Edit tour

Windows Analysis Report
https://t.co/DnQEiw4qor

Overview

General Information

Sample URL:	https://t.co/DnQEiw4qor
Analysis ID:	1526007

Detection

Score:	20
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Performs DNS queries to domains with low reputation

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6904 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 7092 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 --field-trial-handle=1928,i,15819190803342787242,11737813605082890678,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 2556 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://t.co/DnQEiw4qor" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

cleanup

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: https://ofttimesscrapie.pro/?encoded_value=223GDT1&sub1=c972573f12b442909030f3cfd46aae04&sub2=&sub3=&sub4=&sub5=15608&source_id=20121&ip=8.46.123.33&domain=www.clicknloader.com

HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.17:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.17:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.68:443 -> 192.168.2.17:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.209.182:443 -> 192.168.2.17:49779 version: TLS 1.2

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 27MB

Networking

Performs DNS queries to domains with low reputation

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: push-visit.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: push-visit.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: push-visit.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: push-visit.xyz

Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /file.html?pmnohklhivng=jjiybomjnazj10000010000of002ygu020940l17w80yq0001 HTTP/1.1Host: abcfiretech.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Referer: https://t.co/DnQEiw4qorAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /326NL2/893G9HD/?sub1=2_1_137982&sub2=328_879_158.51.98.226_21&sub3=1_29q1i9&sub5=29q1i9 HTTP/1.1Host: www.tl2giutrk.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Referer: https://t.co/DnQEiw4qorAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: t.co
Source: global traffic	DNS traffic detected: DNS query: abcfiretech.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: www.tl2giutrk.com
Source: global traffic	DNS traffic detected: DNS query: www.redirectf4st.com
Source: global traffic	DNS traffic detected: DNS query: www.clicknloader.com
Source: global traffic	DNS traffic detected: DNS query: ofttimesscrapie.pro
Source: global traffic	DNS traffic detected: DNS query: virtualpushplatform.com
Source: global traffic	DNS traffic detected: DNS query: use.fontawesome.com
Source: global traffic	DNS traffic detected: DNS query: push-visit.xyz
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.17:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.17:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.68:443 -> 192.168.2.17:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.209.182:443 -> 192.168.2.17:49779 version: TLS 1.2

Source: classification engine

Classification label: sus20.troj.win@19/21@34/201

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 --field-trial-handle=1928,i,15819190803342787242,11737813605082890678,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://t.co/DnQEiw4qor"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 --field-trial-handle=1928,i,15819190803342787242,11737813605082890678,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Extra Window Memory Injection	1 Extra Window Memory Injection	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
push-visit.xyz	20.50.64.3	true	true	unknown
a.nel.cloudflare.com	35.190.80.1	true	false	unknown
t.co	172.66.0.227	true	false	unknown
www.tl2giutrk.com	34.98.114.148	true	false	unknown
www.clicknloader.com	188.114.96.3	true	false	unknown
www.google.com	172.217.18.100	true	false	unknown
ofttimesscrapie.pro	188.114.96.3	true	false	unknown
virtualpushplatform.com	104.21.67.146	true	false	unknown
abcfiretech.com	130.185.239.18	true	false	unknown
www.redirectf4st.com	172.67.130.219	true	false	unknown
use.fontawesome.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Reputation
http://www.tl2giutrk.com/326NL2/893G9HD/?sub1=2_1_137982&sub2=328_879_158.51.98.226_21&sub3=1_29q1i9&sub5=29q1i9	false	unknown
https://ofttimesscrapie.pro/?encoded_value=223GDT1&sub1=c972573f12b442909030f3cfd46aae04&sub2=&sub3=&sub4=&sub5=15608&source_id=20121&ip=8.46.123.33&domain=www.clicknloader.com	false	unknown
http://abcfiretech.com/file.html?pmnohklhivng=jjiybomjnazj10000010000of002ygu020940l17w80yq0001	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.184.195	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
108.177.15.84	unknown	United States	15169	GOOGLEUS	false
172.67.142.245	unknown	United States	13335	CLOUDFLARENETUS	false
34.98.114.148	www.tl2giutrk.com	United States	15169	GOOGLEUS	false
130.185.239.18	abcfiretech.com	Bulgaria	32181	ASN-GIGENETUS	false
142.250.185.110	unknown	United States	15169	GOOGLEUS	false
172.67.130.219	www.redirectf4st.com	United States	13335	CLOUDFLARENETUS	false
20.50.64.3	push-visit.xyz	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	true
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.185.142	unknown	United States	15169	GOOGLEUS	false
104.21.27.152	unknown	United States	13335	CLOUDFLARENETUS	false
188.114.96.3	www.clicknloader.com	European Union	13335	CLOUDFLARENETUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
172.66.0.227	t.co	United States	13335	CLOUDFLARENETUS	false
172.217.16.195	unknown	United States	15169	GOOGLEUS	false
104.21.67.146	virtualpushplatform.com	United States	13335	CLOUDFLARENETUS	false
172.217.18.100	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.17

