Edit tour

Windows Analysis Report
https://docs.zoom.us/doc/NGIyJXAkRDK0sAtAUh4DFw?from=email

Overview

General Information

Sample URL:	https://docs.zoom.us/doc/NGIyJXAkRDK0sAtAUh4DFw?from=email
Analysis ID:	1589217

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

AI detected landing page (webpage, office document or email)

Phishing site or detected (based on various text indicators)

Detected clear text password fields (password is not hidden)

HTML page contains hidden javascript code

HTML title does not match URL

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 3348 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6804 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1960,i,17700741321206907532,4648256276448606921,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6440 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://docs.zoom.us/doc/NGIyJXAkRDK0sAtAUh4DFw?from=email" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected phishing page

Source: https://koi-armadillo-jnkc.squarespace.com/

Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is a well-known brand with a legitimate domain of 'microsoft.com'., The URL 'koi-armadillo-jnkc.squarespace.com' does not match the legitimate domain of Microsoft., The URL is hosted on 'squarespace.com', which is a website building platform and not directly associated with Microsoft., The presence of a password input field on a non-Microsoft domain is suspicious and indicative of a phishing attempt., The use of a subdomain and unrelated words like 'koi-armadillo-jnkc' increases the suspicion of phishing. DOM: 2.3.pages.csv

AI detected landing page (webpage, office document or email)

Source: https://docs.zoom.us/doc/NGIyJXAkRDK0sAtAUh4DFw?from=email

Joe Sandbox AI: Page contains button: 'Voir Document' Source: '1.1.pages.csv'

Phishing site or detected (based on various text indicators)

Source: Chrome DOM: 2.3

OCR Text: ta SharePoint CD-line Outlook Microsoft Sign in to continue to Cutlook Ennail, phono or Skype Enter Password * Password View Document Sign-in options

Source: https://koi-armadillo-jnkc.squarespace.com/

HTTP Parser: <input type="text"... for password input

Source: https://docs.zoom.us/doc/NGIyJXAkRDK0sAtAUh4DFw?from=email

HTTP Parser: Base64 decoded: <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" fill="none" viewBox="0 0 24 24"><path fill="#0B5CFF" d="M24 12c0 1.283-.103 2.541-.3 3.768a9.602 9.602 0 0 1-7.932 7.932 23.755 23.755 0 0 1-7.536 0A9.602 9.602 0 0 1 .3 15.768a23.745 23.745 0...

Source: https://koi-armadillo-jnkc.squarespace.com/	HTTP Parser: No <meta name="author".. found
Source: https://koi-armadillo-jnkc.squarespace.com/	HTTP Parser: No <meta name="author".. found

Source: https://koi-armadillo-jnkc.squarespace.com/	HTTP Parser: No <meta name="copyright".. found
Source: https://koi-armadillo-jnkc.squarespace.com/	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49929 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49951 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49958 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:50474 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10

Source: global traffic	DNS traffic detected: DNS query: docs.zoom.us
Source: global traffic	DNS traffic detected: DNS query: st1.zoom.us
Source: global traffic	DNS traffic detected: DNS query: us01docs.zoom.us
Source: global traffic	DNS traffic detected: DNS query: log-gateway.zoom.us
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: us01docs-va1.zoom.us
Source: global traffic	DNS traffic detected: DNS query: us.telemetry.zoom.us
Source: global traffic	DNS traffic detected: DNS query: file-paa.zoom.us
Source: global traffic	DNS traffic detected: DNS query: koi-armadillo-jnkc.squarespace.com
Source: global traffic	DNS traffic detected: DNS query: use.typekit.net
Source: global traffic	DNS traffic detected: DNS query: assets.squarespace.com
Source: global traffic	DNS traffic detected: DNS query: images.squarespace-cdn.com
Source: global traffic	DNS traffic detected: DNS query: static1.squarespace.com
Source: global traffic	DNS traffic detected: DNS query: p.typekit.net
Source: global traffic	DNS traffic detected: DNS query: performance.squarespace.com

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1960,i,17700741321206907532,4648256276448606921,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://docs.zoom.us/doc/NGIyJXAkRDK0sAtAUh4DFw?from=email"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1960,i,17700741321206907532,4648256276448606921,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	3 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Name	IP	Active	Malicious	Reputation
performance.squarespace.com	35.186.236.0	true	false	high
a.nel.cloudflare.com	35.190.80.1	true	false	high
us01-web-va1.zoom.us	170.114.11.83	true	false	unknown
static.squarespace.map.fastly.net	151.101.192.237	true	false	high
squarespace.map.fastly.net	151.101.0.238	true	false	high
edge-log-gateway-web-2f8111e8e5387748.elb.us-east-1.amazonaws.com	170.114.65.138	true	false	unknown
us.telemetry.zoom.us	170.114.52.83	true	false	unknown
koi-armadillo-jnkc.squarespace.com	198.185.159.177	true	true	unknown
st1.zoom.us	170.114.46.1	true	false	high
www.google.com	172.217.18.100	true	false	high
edge-log-gateway-web-158ad3d115123922.elb.us-east-2.amazonaws.com	134.224.0.55	true	false	unknown
file-paa.zoom.us	52.84.151.59	true	false	high
prod.squarespace.map.fastly.net	151.101.128.238	true	false	high
docs.zoom.us	170.114.52.96	true	false	unknown
log-gateway.zoom.us	unknown	unknown	false	high
use.typekit.net	unknown	unknown	false	high
images.squarespace-cdn.com	unknown	unknown	false	high
assets.squarespace.com	unknown	unknown	false	high
us01docs-va1.zoom.us	unknown	unknown	false	unknown
static1.squarespace.com	unknown	unknown	false	high
p.typekit.net	unknown	unknown	false	high
us01docs.zoom.us	unknown	unknown	false	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
216.58.206.78	unknown	United States	15169	GOOGLEUS	false
151.101.0.237	unknown	United States	54113	FASTLYUS	false
151.101.0.238	squarespace.map.fastly.net	United States	54113	FASTLYUS	false
2.16.168.125	unknown	European Union	20940	AKAMAI-ASN1EU	false
142.250.185.106	unknown	United States	15169	GOOGLEUS	false
2.16.168.105	unknown	European Union	20940	AKAMAI-ASN1EU	false
170.114.65.138	edge-log-gateway-web-2f8111e8e5387748.elb.us-east-1.amazonaws.com	United States	22347	DORSEY-WHITNEYUS	false
64.233.166.84	unknown	United States	15169	GOOGLEUS	false
151.101.128.238	prod.squarespace.map.fastly.net	United States	54113	FASTLYUS	false
52.84.151.59	file-paa.zoom.us	United States	16509	AMAZON-02US	false
2.16.168.109	unknown	European Union	20940	AKAMAI-ASN1EU	false
142.250.185.142	unknown	United States	15169	GOOGLEUS	false
170.114.52.96	docs.zoom.us	United States	22347	DORSEY-WHITNEYUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
170.114.11.83	us01-web-va1.zoom.us	United States	22347	DORSEY-WHITNEYUS	false
172.217.18.99	unknown	United States	15169	GOOGLEUS	false
142.250.186.74	unknown	United States	15169	GOOGLEUS	false
88.221.110.26	unknown	European Union	20940	AKAMAI-ASN1EU	false
134.224.0.55	edge-log-gateway-web-158ad3d115123922.elb.us-east-2.amazonaws.com	United States	3479	PEACHNET-AS1US	false
142.250.186.35	unknown	United States	15169	GOOGLEUS	false
142.250.184.195	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
170.114.52.83	us.telemetry.zoom.us	United States	22347	DORSEY-WHITNEYUS	false
216.58.212.131	unknown	United States	15169	GOOGLEUS	false
151.101.192.237	static.squarespace.map.fastly.net	United States	54113	FASTLYUS	false
134.224.0.54	unknown	United States	3479	PEACHNET-AS1US	false
216.58.206.42	unknown	United States	15169	GOOGLEUS	false
52.84.151.46	unknown	United States	16509	AMAZON-02US	false
198.185.159.177	koi-armadillo-jnkc.squarespace.com	United States	53831	SQUARESPACEUS	true
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.181.228	unknown	United States	15169	GOOGLEUS	false
170.114.46.1	st1.zoom.us	United States	22347	DORSEY-WHITNEYUS	false
142.250.186.100	unknown	United States	15169	GOOGLEUS	false
35.186.236.0	performance.squarespace.com	United States	15169	GOOGLEUS	false
172.217.18.100	www.google.com	United States	15169	GOOGLEUS	false

IP
192.168.2.17
192.168.2.16

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589217
Start date and time:	2025-01-11 19:31:40 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://docs.zoom.us/doc/NGIyJXAkRDK0sAtAUh4DFw?from=email
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal56.phis.win@17/130@74/274

