Edit tour

Windows Analysis Report
http://jtmidgett.law/CaptRedr.html

Overview

General Information

Sample URL:	http://jtmidgett.law/CaptRedr.html
Analysis ID:	1431513
Infos:

Detection

HTMLPhisher

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Phishing site detected (based on favicon image match)

Yara detected HtmlPhish54

Phishing site detected (based on image similarity)

Found iframes

HTML body contains low number of good links

HTML page contains hidden URLs or javascript code

HTML title does not match URL

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 3808 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://jtmidgett.law/CaptRedr.html MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3532 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1916,i,8087388674922558939,13543690018974928786,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author
3.10.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
3.10.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
4.11.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
4.13.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 25 Apr 2024 09:23:46 GMTServer: ApacheContent-Length: 315Keep-Alive: timeout=5, max=99Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 23.216.73.151:443 -> 192.168.2.16:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.216.73.151:443 -> 192.168.2.16:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.16:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.16:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.28.21:443 -> 192.168.2.16:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.28.21:443 -> 192.168.2.16:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.200:443 -> 192.168.2.16:49774 version: TLS 1.2

Source: classification engine

Classification label: mal76.phis.win@16/32@32/134

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://jtmidgett.law/CaptRedr.html
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1916,i,8087388674922558939,13543690018974928786,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1916,i,8087388674922558939,13543690018974928786,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Drive-by Compromise	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
http://jtmidgett.law/CaptRedr.html	5%	Virustotal		Browse
http://jtmidgett.law/CaptRedr.html	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Link
jtmidgett.law	5%	Virustotal	Browse
api.hcaptcha.com	0%	Virustotal	Browse
js.hcaptcha.com	0%	Virustotal	Browse
imgs3.hcaptcha.com	0%	Virustotal	Browse
newassets.hcaptcha.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://jtmidgett.law/favicon.ico	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
f69c5d00-0d2ab89d.carolscritters.com	159.65.82.236	true	false		unknown
11dd826a-0d2ab89d.carolscritters.com	159.65.82.236	true	false		unknown
jtmidgett.law	162.241.120.242	true	true	5%, Virustotal, Browse	unknown
js.hcaptcha.com	104.18.124.91	true	false	0%, Virustotal, Browse	unknown
api.hcaptcha.com	104.18.124.91	true	false	0%, Virustotal, Browse	unknown
8f8f984b-0d2ab89d.carolscritters.com	159.65.82.236	true	false		unknown
office.carolscritters.com	159.65.82.236	true	false		unknown
www.google.com	172.217.215.147	true	false		high
imgs3.hcaptcha.com	104.18.124.91	true	false	0%, Virustotal, Browse	unknown
newassets.hcaptcha.com	104.18.125.91	true	false	0%, Virustotal, Browse	unknown
l1ve.carolscritters.com	159.65.82.236	true	false		unknown
345c45a6-0d2ab89d.carolscritters.com	159.65.82.236	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://jtmidgett.law/CaptRedr.html	true		unknown
https://newassets.hcaptcha.com/captcha/v1/b1c589a/static/hcaptcha.html#frame=checkbox&id=0ybn7q1nrtas&host=jtmidgett.law&sentry=true&reportapi=https%3A%2F%2Faccounts.hcaptcha.com&recaptchacompat=true&custom=false&hl=en&tplinks=on&pstissuer=https%3A%2F%2Fpst-issuer.hcaptcha.com&sitekey=27a0966c-4e96-43eb-b48c-f3a59f849e8f&theme=light&origin=http%3A%2F%2Fjtmidgett.law	false		unknown
https://f69c5d00-0d2ab89d.carolscritters.com/Prefetch/Prefetch.aspx	false		unknown
https://office.carolscritters.com/?fMwf=ifB8D&sso_reload=true	true		unknown
https://newassets.hcaptcha.com/captcha/v1/b1c589a/static/hcaptcha.html#frame=challenge&id=0ybn7q1nrtas&host=jtmidgett.law&sentry=true&reportapi=https%3A%2F%2Faccounts.hcaptcha.com&recaptchacompat=true&custom=false&hl=en&tplinks=on&pstissuer=https%3A%2F%2Fpst-issuer.hcaptcha.com&sitekey=27a0966c-4e96-43eb-b48c-f3a59f849e8f&theme=light&origin=http%3A%2F%2Fjtmidgett.law	false		unknown
http://jtmidgett.law/favicon.ico	false	Avira URL Cloud: safe	unknown
https://office.carolscritters.com/?fMwf=ifB8D	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
64.233.177.84	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
142.250.105.94	unknown	United States	15169	GOOGLEUS	false
142.250.9.138	unknown	United States	15169	GOOGLEUS	false
172.217.215.147	www.google.com	United States	15169	GOOGLEUS	false
172.253.124.113	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
104.18.124.91	js.hcaptcha.com	United States	13335	CLOUDFLARENETUS	false
142.250.9.95	unknown	United States	15169	GOOGLEUS	false
142.251.15.94	unknown	United States	15169	GOOGLEUS	false
142.251.15.95	unknown	United States	15169	GOOGLEUS	false
104.18.125.91	newassets.hcaptcha.com	United States	13335	CLOUDFLARENETUS	false
162.241.120.242	jtmidgett.law	United States	46606	UNIFIEDLAYER-AS-1US	true
159.65.82.236	f69c5d00-0d2ab89d.carolscritters.com	United States	14061	DIGITALOCEAN-ASNUS	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1431513
Start date and time:	2024-04-25 11:23:20 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	http://jtmidgett.law/CaptRedr.html
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal76.phis.win@16/32@32/134