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1526007
Start date and time:	2024-10-04 16:37:51 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://t.co/DnQEiw4qor
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	SUS
Classification:	sus20.troj.win@19/21@34/201

Warnings

Exclude process from analysis (whitelisted): TextInputHost.exe
Excluded IPs from analysis (whitelisted): 172.217.16.195, 108.177.15.84, 142.250.185.142, 34.104.35.123
Excluded domains from analysis (whitelisted): clients2.google.com, accounts.google.com, edgedl.me.gvt1.com, slscr.update.microsoft.com, clientservices.googleapis.com, clients.l.google.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: https://t.co/DnQEiw4qor

LLM Input / Output

Input	Output
URL: https://ofttimesscrapie.pro/?encoded_value=223GDT1&sub1=c972573f12b442909030f3cfd46aae04&sub2=&sub3=&sub4=&sub5=15608&source_id=20121&ip=8.46.123.33&domain=www.clicknloader.com Model: jbxai	{ "brand":["TRACK 'RACf O"], "contains_trigger_text":true, "trigger_text":"Package stuck in depot, waiting for shipping payment", "prominent_button_name":"Confirm", "text_input_field_labels":["unknown"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

Input

Output

URL: https://ofttimesscrapie.pro/?encoded_value=223GDT1&sub1=c972573f12b442909030f3cfd46aae04&sub2=&sub3=&sub4=&sub5=15608&source_id=20121&ip=8.46.123.33&domain=www.clicknloader.com Model: jbxai

{
"brand":["TRACK 'RACf O"],
"contains_trigger_text":true,
"trigger_text":"Package stuck in depot,
 waiting for shipping payment",
"prominent_button_name":"Confirm",
"text_input_field_labels":["unknown"],
"pdf_icon_visible":false,
"has_visible_captcha":false,
"has_urgent_text":false,
"has_visible_qrcode":false}