Input	Output
URL: https://docs.zoom.us Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://docs.zoom.us
URL: https://docs.zoom.us/doc/NGIyJXAkRDK0sAtAUh4DFw?fr... Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": "The provided JavaScript snippet appears to be a legitimate preload spinner implementation with no high-risk indicators. It creates a loading spinner overlay, applies CSS styles, and removes the spinner when the page has finished loading. The code does not exhibit any behaviors associated with high-risk or malicious activities." }
(()=>{var i=` @keyframes spinner-rotate { from { transform: rotate(0deg); } to { transform: rotate(360deg); } } #preload-spinner { position: fixed; top: 0; right: 0; bottom: 0; left: 0; z-index: 442; display: flex; align-items: center; justify-content: center; background: var(--bg-primary); pointerEvents: none; } #preload-spinner svg { height: 16px; width: 16px; color: var(--text-secondary) !important; animation: spinner-rotate 1s steps(12, end) infinite; } [data-theme='dark'] #preload-spinner { background: var(--bg-primary); } [data-theme='dark'] #preload-spinner svg { color: var(--text-secondary) !important; } `;function a(){let e;e=document.createElement("div"),e.id="preload-spinner",e.style.boxSizing="border-box";let n=document.createElement("style");n.innerText=i;let l=document.createElement("div");l.innerHTML=` <div id="preload-spinner"> <svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" fill="none" viewBox="0 0 16 16"><path fill="currentColor" fill-rule="evenodd" d="M8 0a.5.5 0 0 1 .5.5V4a.5.5 0 0 1-1 0V.5A.5.5 0 0 1 8 0" clip-rule="evenodd"/><path fill="currentColor" fill-rule="evenodd" d="M8 11.5a.5.5 0 0 1 .5.5v3.5a.5.5 0 0 1-1 0V12a.5.5 0 0 1 .5-.5" clip-rule="evenodd" opacity=".5"/><path fill="currentColor" fill-rule="evenodd" d="M12 1.072a.5.5 0 0 1 .183.683l-1.75 3.03a.5.5 0 0 1-.866-.5l1.75-3.03A.5.5 0 0 1 12 1.072" clip-rule="evenodd" opacity=".05"/><path fill="currentColor" fill-rule="evenodd" d="M6.25 11.031a.5.5 0 0 1 .183.683l-1.75 3.031a.5.5 0 0 1-.866-.5l1.75-3.03a.5.5 0 0 1 .683-.184" clip-rule="evenodd" opacity=".6"/><path fill="currentColor" fill-rule="evenodd" d="M14.929 4a.5.5 0 0 1-.183.683l-3.031 1.75a.5.5 0 0 1-.5-.866l3.031-1.75a.5.5 0 0 1 .683.183" clip-rule="evenodd" opacity=".1"/><path fill="currentColor" fill-rule="evenodd" d="M4.968 9.75a.5.5 0 0 1-.183.683l-3.031 1.75a.5.5 0 0 1-.5-.866l3.031-1.75a.5.5 0 0 1 .683.183" clip-rule="evenodd" opacity=".7"/><path fill="currentColor" fill-rule="evenodd" d="M11.5 8a.5.5 0 0 1 .5-.5h3.5a.5.5 0 0 1 0 1H12a.5.5 0 0 1-.5-.5" clip-rule="evenodd" opacity=".2"/><path fill="currentColor" fill-rule="evenodd" d="M0 8a.5.5 0 0 1 .5-.5H4a.5.5 0 0 1 0 1H.5A.5.5 0 0 1 0 8" clip-rule="evenodd" opacity=".8"/><path fill="currentColor" fill-rule="evenodd" d="M11.032 9.75a.5.5 0 0 1 .683-.183l3.031 1.75a.5.5 0 1 1-.5.866l-3.031-1.75a.5.5 0 0 1-.183-.683" clip-rule="evenodd" opacity=".3"/><path fill="currentColor" fill-rule="evenodd" d="M1.071 4a.5.5 0 0 1 .683-.183l3.031 1.75a.5.5 0 0 1-.5.866l-3.031-1.75A.5.5 0 0 1 1.071 4" clip-rule="evenodd" opacity=".9"/><path fill="currentColor" fill-rule="evenodd" d="M9.75 11.031a.5.5 0 0 1 .683.183l1.75 3.031a.5.5 0 1 1-.866.5l-1.75-3.03a.5.5 0 0 1 .183-.684" clip-rule="evenodd" opacity=".4"/><path fill="currentColor" fill-rule="evenodd" d="M4 1.071a.5.5 0 0 1 .683.183l1.75 3.031a.5.5 0 0 1-.866.5l-1.75-3.03A.5.5 0 0 1 4 1.07Z" clip-rule="evenodd" opacity=".95"/></svg> </div> `,e.appendChild(n),e.appendChild(l),document.body.appendChild(e),window.addEventListener("load",()=>{(e==null?void 0:e.parentNode)===document.body&&(document.body.removeChild(e),e=void 0)}),window.removePreloadSpinner=()=>{(e==null?void 0:e.parentNode)===document.body&&(document.body.removeChild(e),e=void 0)}}a();var d,o=(d=window.__ENTRY_TO_ASSETS__)==null?void 0:d.__core,r,t;if(o!=null&&o.length){let e=(t=(r=window.__RUNTIME_ENV__)==null?void 0:r.CDN_HOST)!=null?t:location.origin+"/assets";o.forEach(n=>{if(!n.endsWith(".css"))return;let l=document.createElement("link");l.rel="stylesheet",l.href=`${e}/${n}`,document.head.appendChild(l)})}})();
URL: https://docs.zoom.us/doc/NGIyJXAkRDK0sAtAUh4DFw?fr... Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": "The provided JavaScript snippet appears to be a configuration object for a runtime environment, which does not contain any high-risk indicators. The object defines various configuration parameters, such as allowed embedded URLs, redirect settings, and API endpoints. This type of configuration data is typically used in legitimate web applications and does not demonstrate any malicious behavior." }
window.__RUNTIME_ENV__ = {"ALLOWED_EMBEDDED_URL":["^https:\\/\\/(www\\.)?(twitter\|x)\\.com(\\/.)?$","^https:\\/\\/(www\\.)?(youtube\\.com\|youtu\\.be)(\\/.)?$","^https:\\/\\/(www\\.)?figma\\.com(\\/.)?$","^https:\\/\\/docs\\.google\\.com(\\/.)?$","^https:\\/\\/open\\.spotify\\.com(\\/.)?$","^https:\\/\\/codepen\\.io(\\/.)?$","^https:\\/\\/miro\\.com(\\/.)?$"],"ALLOW_REDIRECT_CLUSTER":false,"ALLOW_TRACING":true,"ALL_DOCS_DOMAIN_REGEX":"^(dg01\|gozm\|us01\|us04\|au01\|ca01\|eu01\|eu02)?(docs\|drive)(\\-(va1\|va2\|oh1))?\\.(zoom\\.us\|zoomconnector\\.com)$","ALTERNATIVE_HOSTS":["https://docs.zoom.us","https://dg01docs.zoom.us","https://us01docs.zoom.us"],"API_HOST":"https://docs.zoom.us","BASE_PATH":"/","CDN_HOST":"https://st1.zoom.us/zoom-docs/release/web/lynx/editor/assets","CHANNEL_URL_SUFFIX":"@conference.xmpp.zoom.us","CLUSTER_ID":"aw1","DOCS_HOSTS":["https://docs.zoom.us","https://dg01docs.zoom.us","https://gozmdocs.zoom.us","https://us01docs.zoom.us","https://us04docs.zoom.us","https://au01docs.zoom.us","https://ca01docs.zoom.us","https://eu01docs.zoom.us","https://eu02docs.zoom.us"],"DOCS_MAX_ALL_TEXT_CONTENT_SIZE":20971520,"DOCS_MAX_BLOCK_CONTENT_SIZE":204800,"DOCS_MAX_COLUMN_NUM":200,"DOCS_MAX_FILE_UPLOAD_SIZE":1048576000,"DOCS_MAX_FREE_USER_UPLOAD_ATTACHMENT_SIZE":10485760,"DOCS_MAX_IMAGE_UPLOAD_SIZE":20971520,"DOCS_MAX_IMPORT_SIZE":10485760,"DOCS_MAX_ROW_CONTENT_SIZE":2097152,"DOCS_MAX_ROW_NUM":20000,"DOCS_MAX_TNS_UPLOAD_SIZE":31457280,"DOCS_MAX_TOTAL_ATTACHMENT_SIZE":2097152000,"DOCS_MAX_TOTAL_BLOCK_NUM":20000,"DOCS_MAX_TOTAL_CHART_NUM":30,"DOCS_MAX_VIEW_CONTENT_SIZE":2097152,"DOCS_MAX_VIEW_NUM":200,"FILE_CLUSTER_API_PREFIX":"https://us01docs.zoom.us/","FILE_ID":"NGIyJXAkRDK0sAtAUh4DFw","HUB_HOSTS":["https://dg01drive.zoom.us"],"JID_USER_SUFFIX":"@xmpp.zoom.us","MEETING_DOC_IN_MEETING_PERMISSION_RETRY_DELAY":3000,"NONCE":"5eeba08f-d04a-11ef-9b8a-c6b1c1c16d39","SIGN":"01b8458bf22e1bf5fcdbbc275a9bb738603304713542881d192e453e1df44e8d","STATIC_ASSETS_PREFIX":"https://st1.zoom.us","TRACING_CHAIN_HOST":"https://log-gateway.zoom.us/zoomdoc/gr","TRACING_HOST":"https://log-gateway.zoom.us/zoomdoc/logs","WHITEBOARD_FLOWCHART":"JbBC2oKmTFW7NP9NFbTQ-w","WHITEBOARD_MINIMAP":"k7MEeU2JSNmGt1_JfANzpg","ZOOM_DOMAIN":"https://zoom.us","ZOOM_PRODUCTS_URL":["^https:\\/\\/([\\w-]+\\.)?([\\w-]+\\.)?zoom\\.us\\/(clips\|wb\|(integration\\/wb)\|rec\|recording\|notes)(\\/.)?$","^https:\\/\\/(dg01\|us01\|us04\|eu01\|ca01\|au01\|eu02\|gozm)?docs\\.zoom\\.us((\\/[^(\\/?(?:logout))](.))?\|\\/)$","^https:\\/\\/([\\w-]+\\.)?zoom\\.com(\\/.)?$","^https:\\/\\/[\\w-]+\\.zoomus\\.cn(\\/.)?$","^https:\\/\\/([\\w-]+\\.)?zoom\\.com\\.cn(\\/.)?$","^https:\\/\\/[\\w-]+\\.zoomconnector\\.com(\\/.)?$","^https:\\/\\/([\\w-]+\\.)?([\\w-]+\\.)?zoomgov\\.com(\\/.)?$"]};