Warnings

Exclude process from analysis (whitelisted): svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.105.94, 142.250.9.138, 142.250.9.113, 142.250.9.100, 142.250.9.101, 142.250.9.139, 142.250.9.102, 64.233.177.84, 34.104.35.123, 142.251.15.95, 142.250.9.95, 74.125.136.95, 74.125.138.95, 142.250.105.95, 64.233.185.95, 173.194.219.95, 108.177.122.95, 172.253.124.95, 172.217.215.95, 64.233.176.95, 64.233.177.95
Excluded domains from analysis (whitelisted): fs.microsoft.com, clients2.google.com, accounts.google.com, edgedl.me.gvt1.com, content-autofill.googleapis.com, clientservices.googleapis.com, clients.l.google.com
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 08:23:48 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9918482994208584
Encrypted:	false
SSDEEP:
MD5:	48222014FF7A9D183EE64D147F333AC0
SHA1:	BB45355ACD0EF223464542690795CBFAC9261939
SHA-256:	F5A7C44F736C826A476A05D18F3EB3CF4175BE9182F4C2124EDE1D2D8036F0A9
SHA-512:	3207E92488843CC82640DD9B6074E318712526BB331DE7F6E72CDB5E622BC292809DF005814173999A4A198BBA5ABDFE9F8845B7D324AB37E5F7F6DE1E87DCB7
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....tZZG...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X.J....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.J....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.J....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.J..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.J...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............PE......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 08:23:48 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.005384179581132
Encrypted:	false
SSDEEP:
MD5:	94917E5D06DD78D796A0244C5A17905F
SHA1:	B8A69BE3095D1B7711A7C768259B39AE20425E70
SHA-256:	37BB3AFCB7F0C0642E1B4344A8043F105606263EBE2CA8145F444D2EC92E7D5A
SHA-512:	45F9223ABA84A14D58A9C3AA88896581FC614BB2E5D80E8EDE3D0011E0263692670606378251F87DF396E0A486CF9DE0D3F9441AE0019492ECFA3D9F05782897
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....?oPG...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X.J....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.J....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.J....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.J..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.J...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............PE......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.013574488496079
Encrypted:	false
SSDEEP:
MD5:	B44175E98CBCCEDC0104E050A5823C7E
SHA1:	EC44DE76BE2E23C9E4D5A18C8B1CC6094FCC0C44
SHA-256:	35E0F560F65B78202CFEE61B6A5F9E38772C2819A4F9F47AD37CC159DE101478
SHA-512:	10907FBFE98C015646390F791C0F52321E1B6058617C27700329554DB5FA46F522BF9E8EFD695834B79CDFE11F0AACFA1CD23C6785E64271FAC2F45877C7E124
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X.J....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.J....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.J....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.J..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............PE......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 08:23:48 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	4.005617896190339
Encrypted:	false
SSDEEP:
MD5:	7D0CEF43E80065B4EE1D3CCCB39895DD
SHA1:	ADFCFDD3BFC5FD5680FC06D1D78D9AA8068E807A
SHA-256:	7C63597A36D1441B28AB475F04D5424B6D01640ED422E08A8DC0EC88E856CC6F
SHA-512:	17A9B2A56E453AD980A62775E452DF6CA36DCD3488D78CEA9BF864765CBE1D908D9F437F15ACAFAF93CB0FE6E228C03F5E555B07675A2664B9A817D6FB3E59BA
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......JG...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X.J....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.J....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.J....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.J..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.J...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............PE......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 08:23:48 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9947910322094153
Encrypted:	false
SSDEEP:
MD5:	6DF612F5822F51FB79E0C83DFD7CD4B8
SHA1:	AD0D4604A38291BF224E115A690BF9DC062AD374
SHA-256:	4AD91238E0FF577DD500949472D30CB42DE8555AA5ED9CAAF5188F284D384127
SHA-512:	903A5C006571C794956A0C376B8ADAC16A5B4C83B448FFC1BBF7826644ACAFE92495DAEA791C911852AA411E854BE115DEAA6430478778C68EDAA59D447AB2DF
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......UG...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X.J....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.J....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.J....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.J..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.J...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............PE......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 08:23:48 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.002769725420212
Encrypted:	false
SSDEEP:
MD5:	9EB7EBB691CC6932FB5BB3E2E914982F
SHA1:	517EAE6404F0AEE80C47419617C37EDBE5E3DA21
SHA-256:	DF69EC962D94ACE99BE1356A9B1740DD5322FC48C4EDE6C30DE024AEF4D1838C
SHA-512:	BE1B3D40C31098E3B5729131FBD24749152469C97CA2F8BF6E8E13114DAA4C1F518E02ADF1E372009AD8804F7EB63A8D3369B3811891AFCEE04D86A7198894D9
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....u.AG...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X.J....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.J....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.J....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.J..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.J...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............PE......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.6644977792004623
Encrypted:	false
SSDEEP:
MD5:	0CEF85A06BA488876294077160628616
SHA1:	85ED668F4B9369F661F9F5D07AF7FA56F568471D
SHA-256:	E7196C74A5271AB14B6DB5B0D9F1BD22622CB7FD9F5E426F2A4BB578EC268ABE
SHA-512:	E7F076037848AA802510F6B271EFB46FB09A305D2F5EB3CB873145174275FD7F06498AE11F09827213CFF86A0E5563F44F6477D41775CBE228A81FDE828A76E9
Malicious:	false
Reputation:	unknown
Preview:	Invalid Method

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 141268
Category:	downloaded
Size (bytes):	49619
Entropy (8bit):	7.994859723968257
Encrypted:	true
SSDEEP:
MD5:	A6F4B08F37D30FA8A1EFB2525E18338D
SHA1:	96DE405558A798C8C8B8EAF7F9A27325298D753C
SHA-256:	33977D23F12DFE44A29673148C735F992B6968A7FA5DD192CF341ADA4E986467
SHA-512:	44E366BAC42620E86B7C802AA4446CAD3AEE57BAF591E07BA71B10C44AA6689F3679A4F06BD92C9EADC65F0F7472BF43B2DA473A5CA0DCCEAD873AD644C5EF12
Malicious:	false
Reputation:	unknown
URL:	https://8f8f984b-0d2ab89d.carolscritters.com/shared/1.0/content/js/BssoInterrupt_Core_Ggyc2EJnCaHFrI6xkBPLcg2.js
Preview:	............[.8.8...+.w..OL...;.4....a..e..qb.<...p....O]$[v..g../g...J.T.U.J...+.S......T....J.S.....A......./.......(..q...?...;tc.U..F.?...4..D....\|wR.G.C%...i..)FI\..q...b.>U.P].U..(y....u._@m...@.Q8}.......?..7........OD..{.t_9.GQ.........#....n$.H.0J.....!e.1}....84.....1u.~..~.M...X&.&/u..ie..\|.*IXy.g..Y....x{..;..U.M.f....f,.Gl.dR..<...bl{E<O. ..T."7@......w..."H,@......0..P....p:...[...E].A..g.....q..j4....k...Y.I2....;?....#7.'.(...\\....^8.......B_......?c....+g.!4.r.>.~.>}...Qn0..`.a0...`.b....-. ....g...V..z.........XX..;.U..r.O....5s.n:._.........9.U\|c...Du .$L^..~.....P2.@[....Z....^E7....t..W...bZ..4:..(...U.k%PeU\%7..?&.0Z].Aw:3.RsV...qR5..\v.y.[.....N........UpcF".EA...@...q..;...v`M.%3....#..,DMLTY+..g........d+.>...{{.&N/...-#F...p.......Xq.(.....}....O..H=.".......p...tM....!...0...T.m.;...$D.N".)..!W.V....r\.... ...&....J\|."Nd.D:uw:..T.+...H&.Z...L=..U.v..ma.f:\......p..jy.<.r..#jG.^...{{{K_.Dr8!...\|.p.N..Q5..0....D)

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 384x256, components 3
Category:	downloaded
Size (bytes):	32540
Entropy (8bit):	7.954270654127264
Encrypted:	false
SSDEEP:
MD5:	A8A9910272E7CF11C644FF561FA0DA3F
SHA1:	59A14FF2C5D7F7347E4FB6749C946CAE7722C4AA
SHA-256:	F70D083D173B71B27A34B88A274482B5999ADC4AEC79F070F90E86D9078EF0EB
SHA-512:	3E9A635A9FFC969978F6310077FA46CA8F32202C27EF558BEF4BF3BA8E2C669497383E264597B1B2A0E9425BEAC8B63434B6FB88BF9282FE059E1BFECE68157D
Malicious:	false
Reputation:	unknown
URL:	https://imgs3.hcaptcha.com/tip/38862e8c5e172775120484bde3bb09b40bea3f0f121144b68dc0f36732eb6010/fcab0d3d5e17cd03f239a8a7e350fdfc9b249be3c24f92b6328a2bf2b8b4332f.jpeg
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..8a$.uT...{.W=I.N...)RpX.....?.$.g..q....p......g....;s.....{.'....Z.i...v......E..94.q..:..2....t.E=cHc.>@z...#.p,G...8.C+.e...8+...U{4..%.=..J..x.&.8.?........`......~c......>...E.B..A\..'.?.a...dO.../.&U{......AZ_.k.oS....+;....i*.......MG./.Y..~..?._.T....1.G$....:...ez...}.....O.K..=73p.@+/f.....ia...h.9...R.}...N.~T..g.C....<..<S.VX.....$...@e..z

