Edit tour

Windows Analysis Report
https://atechelectricalengr.com/mpd/?rim=tlczs5qdc&xyr=touz&t=nbvaz8e57bgik9d&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&chh2pve49=u8Y0610Y

Overview

General Information

Sample URL:	https://atechelectricalengr.com/mpd/?rim=tlczs5qdc&xyr=touz&t=nbvaz8e57bgik9d&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&chh2pve49=u8Y0610Y
Analysis ID:	1636289
Infos:

Detection

Captcha Phish

Score:	56
Range:	0 - 100
Confidence:	100%

Signatures

AI detected phishing page

Yara detected Captcha Phish

Creates files inside the system directory

Deletes files inside the Windows folder

Detected suspicious crossdomain redirect

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6864 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7092 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2056,i,12747472879211138210,13391912177036942368,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 6376 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://atechelectricalengr.com/mpd/?rim=tlczs5qdc&xyr=touz&t=nbvaz8e57bgik9d&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&chh2pve49=u8Y0610Y" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author
0.10.pages.csv	JoeSecurity_CaptchaPhish	Yara detected Captcha Phish	Joe Security
0.9.pages.csv	JoeSecurity_CaptchaPhish	Yara detected Captcha Phish	Joe Security
0.11.pages.csv	JoeSecurity_CaptchaPhish	Yara detected Captcha Phish	Joe Security
0.3.pages.csv	JoeSecurity_CaptchaPhish	Yara detected Captcha Phish	Joe Security
0.0.pages.csv	JoeSecurity_CaptchaPhish	Yara detected Captcha Phish	Joe Security
0.8.pages.csv	JoeSecurity_CaptchaPhish	Yara detected Captcha Phish	Joe Security
0.2.pages.csv	JoeSecurity_CaptchaPhish	Yara detected Captcha Phish	Joe Security
0.1.pages.csv	JoeSecurity_CaptchaPhish	Yara detected Captcha Phish	Joe Security
0.5.pages.csv	JoeSecurity_CaptchaPhish	Yara detected Captcha Phish	Joe Security
0.6.pages.csv	JoeSecurity_CaptchaPhish	Yara detected Captcha Phish	Joe Security
0.7.pages.csv	JoeSecurity_CaptchaPhish	Yara detected Captcha Phish	Joe Security
0.4.pages.csv	JoeSecurity_CaptchaPhish	Yara detected Captcha Phish	Joe Security
0.12.pages.csv	JoeSecurity_CaptchaPhish	Yara detected Captcha Phish	Joe Security
Click to see the 8 entries

HTTP traffic detected: POST /api/online HTTP/1.1Host: cityofmarion.in.gov.marion-police-department.reference-check.topConnection: keep-aliveContent-Length: 4sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Content-Type: application/x-www-form-urlencodedsec-ch-ua-mobile: ?0Accept: */*Origin: https://cityofmarion.in.gov.marion-police-department.reference-check.topSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/index.php?rim=tlczs5qdc&xyr=touz&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&ID=u8Y0610YAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=0a1mjepor016jldjstslou83cm; gid=914854ed48e8213484e3be2fc1f30e315a39b99fd35b7fefb10d5a34428af756a%3A2%3A%7Bi%3A0%3Bs%3A3%3A%22gid%22%3Bi%3A1%3Bs%3A32%3A%227c29e3511ddabcbca3f42c13e86a8ef5%22%3B%7D

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 12 Mar 2025 14:51:02 GMTServer: Apache/2.4.56 (Debian)Content-Length: 327Connection: closeContent-Type: text/html; charset=iso-8859-1

Source: chromecache_85.1.dr	String found in binary or memory: https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/index.php?r
Source: chromecache_80.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFOMCnqEu92Fr1ME7kSn66aGLdTylUAMQXC89YmC2DPNWubEbVmQiArmlw.wo
Source: chromecache_80.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFOMCnqEu92Fr1ME7kSn66aGLdTylUAMQXC89YmC2DPNWubEbVmUiAo.woff2
Source: chromecache_80.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFOMCnqEu92Fr1ME7kSn66aGLdTylUAMQXC89YmC2DPNWubEbVmXiArmlw.wo
Source: chromecache_80.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFOMCnqEu92Fr1ME7kSn66aGLdTylUAMQXC89YmC2DPNWubEbVmYiArmlw.wo
Source: chromecache_80.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFOMCnqEu92Fr1ME7kSn66aGLdTylUAMQXC89YmC2DPNWubEbVmZiArmlw.wo
Source: chromecache_80.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFOMCnqEu92Fr1ME7kSn66aGLdTylUAMQXC89YmC2DPNWubEbVmaiArmlw.wo
Source: chromecache_80.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFOMCnqEu92Fr1ME7kSn66aGLdTylUAMQXC89YmC2DPNWubEbVmbiArmlw.wo
Source: chromecache_80.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFOMCnqEu92Fr1ME7kSn66aGLdTylUAMQXC89YmC2DPNWubEbVn6iArmlw.wo
Source: chromecache_80.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFOMCnqEu92Fr1ME7kSn66aGLdTylUAMQXC89YmC2DPNWubEbVnoiArmlw.wo
Source: chromecache_93.1.dr	String found in binary or memory: https://getbootstrap.com/)
Source: chromecache_93.1.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/main/LICENSE)

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49673
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 49679 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir6864_574287239

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir6864_574287239

Jump to behavior

Source: classification engine

Classification label: mal56.phis.win@24/54@13/5

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\Chrome\Application\Dictionaries