URL: https://st1.zoom.us/zoom-docs/release/web/lynx/edi... Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": "The provided JavaScript snippet appears to be a louserzation object for the Zoom Docs platform. It contains various strings and translations for the user interface, but does not exhibit any high-risk behaviors such as dynamic code execution, data exfiltration, or malicious redirects. The snippet is likely part of the legitimate functionality of the Zoom Docs application and does not pose a significant security risk." }
window.__ZOOM_DOCS_LOCALE__ = {"LNi4mq":"Instant translate","69BaoZ":"Hold the \"Shift\" key and slightly move the cursor over a paragraph to view translation.","Sfd768":"Target language","Gxgt51":"Resolved comments","nTgK6I":"Comment keyboard shortcut","gjpdaf":"Report","hvvUMc":"The report is being submitted, please wait.","Dgx7dW":"Description must be under 200 characters","xyjxwb":"The attachment is being uploaded, please wait.","5xdKYd":"The attachment upload has failed. Please try uploading again or remove the attachment.","+NK7l/":"Report failed, try again later.","nlV/JK":"Report submitted, confirmation will be emailed.","hQRttt":"Submit","dEgA5A":"Cancel","fRpnER":"You don't have permission to export page.","8wUNZQ":"You don't have access to print files. Please contact the administrator to request it.","EqVeSZ":"Please open the page in your browser to print it.","ZdWg0V":"Open in browser","CpR1qa":"Print (save as PDF)","2wxgft":"Rename","6sLeY7":"Show deleted pages","Alx2/L":"Open in new tab","4/RpOy":"Open in new window","WT5n8G":"Page info","tEQUBk":"Version history","IrYrzq":"Save version","96G6Re":"New folder","NDohKw":"Due to the administrator's settings, you can't create shared folder.","6ExD72":"Will be available for basic users soon. Stay tuned!","gXeJv/":"New shared folder","cLDnfU":"Create shared folder","iu7br6":"You can't create doc due to the administrator's setting","LsbOym":"New doc","GaZPdr":["Doc created in ",["location"]],"yLRlZm":"Add page","S/Kwja":"New data table","wDTG6m":"Add data table","0PQZ5O":"You can't create whiteboard due to the administrator's setting","GPAcvl":"New whiteboard","xPN0su":"You can't create note due to the administrator's setting","zPPcuu":"New note","ALz4Wf":"You can't create clip due to the administrator's setting","QB6iUV":"New clip","S2sLVM":"Make a copy","vfYjJ/":"Copy failed.","glPalr":"Copy to my docs","MyrUeA":"Copy to my files","OvEjsP":"Copying...","h1H95j":"Copy succeeded","1TNIig":"Open","9sj0G8":"Copy failed","MVxpbf":"Find and replace","Tz0i8g":"Settings","hB02vO":"Manage members","K4UDRx":"View trash","3wCtJS":"Hide shared folder","onAapK":"Shared folder is hidden","lgJWmb":"Show shared folder","ZOe+Vk":"Shared folder is shown","VAOn4r":"Unlock","AATPBt":["\"",["0"],"\" will be unlocked."],"HD2Tiz":"Lock","raHJLQ":["\"",["0"],"\" will be locked and other people won't be able to visit it."],"dakVor":"Hide from recent list","l3s5ri":"Import","zaYZWH":"Save to my templates","iCQFiA":"Saved to my templates","jpctdh":"View","pCT/Ok":"Failed to start meeting","vpPZx1":"Failed to start meeting. Please retry later.","gtoCSm":"Failed to open schedule","db4J3X":"Failed to open schedule. Please retry later.","LbBZdv":"You are already in a meeting","LK87TX":"Can't start a new meeting while you are in an ongoing one. Please leave the current meeting first.","/7Z/kU":"Meet now","P1gITq":"Schedule meeting","AUYALh":"Coming soon","YCjtjt":["You don't have permission to move the ",["0"],". Please contact the ",["1"]," owner."],"mcfB2A":"Move to","QWdKwH":"Move","XENfgE":"You don't have permission to comment. Contact the doc owner for help","NBdIgR":"Comment","y1eoq1":"Copy link","c1LZZH":"Link copied.","cnGeoo":"Delete","DFjdv0":"Delete template","q1CHuZ":"Delete template doc","pkY45E":"After you delete this template, the corresponding template doc will also be deleted.","krOEVx":"After you delete this template doc, the corresponding template will also be deleted.","sr2B4S":"Delete this doc?","Sy5Vrj":["\"",["displayTitle"],"\" will be moved to trash, and all users will lose access to it."],"oxp5G5":["\"",["displayTitle"],"\" will be moved to the trash in this shared folder, and all users will lose access to it."],"s3TN9v":"Delete pages","O1M1zi":"Delete page","8u7C3p":["\"",["displayTitle"],"\" and all its subpages will be moved to the \"Deleted Pages\" section of this doc, and collaborators will no longer have access to them."],"UEEj/g":["\"",["displayTitle"],"\" will be moved
URL: https://docs.zoom.us/doc/NGIyJXAkRDK0sAtAUh4DFw?fr... Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": "The provided JavaScript snippet appears to be a performance monitoring and analytics script, which is a common and legitimate practice. While it uses some legacy APIs like `XDomainRequest`, the overall behavior is benign and focused on collecting performance metrics without any indicators of malicious intent or data exfiltration. The script is likely part of a larger web application and does not demonstrate high-risk behaviors." }
(()=>{var tn=Object.defineProperty,rn=Object.defineProperties;var on=Object.getOwnPropertyDescriptors;var I=Object.getOwnPropertySymbols;var an=Object.prototype.hasOwnProperty,sn=Object.prototype.propertyIsEnumerable;var M=(n,e,t)=>e in n?tn(n,e,{enumerable:!0,configurable:!0,writable:!0,value:t}):n[e]=t,y=(n,e)=>{for(var t in e\|\|(e={}))an.call(e,t)&&M(n,t,e[t]);if(I)for(var t of I(e))sn.call(e,t)&&M(n,t,e[t]);return n},b=(n,e)=>rn(n,on(e));var W=-1,g=function(n){addEventListener("pageshow",function(e){e.persisted&&(W=e.timeStamp,n(e))},!0)},E=function(){var n=self.performance&&performance.getEntriesByType&&performance.getEntriesByType("navigation")[0];if(n&&n.responseStart>0&&n.responseStart<performance.now())return n},h=function(){var n=E();return n&&n.activationStart\|\|0},d=function(n,e){var t=E(),i="navigate";return W>=0?i="back-forward-cache":t&&(document.prerendering\|\|h()>0?i="prerender":document.wasDiscarded?i="restore":t.type&&(i=t.type.replace(/_/g,"-"))),{name:n,value:e===void 0?-1:e,rating:"good",delta:0,entries:[],id:"v4-".concat(Date.now(),"-").concat(Math.floor(8999999999999*Math.random())+1e12),navigationType:i}},N=function(n,e,t){try{if(PerformanceObserver.supportedEntryTypes.includes(n)){var i=new PerformanceObserver(function(r){Promise.resolve().then(function(){e(r.getEntries())})});return i.observe(Object.assign({type:n,buffered:!0},t\|\|{})),i}}catch(r){}},p=function(n,e,t,i){var r,s;return function(c){e.value>=0&&(c\|\|i)&&((s=e.value-(r\|\|0))\|\|r===void 0)&&(r=e.value,e.delta=s,e.rating=function(u,a){return u>a[1]?"poor":u>a[0]?"needs-improvement":"good"}(e.value,t),n(e))}},V=function(n){requestAnimationFrame(function(){return requestAnimationFrame(function(){return n()})})},$=function(n){document.addEventListener("visibilitychange",function(){document.visibilityState==="hidden"&&n()})},z=function(n){var e=!1;return function(){e\|\|(n(),e=!0)}},f=-1,k=function(){return document.visibilityState!