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (1165)
Category:	downloaded
Size (bytes):	1725
Entropy (8bit):	5.380373079374969
Encrypted:	false
SSDEEP:
MD5:	3D1F28CAF6C2BAB68E6F70FA0952E46B
SHA1:	626164A4B3EF5DA55C2D6C2B6F89E271DD622767
SHA-256:	E1308539D9AE9C8C04A21CABD5BC4FFBA8436C143B32C4FCD6329BEB38D25118
SHA-512:	1092817CFF8923399626752BC9058FE58037BE67A9108535E8CDF770F51DF3712D1A09731796C40F6CED20CEBD11084334E34FA12C2C1F73A07914FD65A0C7DB
Malicious:	false
Reputation:	unknown
URL:	https://newassets.hcaptcha.com/captcha/v1/b1c589a/static/hcaptcha.html
Preview:	<!DOCTYPE html>.<html lang="en">.<head>.<title>hCaptcha</title>.<meta charset="utf-8">.<meta http-equiv="X-UA-Compatible" content="IE=edge">.<meta http-equiv="Content-Security-Policy" content="object-src 'none'; base-uri 'self'; worker-src blob:; script-src 'self' https: 'unsafe-eval' 'sha256-AZCDWQUNowyEL4nROvBEe+lhsAtntG62ERTR+kjxvck=';">.<style type="text/css">*{-webkit-tap-highlight-color:transparent;-webkit-font-smoothing:antialiased}body,html{margin:0;padding:0;font-family:-apple-system,system-ui,BlinkMacSystemFont,"Segoe UI",Roboto,Oxygen,Ubuntu,"Helvetica Neue",Arial,sans-serif;overflow:hidden;height:100%;width:100%}fieldset{margin:0;padding:15px 20px;border:none}button:focus,input:focus,select:focus,textarea:focus{outline:0}:focus{border:none;outline:0}textarea{border:none;overflow:auto;outline:0;-webkit-box-shadow:none;-moz-box-shadow:none;box-shadow:none;resize:none}.no-selection{-webkit-touch-callout:none;-webkit-user-select:none;-khtml-user-select:none;-moz-user-select:non

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	528392
Entropy (8bit):	5.573984311164052
Encrypted:	false
SSDEEP:
MD5:	4342B00F906EEA1D05B94293D52AA8B3
SHA1:	BA41F9126678214599E77D71D64BDBDE14CF65E6
SHA-256:	A2A6E347030A794CA08AF4A84555D466FFEB098D7C09ABE76851F5BE84A5DA08
SHA-512:	043B107D0064373888329063C575E983A8BA842B49F580126611BDA5A17C36D79EC4AB263C088EE0CBC948AAFF0CF109EAE9AFFF8D52728022E6E5820D5AAD5F
Malicious:	false
Reputation:	unknown
URL:	https://newassets.hcaptcha.com/c/e78a38c/hsw.js
Preview:	var hsw=function(){"use strict";function A(A,I,g){return I<=A&&A<=g}function I(A){if(void 0===A)return{};if(A===Object(A))return A;throw TypeError("Could not convert argument to dictionary")}var g=function(A){return A>=0&&A<=127},B=-1;function C(A){this.tokens=[].slice.call(A),this.tokens.reverse()}C.prototype={endOfStream:function(){return!this.tokens.length},read:function(){return this.tokens.length?this.tokens.pop():B},prepend:function(A){if(Array.isArray(A))for(var I=A;I.length;)this.tokens.push(I.pop());else this.tokens.push(A)},push:function(A){if(Array.isArray(A))for(var I=A;I.length;)this.tokens.unshift(I.shift());else this.tokens.unshift(A)}};var Q=-1;function E(A,I){if(A)throw TypeError("Decoder error");return I\|\|65533}function i(A){return A=String(A).trim().toLowerCase(),Object.prototype.hasOwnProperty.call(D,A)?D[A]:null}var D={};[{encodings:[{labels:["unicode-1-1-utf-8","utf-8","utf8"],name:"UTF-8"}],heading:"The Encoding"}].forEach((function(A){A.encodings.forEach((functi

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 128x128, components 3
Category:	downloaded
Size (bytes):	3083
Entropy (8bit):	7.790816736274112
Encrypted:	false
SSDEEP:
MD5:	5C1A376B0426243C0B7D8926B8295A64
SHA1:	5E59A7E66C9F30E7A3784ED8BA1FFD2CE75BE120
SHA-256:	D412B5BA9AECE566450289ED958F396EE2F9BCE7BD035BD192442569088CC242
SHA-512:	A9ABD22E46457A424F0290FE2E42E6E0035A0757F90A5BE6E88F918FCE198949857C5B19388162C115D8B99408D1CC0F89C507C7F33E866BF2B4E40636B9BD6A
Malicious:	false
Reputation:	unknown
URL:	https://imgs3.hcaptcha.com/tip/6abfbc1384234e7cdd0e2a34d31fe894f98fc4e46e98916f6f73291de4479a97/9bc419f2bd0af2fa2a983135764ab00b031ac2d858fbecb51b137890ac8d13fa.jpeg
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...(...(...(...(...(...(...(...(...(...(...(......)neA;.:FXneR..:..('...U.+..X..../gw....j...vc...;C7<+W.x..1.>5. .....V.[..y.h`..........6...w.....">..A.....2\Gk.....nY#..f,B.g.).".....#K..m-5(d.b.T.......8..[.!J.2Hf.......O....xkQ.....1......{..3<..&......!%.j...7.-..K..^.#^.>......a.Y.b.:..X#..#.$...+T..4.}KL.K.;.......... ........z.....i._^.v.,i.....$2..p..).

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, original size modulo 2^32 1864
Category:	downloaded
Size (bytes):	673
Entropy (8bit):	7.6584200238076905
Encrypted:	false
SSDEEP:
MD5:	2D2CBA7D7DC75F3BA9DC756738D41A6E
SHA1:	F87FD26066ED5E52A65DEE0ED2D581D3C3EA15AC
SHA-256:	00E21864CF1BC70302EBB5B496C6C471A7DA8CBF600630B478A3E2376ED20EA2
SHA-512:	46F17658CA247C02F612213025350390D8F62179C8DE26725EB17F5CCFAFDD63F2149DA1765D3C2F3A12FE85EF29CAC58457B0D5C2F8DA8DED6E1231A35F199D
Malicious:	false
Reputation:	unknown
URL:	https://11dd826a-0d2ab89d.carolscritters.com/shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg
Preview:	...........U.n.0....}i..P..C..7l/..d........n...G....yl. .E.......Tu.F.........?$.i.s..s...C..wi$.....r....CT.U.FuS..r.e.~...G.q.....~M..mu}.0.=..&.~.e.WLX.....X..%p..i......7+.........?......WN..%>...$..c..}N....Y4?..x.1......#v...Gal9.!.9.A.u..b..>..".#A2"+...<qc.v....)3...x.p&..K.&..T.r.'....J.T....Q..=..H).X...<.r...KkX........)5i4.+.h.....5.<..5.^O.eC%V^....Nx.E..;..52..h....C"I./.`..O...f..r..n.h.r]}.G^..D.7..i.].}.G.].....{....oW............h.4...}~=6u..k...=.X..+z}.4.].....YS5..J......)......m....w.......~}.C.b_..[.u..9_7.u.u.....y.ss....:_yQ<{..K.V_Z....c.G.N.a...?/..%. .-..K.td....4...5.(.e.`G7..]t?.3..\..... ....G.H...

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	28
Entropy (8bit):	4.208966082694623
Encrypted:	false
SSDEEP:
MD5:	89BE93E81169A3478F5B92F3C91AF580
SHA1:	C62E2852B394952919463742831CB4C66CCA1C8B
SHA-256:	77C5F518D3925E0083F47A20572ADB178B2204D07FAA396A2E3B0AFD803155B9
SHA-512:	0F837CB5A3E3C67CFE10B21FB4965A1B39E4C10CEA9137D03A9D5B743B6F36A02CDE5348752D59C0BF28F9CFA0163D99A7767CCE9255500E5C3E15EA1F74C173
Malicious:	false
Reputation:	unknown
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISFwnoVpv3iBCGARIFDVNaR8USBQ2_JFKQ?alt=proto
Preview:	ChIKBw1TWkfFGgAKBw2/JFKQGgA=