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 4 13:38:42 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9841581833607034
Encrypted:	false
SSDEEP:
MD5:	F2E450E5B4C51719FCD828A5EEFDAF39
SHA1:	4DA07449942108D1C0D1E7B2E2FB8783653D37F9
SHA-256:	898F1CDFE9E89D6C36144D601B0BBA7D174D17EA1F0F8DDEB7F81687A8D57C91
SHA-512:	928EE5804011E999E09643D0058207CF6B2FADAC5C6F1E58D00ED9D68581E4CEB1501A9AAA6A083CD608345B672833F62DB95162E3E855027855B1F1564C0A68
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......#.k.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.IDY.t....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VDY.t....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VDY.t....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VDY.t...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VDY.t...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........C6.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 4 13:38:42 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9990566907633878
Encrypted:	false
SSDEEP:
MD5:	F557ADED66377E3898065DFBBBB1EB29
SHA1:	6A00363B3DE5D4F1091510EA21A2EF6FD22C0EF9
SHA-256:	C51B10810E430972007BF5256D6CAB6C240D09DB32B88FD73E48854F02B89E51
SHA-512:	D930E9A5DAA3DACC7CDC5C8031BA450341B3458009FA6F3FE80658788C1C19AAFB9246D16BEDF427073506F277532E399281D1FCF8B39B24A55DEE1349C00684
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,........k.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.IDY.t....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VDY.t....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VDY.t....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VDY.t...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VDY.t...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........C6.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:54:41 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.011684992701199
Encrypted:	false
SSDEEP:
MD5:	75711B944E12B9CB782FAED76C3390A7
SHA1:	FFD3FBBCF69613EEE9F2C6740A346795DC543E71
SHA-256:	7B08D5AAFDA701BA394ADF4D952344AACF4380C9CD9BDE42ED8599D808769846
SHA-512:	AAC161D16054F8DAF007180DA5C1491CBBB59658FD107D03129F6D432125124AE1B8C78273E4F71E39F3FC8815D2968BCF039A350790929A2AC69AAF1EFEA665
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....v. ;.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.IDY.t....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VDY.t....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VDY.t....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VDY.t...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VFW.N...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........C6.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 4 13:38:42 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9969485146776744
Encrypted:	false
SSDEEP:
MD5:	485F24035FFFA5DB60658DE4E00CC0D9
SHA1:	D721C6F0F11D96489E3B72938FC45DB417D4DABD
SHA-256:	376277D7987206047207A3B4101F053617CDFF8ECA1FFBB53D113F5C37D152F7
SHA-512:	4851950A3C79C7750AF74CCF64F055CE9B40F48A59D6372EFF79252E9E00448C5B38B6EF3779F901137DA5F5FBAF01FA2CE08246E53DAB180FDF4C54685CB752
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....us..k.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.IDY.t....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VDY.t....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VDY.t....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VDY.t...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VDY.t...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........C6.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 4 13:38:42 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9880399215950013
Encrypted:	false
SSDEEP:
MD5:	06876B418223C070405069FED5DC414F
SHA1:	1102D63BDEAC94F0F50827B358C3E6AFECDB459B
SHA-256:	81546D00678565C966EC9567F1F78C9FA14E8B12727E30300632C608FEBD8F30
SHA-512:	143CF6C10C783081B3BB541A5CE6848E6129F9DF7E2847A9444BAE52EE24917CAC72B51B848A677F84A813ECF5800839CE74C764B73A7CD5C909988FF52FF0EE
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,........k.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.IDY.t....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VDY.t....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VDY.t....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VDY.t...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VDY.t...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........C6.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 4 13:38:42 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9958442878214906
Encrypted:	false
SSDEEP:
MD5:	D48762F74D2C6D629425FD4DDAD5A7AC
SHA1:	64B3F1C4FDA039ACA42B5035E51CFD7BBE839F6A
SHA-256:	0934AC28FB18A6755B8CEA40AED507A7E6220E719192548CF4265B3C27A819DB
SHA-512:	02A478537E55F9366FE7A33F2CE5CA01E542F494EC58B53264DD483FD8B6523089C114B564E737AC9CAF10520E22587326C2A81A55C7FB351B7B5904C1824AA4
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....P...k.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.IDY.t....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VDY.t....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VDY.t....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VDY.t...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VDY.t...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........C6.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2087)
Category:	downloaded
Size (bytes):	9893
Entropy (8bit):	5.320768083612627
Encrypted:	false
SSDEEP:
MD5:	E1BBDDE3DA7E752B53670EDFBC2AC0B6
SHA1:	3596BA7A911A76EBCFCB3DB9A17D32363C75788D
SHA-256:	3C84B28386C5C3620305387766021AB72864D3A9216B716CE0C70B9EFA11A1DA
SHA-512:	8813D2006E7292E6F6188398AC00C1509D3EF20E79DE088E166BE7FC3F45A4FB1647496E78E02F61F56D402DBAC0D73FCB6F643FECF628FD392204DAC4225AFF
Malicious:	false
Reputation:	unknown
URL:	https://virtualpushplatform.com/ace-push.js
Preview:	let baseUrl='',visitBaseUrl='',userId,postfix='',hasLoaded=false,subscriptionSuccess=false,errorCode=0,visit,safariLoaded=false;const setPostFix=(val)=>postfix=val;function initializeAcePush(pushAccountGuid=''){if(pushAccountGuid)localStorage.setItem("accGuid",pushAccountGuid?.toLowerCase());if(document.readyState==='complete'){mainInitializer().then(()=>console.log('ready'));}else{document.addEventListener('DOMContentLoaded',mainInitializer);window.onload=mainInitializer;}}.const mainInitializer=async(e)=>{var pushAccountGuid=localStorage.getItem("accGuid");if(hasLoaded\|\|!pushAccountGuid)return;hasLoaded=true;visit={pushAccountGuid:pushAccountGuid,domain:window.location.origin,userGuid:localStorage.getItem("userId")?localStorage.getItem("userId"):'',pathName:window.location.pathname,params:window.location.search};try{setBaseUrl();visit.browserId=getBrowserId();visit.isMobile=isMobile();visit.userAgent=navigator.userAgent;visit.language=navigator.language;visit.platform=navigator.platf