=="hidden"\|\|document.prerendering?1/0:0},v=function(n){document.visibilityState==="hidden"&&f>-1&&(f=n.type==="visibilitychange"?n.timeStamp:0,cn())},q=function(){addEventListener("visibilitychange",v,!0),addEventListener("prerenderingchange",v,!0)},cn=function(){removeEventListener("visibilitychange",v,!0),removeEventListener("prerenderingchange",v,!0)},H=function(){return f<0&&(f=k(),q(),g(function(){setTimeout(function(){f=k(),q()},0)})),{get firstHiddenTime(){return f}}},R=function(n){document.prerendering?addEventListener("prerenderingchange",function(){return n()},!0):n()},j=[1800,3e3],U=function(n,e){e=e\|\|{},R(function(){var t,i=H(),r=d("FCP"),s=N("paint",function(c){c.forEach(function(u){u.name==="first-contentful-paint"&&(s.disconnect(),u.startTime<i.firstHiddenTime&&(r.value=Math.max(u.startTime-h(),0),r.entries.push(u),t(!0)))})});s&&(t=p(n,r,j,e.reportAllChanges),g(function(c){r=d("FCP"),t=p(n,r,j,e.reportAllChanges),V(function(){r.value=performance.now()-c.timeStamp,t(!0)})}))})};var un=function(n){var e=self.requestIdleCallback\|\|self.setTimeout,t=-1;return n=z(n),document.visibilityState==="hidden"?n():(t=e(n),$(n)),t};var O=[2500,4e3],C={},_=function(n,e){e=e\|\|{},R(function(){var t,i=H(),r=d("LCP"),s=function(a){e.reportAllChanges\|\|(a=a.slice(-1)),a.forEach(function(m){m.startTime<i.firstHiddenTime&&(r.value=Math.max(m.startTime-h(),0),r.entries=[m],t())})},c=N("largest-contentful-paint",s);if(c){t=p(n,r,O,e.reportAllChanges);var u=z(function(){C[r.id]\|\|(s(c.takeRecords()),c.disconnect(),C[r.id]=!0,t(!0))});["keydown","click"].forEach(function(a){addEventListener(a,function(){return un(u)},!0)}),$(u),g(function(a){r=d("LCP"),t=p(n,r,O,e.reportAllChanges),V(function(){r.value=performance.now()-a.timeStamp,C[r.id]=!0,t(!0)})})}})},B=[800,1800],ln=function n(e){document.prerendering?R(function(){return n(e)}):document.readyState!=="complete"?addEventListener("load",function(){return n(e)},!0):setTimeout(e,0)},G=function(n,e){e=e\|\|{};var t=d("TTFB"),i=p(n,t,B,e.reportAllChanges);ln(function(){var r=E();r&&(t.value=Mat
URL: https://docs.zoom.us/doc/NGIyJXAkRDK0sAtAUh4DFw?fr... Model: Joe Sandbox AI	{ "risk_score": 4, "reasoning": "The script appears to be a louserzation and caching mechanism for a web application. It has some moderate-risk indicators, such as using `sessionStorage` to store and reload the application, but the overall behavior is not inherently malicious. The script is primarily focused on managing language preferences and cache invalidation, which are common practices in web development. However, the use of `window.location.reload()` and the `__BEFORE_UNLOAD__` flag could potentially be abused, so further review may be warranted." }
(()=>{var D=Object.defineProperty,S=Object.defineProperties;var y=Object.getOwnPropertyDescriptors;var f=Object.getOwnPropertySymbols;var C=Object.prototype.hasOwnProperty,N=Object.prototype.propertyIsEnumerable;var g=(i,n,r)=>n in i?D(i,n,{enumerable:!0,configurable:!0,writable:!0,value:r}):i[n]=r,s=(i,n)=>{for(var r in n\|\|(n={}))C.call(n,r)&&g(i,r,n[r]);if(f)for(var r of f(n))N.call(n,r)&&g(i,r,n[r]);return i},c=(i,n)=>S(i,y(n));const v="static-v2_entry",O="index.html",u=["en-US","de-DE","fr-FR","es-ES","ru-RU","ja-JP","ko-KR","pt-PT","vi-VN","zh-CN","zh-TW","it-IT","tr-TR","pl-PL","id-ID","nl-NL","sv-SE"],x={en:0,uk:0,nl:0,au:0,ca:0,en_GB:0,de:1,de_DE:1,"de-de":1,fr:2,fr_FR:2,"fr-fr":2,es:3,es_ES:3,"es-es":3,ru:4,ru_RU:4,"ru-ru":4,"ru-R":4,jp:5,ja:5,ja_JP:5,"jp-jp":5,"jp-JP":5,ko:6,ko_KR:6,"ko-ko":6,"ko-KO":6,pt:7,pt_BR:7,"pt-BR":7,"pt-pt":7,vi:8,vi_VN:8,"vi-vn":8,zh:9,zh_CN:9,"zh-cn":9,zh_TW:10,zh_HK:10,"zh-tw":10,it:11,it_IT:11,"it-it":11,tr:12,tr_TR:12,"tr-tr":12,pl:13,pl_PL:13,"pl-pl":13,id:14,id_ID:14,id_id:14,"in-ID":14,"nl-nl":15,sv:16,"sv-SE":16,sv_SE:16,"sv-se":16},d="sun:i18n:reload";function z(){const i={duration:6e4,maxTimes:3};function n(){return c(s({},i),{start:Date.now(),times:1})}function r(){try{const t=sessionStorage.getItem(d),e=t?JSON.parse(t):{};return e&&typeof e=="object"?e:{}}catch(t){return{}}}function l(t){var R;const e=r();let o=(R=e[t])!=null?R:n();const T=Date.now()-o.start>o.duration,h=o.times<o.maxTimes;if(T){o=c(s({},o),{start:Date.now()}),e[t]=o,sessionStorage.setItem(d,JSON.stringify(e)),window.__BEFORE_UNLOAD__=!0,window.location.reload();return}if(h){o=c(s({},o),{times:o.times+1}),e[t]=o,sessionStorage.setItem(d,JSON.stringify(e)),window.__BEFORE_UNLOAD__=!0,window.location.reload();return}}function L(t){const e=new RegExp(`${t}=([\\w-_]+)`).exec(document.cookie);return e==null?void 0:e[1].trim()}function p(t,e){document.cookie=`${t}=${e};path=/;max-age=${31536e6};`}function A(t){return t.startsWith("/")?t:`/${t}`}function w(t,e){return u.includes(t)?t:u[x[t]]\|\|e}const a="en-US",m=window._zm_lang;m&&p("_zm_lang",encodeURIComponent(m));const _=L("_zm_lang")\|\|a,E=document.documentElement.getAttribute("lang")\|\|a;w(_,a)!==E&&u.includes(E)&&(caches?caches.open(v).then(async t=>{const e=new Request(A(O));await t.delete(e),l(_)}).catch(console.error):l(_))}if(typeof window!="undefined")try{z()}catch(i){console.error(i)}})();
URL: https://st1.zoom.us/zoom-docs/release/web/lynx/edi... Model: Joe Sandbox AI	{ "risk_score": 3, "reasoning": "The provided JavaScript snippet appears to be a part of a larger application and does not contain any high-risk indicators. It uses common JavaScript practices like object manipulation, imports, and React components. While it includes some moderate-risk indicators like external data transmission and DOM manipulation, these behaviors are likely part of the application's legitimate functionality. Overall, the risk score is low, and the script does not demonstrate any clear malicious intent." }
var re=Object.defineProperty,ne=Object.defineProperties;var oe=Object.getOwnPropertyDescriptors;var y=Object.getOwnPropertySymbols;var te=Object.prototype.hasOwnProperty,ae=Object.prototype.propertyIsEnumerable;var D=(s,i,r)=>i in s?re(s,i,{enumerable:!0,configurable:!0,writable:!0,value:r}):s[i]=r,w=(s,i)=>{for(var r in i\|\|(i={}))te.call(i,r)&&D(s,r,i[r]);if(y)for(var r of y(i))ae.call(i,r)&&D(s,r,i[r]);return s},L=(s,i)=>ne(s,oe(i));import{j as e,r as R,a as le,H as m,C as M}from"./main-vendor-W6FLmhIb.js";import{P as h,s as a,e as n,B as x,T as f,u as X,bp as $,b as V,ar as ce,a$ as de,ao as S,bq as ue,br as _,Q as N,N as me,ag as xe,aD as K,bs as pe,a6 as Q,bt as F,bu as I,bv as g,bw as ge,f as H,bx as C,M as fe,by as he,bz as be,bA as je,bB as ve,bC as O}from"./main-CWTidvqS.js";import{u as Re,a as Se,R as z}from"./RequestPermissionButton-Pm4bLW1S.js";const Ee=({onGoHome:s})=>e.jsx(h.Template,{type:"notFound",title:a._({id:"H72HpF"}),action:s&&!n.webview.inChatTabWebview&&e.jsx(x,{variant:"primary",size:32,style:{minWidth:"auto"},onClick:s,children:e.jsx(f,{id:"z74+Vv"})})}),B=n.device.mobile,Pe=m.div(["display:flex;flex-direction:column;align-items:center;row-gap:16px;"]),we=m.div(["display:flex;flex-direction:column;gap:12px;align-items:stretch;width:100%;"]),_e=m.div(["text-align:left;"]),Ne=m.span(["display:inline-flex;align-items:center;color:var(--text-primary);font-weight:500;font-size:14px;line-height:16px;"]),G=m(x)(["display:inline-flex;align-items:center;color:var(--text-brand);cursor:pointer;"]),U=m(Q)(["transform:rotate(","deg);transition:transform 0.3s;"],s=>s.$rotate?-180:0),Fe=s=>{const i=X(),r=$(),o=V(i.featureSetting,()=>i.featureSetting.query.getFeatureSwitch().enableEmbedRequestPermission);return n.flags.isPreview&&!n.flags.isEmbeddedPreview\|\|n.flags.isEmbeddedPreview&&!o\|\|!n.flags.user?e.jsx(h.Template,{type:"noPermission",title:a._({id:"E6lIvM"})}):r?e.jsx(Ce,w({},s)):e.jsx(Ie,{})},Ie=()=>(R.useEffect(()=>{ce({quickSignin:!0})},[]),null),Ce=({nodeId:s,title:i,canGoHome:r,onGoHome:o,canRequestPermission:t,onPermissionRequestSent:E})=>{var k;const b=de(),j=(k=b.searchParams)==null?void 0:k.requestPermission,P=S();R.useEffect(()=>{var l;if(j){const q=le(b);(l=q.searchParams)==null\|\|delete l.requestPermission,P(q,{replace:!0})}},[]);const{availableRoles:p,selectedRole:v,input:c,requestStatus:d,sendRequest:Z,selectRole:T}=Re({id:s!