Edit tour

Windows Analysis Report
http://www.hvacplus.com

Overview

General Information

Sample URL:	http://www.hvacplus.com
Analysis ID:	1501358

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Detected non-DNS traffic on DNS port

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6876 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://www.hvacplus.com/ MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 7064 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=1788,i,12420617036597701248,9094236409604254493,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

cleanup

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: https://www.hvacplus.com/	HTTP Parser: No favicon
Source: https://www.hvacplus.com/	HTTP Parser: No favicon
Source: https://www.hvacplus.com/	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.17:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:51188 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:51190 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.124.78.146:443 -> 192.168.2.17:51191 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.73:443 -> 192.168.2.17:51192 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.73:443 -> 192.168.2.17:51197 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.124.78.146:443 -> 192.168.2.17:51198 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.124.78.146:443 -> 192.168.2.17:51199 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.124.78.146:443 -> 192.168.2.17:51201 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.124.78.146:443 -> 192.168.2.17:51202 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:51204 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.209.173:443 -> 192.168.2.17:51205 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.17:51206 version: TLS 1.2

Source: global traffic	TCP traffic: 192.168.2.17:51187 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:51187 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:51187 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:51187 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:51187 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:51187 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:51187 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:51187 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:51187 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:51187 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:51187 -> 1.1.1.1:53

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27

Source: global traffic	DNS traffic detected: DNS query: www.hvacplus.com
Source: global traffic	DNS traffic detected: DNS query: hits-cache.com
Source: global traffic	DNS traffic detected: DNS query: app.purechat.com
Source: global traffic	DNS traffic detected: DNS query: a.mouseflow.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: server.iad.liveperson.net
Source: global traffic	DNS traffic detected: DNS query: widgetapi.purechat.com

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51199 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51194 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51204 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 51192 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51208 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 51202 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51198 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 51188 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 51203 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51193 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 51201 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51196 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 51191 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51206 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49690
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51208
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51205
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51206
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51200
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51203
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51204
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51201
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51202
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 51197 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51205 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51188
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51191
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51192
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51190
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51195
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51196
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51193
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51194
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51199
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51197
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51195 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51198
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51190 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49690 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51200 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443

Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.17:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:51188 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:51190 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.124.78.146:443 -> 192.168.2.17:51191 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.73:443 -> 192.168.2.17:51192 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.73:443 -> 192.168.2.17:51197 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.124.78.146:443 -> 192.168.2.17:51198 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.124.78.146:443 -> 192.168.2.17:51199 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.124.78.146:443 -> 192.168.2.17:51201 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.124.78.146:443 -> 192.168.2.17:51202 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:51204 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.209.173:443 -> 192.168.2.17:51205 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.17:51206 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@20/53@26/201

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://www.hvacplus.com/
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=1788,i,12420617036597701248,9094236409604254493,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=1788,i,12420617036597701248,9094236409604254493,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
http://www.hvacplus.com	0%	Avira URL Cloud	safe

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
app.purechat.com	13.32.121.25	true	false	unknown
server.iad.liveperson.net	162.252.72.215	true	false	unknown
www.google.com	142.250.186.68	true	false	unknown
hvacplus.com	209.87.159.219	true	false	unknown
api-prod.eba-bnrzyg4w.us-east-2.elasticbeanstalk.com	3.140.97.7	true	false	unknown
www.hvacplus.com	unknown	unknown	false	unknown
hits-cache.com	unknown	unknown	false	unknown
widgetapi.purechat.com	unknown	unknown	false	unknown
a.mouseflow.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.hvacplus.com/	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.68	www.google.com	United States	15169	GOOGLEUS	false
142.250.186.78	unknown	United States	15169	GOOGLEUS	false
172.217.16.136	unknown	United States	15169	GOOGLEUS	false
34.104.35.123	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
142.250.186.163	unknown	United States	15169	GOOGLEUS	false
3.15.255.72	unknown	United States	16509	AMAZON-02US	false
216.58.206.42	unknown	United States	15169	GOOGLEUS	false
162.252.72.215	server.iad.liveperson.net	United States	11054	LIVEPERSONUS	false
142.251.173.84	unknown	United States	15169	GOOGLEUS	false
216.58.206.46	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
3.140.97.7	api-prod.eba-bnrzyg4w.us-east-2.elasticbeanstalk.com	United States	16509	AMAZON-02US	false
13.32.121.25	app.purechat.com	United States	16509	AMAZON-02US	false
142.250.184.227	unknown	United States	15169	GOOGLEUS	false
209.87.159.219	hvacplus.com	United States	36444	NEXCESS-NETUS	false
142.250.186.42	unknown	United States	15169	GOOGLEUS	false
142.250.186.136	unknown	United States	15169	GOOGLEUS	false
142.250.186.99	unknown	United States	15169	GOOGLEUS	false
65.9.86.59	unknown	United States	16509	AMAZON-02US	false

Private

IP
192.168.2.17

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1501358
Start date and time:	2024-08-29 19:26:20 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	http://www.hvacplus.com
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean1.win@20/53@26/201

Warnings

Exclude process from analysis (whitelisted): SIHClient.exe
Excluded IPs from analysis (whitelisted): 142.250.186.99, 216.58.206.46, 142.251.173.84, 34.104.35.123, 142.250.186.42, 142.250.184.227, 142.250.186.136, 216.58.206.42, 142.250.186.170, 142.250.181.234, 142.250.185.170, 142.250.186.74, 142.250.185.106, 142.250.185.138, 142.250.185.234, 142.250.185.202, 142.250.186.106, 142.250.186.138, 142.250.184.202, 172.217.23.106, 216.58.212.138, 142.250.185.74, 142.250.184.234, 172.217.16.136
Excluded domains from analysis (whitelisted): ssl.google-analytics.com, fonts.googleapis.com, clients2.google.com, accounts.google.com, edgedl.me.gvt1.com, content-autofill.googleapis.com, fonts.gstatic.com, clientservices.googleapis.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: http://www.hvacplus.com

LLM Input / Output

Input	Output
URL: https://www.hvacplus.com/ Model: jbxai	{ "brand":["HVAC PLUS"], "contains_trigger_text":false, "prominent_button_name":"unknown", "text_input_field_labels":["unknown"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

Input

Output

URL: https://www.hvacplus.com/ Model: jbxai

{
"brand":["HVAC PLUS"],
"contains_trigger_text":false,
"prominent_button_name":"unknown",
"text_input_field_labels":["unknown"],
"pdf_icon_visible":false,
"has_visible_captcha":false,
"has_urgent_text":false,
"has_visible_qrcode":false}

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Aug 29 16:26:51 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.993964180287572
Encrypted:	false
SSDEEP:
MD5:	6B82F4260AF8E94C3FB3653C30B4FFDC
SHA1:	0671B2EFBE9F7439AD8A11925ED5BF1ED4EE67DE
SHA-256:	49722DC604680F9AA80939AF66A04B46034AC50EE1DFB80A1E0D0D2BD8C01FEE
SHA-512:	096817B18912ED0072F75F7CE2C561EAFC5A38496AA9C5BB9CB595F65D8E159072696DB8F33E61C520277EB9BA3643A9BFD642A812DC7682B8CB62368698AC85
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....T~\|.8.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.YQ.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.YY.....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.YY.....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.YY............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.YZ............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........7A?Y.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Aug 29 16:26:51 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.007483973600642
Encrypted:	false
SSDEEP:
MD5:	7D2A1D9B26D0ED336C6AD7BA746162BE
SHA1:	76779ADA50F1922960B0447A475B6BDB4F58EBFF
SHA-256:	7F61D2A7323C5E66CFF0A086E4E3587D741F459F1EAEE2FF69765BE35C1D934A
SHA-512:	BB8757AD23611B0F98DE3CE3FF5196548F17D8167A33615F4164B34BDED99C994A6A507CD6C342FF716EB6A112D635242D8ED3BE2806DCBBD2A061B9A065824A
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....t.p.8.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.YQ.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.YY.....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.YY.....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.YY............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.YZ............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........7A?Y.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:54:41 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.0171363292685145
Encrypted:	false
SSDEEP:
MD5:	30C60FDBC93E06797BFF073F231B52FE
SHA1:	EFB64C27B8ED2D44E8F2911549BC6402D147392D
SHA-256:	EF70705BCFC346E2C485C12949DADA775A33635AF89CB1DC662C05C9DCDF3071
SHA-512:	5E9D99287018250ACB910E0B2E7BE00099A6BBD43653B24900DCAD55D99AD7E7C996A9960565433170177AEBF0E853292C8B48B932B692D7C3E0920B068FF3B6
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....v. ;.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.YQ.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.YY.....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.YY.....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.YY............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VFW.N...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........7A?Y.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Aug 29 16:26:51 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	4.008334119758939
Encrypted:	false
SSDEEP:
MD5:	23B4D0818652BA61B3AEF239551F50E8
SHA1:	E19D261BDA636D171564D7F9EC2EFDBA0C22CFA4
SHA-256:	BD87CEBBB9B687B93ECB1512060276A65D7BF7FE85254B06CE9A9F5E38CFFDFB
SHA-512:	B3B7729DB5B8990504E56DD1EA8DEC49052BA6C0D3B0CB4159A4F6CFC727315D6D37E7EF430DE0080474FAC4AE72F368335AD0D30BFE99447F18B7EEA8240750
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......j.8.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.YQ.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.YY.....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.YY.....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.YY............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.YZ............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........7A?Y.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Aug 29 16:26:51 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.996707446077396
Encrypted:	false
SSDEEP:
MD5:	DD44BC9BBE0E2802BBFADC6B5807DB72
SHA1:	CC26060AA73ADD2DE58FDDE60A9B4F32CA989FD8
SHA-256:	95CFD80753F48032DB784C240AED7E4297EC53875B4537C12E68AC357DF40FC9
SHA-512:	8A1AA96BD02BA9015E51CAEBC2D500CD9827BD900D6283F110877646ED65471940B686AA255E7A05D7F1E4F844ADFEEAB6E54B593EDD09C69E60B7D39D9E515D
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......v.8.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.YQ.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.YY.....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.YY.....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.YY............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.YZ............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........7A?Y.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Aug 29 16:26:51 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	4.007144828356892
Encrypted:	false
SSDEEP:
MD5:	2DABAA2AE1F08B206823092B19E4DB19
SHA1:	3DEDD4C40E66D36F75C8F0FBC1FCCCB12BF7D484
SHA-256:	BE1BEF4F79F3ABEA418179033D4F17B8046C2B305FE18268F968D1E64A7C8B24
SHA-512:	B5F717D9C53009D9F8D49AF28AEE2342219DBF9FFB19EBCB5C82C903A69AD30F2CE750F323CC92D856BB14DFCCD39AA90813CA612B67E52BE90EF2C944F40381
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......^.8.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.YQ.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.YY.....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.YY.....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.YY............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.YZ............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........7A?Y.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 193