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2056,i,12747472879211138210,13391912177036942368,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://atechelectricalengr.com/mpd/?rim=tlczs5qdc&xyr=touz&t=nbvaz8e57bgik9d&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&chh2pve49=u8Y0610Y"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2056,i,12747472879211138210,13391912177036942368,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	12 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://atechelectricalengr.com/mpd/?rim=tlczs5qdc&xyr=touz&t=nbvaz8e57bgik9d&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&chh2pve49=u8Y0610Y	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/img/pic1-1.svg	0%	Avira URL Cloud	safe
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/botdetect.php?get=script-include&c=JVYntHRcb4BXsdfhn&t=eacd99f81358d8e5e62e46415dc2a23b	0%	Avira URL Cloud	safe
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/index.php?rim=tlczs5qdc&xyr=touz&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&chh2pve49=u8Y0610Y	0%	Avira URL Cloud	safe
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/botdetect/public/bdc-layout-stylesheet.css?t=1741791104	0%	Avira URL Cloud	safe
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/css/styles.min.css	0%	Avira URL Cloud	safe
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/botdetect.php?get=script-include&c=JVYntHRcb4BXsdfhn&t=4d6e2debbedb5da83c50fefa8024eae6	0%	Avira URL Cloud	safe
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/botdetect/public/bdc-layout-stylesheet.css?t=1741791044	0%	Avira URL Cloud	safe
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/botdetect.php?get=image&c=JVYntHRcb4BXsdfhn&t=1400a799ca043567983c28dd957cb010	0%	Avira URL Cloud	safe
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/botdetect/public/bdc-sound-icon.gif	0%	Avira URL Cloud	safe
https://mrt.response-check.top/mpi.php?rim=tlczs5qdc&xyr=touz&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&chh2pve49=u8Y0610Y	0%	Avira URL Cloud	safe
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/botdetect/public/bdc-layout-stylesheet.css?t=1741791081	0%	Avira URL Cloud	safe
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/img/logo.jpg	0%	Avira URL Cloud	safe
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/botdetect.php?get=script-include&c=JVYntHRcb4BXsdfhn&t=1400a799ca043567983c28dd957cb010	0%	Avira URL Cloud	safe
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/botdetect/public/bdc-sound-disabled-icon.gif	0%	Avira URL Cloud	safe
https://cityofmarion.in.gov.marion-police-department.reference-check.top/favicon.ico	0%	Avira URL Cloud	safe
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/css/bootstrap.min.css	0%	Avira URL Cloud	safe
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/botdetect.php?get=image&c=JVYntHRcb4BXsdfhn&t=4d6e2debbedb5da83c50fefa8024eae6	0%	Avira URL Cloud	safe
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/botdetect/public/bdc-reload-disabled-icon.gif	0%	Avira URL Cloud	safe
https://cityofmarion.in.gov.marion-police-department.reference-check.top/api/online	0%	Avira URL Cloud	safe
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/img/pic1-3.svg	0%	Avira URL Cloud	safe
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/img/doc.jpg	0%	Avira URL Cloud	safe
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/img/pic1-2.svg	0%	Avira URL Cloud	safe
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/botdetect.php?get=image&c=JVYntHRcb4BXsdfhn&t=eacd99f81358d8e5e62e46415dc2a23b	0%	Avira URL Cloud	safe
https://cityofmarion.in.gov.marion-police-department.reference-check.top/api/counter	0%	Avira URL Cloud	safe
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/index.php?r	0%	Avira URL Cloud	safe
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/botdetect/public/bdc-reload-icon.gif	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
atechelectricalengr.com	102.212.247.74	true	false	unknown
remote.captcha.com	188.40.246.96	true	false	high
www.google.com	142.250.186.36	true	false	high
response-check.top	94.159.113.79	true	false	unknown
reference-check.top	94.159.113.79	true	true	unknown
cityofmarion.in.gov.marion-police-department.reference-check.top	unknown	unknown	false	high
mrt.response-check.top	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/css/styles.min.css	false	Avira URL Cloud: safe	unknown
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/img/pic1-1.svg	false	Avira URL Cloud: safe	unknown
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/botdetect.php?get=script-include&c=JVYntHRcb4BXsdfhn&t=eacd99f81358d8e5e62e46415dc2a23b	false	Avira URL Cloud: safe	unknown
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/botdetect.php?get=image&c=JVYntHRcb4BXsdfhn&t=1400a799ca043567983c28dd957cb010	false	Avira URL Cloud: safe	unknown
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/botdetect/public/bdc-layout-stylesheet.css?t=1741791044	false	Avira URL Cloud: safe	unknown
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/index.php?rim=tlczs5qdc&xyr=touz&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&chh2pve49=u8Y0610Y	false	Avira URL Cloud: safe	unknown
https://mrt.response-check.top/mpi.php?rim=tlczs5qdc&xyr=touz&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&chh2pve49=u8Y0610Y	false	Avira URL Cloud: safe	unknown
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/botdetect/public/bdc-sound-icon.gif	false	Avira URL Cloud: safe	unknown
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/botdetect/public/bdc-layout-stylesheet.css?t=1741791104	false	Avira URL Cloud: safe	unknown
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/botdetect.php?get=script-include&c=JVYntHRcb4BXsdfhn&t=4d6e2debbedb5da83c50fefa8024eae6	false	Avira URL Cloud: safe	unknown
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/botdetect/public/bdc-layout-stylesheet.css?t=1741791081	false	Avira URL Cloud: safe	unknown
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/img/logo.jpg	false	Avira URL Cloud: safe	unknown
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/botdetect/public/bdc-sound-disabled-icon.gif	false	Avira URL Cloud: safe	unknown
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/botdetect/public/bdc-reload-disabled-icon.gif	false	Avira URL Cloud: safe	unknown
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/css/bootstrap.min.css	false	Avira URL Cloud: safe	unknown
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/img/pic1-3.svg	false	Avira URL Cloud: safe	unknown
https://cityofmarion.in.gov.marion-police-department.reference-check.top/api/online	false	Avira URL Cloud: safe	unknown
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/botdetect.php?get=script-include&c=JVYntHRcb4BXsdfhn&t=1400a799ca043567983c28dd957cb010	false	Avira URL Cloud: safe	unknown
https://cityofmarion.in.gov.marion-police-department.reference-check.top/favicon.ico	false	Avira URL Cloud: safe	unknown
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/botdetect.php?get=image&c=JVYntHRcb4BXsdfhn&t=4d6e2debbedb5da83c50fefa8024eae6	false	Avira URL Cloud: safe	unknown
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/img/doc.jpg	false	Avira URL Cloud: safe	unknown
https://atechelectricalengr.com/mpd/?rim=tlczs5qdc&xyr=touz&t=nbvaz8e57bgik9d&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&chh2pve49=u8Y0610Y	false		unknown
https://remote.captcha.com/include.js?i=DSdFLpCLdukM1CE-jgQNC9zKESlcuxRZL05PWRsxoiIEK5O6IDlOSonnabb6CIaPI0SQU2TD3hRFtbVG0F2e0LkY-4b0bUxJsHpBJNEYq8p7PiQwDijt4l1tF9-x032A8Cszdz0JwcaLphSFsKwwbmn2sHLgZzCnJfC4m34lBHVT_dlOGsYT6e4rF07wNLO57f30Wmcau9ZG-rT_WrkKx772e-_P1cJFAZ_6UDQBdcmSzzFx98VlF_jM2-A	false		high
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/botdetect/public/bdc-reload-icon.gif	false	Avira URL Cloud: safe	unknown
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/botdetect.php?get=image&c=JVYntHRcb4BXsdfhn&t=eacd99f81358d8e5e62e46415dc2a23b	false	Avira URL Cloud: safe	unknown
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/index.php?rim=tlczs5qdc&xyr=touz&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&ID=u8Y0610Y	true		unknown
https://remote.captcha.com/include.js?i=DqEWLv6YsLoOBmE6c41vL5-nFjAXSPcD5Xh5NLbpFqjsbIrlcMpvOOXoMdVvxdkNcqqjoEEVn_G6tXRuiwTrtq3K83a8h71H9NtjBXW7gZsQ-4H2wDJknuiOY3Aeo7SM_iLT9mxzhEhGIoXdzX9hwfAjW1Fw-gtG1jhoVbMrsELKXn6VyMZXqKc-QAhnV9AW2XYJ_Am-tH01uBWSXDYmgkfI12rYsj7reGAHBbaghMZW0BEAALZRJG0Zwho	false		high
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/img/pic1-2.svg	false	Avira URL Cloud: safe	unknown
https://cityofmarion.in.gov.marion-police-department.reference-check.top/api/counter	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/twbs/bootstrap/blob/main/LICENSE)	chromecache_93.1.dr	false		high
https://getbootstrap.com/)	chromecache_93.1.dr	false		high
https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/index.php?r	chromecache_85.1.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.36	www.google.com	United States	15169	GOOGLEUS	false
188.40.246.96	remote.captcha.com	Germany	24940	HETZNER-ASDE	false
102.212.247.74	atechelectricalengr.com	unknown	36926	CKL1-ASNKE	false
94.159.113.79	response-check.top	Russian Federation	49531	NETCOM-R-ASRU	true

