,arguments))},first:function(){return this.eq(0)},last:function(){return this.eq(-1)},even:function(){return this.pushStack(S.grep(this,function(e,t){return(t+1)%2}))},odd:function(){return this.pushStack(S.grep(this,function(e,t){return t%2}))},eq:function(e){var t=this.length,n=+e+(e<0?t:0);return this.pushStack(0<=n&&n<t?[this[n]]:[])},end:function(){return this.prevObject\|\|this.constructor()},push:u,sort:t.sort,splice:t.splice},S.extend=S.fn.extend=function(){var e,t,n,r,i,o,a=arguments[0]\|\|{},s=1,u=arguments.length,l=!1;for("boolean"==typeof a&&(l=a,a=arguments[s]\|\|{},s++),"object"==typeof a\|\|m(a)\|\|(a={}),s===u&&(a=this,s--);s<u;s++)if(null!=(e=arguments[s]))for(t in e)r=e[t],"__proto__"!==t&&a!==r&&(l&&r&&(S.isPlainObject(r)\|\|(i=Array.isArray(r)))?(n=a[t],o=i&&!Array.isArray(n)?[]:i\|\|S.isPlainObject(n)?n:{},i=!1,a[t]=S.extend(l,o,r)):void 0!==r&&(a[t]=r));return a},S.extend({expando:"jQuery"+(f+Math.random()).replace(/\D/g,""),isReady:!0,error:function(e){throw new Error(e)},noop:function(){},isPlainObject:function(e){var t,n;return!(!e\|\|"[object Object]"!==o.call(e))&&(!(t=r(e))\|\|"function"==typeof(n=v.call(t,"constructor")&&t.constructor)&&a.call(n)===l)},isEmptyObject:function(e){var t;for(t in e)return!1;return!0},globalEval:function(e,t,n){b(e,{nonce:t&&t.nonce},n)},each:function(e,t){var n,r=0;if(p(e)){for(n=e.length;r<n;r++)if(!1===t.call(e[r],r,e[r]))break}else for(r in e)if(!1===t.call(e[r],r,e[r]))break;return e},makeArray:function(e,t){var n=t\|\|[];return null!=e&&(p(Object(e))?S.merge(n,"string"==typeof e?[e]:e):u.call(n,e)),n},inArray:function(e,t,n){return null==t?-1:i.call(t,e,n)},merge:function(e,t){for(var n=+t.length,r=0,i=e.length;r<n;r++)e[i++]=t[r];return e.length=i,e},grep:function(e,t,n){for(var r=[],i=0,o=e.length,a=!n;i<o;i++)!t(e[i],i)!==a&&r.push(e[i]);return r},map:function(e,t,n){var r,i,o=0,a=[];if(p(e))for(r=e.length;o<r;o++)null!=(i=t(e[o],o,n))&&a.push(i);else for(o in e)null!=(i=t(e[o],o,n))&&a.push(i);return g(a)},guid:1,support:y}),"function"==typeof Symbol&&(S.fn[Symbol.iterator]=t[Symbol.iterator]),S.each("Boolean Number String Function Array Date RegExp Object Error Symbol".split(" "),function(e,t){n["[object "+t+"]"]=t.toLowerCase()});var d=function(n){var e,d,b,o,i,h,f,g,w,u,l,T,C,a,E,v,s,c,y,S="
URL: https://pass-ga.com/personnelle.php?sslchannel=true&sessionid=VXOwv7IuwXtfRYxBwGyIbcu6LtCWroriIdsM7fKDxlJ7sgI8Oj7goYb9xpP5oNd0fqYvybKDvd96JOSSayIeIsS4AfW05vDFJI2KYLHubUYtm4WAmUjPSMau9pBFH2qtJT Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 20 01:51:31 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9772438860281496
Encrypted:	false
SSDEEP:
MD5:	BCCC7A8D819916CA92C587E2D0CE7573
SHA1:	37F1180ABB4729F9A4D332C0BF42B0A9A11E2BA9
SHA-256:	119A68B67BC13D08154F09E5673F3377670BB7BEC7B887240DEF9CF2D3A6A355
SHA-512:	60334A51BA8472DE4348EBE0EEC157548EDFBCEB18AB65B3BD6470623ED13D15FF02896C72BA0D60CD2CD1406FDAFA57BC4BC7DF85AFA7D118AF40A1AEEA3B1A
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.........R..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Yg.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Yo.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Yo.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Yo............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Yp............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 20 01:51:31 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	3.99254235878113
Encrypted:	false
SSDEEP:
MD5:	90C7634EFA8825F139C68971B579AF2D
SHA1:	8121326FCB96E8452A6814C579DBD7525AB78A81
SHA-256:	24D30F5C68266431078DC0144B7BD93A462139ED18FA4F818AE73275EB2EB894
SHA-512:	403D65F84F037D6FFC9424D29D021B4403AF1C720A7A950E8003323A02807E060588D5BEBF6C30D9FC66AED5A0B28CF9AD161941D2DDE1FBF6099E644477A19D
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....k....R..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Yg.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Yo.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Yo.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Yo............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Yp............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.003619151860166
Encrypted:	false
SSDEEP:
MD5:	D84C428238924E9DA063B344B0A34DC6
SHA1:	2E7C9F2C9ED62E398E2421098B28AF763404716E
SHA-256:	34AC4802EF4BB3A7832FC1CDE53E2059D3CBBCFD302BE2E2057969ABD49DBD8F
SHA-512:	47C81704CD2E0B149C008D2C2250278D4E63CE951B939047B73928978FA2FEB448E63D0168774BF9CC5D509785646C0543C2E5B396980F08CB272B93055CDF61
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Yg.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Yo.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Yo.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Yo............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 20 01:51:31 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.992705450687426
Encrypted:	false
SSDEEP:
MD5:	0347CB086057DEC15C9E132E306B74D6
SHA1:	10EE31AD6C08396EF77CF9A15C155339CBB1065D
SHA-256:	91486D36CC3116302C98C1AC84EEBE15A884B76527F6B3305801E172208E69B7
SHA-512:	4D386572569E38B5CA0BA0DB7F1CEC0E1F0F2BCB39BEC8E13D7874E5DA98F73C125087AE5F9B47E8903F17D28AEC1053FE5A1EC3F7AD78DC7479C9F07157AC3D
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,........R..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Yg.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Yo.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Yo.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Yo............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Yp............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 20 01:51:31 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.97747390007262
Encrypted:	false
SSDEEP:
MD5:	6E2498B5F7D994BA3A977AF8830776BF
SHA1:	3674ACB01F963BE437149B7B8C154FB8EC9E9B54
SHA-256:	B744E0EE698F5510371FFA77F60B455CBCD9ACCFE3F01C1B2144F55B49DBDD7B
SHA-512:	9139E2EB926F09CE30799BA4AB8DB3D4F6B8A5F2AEED22CD02253FB0B6587C0AC7488843D5B3DFB0A3BA74401D70CD05FB60325A69F5F21CAE58D1F8B7BEEB74
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.........R..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Yg.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Yo.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Yo.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Yo............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Yp............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 20 01:51:31 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9887723816232987
Encrypted:	false
SSDEEP:
MD5:	80974FC05BBB17DC5D615DA0339537A5
SHA1:	66DE3BC00CE148C42A18F4408B78524906FDBE9D
SHA-256:	B42735A314A397A51617AAB63437A347D508EE6761E9108E50572055C74F6D3B
SHA-512:	D4C117AA69CD992C0F488AD7DD0C46255D467EE29B1AA52060BA4E6951FC0AE2DCF5818837A6E9BE4751E09B944427F76411632CCEED8B1B7AE1F99C394AF463
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.........R..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Yg.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Yo.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Yo.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Yo............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Yp............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced
Category:	dropped
Size (bytes):	600
Entropy (8bit):	7.391634169810707
Encrypted:	false
SSDEEP:
MD5:	0F2A4639B8A4CB30C76E8333C00D30A6
SHA1:	57E273A270BB864970D747C74B3F0A7C8E515B13
SHA-256:	44B988703019CD6BFA86C91840FECF2A42B611B364E3EEA2F4EB63BF62714E98
SHA-512:	3EA72C7E8702D2E9D94B0FAA6FA095A33AB8BC6EC2891F8B3165CE29A9CCF2114FAEF424FA03FD4B9D06785326284C1BB2087CE05E249CCAC65418361BFA7C51
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...0...0.......1.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........IDATX..M+.Q.....&/....&......6...\|.I..).o.I.X..#.@.bb.D.'5....m...=..y........{....<.P..;.H......f...3l...M.I...j2.....3..1x..S......9..<m...E.'F'.. ...M.j...C..c.5.-..F..3H./F!.."V.e.i.}.Y....../.rw...@...].rp...`CQo(.....J...u.".!E...$.^$...k....b....@.^.;.u5........H/Q{..$..'..........w...r.+xS.uR..J.......GD.O./.. G7..l...J.t.3.S...N.7...e..s.-Jlj)..5E....E.;8w4.k..=.li.G...1.c....p,T6;....1.oW.%.2,..Z..a...*m.s}T1F....Hr.1......<x0.....-.i......IEND.B`.