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	163313
Entropy (8bit):	4.930081767182207
Encrypted:	false
SSDEEP:
MD5:	3B4B13DAD33B475E11FEB26FD3468ECC
SHA1:	3D542E33A9F3EB3CB45E06FE93D08DD4B7490496
SHA-256:	DEDEA3AA22A087B3745C9635E7A3D65E772D57CE590B541A6A32069A0B1D60B9
SHA-512:	5D48F1CA62332A5E9FDB08352E778C4DDE3CACEF1AAB159085BC6EADCE55A0E7778E626DF0C9D96473355E325C12E9819E82D28F75906BEF597611B3C388BB05
Malicious:	false
Reputation:	unknown
Preview:	/* Prototype JavaScript framework, version 1.7. * (c) 2005-2010 Sam Stephenson. . Prototype is freely distributable under the terms of an MIT-style license.. * For details, see the Prototype web site: http://www.prototypejs.org/. . --------------------------------------------------------------------------/..var Prototype = {.. Version: '1.7',.. Browser: (function(){. var ua = navigator.userAgent;. var isOpera = Object.prototype.toString.call(window.opera) == '[object Opera]';. return {. IE: !!window.attachEvent && !isOpera,. Opera: isOpera,. WebKit: ua.indexOf('AppleWebKit/') > -1,. Gecko: ua.indexOf('Gecko') > -1 && ua.indexOf('KHTML') === -1,. MobileSafari: /Apple.Mobile/.test(ua). }. })(),.. BrowserFeatures: {. XPath: !!document.evaluate,.. SelectorsAPI: !!document.querySelector,.. ElementExtensions: (function() {. var constructor = window.Element \|\| window.HTMLElement;. re

Chrome Cache Entry: 199

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	14189
Entropy (8bit):	4.348919712797976
Encrypted:	false
SSDEEP:
MD5:	C16ED6F82B78D8F3BC07DE6F5EBD8EB6
SHA1:	9E50D8FE0FEB418A67F036E6B9C5F63582CF2A20
SHA-256:	CC25A6F31727452533E6170A15BFC3010D54B1CC4661836905F226F0BD41F1C0
SHA-512:	4A5C1B4D7578CC55B888021C3F5B3874DF8C4E99B35D02D3CDE8509110FADD9398EC76A13EFF9847A571F2245044572B06F4DB4C06B1F1609E705FD954AE54F1
Malicious:	false
Reputation:	unknown
Preview:	/*. Magento. . NOTICE OF LICENSE. . This source file is subject to the Academic Free License (AFL 3.0). * that is bundled with this package in the file LICENSE_AFL.txt.. * It is also available through the world-wide-web at this URL:. * http://opensource.org/licenses/afl-3.0.php. * If you did not receive a copy of the license and are unable to. * obtain it through the world-wide-web, please send an email. * to license@magentocommerce.com so we can send you a copy immediately.. . DISCLAIMER. . Do not edit or add to this file if you wish to upgrade Magento to newer. * versions in the future. If you wish to customize Magento for your. * needs please refer to http://www.magentocommerce.com for more information.. . @category Varien. * @package js. * @copyright Copyright (c) 2012 Magento Inc. (http://www.magentocommerce.com). * @license http://opensource.org/licenses/afl-3.0.php Academic Free License (AFL 3.0). */.VarienForm = Class.create();.VarienForm.prototy

Chrome Cache Entry: 202

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 73 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	6666
Entropy (8bit):	7.90632114382104
Encrypted:	false
SSDEEP:
MD5:	1395EC3BE5A9C84CDB9FAB8E43B8C0E2
SHA1:	97CB41079E1FAE1CD2EAA557E00A902E142A8102
SHA-256:	4A21CE2915E3C31FD07B52D5CF269D850D694DEC353465954C8E475DAF6B9525
SHA-512:	4B0B5CBF425A1B63BA1F3F4FB8D8148983C6D1D81BCC9E29B5EF732D641B28A891AC9A21D60BE344F46D1205957B5BDD1986176BD6FA68D02875B64F1846D4BD
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...I...0.....]^W.....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.155772, 2014/01/13-19:44:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2014 (Windows)" xmpMM:InstanceID="xmp.iid:5F0AB643E5EE11E58D809EB43DDCC038" xmpMM:DocumentID="xmp.did:5F0AB644E5EE11E58D809EB43DDCC038"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5F0AB641E5EE11E58D809EB43DDCC038" stRef:documentID="xmp.did:5F0AB642E5EE11E58D809EB43DDCC038"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.Y....zIDATx..[y.T........}..nv.. .U.....$$./..\|A."&..,&qIbf.Ib2...q..70D.(....7...[..]..z.{_54..4..M.=.^.{..

Chrome Cache Entry: 204

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 343x35, components 3
Category:	dropped
Size (bytes):	10421
Entropy (8bit):	7.947620548164858
Encrypted:	false
SSDEEP:
MD5:	40500026F1BF9E47D09F6F813E7BA011
SHA1:	6AF90B7EB716BAF01FBD8D08B5BE5DB933166A11
SHA-256:	F35ABC6924291B0686A2A36180AF050D9A79BB3AAA3DA0C3227C58711518BA4A
SHA-512:	BDD0AA415970DF88DF6962820346193B52E27F9407AC7B621CF098FA318629AD42BAE42293D478CDEE99394CB0EE7F3D500F7438E1B61B6DF8FD08670A3DC153
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....d.d......Ducky.......P......Adobe.d.................................................................................................................................................#.W..............................................................................................!.1.A".#c..Qq.a...2B.R34D...rSs$.VW.b....T.&6.........................!.1AQa..."R.q......2B.S..br..c%...#C..3s$45............?..wr...{TkZ..tek...m[O8[..3g...>..A...z.6.}0.mg.E%.G.r.....:.H..U!R..[q..<.....4..;.?.,......,.uL.[S..D.m.K8..!. .,~8$$r.).;..U9$.RuZo..LY.].Z.&...q.......+.R.K.....h..z..]..}e.0#.v...jH..PY..-.^...q....w.9d.9.K......YZ.....D.....I..u..>.G...#.e......{.....S..... .U~$n...e..L.1.4r4=.e.m..G/.....o).Y!B.'.H.{`\we...;+J.w.f.J....~.k.r..$s..).#a.o.;.\.#.cEAi\V........m..V..H..c..5.\|L#..j.%.@..H.....)c`................cv.T.E.....>..........\|..%W.G..{]S+}6&3-6BV.............U...67k..C,..n.vB~.......>.....;S..R..'...4S.:-.W.>;...m.....=.u..6\..

Chrome Cache Entry: 209

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	747
Entropy (8bit):	4.756332367779961
Encrypted:	false
SSDEEP:
MD5:	D3E849BE0977D53DE4AF933B40293FF6
SHA1:	F6D83810DA46CE18315E04B19C8011BAB2D9620E
SHA-256:	71EFC700B9091F1449E2C952536CF7281ADED3A30A96E44BE5D06E606E2904BD
SHA-512:	2019DC8E9E2462514A2A3C5E8D4181C03A7D89B1846624844A78367C59CD9A35573F8FCCA22A734FD635736295F90A9241B2D2665F06F880BF0E7D15001D6A2B
Malicious:	false
Reputation:	unknown
URL:	https://www.hvacplus.com/js/lib/ccard.js
Preview:	// Credit Card Validation Javascript.// copyright 12th May 2003, by Stephen Chapman, Felgall Pty Ltd..// You have permission to copy and use this javascript provided that.// the content of the script is not changed in any way...function validateCreditCard(s) {. // remove non-numerics. var v = "0123456789";. var w = "";. for (i=0; i < s.length; i++) {. x = s.charAt(i);. if (v.indexOf(x,0) != -1). w += x;. }. // validate number. j = w.length / 2;. k = Math.floor(j);. m = Math.ceil(j) - k;. c = 0;. for (i=0; i<k; i++) {. a = w.charAt(i2+m) 2;. c += a > 9 ? Math.floor(a/10 + a%10) : a;. }. for (i=0; i<k+m; i++) c += w.charAt(i2+1-m) 1;. return (c%10 == 0);.}..

Chrome Cache Entry: 210

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1476
Entropy (8bit):	4.952950895589963
Encrypted:	false
SSDEEP:
MD5:	0371B5A2D50E985B09B7D337EDC0DC9F
SHA1:	07AD383DE4CD0E21C289E3C6695B4822D1A7AD1D
SHA-256:	4DC77EE90DC2225B57B31D28FE06213CD6C491BDC7249A6E70EBD003B72C5702
SHA-512:	45685C0B5F5DF00DEF13B9295EAE997B819C3DF19EDC3416B9E9E15C06DC1A264E6AA1A88CBB56C22B7579E33D8CB18716FF219F0A57DDB9492868D3B1FD87C5
Malicious:	false
Reputation:	unknown
URL:	https://www.hvacplus.com/skin/frontend/seoinc/hvac/css/owl-carousel/owl.carousel.css
Preview:	/* . * .Core Owl Carousel CSS File. .v1.3.3. /../* clearfix /..owl-carousel .owl-wrapper:after {..content: ".";..display: block;..clear: both;..visibility: hidden;..line-height: 0;..height: 0;.}./ display none until init */..owl-carousel{..display: none;..position: relative;..width: 100%;..-ms-touch-action: pan-y;.}..owl-carousel .owl-wrapper{..display: none;..position: relative;..-webkit-transform: translate3d(0px, 0px, 0px);.}..owl-carousel .owl-wrapper-outer{..overflow: hidden;..position: relative;..width: 100%;.}..owl-carousel .owl-wrapper-outer.autoHeight{..-webkit-transition: height 500ms ease-in-out;..-moz-transition: height 500ms ease-in-out;..-ms-transition: height 500ms ease-in-out;..-o-transition: height 500ms ease-in-out;..transition: height 500ms ease-in-out;.}....owl-carousel .owl-item{..float: left;.}..owl-controls .owl-page,..owl-controls .owl-buttons div{..cursor: pointer;.}..owl-controls {..-webkit-user-select: none;..-khtml-user-select: none;..-moz-user-select: n

Chrome Cache Entry: 211

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	149
Entropy (8bit):	4.9705381723670605
Encrypted:	false
SSDEEP:
MD5:	DB7FD83A26B7622AC99AFD28D72570AA
SHA1:	BF62DDEA48FFE5F88129CD3CE822A59970AFE117
SHA-256:	F5AEF01FBC0F4C3DDDB3D6F52D0F7673D1A64B50BB0761B80A628899AE212FF1
SHA-512:	4E388A20DE79C5298B7A612C6E84F240F8DCE6D49819675BD8FC4FA77CFF1C3882D4EB1A41AAA81A4426D448D8C21E6E054B777C62C08F4CDABF86A53909EFBD
Malicious:	false
Reputation:	unknown
Preview:	lpConnLib.Process({"ResultSet":{"lpCallId":"722655180072-321998213271","lpCallError":"BUSY","lpErrorDetail":"Wrong credentials","lpErrorCode":"26"}})

Chrome Cache Entry: 212

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 73 x 48, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	3848
Entropy (8bit):	7.793473345202653
Encrypted:	false
SSDEEP:
MD5:	FC5BF61BF1513511EC3866FA572EF06D
SHA1:	838A5391605F874EBB5E19072A2B46105CE92179
SHA-256:	E57E62C5761981D416F9A4872E8B6388C1911BE3B0ECF5ED3D626927FD73A41E
SHA-512:	D7AA7AACBEBB3CD6CA3E3F1D310157C1FDB3398413B6A77BD364072CDC3E168709E5C8ACCF67A32A9780AE80A50BF181D2BEC93D65B136979BD56E3DCB5DB3E7
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...I...0......<......tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.155772, 2014/01/13-19:44:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2014 (Windows)" xmpMM:InstanceID="xmp.iid:44A63104E5EE11E5AD81ED587EA41B5D" xmpMM:DocumentID="xmp.did:44A63105E5EE11E5AD81ED587EA41B5D"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:44A63102E5EE11E5AD81ED587EA41B5D" stRef:documentID="xmp.did:44A63103E5EE11E5AD81ED587EA41B5D"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...B...xIDATx..Yip[...o..-......8.gB.!..PZ.4.(.v....L~t.-.:..?....J.)..[B.CH2).I......e.l.>.m=.=IV.d.N..j4