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1636289
Start date and time:	2025-03-12 15:49:55 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://atechelectricalengr.com/mpd/?rim=tlczs5qdc&xyr=touz&t=nbvaz8e57bgik9d&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&chh2pve49=u8Y0610Y
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal56.phis.win@24/54@13/5
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.227, 172.217.18.14, 142.250.185.238, 173.194.76.84, 142.250.186.142, 142.250.184.238, 216.58.206.42, 216.58.206.67, 216.58.206.78, 142.250.185.78, 142.250.186.174, 142.250.186.42, 142.250.184.234, 216.58.212.170, 142.250.185.170, 142.250.186.138, 142.250.186.170, 142.250.186.74, 142.250.186.106, 216.58.206.74, 142.250.185.138, 142.250.185.202, 142.250.185.234, 142.250.74.202, 142.250.184.202, 142.250.181.234, 142.250.184.206, 142.250.186.99, 142.250.181.238, 142.250.185.142, 142.250.185.99, 142.250.186.110, 142.250.185.206, 4.245.163.56, 23.60.203.209, 40.126.31.128, 2.19.96.66
Excluded domains from analysis (whitelisted): www.bing.com, clients1.google.com, fonts.googleapis.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, fonts.gstatic.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, redirector.gvt1.com, login.live.com, update.googleapis.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://atechelectricalengr.com/mpd/?rim=tlczs5qdc&xyr=touz&t=nbvaz8e57bgik9d&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&chh2pve49=u8Y0610Y

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	453
Entropy (8bit):	5.4631838475597725
Encrypted:	false
SSDEEP:	6:TMVBdojsMbdgXRxVnzVEnVWBrmaKmc4slZKYnic4sf35Ht/sUgqOeMVERINxIiHv:TMHdwsMi/nzVPK/KYf3Zt/spNl4iHv
MD5:	9BDF81A2C57C62EBC808E3051636FD80
SHA1:	6760FDAECFA139212FED4D6C51A731608818A828
SHA-256:	FC0E3CE72A4D2D7243A6241ADB725C9FB75F6EEF167B4DE8330DD5D64F8F50A4
SHA-512:	10BC5452B20A5C7333FA714EC53428788807AD691416F668D2A3B7E902B3C9DE3C01AF6A4A758A89BB5E2F6F2B6F6D2E3C69197C564F3085146A8B3327573715
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Generator: Adobe Illustrator 23.0.6, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->..<svg version="1.1" id="...._1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"... width="13.1px" height="66px" viewBox="0 0 13.1 66" style="enable-background:new 0 0 13.1 66;" xml:space="preserve">..<path d="M5,0v66H0V0H5z"/>..<path d="M13,26v40H8V26H13z"/>..</svg>..