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1684 x 551, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	78542
Entropy (8bit):	7.9232301611256215
Encrypted:	false
SSDEEP:
MD5:	82C104DE86667C2B15A9586EEB4A3145
SHA1:	3C96B92F06699772590E8A83739AA37BE19BFE3A
SHA-256:	668C19383725720F06B04EA4AD62D93C56D0C9B68AE91CDCEF0828318B9705AE
SHA-512:	7BE8D30F762E04380366F1CB5972F64A03C3B248E7788EA7D7034AC867D68E6AFADF3C3DB0F174372CA6A48043B606937E46E26466146AB89DEDB060C40B0ECB
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......'......H.e....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 21.0 (Windows)" xmp:CreateDate="2022-05-02T15:58:37+08:00" xmp:ModifyDate="2024-02-06T19:31:14+08:00" xmp:MetadataDate="2024-02-06T19:31:14+08:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:8429c321-d010-7442-8a71-206544727440" xmpMM:DocumentID="adobe:docid:photoshop:7b8b9d54-ef00-7843-8e3d-f48f16a1584c"

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	10270
Entropy (8bit):	7.867101100579872
Encrypted:	false
SSDEEP:
MD5:	11C6A53B4E028D2CA36BDBB0F46F12D7
SHA1:	170B3977139D27791F2C281B6A235793B455F678
SHA-256:	158DF9E156E7522DB3CCA6577A212582E0764C9F749BBC39EDADBB75782DE21C
SHA-512:	B3312A07DA96FCA8A5619C29B3CDCF097053FFB3D86B6A9ADB41FF0C7EDE1E625CAD7859EDD2972EA9F9FB2B2E7C7252DF240AD0E52E7243C3519C6B7DBB11AF
Malicious:	false
Reputation:	unknown
URL:	https://ofttimesscrapie.pro/images/check.png
Preview:	.PNG........IHDR..............>a.....pHYs................kiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)" xmp:CreateDate="2020-04-04T18:22:38+07:00" xmp:ModifyDate="2024-01-22T18:15:22+08:00" xmp:MetadataDate="2024-01-22T18:15:22+08:00" xmpMM:InstanceID="xmp.iid:658d80e7-0560-3e43-99e1-db7cd60b139a" xmpMM:DocumentID="adobe:docid:photoshop:b63fd44b-7988-11ea-a361-a4335e20310d" xmpMM:OriginalDocumentI

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	15071
Entropy (8bit):	4.88642628490906
Encrypted:	false
SSDEEP:
MD5:	58C942A1D03F93C3EE99A709E03DDF54
SHA1:	52E21A8F0D44189BE30758629ABE1BA1B07429F5
SHA-256:	11F105A08E89103402777A983B6D8F88CC66C7706F95A348719D70FFE3ADADA3
SHA-512:	528D3899AC994AB626F84098DB454EF9B7973D91C569025989DDB5A22B3BB5F3B423EA7A13B2EAC957B394C2E410CE592A192A1E251D6F0CE3058BC1339B3202
Malicious:	false
Reputation:	unknown
URL:	https://ofttimesscrapie.pro/css/style.css
Preview:	body{.. font-family: "Poppins", sans-serif;.. padding: 0;.. margin: 0;.. width: 100%;.. height: 100%;.. min-height: 100%;.. background-color: #eeeeee;.. /* background-image: linear-gradient(165deg, #e4b100,#ffffff); /.. / background-image: url('../images/baagl.jpg'); /.. background-repeat: no-repeat;.. background-size: cover;.. color: #353535;..}.....fview{.. position: relative;.. z-index: 0;.. height: 100vh;..}.......container{.. max-width: 450px;.. margin: auto;..}.....container-head{.. padding: .1rem 0 0 0;.. text-align: center;..}.....container-head-button {.. padding: .5rem 0 0 0;.. text-align: center;..}.....container-head img{.. max-width: 200px;.. margin: auto;..}....p{.. font-size: 19px;..}....button{.. width: 100%;.. max-width: 320px;.. padding: 15px 20px;.. background-color: #351c15;.. box-shadow: 0px 0px 15px 5px rgb(0 0 0 / 20%);.. border: none;.. / border-radius: 999px; */..