Chrome Cache Entry: 213

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 214x167, components 3
Category:	dropped
Size (bytes):	28788
Entropy (8bit):	7.97420661954564
Encrypted:	false
SSDEEP:
MD5:	42861B52EB125CC4EF1DC09A4600D244
SHA1:	108FB1753E4D3543836BACDDE8EDF870D7017C60
SHA-256:	99A830C1CEB54F5988C137EE498FB9900BF2502424D3C7059DC1F456D962E546
SHA-512:	5857A2C11B48F8B14153060CD80634B39BC8945FCA193ABC1C2D5255BB8403097B269E713FEA8511BC098F29AAE86D1361D3860E21FF0CBABDC4FD1F3311C8E8
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....d.d......Ducky.......d......Adobe.d.......................................................................................................................................................................................................................................................!..1...W.AQa"#.....2.6vw.q.BSs%.7..Rb345&V.r.Cg.8.....$DFf(...........................!1..Q..UAa..."2.t...q...r.#3..T....R..s$4d%567...Bb.&V...CS..u..'............?..m.k5...L.h....#.##!#.4I..J\..(...vEg.H.a..%..JR..........H....)O.H}...y..%....1.........y.f^B.."...;...0.qGJ...Q...e...=..........ooS..o...U.t.+.S....qW.-? ...>1.5~.:....Xz.e...=......i..7...q..9.\|.'..../.....U.g..O.)..O.C._....<V...}.d.F..=0Z~AM..\|b.j..u_.I..>..k z7.~.....ooS...W.s..:O...._kY.....L...S{z.....s.W..x.=O..Z...._.z`........8.......a.}...@.n.3........!...U.t.+.S....qW.-? ...>1.5~.:....Xz.e...=......i..7...q..9.\|.'..../.....U.g..O.)..O.C._....<V...}.d.F..=0Z~AM..\|b.j..u_.I..>..k z7.~..

Chrome Cache Entry: 214

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	30
Entropy (8bit):	4.481727678869736
Encrypted:	false
SSDEEP:
MD5:	AA385DB0EDC8478D5F7C7AE23E4B42F5
SHA1:	F6D2E6601482C47E4A1A832E289C1F2A1F53CBF3
SHA-256:	CD58ADC4794B80A276F5EBBFA5A2033A8C456FD1F3FC391A072CF3327919F0A0
SHA-512:	DA91207C3BA857B19CEDC6D11DA298B32AD2859DD438A18080F7E51FE4730643B14DF613ABDA92B515B9F0563DE4318012A871444C5F4B077827D3AFF5B80B93
Malicious:	false
Reputation:	unknown
URL:	https://www.hvacplus.com/js/noconflict1.js
Preview:	var $j = jQuery.noConflict();.

Chrome Cache Entry: 215

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	149
Entropy (8bit):	5.0117576988776396
Encrypted:	false
SSDEEP:
MD5:	FE974175C1269E8A77C23DAD5FEE8267
SHA1:	8311D07649E8376BDF9829E274D0ADEAA8C93285
SHA-256:	1C61EA6E6F24CB0C625638F6237ADC8C1AF02B969830B833A33A7B7DF9925435
SHA-512:	7B0561C9D08765612175870E156FF8107701B612606F0187D16DE0DF8586512A4E4E2DE7BBD572FD308BECF0CDB602DFFBBD1E2AC9E566306619B963FC477BA1
Malicious:	false
Reputation:	unknown
Preview:	lpConnLib.Process({"ResultSet":{"lpCallId":"740373413589-576897082982","lpCallError":"BUSY","lpErrorDetail":"Wrong credentials","lpErrorCode":"26"}})

Chrome Cache Entry: 216

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text
Category:	downloaded
Size (bytes):	57839
Entropy (8bit):	4.968078186991384
Encrypted:	false
SSDEEP:
MD5:	A4679428221DFAD03E7BAF255283A049
SHA1:	772B8AF341CE7400416E3807423D180479AEF382
SHA-256:	77C72487B165C1B634B0C60B8973983EA2CCF6724B2D383089BBD01922F36114
SHA-512:	7861459C320588720AB62CAF4F61FBE5BC1052F9B15028CC38877807A0F90EA0ECE3E9A620644557A9E638FF5AD0A2344D769D917062C993626CD012DDD02949
Malicious:	false
Reputation:	unknown
URL:	https://www.hvacplus.com/skin/frontend/seoinc/hvac/css/stylesheet.css
Preview:	@charset "utf-8";./* CSS Document */.@import url(https://fonts.googleapis.com/css?family=Open+Sans:400,300,600,700);.img {..width: auto;..max-width: 100%;.}..top_bar {..background: #eeeeee;..min-height: 40px;.}..left_menu {..float: left;..margin: 0px !important;..padding: 0px;.}..left_menu li a {..color: #666668;..font-family: inherit;..font-size: 14px;..color: #666668;.}..list-inline.left_menu > li {..padding: 10px 8px;.}..left_menu li:last-child {..border-left: 1px solid #cecece;..border-right: 1px solid #cecece;.}..left_menu li:first-child {..border-left: 1px solid #cecece;.}..left_menu li:last-child .fa.fa-mobile {..background: #e24a49 none repeat scroll 0 0;..border-radius: 100%;..color: #fff;..height: 20px;..line-height: 21px;..text-align: center;..margin-left: 2px;..width: 20px;.}..right_menu {..float: right;..margin: 0px !important;..padding: 0px;..display: flex;.}..right_menu > li {..border-left: 1px solid #cecece;..padding: 10px 0px !important;.}..right_menu li:last-child {..

Chrome Cache Entry: 217

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	149
Entropy (8bit):	4.973158034954733
Encrypted:	false
SSDEEP:
MD5:	67A67353C8B5EB4F1C797F806DF4E496
SHA1:	31ACC1726D6C4A0DFA11B9A1C2BEA790E9BC061B
SHA-256:	115C7BA3E4E952B3625903E2814438928E02092D5C211CE23CBBD9EF15D9BA61
SHA-512:	0AC7124F5A43369324D03CE76D0D7DF66976708A50AAE31C761EE08FD8BFC5F196E9AA74B2ED35004597D296D54F84E686E86399410210E0DE84A4E5BE64BC50
Malicious:	false
Reputation:	unknown
Preview:	lpConnLib.Process({"ResultSet":{"lpCallId":"615606946876-137678850727","lpCallError":"BUSY","lpErrorDetail":"Wrong credentials","lpErrorCode":"26"}})

Chrome Cache Entry: 218

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (540)
Category:	downloaded
Size (bytes):	146054
Entropy (8bit):	5.019637412269734
Encrypted:	false
SSDEEP:
MD5:	071E62CE5DD692147A8C1911143780BF
SHA1:	EF2A8DF6E2079CB152634B51E6B97BF5D8823AB6
SHA-256:	883301D7C63848F2E028162692201987530E219598357E475826A847722AF58E
SHA-512:	E5BB6D1BAF8B3B017F26F1E3604269301F10F0F8236B460C2D479F5A4AC3C28C390EDFD3DC87DF70B186688C0AD6BB42704BEB4E2ADEB6D503BDA0098AD59A43
Malicious:	false
Reputation:	unknown
URL:	https://www.hvacplus.com/skin/frontend/seoinc/hvac/css/bootstrap.css
Preview:	/!. Bootstrap v3.3.6 (http://getbootstrap.com). * Copyright 2011-2015 Twitter, Inc.. * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE). /./! normalize.css v3.0.3 \| MIT License \| github.com/necolas/normalize.css */.html {. font-family: sans-serif;. -webkit-text-size-adjust: 100%;. -ms-text-size-adjust: 100%;.}.body {. margin: 0;.}.article,.aside,.details,.figcaption,.figure,.footer,.header,.hgroup,.main,.menu,.nav,.section,.summary {. display: block;.}.audio,.canvas,.progress,.video {. display: inline-block;. vertical-align: baseline;.}.audio:not([controls]) {. display: none;. height: 0;.}.[hidden],.template {. display: none;.}.a {. background-color: transparent;.}.a:active,.a:hover {. outline: 0;.}.abbr[title] {. border-bottom: 1px dotted;.}.b,.strong {. font-weight: bold;.}.dfn {. font-style: italic;.}.h1 {. margin: .67em 0;. font-size: 2em;.}.mark {. color: #000;. background: #ff0;.}.small {. font-size: 80%;.}.sub,.sup {. posit

Chrome Cache Entry: 219

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1572)
Category:	downloaded
Size (bytes):	22388
Entropy (8bit):	5.340794659982224
Encrypted:	false
SSDEEP:
MD5:	CB6AFEA6EE75D2FC22E4A22512425465
SHA1:	F91258C83A54D1D44DF8637909885B300B5D305B
SHA-256:	31FE46164CE2459191CA1F7727FD742CE01833EE4F705459E88D43F53FCC9F80
SHA-512:	91FDA973E0A4490AC58E5F3881A5600E41721DB09714047CE3666C680961710DC060D454FA1A668D8D43A21D9D8358CEF90BE89D199AA9BD4124D32F9F8FBF0B
Malicious:	false
Reputation:	unknown
URL:	"https://fonts.googleapis.com/css?family=Open+Sans:400,300,600,700"
Preview:	/* cyrillic-ext /.@font-face {. font-family: 'Open Sans';. font-style: normal;. font-weight: 300;. font-stretch: 100%;. src: url(https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSKmu1aB.woff2) format('woff2');. unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;.}./ cyrillic /.@font-face {. font-family: 'Open Sans';. font-style: normal;. font-weight: 300;. font-stretch: 100%;. src: url(https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSumu1aB.woff2) format('woff2');. unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;.}./ greek-ext /.@font-face {. font-family: 'Open Sans';. font-style: normal;. font-weight: 300;. font-stretch: 100%;. src: url(https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSOmu1aB.woff2) format('woff2');. unicode-range: U+1F00-1FFF;.}./ greek */.@font-face {. font-family: 'Open Sans';. font-style: normal;