Chrome Cache Entry: 65

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	453
Entropy (8bit):	5.476124853696989
Encrypted:	false
SSDEEP:	6:TMVBdojsMbdgXRxVnzVEnVWBrmaKmc4slZKYnic4sf35Ht/sUgqOeMVERIXImL:TMHdwsMi/nzVPK/KYf3Zt/spNl4mL
MD5:	97AE45B5ADE5F66B5D3D88A52CCA4E25
SHA1:	87CC1461134BF3A9257391F5D9E671704841EF5A
SHA-256:	A4FD82398DD04B81B7C8B50828B8F51D821BC1B43E12C64D2808AFED9D929DA6
SHA-512:	8BC3415C88A0381A0FEF786AD685DC7EC817E7D501198D43581596C1C5071A3FF397FBE558D608961129DED8E4611CB0DD843EB52CBDAE8A575325FD07E7A95D
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Generator: Adobe Illustrator 23.0.6, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->..<svg version="1.1" id="...._1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"... width="13.1px" height="66px" viewBox="0 0 13.1 66" style="enable-background:new 0 0 13.1 66;" xml:space="preserve">..<path d="M5,22v44H0V22H5z"/>..<path d="M13,0v66H8V0H13z"/>..</svg>..

Chrome Cache Entry: 66

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=0], baseline, precision 8, 1081x1449, components 3
Category:	dropped
Size (bytes):	69113
Entropy (8bit):	7.570085661026048
Encrypted:	false
SSDEEP:	1536:JLCDY7ATCN6LQs90/uptTDDw1CZOPRqT38mVyKJDYnwFfflf:1Z72/ju+tUAOZqT38+lYnw7
MD5:	CEA688E482A69EB2B3EF419F8909A071
SHA1:	49DEB40970F439B5BBCAC06487615C73C89C0F95
SHA-256:	87E94491D81E8575B9D307C71F3DF3BA9F8FD1F0BCD70ECF917B179A7D2C477E
SHA-512:	4CD737245E5E589DACB3C42B7A5020601C36E28BDECAF776633B1987FB6F2248A5D24FF6FD1DB736FB97E9D3C24EA1F862DDE3F6CB06996092966DF2D0881FF4
Malicious:	false
Reputation:	low
Preview:	......JFIF.....`.`......Exif..MM.*.............>http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>..<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 ">...<rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">....<rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:3E8A917AC5F811EC800486838A1A1664" xmpMM:InstanceID="xmp.iid:3E8A9179C5F811EC800486838A1A1664" xmp:CreatorTool="Adobe Photoshop CC 2019 Windows">.....<xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2C432877A9B811EC8774A7A407060043" stRef:documentID="xmp.did:2C432878A9B811EC8774A7A407060043"/>....</rdf:Description>...</rdf:RDF>..</x:xmpmeta>..<?xpacket end='w'?>...C....................................................................C...................................................

Chrome Cache Entry: 67

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	453
Entropy (8bit):	5.476124853696989
Encrypted:	false
SSDEEP:	6:TMVBdojsMbdgXRxVnzVEnVWBrmaKmc4slZKYnic4sf35Ht/sUgqOeMVERIXImL:TMHdwsMi/nzVPK/KYf3Zt/spNl4mL
MD5:	97AE45B5ADE5F66B5D3D88A52CCA4E25
SHA1:	87CC1461134BF3A9257391F5D9E671704841EF5A
SHA-256:	A4FD82398DD04B81B7C8B50828B8F51D821BC1B43E12C64D2808AFED9D929DA6
SHA-512:	8BC3415C88A0381A0FEF786AD685DC7EC817E7D501198D43581596C1C5071A3FF397FBE558D608961129DED8E4611CB0DD843EB52CBDAE8A575325FD07E7A95D
Malicious:	false
Reputation:	low
URL:	https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/img/pic1-2.svg
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Generator: Adobe Illustrator 23.0.6, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->..<svg version="1.1" id="...._1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"... width="13.1px" height="66px" viewBox="0 0 13.1 66" style="enable-background:new 0 0 13.1 66;" xml:space="preserve">..<path d="M5,22v44H0V22H5z"/>..<path d="M13,0v66H8V0H13z"/>..</svg>..

Chrome Cache Entry: 68

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 22 x 22
Category:	dropped
Size (bytes):	1071
Entropy (8bit):	5.456081951539905
Encrypted:	false
SSDEEP:	24:dmFOmITA4e/k3QkGTqqF3rkuBDFJ8Dvw5iYHcBEDWb:oFOmT1/kcH2M5iYHcBEqb
MD5:	5363D08FC530C3BAE37BE3D4EEA066C7
SHA1:	6F974C9E483A8265D749559DB1C02EFC458559A9
SHA-256:	F3BDD2185C191359C53405A2108EEA8ED242F94B9E87832A23FF703E809F2915
SHA-512:	115EE9F765C986313358A4117B2C1ECE02628D7B1AD5A4105BA533B1EC8A0BBA90E74B6A34CC86C26365C4C2217C0A874DD33660117315A9E9C6688CE5DED2C9
Malicious:	false
Reputation:	low
Preview:	GIF89a..................................................................................."................P.-...".....xZ.}.."\...e.0..a.#}...~e..2".N..}0.Z...........Z...a..}..H.....".......R..ea.p}.l..a..c..e.. ..f..i".l..e..................."......0....#.....Z.T..N..}..X...........k........................a........H..........................Z....a..}...p..`.a$.}....................aN.}}...L."N..}......."".................x..}.."............#...e0..(.aP.}}.p..}..".....................(.aP.}}.......".N..}......a..}...x..}.a"N}.}xA~}.."b..}...~..........#..P..O..}......................................#F.P..OL.}............. .w..P.aO.}.h.0....b..}.\.#..P..O..}.............#..P."O..}.............l!..R..O..}..{#.PP.OO.}}T...........40...m......`.......#...s....-..H...!.......,.......................,x.......H.b.......E..(...!A...+...... 00Y.B..8U.`.@...%aR. a..:yJ@0.B.....<. )....@..a.L..(\.k.....(H8. B.W.(. ..,,.@v..L2`......&...`B....8.!....-.X.......X..9......$...^..