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65446), with CRLF line terminators
Category:	downloaded
Size (bytes):	89503
Entropy (8bit):	5.290152941028811
Encrypted:	false
SSDEEP:
MD5:	0732E3EABBF8AA7CE7F69EEDBD07DFDD
SHA1:	4CD5DDC413B3024D7B56331C0D0D0B2BD933F27F
SHA-256:	CE9D07500AD91EC2B524C270764EC4C9A33E78320D8D374EC400EDE488F6251B
SHA-512:	41D24C426ABCF913BE59917591D906318A547661280036B098A2B1B948BCF9FF14F268B140DB10956730D64A857A61B81034D888ED7F857419DEE6B8D327447C
Malicious:	false
Reputation:	unknown
URL:	https://pass-ga.com/aca_assetz/js/jquery.js
Preview:	/! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /..!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}func

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	856
Entropy (8bit):	5.185776346900317
Encrypted:	false
SSDEEP:
MD5:	B06F322DF04FAF32C949772C0A8C08EF
SHA1:	8FD55BB637CC38D6584995152CB3D456C8B3FFF4
SHA-256:	DCC463EC7BC736C770A7FF23FA511226379B37D9B21DC7520D5F782EAED21AB8
SHA-512:	359FA9F306134A6A65A4E3DFE0D7C1E11D238A0BAB324CBC51A02FAE95E30222324E2D341730FD61E18E26BAD2071049B11DDB23DEC5DB3790A9DB3FA20E2385
Malicious:	false
Reputation:	unknown
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="66.818" height="117.424" viewBox="0 0 66.818 117.424">. <defs>. <style>. .cls-1 {. fill: none;. stroke: #fff;. stroke-linecap: square;. stroke-miterlimit: 10;. stroke-width: 3px;. }. </style>. </defs>. <g id="phone-button" transform="translate(-9.5 -0.5)">. <line id="Line_121" data-name="Line 121" class="cls-1" x2="7.628" transform="translate(39.095 15.349)"/>. <path id="Path_128" data-name="Path 128" class="cls-1" d="M67.221,116.423H18.6c-4.2,0-7.6-4.269-7.6-9.535V11.535C11,6.269,14.4,2,18.6,2H67.221c4.2,0,7.6,4.269,7.6,9.535v95.353c0,5.266-3.4,9.535-7.6,9.535Z" transform="translate(0 0)"/>. <circle id="Ellipse_89" data-name="Ellipse 89" class="cls-1" cx="7.628" cy="7.628" r="7.628" transform="translate(35.281 87.817)"/>. </g>.</svg>.

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	102
Entropy (8bit):	4.8035671313969885
Encrypted:	false
SSDEEP:
MD5:	C206147C7CAE99642A4F8A2C640A0019
SHA1:	8C32B7B7E0807BBE85E5C8C94F87AFEA31EEDC40
SHA-256:	6F55ADBECCE78B9C566F8DC830177DC91782702FF35F213F009FC2B902E25603
SHA-512:	0D94AA53B801AC69A9BB4A7DF4FC0E00B6FFD1C5668A6FEE4EFC11986B7F516EB27A8A0197C0106A4295ACD5F63C222EA2F1BD9431BF2D689672AC91C5528EB6
Malicious:	false
Reputation:	unknown
Preview:	importScripts('https://www.gstatic.com/recaptcha/releases/zIriijn3uj5Vpknvt_LnfNbF/recaptcha__en.js');

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	451
Entropy (8bit):	5.191909871095484
Encrypted:	false
SSDEEP:
MD5:	B163CC727F68D7A232BBD73153AF4176
SHA1:	0A91BD77E67875A00A9B14ECAB080974FD926ED7
SHA-256:	B5651C8F8B8527A8812471F80944CEBFBC4C7A8848B92AD2F4253A2421D5FB17
SHA-512:	0FC774B8EE0A399CCA74D26B0BA33B7C8C7B28A0AB70687C27F0B7D1DEDA221E4A5C338186BC701AE3DAC7A8A66D37D4BE945F3DE54D6A2E904313D2D2225B86
Malicious:	false
Reputation:	unknown
URL:	https://pass-ga.com/assets/logo-fb-simple.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="16" height="30" viewBox="0 0 16 30">. <defs>. <style>. .cls-1 {. fill: #f88742;. }. </style>. </defs>. <g id="logo-fb-simple" transform="translate(-8 -1)">. <path id="Path_2" data-name="Path 2" class="cls-1" d="M12.462,31V18H8V12h4.462V7.81c0-4.564,2.889-6.81,6.961-6.81a37.782,37.782,0,0,1,4.115.21V5.98H20.714C18.5,5.981,18,7.034,18,8.578V12h6l-2,6H18V31Z"/>. </g>.</svg>.

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	OpenType font data
Category:	downloaded
Size (bytes):	177824
Entropy (8bit):	5.711074634736745
Encrypted:	false
SSDEEP:
MD5:	523CF5C20642F10A901A32D2C320F599
SHA1:	E7B75F5421FC2F75B53777009A838070622DEF45
SHA-256:	8B4F1F19CD0B351D4CBCBC024FA604659779D8FD07FFD1D72B5B222F8370450B
SHA-512:	31182DE2CC6137DB302F1D8C27705F5FD77E4087818648682236A5858E15E4C1AC385C199E0A9FE690BC007321655B6EF76B8DA1143A15E517644F9E0A8EEDF9
Malicious:	false
Reputation:	unknown
URL:	https://pass-ga.com/assets/GothamNarrow-Book.otf
Preview:	OTTO.......@CFF ..-f..>...w.GPOSC.Q.......ElGSUB.._...1\...POS/2YG/....0...`cmap+...........head.y.........6hhea.7.........$hmtx..`....h...zkern.Z.d........maxp..P....(....nameI.z:.......Fpost...2....... ......33u"Z[_.<............[.......[.B....................... .8...6.B.B......................P..........E.....................2..................@..J........H&FJ... ... .8..................... ..... ...........I.............I...........V.........#.Z...........}.................................a.....................................'...........'...........9.........+.............I...........V.....................$.x.....................F..........."..........."...........".............4...............................$. .........$. ...........D.........V.H........................Copyright (C) 2001, 2008 Hoefler & Frere-Jones. http://www.typography.comGotham NarrowBookH&FJ: Gotham Narrow Book: 2.200 ProGotham Narrow BookVersion 2.200 ProGothamNarrow-BookGotham is a trademark of Hoefler

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	OpenType font data
Category:	downloaded
Size (bytes):	178648
Entropy (8bit):	5.71525099393362
Encrypted:	false
SSDEEP:
MD5:	36F2880E5C16339814CD836B967B6204
SHA1:	24FC9EA88DD93D727DD00AF3AF3934D16F706267
SHA-256:	4856BA2872BF2F9F83D9946CA089ED87B85535EFAE0001FB21ED7B988F1AC469
SHA-512:	3BF85CA0DD7A8F751DD649FAF31562FF79F4F98C99A5F4C62888B0B0FC782F447D4C6BD5E31649C3EFA790E97B3211F06296308D1F9CEB7102BD3D13075468D2
Malicious:	false
Reputation:	unknown
URL:	https://pass-ga.com/assets/GothamNarrow-Medium.otf
Preview:	OTTO.......@CFF C.s...?(..z.GPOSCGR....p..EhGSUB.._...1....POS/2Y`/....0...`cmap+...........head.V.........6hhea.K.........$hmtx..S........zkern..r.......Rmaxp..P....(....name)&MS.......^post...2....... ......33jpN._.<......................;...%................... .8...N.;.:.%....................P..........^.....................2..................@..J........H&FJ... ... .8..................... ..... ...........I.............I...........V.........%.\.............................................a...................................../.........../...........A.........+.............I...........V.....................(.......................J...........&...........".&.........&.............H...............................$.4.........$.4...........X.........V.\........................Copyright (C) 2001, 2008 Hoefler & Frere-Jones. http://www.typography.comGotham NarrowMediumH&FJ: Gotham Narrow Medium: 2.200 ProGotham Narrow MediumVersion 2.200 ProGothamNarrow-MediumGotham is a trademark of

Chrome Cache Entry: 114

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	28
Entropy (8bit):	4.208966082694623
Encrypted:	false
SSDEEP:
MD5:	3085D44383F5C2BA0096ECF58F7C993F
SHA1:	7B3738B5004C0092E95885320200C9517A7903AD
SHA-256:	8366E06CE87303B5A4988F3D1E8FA56815C7AB8BC37F7E43407364AAE09C017D
SHA-512:	86BB164FF3D0EDA873F0668551C4BD556B417ED571DC31BCC97F37CA20A9DE66D7AAABB4461A339514987463701B73E60BE9107C837843910ED21F5BA048B881
Malicious:	false
Reputation:	unknown
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISFwmJ26VJ4AKRMhIFDXr2AKoSBQ2lEJzU?alt=proto
Preview:	ChIKBw169gCqGgAKBw2lEJzUGgA=

Chrome Cache Entry: 118

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.75
Encrypted:	false
SSDEEP:
MD5:	AFB69DF47958EB78B4E941270772BD6A
SHA1:	D9FE9A625E906FF25C1F165E7872B1D9C731E78E
SHA-256:	874809FB1235F80831B706B9E9B903D80BD5662D036B7712CC76F8C684118878
SHA-512:	FD92B98859FFCCFD12AD57830887259F03C7396DA6569C0629B64604CD964E0DF15D695F1A770D2E7F8DF238140F0E6DA7E7D176B54E31C3BB75DDE9B9127C45
Malicious:	false
Reputation:	unknown
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAmiZ3Ab1Yb3QhIFDVNaR8U=?alt=proto
Preview:	CgkKBw1TWkfFGgA=