Chrome Cache Entry: 221

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	2615
Entropy (8bit):	4.881101201043646
Encrypted:	false
SSDEEP:
MD5:	910C5ADFACB3E86D4DC3ABC4A03F6B72
SHA1:	65BE7735A29AC72E765198DAD4DDD319BEA7B53E
SHA-256:	B1D9327FE157838B4122333C2EE40550F54F2E38FE58BB16A8FD76F14DCFDC19
SHA-512:	ACDE516CCD23A71E6CEAA6CED8DB7CE298BFC5E3B0492A29B956E599D6E6B2EACB4F1673D1151F395DED6A5A719CCD6EF659851330810313785368819560A61B
Malicious:	false
Reputation:	unknown
URL:	https://www.hvacplus.com/js/mage/cookies.js
Preview:	/*. Magento. . NOTICE OF LICENSE. . This source file is subject to the Academic Free License (AFL 3.0). * that is bundled with this package in the file LICENSE_AFL.txt.. * It is also available through the world-wide-web at this URL:. * http://opensource.org/licenses/afl-3.0.php. * If you did not receive a copy of the license and are unable to. * obtain it through the world-wide-web, please send an email. * to license@magentocommerce.com so we can send you a copy immediately.. . DISCLAIMER. . Do not edit or add to this file if you wish to upgrade Magento to newer. * versions in the future. If you wish to customize Magento for your. * needs please refer to http://www.magentocommerce.com for more information.. . @category Mage. * @package js. * @copyright Copyright (c) 2012 Magento Inc. (http://www.magentocommerce.com). * @license http://opensource.org/licenses/afl-3.0.php Academic Free License (AFL 3.0). */.// old school cookie functions grabbed off the we

Chrome Cache Entry: 222

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	34797
Entropy (8bit):	4.828516742895271
Encrypted:	false
SSDEEP:
MD5:	8C414E1787C0AC9F10B16B252361C8B2
SHA1:	30C994521024E01FCBCEB82D58CB9B6B4D4C7E62
SHA-256:	394EE4643D5C3FC7D0A671052576E3E7250E6CBCCC407772679A359CE59F2794
SHA-512:	9BFD70BCCA48C51A13A5EDBE65E672A31EB1D042555B3349058783CF72C4609E12FC595A26D7EB033979870D10D3A1CBEACD7271E62B142615F13F0E57F8F9C9
Malicious:	false
Reputation:	unknown
Preview:	// script.aculo.us controls.js v1.8.2, Tue Nov 18 18:30:58 +0100 2008..// Copyright (c) 2005-2008 Thomas Fuchs (http://script.aculo.us, http://mir.aculo.us).// (c) 2005-2008 Ivan Krstic (http://blogs.law.harvard.edu/ivan).// (c) 2005-2008 Jon Tirsen (http://www.tirsen.com).// Contributors:.// Richard Livsey.// Rahul Bhargava.// Rob Wills.//.// script.aculo.us is freely distributable under the terms of an MIT-style license..// For details, see the script.aculo.us web site: http://script.aculo.us/..// Autocompleter.Base handles all the autocompletion functionality.// that's independent of the data source for autocompletion. This.// includes drawing the autocompletion menu, observing keyboard.// and mouse events, and similar..//.// Specific autocompleters need to provide, at the very least,.// a getUpdatedChoices function that will be invoked every time.// the text inside the monitored textbox changes. This method.// should get the text for which to provide autocomp

Chrome Cache Entry: 223

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	4774
Entropy (8bit):	4.902798241592569
Encrypted:	false
SSDEEP:
MD5:	9A99F8D63C137A15FE584C7DAF86E240
SHA1:	DFAB14B10A2396A65D6A1F27E4C2DD162C590C24
SHA-256:	B1AE8E255E4302F0C4F75209EC7DA74F4D165F12BC369A49DAE1CF2C60B6625A
SHA-512:	CA79F53785550CC08082ACAEA81FAC7569683EA2516F6729C095DF20F0B75871FDCDB7174CF76020EB4A123E2FA751AA70C26CBA2DB41CD824F7ABDB3D8C22A3
Malicious:	false
Reputation:	unknown
URL:	https://www.hvacplus.com/skin/frontend/seoinc/hvac/pmatch/css/style.css
Preview:	.overlay_pmatch-popup {. background-color: #000000;. z-index: 100 !important;. opacity: 0.6;. filter: Alpha(Opacity=60);.}..dialog {. border-radius: 5px;. display: block;. position: absolute;. z-index: 200 !important;. background: #fff;. padding: 15px;. border: 1px solid #ccc;.}..pmatch-popup_close {. float: right;. width: 17px;. height: 17px;. background: url("../images/close_label.gif") no-repeat;. border: none;. cursor: pointer;.}...pmatch-form .fieldset, .pmatch-form fieldset.group-select {. margin: 0;.}...pmatch-form fieldset.group-select {. width: 600px;. padding: 22px 0 12px 10px;.}...pmatch-form .buttons-set, .pmatch-form .button-set {. margin: 0;.}...pmatch-form .button-set {. width: 610px;.}...pmatch-form .input-box {. float: right;. text-align: left;. width: 50%;.}..pmatch-form .input-box input,.pmatch-form .input-box textarea{ border: 1px solid #ccc;. padding: 5px;. width: 100%;}...pmatch-popup

Chrome Cache Entry: 225

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.248434505777206
Encrypted:	false
SSDEEP:
MD5:	88733EE53676A47FC354A61C32516E82
SHA1:	A07B8EB3FF62A59CEEE8E2B0D082B9E3FFC2317B
SHA-256:	CE2DE4B3BE943FD5414DC6F3190D332FC9F6369F5DFBF6366B00B261ED02A4CF
SHA-512:	3E4D45904EE4036F7A151A2F40E5AEB1709077E59696177A8D8AC200CAC43196C28496F8974A34CFD8706137BE9C660125FFD70BC40BBBD7291F12CB8BCF1864
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ................................................J....-C..:X.........<..................................."....A`..>..Wx..Hi..%,..\{.....e...........................F........$...?^..........$...):.............................Ib..........$...@_..........$....C..........Zi....d........(8..2M..........$...?^..........$....C..........'6..LY..........)9..3N..........$...?^..........$....C..........);..T`..........)9..3N..........$...?^..........$....C..........=..Vb..........)9..3N..........$...<[..........$...-B..........+?..Vb..........)9..3N..........&..Ur...........9..0F..........,A..Xb..........)9..2L..........5F..]x..........4B..Fa..........-C..Xb..........(8..9T..............m...........Vq..............-?..U_..........>W..Ha..a}..................................To..E]..dw.............Tdx..Ha..Ql..q...................b~..Kd..Ha..v......3....................Ib..Jb..Xs..~...~...Le..Ib..[q....^...............................0....Jb..Le..Le..Me....

Chrome Cache Entry: 226

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 20 x 21
Category:	downloaded
Size (bytes):	1163
Entropy (8bit):	6.412920908872005
Encrypted:	false
SSDEEP:
MD5:	36F1943AE5E28A38FB0C5F81BFC37103
SHA1:	2B91B1A9933023F6CD2CDB1BDF1F3FCD5922D34C
SHA-256:	2D1E85A5D99BF3E7187D1FA19A17EAF9CD4C79579C687CBB539A2DEE3560349E
SHA-512:	35DE5255B569A8B8696B6CFE4408ECEBC8B69531E84A9DEC0B620743E640DCF108570677F645856C6B7B1CC3C8F633C4216248D99E52FC213C3F05038CA72AA8
Malicious:	false
Reputation:	unknown
URL:	https://www.hvacplus.com/skin/frontend/seoinc/hvac/images/bulet.gif
Preview:	GIF89a.......\|.&t.-t.:n..~.......$\|.&{.)z....?t.%}.... ........'........-..!..'.................!..).....0..2.....)........!......................!..A..D..`.................#........!...........E.....!..D.....&..I..O..T..:..r..K..W..[..U..p..R..{..o..j....y..\|..m.......y..{.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!..Created with GIMP.,............Si.......@a.xH.....z.(.T&N..&2..`.K...t0.&..L..#e......".Ie.6J.. ..!P..A\4I... ...t."%M.R...L..8..q4...>...D4....)xtH...#Dv.L.1....j8.(.#G....B'U.:S...r...G.8a<.@B./..,.@C...k....

Chrome Cache Entry: 228

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32036)
Category:	dropped
Size (bytes):	34849
Entropy (8bit):	5.4283179061895295
Encrypted:	false
SSDEEP:
MD5:	7184520C667B0BEAF6492E25D79A8DF5
SHA1:	F6D2C8A273B56277185D9803FB47DAE49A4E6E78
SHA-256:	211393B09AB7FDFBA9DDB5F6135625E6674613FD89B872D258AB535A348D2ADB
SHA-512:	F52D3EA03064E485E970DF8D7AF6244F81D7210B138D7E21B2C804EBEB53E4FB7DCB9A1A999FD33A0598ED9490262A14DDFBE633396BAA4EED1F9EA6D7B7E924
Malicious:	false
Reputation:	unknown
Preview:	/! VelocityJS.org (1.2.1). (C) 2014 Julian Shapiro. MIT @license: en.wikipedia.org/wiki/MIT_License /./! VelocityJS.org jQuery Shim (1.0.1). (C) 2014 The jQuery Foundation. MIT @license: en.wikipedia.org/wiki/MIT_License. /.!function(e){function t(e){var t=e.length,r=$.type(e);return"function"===r\|\|$.isWindow(e)?!1:1===e.nodeType&&t?!0:"array"===r\|\|0===t\|\|"number"==typeof t&&t>0&&t-1 in e}if(!e.jQuery){var $=function(e,t){return new $.fn.init(e,t)};$.isWindow=function(e){return null!=e&&e==e.window},$.type=function(e){return null==e?e+"":"object"==typeof e\|\|"function"==typeof e?a[o.call(e)]\|\|"object":typeof e},$.isArray=Array.isArray\|\|function(e){return"array"===$.type(e)},$.isPlainObject=function(e){var t;if(!e\|\|"object"!==$.type(e)\|\|e.nodeType\|\|$.isWindow(e))return!1;try{if(e.constructor&&!n.call(e,"constructor")&&!n.call(e.constructor.prototype,"isPrototypeOf"))return!1}catch(r){return!1}for(t in e);return void 0===t\|\|n.call(e,t)},$.each=function(e,r,a){var n,o=0,i=e.length,s=t(

Chrome Cache Entry: 229

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:
MD5:	C6CB4F21C7DCEB18C48B802BDE96868D
SHA1:	D44E74B07ED4E8267728C2BCDD16599E9110D05B
SHA-256:	B77A3071A80FC28A1E314D251064103CF265866101F7CDCCCF00B77C80484BD5
SHA-512:	8C65A0458DD4A8B93AEEA70A0CA67DB43B6E1C0DAAB17B7091449335532F3F5489E5B8A1617B42B99EE95B66CD8EF3E572F537121C9960743E100FE560F4C0F0
Malicious:	false
Reputation:	unknown
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xNDkSEAmjtX8M-_pNXBIFDT0fUzw=?alt=proto
Preview:	CgkKBw09H1M8GgA=