Chrome Cache Entry: 69

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1046
Entropy (8bit):	4.762583310981761
Encrypted:	false
SSDEEP:	24:GfwuIKAjrG7KH42HBm402P28HBN0KPI8HBNic2PI6PHBUi+LZpuw:RFBPG7442HBm40Y28HBN0cI8HBNicYIT
MD5:	FF5B97880EE056D0620C253BC2910D3F
SHA1:	80B0E051C4DCD7FF44D099317B9B14BDB91D73AA
SHA-256:	EAC0EC918CD74C051F4C5C83CDFE60C12A3BF2FD44A0472661FAFAB04777E9F9
SHA-512:	84E412A229E4A08DB5811F50D3E883DDA8701A07207934951A139643E9B240B899B68FD99FAC1406E8607E653AEC1CBF203C8F2A75ECC65D3379E9C07CD2843F
Malicious:	false
Reputation:	low
URL:	https://remote.captcha.com/include.js?i=DIREuEMGUIk0fVgZRGpskyCzU6S2kys6wn0VYa13FTBpBAv6djqLkncSK5ERuz3oRRA30_1VhnNIzEenNeYLAGUGcM1kp-CGdfSCUoIkDyP0DraWBnH5fBB4On5o1hvbtbJ1wMVoCON7E7yg_6JHmTucguvbQpTIGPDQ9iBTq8wGMZD0tN-WZxEcNY0P5gVGNhjQK-HAiqlTqW_NSfcm-CsJI7HSG80h6BvTyCa0l6wMznc1XPeSW3csYBk
Preview:	/..Google was indexing this file while it was empty -- probably because it couldn't figure out that an empty file can be intentionally empty JavaScript file -- despite being invoked as such..So OK, hopefully Google will be smarter with this version of it...BotDetect Team../...// This JavaScript code snippet shows how to swap two variables without using a third temporary variable..var swapDemo_firstVar = 19;.var swapDemo_secondVar = 7;.// variable values are: swapDemo_firstVar is 19, swapDemo_secondVar is 7..swapDemo_firstVar = swapDemo_firstVar + swapDemo_secondVar;.// now variable values are: swapDemo_firstVar is 26, swapDemo_secondVar is 7..swapDemo_secondVar = swapDemo_firstVar - swapDemo_secondVar;.// now variable values are: swapDemo_firstVar is 26, swapDemo_secondVar is 19..swapDemo_firstVar = swapDemo_firstVar - swapDemo_secondVar;.// and finally:.// now variable values are: swapDemo_firstVar is 7, swapDemo_secondVar is 19 :)..../*..See Google, it is JavaScript indeed. Would y

Chrome Cache Entry: 70

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	3611
Entropy (8bit):	4.90892673332111
Encrypted:	false
SSDEEP:	48:eylnenIUqn1D17rFT/A5eKi1fZd1YOypxU:eyleIlagKKBd1YO2xU
MD5:	78141454F16AC3DB94FB912285AAB253
SHA1:	2B647A5570AFE9C7E10F6B103487708C9A5035C0
SHA-256:	26502ECAD502D81B20A0F6AC7F5724F8711F5E26FD7589A73D1CD155B97A878C
SHA-512:	65DC02912F3399FD62DB245A08C0FE7350398D9FBCAE69FF88B7AA8C2AE6CDBEB34BCF8024FE35B5EC1F6316726A22CC3F6AA95AD6FE15A15BF66196FBF2494A
Malicious:	false
Reputation:	low
URL:	https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/botdetect/public/bdc-layout-stylesheet.css?t=1741791104
Preview:	.BDC_CaptchaDiv {. padding: 0 !important;. margin: 0 !important;. overflow: visible !important;.}...BDC_CaptchaImageDiv {. margin: 0 !important;. padding: 0 !important;. display: -moz-inline-stack;. display: inline-block !important;. vertical-align: top !important;. zoom: 1 !important;. display: inline !important;.}...BDC_CaptchaIconsDiv {. text-align: left !important;. margin: 0 2px -4px 2px !important;. padding: 0 !important;. display: -moz-inline-stack;. display: inline-block !important;. vertical-align: top !important;. zoom: 1 !important;. display: inline !important;.}...BDC_CaptchaDiv a:link, .BDC_CaptchaDiv a:visited, .BDC_CaptchaDiv a:focus, .BDC_CaptchaDiv a:hover, .BDC_CaptchaDiv a:active {. margin: 0 !important;. padding: 0 !important;. background-color: transparent !important;. border: none !important;. text-decoration: none !important;. outline: none !important;. -moz-outline-style: none !important;. display: -moz-inline-stack;. display: inline