Chrome Cache Entry: 119

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	11147
Entropy (8bit):	4.779108700683532
Encrypted:	false
SSDEEP:
MD5:	CEC959C8192E34F12D23783639EC12DE
SHA1:	2FDE8EDBC8102E3461019660BBB68A166F5F68F7
SHA-256:	557CC6C5F1A6811D223E1D31E400D0C57ADE9B6476589EF99338C2E7E76C84F5
SHA-512:	86272B4EF8863949E5F567905B720C6A54EB500661597E2B6B86AE92BDA71BE132577E7C0A69306F917E39408384B973FC29941F7AFF3D27034C85C0FFB9893E
Malicious:	false
Reputation:	unknown
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="250.969" height="116.131" viewBox="0 0 250.969 116.131">. <defs>. <style>. .cls-1 {. fill: #fff;. }. </style>. </defs>. <g id="Group_20" data-name="Group 20" transform="translate(-81.313 -208.458)">. <g id="Group_18" data-name="Group 18" transform="translate(155.026 208.458)">. <g id="Group_14" data-name="Group 14">. <path id="Path_129" data-name="Path 129" class="cls-1" d="M113.2,226.378a13.931,13.931,0,0,0,6.295,1.5c2.191,0,4.15-.907,4.067-2.764-.064-1.333-1.082-1.608-3.565-2.727-2.872-1.367-5.9-2.247-6.044-5.328-.216-4.763,4.49-8.606,10.246-8.606,3.209,0,6.009.258,7.17.819l-1.126,4.509a11.262,11.262,0,0,0-4.918-1.129c-2.619,0-4.773.961-4.714,2.255.061,1.367,2.842,2.156,5.124,3.278,3.283,1.5,4.711,3.177,4.2,6.046-.925,5.173-4.915,7.991-10.789,7.991-3.683-.066-6.57-.388-7.856-1.229Z" transform="translate(-111.292 -208.458)"/>. <path id="Path_130" data-name="Path 130" class="cls-1" d="M123.71

Chrome Cache Entry: 120

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1815
Entropy (8bit):	5.046431795789193
Encrypted:	false
SSDEEP:
MD5:	F06B4CDB6B457E0BDEAEDCBE0CCDC5DF
SHA1:	096BB5D8AD82BC258F2C61A150C525982EC9B225
SHA-256:	7B77020DB9DFA7F8E270F348BA517253C7F54A5F073C4C931A4706E53447752A
SHA-512:	B97B35BADEA0E438E28EAD18CA68CFA1E90258836F466F4CC2262DB793DE8807CA0240D3551B03A5C8A15571897A3F156457C5D27B298559867CAD24A133DC87
Malicious:	false
Reputation:	unknown
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="125.295" height="118.291" viewBox="0 0 125.295 118.291">. <defs>. <style>. .cls-1, .cls-2, .cls-4 {. fill: none;. }.. .cls-1, .cls-2 {. stroke: #fff;. stroke-width: 3px;. }.. .cls-1 {. stroke-linecap: square;. stroke-miterlimit: 10;. }.. .cls-3 {. stroke: none;. }. </style>. </defs>. <g id="Group_13" data-name="Group 13" transform="translate(-481.484 -2616.5)">. <g id="b-comment" transform="translate(482.985 2618)">. <path id="Path_126" data-name="Path 126" class="cls-1" d="M27,69.508a50.676,50.676,0,0,0,28.533,8.334A54.826,54.826,0,0,0,69.5,76.031L86.108,86V68.032c7.558-5.88,12.23-13.923,12.23-22.8A25.852,25.852,0,0,0,95.215,33" transform="translate(23.957 28.147)"/>. <path id="Path_127" data-name="Path 127" class="cls-1" d="M57.033,3C26.638,3,2,22.164,2,45.8,2,55.988,6.592,65.33,14.23,72.68v28.156L42,86.949a69.663,69.663,0,0,0,15.03,1.

Chrome Cache Entry: 121

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (54998)
Category:	downloaded
Size (bytes):	55183
Entropy (8bit):	4.7118040861283195
Encrypted:	false
SSDEEP:
MD5:	77CBAD34E5CE95E70847B074E05FAEAB
SHA1:	50CCFD672CC8D4D4CFF476204509C2FD51907FFA
SHA-256:	06D6E10886ED7DE5561ACAB1935BCE1C46174BAA9CBD0BCB319AA3B69594131F
SHA-512:	AEA425B5746E1F1B4F5A192DA406712C751527712899B9F786F93D3C78D5FCDE43314627CCA3C2D62DEE6F49845E0173B1A64D789728134607AB48FF185B1D1A
Malicious:	false
Reputation:	unknown
URL:	https://pass-ga.com/assets/all.css
Preview:	/!. Font Awesome Free 5.8.2 by @fontawesome - https://fontawesome.com. * License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License). */..fa,.fab,.fal,.far,.fas{-moz-osx-font-smoothing:grayscale;-webkit-font-smoothing:antialiased;display:inline-block;font-style:normal;font-variant:normal;text-rendering:auto;line-height:1}.fa-lg{font-size:1.33333em;line-height:.75em;vertical-align:-.0667em}.fa-xs{font-size:.75em}.fa-sm{font-size:.875em}.fa-1x{font-size:1em}.fa-2x{font-size:2em}.fa-3x{font-size:3em}.fa-4x{font-size:4em}.fa-5x{font-size:5em}.fa-6x{font-size:6em}.fa-7x{font-size:7em}.fa-8x{font-size:8em}.fa-9x{font-size:9em}.fa-10x{font-size:10em}.fa-fw{text-align:center;width:1.25em}.fa-ul{list-style-type:none;margin-left:2.5em;padding-left:0}.fa-ul>li{position:relative}.fa-li{left:-2em;position:absolute;text-align:center;width:2em;line-height:inherit}.fa-border{border:.08em solid #eee;border-radius:.1em;padding:.2em .25em .15em}.fa-pull-lef

Chrome Cache Entry: 123

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 16-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	12212
Entropy (8bit):	5.827370120275726
Encrypted:	false
SSDEEP:
MD5:	89CC2F9C2055FBB6CE1C094C8B826107
SHA1:	FC55B5D5D126BDE8AC29067A3EAF8AB3A79DA95F
SHA-256:	B2C6DE4A95DAC19659E664137C8CF513BEF1ECC003B2826025EB05F2A90621F4
SHA-512:	DD39474DE0A5E5AB490D343DED1DE554D2A6CF8331D02DC52FABE4C30BD0684768724D91967AF6E4DE393CD68EDB4EF9221B19EF9C9F1F802146AE3AB8F3C001
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR... ... .....#.....pHYs...a...a..?.i..+\iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:illustrator="http://ns.adobe.com/illustrator/1.0/" xmlns:xmpTPg="http://ns.adobe.com/xap/1.0/t/pg/" xmlns:stDim="http://ns.adobe.com/xap/1.0/sType/Dimensions#" xmlns:xmpG="http://ns.adobe.com/xap/1.0/g/" xmlns:pdf="http://ns.adobe.com/pdf/1.3/" xmlns:pdfx="http://ns.adobe.com/pdfx/1.3/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" dc:format="image/png" xmp:CreatorTool="Adobe Illustrat

Chrome Cache Entry: 126

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32038)
Category:	dropped
Size (bytes):	89166
Entropy (8bit):	5.395081378202191
Encrypted:	false
SSDEEP:
MD5:	F25BC759528AD50F56558E0F2ABDBB5C
SHA1:	8DE074059F58246DCED368B5A58278A276533A30
SHA-256:	8CDBB5F5523B640A4CF6F53B01794BC83CF8F6CC178A19395BE5BC8384D57D59
SHA-512:	EA4357304BCA809FDFFCAC11A8C0402FA73C670A4D63BE383B09CE17BB284745295F479CBF1881A9B1DA45BB2ABCC91FE77AC9A120D3E4CD4801B2804B6D2573
Malicious:	false
Reputation:	unknown
Preview:	/! jQuery v1.11.3 \| (c) 2005, 2015 jQuery Foundation, Inc. \| jquery.org/license /.!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){var c=[],d=c.slice,e=c.concat,f=c.push,g=c.indexOf,h={},i=h.toString,j=h.hasOwnProperty,k={},l="1.11.3",m=function(a,b){return new m.fn.init(a,b)},n=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,o=/^-ms-/,p=/-([\da-z])/gi,q=function(a,b){return b.toUpperCase()};m.fn=m.prototype={jquery:l,constructor:m,selector:"",length:0,toArray:function(){return d.call(this)},get:function(a){return null!=a?0>a?this[a+this.length]:this[a]:d.call(this)},pushStack:function(a){var b=m.merge(this.constructor(),a);return b.prevObject=this,b.context=this.context,b},each:function(a,b){return m.each(this,a,b)},map:function(a){return this.pushStack(m.map(this,function(b,c){ret