Chrome Cache Entry: 231

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	assembler source, ASCII text
Category:	downloaded
Size (bytes):	10269
Entropy (8bit):	5.104720784166663
Encrypted:	false
SSDEEP:
MD5:	9A848FC34BB15AE4BB876112AA59C4CB
SHA1:	5D544914F4F5CE7F788861545905AAB491B96018
SHA-256:	8EF84C396E6431DF5E29E49C43E1F557A9F30EE8231BC5D5C8E54AD97D16D15E
SHA-512:	D43B55FFF4F7B512F6DEE175B3F76D3C0D65D0BDAC883889794FE2750D9B86B0D1286A663987AFB6079DB10516C4295805ACE459C1E7F16EAE63865B4D18D721
Malicious:	false
Reputation:	unknown
URL:	https://www.hvacplus.com/skin/frontend/seoinc/hvac/css/responsive.css
Preview:	@charset "utf-8";../* CSS Document */.@media screen and (max-width:480px){...social-btn > ul > li > a span{font-size:10px;}...filter-row > div{float:left;width:100%;margin-bottom:15px;text-align:left;}...filter-row > div:last-child{margin-bottom:0;border-top:1px solid #E7E7E7;padding-top:15px;}...custom-paging .pagination > li > a,.custom-paging .pagination > li > span{font-size:10px;}...foot_cols2 ul.list-unstyled li em{padding:1px;}..footer.main_foot #footer .container > div:first-child,footer.main_foot #footer .container > div:nth-child(2){width:100%!important;}...box-account .box-head h2{font-size:24px;}...box .box-title h3{font-size:18px;}...box-info h4{font-size:14px;width:100%;}...col-1 > address a,.col-2 > address a{font-size:11px!important;right:0;}...addresses-primary .item > h3,.addresses-additional >h2{font-size:20px;}..ul#payment_form_authorizenet li .input-box{width:100%;}.}.@media screen and (max-width:560px){..td.first{padding-left:5px!important;padding-top:20px;text-al

Chrome Cache Entry: 232

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ISO-8859 text, with very long lines (13773)
Category:	downloaded
Size (bytes):	14008
Entropy (8bit):	5.256792074023561
Encrypted:	false
SSDEEP:
MD5:	B8D990EC68FACABAA5E427DDB18AFCF7
SHA1:	8984ECF8CFE7E234719CECA6033B4C31436A0C51
SHA-256:	467D16A975F33CB8685EF8BE6C95CEA856EA7929840EC89914886C6236BC5143
SHA-512:	640D3A427AA1E868863E1FA393AC74A1E1370B11C71A61C3810757958315B62FA82A9EB61466E77B508C25B111F365C84DD4EB057332A07269060C378CDEE7B4
Malicious:	false
Reputation:	unknown
URL:	https://www.hvacplus.com/js/jquery.bxSlider.js
Preview:	....../*. jQuery bxSlider v3.0. * http://bxslider.com. . Copyright 2010, Steven Wanderski. * http://bxcreative.com. . Free to use and abuse under the MIT license.. * http://www.opensource.org/licenses/mit-license.php. * . /.(function(a){a.fn.bxSlider=function(b){function Z(b,c,d,e){var f=[];var g=d;var h=false;if(e=="backward"){b=a.makeArray(b);b.reverse()}while(g>0){a.each(b,function(b,d){if(g>0){if(!h){if(b==c){h=true;f.push(a(this).clone());g--}}else{f.push(a(this).clone());g--}}else{return false}})}return f}function Y(){var a=i.outerHeight()b.displaySlideQty;return a}function X(){var a=i.outerWidth()*b.displaySlideQty;return a}function W(b,c){if(c=="left"){var d=a(".pager",h).eq(b).position().left}else if(c=="top"){var d=a(".pager",h).eq(b).position().top}return d}function V(){if(!b.infiniteLoop&&b.hideControlOnEnd){if(x==F){a(".bx-prev",h).hide()}else{a(".bx-prev",h).show()}if(x==G){a(".bx-next",h).hide()}else{a(".bx-next",h).show()}}}function U(c,e,f,g){p=a('<a href=""

Chrome Cache Entry: 236

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32038)
Category:	dropped
Size (bytes):	95992
Entropy (8bit):	5.391333957965341
Encrypted:	false
SSDEEP:
MD5:	F03E5A3BF534F4A738BC350631FD05BD
SHA1:	37B1DB88B57438F1072A8EBC7559C909C9D3A682
SHA-256:	AEC3D419D50F05781A96F223E18289AEB52598B5DB39BE82A7B71DC67D6A7947
SHA-512:	8EEEAEFB86CF5F9D09426814F7B60E1805E644CAC3F5AB382C4D393DD0B7AB272C1909A31A57E6D38D5ACF207555F097A64A6DD62F60A97093E97BB184126D2A
Malicious:	false
Reputation:	unknown
Preview:	/! jQuery v1.11.3 \| (c) 2005, 2015 jQuery Foundation, Inc. \| jquery.org/license /.!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){var c=[],d=c.slice,e=c.concat,f=c.push,g=c.indexOf,h={},i=h.toString,j=h.hasOwnProperty,k={},l="1.11.3",m=function(a,b){return new m.fn.init(a,b)},n=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,o=/^-ms-/,p=/-([\da-z])/gi,q=function(a,b){return b.toUpperCase()};m.fn=m.prototype={jquery:l,constructor:m,selector:"",length:0,toArray:function(){return d.call(this)},get:function(a){return null!=a?0>a?this[a+this.length]:this[a]:d.call(this)},pushStack:function(a){var b=m.merge(this.constructor(),a);return b.prevObject=this,b.context=this.context,b},each:function(a,b){return m.each(this,a,b)},map:function(a){return this.pushStack(m.map(this,function(b,c){ret

Chrome Cache Entry: 237

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10331
Entropy (8bit):	4.802982265491155
Encrypted:	false
SSDEEP:
MD5:	6043F96A71D2685FECD02E2AB99E84D9
SHA1:	CFE4B5B08BBA43C94897082EA3AE62329BCCCA40
SHA-256:	727EE107A8036E193FEF85E1FAF9E1EB145D25D03A4AA73D6DB7C5AD71118797
SHA-512:	2DC0B2793FE0FC56B60BA63E271E225E6C3AD1ADBB76EC99DF4AAE01077DD37E47CDD438147B4D985D2E26DE7319D9262CE923FB0DEFF0471C1BF0165FBC9031
Malicious:	false
Reputation:	unknown
Preview:	// script.aculo.us slider.js v1.8.2, Tue Nov 18 18:30:58 +0100 2008..// Copyright (c) 2005-2008 Marty Haught, Thomas Fuchs.//.// script.aculo.us is freely distributable under the terms of an MIT-style license..// For details, see the script.aculo.us web site: http://script.aculo.us/..if (!Control) var Control = { };..// options:.// axis: 'vertical', or 'horizontal' (default).//.// callbacks:.// onChange(value).// onSlide(value).Control.Slider = Class.create({. initialize: function(handle, track, options) {. var slider = this;.. if (Object.isArray(handle)) {. this.handles = handle.collect( function(e) { return $(e) });. } else {. this.handles = [$(handle)];. }.. this.track = $(track);. this.options = options \|\| { };.. this.axis = this.options.axis \|\| 'horizontal';. this.increment = this.options.increment \|\| 1;. this.step = parseInt(this.options.step \|\| '1');. this.range = this.options.range \|\| $R(0,1);.. this.value = 0;

Chrome Cache Entry: 238

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 226x102, components 3
Category:	dropped
Size (bytes):	14616
Entropy (8bit):	7.940279047514479
Encrypted:	false
SSDEEP:
MD5:	D955D32F99F7C751AD086C3F0A79A6B8
SHA1:	F2AB1483A3166CDBE16E6420BCD9306F203AE4A0
SHA-256:	160675D7912FA2B5AA5F332DB869D2869C2B7B4815BD1CB3F016D90EB6B6B27A
SHA-512:	F8CEEA0F73B79A3D6FF610D004583FA479E51B1FF7CC5F9EB217633A3901512A4753CF1AC0372FF48D49F9A85DE880730D91F4E8AC0773C54D32688C3350A087
Malicious:	false
Reputation:	unknown
Preview:	......Exif..II*.................Ducky.......d...../http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)" xmpMM:InstanceID="xmp.iid:9D9B7DC6E5BC11E59266D62214589DCD" xmpMM:DocumentID="xmp.did:9D9B7DC7E5BC11E59266D62214589DCD"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:9D9B7DC4E5BC11E59266D62214589DCD" stRef:documentID="xmp.did:9D9B7DC5E5BC11E59266D62214589DCD"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.............................................................................................................................

Chrome Cache Entry: 239

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	170
Entropy (8bit):	3.8075027245798485
Encrypted:	false
SSDEEP:
MD5:	E7D292231AA604DD7A497B19DE346488
SHA1:	1F07D9260108958960A187AD36A1BF20618AD1CF
SHA-256:	BEDF333584002E5C2AC56B78C195F40243BB143991F9C783250E74D27C637C47
SHA-512:	08428A755864CB8447D3F2D4DB3D33CBC2E7A398C38034528BAFFFD4620D76098D214EB91E058AD542C03CC332B6C89B11F83127890574C2F97701C48B1E9226
Malicious:	false
Reputation:	unknown
Preview:	{"v":1,"sv":null,"wv":null,"csu":null,"csv":null,"sru":null,"aru":null,"dap":0,"ip":null,"rfm":false,"b":0,"bd":null,"cru":null,"acru":null,"id":null,"s":false,"qe":true}

Chrome Cache Entry: 242

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1665
Entropy (8bit):	5.221389230587169
Encrypted:	false
SSDEEP:
MD5:	F23CF727E4FCCA9A5470658DA5E755C9
SHA1:	98C420DADBA613AE097236B8A54138D0A5FA94CF
SHA-256:	91EE720F3C25EC6B209D88019C20E2592340FF1FE1C94F3D5431E5FD1E77E5DC
SHA-512:	8AD17FF48FCD8A063DBB8BA48F0F6CEFF906E920BB2C9E50E2944D3274DB19902C3B8FD14947A57D5B98064F00912936DEA11CB9C22A754973CE9CB6A9FEE31A
Malicious:	false
Reputation:	unknown
URL:	https://www.hvacplus.com/skin/frontend/seoinc/hvac/css/owl-carousel/owl.theme.css
Preview:	/. .Owl Carousel Owl Demo Theme ..v1.3.3./...owl-theme .owl-controls{..margin-top: 10px;..text-align: center;.}../* Styling Next and Prev buttons /...owl-theme .owl-controls .owl-buttons div{..color: #FFF;..display: inline-block;..zoom: 1;..display: inline;/IE7 life-saver /..margin: 5px;..padding: 3px 10px;..font-size: 12px;..-webkit-border-radius: 30px;..-moz-border-radius: 30px;..border-radius: 30px;..background: #869791;..filter: Alpha(Opacity=50);/IE7 fix/..opacity: 0.5;.}./* Clickable class fix problem with hover on touch devices /./ Use it for non-touch hover action /..owl-theme .owl-controls.clickable .owl-buttons div:hover{..filter: Alpha(Opacity=100);/IE7 fix/..opacity: 1;..text-decoration: none;.}../ Styling Pagination/...owl-theme .owl-controls .owl-page{..display: inline-block;..zoom: 1;..display: inline;/IE7 life-saver /.}..owl-theme .owl-controls .owl-page span{..display: block;..width: 12px;..height: 12px;..margin: 5px 7px;..filter: Alpha(Opacity=50);