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (479), with no line terminators
Category:	downloaded
Size (bytes):	479
Entropy (8bit):	5.099569759865294
Encrypted:	false
SSDEEP:
MD5:	A03E833C50B9B5338C8FEAD76A8BCBC3
SHA1:	E5A4AA30637B2C3BA66313747F8EEB3914F9417D
SHA-256:	7B8153BB141B7FEACD16B40641288A017AFC844A2FAFF63AC28472217AC329B0
SHA-512:	F55F5BE56DD6E8C471032EDD9A3919D6E82A7832A56B4883BBDABACD86DCC09DB20817F315356DAC37B8DE4CC62F7D39891A679F62BA7C6AE73AE88817EB536A
Malicious:	false
Reputation:	unknown
URL:	https://t.co/DnQEiw4qor
Preview:	<head><meta name="referrer" content="always"><noscript><META http-equiv="refresh" content="0;URL=http://abcfiretech.com/file.html?pmnohklhivng=jjiybomjnazj10000010000of002ygu020940l17w80yq0001"></noscript><title>http://abcfiretech.com/file.html?pmnohklhivng=jjiybomjnazj10000010000of002ygu020940l17w80yq0001</title></head><script>window.opener = null; location.replace("http:\/\/abcfiretech.com\/file.html?pmnohklhivng=jjiybomjnazj10000010000of002ygu020940l17w80yq0001")</script>

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65350)
Category:	downloaded
Size (bytes):	1196706
Entropy (8bit):	4.2942692242496445
Encrypted:	false
SSDEEP:
MD5:	5E29440867FDB02A48DFFDED02338C31
SHA1:	C8BFBBFCA7EB327E2E98CAF637D6DE05E5EE737A
SHA-256:	812AB0E46F86B2CE98AB2425AB2224B90D0845952A1AC0D5ABD734B6217E98BF
SHA-512:	4E7DA6D13229815C93CF3BE6C4B36EA9B4891F724FF239BE0B2DE1BC7AD6EE77530DC275C399818A4B2A0C16FC1A913692C92D16F0C1FF2919D260E9B198F6D3
Malicious:	false
Reputation:	unknown
URL:	https://use.fontawesome.com/releases/v5.15.4/js/all.js
Preview:	/!. Font Awesome Free 5.15.4 by @fontawesome - https://fontawesome.com. * License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License). */.!function(){"use strict";var c={},l={};try{"undefined"!=typeof window&&(c=window),"undefined"!=typeof document&&(l=document)}catch(c){}var h=(c.navigator\|\|{}).userAgent,a=void 0===h?"":h,z=c,v=l,m=(z.document,!!v.documentElement&&!!v.head&&"function"==typeof v.addEventListener&&v.createElement,~a.indexOf("MSIE")\|\|a.indexOf("Trident/"),"___FONT_AWESOME___"),e=function(){try{return!0}catch(c){return!1}}();var s=z\|\|{};s[m]\|\|(s[m]={}),s[m].styles\|\|(s[m].styles={}),s[m].hooks\|\|(s[m].hooks={}),s[m].shims\|\|(s[m].shims=[]);var t=s[m];function M(c,a){var l=(2<arguments.length&&void 0!==arguments[2]?arguments[2]:{}).skipHooks,h=void 0!==l&&l,z=Object.keys(a).reduce(function(c,l){var h=a[l];return!!h.icon?c[h.iconName]=h.icon:c[l]=h,c},{});"function"!=typeof t.hooks.addPack\|\|h?t.styles[c]=function(z){for(var c=1;c

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	147
Entropy (8bit):	4.7008179873358165
Encrypted:	false
SSDEEP:
MD5:	214349946705960CFE67BEDAF33557FD
SHA1:	9913FDF6E3A598AB77C67A9FEA25350C5240E796
SHA-256:	F01E80D938B5EF8A342CB62ED6E4C7DFA34B5E64E4EA511CB5231A9B0B266B1D
SHA-512:	7615AECA81B8BB4A102BCB0032922EF61FD6CA51F1D61D1EFA7990C34F58780BE48863E6D5E7FE4F6263AF602F64E4BD4EF0B66183936CD1A9FEE14BA5EB5732
Malicious:	false
Reputation:	unknown
URL:	https://ofttimesscrapie.pro/md-service-worker.js
Preview:	'use strict';..let baseUrl = 'https://virtualpushplatform.com';.importScripts('https://virtualpushplatform.com' + '/md-service-worker-content.js');