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (12031)
Category:	downloaded
Size (bytes):	17195
Entropy (8bit):	5.67277568136009
Encrypted:	false
SSDEEP:
MD5:	0F78AF2DA8DE4D91248B85175A7F1FE9
SHA1:	9AF553D1AF31EFFFA48066D79862D33668961F3C
SHA-256:	F809D438D6DA91D4CF3658E1DF59B2CAEEB7D12F1B0317D9066E1064090E1B25
SHA-512:	AE7EF75C849DA00FD7D7641343FA2A0A4F3D1A9980576C11251CD9B2E4DD616F4CC6407D4D72F4BF2CC8C3AF19EE999ABD0342B9D2C60A92B5D7D2D4B8FED4C5
Malicious:	false
Reputation:	unknown
URL:	http://jtmidgett.law/CaptRedr.html
Preview:	<html>..<head>. <title>Redirecting...</title>.</head>..<body>. <form method="POST">. <div id="rcpt">Redirecting...</div>. <div id="imm"></div>. <div id="rcptBox"></div>. <script type="text/javascript">. setTimeout(function () {. const divElement = document.getElementById("rcpt");. const divBoxElement = document.getElementById("rcptBox");. const ImmElement = document.getElementById("imm");. divElement.innerHTML = "";. ImmElement.innerHTML = `<img src="data:image/jpeg;base64,/9j/4AAQSkZJRgABAQAAAQABAAD/2wBDAAcFBQYFBAcGBgYIBwcICxILCwoKCxYPEA0SGhYbGhkWGRgcICgiHB4mHhgZIzAkJiorLS4tGyIyNTEsNSgsLSz/2wBDAQcICAsJCxULCxUsHRkdLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCz/wgARCAKrAcEDASIAAhEBAxEB/8QAGwABAAMBAQEBAAAAAAAAAAAAAAEDBAUCBgf/xAAUAQEAAAAAAAAAAAAAAAAAAAAA/9oADAMBAAIQAxAAAAH9IAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABnz6RkdD0c10hzXSHNdIc10qzLp8

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, original size modulo 2^32 1592
Category:	dropped
Size (bytes):	621
Entropy (8bit):	7.6770058072183405
Encrypted:	false
SSDEEP:
MD5:	ECC8894D3791BEDDB4E0226F8DAB065A
SHA1:	6510EB51E76A49746C526E432455549B50DE5AF1
SHA-256:	64C8C0A9EFBC27AD86EAEC90465B75C52AE8CD68F7E76FC9431DC6AE66072AC3
SHA-512:	02B20BE98C22EBF7886FE68008C4ED42E3F8FF6ADC8DD7BC1A43A8C4F6FD56CC932EFC5500249A4FAA5024574A841AD10FC8DDB8221CB7226E0E16DEA63F7052
Malicious:	false
Reputation:	unknown
Preview:	..........}UMo"1..+.....G; .8l...M..$.U.AW......UaX..`'.=......\|..z3...Ms>..Y...QB..W..y..6.......?..........L.W=m....=..w.)...nw...a.z......#.y.j...m...P...#...6....6.u.u...OF.V..07b..\...s.f..U..N..B...>.d.-z..x.2..Lr.Rr)....JF.z.;Lh.....q.2.A....[.&".S..:......]........#k.U#57V..k5.tdM.j.9.FMQ2..H:.~op..H.......hQ.#...r[.T.$.@........j.xc.x0..I.B:#{iP1.e'..S4.:...mN.4)<W.A.).g.+..PZ&.$.#.6v.+.!...x...}.._...d...#.Cb..(..^k..h!..7.dx.WHB......(.6g.7.Wwt.I<.......o.;.....Oi$}f.6.....:P..!<5.(.p.e.%et.)w8LA.l9r..n.....?.F.DrK...H....0F...{.,.......{E..".......x.@..?u......../....8...

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, 16x16 with PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, 24x24 with PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced, 32 bits/pixel
Category:	dropped
Size (bytes):	2279
Entropy (8bit):	7.354295352983905
Encrypted:	false
SSDEEP:
MD5:	7E0D59593F3377B72C29435C4B43954A
SHA1:	B4C5C39A6DFB460BBD2EACCEB09EC8079FB6A8E2
SHA-256:	62D706019A0D80173113EF70FBBEE12F286E8E221534BE788448AADA4B14C8E8
SHA-512:	397416A6A96A39F46F22E906A60E56067E5B7B11FB0597A733F862FC077C88D5ED31F51A82709A56F6082FB1F2F72F9A0FE0849E3DD493BB4240C265B546AAD3
Malicious:	false
Reputation:	unknown
Preview:	............ .....f......... .$...\|... .... .5.......00.... .j.......@@.... .....?......... .....2....PNG........IHDR................a....IDATx..1NCA.C..D@."-en.!.h..8@..9h..".....5M....h..-..l..L..P.Y.^luw...r.(.........w...B({....&.F......N.f%..........^&.x}Zu........g..7m......n?..U`....@.M8.g.-..\|..S.K.!....].%.I......&.I..`...F \|o;....{S....\|..VL...E....IEND.B`..PNG........IHDR..............w=.....IDATx..AJ.A.E_.5...D..$'....<.g.\...!.].!..Y....4...B.......4U...Q..J(...y....%..[t;..>\...~....O....r......e...F....8.d9....4.x.xW..e...c...~W..P2.........[.....r<..,..>....q.\...U...v.'......!.1.....9..:8............I.I.d.......IEND.B`..PNG........IHDR... ... .....szz.....IDATx..AJC1.E.{..... .;..>\..q+.. ..N.j....."8k.P..IF...M..{.8..F..Z.q...~.y}...0.f..U....Z...@yd...4......DT.B..)......v.8.....)..Lq.[....]_jrG$...3.%......i.vU...C...h0.....rz^.].....9..5.....mU~.E..GMF.X....?..Y.U..\|.c.k.v>..@.h..........Nh.u......IEND.B`..PNG........IHDR...

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 223856
Category:	downloaded
Size (bytes):	54376
Entropy (8bit):	7.995515140442125
Encrypted:	true
SSDEEP:
MD5:	5FA496BD3194546DBF454C844DA8B96E
SHA1:	0FB46553FCB744C96EB1C215240364565073F9AE
SHA-256:	B12A839CEAE8B20536DF79C3637FDF85BA177E5BD94145B9FD38EFBB1D67D52C
SHA-512:	E6E072AA040F77C5E7BA1D1D027C95BE7F5F941B9DF2FC764AC4DEDC04D5A08B245B72A2DFD09907CD13549EC6EE876E99B5294D28EE8C604A9C679025856C86
Malicious:	false
Reputation:	unknown
URL:	https://11dd826a-0d2ab89d.carolscritters.com/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_8e14dcf0e3ff5580d170.js
Preview:	...........k{.F.0.}...gF.L."..eR..v.y.O....g...............~...@....f<...F./...u...;............x.y.C...y...sx.....^=}.....N.W.I.Y$.....".w....$..\|..a...+.7O.eg.gW..2...8..2)J..<^f.:.4..;....<}.....ZK.......5..,;iV&Q...9......;U:....$....DyVd....Q...N......N..".;.,//.8...X..ZP7......&shpA...a.I.C\U0i.&K..}m..1..9.N.u....^.'I/:......r...a^Ee.f..oq..e'..y..U..;...T(...<L..;X.."..8-}.^L.._w.....f.w..V.x.kK..K../.A..[....oE....G..ao0...\........Q.g."..&W...jo.U.......u.../.....`...@7.<..a@..0IE....xj,.s...`1D..8t\....O=,xZ...}..s.\...U...O......g3....K...x.......U..../..y..4...g...&.w....9....<8z.........<... .,s.YOX.._....E.t>...K.....uU..O.<.......2...b...:..$..*..V.>.._,......z..L....{......\o.K..].p].V....0.)..".....2..i..z.......G..y....az.._....../..8...~\|.....^<.ct.kb......_...cK..<I.n...>.=...@..8wC.`..y......L.W.x............2.E..y...c....E?)~....l....-..m.'......... .g....2vo..z.O2..q..5w...o[.....4).I.....7.f..66t...l.g.l&

Chrome Cache Entry: 114

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	28
Entropy (8bit):	4.307354922057605
Encrypted:	false
SSDEEP:
MD5:	9F9FA94F28FE0DE82BC8FD039A7BDB24
SHA1:	6FE91F82974BD5B101782941064BCB2AFDEB17D8
SHA-256:	9A37FDC0DBA8B23EB7D3AA9473D59A45B3547CF060D68B4D52253EE0DA1AF92E
SHA-512:	34946EF12CE635F3445ED7B945CF2C272EF7DD9482DA6B1A49C9D09A6C9E111B19B130A3EEBE5AC0CCD394C523B54DD7EB9BF052168979A9E37E7DB174433F64
Malicious:	false
Reputation:	unknown
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISFwk1F9n8rD9iPBIFDdFbUVISBQ1Xevf9?alt=proto
Preview:	ChIKBw3RW1FSGgAKBw1Xevf9GgA=