Chrome Cache Entry: 244

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	38745
Entropy (8bit):	4.8723768620636045
Encrypted:	false
SSDEEP:
MD5:	D795089F95A22306CCA9B337C439C65A
SHA1:	5DCD6AE86DEC74E0E481ECA75CC12836933416F9
SHA-256:	328CAB78EBB3E3C4E94E23B87630A56AE7AD2DB686ECD1D69F93176318B6F82D
SHA-512:	5EE5571B9063EA1174E2DE1B16A1CD8F2FF8239D62AED6EF53B6E6F087840822CA4C31E13CCDE891071C603B75213CCD16D1FC03312C38CB027014C214F5E7A2
Malicious:	false
Reputation:	unknown
URL:	https://www.hvacplus.com/js/scriptaculous/effects.js
Preview:	// script.aculo.us effects.js v1.8.2, Tue Nov 18 18:30:58 +0100 2008..// Copyright (c) 2005-2008 Thomas Fuchs (http://script.aculo.us, http://mir.aculo.us).// Contributors:.// Justin Palmer (http://encytemedia.com/).// Mark Pilgrim (http://diveintomark.org/).// Martin Bialasinki.//.// script.aculo.us is freely distributable under the terms of an MIT-style license..// For details, see the script.aculo.us web site: http://script.aculo.us/..// converts rgb() and #xxx to #xxxxxx format,.// returns self (or first argument) if not convertable.String.prototype.parseColor = function() {. var color = '#';. if (this.slice(0,4) == 'rgb(') {. var cols = this.slice(4,this.length-1).split(',');. var i=0; do { color += parseInt(cols[i]).toColorPart() } while (++i<3);. } else {. if (this.slice(0,1) == '#') {. if (this.length==4) for(var i=1;i<4;i++) color += (this.charAt(i) + this.charAt(i)).toLowerCase();. if (this.length==7) color = this.toLowerCase();. }. }. return (co

Chrome Cache Entry: 245

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1597
Entropy (8bit):	4.73302274814688
Encrypted:	false
SSDEEP:
MD5:	BA0EDA44563ECF432EAABD5C681D7ED5
SHA1:	6E69F1A8F1CF740143117FFEAA6CC74A83E65B5F
SHA-256:	25EDC1009C82ED5E4A65744AED8ED743F2E32CEEED36EFD46822A04D1469388F
SHA-512:	7770F168D74026DBD700042FB8CAADFCE22A64F7D7B060883BC24AB005C64E83CE82A3AA60B64283777F3BBBDEB8DDA0586092F9995E31B10EB5F131B42B21FA
Malicious:	false
Reputation:	unknown
URL:	https://www.hvacplus.com/js/mage/translate.js
Preview:	/*. Magento. . NOTICE OF LICENSE. . This source file is subject to the Academic Free License (AFL 3.0). * that is bundled with this package in the file LICENSE_AFL.txt.. * It is also available through the world-wide-web at this URL:. * http://opensource.org/licenses/afl-3.0.php. * If you did not receive a copy of the license and are unable to. * obtain it through the world-wide-web, please send an email. * to license@magentocommerce.com so we can send you a copy immediately.. . DISCLAIMER. . Do not edit or add to this file if you wish to upgrade Magento to newer. * versions in the future. If you wish to customize Magento for your. * needs please refer to http://www.magentocommerce.com for more information.. . @category Mage. * @package js. * @copyright Copyright (c) 2012 Magento Inc. (http://www.magentocommerce.com). * @license http://opensource.org/licenses/afl-3.0.php Academic Free License (AFL 3.0). */..var Translate = Class.create();.Translate.protot

Chrome Cache Entry: 247

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	22592
Entropy (8bit):	4.638913438341276
Encrypted:	false
SSDEEP:
MD5:	BFF5486446E27AECEB7EB73DE7756C17
SHA1:	24049C8F3C0511A5CBBE65D6A0D0FA852E255D1F
SHA-256:	349778AFE309CF47E57CBC2D17E7F220149A789A52E7D3E941A63BB4C165E6B0
SHA-512:	7B7EF5283A53F3057C512793AA9AE9A1F2DBA592161C37528FC60F3268EFCA43E101BBC82E9968F20945ACE6C316222254B59656499335E41562718C1227F72B
Malicious:	false
Reputation:	unknown
URL:	https://www.hvacplus.com/js/varien/js.js
Preview:	/*. Magento. . NOTICE OF LICENSE. . This source file is subject to the Academic Free License (AFL 3.0). * that is bundled with this package in the file LICENSE_AFL.txt.. * It is also available through the world-wide-web at this URL:. * http://opensource.org/licenses/afl-3.0.php. * If you did not receive a copy of the license and are unable to. * obtain it through the world-wide-web, please send an email. * to license@magentocommerce.com so we can send you a copy immediately.. . DISCLAIMER. . Do not edit or add to this file if you wish to upgrade Magento to newer. * versions in the future. If you wish to customize Magento for your. * needs please refer to http://www.magentocommerce.com for more information.. . @category Varien. * @package js. * @copyright Copyright (c) 2012 Magento Inc. (http://www.magentocommerce.com). * @license http://opensource.org/licenses/afl-3.0.php Academic Free License (AFL 3.0). */.function popWin(url,win,para) {. var win = w

Chrome Cache Entry: 248

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 73 x 48, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	6157
Entropy (8bit):	7.902782837059821
Encrypted:	false
SSDEEP:
MD5:	F15CC7D981126EEDF11C6C8C4734560F
SHA1:	78C24A34F97FC47C9B61DE33B0363EB694DE28AA
SHA-256:	C0DD3F2DA144DA86F1694E0495DA72371F0A4B6D3FEA8D7ED7C7C5BB205E5EC9
SHA-512:	DDF739D37E8499F67153332A1BD9ABF1E1360046D8138422DBCBE1B4AB3B9346613A0B9BEFBB66E59025485EBDA71280426A3BEA4DD56089CA88CF51097778B9
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...I...0......<......tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.155772, 2014/01/13-19:44:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2014 (Windows)" xmpMM:InstanceID="xmp.iid:E8C5680EE5ED11E58B19B8A2B9F06232" xmpMM:DocumentID="xmp.did:E8C5680FE5ED11E58B19B8A2B9F06232"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:E8C5680CE5ED11E58B19B8A2B9F06232" stRef:documentID="xmp.did:E8C5680DE5ED11E58B19B8A2B9F06232"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.[....}IDATx.Z....y~.....K..+i..J..........TR$q..1.....T....U).*b..l.+..S.............$!....jW.=ggvg........

Chrome Cache Entry: 251

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1305)
Category:	dropped
Size (bytes):	46274
Entropy (8bit):	5.48786904450865
Encrypted:	false
SSDEEP:
MD5:	E9372F0EBBCF71F851E3D321EF2A8E5A
SHA1:	2C7D19D1AF7D97085C977D1B69DCB8B84483D87C
SHA-256:	1259EA99BD76596239BFD3102C679EB0A5052578DC526B0452F4D42F8BCDD45F
SHA-512:	C3A1C74AC968FC2FA366D9C25442162773DB9AF1289ADFB165FC71E7750A7E62BD22F424F241730F3C2427AFFF8A540C214B3B97219A360A231D4875E6DDEE6F
Malicious:	false
Reputation:	unknown
Preview:	(function(){var E;var g=window,n=document,p=function(a){var b=g._gaUserPrefs;if(b&&b.ioo&&b.ioo()\|\|a&&!0===g["ga-disable-"+a])return!0;try{var c=g.external;if(c&&c._gaUserPrefs&&"oo"==c._gaUserPrefs)return!0}catch(f){}a=[];b=n.cookie.split(";");c=/^\sAMP_TOKEN=\s(.?)\s$/;for(var d=0;d<b.length;d++){var e=b[d].match(c);e&&a.push(e[1])}for(b=0;b<a.length;b++)if("$OPT_OUT"==decodeURIComponent(a[b]))return!0;return!1};var q=function(a){return encodeURIComponent?encodeURIComponent(a).replace(/$/g,"%28").replace(/$/g,"%29"):a},r=/^(www\.)?google(\.com?)?(\.[a-z]{2})?$/,u=/(^\|\.)doubleclick\.net$/i;function Aa(a,b){switch(b){case 0:return""+a;case 1:return 1a;case 2:return!!a;case 3:return 1E3a}return a}function Ba(a){return"function"==typeof a}function Ca(a){return void 0!=a&&-1<(a.constructor+"").indexOf("String")}function F(a,b){return void 0==a\|\|"-"==a&&!b\|\|""==a}function Da(a){if(!a\|\|""==a)return"";for(;a&&-1<" \n\r\t".indexOf(a.charAt(0));)a=a.substring(1);for(;a&&-1<" \n\r\t".i

Chrome Cache Entry: 255

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 48236, version 1.0
Category:	downloaded
Size (bytes):	48236
Entropy (8bit):	7.994912604882335
Encrypted:	true
SSDEEP:
MD5:	015C126A3520C9A8F6A27979D0266E96
SHA1:	2ACF956561D44434A6D84204670CF849D3215D5F
SHA-256:	3C4D6A1421C7DDB7E404521FE8C4CD5BE5AF446D7689CD880BE26612EAAD3CFA
SHA-512:	02A20F2788BB1C3B2C7D3142C664CDEC306B6BA5366E57E33C008EDB3EB78638B98DC03CDF932A9DC440DED7827956F99117E7A3A4D55ACADD29B006032D9C5C
Malicious:	false
Reputation:	unknown
URL:	https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
Preview:	wOF2.......l......D...............................O..B..h?HVAR.x.`?STAT.$'...0+...\|.../V........+..2.0..6.6.$..`. ..~......[B4q.....t..P.M_.z...1..R.S...u.#..R....fR.1.N.v.N.P...;.2........!Z......Qs...5f.G.K.an2&....2.........C.H.t..N!.....nh.<(.vN.....j.._.L.P.t..Ai.%.............._I.i,..o,C.].H.X9.....a.=N....k.....n.L..k.f.u..{...:.}^\[..~5...Z`...........`!...%4..,...K0..&.a/....P....S....m.Z......u...D.j.F...f.0`I.`.`.h#..)(FQ.F!o$........S.).MV8%Rh...r...x...T]$.=......Y...!.3.&U..."....Q....{.l/0..d..4iJ/..}...3....i[Z..NG.WD...>.[U..Q.h..@m.=..S...1C2...d...<..v.?.q.f..n...OUz.....&Z......Z."..N.....n...9.B..C..W....}...W..6Zs.i.+Z........jB.n..x.8M.....q..@I....-.%..,C,..K..#.2...4)/.v_..x.<....t.....%[.4?.=j.V..jj''..W.u..q....I.L.=......E...\.M.7{.>......W........C.`...,9$......\..o........y...4A..m.P.,X..=?.:................wF`..+.P..........M!.4.......l.>M..t.ff5r..^..Z.g...!fA,hIIQ...e.R>B.AH.VuX..>..\.=.ky...1>C....>C.c.;...6D.