=null?s:"",defaultRole:ue[j],onSuccess:E}),ee=p.map(l=>({id:l,content:_[l],onSelect:()=>{T(l)},checked:l===v})).reverse(),{showMobileRoleSelector:se}=Se(p,T),ie=R.useMemo(()=>i\|\|(s&&t?a._({id:"E6lIvM"}):a._({id:"UYZMtb"})),[i,t,s]);return e.jsx(h.Template,{type:"noPermission",title:ie,action:e.jsxs(Pe,{children:[!!s&&t&&e.jsxs(we,{children:[e.jsx(_e,{children:e.jsxs(Ne,{children:[e.jsx(f,{id:"HXomwI"})," ",B?e.jsxs(G,{variant:"text",onClick:se,children:[_[v],e.jsx(U,{size:16,src:N.arrowDownSolidBlue})]}):e.jsx(me,{size:"s",menu:ee,contentProps:{align:"center"},children:({open:l})=>e.jsxs(G,{variant:"text",children:[_[v],e.jsx(U,{size:16,src:N.arrowDownSolidBlue,$rotate:l})]})})]})}),e.jsx(xe,L(w({size:40,block:!0},c),{onInput:()=>{},placeholder:a._({id:"pCR7zH"})})),e.jsxs(x,{variant:"primary",size:B?40:32,disabled:d!==z.idle,onClick:Z,children:[d===z.requesting&&e.jsx(K,{}),e.jsx(f,{id:"OlFf9i"})]})]}),!n.flags.isPreview&&e.jsx(pe,{})]})})},J=n.device.mobile,Ae=m.div(["display:flex;",""],J?M(["flex-direction:column-reverse;gap:16px;"]):M(["flex-direction:row;gap:12px;"])),Te=({onGoHome:s})=>{const i=J?40:32,r=()=>{var o;(o=window.location)==null\|\|o.reload()};return e.jsx(h.Template,{type:"permissionRequestSent",title:a._({id:"1RVBJe"}),detail:a._({id:"rr2hs3"}),action:e.jsx(e.Fragment,{children:e.jsxs(Ae,{children:[e.jsxs(x,{size:i,onClick:r,children:[e.jsx(Q,{src:N.reload,style:{transform:"scaleX(-1)"}}),a._({id:"HpK/8d"})]}),!n.flags.isPreview&&!n.webview.inChatTabWebview&&n.device.pc&&e.jsx(x,{variant:"primary",size:i,style:{minWidth:"auto"},onClick:s,children:e.jsx(f,{id:"yv/Kz
URL: https://st1.zoom.us/zoom-docs/release/web/lynx/edi... Model: Joe Sandbox AI	{ "risk_score": 3, "reasoning": "The provided JavaScript snippet appears to be a utility function that handles object manipulation and iteration. It does not contain any high-risk indicators such as dynamic code execution, data exfiltration, or redirects to malicious domains. The code uses standard JavaScript features like `Object.defineProperty`, `Object.defineProperties`, and `Object.getOwnPropertyDescriptors`, which are common and legitimate practices. While the code includes some obfuscation techniques, such as the use of Symbol properties, this is not necessarily an indicator of malicious intent. Overall, the script seems to be a utility library with low-risk behaviors, and the risk score is assessed as 3 (Low Risk)." }
var H3=Object.defineProperty,W3=Object.defineProperties;var V3=Object.getOwnPropertyDescriptors;var Bd=Object.getOwnPropertySymbols;var av=Object.prototype.hasOwnProperty,cv=Object.prototype.propertyIsEnumerable;var Hg=(e,t)=>(t=Symbol[e])?t:Symbol.for("Symbol."+e);var sv=(e,t,n)=>t in e?H3(e,t,{enumerable:!0,configurable:!0,writable:!0,value:n}):e[t]=n,x=(e,t)=>{for(var n in t\|\|(t={}))av.call(t,n)&&sv(e,n,t[n]);if(Bd)for(var n of Bd(t))cv.call(t,n)&&sv(e,n,t[n]);return e},N=(e,t)=>W3(e,V3(t));var ge=(e,t)=>{var n={};for(var r in e)av.call(e,r)&&t.indexOf(r)<0&&(n[r]=e[r]);if(e!=null&&Bd)for(var r of Bd(e))t.indexOf(r)<0&&cv.call(e,r)&&(n[r]=e[r]);return n};var $3=function(e,t){this[0]=e,this[1]=t};var lv=e=>{var t=e[Hg("asyncIterator")],n=!1,r,o={};return t==null?(t=e[Hg("iterator")](),r=i=>o[i]=s=>t[i](s)):(t=t.call(e),r=i=>o[i]=s=>{if(n){if(n=!1,i==="throw")throw s;return s}return n=!0,{done:!1,value:new $3(new Promise(c=>{var l=t[i](s);if(!(l instanceof Object))throw TypeError("Object expected");c(l)}),1)}}),o[Hg("iterator")]=()=>o,r("next"),"throw"in t?r("throw"):o.throw=i=>{throw i},"return"in t&&r("return"),o};import{K as Yn,$ as Mn,ax as Y3,ay as G3,F as u4,a2 as ba,az as Z3,aA as q3,v as zn,aB as Q3,aC as n1,r as g,aD as J3,aE as tl,aF as X3,R as Be,j as a,U as fr,c as ds,aG as K3,H as I,k as gr,C as P,I as e5,M as r1,n as fo,x as rh,aH as t5,aI as Lu,z as Vn,aJ as n5,i as o1,aK as r5,aL as o5,aM as i5,aN as s5,aO as a5,aP as c5,al as ql,aQ as l5,aR as d5,aS as u5,aT as h5,aU as f5,aV as g5,aW as p5,aX as m5,aY as y5,aZ as v5,a_ as w5,aj as b5,a$ as x5,y as fn,ah as I5,q as h4,T as f4,a as oa,m as ic,ai as S5,b0 as bl,a1 as oh,b1 as E5,p as ju,E as bo,b2 as M5,b3 as C5,b4 as T5,b5 as i1,b6 as s1,b7 as a1,b8 as g4,A as Nf,b9 as A5,ba as _5,bb as D5,bc as N5,bd as Jt,be as p4,bf as L5,bg as j5,bh as R5,bi as k5,bj as O5,bk as P5,h as c1,X as F5,bl as U5,bm as z5,W as l1,aw as B5,B as m4,bn as H5,bo as W5,bp as y4,bq as v4,br as w4,t as b4,J as I0}from"./main-vendor-W6FLmhIb.js";(function(){const t=document.createElement("link").relList;if(t&&t.supports&&t.supports("modulepreload"))return;for(const o of document.querySelectorAll('link[rel="modulepreload"]'))r(o);new MutationObserver(o=>{for(const i of o)if(i.type==="childList")for(const s of i.addedNodes)s.tagName==="LINK"&&s.rel==="modulepreload"&&r(s)}).observe(document,{childList:!0,subtree:!0});function n(o){const i={};return o.integrity&&(i.integrity=o.integrity),o.referrerPolicy&&(i.referrerPolicy=o.referrerPolicy),o.crossOrigin==="use-credentials"?i.credentials="include":o.crossOrigin==="anonymous"?i.credentials="omit":i.credentials="same-origin",i}function r(o){if(o.ep)return;o.ep=!0;const i=n(o);fetch(o.href,i)}})();const V5="modulepreload",$5=function(e,t){return e[0]==="."?new URL(e,t).href:e},dv={},Mt=function(t,n,r){let o=Promise.resolve();if(n&&n.length>0){const i=document.getElementsByTagName("link");o=Promise.all(n.map(s=>{if(s=$5(s,r),s in dv)return;dv[s]=!0;const c=s.endsWith(".css"),l=c?'[rel="stylesheet"]':"";if(!!r)for(let p=i.length-1;p>=0;p--){const u=i[p];if(u.href===s&&(!c\|\|u.rel==="stylesheet"))return}else if(document.querySelector(`link[href="${s}"]${l}`))return;const h=document.createElement("link");if(h.rel=c?"stylesheet":V5,c\|\|(h.as="script",h.crossOrigin=""),h.href=s,document.head.appendChild(h),c)return new Promise((p,u)=>{h.addEventListener("load",p),h.addEventListener("error",()=>u(new Error(`Unable to preload CSS for ${s}`)))})}))}return o.then(()=>t()).catch(i=>{const s=new Event("vite:preloadError",{cancelable:!0});if(s.payload=i,window.dispatchEvent(s),!s.defaultPrevented)throw i})};window.__sunMainJsIsNotEmpty__=!0;var sc;(function(e){e.GOOGLE_CALENDAR="googleCalendar",e.OFFICE="office"})(sc\|\|(sc={}));var AE,_E;const bd={googleCalendar:"https://calendar.google.com",office:typeof window!="undefined"&&(_E=(AE=window==null?void 0:window.__RUNTIME_ENV__)==null?void 0:AE.ZOOM_DOMAIN)!=null?_E:"https://zoom.us"},{from:S0}=typeof window!="unde
URL: https://st1.zoom.us/zoom-docs/release/web/lynx/edi... Model: Joe Sandbox AI	```json { "risk_score": 1, "reasoning": "The script primarily consists of module imports and variable declarations without any high-risk behaviors such as dynamic code execution, data exfiltration, or redirects. It appears to be part of a larger application, likely for UI components or state management, with no evident malicious intent." }