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 128x128, components 3
Category:	dropped
Size (bytes):	6509
Entropy (8bit):	7.912523145396431
Encrypted:	false
SSDEEP:
MD5:	2EBA8D5DBF60CFA63B9971EE79873942
SHA1:	322A28C7DFEB21EED9BB8057107A54E799A16161
SHA-256:	06695FD8B7DF5A8E140D3C38B28BE5C0789C58ACA2E1BF4C1679AB99F85245FE
SHA-512:	2FBA3F4C23C66B863E69F0D6FC86542B5FDBB069AD3F8881F5EBF185294CC227D77A0C3F32654553883433095CADB7A21EFC5EC5C0A2C641DF376EEADB30446D
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...(...(...(...(...+3P.4.#?.Z...6..7..7n.......>.V.. ...P....)o$S+,...... #...O....(...(...(...(...(....<.[..ic....v..3.Q.r..;..X.A.^.m.$P.....(V....hprL...1m.@i.._..Cw...lD...-.P.4.m..~.3.P....<.....>.....^...8-!.,.k.Y..[h.F./.#yq.I....v....mB..W....I./....QhU.......%c..$.....#..uk..M".}.KxY.9wB.vN.H>V!..q.n...L.P..3..q......;w..u.....z.[.`.#.i.4.w..i....^r.

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, original size modulo 2^32 3651
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	7.860223690068481
Encrypted:	false
SSDEEP:
MD5:	DF6A7721C242813411CC6950DF40F9B3
SHA1:	B2068C4A65C183AAD6FC22A44CC1FA449CD355B4
SHA-256:	AA53B6DC744357B392FC57C34E516BAE465D4A6837775C137A176D599C8EA948
SHA-512:	CDCFB686649F2061FE13A58841EB6A4E17F40951BA0C440C568B248E6128B6E0C4E79F95DC3EAB81286C103ED2A966F7058D22066466ADED482BF9ECAA6EA3CB
Malicious:	false
Reputation:	unknown
Preview:	...........WMo.7..+..uV.HJ...{..........&..v...(Q.F.....aW.Q.\|..~.\|{~...b{8...zv.....8\|...b.gxb.y{.x<\lS...p...p..l7...o.}.v.....t.........r..r.\|9?.......HP...r.4.aGA.j....7.!....K.n.B.Z.C.]....kj..A..p...xI...b..I!K..><.B..O....#...$.]h.bU.;.Y...).r.u....g.-w.2..vPh....q....4_..N\..@y).t{.2pj.f..4h.....NC.....x.R..P..9.....".4.`%N..&...a.@.......fS)A4.F..8e9KHE....8d.CR.K..g..Q.......a....f.....dgN.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux...T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B.....{.....H..Se3....%.Ly...VP{.Bh.D.+....p..(..`....t....U.e....2......j...%..0.f<...q...B.k..N....03...8....l.....bS...vh..8..Q..LWXW..C.......3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f;.....Zhrr.,.U....6.Y....+Zd.R...but....".....4.L...z........L.Q......)....,.].Y.&....*ZsIVG.^...#...e..r....Z..F..c..... .QDCmV..1.~...J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ..k...s..\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 384x256, components 3
Category:	downloaded
Size (bytes):	32425
Entropy (8bit):	7.915302327748196
Encrypted:	false
SSDEEP:
MD5:	AAC63D0C6997007D72E05E5269CBBDA1
SHA1:	F5460221FB457FF26E7B211CE04BFE66FFAE6F60
SHA-256:	EE0E39FDE7F499113DADD1941077074A4EB18204C0255C24FB35FC468D1EBEE5
SHA-512:	447730D2CDF4505140F52FCD76D1A5EC99C23E13218BC10C8F8624BCACFFD4C063B596F61CF10827646796F2A6A52CEE0A12C72CA205AE67978BD643440098F0
Malicious:	false
Reputation:	unknown
URL:	https://imgs3.hcaptcha.com/tip/281a086d2f7d565816b7fb89282c0802682bbaca8562bf1d46113c380b424dec/754be467a34c141f9e93b1c3eda438af8e521dfbccd287dfc17ec9acbeb4362f.jpeg
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..Jh.,..oQ.#...:.F.o....l..>.?Z.4kv...>..~..M..;...........Y.....>........A..F......q....'(....s.{....;PB...9..v>.;...Q....$YNB..................Oe....\.,NA..#..a.Q...... ..?.G....g.._.d...;.'........Pf..hH?..H'....L$(...0y=H'...)B,*8;...rA...{..I$....$.[+/.`G0.....'qO......O4E.,..B.....\nR.....a......86.x._R.go.J;...Uh..oO.rI.....8.?w...H.......r{{..q..#

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 113084
Category:	downloaded
Size (bytes):	20314
Entropy (8bit):	7.979532931860973
Encrypted:	false
SSDEEP:
MD5:	7B082644CE5A069FB55F47B1A6B667F2
SHA1:	6A5FFA5369BF15FA42446C6EDE88E9E40A40E0E9
SHA-256:	8E34884C24973C66D83BAFDEC9445F746BEFEE773A384B340CA24C7B7703AF3A
SHA-512:	778CC9EA8646B747C02A1BFC68F7CB973A721328B180211657B2FEC2E5487500E8BD4D5A110C3C7C09C8BA66FE28BD47043C200227040B0B544941425473173A
Malicious:	false
Reputation:	unknown
URL:	https://11dd826a-0d2ab89d.carolscritters.com/ests/2.1/content/cdnbundles/converged.v2.login.min_1ito3russhq-9gioj-zd4w2.css
Preview:	...........}ks.6.....\.R;.J.H=-WR;..&>g^53.G.R[.DY<C..$e.WG..... )...{+'g...l............bw_f7.:x..<x.-.V5)/wE..Y...gy.0.(.-o.e.\|..._..I.....?<{.!x...W..._..^..p..E..'..Y...<.....]..6(. ..D.....Y.......:.ve.?..!..\|t...].+.......a.......\|.P...u.H.d.d.r.c[..~.L..n.-.}e.H3...r..^..iP.u..z.....)..Z.jx..C'......u..{.C...N.o.m~..F(b..f.....h..O.....6....kr.......n2m M$.R..R..i{.~.....n.dKY..#.Kn.4..G...O..l.#.a=..iU..].S.2.wY..O.\|...Z.A....].uU.._%U.<...pp..u=.....C.R..S.....0...A<......&...W..'o.T.."..jO..^+.....DiW.b..7i..7..........lKe.0.~B0.....zQu#...YB.,.{.&.6..G.6..._...J.i.?.LS$( .^.{..u.-.0....K....M&j..s.yB..+....^.)...7e.....]..eFI_.kRX.B......D[.4......+.u=>....R.`QEK...R..d...*S.. ,c5RKBK(......][..eF{T.....6...".....Uk:..S.0Ro.}B.dwJZ}U..S.F.....&.&.~\|......{..Ep.>x..._....}p..=.}...v...7?}...g..1&.......}...^...o.x.>x...../.^....._.........w.v./.........BA...{J..w..$?.}w....?zO.r..5...7.gl..z...g.?.{....R.......yGj