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 452 x 302
Category:	downloaded
Size (bytes):	109494
Entropy (8bit):	7.8746941932138474
Encrypted:	false
SSDEEP:
MD5:	F39EC33F8E63AA394EF898EFFF0D3969
SHA1:	DF50325585B0582FE435CFB0206B851D4B1C0105
SHA-256:	A09A57DB981B13C71AC6A6F4C966656994CEF24C3CEBFBD816FE1FA5AF8C1065
SHA-512:	00BD22876A4FFCAB815CD9AF7EA543B77F6D2BBBC35D4A2CC45C2C3DED0C5DBF48746AFA15700BDF9CFAA7D9FB18E440DEE51B7D3FBC9229EC60FD98897932E4
Malicious:	false
Reputation:	unknown
URL:	https://ofttimesscrapie.pro/images/loading.gif
Preview:	GIF89a.......................cPJ...5..6..:!.=%.D-&P:4ZF@lZUve`....uq.......................................!..NETSCAPE2.0.....!.......,...........`&.di.h..l.p,.tm.x..\|....pH,...r.l:..tJ.Z..v..z..xL....z.n...\|N.....~........................................................................................................................................H......\....#J.H....3j.... C..I...(S..\...0c.I...8s...'....0H...Q..,Lh`..S.He.p.j...P..(VU.$t........5K..V.d.....].."......{..X.W...O.L(..p.....} .q(...H.`Y....t.......E].lwB.Q..>@.:....D....n...&...........rP...x..3...?UPK<;..\.{7\|}\|..d).........v}......o..U.~J..._&.9E...........}.Vr_W.E8..].f!%cmH..]I..$.6U.t.........8XU~0...56.`U.....\...SVA(."...HWJ*r..M".dU.D...Uihe!.p5...eUc`..e....f j...W4...W...U....Wy....~.iU....f.w..h...:..U...]Z..u`.....1eb...d....h.l$.j.DVe.n\|...p..T....b.n...........b.k.h......a.g......1!W.f...O..-..>..]([T..zQ.S..U.+/...z...=....Z..X.7.z.k..U.%..xV..0..%..NX7

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1684 x 387, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	53086
Entropy (8bit):	7.886608612585753
Encrypted:	false
SSDEEP:
MD5:	3A72DCBECCB52F82840FF280A6AFDB05
SHA1:	1F0AA7E26C87515CE83CA44F794A7E25D350C675
SHA-256:	97F53F1905052FCCE8B5496AFEEA1CC3E1BA1407E052F04682BE81D09B690562
SHA-512:	ABAAB9427EFEA485F185C007514A3C895F52A41B81E0EBD25D9217730D70490C01A29BA87685B1BF045669B489C3D9FAD9EAA77F3D378D497A5931B77C5839BF
Malicious:	false
Reputation:	unknown
URL:	https://ofttimesscrapie.pro/images/logopp.png
Preview:	.PNG........IHDR.............%-......pHYs................:iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 21.0 (Windows)" xmp:CreateDate="2022-05-02T15:58:37+08:00" xmp:ModifyDate="2024-02-06T19:30:59+08:00" xmp:MetadataDate="2024-02-06T19:30:59+08:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:4701c373-b4f7-9f4e-8370-dde9b183fa0a" xmpMM:DocumentID="adobe:docid:photoshop:7b8b9d54-ef00-7843-8e3d-f48f16a1584c"

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	13488
Entropy (8bit):	4.874696151840685
Encrypted:	false
SSDEEP:
MD5:	3AB05E26F5BDCD56D77D2B195BE0C644
SHA1:	A9A42E1DA8A5DF1561C06B5EE26C8C6BA314A6B3
SHA-256:	2D52B22D335024AA0EFBA1DD0A13EBDAC87329BF27B3F0B6D7BBA7A2522EED33
SHA-512:	D035FE7623E2CF04E99850883A2E0BA5D1D08709046676CB01C5FE733A9185C5B870B417CE95102CD3C0A2EA9C6AA9120D7AA797D0090E0D11F2DE21B6DDB916
Malicious:	false
Reputation:	unknown
Preview:	document.getElementById('q1-2').addEventListener("click",function(){.. document.getElementById('q1-2').style.display = "none";.. document.getElementById('q1-2').style.opacity = "0";.. document.getElementsByClassName('question__error')[0].classList.remove("hidden");.. document.getElementById('q1-2').checked = false;..},false);............document.getElementById('confirm_popmessage').addEventListener("click",function(){.. document.getElementsByClassName("fview")[0].classList.add("fadeOut"); .... document.getElementsByClassName("pop-message-div")[0].classList.remove("infinite"); .. document.getElementsByClassName("pop-message-div")[0].classList.remove("pulse"); .. document.getElementsByClassName("pop-message-div")[0].classList.remove("slower"); .. .. document.getElementsByClassName("flx-step-fnt")[0].style.display = "none";.... document.getElementById("pop-message-con").classList.add("fadeOut"); .. .. window.setTimeout(function () { .. documen