import{r as o,j as s,H as E,k as Ne,C as M,a as _e}from"./main-vendor-W6FLmhIb.js";import{cN as he,cE as Le,o as Re,Q as xe,T as G,z as Se,f as F,cO as ae,a6 as we,bm as le,cP as ke,cQ as Y,e as u,cH as ye,u as B,cR as ce,m as J,a as Oe,bp as Z,cS as Te,a$ as ee,b as W,cT as Ve,E as Fe,cU as Ee,R as He,W as Be,g as ze,C as X,aD as Ue,bt as Ke,bu as $e,P as Ge,cV as Ye,cW as Xe,aL as Qe,cX as Je,cY as Ze,cZ as et,c_ as l,cK as tt,c$ as rt,cc as it,bF as st,ax as nt,ai as ot,b4 as at,cd as lt,d0 as Pe,d1 as ct,bB as dt,d2 as O,bz as ut,bA as pt,d3 as mt,d4 as ft,bv as bt,M as gt,ao as vt,bG as ht,bq as D,d5 as xt,aQ as de,bC as St}from"./main-CWTidvqS.js";import{u as wt}from"./useShowProcessDialog-CJgg6rjO.js";import{b as yt}from"./RequestPermissionButton-Pm4bLW1S.js";import{F as Tt,b as ue,c as Ft}from"./useFilePlaceHolder-Ypoff9Ih.js";import{l as Et}from"./List-IA0QNOnX.js";import{UserHelp as Pt,UserFeedback as jt}from"./Onboarding-B7iD5iu6.js";import{F as $,M as je,a as pe,f as V,g as It}from"./NewUserToastOutMeeting-H_J4okIk.js";import"./UserGuide-DCc9lj22.js";import{u as Mt,a as Ct,b as Wt,F as Dt,W as At}from"./SidePanelHeader-Du1jSsBC.js";import{D as qt}from"./DocEditor-CyIse8OY.js";import{D as Nt}from"./Collaborators-BVmhz4Wz.js";import{u as _t,a as Lt,F as Rt}from"./useResizeSidebar-NMajDaa3.js";import"./index-l8vG4mWe.js";import"./getGroupByDate-10oxUQMG.js";import"./useHeaderTheme-CxrrUL6q.js";import"./viewers-CPI_UQ1O.js";import"./FailedLoadContent-CWRcEQzv.js";import"./fileDragDrop-BeOm1_j0.js";import"./WikiTreeItem-B6JPCzzM.js";import"./showTemplatesView-XRa0n3Sl.js";import"./index-Coo--B9w.js";import"./merge-CibCURTz.js";import"./index-B5P4G2gN.js";import"./usePageOptions-CH8EPZT2.js";import"./narrow-Cfpv1Hgm.js";import"./index-B4SxylNL.js";import"./panel-BgZHGKs6.js";import"./delay-K73c_sL5.js";import"./usePageSubscriber-CQqVas6f.js";let me=!1;const kt=e=>{const t=Mt(),n=he();o.useEffect(()=>{var c,p;const a=Le((c=n==null?void 0:n.linkUrl)!=null?c:""),i=(p=a==null?void 0:a.searchParams)==null?void 0:p.shareFrom;e&&!me&&![$.None,$.OffLine].includes(t)&&i==="existed"&&(n!=null&&n.isPresenter)&&(me=!0,t===$.Default&&e.requestPresenter())},[t,e,n])},Ot=3e3,Vt=E.div(["position:fixed;top:50%;left:50%;z-index:",";background-color:red;"],Se.toast),Ht=E.div(["--animation-appear-duration:","ms;position:absolute;"," gap:16px;width:140px;height:128px;color:var(--text-primary-reverse);font-weight:500;font-size:12px;line-height:18px;text-align:center;background:var(--color-utility-gray-alpha-900);border:1px solid var(--color-utility-gray-700);border-radius:6px;box-shadow:0px 1px 2px 0px var(--shadow-secondary),0px 4px 4px -4px var(--shadow-primary);transform:translate(-50%,-50%);&[data-state='open']{animation:"," var(--animation-appear-duration) "," both;}&[data-state='close']{animation:"," var(--animation-appear-duration) "," both;}[data-theme='dark'] &{color:var(--text-primary-reverse);background:var(--fg-primary);border:1px solid var(--border-primary-alpha);box-shadow:0px 2px 6px 0px var(--shadow-tertiary),0px 32px 41px -24px var(--shadow-tertiary);}"],je,F.column,ae.fadeInScaleInCentered,pe,ae.fadeInScaleInCenteredReverse,pe),Bt=E(we)(["width:34px !important;height:29px !important;margin-top:30px;margin-left:56px;"]),zt=({onClose:e})=>{const[t,n]=o.useState(!0),a=o.useRef(),i=o.useRef(performance.now());return o.useEffect(()=>{function c(){n(!1),e()}clearTimeout(a.current);const p=performance.now(),v=Ot-(p-i.current);a.current=setTimeout(c,v)},[e]),s.jsx(Re,{present:t,children:s.jsx(Vt,{children:s.jsxs(Ht,{"data-state":t?"open":"close",children:[s.jsx(Bt,{src:xe.unfollow}),s.jsx(G,{id:"HIlSsv"})]})})})};let H;const Ut=()=>{let e;const t=new Promise((c,p)=>{e={resolve:c,reject:p}});if(H)return;const n=ke("followTutorial"),a=Ne(n),i=c=>{setTimeout(function(){a.unmount(),n.remove(),e.resolve(c),H=void 0},je)};return a.render(s.jsx(zt,{onClose:i})),H={close:i,result:t},H};let fe=!1;const Kt=()=>{const e=le.get("shareMeeting")\|\|{};
URL: https://st1.zoom.us/zoom-docs/release/web/lynx/edi... Model: Joe Sandbox AI	```json { "risk_score": 1, "reasoning": "The script primarily involves object manipulation, state management, and UI interactions without any high-risk behaviors such as dynamic code execution or data exfiltration. It does not interact with external domains or use obfuscated code, indicating a low risk." }
var te=Object.defineProperty,oe=Object.defineProperties;var ne=Object.getOwnPropertyDescriptors;var k=Object.getOwnPropertySymbols;var re=Object.prototype.hasOwnProperty,ie=Object.prototype.propertyIsEnumerable;var z=(e,s,t)=>s in e?te(e,s,{enumerable:!0,configurable:!0,writable:!0,value:t}):e[s]=t,G=(e,s)=>{for(var t in s\|\|(s={}))re.call(s,t)&&z(e,t,s[t]);if(k)for(var t of k(s))ie.call(s,t)&&z(e,t,s[t]);return e},Q=(e,s)=>oe(e,ne(s));import{r as d,j as n,H as q}from"./main-vendor-W6FLmhIb.js";import{bq as R,Q as y,aO as ae,u as D,M as J,bG as B,e as le,b as W,ef as V,d5 as ce,aQ as P,aK as L,s as a,dc as Z,bv as v,bz as T,an as ue,eo as X,ep as b,br as M,ee as de,T as O,ai as me,c2 as Re,eq as pe,cn as ge,m as K,N as he,B as F,aD as Ee,er as xe,a6 as $,e4 as _e,e5 as fe,bF as Se}from"./main-CWTidvqS.js";const we=[R.editor,R.commenter,R.viewer,R.noAccess],Ae={"co-owner":y.roleEditor,editor:y.roleEditor,commenter:y.roleCommenter,viewer:y.roleViewer,noAccess:void 0},ve=3,j=200,qe="REASON_LIMIT_TOAST_ID",Te=ae("app:requestPermission");var Y;(function(e){e.idle="idle",e.declining="declining",e.approving="approving"})(Y\|\|(Y={}));var C;(function(e){e.idle="idle",e.requesting="requesting"})(C\|\|(C={}));const ee=e=>we.filter(s=>ce(P[s],P[e])>0),Pe=({id:e,defaultRole:s,onSuccess:t})=>{var i;const{requestPermission:r}=D(),o=J(e).node,f=(i=o==null?void 0:o.privilege.role.newRole)!=null?i:R.noAccess,u=ee(R[f]),h=d.useMemo(()=>s&&u.includes(s)?s:f===R.noAccess&&u.includes(R.commenter)?R.commenter:u[u.length-1],[f,u,s]),[E,w]=d.useState(""),[p,S]=d.useState(h),[A,g]=d.useState("idle"),l=m=>{S(m)},c=m=>{m.target.value.length>j?(L({id:qe,content:a._({id:"5Ad6IP",values:{REQUEST_REASON_MAX_LENGTH:j}})}),w(m.target.value.slice(0,j))):w(m.target.value)};return{availableRoles:u,reason:E,selectedRole:p,requestStatus:A,selectRole:l,sendRequest:B(async()=>{try{g("requesting"),await r.command.requestPermission({id:e,role:{newRole:P[p],role:P[p]},requestMessage:E}),t==null\|\|t()}catch(m){const _=Z(m);switch(_){case v.REASON_FILE_NOT_FOUND:case v.REASON_FILE_DELETED:throw new T({errmsg:a._({id:"H72HpF"}),cause:m,reason:_});case v.REASON_FREQUENCY_LIMIT_EXCEEDED:throw new T({errmsg:a._({id:"qCOEvp"}),cause:m,reason:_});case v.REASON_ADMIN_SETTING_FILE_EXTERNAL_SHARING_FORBIDDEN:throw new T({errmsg:a._({id:"t/wvlB"}),cause:m,reason:_});case v.REASON_ADMIN_SETTING_USER_ACCESS_EXTERNAL_FILE_FORBIDDEN:throw new T({errmsg:a._({id:"EG93Fa"}),cause:m,reason:_});default:throw m}}finally{g("idle")}},{toastProps:{position:le.flags.isEmbeddedPreview?"top":"bottom",content:null}}),input:{value:E,onChange:c}}},ze=e=>{var g,l,c;const{requestPermission:s}=D(),t=W(s,()=>s.query.getRequestList()),r=s.command.ignoreRequest,o=x=>{s.command.insertRequests(x.requests,x.paging)},f=(g=t.paging)==null?void 0:g.fetchedAll;d.useLayoutEffect(()=>{s.command.resetList()},[s.command]);const u=V(s.command.loadPermissionRequests,[{id:e,requestOptions:{loadMore:!1},callback:o}]),h=V(s.command.loadPermissionRequests,[{id:e,requestOptions:{loadMore:!0,fetchedAll:(l=t.paging)==null?void 0:l.fetchedAll,pagingToken:(c=t.paging)==null?void 0:c.nextToken},callback:o}],{loadOnMount:!1}),E=x=>[u.status,h.status].some(i=>i===x),w=E("loading"),p=E("success"),S=E("error"),A=d.useCallback(()=>{var x;f\|\|w\|\|S\|\|((x=t==null?void 0:t.requests.length)!=null?x:0)<=ve*2&&h.reload()},[f,S,w,h,t==null?void 0:t.requests.length]);return d.useEffect(()=>{p&&A()},[p,A]),{requests:t.requests,ignoreRequest:r}},Ge=(e,s)=>{const t=D(),{ui:r,requestPermission:o,files:f}=t,u=W(r,()=>r.query.isPermissionRequestTipVisible()),[h,E]=d.useState(e==null?void 0:e.role.newRole),[w,p]=d.useState("idle"),{me:S}=ue();d.useEffect(()=>{E(e.role.newRole)},[e]);const A=()=>{r.command.setPermissionRequestTipVisible(!1)},g=async i=>{const m=async()=>{const I=await f.command.loadCollaborators(e.id),N=I==null?void 0:I.collaborators.find(se=>{var U;return((U=se.user)==null?void 0:U.id)===e.requester.id});if(N!=null&&N.user)return a._({id:"DLBT