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=0], baseline, precision 8, 1081x1449, components 3
Category:	downloaded
Size (bytes):	69113
Entropy (8bit):	7.570085661026048
Encrypted:	false
SSDEEP:	1536:JLCDY7ATCN6LQs90/uptTDDw1CZOPRqT38mVyKJDYnwFfflf:1Z72/ju+tUAOZqT38+lYnw7
MD5:	CEA688E482A69EB2B3EF419F8909A071
SHA1:	49DEB40970F439B5BBCAC06487615C73C89C0F95
SHA-256:	87E94491D81E8575B9D307C71F3DF3BA9F8FD1F0BCD70ECF917B179A7D2C477E
SHA-512:	4CD737245E5E589DACB3C42B7A5020601C36E28BDECAF776633B1987FB6F2248A5D24FF6FD1DB736FB97E9D3C24EA1F862DDE3F6CB06996092966DF2D0881FF4
Malicious:	false
Reputation:	low
URL:	https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/img/doc.jpg
Preview:	......JFIF.....`.`......Exif..MM.*.............>http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>..<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 ">...<rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">....<rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:3E8A917AC5F811EC800486838A1A1664" xmpMM:InstanceID="xmp.iid:3E8A9179C5F811EC800486838A1A1664" xmp:CreatorTool="Adobe Photoshop CC 2019 Windows">.....<xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2C432877A9B811EC8774A7A407060043" stRef:documentID="xmp.did:2C432878A9B811EC8774A7A407060043"/>....</rdf:Description>...</rdf:RDF>..</x:xmpmeta>..<?xpacket end='w'?>...C....................................................................C...................................................

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	458
Entropy (8bit):	5.469110136768744
Encrypted:	false
SSDEEP:	6:TMVBdojsMbdgXRxVnzVEnVWBrmaKmc4slZKYnic4sf35Ht/sUgqOeMVERI1VGiqW:TMHdwsMi/nzVPK/KYf3Zt/spNluiqbS
MD5:	1967F211D55704C2929CC5D27147F2A5
SHA1:	3BCF030D8AA584BB8B51079B783CEB92B35651F5
SHA-256:	0F4BECBC6B91474FCC324FFD9D5D2F37633FD7E616B2014891C66B1CE02AF893
SHA-512:	D0FDC0AE201E951AA8CEC146C92AB7BCA88CCC4B977A7A09F83200A010AF1A4D3506F1710219E32FC75A00A8A9B560C7D4409AE8B27A2DBF56B16319D6195062
Malicious:	false
Reputation:	low
URL:	https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/img/pic1-1.svg
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Generator: Adobe Illustrator 23.0.6, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->..<svg version="1.1" id="...._1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"... width="13.1px" height="66px" viewBox="0 0 13.1 66" style="enable-background:new 0 0 13.1 66;" xml:space="preserve">..<path d="M13.1,0v66h-5V0H13.1z"/>..<path d="M5,22v44H0V22H5z"/>..</svg>..

Chrome Cache Entry: 73

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:	3:HCgYn:igY
MD5:	373FC64425D16437EC88212B43F2DC87
SHA1:	E07006092DDCDA6D09B4A74D933952C4337461CB
SHA-256:	D3E85FEF73FE3CD0F978C9C2D15850A079C21B593B9BB0080AD010394128C203
SHA-512:	B539FD65B1CAED439BA32380DCC83D4132465B8272B188E6C4F3313DD56A46A767203E14B2C65D40F4CADF419DFEC471073281DA85A4205C9074C8519778BC47
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChRDaHJvbWUvMTM0LjAuNjk5OC4zNhIZCR4Bb2UX_H1hEgUNYn40MiHUEmVmy_pSPQ==?alt=proto
Preview:	CgkKBw1ifjQyGgA=

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	3611
Entropy (8bit):	4.90892673332111
Encrypted:	false
SSDEEP:	48:eylnenIUqn1D17rFT/A5eKi1fZd1YOypxU:eyleIlagKKBd1YO2xU
MD5:	78141454F16AC3DB94FB912285AAB253
SHA1:	2B647A5570AFE9C7E10F6B103487708C9A5035C0
SHA-256:	26502ECAD502D81B20A0F6AC7F5724F8711F5E26FD7589A73D1CD155B97A878C
SHA-512:	65DC02912F3399FD62DB245A08C0FE7350398D9FBCAE69FF88B7AA8C2AE6CDBEB34BCF8024FE35B5EC1F6316726A22CC3F6AA95AD6FE15A15BF66196FBF2494A
Malicious:	false
Reputation:	low
URL:	https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/botdetect/public/bdc-layout-stylesheet.css?t=1741791081
Preview:	.BDC_CaptchaDiv {. padding: 0 !important;. margin: 0 !important;. overflow: visible !important;.}...BDC_CaptchaImageDiv {. margin: 0 !important;. padding: 0 !important;. display: -moz-inline-stack;. display: inline-block !important;. vertical-align: top !important;. zoom: 1 !important;. display: inline !important;.}...BDC_CaptchaIconsDiv {. text-align: left !important;. margin: 0 2px -4px 2px !important;. padding: 0 !important;. display: -moz-inline-stack;. display: inline-block !important;. vertical-align: top !important;. zoom: 1 !important;. display: inline !important;.}...BDC_CaptchaDiv a:link, .BDC_CaptchaDiv a:visited, .BDC_CaptchaDiv a:focus, .BDC_CaptchaDiv a:hover, .BDC_CaptchaDiv a:active {. margin: 0 !important;. padding: 0 !important;. background-color: transparent !important;. border: none !important;. text-decoration: none !important;. outline: none !important;. -moz-outline-style: none !important;. display: -moz-inline-stack;. display: inline