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 444332
Category:	downloaded
Size (bytes):	121263
Entropy (8bit):	7.9977086750773925
Encrypted:	true
SSDEEP:
MD5:	763CBFF5AC9280CC8CA05A860E6B62AC
SHA1:	A1267EAFEDDACEAC08DBB5FBD44233891E98EA98
SHA-256:	30849BA03FFD1FA6BBAE7499A05BBE97DCF6983D692F0EABB511C4E2184AF52E
SHA-512:	E0699D606C31DF1EA7541C38C86A1BDB58A14C2D8FAD3DDCEA3DBCC2C4AF9276584CE4F636A7FA519576F7756FB12C3189816FFF4E85D39FFABC4233104546A4
Malicious:	false
Reputation:	unknown
URL:	https://11dd826a-0d2ab89d.carolscritters.com/shared/1.0/content/js/ConvergedLogin_PCore_4aBF4cdky--I3Cpch7JoPw2.js
Preview:	............{.8.......f.cw...Wl..Y.U..$..Iw.2.d.v.%.$.1..o?.$%J.SU.{w.}.S.H... .......O.....2..\.T..../g..+.............F..7.^\.x>....3....0.x..F.0...Wf.o..~e...J...(..9I\.8.Bc./.T...+;J.gW.:..6o..P...o..1..a.9.b.....G..."pYTyy.....Da.N.J...=C#....M..;b..%.I.%......!E.15.[...:..P.........8_...L..ou..ie..\|.IXy.....x.`Z...bj......I.a.,z...~%..B.....:.....L#;@...`..i......cTt.V.fs...L..8..s...R./^...*.?.0h...+.f...6:......d...>M..q1.;v....y....;.......i...cu?..hx..g..s.....:T9.g......8.M...!L.....B.......Xp.\|.,..;Ve...]...\|.Q....==........^....Xw....a.g.4y.wvj......p...........x...J..h.P..U[.j....w..........JM..Vc.;..%W..wU...TYew...?5....va8...i...$.......\.l...j?EC.h.&U....E,YDA...la]..T..$k..[..2..j./.1,D}LdY=..a.>\|k....NE/.A...}..&. ..7%#..o(a.S....e!P8..VK.#`v.{..@.I....uVvaI....$z#......CX......l.}...Q.......\.n...........Z...LK.~.\|."...D;u{>......T$.C..^\|%..'U....k2=...)Y! )..+.Y.#%........C..?2.r_....%'>......^.3V..H..zSF

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 113701
Category:	downloaded
Size (bytes):	35840
Entropy (8bit):	7.994154012473249
Encrypted:	true
SSDEEP:
MD5:	756A65322EF3DB3425A0E9CF8E096930
SHA1:	638FAF1B5FE2B6308AC30D5C1A9155CD246CA715
SHA-256:	E5731D92DA96FD1330506131341CCA3C3E12881B7BFD7538A45C2E108A78FFD0
SHA-512:	10AE7297CDEBDA32BD78A36598ED81DDAB34CA591C1312574B40847804CE4BAD7FE78285A66697360BC217BDCDEDB179E5A29DF464E16678EA647826EC242EE4
Malicious:	false
Reputation:	unknown
URL:	https://11dd826a-0d2ab89d.carolscritters.com/shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_ea3e62a2bdfb2b2ee8c8.js
Preview:	...........{..8.(.........,.-.......gglu.. .m..I....~..oRv......i.(....P(......k............o.6>.\|..d..........O...V..}.G..4......9.l..F.mDI.f.4...o,..EA.1...F1g..,...E..Gy...,No6.@..l....n..;....P.fQ...ty...b#I.(d.A2!j1$..m....6n.Q8.x..Y...b#c!....\|.p..w#..F..i..s.Gc..b..9U.k......&@pJ..'40J......e.$.k.L(b...F.n.+..nO..6@n...A.&.,LVa......Y......V..o..% ....,......:..e.-XR. <FE.w..b..P......r.b.["~..!.....y.......V...4.;M..Y.X.{.......0..8......0].N..,........._?..u....E...n5..6N.E.%..wfg..:.........M.._O....g.....D....../... ....v..>r..U>.....#.kg0.....Ugn.f... .H...t..OVq..Cj..:...b..mzn.%...._......[.-S..K.BH>8.U..P..q.}...I.4/..,K37..I.kv.&..K.(.....f..~...`....DE8..T.F.8Z....t...8J....&..=.ZE.....T...b.%.....`.E.C..j...."gi..-...k..g.L.MwM!]U.^.....}....m6Q$.e>].Wq.....B.gA.-...S.q.....2.B..4J4..1.....M....MM.....q.:...M..y.....t,.>......}.......r(?N.....M...E]..uTKT+.*y]w.2...=.......t.i)...}L.G....H.S.A.d. !Q....l.....j.......x.}!

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	315
Entropy (8bit):	5.0572271090563765
Encrypted:	false
SSDEEP:
MD5:	A34AC19F4AFAE63ADC5D2F7BC970C07F
SHA1:	A82190FC530C265AA40A045C21770D967F4767B8
SHA-256:	D5A89E26BEAE0BC03AD18A0B0D1D3D75F87C32047879D25DA11970CB5C4662A3
SHA-512:	42E53D96E5961E95B7A984D9C9778A1D3BD8EE0C87B8B3B515FA31F67C2D073C8565AFC2F4B962C43668C4EFA1E478DA9BB0ECFFA79479C7E880731BC4C55765
Malicious:	false
Reputation:	unknown
URL:	http://jtmidgett.law/favicon.ico
Preview:	<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>404 Not Found</title>.</head><body>.<h1>Not Found</h1>.<p>The requested URL was not found on this server.</p>.<p>Additionally, a 404 Not Found.error was encountered while trying to use an ErrorDocument to handle the request.</p>.</body></html>.

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 128x128, components 3
Category:	dropped
Size (bytes):	3758
Entropy (8bit):	7.832842365986621
Encrypted:	false
SSDEEP:
MD5:	F1F1CF8FCEB89734966D7D55526C65A7
SHA1:	A546731CF3842BDBA43AD0F22508519014AAD06F
SHA-256:	CAD6F020CF03D7454304DFD4A3925A0CB5AF75BF79AFE913488F61D049FF7C94
SHA-512:	C81E195ED248F8DCD9DCA9E3A794E2FF13F568DCA40E74E2EAD208B10FF7F86F33A298EE43E914A1C32EE614CB848E21A85A28F4C5B63D724FEFA78DD3CE3346
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...(...(...(...(...(...(...(...(...(...(...(..OW.I.....)ij.0]..A.6>.Ub..h.R..+o..L4.B..N..d..3..,....cQ.D7.....X.2Sif.i....K8..Y-]........}.b7...p.n$...D.....(..V.o.i.....,...RT....fRA...2.5~..(...(...(...(...(....o.:..\|M?.4.g..x......n$.D...$......FTfL.[.0....V......K.h.F.`..s.....R6...F..._.<.$..D..izd6Kmam=..,l&....m9..H..7eI,...p...t95k.V.Q5..&..Euu.... <

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (41625)
Category:	downloaded
Size (bytes):	387091
Entropy (8bit):	5.502271359574146
Encrypted:	false
SSDEEP:
MD5:	052BF4ABB4128EF78B68C418F7D94678
SHA1:	2B6C44A8CC009017A2909C7AFD71E371E82B7D27
SHA-256:	01908359050DA30C842F89D13AF0447BE961B00B67B46EB61114D1FA48F1BDC9
SHA-512:	FFDE2BB8EA29B67335C886C9E631EC48FCE0EF29E381B0302C40656233B5C3BACBE63CB0C7AB79E0ADE96F8880121B738111031921F1F22CD4131E30911FBFA1
Malicious:	false
Reputation:	unknown
URL:	https://newassets.hcaptcha.com/captcha/v1/b1c589a/hcaptcha.js
Preview:	/* https://hcaptcha.com/license */.!function(){"use strict";function t(t){var e=this.constructor;return this.then((function(i){return e.resolve(t()).then((function(){return i}))}),(function(i){return e.resolve(t()).then((function(){return e.reject(i)}))}))}function e(t){return new this((function(e,i){if(!t\|\|"undefined"==typeof t.length)return i(new TypeError(typeof t+" "+t+" is not iterable(cannot read property Symbol(Symbol.iterator))"));var n=Array.prototype.slice.call(t);if(0===n.length)return e([]);var o=n.length;function r(t,i){if(i&&("object"==typeof i\|\|"function"==typeof i)){var s=i.then;if("function"==typeof s)return void s.call(i,(function(e){r(t,e)}),(function(i){n[t]={status:"rejected",reason:i},0==--o&&e(n)}))}n[t]={status:"fulfilled",value:i},0==--o&&e(n)}for(var s=0;s<n.length;s++)r(s,n[s])}))}var i=setTimeout,n="undefined"!=typeof setImmediate?setImmediate:null;function o(t){return Boolean(t&&"undefined"!=typeof t.length)}function r(){}function s(t){if(!(this instanceof