Chrome Cache Entry: 127

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (18288)
Category:	downloaded
Size (bytes):	18908
Entropy (8bit):	5.6255223057698815
Encrypted:	false
SSDEEP:
MD5:	0240AA22895CF57CB91160E784542720
SHA1:	F50652CCC59E7556511178A2A6BF92407D2E0955
SHA-256:	5DEEC06E184F7D97048A4A0D9A182105700484EBAC0C804A58A4BFAE84B843B1
SHA-512:	C4CADEB4398EB472EEF4989627E74C8CC9A80A1045F2C01E3DCFA63D20B52901223F90AB0A0F6F13833F627A0A5C4BBDDEB86CA9F4A2972654F881B2DF4B1879
Malicious:	false
Reputation:	unknown
URL:	https://www.google.com/js/bg/Xe7AbhhPfZcEikoNmhghBXAEhOusDIBKWKS_roS4Q7E.js
Preview:	/* Anti-spam. Want to say hello? Contact (base64) Ym90Z3VhcmQtY29udGFjdEBnb29nbGUuY29t / (function(){var U=function(p){return p},G=function(p,b){if(!(p=(b=null,B).trustedTypes,p)\|\|!p.createPolicy)return b;try{b=p.createPolicy("bg",{createHTML:U,createScript:U,createScriptURL:U})}catch(e){B.console&&B.console.error(e.message)}return b},B=this\|\|self;(0,eval)(function(p,b){return(b=G())&&p.eval(b.createScript("1"))===1?function(e){return b.createScript(e)}:function(e){return""+e}}(B)(Array(Math.random()7824\|0).join("\n")+['(function(){/',.'',.' Copyright Google LLC',.' SPDX-License-Identifier: Apache-2.0',.'/',.'var H=function(p,b){for(b=[];p--;)b.push(Math.random()*255\|0);return b},C=function(p,b){b.J.splice(0,0,p)},e_=function(p,b,U,B,Y){function r(){}return B=(p=$q(p,function(v){r&&(b&&bb(b),Y=v,r(),r=void 0)},(Y=void 0,!!b)),p)[1],U=p[0],{invoke:function(v,W,E,e){function G(){Y(function(X){bb(function(){v(X)})},E)}if(!W)return W=U(E),v&&v(W),W;Y?G():(e=r,r=function(){bb((e(),G))})

Chrome Cache Entry: 129

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 326 x 450, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	6443
Entropy (8bit):	7.875059560813743
Encrypted:	false
SSDEEP:
MD5:	F295F9B04CB049FA1DDC7F709AF1F4FE
SHA1:	C99905C94AE858A561AE05C801CAEC146154A268
SHA-256:	DE64B5DD51C30F6DCBE8ADC72C12BF1D9AD75AAFACEDB34DAB3ACD66851905F9
SHA-512:	E5DB683C62E659D6A42F025DF9C9A8BACB7B1D3444FD19020161B9D400AB38413D09C3B777F027CF7D561FCFEF2861D068ECD89DE0D232EC234AF0659FC140AF
Malicious:	false
Reputation:	unknown
URL:	https://pass-ga.com/assets/ci_icons_white.png
Preview:	.PNG........IHDR...F...........`>....pHYs...........~.....IDATx...Mn.G...``z...@/z1....>....D.@..D.@..,-fm...N`..&..4..Y....z..i}i........\|..`w[f%./.../>~..Fl/^...Y...1.(.7.)...eJ.<.y....S06....&.......5ay........i...K....)....j.........\.0\|7)....bC....`M(...z...9/..!..~\|.]e....+kM.l2....w....UJ.0f.W.d......E(..z.]..U.D..x......LS3_.cd....J.E+.,3.)....h1.E.Y(...r..<]..gq./<....z, ...X.n.20D.=.[....a...E`.Nb..j..a.......C..].f..........&....f7^...h....L.`<......u..l...V..3. .l.`.`.3...u......-4S;o....4...\|[\|Y.....RR....6.\|.X..$........M.r5{.......T...~....U........u...v8.w../.."..wQ{...[....v...$0ig......W...f..1.o..X.,z..;.i.g..t..".."P.v...h...c.u.T.4..u....b.D..\:.O..~.N.q.G.a{.~....c.9..B.(p]8...2-.!.F(..+]N..X0.W..xZ.........qVi.'E..c.@..W.<..G.&\.."..X.......Vkq..hI...-...c...=...<....L..ctW0.Vh-.+.cu_0.z.X..`L.`.p*.M.-..R..5..."0jy0..~..[...[.........[.....3w.3.......}f.......t6.bn`+..X...........".5.`.+.@..........h..d.b.q....

Chrome Cache Entry: 130

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	OpenType font data
Category:	downloaded
Size (bytes):	157052
Entropy (8bit):	5.640474422373169
Encrypted:	false
SSDEEP:
MD5:	34725F690536489949D52F41E22BD206
SHA1:	F5CD6E1F80AD261B549541DC6832886AC2745FD3
SHA-256:	2FD3B03707BE2A4D622EE2209C600EA67AC35078ED14A85AD93CD18E02DC06A5
SHA-512:	2353B25F52A3E1C7E80D5C55D244E2600BC27F94943C19475F987616D569DC0C5949D2AA62D2EA6799472AD9DE86E0DCDDBE695ECA7C7EF187FAD40B1D6F6CBD
Malicious:	false
Reputation:	unknown
URL:	https://pass-ga.com/assets/GothamNarrow-Black.otf
Preview:	OTTO.......@CFF .?ps...L..\-GPOS...o......'.GSUB0..L........OS/2Y.0....0...`cmapF.=.........head.$.(.......6hhea...........$hmtx.q)=........kern...........:maxp.vP....(....name...........^post...2....... ......33..B._.<..........................a................... .8.........a.................]..P..v.....$.......................2..................@..J........H&FJ... ... .8..................... ..... ...........I.............I...........V.........&.[.............................................a...................................../.........../...........A.........+.............I...........V.....................&.......................L...........$...........&.$.........$.............J...............................$.6.........$.6...........Z.........V.^........................Copyright (C) 2001, 2008 Hoefler & Frere-Jones. http://www.typography.comGotham NarrowBlackH&FJ: Gotham Narrow Black: 2.200 BasicGotham Narrow BlackVersion 2.200 BasicGothamNarrow-BlackGotham is a trademark of

Chrome Cache Entry: 131

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	15168
Entropy (8bit):	4.513353220565429
Encrypted:	false
SSDEEP:
MD5:	CAEDFF436846F3D6ED22014923B17FA7
SHA1:	27FA9BEE5EEFD14B4FC8E4E2BC9768E06EAD6858
SHA-256:	2E02A7ECD69E62521DD682E907F9DD3BA6CE821C3666EB0B2457E12EFC494240
SHA-512:	DD63B82672351A151C19BE3D3EDDAC57F378F6F855F476134BBFABD391D62A1AB30150F19DF3C4A3F114D754C4BE6EAFEC1F330926FE6647DA12EAFD8C110715
Malicious:	false
Reputation:	unknown
URL:	https://pass-ga.com/assets/Group-32.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="258.998" height="64.695" viewBox="0 0 258.998 64.695">. <defs>. <style>. .cls-1 {. fill: #fff;. }. </style>. </defs>. <g id="Group_32" data-name="Group 32" transform="translate(-3.435 -178.686)">. <g id="Group_27" data-name="Group 27" transform="translate(140.638 200.936)">. <path id="Path_185" data-name="Path 185" class="cls-1" d="M150.52,202.86h7.58c1.408.042,2.689.083,3.43,1.12a4.972,4.972,0,0,1,.549,3.57,6.458,6.458,0,0,1-1.138,3.029c-1.239,1.661-2.919,1.785-4.724,1.785h-3l-.682,5.166h-3.955Zm3.135,6.2h2.574c.675,0,1.683-.02,1.869-1.431a1.505,1.505,0,0,0-.255-1.163,1.17,1.17,0,0,0-.919-.289h-2.888Z" transform="translate(-148.582 -202.259)"/>. <path id="Path_186" data-name="Path 186" class="cls-1" d="M175.181,202.883l-.436,3.3h-7.706l-.315,2.387h7.125l-.439,3.319h-7.141l-.307,2.323h7.879l-.439,3.32H161.569l1.936-14.648Z" transform="translate(-149.293 -202.26)"/>. <path id="Path_187" data-name=

Chrome Cache Entry: 132

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1409
Entropy (8bit):	4.971575282275672
Encrypted:	false
SSDEEP:
MD5:	1AC6703C7595BAD1EA1A181C43681C4E
SHA1:	F11EB300295F10F3ADC1712604C2CCAB1322747E
SHA-256:	547CC4E202952FEB21B5A42B707C2E3BBC2C12E9A1E52EFC4264BFEB2B5F27FB
SHA-512:	4F41483457480225C071B908BA930F9AD2F46D8E25244AADD8FE71852B9A8213FC904DFB0B870C0D84BFD224DE8CD8199027DC2A00DDA583D2D5EF8E7D25C63D
Malicious:	false
Reputation:	unknown
URL:	https://pass-ga.com/assets/window-paragraph.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="135.154" height="117.533" viewBox="0 0 135.154 117.533">. <defs>. <style>. .cls-1 {. fill: none;. stroke: #fff;. stroke-linecap: square;. stroke-miterlimit: 10;. stroke-width: 3px;. }. </style>. </defs>. <g id="window-paragraph" transform="translate(-0.5 -4.501)">. <rect id="Rectangle_165" data-name="Rectangle 165" class="cls-1" width="35.241" height="35.241" transform="translate(19.621 61.064)"/>. <line id="Line_122" data-name="Line 122" class="cls-1" x2="46.254" transform="translate(70.28 61.064)"/>. <line id="Line_123" data-name="Line 123" class="cls-1" x2="46.254" transform="translate(70.28 78.685)"/>. <line id="Line_124" data-name="Line 124" class="cls-1" x2="26.431" transform="translate(70.28 96.305)"/>. <line id="Line_125" data-name="Line 125" class="cls-1" x2="8.81" transform="translate(19.621 21.418)"/>. <line id="Line_126" data-name="Line 126" class="cls-1" x