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 22 x 22
Category:	dropped
Size (bytes):	1083
Entropy (8bit):	7.939822191104927
Encrypted:	false
SSDEEP:	24:dJtIsQAQ8Ic44Yo4bo4Y4ofXQLo4LoXgMXI7gAgXIL1C0Ay5dIXWAQIwl:p3nfXP3nfXfX/HXPX/HXaC0AyDQQR
MD5:	A97BFD93EA9EC02B04D746648FD909D6
SHA1:	7CEEB57C8F327587AC79ED6B8B9B6C334D926ED1
SHA-256:	96AA0E2304D5F823DEFCE8F2EE99EDDF59CAB3A49159B7B7470886D468B66AC1
SHA-512:	063E8267C8245C04FAB3D7E1D239C0DBED2E66E53A8BA5803ADB814491ABF30254D3CBD918359AE2445974F6FE6A0324C122C817FA1ABD041A90729F97F21320
Malicious:	false
Reputation:	low
Preview:	GIF89a....................................................................................................... !!!"""###$$$%%%&&&'''((()))**+++,,,---...///000111222333444555666777888999:::;;;<<<===>>>???@@@AAABBBCCCDDDEEEFFFGGGHHHIIIJJJKKKLLLMMMNNNOOOPPPQQQRRRSSSTTTUUUVVVWWWXXXYYYZZZ[[[\\\]]]^^^___```aaabbbcccdddeeefffggghhhiiijjjkkklllmmmnnnooopppqqqrrrssstttuuuvvvwwwxxxyyyzzz{{{\|\|\|}}}~~~...................................................................................................................................................................................................................................................................................................................................................................................................!.......,.......................,........H."........6..q.{.O_.a.~.....Cv...I.&.].z...Sd.3..,.3......r.4i/`....W.(.\.1=J.).........b......)._.r.:o^.e..6.Z.`.s..G7W.`..[...\......0^u...v....B..u.\....7U^..h

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 22 x 22
Category:	dropped
Size (bytes):	1170
Entropy (8bit):	5.892091590438216
Encrypted:	false
SSDEEP:	12:dgPAZcIneL9wbicervWvdbrPkzTz4wGOtbifl4BpU01a7OgC+FQawt:dyhY69GiXSvdUznhGyXIPChv
MD5:	86190A82D56DF324E9C499B07D3AB768
SHA1:	C57C250EFF55C3D02E924F810714893A7ABFEF5C
SHA-256:	7106A845473C9DF48F3C2D4737F9CB2804310AEC8CF1B35BBD15551A3A05BF4E
SHA-512:	D5B974962A293D49C62C58CEB5B3765CFB93E8BC5583FB9B9464E720D005954501538BD63C65BD71370FF323DAE682CEDE6FABBE57A8C31F567FBDA3726F0285
Malicious:	false
Reputation:	low
Preview:	GIF89a.......000.........666..................SSS..............................DDD.........JJJ.........QQQ.....................NNN......>>>]]].....................qqqjjj...\\\............rrr.......///...VVV@@@...cccRRR...QQQ.........yyysss.......EEEjjj\|\|\|bbbCCCgggZZZ.........^^^.........ggg...PPP@@@......pppIII......\\\...WWW..............fffhhh.......zzz...ccc...ZZZGGG}}}......QQQ...........aaa___................................................................................................................................................................................................................................................................................................................................................................................!.......,..............\........,8.......@.A....X.pDM...,.........H..f..C.Vr. ..H..:D...G.6v...b....;..,.@...a.>e.#..2X..P....._?.U......r-.....h.....B...,@.....1.@9..6x-.u.v....d.H.....x.x.@..Z.$.......D...X.....k

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	458
Entropy (8bit):	5.469110136768744
Encrypted:	false
SSDEEP:	6:TMVBdojsMbdgXRxVnzVEnVWBrmaKmc4slZKYnic4sf35Ht/sUgqOeMVERI1VGiqW:TMHdwsMi/nzVPK/KYf3Zt/spNluiqbS
MD5:	1967F211D55704C2929CC5D27147F2A5
SHA1:	3BCF030D8AA584BB8B51079B783CEB92B35651F5
SHA-256:	0F4BECBC6B91474FCC324FFD9D5D2F37633FD7E616B2014891C66B1CE02AF893
SHA-512:	D0FDC0AE201E951AA8CEC146C92AB7BCA88CCC4B977A7A09F83200A010AF1A4D3506F1710219E32FC75A00A8A9B560C7D4409AE8B27A2DBF56B16319D6195062
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Generator: Adobe Illustrator 23.0.6, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->..<svg version="1.1" id="...._1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"... width="13.1px" height="66px" viewBox="0 0 13.1 66" style="enable-background:new 0 0 13.1 66;" xml:space="preserve">..<path d="M13.1,0v66h-5V0H13.1z"/>..<path d="M5,22v44H0V22H5z"/>..</svg>..

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1076x1274, components 3
Category:	dropped
Size (bytes):	157233
Entropy (8bit):	7.828518880185778
Encrypted:	false
SSDEEP:	3072:1iLu7dE99AO8fyrFqWY5fAPZ4UidW5DbDjeopJGjApSJZHYbJ:x709AOT05I+rdCLK3jhQ
MD5:	7705573FF00CBE21B270488F4C69CDAA
SHA1:	A9FE44AEE4250106206238215A8A52902BE4DEA7
SHA-256:	CAE876D0E44274E953B5CAE70E5215A21B177B8D2896DE2AEEA6530EFBA6411B
SHA-512:	DB0AF549B6C33794C15321D69A6D689B66883D66D9E8FFF40326678A0609AC447BC33BA771D99C589D14D096C75BCCE6EEB20E1BCAF65EDC56BED1B628E0EB0C
Malicious:	false
Reputation:	low
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................4.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..M..(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 22 x 22
Category:	dropped
Size (bytes):	1191
Entropy (8bit):	6.4656239153974715
Encrypted:	false
SSDEEP:	12:dr+rJS3NYWFz//w4x1qVG7iyX+Zfw/gIgsydjk1/LAinhjQ3i6YFkQ5FG:drsJS3NrFDY4x1IqX0fw/5cmlhjQ98c
MD5:	FC212AEDF7AA6B680225AB7E9C6A5B8F
SHA1:	BEE6C9E55324D2F0809FF42C9FC283E1FBE1CE39
SHA-256:	F34A3B7A468FE25416791A63831CF9ED92A2985B57C5F5BB4AD30DD7D873B852
SHA-512:	2BFA281F33C9F9A03BD7CC8BD5F3689365DF900507D47D4492906C08D448C3F70DF7DD4A9A6BC6E4584783FFC01864B10D1DCEAC1425E4AC0A1A5B3D2A7DC479
Malicious:	false
Reputation:	low
Preview:	GIF89a.......000.......................................lll............................SSS............EEE...............kkk...888...[[[...........................]]]......vvv.........\|\|\|.................MMM.......fff.................```iii...GGG...........................EEE.........LLL...QQQ.........iiipppqqq555...........sssyyyrrr......QQQ.................rrrJJJ...}}}..........MMM..............>>>.................;;;.............................................___......NNN......www.......{{{........................................................................................................................................................................................................................................................................!.......,............S.L........,(.......@Q.....X..)..C.,........*-X....R+.h. s$....4.....3...P.bEN....`....2@L8..b..(..2MzsS..Bb..C"..=jfDX.)...q.`.....m.x...._.o7t.C......d.R.....:.U..G.,d.....C.. B.P......xXsJ..0}