Chrome Cache Entry: 256

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 73 x 48, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	4148
Entropy (8bit):	7.818684553520774
Encrypted:	false
SSDEEP:
MD5:	A3BEF944586B37B28D170E850551F499
SHA1:	C464DDD32075121858315BD07DD1DBB0FE895596
SHA-256:	1B879E27E1862257774AD8B444F9CF2D69CC043C597FD442369C6E3923969299
SHA-512:	24B9EA5F7C3BDFA0028F381CE617A2622E98D291E7756C31792532768523474F2D162A4D953ACE90B3491D3A8BFA05D7F208D544B700FD120C379E9076F5F609
Malicious:	false
Reputation:	unknown
URL:	https://www.hvacplus.com/skin/frontend/seoinc/hvac/images/pay-4.png
Preview:	.PNG........IHDR...I...0......<......tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.155772, 2014/01/13-19:44:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2014 (Windows)" xmpMM:InstanceID="xmp.iid:079212E1E5EE11E5A650B2CE328FE7C6" xmpMM:DocumentID="xmp.did:079212E2E5EE11E5A650B2CE328FE7C6"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:079212DFE5EE11E5A650B2CE328FE7C6" stRef:documentID="xmp.did:079212E0E5EE11E5A650B2CE328FE7C6"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.r`.....IDATx...\TG.._.......**EY....Kb.D..-F.IL<M1...r.b...c.S/..S4.B.D..D@.&M.&U.....}.....Es$.x...~og...\|.\|

Chrome Cache Entry: 257

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	52797
Entropy (8bit):	4.029688138268403
Encrypted:	false
SSDEEP:
MD5:	A5F96C62D75BE144282EF6CC429A6259
SHA1:	99A600283194105BE6679B4A7CBA8AC27A8C455A
SHA-256:	9221608A4DF26C3A67D553A85EA42269235CA69D2FF47419148853830D5CEA2D
SHA-512:	214A522A93CA957B8FA2489838D119506FC7E1CD6BC385666C676704A075F2A9BFF636E7C50E11BF90DAF6A1260778486B79380F144DA197C1E854E91119EE39
Malicious:	false
Reputation:	unknown
URL:	https://www.hvacplus.com/js/owl-carousel/owl.carousel.js
Preview:	/. jQuery OwlCarousel v1.3.3. . Copyright (c) 2013 Bartosz Wojciechowski. * http://www.owlgraphic.com/owlcarousel/. . Licensed under MIT. . /../JS Lint helpers: /./global dragMove: false, dragEnd: false, $, jQuery, alert, window, document /./jslint nomen: true, continue:true /..if (typeof Object.create !== "function") {. Object.create = function (obj) {. function F() {}. F.prototype = obj;. return new F();. };.}.(function ($, window, document) {.. var Carousel = {. init : function (options, el) {. var base = this;.. base.$elem = $(el);. base.options = $.extend({}, $.fn.owlCarousel.options, base.$elem.data(), options);.. base.userOptions = options;. base.loadContent();. },.. loadContent : function () {. var base = this, url;.. function getData(data) {. var i, content = "";. if (typeof base.options.jsonSuccess =

Chrome Cache Entry: 258

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4711
Entropy (8bit):	5.035611430609867
Encrypted:	false
SSDEEP:
MD5:	A14A0DC196C6CC41C9669AC1F87D80DD
SHA1:	EA4AAE9A6A9382714DF8B9ED6CE2A35265FF8A7B
SHA-256:	431D674CA250CC2B5A1C8E1F023D408149CDA1169ECBF57D04009A116411D1BC
SHA-512:	35E12608A69A143CF09689DDAC940227C345A18D6FB251078A1963CC072FACE89B5F43148ADACB2C45FE5107CB26D8CABE90A7AA8AD55B100A339577DB307AD9
Malicious:	false
Reputation:	unknown
Preview:	(function($j) {.$j.fn.menumaker = function(options) { . var main_menu = $j(this), settings = $j.extend({. format: "dropdown",. sticky: false. }, options);. return this.each(function() {. $j(this).find(".button").on('click', function(){. $j(this).toggleClass('menu-opened');. var mainmenu = $j(this).next('ul');. if (mainmenu.hasClass('open')) { . mainmenu.slideToggle().removeClass('open');. }. else {. mainmenu.slideToggle().addClass('open');. if (settings.format === "dropdown") {. mainmenu.find('ul').show();. }. }. });. main_menu.find('li ul').parent().addClass('has-sub');.multiTg = function() {. main_menu.find(".has-sub").prepend('<span class="submenu-button"></span>');. main_menu.find('.submenu-button').on('click', function() {. $j(this).toggleClass('submenu-opened');. if ($j(this).siblings('ul').hasClass('open')) {. $j(this).siblings('ul').removeClass('open').slideToggle();. }. e

Chrome Cache Entry: 259

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	17753
Entropy (8bit):	6.887025176623594
Encrypted:	false
SSDEEP:
MD5:	DEF739A9B7259AED34C75BD549E59E49
SHA1:	57033C7FA87F75537DB049F29F8821D208287D76
SHA-256:	3D6B6EEE4E6BFEED58D3AD23159AD229DEEDD8CA20E25CCED6A23CF1B7A9CEAC
SHA-512:	FCEB95CC788BA9CD52E3BDFEE4011FFD021E237E5D3361E49FBC3DC9CA28C592412FC09D5FA43C38A9E3B51E839D894E2D489E76F2A158BEC09719907A7F2C3D
Malicious:	false
Reputation:	unknown
Preview:	eval((function(s){var a,c,e,i,j,o="",r,t=".....................................................................................................................$@^`~.";for(i=0;i<s.length;i++){r=t+s[i][2];a=s[i][1].split(".");for(j=a.length-1;j>=0;j--){s[i][0]=s[i][0].split(r.charAt(j)).join(a[j])}o+=s[i][0]}var p=21436,x=function(r){var c,p,s,l='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_0123456789';if(r<63)c=l.charAt(r);else{r-=63;p=Math.floor(r/63);s=r%63;c=l.charAt(p)+l.charAt(s)}return c};a=o.substr(p).split(':');r=a[1].split('?');a=a[0].split('?');o=o.substr(0,p);if(!''.replace(/^/,String)){var z={};for(i=0;i<542;i++){var y=x(i);z[y]=r[i]\|\|y}t=/\b\w\w?\b/g;y=function(a){return z[a]\|\|a};o=o.replace(t,y)}else{for(j=a[a.length-1]-1;j>=0;j--){if(r[j])o=o.replace(new RegExp('\b'+(j<63?c.charAt(j):c.charAt((j-63)/63)+c.charAt((j-63)%63))+'\b','g'),r[j])}}return o.replace(/./g,"\"")})([["if(w .==.j'..a,c.i=0,e.2,d@copy(),f=a;.!c.c@y-a}.i.e.-2..i]=e[i+2]}.a;a<.y-c;a++.e.-2]=d[a-

Chrome Cache Entry: 260

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (12080), with no line terminators
Category:	downloaded
Size (bytes):	12080
Entropy (8bit):	5.270301680783571
Encrypted:	false
SSDEEP:
MD5:	3CC943CF82FE16508CED6EE433E4845C
SHA1:	4C77F08560EC485125148699D556AB07BCD50F79
SHA-256:	D70317ECFD90A7AA5D068E210DE6940A0F1E473275526EAE00400B9D141FF41E
SHA-512:	7B948F5ACD130875B968474A0B421DC88DF90712E37D2CFBA8912F8B6A021C1991B5CF8E3FFD3C88471E75E4A09203D9FF9B3DA762AE4F4B888DE22013EB0930
Malicious:	false
Reputation:	unknown
URL:	https://app.purechat.com/VisitorWidget/WidgetScript
Preview:	!function(){var e={5892:function(e){e.exports={homeUrl:"https://www.purechat.com",apiUrl:"https://api.purechat.com",cdnUrl:"https://prod.purechatcdn.com",apiCdnServerUrl:"https://api-cdn.purechat.com",trackingOperatorApiUrl:"https://visitors.purechat.com",adminApiUrl:"https://admin-api.purechat.com",googleEmbedApiKey:"AIzaSyBEorMC35CFuuH2caNZhAeFGRtqwbWE4Mc",cdnServerUrl:"https://prod.purechatcdn.com",customerIoSiteId:"d4a6e4df3666072e5b55",dashboardRootUrl:"https://app.purechat.com",apiRootUrl:"https://api.purechat.com",widgetApiRootUrl:"https://widgetapi.purechat.com",filesRootUrl:"https://files.purechat.com",pingQueueUrl:"https://checkin.purechat.com/api/checkin",authCookieName:"purechatAuthv5",pidCookieName:"prodvtftwPID",pingInterval:5e3,sessionTimeout:12e5,recaptchaClientKey:"6LeJv-MUAAAAADCcAJn1EW3l5bMoqAxPfCO898oc",adminTokenName:"prodAdminToken"}}},t={};function n(i){var o=t[i];if(void 0!==o)return o.exports;var r=t[i]={exports:{}};return e[i](r,r.exports,n),r.exports}n.n=func

Chrome Cache Entry: 263

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32003)
Category:	dropped
Size (bytes):	36868
Entropy (8bit):	5.176279342143451
Encrypted:	false
SSDEEP:
MD5:	C5B5B2FA19BD66FF23211D9F844E0131
SHA1:	791AA054A026BDDC0DE92BAD6CF7A1C6E73713D5
SHA-256:	2979F9A6E32FC42C3E7406339EE9FE76B31D1B52059776A02B4A7FA6A4FD280A
SHA-512:	D9EF2AAB411371F5912381C9073422037528C8593AB5B3721BEA926880592F25BD5DFDEC5991CDFE5C5EF5F4E1D54E390E93DFD3BCA3F782AC5071D67B8624D4
Malicious:	false
Reputation:	unknown
Preview:	/!. Bootstrap v3.3.6 (http://getbootstrap.com). * Copyright 2011-2015 Twitter, Inc.. * Licensed under the MIT license. */.if("undefined"==typeof jQuery)throw new Error("Bootstrap's JavaScript requires jQuery");+function(a){"use strict";var b=a.fn.jquery.split(" ")[0].split(".");if(b[0]<2&&b[1]<9\|\|1==b[0]&&9==b[1]&&b[2]<1\|\|b[0]>2)throw new Error("Bootstrap's JavaScript requires jQuery version 1.9.1 or higher, but lower than version 3")}(jQuery),+function(a){"use strict";function b(){var a=document.createElement("bootstrap"),b={WebkitTransition:"webkitTransitionEnd",MozTransition:"transitionend",OTransition:"oTransitionEnd otransitionend",transition:"transitionend"};for(var c in b)if(void 0!==a.style[c])return{end:b[c]};return!1}a.fn.emulateTransitionEnd=function(b){var c=!1,d=this;a(this).one("bsTransitionEnd",function(){c=!0});var e=function(){c\|\|a(d).trigger(a.support.transition.end)};return setTimeout(e,b),this},a(function(){a.support.transition=b(),a.support.transition&&(a.event.