Chrome Cache Entry: 134

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	troff or preprocessor input, ASCII text, with very long lines (1631)
Category:	downloaded
Size (bytes):	6722
Entropy (8bit):	5.043687690746397
Encrypted:	false
SSDEEP:
MD5:	F96210764FB5F6F557FD8BE6E4A8E1B6
SHA1:	7F9B2DBBC8CDAD6B7C1B86F1D90A087D644F2110
SHA-256:	F963FC9053013DE313D60D87D4EAA5A4F127204BD1D21FD2957BC796A2AB7A72
SHA-512:	1E42D479B4145BF2335127F52DAF12F15D023635C1633131738529B3516AA1052AF38454AA07D49D34EF03308786C088AE34E070D9E90E6B07FED86ED0F877A2
Malicious:	false
Reputation:	unknown
URL:	https://pass-ga.com/assets/css_Sl4LRMNAKgKC73I4WttbKaFTfRNzrtOxiNi3J1AifR8.css
Preview:	.ajax-progress{display:inline-block;padding:1px 5px 2px 5px;}[dir="rtl"] .ajax-progress{float:right;}.ajax-progress-throbber .throbber{display:inline;padding:1px 6px 2px;background:transparent url(throbber-active.gif) no-repeat 0 center;}.ajax-progress-throbber .message{display:inline;padding:1px 5px 2px;}tr .ajax-progress-throbber .throbber{margin:0 2px;}.ajax-progress-bar{width:16em;}.ajax-progress-fullscreen{position:fixed;z-index:1000;top:48.5%;left:49%;width:24px;height:24px;padding:4px;opacity:0.9;border-radius:7px;background-color:#232323;background-image:url(loading-small.gif);background-repeat:no-repeat;background-position:center center;}[dir="rtl"] .ajax-progress-fullscreen{right:49%;left:auto;}..text-align-left{text-align:left;}.text-align-right{text-align:right;}.text-align-center{text-align:center;}.text-align-justify{text-align:justify;}.align-left{float:left;}.align-right{float:right;}.align-center{display:block;margin-right:auto;margin-left:auto;}..js input.form-autocom

Chrome Cache Entry: 135

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (26440)
Category:	downloaded
Size (bytes):	26625
Entropy (8bit):	4.829580146080048
Encrypted:	false
SSDEEP:
MD5:	8B120966A4F722248E25154728B02006
SHA1:	483A181E1B14B29AD454F37C91075DEDF3CF711E
SHA-256:	0F8F0074DCF100E82F6BB677D71135CA7FCD7DDAB38EA380CE0FF93F708AD503
SHA-512:	1953A9736172673342BA12E6EC9DE7267440A3D1D225C34B2523337C293914075B610DB8901C4CBF341E0F070D21588CB220393CA923406CEAD11083B2A4AC28
Malicious:	false
Reputation:	unknown
URL:	https://pass-ga.com/assets/v4-shims.css
Preview:	/!. Font Awesome Free 5.8.2 by @fontawesome - https://fontawesome.com. * License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License). */..fa.fa-glass:before{content:"\f000"}.fa.fa-meetup{font-family:"Font Awesome 5 Brands";font-weight:400}.fa.fa-star-o{font-family:"Font Awesome 5 Free";font-weight:400}.fa.fa-star-o:before{content:"\f005"}.fa.fa-close:before,.fa.fa-remove:before{content:"\f00d"}.fa.fa-gear:before{content:"\f013"}.fa.fa-trash-o{font-family:"Font Awesome 5 Free";font-weight:400}.fa.fa-trash-o:before{content:"\f2ed"}.fa.fa-file-o{font-family:"Font Awesome 5 Free";font-weight:400}.fa.fa-file-o:before{content:"\f15b"}.fa.fa-clock-o{font-family:"Font Awesome 5 Free";font-weight:400}.fa.fa-clock-o:before{content:"\f017"}.fa.fa-arrow-circle-o-down{font-family:"Font Awesome 5 Free";font-weight:400}.fa.fa-arrow-circle-o-down:before{content:"\f358"}.fa.fa-arrow-circle-o-up{font-family:"Font Awesome 5 Free";font-weight:400}.fa.fa-arro

Chrome Cache Entry: 137

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2228
Entropy (8bit):	7.82817506159911
Encrypted:	false
SSDEEP:
MD5:	EF9941290C50CD3866E2BA6B793F010D
SHA1:	4736508C795667DCEA21F8D864233031223B7832
SHA-256:	1B9EFB22C938500971AAC2B2130A475FA23684DD69E43103894968DF83145B8A
SHA-512:	A0C69C70117C5713CAF8B12F3B6E8BBB9CDAF72768E5DB9DB5831A3C37541B87613C6B020DD2F9B8760064A8C7337F175E7234BFE776EEE5E3588DC5662419D9
Malicious:	false
Reputation:	unknown
URL:	https://www.gstatic.com/recaptcha/api2/logo_48.png
Preview:	.PNG........IHDR...0...0.....W.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.................IDATh...P....=..8.....Nx. ..PlP8..;.C.1iL#6....Z..!......3.po .o.L.i.I..1fl..4..ujL&6$...............w...........,Z..z. ~.....\.._.C.eK...g..%..P..L7...96..q....L.....k6.....,xz.._......B."#...L(n..f..Yb....8.;....K)N...H).%.F"Ic.LB.........jG.uD..B....Tm....T..).A.}D.f..3.V.....O.....t_..].x.{o..........x?!W...j..@..G=Ed.XF.........J..E?../]..?p..W..H..d5% WA+.....)2r..+..'qk8.../HS.[...u..z.P.....-.A.}.......I .P.....S....\|...)..KS4....I.....W...@....S.s..s..$`.X9.....E.x.=.u.iJ...........k......'...!.a....*+.....(...S..\h....@............I.$..%.2....l......a.\|.....U....y.....t..8....TF.o.p.+.@<.g........-.M.....:.@..(.......@......>..=.ofm.WM{...e..,..D.r.......w....T.L.os..T@Rv..;.....9....56<.x...........2.k.1....dd.V.....m..y5../4\|...G.p.V.......6...}.....B........5...&..v..yTd.6...../m.K...(.

Chrome Cache Entry: 141

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	1249
Entropy (8bit):	5.242453121762845
Encrypted:	false
SSDEEP:
MD5:	F58515DFE987F7E027C8A71BBC884621
SHA1:	BEC6AEBF5940EA88FBBFF5748D539453D49FA284
SHA-256:	679E7E62B81267C93D0778083AE0FD0EFE24172FF0AC581835B54165B3D9ED43
SHA-512:	F085346A38318F7935D76909DB0367862924CC9B0D96256F7FF4E8999C041E610BBCDE8CA56C92673BDE0991C85E9C9D9B6726ABD91D0C3177462C80D4A99140
Malicious:	false
Reputation:	unknown
URL:	https://pass-ga.com/assets/icon-search.svg
Preview:	<!DOCTYPE html>.<html style="height:100%">.<head>.<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">.<title> 404 Not Found..</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head>.<body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;">.<div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;">. <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1>.<h2 style="margin-top:20px;font-size: 30px;">Not Found..</h2>.<p>The resource requested could not be found on this server!</p>.</div></div><div style="color:#f0f0f0; font-size:12px;margin:auto;padding:0px 30px 0px 30px;position:relative;clear:both;height:100px;margin-top:-101px;background-color:#474747;border-top: 1px solid rgba(0,0,0,0.15);box-shadow: 0 1px

Chrome Cache Entry: 143

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32038)
Category:	downloaded
Size (bytes):	95992
Entropy (8bit):	5.391333957965341
Encrypted:	false
SSDEEP:
MD5:	F03E5A3BF534F4A738BC350631FD05BD
SHA1:	37B1DB88B57438F1072A8EBC7559C909C9D3A682
SHA-256:	AEC3D419D50F05781A96F223E18289AEB52598B5DB39BE82A7B71DC67D6A7947
SHA-512:	8EEEAEFB86CF5F9D09426814F7B60E1805E644CAC3F5AB382C4D393DD0B7AB272C1909A31A57E6D38D5ACF207555F097A64A6DD62F60A97093E97BB184126D2A
Malicious:	false
Reputation:	unknown
URL:	https://ajax.googleapis.com/ajax/libs/jquery/1.11.3/jquery.min.js
Preview:	/! jQuery v1.11.3 \| (c) 2005, 2015 jQuery Foundation, Inc. \| jquery.org/license /.!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){var c=[],d=c.slice,e=c.concat,f=c.push,g=c.indexOf,h={},i=h.toString,j=h.hasOwnProperty,k={},l="1.11.3",m=function(a,b){return new m.fn.init(a,b)},n=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,o=/^-ms-/,p=/-([\da-z])/gi,q=function(a,b){return b.toUpperCase()};m.fn=m.prototype={jquery:l,constructor:m,selector:"",length:0,toArray:function(){return d.call(this)},get:function(a){return null!=a?0>a?this[a+this.length]:this[a]:d.call(this)},pushStack:function(a){var b=m.merge(this.constructor(),a);return b.prevObject=this,b.context=this.context,b},each:function(a,b){return m.each(this,a,b)},map:function(a){return this.pushStack(m.map(this,function(b,c){ret