URL: https://st1.zoom.us/zoom-docs/release/web/lynx/edi... Model: Joe Sandbox AI	```json { "risk_score": 1, "reasoning": "The script primarily consists of utility functions and object manipulations, with no high-risk behaviors such as dynamic code execution, data exfiltration, or redirects. It appears to be a part of a larger library or framework, possibly related to module handling or React, given the presence of React-related symbols. There are no interactions with external domains or obfuscated code, indicating low risk." }
var p6=Object.defineProperty,v6=Object.defineProperties;var m6=Object.getOwnPropertyDescriptors;var Lf=Object.getOwnPropertySymbols;var iS=Object.prototype.hasOwnProperty,oS=Object.prototype.propertyIsEnumerable;var fs=(e,t)=>(t=Symbol[e])?t:Symbol.for("Symbol."+e);var Rm=(e,t,n)=>t in e?p6(e,t,{enumerable:!0,configurable:!0,writable:!0,value:n}):e[t]=n,re=(e,t)=>{for(var n in t\|\|(t={}))iS.call(t,n)&&Rm(e,n,t[n]);if(Lf)for(var n of Lf(t))oS.call(t,n)&&Rm(e,n,t[n]);return e},Ae=(e,t)=>v6(e,m6(t));var we=(e,t)=>{var n={};for(var r in e)iS.call(e,r)&&t.indexOf(r)<0&&(n[r]=e[r]);if(e!=null&&Lf)for(var r of Lf(e))t.indexOf(r)<0&&oS.call(e,r)&&(n[r]=e[r]);return n};var O=(e,t,n)=>(Rm(e,typeof t!="symbol"?t+"":t,n),n),aS=(e,t,n)=>{if(!t.has(e))throw TypeError("Cannot "+n)};var qr=(e,t,n)=>(aS(e,t,"read from private field"),n?n.call(e):t.get(e)),Ff=(e,t,n)=>{if(t.has(e))throw TypeError("Cannot add the same private member more than once");t instanceof WeakSet?t.add(e):t.set(e,n)},Ti=(e,t,n,r)=>(aS(e,t,"write to private field"),r?r.call(e,n):t.set(e,n),n);var Am=(e,t,n,r)=>({set _(i){Ti(e,t,i,n)},get _(){return qr(e,t,r)}});var Oi=function(e,t){this[0]=e,this[1]=t},jf=(e,t,n)=>{var r=(a,s,u,l)=>{try{var c=n[a](s),f=(s=c.value)instanceof Oi,d=c.done;Promise.resolve(f?s[0]:s).then(h=>f?r(a==="return"?a:"next",s[1]?{done:h.done,value:h.value}:h,u,l):u({value:h,done:d})).catch(h=>r("throw",h,u,l))}catch(h){l(h)}},i=a=>o[a]=s=>new Promise((u,l)=>r(a,s,u,l)),o={};return n=n.apply(e,t),o[fs("asyncIterator")]=()=>o,i("next"),i("throw"),i("return"),o},Nm=e=>{var t=e[fs("asyncIterator")],n=!1,r,i={};return t==null?(t=e[fs("iterator")](),r=o=>i[o]=a=>t[o](a)):(t=t.call(e),r=o=>i[o]=a=>{if(n){if(n=!1,o==="throw")throw a;return a}return n=!0,{done:!1,value:new Oi(new Promise(s=>{var u=t[o](a);if(!(u instanceof Object))throw TypeError("Object expected");s(u)}),1)}}),i[fs("iterator")]=()=>i,r("next"),"throw"in t?r("throw"):i.throw=o=>{throw o},"return"in t&&r("return"),i},sS=(e,t,n)=>(t=e[fs("asyncIterator")])?t.call(e):(e=e[fs("iterator")](),t={},n=(r,i)=>(i=e[r])&&(t[r]=o=>new Promise((a,s,u)=>(o=i.call(e,o),u=o.done,Promise.resolve(o.value).then(l=>a({value:l,done:u}),s)))),n("next"),n("return"),t);function g6(e,t){for(var n=0;n<t.length;n++){const r=t[n];if(typeof r!="string"&&!Array.isArray(r)){for(const i in r)if(i!=="default"&&!(i in e)){const o=Object.getOwnPropertyDescriptor(r,i);o&&Object.defineProperty(e,i,o.get?o:{enumerable:!0,get:()=>r[i]})}}}return Object.freeze(Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}))}var fu=typeof globalThis!="undefined"?globalThis:typeof window!="undefined"?window:typeof global!="undefined"?global:typeof self!="undefined"?self:{};function oo(e){return e&&e.__esModule&&Object.prototype.hasOwnProperty.call(e,"default")?e.default:e}function y6(e){if(e.__esModule)return e;var t=e.default;if(typeof t=="function"){var n=function r(){return this instanceof r?Reflect.construct(t,arguments,this.constructor):t.apply(this,arguments)};n.prototype=t.prototype}else n={};return Object.defineProperty(n,"__esModule",{value:!0}),Object.keys(e).forEach(function(r){var i=Object.getOwnPropertyDescriptor(e,r);Object.defineProperty(n,r,i.get?i:{enumerable:!0,get:function(){return e[r]}})}),n}var jR={exports:{}},$p={},VR={exports:{}},je={};/** * @license React * react.production.min.js * * Copyright (c) Facebook, Inc. and its affiliates. * * This source code is licensed under the MIT license found in the * LICENSE file in the root directory of this source tree. */var Yc=Symbol.for("react.element"),_6=Symbol.for("react.portal"),w6=Symbol.for("react.fragment"),b6=Symbol.for("react.strict_mode"),E6=Symbol.for("react.profiler"),S6=Symbol.for("react.provider"),T6=Symbol.for("react.context"),O6=Symbol.for("react.forward_ref"),I6=Symbol.for("react.suspense"),C6=Symbol.for("react.memo"),x6=Symbol.for("react.lazy"),lS=Symbol.iterator;function R6(e){return e===null\|\|typeof e!="object"?null:(e=lS&&e[lS]\|\|e["@@iterator"],typeof
URL: https://docs.zoom.us/doc/NGIyJXAkRDK0sAtAUh4DFw?from=email Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Ce fichier Business a t partag avec vous sur ZOOM Doc, Veuillez cliquer sur afficher le fichier ci-dessous pour votre approbation personnelle et reconnaissance", "prominent_button_name": "Voir Document", "text_input_field_labels": "unknown", "pdf_icon_visible": true, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://docs.zoom.us/doc/NGIyJXAkRDK0sAtAUh4DFw?from=email Model: Joe Sandbox AI	{ "brands": [ "Zoom" ] }
	{ "brands": [ "Zoom" ] }
URL: https://koi-armadillo-jnkc.squarespace.com/ Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "View Document", "prominent_button_name": "View Document", "text_input_field_labels": [ "Enter Password *" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://koi-armadillo-jnkc.squarespace.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": true, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": true }
URL: https://koi-armadillo-jnkc.squarespace.com
URL: https://koi-armadillo-jnkc.squarespace.com/ Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://koi-armadillo-jnkc.squarespace.com/ Model: Joe Sandbox AI	```json{ "legit_domain": "microsoft.com", "classification": "wellknown", "reasons": [ "The brand 'Microsoft' is a well-known brand with a legitimate domain of 'microsoft.com'.", "The URL 'koi-armadillo-jnkc.squarespace.com' does not match the legitimate domain of Microsoft.", "The URL is hosted on 'squarespace.com', which is a website building platform and not directly associated with Microsoft.", "The presence of a password input field on a non-Microsoft domain is suspicious and indicative of a phishing attempt.", "The use of a subdomain and unrelated words like 'koi-armadillo-jnkc' increases the suspicion of phishing." ], "riskscore": 9} Google indexed: False
URL: koi-armadillo-jnkc.squarespace.com Brands: Microsoft Input Fields: Enter Password *
URL: https://koi-armadillo-jnkc.squarespace.com/ Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Sign in to continue to Outlook", "prominent_button_name": "Submitting...", "text_input_field_labels": [ "Enter Password *" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://koi-armadillo-jnkc.squarespace.com/ Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://zoom.us Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://zoom.us