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 449 x 361, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	212198
Entropy (8bit):	7.9890094303968056
Encrypted:	false
SSDEEP:
MD5:	D33BD0635F2A373C686B1F4FF1636E28
SHA1:	6A273355A9D22D8564D7F4BBFAEC1A9636AB87E7
SHA-256:	0B1E3F520732D85B3EF94866C75FED54B83A92A43738E7B4DF6ADDB9EE2E4789
SHA-512:	0AF4DFE20AF4EBE772359DC757070CD6F3886D45A967D65527BF9F3659CFAA9760CCD12F5C1A12CA776A0E616E069B960465E412AE9139C34970F36329545FE7
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......i.....k..<....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmp:CreatorTool="Adobe Photoshop 22.1 (Windows)" xmp:CreateDate="2022-05-02T15:58:37+08:00" xmp:ModifyDate="2024-01-22T18:00:15+08:00" xmp:MetadataDate="2024-01-22T18:00:15+08:00" xmpMM:InstanceID="xmp.iid:6bdfa8b9-fafa-5f4e-834b-cbb44bd982fa" xmpMM:DocumentID="adobe:docid:photoshop:c6a67420-b254-9c4f-860d-81181cd2b11c" xmpMM:OriginalDocumentID="

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (57919), with CRLF line terminators
Category:	downloaded
Size (bytes):	58139
Entropy (8bit):	5.096901052268529
Encrypted:	false
SSDEEP:
MD5:	43D6B8FDF324505F0CEB7EA698D0B7A5
SHA1:	5FAB2FF7884F74BEB235AE1382A647CBD4491F3A
SHA-256:	4C055E6D0D9BA2B8F1BE4719110E92C1B9499ED0759F0D1C48FCCD16A7B31DCF
SHA-512:	721DE0C161BFCF9FD7D8DC964C5FFBBBF5F183D90C69AF9E38F93AF3805F339FC6F576E36F9D923FBC7EB0A3C66FDE0F2548266AC5CF6C9BE298F090C2E46331
Malicious:	false
Reputation:	unknown
URL:	https://ofttimesscrapie.pro/css/animate.min.css
Preview:	@charset "UTF-8";..../!.. animate.css -https://daneden.github.io/animate.css/.. * Version - 3.7.2.. * Licensed under the MIT license - http://opensource.org/licenses/MIT.. .. Copyright (c) 2019 Daniel Eden.. */....@-webkit-keyframes bounce{0%,20%,53%,80%,to{-webkit-animation-timing-function:cubic-bezier(.215,.61,.355,1);animation-timing-function:cubic-bezier(.215,.61,.355,1);-webkit-transform:translateZ(0);transform:translateZ(0)}40%,43%{-webkit-animation-timing-function:cubic-bezier(.755,.05,.855,.06);animation-timing-function:cubic-bezier(.755,.05,.855,.06);-webkit-transform:translate3d(0,-30px,0);transform:translate3d(0,-30px,0)}70%{-webkit-animation-timing-function:cubic-bezier(.755,.05,.855,.06);animation-timing-function:cubic-bezier(.755,.05,.855,.06);-webkit-transform:translate3d(0,-15px,0);transform:translate3d(0,-15px,0)}90%{-webkit-transform:translate3d(0,-4px,0);transform:translate3d(0,-4px,0)}}@keyframes bounce{0%,20%,53%,80%,to{-webkit-animation-timing-function:cubic

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1301)
Category:	downloaded
Size (bytes):	4186
Entropy (8bit):	4.992425400219135
Encrypted:	false
SSDEEP:
MD5:	A039CF921197E7D7FC55F91381931C9C
SHA1:	6B0F2BDF4383B05C4BAB383D4BB0031865B0042E
SHA-256:	A26CD1F11C52B3D369A64DB3026165F5109C51875F971F8459878F4E070637FA
SHA-512:	6D3EA3D821A81A255C476D6BB51394C18470C7A9234A66261587ABB7C024D5AA27A7C15A0895CF0DCC92AD56B274C1303650FB2EDD57D0AB29B69C9D0C7B0E93
Malicious:	false
Reputation:	unknown
URL:	https://virtualpushplatform.com/md-service-worker-content.js
Preview:	let dbVersion=2;let displayStatus=4;let clickStatus=5;let nextSendoutDateKeyName='nextSendoutDate';self.addEventListener('install',function(event){event.waitUntil(self.skipWaiting());});self.addEventListener('activate',function(event){event.waitUntil(self.clients.claim());});self.addEventListener('push',function(event){if(event.data){let payload=event.data.json();if(!payload.image\|\|!payload.image.includes('http'))delete payload.image;if(!payload.badge\|\|!payload.badge.includes('http'))delete payload.badge;if(!payload.icon\|\|!payload.icon.includes('http'))delete payload.icon;event.waitUntil(self.registration.showNotification(payload.title,payload));payload.data.status=displayStatus;event.waitUntil(addStat(payload.data));if(payload.data.taboolaVisibleUrl){event.waitUntil(updateTaboolaVisible(payload.data.taboolaVisibleUrl));}}});self.addEventListener('notificationclick',function(event){event.notification.close();event.waitUntil(clients.openWindow(event.notification.data.clickLink));event.n