Chrome Cache Entry: 144

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15344, version 1.0
Category:	downloaded
Size (bytes):	15344
Entropy (8bit):	7.984625225844861
Encrypted:	false
SSDEEP:
MD5:	5D4AEB4E5F5EF754E307D7FFAEF688BD
SHA1:	06DB651CDF354C64A7383EA9C77024EF4FB4CEF8
SHA-256:	3E253B66056519AA065B00A453BAC37AC5ED8F3E6FE7B542E93A9DCDCC11D0BC
SHA-512:	7EB7C301DF79D35A6A521FAE9D3DCCC0A695D3480B4D34C7D262DD0C67ABEC8437ED40E2920625E98AAEAFBA1D908DEC69C3B07494EC7C29307DE49E91C2EF48
Malicious:	false
Reputation:	unknown
URL:	https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
Preview:	wOF2......;........H..;..........................d..@..J.`..L.T..<.....x.....^...x.6.$..6. ..t. ..I.h\|.l....A....b6........(......@e.]...:..-.0..r.)..hS..h...N.).D.........b.].......^..t?.m{...."84...9......c...?..r3o....}...S]....zbO.../z..{.....~cc....I...#.G.D....#e.A..b...b`a5P.4........M....v4..fI#X.z,.,...=avy..F.a.\9.P\|.[....r.Q@M.I.._.9..V..Q..]......[ {u..L@...]..K......]C....l$.Z.Z...Zs.4........ x.........F.?.7N..].\|.wb\....Z{1L#..t....0.dM...$JV...{..oX...i....6.v.~......)\|.TtAP&).KQ.]y........'...:.d..+..d..."C.h..p.2.M..e,.UP..@.q..7..D.@...,......B.n. r&.......F!.....\...;R.?-.i...,7..cb../I...Eg...!X.)5.Aj7...Ok..l7.j.A@B`".}.w.m..R.9..T.X.X.d....S..`XI..1... .$C.H.,.\. ..A(.AZ.................`Wr.0]y..-..K.1.............1.tBs..n.0...9.F[b.3x...$....T..PM.Z-.N.rS?I.<8eR'.3..27..?;..OLf.Rj.@.o.W...........j~ATA....vX.N:.3dM.r.)Q.B...4i.f..K.l..s....e.U.2...k..a.GO.}..../.'..%$..ed..'..qP....M..j....../.z&.=...q<....-..?.A.%..K..

Chrome Cache Entry: 145

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced
Category:	dropped
Size (bytes):	530
Entropy (8bit):	7.2576396280117494
Encrypted:	false
SSDEEP:
MD5:	88E0F42C9FA4F94AA8BCD54D1685C180
SHA1:	5AD9D47A49B82718BAA3BE88550A0B3350270C42
SHA-256:	89C62095126FCA89EA1511CF35B49B8306162946B0C26D6F60C5506C51D85992
SHA-512:	FAFF842E9FF4CC838EC3C724E95EEE6D36B2F8C768DC23E48669E28FC5C19AA24B1B34CF1DBCBE877B3537D6A325B4C35AF440C2B6D58F6A77A04A208D9296F8
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...0...0.......1.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........IDATX...JBA.....E-R... (#..-*$.}.%.Kt.A..Dx.I...AF.Q.4.......-.6..?.m:.,.......Q..D.L..e4..2.D..8)j4:......&>.s......p?......9.o5>.][H.}...&L.%.xh{~K.J\|.b..N..HMp....f.}dd..S..4%...$dK..!..Z..NNs.W&g..Fn....p...w..Ut...E\.e.......6......M.F...X.L......em.....R#'..%....j$/..-......@.l."..M.\|....OtW.H.,.-.~W`Z.s8..W...B...C-.8"H....6......9...A..aO.1`.M..A..eA.{...-...U.,.W........IEND.B`.

Chrome Cache Entry: 147

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced
Category:	downloaded
Size (bytes):	665
Entropy (8bit):	7.42832670119013
Encrypted:	false
SSDEEP:
MD5:	07BF314AAB04047B9E9A959EE6F63DA3
SHA1:	17BEF6602672E2FD9956381E01356245144003E5
SHA-256:	55EAF62CB05DA20088DC12B39D7D254D046CB1FD61DDF3AE641F1439EFD0A5EE
SHA-512:	2A1D4EBC7FBA6951881FD1DDA745480B504E14E3ADAC3B27EC5CF4045DE14FF030D45DDA99DC056285C7980446BA0FC37F489B7534BE46107B21BD43CEE87BA0
Malicious:	false
Reputation:	unknown
URL:	https://www.gstatic.com/recaptcha/api2/info_2x.png
Preview:	.PNG........IHDR...0...0.......1.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........IDATX..W..DA.=.6O...H.,E.............b.....C.1...1..EbLPI.W......H..s.z5.:..._.d.0.u.......j.x.R..._.v..R...1..ir..`.yn..R..j.h./y..l......(`..5....l.E..0......B^......F.....F....Y\|p..._,p.............(3^.r.P.O......;<....z.,..yF....N..x.MS...Q.C%......D8G.+......oOk...)T..}\|..e...G.....'.R..G.Z.T}7(...&..@...G....$PGYv...A.c.]d....N..'.4b...R.%..)2Yd..b.M..^@.M....^.:h.N(dP*t..RQ%.o...{.vGH..S._".@./...g.....]...?..h..E.,r.m.%."."W.6G..t...->....q\.Kc.t"^......Kj~{l..C..).y..><@\|yB....=c.............!...<....IEND.B`.

Chrome Cache Entry: 148

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	OpenType font data
Category:	downloaded
Size (bytes):	146180
Entropy (8bit):	5.705325879232613
Encrypted:	false
SSDEEP:
MD5:	E7FD253C5F344CF7C22035B2618E9B89
SHA1:	9EAF7A37F0CB075644940EF8F1884A745293A1ED
SHA-256:	4D01300F7619B41556E9C39673788CA61EB360CC219C96BF9E18F673B91884AF
SHA-512:	3C0EEB7E29A1608950E99F2EC437C480D80DB11A824933330C9D187ABB4CF3A5AC52B549382528E29311FD7346F612C05666F5FDC7FB8C8C99355E6C92032C93
Malicious:	false
Reputation:	unknown
URL:	https://pass-ga.com/assets/GothamNarrow-Ultra.otf
Preview:	OTTO.......@CFF U,.g...<.._.GPOS........".GSUB0..L.......OS/2Y.0....0...`cmapF.=.........head.9.........6hhea.,.........$hmtx.2.v........kern.8.........$maxp.vP....(....name.b$........^post...2....... ......33..V_.<............w.......w......................... .8.......j...................]..P..v.....'.......................2..................@..J........H&FJ... ... .8..............."..... ..... ...........I.............I...........V.........&.[.............................................a...................................../.........../...........A.........+.............I...........V.....................&.......................L...........$...........&.$.........$.............J....................*...........$.6.........$.6...........Z.........V.^........................Copyright (C) 2001, 2008 Hoefler & Frere-Jones. http://www.typography.comGotham NarrowUltraH&FJ: Gotham Narrow Ultra: 2.200 BasicGotham Narrow UltraVersion 2.200 BasicGothamNarrow-UltraGotham is a trademark of

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8392), with CRLF line terminators
Category:	downloaded
Size (bytes):	15900
Entropy (8bit):	5.360677669540533
Encrypted:	false
SSDEEP:
MD5:	60D94294DD7FBDA0B19398130E366E8A
SHA1:	C01EBC1BB2DA151A636082DBD0D69F179A23DBD5
SHA-256:	475575A56670C4AB3F05CA4B001674BBEA9E6CBACAF9E0C0F2527A1AACDB9731
SHA-512:	E55E61B93B02721793A62AC2122DE826C0D4D526E57EC34EDF21F57B8179B3D12B8471653A59F08A162F88CCFC07AF423A19246937BB7FA1EF9102621B5AB098
Malicious:	false
Reputation:	unknown
URL:	https://pass-ga.com/aca_assetz/js/misc.js
Preview:	// jQuery Mask Plugin v1.14.8..// github.com/igorescobar/jQuery-Mask-Plugin..var $jscomp={scope:{},findInternal:function(a,f,c){a instanceof String&&(a=String(a));for(var l=a.length,g=0;g<l;g++){var b=a[g];if(f.call(c,b,g,a))return{i:g,v:b}}return{i:-1,v:void 0}}};$jscomp.defineProperty="function"==typeof Object.defineProperties?Object.defineProperty:function(a,f,c){if(c.get\|\|c.set)throw new TypeError("ES3 does not support getters and setters.");a!=Array.prototype&&a!=Object.prototype&&(a[f]=c.value)};..$jscomp.getGlobal=function(a){return"undefined"!=typeof window&&window===a?a:"undefined"!=typeof global&&null!=global?global:a};$jscomp.global=$jscomp.getGlobal(this);$jscomp.polyfill=function(a,f,c,l){if(f){c=$jscomp.global;a=a.split(".");for(l=0;l<a.length-1;l++){var g=a[l];g in c\|\|(c[g]={});c=c[g]}a=a[a.length-1];l=c[a];f=f(l);f!=l&&null!=f&&$jscomp.defineProperty(c,a,{configurable:!0,writable:!0,value:f})}};..$jscomp.polyfill("Array.prototype.find",function(a){return a?a:function(a,