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Jan 11 17:32:11 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9843749936945594
Encrypted:	false
SSDEEP:
MD5:	C9521DAFB4F96B1D3C1D3F195F7C1BAE
SHA1:	6DECF781E853D5F36AD560F7D5DE61376A0C3173
SHA-256:	01F95E8D4BDF25086979A5D5C5B016CEBFB6F7AEA987B531E1ED2931C386FDBD
SHA-512:	F62F34F9E62C2B66C9D74B3757B6EC68BEE96C959357171626E25F41D1C7FB211F8AEBA5469589AB7A841181D8497F084CBFDC2E94EF269364408ABE19B21AC2
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....F.. Wd..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I+Z......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V+Z......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V+Z......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V+Z............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V+Z.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............toj.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://docs.zoom.us/doc/NGIyJXAkRDK0sAtAUh4DFw?from=email

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 216

Chrome Cache Entry: 217

Chrome Cache Entry: 219

Chrome Cache Entry: 221

Chrome Cache Entry: 223

Chrome Cache Entry: 224

Chrome Cache Entry: 227

Chrome Cache Entry: 228

Chrome Cache Entry: 229

Chrome Cache Entry: 231

Chrome Cache Entry: 234

Chrome Cache Entry: 235

Chrome Cache Entry: 236

Chrome Cache Entry: 237

Chrome Cache Entry: 239

Chrome Cache Entry: 240

Chrome Cache Entry: 241

Chrome Cache Entry: 242

Chrome Cache Entry: 245

Chrome Cache Entry: 246

Chrome Cache Entry: 247

Chrome Cache Entry: 248

Chrome Cache Entry: 249

Chrome Cache Entry: 256

Chrome Cache Entry: 257

Chrome Cache Entry: 258

Chrome Cache Entry: 259

Chrome Cache Entry: 261

Chrome Cache Entry: 263

Chrome Cache Entry: 267

Chrome Cache Entry: 268

Chrome Cache Entry: 269

Windows Analysis Report
https://docs.zoom.us/doc/NGIyJXAkRDK0sAtAUh4DFw?from=email