Chrome Cache Entry: 267

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	31066
Entropy (8bit):	4.801922269100877
Encrypted:	false
SSDEEP:
MD5:	046759400DB7A6096376E50110104EDD
SHA1:	F02BE2B96396A9A9AAB71B17CFFBC77F025FC906
SHA-256:	1B88542D1458CD86DACD3DE3CB9635DED83C01EDCAE01BE5F49451611985CFF8
SHA-512:	0A37E1983F0E6C31A6D0B8B9DF98338AC5239B46CE053B0153F4284B96910A0A9B02D70558D1CF84A5864653C0E17D74B5080E4DAD0CEE13C2B00D51513580C9
Malicious:	false
Reputation:	unknown
URL:	https://www.hvacplus.com/js/scriptaculous/dragdrop.js
Preview:	// script.aculo.us dragdrop.js v1.9.0, Thu Dec 23 16:54:48 -0500 2010..// Copyright (c) 2005-2010 Thomas Fuchs (http://script.aculo.us, http://mir.aculo.us).//.// script.aculo.us is freely distributable under the terms of an MIT-style license..// For details, see the script.aculo.us web site: http://script.aculo.us/..if(Object.isUndefined(Effect)). throw("dragdrop.js requires including script.aculo.us' effects.js library");..var Droppables = {. drops: [],.. remove: function(element) {. this.drops = this.drops.reject(function(d) { return d.element==$(element) });. },.. add: function(element) {. element = $(element);. var options = Object.extend({. greedy: true,. hoverclass: null,. tree: false. }, arguments[1] \|\| { });.. // cache containers. if(options.containment) {. options._containers = [];. var containment = options.containment;. if(Object.isArray(containment)) {. containment.each( function(c) { options._containers

Chrome Cache Entry: 268

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	4744
Entropy (8bit):	5.035600989545859
Encrypted:	false
SSDEEP:
MD5:	1174F6FC34CA5D54BA10B0C719386E7C
SHA1:	08B8E5917B089105DAD96850C3BF99B7183F292F
SHA-256:	8A2E4F92CBA8509D0D26255BB950E4A53345FAD6C1B38DA13448B9C7A561832A
SHA-512:	0B93CE208E2B111F55D474E30DC6E1B840BBF7D3025DF51A03556F252CD2007D4387E25E80BEBE7D3826E0B1C6017269D30C863FFEBCBA65FE830BCCB6E81C68
Malicious:	false
Reputation:	unknown
URL:	https://www.hvacplus.com/js/scriptaculous/builder.js
Preview:	// script.aculo.us builder.js v1.8.2, Tue Nov 18 18:30:58 +0100 2008..// Copyright (c) 2005-2008 Thomas Fuchs (http://script.aculo.us, http://mir.aculo.us).//.// script.aculo.us is freely distributable under the terms of an MIT-style license..// For details, see the script.aculo.us web site: http://script.aculo.us/..var Builder = {. NODEMAP: {. AREA: 'map',. CAPTION: 'table',. COL: 'table',. COLGROUP: 'table',. LEGEND: 'fieldset',. OPTGROUP: 'select',. OPTION: 'select',. PARAM: 'object',. TBODY: 'table',. TD: 'table',. TFOOT: 'table',. TH: 'table',. THEAD: 'table',. TR: 'table'. },. // note: For Firefox < 1.5, OPTION and OPTGROUP tags are currently broken,. // due to a Firefox bug. node: function(elementName) {. elementName = elementName.toUpperCase();.. // try innerHTML approach. var parentTag = this.NODEMAP[elementName] \|\| 'div';. var parentElement = document.createElement(parentTag);. try { // prevent IE "feature":

Chrome Cache Entry: 269

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Algol 68 source, ASCII text, with very long lines (479)
Category:	downloaded
Size (bytes):	39080
Entropy (8bit):	4.719371266141512
Encrypted:	false
SSDEEP:
MD5:	CC33CF31BFF59331AF843B9EE17F0F69
SHA1:	EADDD4B2E062290575F69B5418CA258F2334890C
SHA-256:	76493B037686B5C5CF4DB0AA1C5245C09158D6BEDEFDB382AA2AEF474A0C154E
SHA-512:	75C7E06CA1A92AD340C593D04222B6AF75D05A3A97F66952FB4C41F896E1441E6F5E2994BE4312D36EA46D74C11D17ED139639155C15569ECB87A80DBF0A7534
Malicious:	false
Reputation:	unknown
URL:	https://www.hvacplus.com/js/prototype/validation.js
Preview:	/. Really easy field validation with Prototype.* http://tetlaw.id.au/view/javascript/really-easy-field-validation.* Andrew Tetlaw.* Version 1.5.4.1 (2007-01-05).. Copyright (c) 2007 Andrew Tetlaw.* Permission is hereby granted, free of charge, to any person.* obtaining a copy of this software and associated documentation.* files (the "Software"), to deal in the Software without.* restriction, including without limitation the rights to use, copy,.* modify, merge, publish, distribute, sublicense, and/or sell copies.* of the Software, and to permit persons to whom the Software is.* furnished to do so, subject to the following conditions:.. The above copyright notice and this permission notice shall be.* included in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.* EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.* MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.* NONINFRINGEMENT. IN NO EV

Chrome Cache Entry: 270

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 66624, version 4.262
Category:	downloaded
Size (bytes):	66624
Entropy (8bit):	7.996443365254666
Encrypted:	true
SSDEEP:
MD5:	DB812D8A70A4E88E888744C1C9A27E89
SHA1:	638C652D623280A58144F93E7B552C66D1667A11
SHA-256:	FF82AEED6B9BB6701696C84D1B223D2E682EB78C89117A438CE6CFEA8C498995
SHA-512:	17222F02957B3335849E3FE277B17C21C4AAF0C76CD3DA01A4CA39C035629695D29645913865B78E097066492F9CEE5618AF5159560363D2723BED7C3B9CF2A8
Malicious:	false
Reputation:	unknown
URL:	https://www.hvacplus.com/skin/frontend/seoinc/hvac/css/font-awesome/fonts/fontawesome-webfont.woff2?v=4.5.0
Preview:	wOF2.......@...................................?FFTM.. .`..r........5.6.$........ ..... ?webf.[.....@...nC....t.TL...f...t....q...5....?=i.l..\.vl ..T...b.... .1.f..7.T.Q....D.;:...1.l.jv..e....n..E....k5>.d.7Q.l..Ba....u.x].......W.C....$.8.v#..y`..F..1aM.8.....w.=\|'..0..T\|..2/..M.%.b.. .tY$!.....5cb.....(.&.-A/mY......./y..o\........Z=.....5c.k._.n3...(W.........Nag+.....O.R.'...5...=?....m...L......:..._V...........z+zc.1`..Q#j.../.Z0...-..F..i.b.F"2.<EE...;.."u?..........R.Z.HR..D...x.Y,.5.Tt.vb...e..YN..sFND+........1.......`.....D.(.&6baP6(.....X.6gNW.6k..9]..v......$Cf.v.v..x@..-J.`G...w..w[..A.......4.msI>....i.......p..F(2b....~H.]J.]..j....F.f-~.@......gg.B.-..Tx.%..pU.u..me....'........;...@7..t.=pN....../_.U8.....r....s...X=g....H........j..c....d._1l:1i..I..T.r..>.....v{Gb...T1*...f.-.x.-i..{..1..h...>..(..3.3..!.$.:.....j.~....:ugv.......%.....?...d..5+......fU.z...X.X.<.c%@fBHO.8.....i..G...{...[..M#.FZk."_.'.n{.

Chrome Cache Entry: 273

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (27303)
Category:	downloaded
Size (bytes):	27466
Entropy (8bit):	4.752060795123139
Encrypted:	false
SSDEEP:
MD5:	4FBD15CB6047AF93373F4F895639C8BF
SHA1:	12D6861075DE8E293265FF6FF03B1F3ADCB44C76
SHA-256:	DDD92F10AD162C7449EFF0ACAF40598C05B1111739587EDB75E5326B6697C5D5
SHA-512:	F8BE32CBA15170319B5C9F663C6F0C4FFDD4083CF047D80F7B214D302B489ECA25FBEE66DDB9366D758A7598EFC9B9A886B02C9F751AE71F207CB9DB1356243A
Malicious:	false
Reputation:	unknown
URL:	https://www.hvacplus.com/skin/frontend/seoinc/hvac/css/font-awesome/css/font-awesome.min.css
Preview:	/!. Font Awesome 4.5.0 by @davegandy - http://fontawesome.io - @fontawesome. * License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License). */@font-face{font-family:'FontAwesome';src:url('../fonts/fontawesome-webfont.eot?v=4.5.0');src:url('../fonts/fontawesome-webfont.eot?#iefix&v=4.5.0') format('embedded-opentype'),url('../fonts/fontawesome-webfont.woff2?v=4.5.0') format('woff2'),url('../fonts/fontawesome-webfont.woff?v=4.5.0') format('woff'),url('../fonts/fontawesome-webfont.ttf?v=4.5.0') format('truetype'),url('../fonts/fontawesome-webfont.svg?v=4.5.0#fontawesomeregular') format('svg');font-weight:normal;font-style:normal}.fa{display:inline-block;font:normal normal normal 14px/1 FontAwesome;font-size:inherit;text-rendering:auto;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale}.fa-lg{font-size:1.33333333em;line-height:.75em;vertical-align:-15%}.fa-2x{font-size:2em}.fa-3x{font-size:3em}.fa-4x{font-size:4em}.fa-5x{font-size:5em}.fa-fw{width:1.

Chrome Cache Entry: 275

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4426
Entropy (8bit):	4.425753664853671
Encrypted:	false
SSDEEP:
MD5:	A457935D44E224B38FCE6AD4BDD17E2C
SHA1:	7E9FF9A2E4672825B45F44A9A6C0A617A75839BA
SHA-256:	35B89684F3AA93458084A7BBA04EAABD05459B09D940DB3CE47AD86642F8EC01
SHA-512:	5637EC8ECD722172DBA29EB93CD1CA79ABC0AFC78EE2D2B1679630BCF2A370BCEA6807E3A1355C8199413AF8170F0759383CEB03D29B07CE87A9565FC4670E77
Malicious:	false
Reputation:	unknown
Preview:	/*. Magento. . NOTICE OF LICENSE. . This source file is subject to the Academic Free License (AFL 3.0). * that is bundled with this package in the file LICENSE_AFL.txt.. * It is also available through the world-wide-web at this URL:. * http://opensource.org/licenses/afl-3.0.php. * If you did not receive a copy of the license and are unable to. * obtain it through the world-wide-web, please send an email. * to license@magentocommerce.com so we can send you a copy immediately.. . DISCLAIMER. . Do not edit or add to this file if you wish to upgrade Magento to newer. * versions in the future. If you wish to customize Magento for your. * needs please refer to http://www.magentocommerce.com for more information.. . @category Varien. * @package js. * @copyright Copyright (c) 2012 Magento Inc. (http://www.magentocommerce.com). * @license http://opensource.org/licenses/afl-3.0.php Academic Free License (AFL 3.0). /../. @classDescription simple Navigation wit

Static File Info

⊘No static file info

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://www.hvacplus.com

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 193

Chrome Cache Entry: 199

Chrome Cache Entry: 202

Chrome Cache Entry: 204

Chrome Cache Entry: 209

Chrome Cache Entry: 210

Chrome Cache Entry: 211

Chrome Cache Entry: 212

Chrome Cache Entry: 213

Chrome Cache Entry: 214

Chrome Cache Entry: 215

Chrome Cache Entry: 216

Chrome Cache Entry: 217

Chrome Cache Entry: 218

Chrome Cache Entry: 219

Chrome Cache Entry: 221

Chrome Cache Entry: 222

Chrome Cache Entry: 223

Chrome Cache Entry: 225

Chrome Cache Entry: 226

Chrome Cache Entry: 228

Chrome Cache Entry: 229

Chrome Cache Entry: 231

Chrome Cache Entry: 232

Chrome Cache Entry: 236

Chrome Cache Entry: 237

Chrome Cache Entry: 238

Chrome Cache Entry: 239

Chrome Cache Entry: 242

Chrome Cache Entry: 244

Chrome Cache Entry: 245

Chrome Cache Entry: 247

Windows Analysis Report
http://www.hvacplus.com