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	810
Entropy (8bit):	4.755495893947412
Encrypted:	false
SSDEEP:
MD5:	F3AE57391AF6166FBCAC4B1621A682C0
SHA1:	223EE7032997C1D98B3C4DBF8BB6AD44BB31C2AB
SHA-256:	8FBCE5FB46CAC00A420EAF2ADD1C03CE97F6CE1E94ADFF5951CA75080DDC7E67
SHA-512:	EDE7ABE54AC4B0A6E41AA0734C1D63AFB1A211809D24203097C306DC26E5A113FE8B83034D77A5AF106BA01CC2EB2A0BB4986F812B15FDAD8605BF675D684824
Malicious:	false
Reputation:	unknown
URL:	https://pass-ga.com/assets/logo-twitter.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="32.1" height="26" viewBox="0 0 32.1 26">. <defs>. <style>. .cls-1 {. fill: #f88742;. }. </style>. </defs>. <g id="logo-twitter" transform="translate(0.1 -3)">. <path id="Path_3" data-name="Path 3" class="cls-1" d="M32,6.1a11.836,11.836,0,0,1-3.8,1,6.462,6.462,0,0,0,2.9-3.6,12.606,12.606,0,0,1-4.2,1.6A6.438,6.438,0,0,0,22.2,3a6.594,6.594,0,0,0-6.6,6.6,7.719,7.719,0,0,0,.2,1.5A18.852,18.852,0,0,1,2.2,4.2a6.294,6.294,0,0,0-.9,3.3A6.765,6.765,0,0,0,4.2,13a6.109,6.109,0,0,1-3-.8v.1a6.543,6.543,0,0,0,5.3,6.4,9.852,9.852,0,0,1-1.7.2,4.869,4.869,0,0,1-1.2-.1,6.679,6.679,0,0,0,6.1,4.6,12.917,12.917,0,0,1-8.2,2.8,8.6,8.6,0,0,1-1.6-.1A19.851,19.851,0,0,0,10.1,29c12.1,0,18.7-10,18.7-18.7V9.5A17.215,17.215,0,0,0,32,6.1Z"/>. </g>.</svg>.

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2567)
Category:	downloaded
Size (bytes):	445360
Entropy (8bit):	5.042704571611597
Encrypted:	false
SSDEEP:
MD5:	CD48718AF6B26F4981D3AA8834E7466B
SHA1:	4440D8B7AC7AA81C611BB8C24BC8F3C55A133639
SHA-256:	E3B314B46CCF08D693A9A48BF3E91F95FC0AEA6AE52AA88EE1D4C0E85B1969E3
SHA-512:	AF4F41BDA00F2A3CC6137B668A24C29B8F62E1ED725F979283CFC680F7C6364BECBF724F12374F8E9B2BD3B0E7B0086E25EF2C2F38A4F60430AC43FE5D9BD5DB
Malicious:	false
Reputation:	unknown
URL:	https://pass-ga.com/assets/css_0qBQwEogu_tfxbfN86gr6vJ-8z0hcYrfgKX25RxeRao.css
Preview:	html {. font-family: sans-serif;. -ms-text-size-adjust: 100%;. -webkit-text-size-adjust: 100%;.}.body {. margin: 0;.}.article,.aside,.details,.figcaption,.figure,.footer,.header,.hgroup,.main,.menu,.nav,.section,.summary {. display: block;.}.audio,.canvas,.progress,.video {. display: inline-block;. vertical-align: baseline;.}.audio:not([controls]) {. display: none;. height: 0;.}.[hidden],.template {. display: none;.}.a {. background-color: transparent;.}.a:active,.a:hover {. outline: 0;.}.abbr[title] {. border-bottom: 1px dotted;.}.b,.strong {. font-weight: bold;.}.dfn {. font-style: italic;.}.h1 {. font-size: 2em;. margin: 0.67em 0;.}.mark {. background: #ff0;. color: #000;.}.small {. font-size: 80%;.}.sub,.sup {. font-size: 75%;. line-height: 0;. position: relative;. vertical-align: baseline;.}.sup {. top: -0.5em;.}.sub {. bottom: -0.25em;.}.img {. border: 0;.}.svg:not(:root) {. overflow: hidden;.}.figure {. margin: 1em 40px;.}.hr {. box-sizing: content-

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	100
Entropy (8bit):	4.624792336270294
Encrypted:	false
SSDEEP:
MD5:	953C62979F46E4E182B544E57FDF0F68
SHA1:	E329E35C531427431CEF228B656D1DC3EC762B7E
SHA-256:	5C73473A9E6BFC602B31A5994CFF6EAFC9CAA99EDDC4C6752B05575C77EC59F4
SHA-512:	8E18FACC6154445F1215D3C4AC2E0C28C7862537EAF954BE67B31877E4C7F5737245CACEC63A55E544474BB066E8F84D3DF17688DC626CD1C0A4791D4E64CE52
Malicious:	false
Reputation:	unknown
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISQQkO_vR27ajVqBIFDfyM-aUSBQ3GsYpmEgUND6hsDBIFDZ66MogSBQ1jkyeHEgUNRmcVfRIFDfKo5J0SBQ0c_HLy?alt=proto
Preview:	CkgKBw38jPmlGgAKBw3GsYpmGgAKBw0PqGwMGgAKBw2eujKIGgAKBw1jkyeHGgAKBw1GZxV9GgAKBw3yqOSdGgAKBw0c/HLyGgA=

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	OpenType font data
Category:	downloaded
Size (bytes):	174132
Entropy (8bit):	5.746162904698821
Encrypted:	false
SSDEEP:
MD5:	7C9A1387EAE4CC9434E26A23EF0D5657
SHA1:	C527605053AD6034E31EFA917B089A342B21F67F
SHA-256:	AC87C8B4C738217B987BA9FB5A035665FE8EE6434FD815DDBE88759ED531C4A2
SHA-512:	D30694972E10A28FF19B9AE6EE56EE19271BFCA42D0366862CCE01847E5B69F4F54796EC9874CE0FD45EB2448759038A1A3F7D8EC19E0AD47FBED369C7617B5A
Malicious:	false
Reputation:	unknown
URL:	https://pass-ga.com/assets/GothamNarrow-Light.otf
Preview:	OTTO.......@CFF ..........y.GPOS?.Gz...8..B.GSUB.._...!T...POS/2Y./....0...`cmap+...........head.6........6hhea.+.y.......$hmtx..h....t...zkernD.m........&maxp..P....(....nameK..+.......Rpost...2....... ......33.3._.<......................G.+..................... .8...'.G.G......................P..........,.....................2..................@..J........H&FJ... ... .8..................... ..... ...........I.............I...........V.........$.[.............................................a.....................................+...........+...........=.........+.............I...........V.....................&.\|.....................H...........$..........."...........$.............>...............................$..........$.*...........N.........V.R........................Copyright (C) 2001, 2008 Hoefler & Frere-Jones. http://www.typography.comGotham NarrowLightH&FJ: Gotham Narrow Light: 2.200 ProGotham Narrow LightVersion 2.200 ProGothamNarrow-LightGotham is a trademark of Hoef

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	72649
Entropy (8bit):	3.731904033833895
Encrypted:	false
SSDEEP:
MD5:	55D83D4528F75205497442F11B48864A
SHA1:	D8F5C880A11189FAE9251A6F1D477EAC306F554B
SHA-256:	0A0479725F7901D6938573044600D0437C5861788171F096FA82BCBF16454A4B
SHA-512:	69BAEF39AFACC0CF463EDE9C33E0B2735ADD6A37B64D6B1EDFE49142ED0386218B8EB2094C697E8D5E543BE820B752CDF2EA24DBE0C84923F96229E1E089D209
Malicious:	false
Reputation:	unknown
URL:	https://pass-ga.com/assets/MyPeachPass-Horz.svg
Preview:	<?xml version="1.0" encoding="utf-8"?>. Generator: Adobe Illustrator 23.0.2, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->.<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px".. viewBox="0 0 309 77.9" style="enable-background:new 0 0 309 77.9;" xml:space="preserve">.<style type="text/css">...st0{fill:none;}...st1{fill:#F7BC60;}...st2{fill:#FFFFFF;}...st3{fill:#919195;}...st4{fill:#7AC143;}...st5{fill:#F89C57;}.</style>.<pattern x="4.6" y="273.9" width="69" height="69" patternUnits="userSpaceOnUse" id="Polka_Dot_Pattern" viewBox="2.1 -70.9 69 69" style="overflow:visible;">..<g>...<rect x="2.1" y="-70.9" class="st0" width="69" height="69"/>...<rect x="2.1" y="-70.9" class="st1" width="69" height="69"/>...<g>....<path class="st2" d="M61.8-71.7c0,0.1,0,0.1,0,0.2c-0.1,0.1-0.1,0.1-0.2,0.1c-0.1,0.1-0.1,0.3-0.1,0.4c-0.2,0.1,0,0.2,0,0.3.....c0,0,0,0.1,0,0.2c0,0.1,0,0.3,0.1,0.4c0.1,0.2,0.3,0.4,0.4,0.5c0.2,0.1,0.