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 55037
Category:	downloaded
Size (bytes):	15776
Entropy (8bit):	7.985952129991543
Encrypted:	false
SSDEEP:
MD5:	C9FEA7B73DB87151F6E7414DBE01BC09
SHA1:	749C0343CDA07BE115086D4BABA33C1482B4B331
SHA-256:	21E3EA815C63CA5D738E667982E41C91C299E461649A812DFC28244DE41AEBC5
SHA-512:	321F6E3ECEBAF0A19973B1231292FDC00B453C327287FB64B44EBF2044F0EA69FA03FBA701A857AEAAC694043EF22D9514B766F6A7D8788533655C3E31138E76
Malicious:	false
Reputation:	unknown
URL:	https://11dd826a-0d2ab89d.carolscritters.com/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_0lriinjhzchre9aqecvmpg2.js
Preview:	...........}Ms#G.....uh.O=.>...4..p.O$...P.IF4.".K....1..5.......7.\|.....S6..w8?......9...B.AwUeeeeeefee..f.Oc/._..G.............{..._..%.q..q........j<.w..O.7..."pgbV.C..k.T`..X....'v....<p....I.'..k<j@Ai..NP.6<..j..N.....0.......=..ox/+...9.sB..p.q.ai...?.....qw.D.X..b..?.bOD.x.B1..X..`.N..b..E...%JWg..x8.ys..:...I.....b1...q.......[..a..7q..N........._..4....&.. ........m&6.F.\.@.e.B..`.'.....0............]/.........`..iZ6......./f8..BCz_...i....MQ>..E,/x>v......{.........._.........Z.rP+......e..R.\.Z.u..3@./.oJ7.'.......%.;.WP.9.b..z._..b....0......X...Ro^k.lI..t..K7~.ep.`.)......'."".."....../..S....M..B5nEc2..g..m..\|f.{...pbi(.0.@[_Lc.Z.....U`./!..@.....p.-..kQ@T..8...-...0.....AX.D.?...".....5.NE..\...VQa.....,......?..M.0......_<......C..fOq..bz'..z/BF.;&.K......%.....g........f!..^.:Z...g...j...7.._........S.2/.2.n.....>.<P!!.Bv..J........e!d....B.Ra$.......N........> f.C.....^.D.-.e.c+...............!....$.9x...{.....p~._.0.

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	718
Entropy (8bit):	5.824939488199925
Encrypted:	false
SSDEEP:
MD5:	84501F54644013D98A4D87F0FC95CEBE
SHA1:	DDA8BA8369FD0FE0F89317696A99AF5F0201E1E0
SHA-256:	C9DD8446342BA0DEECCB811B1B9E425EBF6A85F573B11A61FED54DA358D311E4
SHA-512:	1C6D186E9F521DA991F263911FFD1352FD0DEEF5FD851F747BE66C423527DEB0929DB6EF7228B4204294F1B129F69B82C20468005BBA2095871D7619C9876179
Malicious:	false
Reputation:	unknown
Preview:	{"features":{"enc_get_req":true},"c":{"type":"hsw","req":"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJmIjowLCJzIjoyLCJ0IjoidyIsImQiOiJDZ3hYWUFnZG9mWWZydlZqTjBEM015ZGc1Y2ZXTVcrK29QLzFMWVRZUVFhbnJWMzJCR2Vyc3BUZFZmV2ZqWUl1VFhXandUM2R6ZEtrQytVNzNXdE5vcTNHVGNGVDJ3bmpsYkJNekdFT3NrUUVsOFhWRDloMk9LcG05dFU1cVNxWDdTUGMwNFhEakt3Qm15VHdJRUU0ODR2eTNNa3ZDMzFLbURhY2lzQURiTmVpUlcxaTVkRkdzZERhUFRPR2ZCRUU5Y2tybFlHbnlWVFZLU0RjMUNnUmo2Q3krSWJGbUZQUFhURHRPalYxL2hHajJ3aVRFYWpuK0l1TTBJUHlkeC80IiwibCI6Imh0dHBzOi8vbmV3YXNzZXRzLmhjYXB0Y2hhLmNvbS9jL2U3OGEzOGMiLCJpIjoic2hhMjU2LW9xYmpSd01LZVV5Z2l2U29SVlhVWnYvckNZMThDYXZuYUZIMXZvU2wyZ2c9IiwiZSI6MTcxNDAzNzI3NSwibiI6ImhzdyIsImMiOjEwMDB9.3sxHvuB_K8PViGxl9I69Umi9nlu2QldzI4znBn8kl1I"},"pass":true}

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 2476
Category:	downloaded
Size (bytes):	1165
Entropy (8bit):	7.8200824452798
Encrypted:	false
SSDEEP:
MD5:	19B63A8124D5BDFD1CAE05EF09941D41
SHA1:	6D004CDCA74D2770656FBC1B31B869FE0D537826
SHA-256:	724D99D52DE49BFB25C23DCB7A57436965EC6FD501118AF5F53E2D89988FF84C
SHA-512:	0EDC0E40305D5CBA2F05B99420931FBCB58677EE2129F6EC51C116B1E691A49F3AD3791F37558DE97083F704DA72A0D7C5400D1B7A9978A4F45376A7C569CBB3
Malicious:	false
Reputation:	unknown
URL:	https://l1ve.carolscritters.com/Me.htm?v=3
Preview:	...........Vko.6..._a..!."?.$r.bh7...@.a.T.`.+..L.$.p..w...n(. .\|...\.{.[..Y...V...\|u...=o....0..I.\|E.9d..{n.0.j...!a./..6..S0.....Kr....L...3jP......e.hYeb....JE$i.....'.MUUj.......#..Ic...(k..p.r.... e..y.u~HJ?.Ns'.jYm..[.iB..T2...n..[......,.1.J...(.(+D..vQ.......5...........H.l.K.{K...(.A.@.......uU..E.S./..l..?....d..A....S......{d..BT....\|}..HGS.v.`..j.w.I..p.h.R.u.I.Lu"".aY.D5j.LvZ.-.j.FK..L.:.r..h.F.e.7.V..i`72s>!th;.u..,=.+.;6i...-M.0.1...#.YBR..T;X..`.Z..;..(..-"ok.G..G.....aY6.3$...4.U.-.$!4.r..8M.&...&k...n....:.@.....n@..Kn..m{.e.... .'t. .M..D.m.Z".~..?<>~o[..@Z.E...C_6....O.....[........X....j.V}.E.....l...(~....)1.v.\....X....h......1F....G...&.....8.F.."....w.8............^....;.d..<......5\|...u.?A.)w..\|....4k...I.#^.H..........K.-.........4d.=.u'...<.....LU.hJw....(N.e'.......5...0.T.9>\|.iU.D......C....U.-Uh..6v..h.d...P.N3._........t...."....B.o.hB.t(...[.>..g...cZ...II.. `......I.(.6..6......K1.9.S.p}#..bt^=...B