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	555
Entropy (8bit):	4.741093475929192
Encrypted:	false
SSDEEP:
MD5:	1F2D48C4FF4E64B6CD52DCC195661137
SHA1:	4027FD733385BE485C946A2CFF56D950028B5D15
SHA-256:	3365FD5BCCA6DB3766CF099D5BBB74DC8DB7FAE302C30FA6BDF43EEDDAF98742
SHA-512:	70D039A2C59AB4DA2F6FF1B4EA18338C4A4C539972F4127CBA1105E635722E1483FCD63CCF4262E2268511C91B7E31198367157743D0CB9856764FF2BAA558D9
Malicious:	false
Reputation:	unknown
URL:	https://ofttimesscrapie.pro/favicon.ico
Preview:	<html>..<head><title>404 Not Found</title></head>..<body>..<center><h1>404 Not Found</h1></center>..<hr><center>nginx/1.27.0</center>..</body>..</html>.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->..

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (328), with CRLF line terminators
Category:	downloaded
Size (bytes):	17533
Entropy (8bit):	3.802662704494595
Encrypted:	false
SSDEEP:
MD5:	0BE53146CD7082EB72FFA6698B1539E1
SHA1:	61D6D81B21E73FD99C54987A28660C9C25EC6CCE
SHA-256:	DA41938F706677C7EBCC766AEB3429A4853584F015EDF3C4EBDB2E9A902A250C
SHA-512:	BDCDB837DF80D8C1DAF3A25A5BCCA041B848E8ACBED0E4F718FA8C3B2DE332A3D33AD27B0AB11B94EB99BE5538775487DC6186375FF375DFD55ECEDB0D78AA25
Malicious:	false
Reputation:	unknown
URL:	https://ofttimesscrapie.pro/?encoded_value=223GDT1&sub1=c972573f12b442909030f3cfd46aae04&sub2=&sub3=&sub4=&sub5=15608&source_id=20121&ip=8.46.123.33&domain=www.clicknloader.com
Preview:	<!DOCTYPE html>..<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">.. <head>.. <meta charset="UTF-8">.. <meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1.0">.. <title>(1) Notification</title>.. <link rel="stylesheet" href="./css/style.css">.. <link rel="stylesheet" href="./css/animate.min.css">.. <script defer src="https://use.fontawesome.com/releases/v5.15.4/js/all.js".. integrity="sha384-rOA1PnstxnOBLzCLMcre8ybwbTmemjzdNlILg8O7z1lUkLXozs4DHonlDtnE7fpc".. crossorigin="anonymous"></script>......<script src="https://virtualpushplatform.com/ace-push.js"></script>..<script>.. initializeAcePush('6ec829a0-2d9d-4e84-8ae5-84dd942bbd6e');..</script>.. <script>.. function ddddtttss(ddd) {.. var mydate = new Date();.. mydate.setDate(mydate.getDate()-ddd);.. var year = mydate.ge

Static File Info

⊘No static file info

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://t.co/DnQEiw4qor

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 104

Chrome Cache Entry: 106

Chrome Cache Entry: 84

Chrome Cache Entry: 85

Chrome Cache Entry: 86

Chrome Cache Entry: 87

Chrome Cache Entry: 88

Chrome Cache Entry: 89

Chrome Cache Entry: 92

Chrome Cache Entry: 93

Chrome Cache Entry: 94

Chrome Cache Entry: 96

Chrome Cache Entry: 97

Chrome Cache Entry: 98

Chrome Cache Entry: 99

Static File Info

Windows Analysis Report
https://t.co/DnQEiw4qor