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (654)
Category:	downloaded
Size (bytes):	560258
Entropy (8bit):	5.668859512958225
Encrypted:	false
SSDEEP:
MD5:	19DDAC3BE88EDA2C8263C5D52FA7F6BD
SHA1:	C81720778F57C56244C72CE6EF402BB4DE5F9619
SHA-256:	B261530F05E272E18B5B5C86D860C4979C82B5B6C538E1643B3C94FC9BA76DD6
SHA-512:	393015B8C7F14D5D4BDB9CCEED7CD1477A7DB07BC7C40BAE7D0A48A2ADFA7D56F9D1C3E4EC05C92FDE152E72FFA6B75D8BF724E1F63F9BC21421125667AFB05C
Malicious:	false
Reputation:	unknown
URL:	https://www.gstatic.com/recaptcha/releases/zIriijn3uj5Vpknvt_LnfNbF/recaptcha__en.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././.. Copyright Google LLC. SPDX-License-Identifier: Apache-2.0././.. Copyright 2005, 2007 Bob Ippolito. All Rights Reserved.. Copyright The Closure Library Authors.. SPDX-License-Identifier: MIT././. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var X=function(){return[function(N,a,U,y,A,l,z){if((l=["toString",6,"constructor"],N&71)==N)if(typeof U==="string")z={buffer:Z[11](17,1,a,U),qH:!1};else if(Array.isArray(U))z={buffer:new Uint8Array(U),qH:!1};else if(U[l[2]]===Uint8Array)z={buffer:U,qH:!1};else if(U[l[2]]===ArrayBuffer)z={buffer:new Uint8Array(U),qH:!1};else if(U[l[2]]===WC)z={buffer:r[9](25,a,null,U)\|\|new Uint8Array(0),qH:!0};else if(U instanceof Uint8Array)z={buffer:new Uint8Array(U.buffer,U.byteOffset,U.byteLength),qH:!1};else throw Error("Type not convertible to a Uint8Array, expected a Uint8Array, an ArrayBuffer, a base64 encoded string, a Byt

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1434), with no line terminators
Category:	downloaded
Size (bytes):	1434
Entropy (8bit):	5.765556935416344
Encrypted:	false
SSDEEP:
MD5:	764EE6309BF4800054E4A2A67DEB3575
SHA1:	2FFD2FDA8E49AD861B75DE1E5ED583D8CE1D5B0A
SHA-256:	652E8677AEC33767D2A5F229384F79B4F526104BF7E94D7D258070F94743C3CC
SHA-512:	4333F5A85D3085C54ACF34632CFDD57CF7EEA2D539C5CEFC1DBD07A6486083CAC1C1DA6BADB9743FD01BCDEE63AEFB187074A6BF7AB945BC897E227E1C4F5C6D
Malicious:	false
Reputation:	unknown
URL:	https://www.google.com/recaptcha/api.js
Preview:	/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]\|\|{},N='grecaptcha';var gr=w[N]=w[N]\|\|{};gr.ready=gr.ready\|\|function(f){(cfg['fns']=cfg['fns']\|\|[]).push(f);};w['__recaptcha_api']='https://www.google.com/recaptcha/api2/';(cfg['render']=cfg['render']\|\|[]).push('onload');w['__google_recaptcha_client']=true;var d=document,po=d.createElement('script');po.type='text/javascript';po.async=true; po.charset='utf-8';var v=w.navigator,m=d.createElement('meta');m.httpEquiv='origin-trial';m.content='A/kargTFyk8MR5ueravczef/wIlTkbVk1qXQesp39nV+xNECPdLBVeYffxrM8TmZT6RArWGQVCJ0LRivD7glcAUAAACQeyJvcmlnaW4iOiJodHRwczovL2dvb2dsZS5jb206NDQzIiwiZmVhdHVyZSI6IkRpc2FibGVUaGlyZFBhcnR5U3RvcmFnZVBhcnRpdGlvbmluZzIiLCJleHBpcnkiOjE3NDIzNDIzOTksImlzU3ViZG9tYWluIjp0cnVlLCJpc1RoaXJkUGFydHkiOnRydWV9';if(v&&v.cookieDeprecationLabel){v.cookieDeprecationLabel.getValue().then(function(l){if(l!=='treatment_1.1'&&l!=='treatment_1.2'&&l!=='control_1.1'){d.head.prepend(m)

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1456
Entropy (8bit):	4.731633898801165
Encrypted:	false
SSDEEP:
MD5:	62FDCB634DB4D3E351127232EF6D5C35
SHA1:	AD24DBD9474DA0BED08641C86678546274DB7140
SHA-256:	2DC78DE604E03F003401B3E1FCDD5BA39B49474AEEE1D6D4D255BFB7C18EFD9E
SHA-512:	4C638B0332ED9B1A5A07CA6E152E3A9168CE3F7CC21FBEA07DF1CAA9E89C2979C9EDAE202D4A40C5EB9E920AC81F97CCE9F1A23F496734B69D6FFD8F4DAEA6AF
Malicious:	false
Reputation:	unknown
Preview:	<svg id="logo-instagram" xmlns="http://www.w3.org/2000/svg" width="32" height="32" viewBox="0 0 32 32">. <defs>. <style>. .cls-1 {. fill: #f88742;. }. </style>. </defs>. <path id="Path_4" data-name="Path 4" class="cls-1" d="M16,2.883c4.272,0,4.778.016,6.465.093a6.855,6.855,0,0,1,4.811,1.748,6.855,6.855,0,0,1,1.748,4.811c.077,1.687.093,2.193.093,6.465s-.016,4.778-.093,6.465a6.855,6.855,0,0,1-1.748,4.811,6.855,6.855,0,0,1-4.811,1.748c-1.687.077-2.193.093-6.465.093s-4.778-.016-6.465-.093a6.855,6.855,0,0,1-4.811-1.748,6.855,6.855,0,0,1-1.748-4.811C2.9,20.778,2.883,20.272,2.883,16s.016-4.778.093-6.465A6.855,6.855,0,0,1,4.724,4.724,6.855,6.855,0,0,1,9.535,2.976C11.222,2.9,11.728,2.883,16,2.883M16,0c-4.345,0-4.89.018-6.6.1A9.567,9.567,0,0,0,2.685,2.685,9.563,9.563,0,0,0,.1,9.4C.018,11.11,0,11.655,0,16s.018,4.89.1,6.6a9.567,9.567,0,0,0,2.589,6.718A9.563,9.563,0,0,0,9.4,31.9c1.707.078,2.252.1,6.6.1s4.89-.018,6.6-.1a9.567,9.567,0,0,0,6.718-2.589A9.563,9.563,0,0,0,31.9,2

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	78685
Entropy (8bit):	6.020282308187139
Encrypted:	false
SSDEEP:
MD5:	6AEC8CFD5D3A790339DC627F9F1229B5
SHA1:	B6C8CFFE38E1015DD8595F2DD1A92435E2795874
SHA-256:	80583FA3C83831A9E036EBA0500D1B9C0D30892D0701F1617E0FAFAF5AEAA2CA
SHA-512:	4279E479C860007D04CD6FF0B8C45131C18D87420CD5CEB5C727A7DDBFB4206D007069102D643DA97C3BF01D0B756A2EF4662C8E39B6969FC154DE3C763B1EFC
Malicious:	false
Reputation:	unknown
URL:	https://www.gstatic.com/recaptcha/releases/zIriijn3uj5Vpknvt_LnfNbF/styles__ltr.css
Preview:	.goog-inline-block{position:relative;display:-moz-inline-box;display:inline-block}* html .goog-inline-block{display:inline}*:first-child+html .goog-inline-block{display:inline}.recaptcha-checkbox{border:none;font-size:1px;height:28px;margin:4px;width:28px;overflow:visible;outline:0;vertical-align:text-bottom}.recaptcha-checkbox-border{-webkit-border-radius:2px;-moz-border-radius:2px;border-radius:2px;background-color:#fff;border:2px solid #c1c1c1;font-size:1px;height:24px;position:absolute;width:24px;z-index:1}.recaptcha-checkbox-borderAnimation{background-image:url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAFQAAANICAYAAABZl8i8AAAAIGNIUk0AAHomAACAhAAA+gAAAIDoAAB1MAAA6mAAADqYAAAXcJy6UTwAAAAGYktHRAD/AP8A/6C9p5MAAHq9SURBVHja7Z15fFTl9f/fd9ZM9n1PgCyEXSSRNYKCgAuiIipuVSuudavV1tq6W/WrtnWrrZbWDZUqUqUoCoIEQhBI2JesELKvM9mTWe7c3x83d5xAlkky8fv92ft5vfKC19znOWfuZ571POc5B1SoUKFChQoVKlSoUKFChQoVKlSoUKFChQoVKlSoUKFChQoVKlSoUKFChQoVKlSoUKFChQoVKlSoUKHifwGCRqsTNFrdj6VPq9XqtNofT9+wvutQyEyad8t9IaPPntFUd

Static File Info

⊘No static file info

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://pass-ga.com/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 102

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 113

Chrome Cache Entry: 114

Chrome Cache Entry: 118

Chrome Cache Entry: 119

Chrome Cache Entry: 120

Chrome Cache Entry: 121

Chrome Cache Entry: 123

Chrome Cache Entry: 126

Chrome Cache Entry: 127

Chrome Cache Entry: 129

Chrome Cache Entry: 130

Chrome Cache Entry: 131

Chrome Cache Entry: 132

Chrome Cache Entry: 134

Chrome Cache Entry: 135

Chrome Cache Entry: 137

Chrome Cache Entry: 141

Chrome Cache Entry: 143

Chrome Cache Entry: 144

Chrome Cache Entry: 145

Chrome Cache Entry: 147

Chrome Cache Entry: 148

Chrome Cache Entry: 84

Chrome Cache Entry: 87

Chrome Cache Entry: 89

Chrome Cache Entry: 91

Windows Analysis Report
https://pass-ga.com/