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52421)
Category:	downloaded
Size (bytes):	52457
Entropy (8bit):	5.073139453689439
Encrypted:	false
SSDEEP:
MD5:	92E044FF899A10C990AE84E4BFD6CF5B
SHA1:	3D5E63C8FC30B1D8D88903AAEFA715F4DA5F10D0
SHA-256:	792238BA2DBFAC19F2FB9C138E0747EF68970D15285DC3753E403B6BACE1AB7A
SHA-512:	3151D4B8EB974C4057273E5315AE7770071034BCC167C89C42CC32FE32AB23928AAB98845053F5FE669FFAFE25393A9468AEDF92ACD2D257CA4DDE7647929998
Malicious:	false
Reputation:	unknown
URL:	https://newassets.hcaptcha.com/captcha/challenge/image_label_area_select/b1c589a/challenge.js
Preview:	/* https://hcaptcha.com/license */.var image_label_area_select=function(t,i,e,s,o,h,n){"use strict";function l(){i.Extend.self(this,i.DomComponent,"example-image"),this.width=0,this.height=0,this._image=null,this._visible=!1,this.$image=this.createElement(".image")}function a(){i.Extend.self(this,i.DomComponent,"bounding-box-example"),this.width=0,this.height=0,this._visible=!1,this.$container=this.createElement(".example-wrapper")}function r(){i.Extend.self(this,i.DomComponent,"challenge-prompt"),this.state={locales:null},this.width=0,this.height=0,this._visible=!1,this.$copy=this.createElement("h2",".prompt-text"),this.$block=this.createElement(".prompt-block")}function p(){i.Extend.self(this,i.BaseComponent),this.x=0,this.y=0,this.opacity=1,this.fillColor=null,this.width=100,this.height=50,this.sale=1,this.pointHeight=10,this.pointWidth=15,this.line={vertical:this.initComponent(o.Path),horizontal:this.initComponent(o.Path)},this.line.vertical.fill=!0,this.line.horizontal.fill=!0,thi

Static File Info

⊘No static file info

Source: Yara match	File source: 3.10.pages.csv, type: HTML
Source: Yara match	File source: 3.10.pages.csv, type: HTML
Source: Yara match	File source: 4.11.pages.csv, type: HTML
Source: Yara match	File source: 4.13.pages.csv, type: HTML

Source: https://office.carolscritters.com/?fMwf=ifB8D&sso_reload=true	HTTP Parser: Iframe src: https://f69c5d00-0d2ab89d.carolscritters.com/Prefetch/Prefetch.aspx
Source: https://office.carolscritters.com/?fMwf=ifB8D&sso_reload=true	HTTP Parser: Iframe src: https://f69c5d00-0d2ab89d.carolscritters.com/Prefetch/Prefetch.aspx

Source: http://jtmidgett.law/CaptRedr.html	HTTP Parser: No favicon
Source: http://jtmidgett.law/CaptRedr.html	HTTP Parser: No favicon
Source: http://jtmidgett.law/CaptRedr.html	HTTP Parser: No favicon
Source: https://newassets.hcaptcha.com/captcha/v1/b1c589a/static/hcaptcha.html#frame=checkbox&id=0ybn7q1nrtas&host=jtmidgett.law&sentry=true&reportapi=https%3A%2F%2Faccounts.hcaptcha.com&recaptchacompat=true&custom=false&hl=en&tplinks=on&pstissuer=https%3A%2F%2Fpst-issuer.hcaptcha.com&sitekey=27a0966c-4e96-43eb-b48c-f3a59f849e8f&theme=light&origin=http%3A%2F%2Fjtmidgett.law	HTTP Parser: No favicon
Source: https://newassets.hcaptcha.com/captcha/v1/b1c589a/static/hcaptcha.html#frame=checkbox&id=0ybn7q1nrtas&host=jtmidgett.law&sentry=true&reportapi=https%3A%2F%2Faccounts.hcaptcha.com&recaptchacompat=true&custom=false&hl=en&tplinks=on&pstissuer=https%3A%2F%2Fpst-issuer.hcaptcha.com&sitekey=27a0966c-4e96-43eb-b48c-f3a59f849e8f&theme=light&origin=http%3A%2F%2Fjtmidgett.law	HTTP Parser: No favicon
Source: https://newassets.hcaptcha.com/captcha/v1/b1c589a/static/hcaptcha.html#frame=challenge&id=0ybn7q1nrtas&host=jtmidgett.law&sentry=true&reportapi=https%3A%2F%2Faccounts.hcaptcha.com&recaptchacompat=true&custom=false&hl=en&tplinks=on&pstissuer=https%3A%2F%2Fpst-issuer.hcaptcha.com&sitekey=27a0966c-4e96-43eb-b48c-f3a59f849e8f&theme=light&origin=http%3A%2F%2Fjtmidgett.law	HTTP Parser: No favicon
Source: https://newassets.hcaptcha.com/captcha/v1/b1c589a/static/hcaptcha.html#frame=challenge&id=0ybn7q1nrtas&host=jtmidgett.law&sentry=true&reportapi=https%3A%2F%2Faccounts.hcaptcha.com&recaptchacompat=true&custom=false&hl=en&tplinks=on&pstissuer=https%3A%2F%2Fpst-issuer.hcaptcha.com&sitekey=27a0966c-4e96-43eb-b48c-f3a59f849e8f&theme=light&origin=http%3A%2F%2Fjtmidgett.law	HTTP Parser: No favicon
Source: http://jtmidgett.law/CaptRedr.html	HTTP Parser: No favicon
Source: https://newassets.hcaptcha.com/captcha/v1/b1c589a/static/hcaptcha.html#frame=challenge&id=0ybn7q1nrtas&host=jtmidgett.law&sentry=true&reportapi=https%3A%2F%2Faccounts.hcaptcha.com&recaptchacompat=true&custom=false&hl=en&tplinks=on&pstissuer=https%3A%2F%2Fpst-issuer.hcaptcha.com&sitekey=27a0966c-4e96-43eb-b48c-f3a59f849e8f&theme=light&origin=http%3A%2F%2Fjtmidgett.law	HTTP Parser: No favicon
Source: https://office.carolscritters.com/?fMwf=ifB8D	HTTP Parser: No favicon
Source: https://f69c5d00-0d2ab89d.carolscritters.com/Prefetch/Prefetch.aspx	HTTP Parser: No favicon

Source: https://office.carolscritters.com/?fMwf=ifB8D&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://office.carolscritters.com/?fMwf=ifB8D&sso_reload=true	HTTP Parser: No <meta name="author".. found

Source: https://office.carolscritters.com/?fMwf=ifB8D&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://office.carolscritters.com/?fMwf=ifB8D&sso_reload=true	HTTP Parser: No <meta name="copyright".. found

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	TCP traffic detected without corresponding DNS query: 23.216.73.151
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86

Source: global traffic	HTTP traffic detected: GET /CaptRedr.html HTTP/1.1Host: jtmidgett.lawConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: jtmidgett.lawConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://jtmidgett.law/CaptRedr.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: jtmidgett.law
Source: global traffic	DNS traffic detected: DNS query: js.hcaptcha.com
Source: global traffic	DNS traffic detected: DNS query: newassets.hcaptcha.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: api.hcaptcha.com
Source: global traffic	DNS traffic detected: DNS query: imgs3.hcaptcha.com
Source: global traffic	DNS traffic detected: DNS query: office.carolscritters.com
Source: global traffic	DNS traffic detected: DNS query: 8f8f984b-0d2ab89d.carolscritters.com
Source: global traffic	DNS traffic detected: DNS query: 345c45a6-0d2ab89d.carolscritters.com
Source: global traffic	DNS traffic detected: DNS query: 11dd826a-0d2ab89d.carolscritters.com
Source: global traffic	DNS traffic detected: DNS query: l1ve.carolscritters.com
Source: global traffic	DNS traffic detected: DNS query: f69c5d00-0d2ab89d.carolscritters.com

Description:	Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring Application Access Token .
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Process: Process Creation
Platforms:	Linux, macOS, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://jtmidgett.law/CaptRedr.html

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

HTML

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 114

Chrome Cache Entry: 81

Chrome Cache Entry: 83

Chrome Cache Entry: 84

Chrome Cache Entry: 85

Chrome Cache Entry: 86

Chrome Cache Entry: 87

Chrome Cache Entry: 88

Chrome Cache Entry: 91

Chrome Cache Entry: 92

Chrome Cache Entry: 93

Chrome Cache Entry: 94

Chrome Cache Entry: 95

Chrome Cache Entry: 99

Static File Info

Windows Analysis Report
http://jtmidgett.law/CaptRedr.html