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1572)
Category:	downloaded
Size (bytes):	5746
Entropy (8bit):	5.3636254724287085
Encrypted:	false
SSDEEP:	96:1OEbaNMclOEbaNMHFZKOEbaNMjOEbaNM4TOEbaNMUy+aZjzBrgOEbaNMPubqGIFh:2NMcmNMBNM0NM4kNMUqbNMGbqGIwV4Bt
MD5:	DCE8B1041389E28A34E22250FEED115A
SHA1:	9C290194B85035FB588C9E25FA515C676172B920
SHA-256:	1EDE014F47795C3D04812B724EF687909970F776D37854E7312A5AD859C84E41
SHA-512:	2A5CC5707C9F66B2071DB4F050A1E025517513A1E8E70D3B6D9E06CBB4E389701A90D6212D41C3873357ECAD8D48AF084A2B593BBEB2AF8436C6BB305BCEA253
Malicious:	false
Reputation:	low
URL:	https://fonts.googleapis.com/css2?family=Roboto:wght@400&display=swap
Preview:	/* cyrillic-ext /.@font-face {. font-family: 'Roboto';. font-style: normal;. font-weight: 400;. font-stretch: 100%;. font-display: swap;. src: url(https://fonts.gstatic.com/s/roboto/v47/KFOMCnqEu92Fr1ME7kSn66aGLdTylUAMQXC89YmC2DPNWubEbVmZiArmlw.woff2) format('woff2');. unicode-range: U+0460-052F, U+1C80-1C8A, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;.}./ cyrillic /.@font-face {. font-family: 'Roboto';. font-style: normal;. font-weight: 400;. font-stretch: 100%;. font-display: swap;. src: url(https://fonts.gstatic.com/s/roboto/v47/KFOMCnqEu92Fr1ME7kSn66aGLdTylUAMQXC89YmC2DPNWubEbVmQiArmlw.woff2) format('woff2');. unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;.}./ greek-ext */.@font-face {. font-family: 'Roboto';. font-style: normal;. font-weight: 400;. font-stretch: 100%;. font-display: swap;. src: url(https://fonts.gstatic.com/s/roboto/v47/KFOMCnqEu92Fr1ME7kSn66aGLdTylUAMQXC89YmC2DPNWubEbVmYiArmlw.woff2) format('woff2');. unicode-ran

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1046
Entropy (8bit):	4.762583310981761
Encrypted:	false
SSDEEP:	24:GfwuIKAjrG7KH42HBm402P28HBN0KPI8HBNic2PI6PHBUi+LZpuw:RFBPG7442HBm40Y28HBN0cI8HBNicYIT
MD5:	FF5B97880EE056D0620C253BC2910D3F
SHA1:	80B0E051C4DCD7FF44D099317B9B14BDB91D73AA
SHA-256:	EAC0EC918CD74C051F4C5C83CDFE60C12A3BF2FD44A0472661FAFAB04777E9F9
SHA-512:	84E412A229E4A08DB5811F50D3E883DDA8701A07207934951A139643E9B240B899B68FD99FAC1406E8607E653AEC1CBF203C8F2A75ECC65D3379E9C07CD2843F
Malicious:	false
Reputation:	low
URL:	https://remote.captcha.com/include.js?i=DqEWLv6YsLoOBmE6c41vL5-nFjAXSPcD5Xh5NLbpFqjsbIrlcMpvOOXoMdVvxdkNcqqjoEEVn_G6tXRuiwTrtq3K83a8h71H9NtjBXW7gZsQ-4H2wDJknuiOY3Aeo7SM_iLT9mxzhEhGIoXdzX9hwfAjW1Fw-gtG1jhoVbMrsELKXn6VyMZXqKc-QAhnV9AW2XYJ_Am-tH01uBWSXDYmgkfI12rYsj7reGAHBbaghMZW0BEAALZRJG0Zwho
Preview:	/..Google was indexing this file while it was empty -- probably because it couldn't figure out that an empty file can be intentionally empty JavaScript file -- despite being invoked as such..So OK, hopefully Google will be smarter with this version of it...BotDetect Team../...// This JavaScript code snippet shows how to swap two variables without using a third temporary variable..var swapDemo_firstVar = 19;.var swapDemo_secondVar = 7;.// variable values are: swapDemo_firstVar is 19, swapDemo_secondVar is 7..swapDemo_firstVar = swapDemo_firstVar + swapDemo_secondVar;.// now variable values are: swapDemo_firstVar is 26, swapDemo_secondVar is 7..swapDemo_secondVar = swapDemo_firstVar - swapDemo_secondVar;.// now variable values are: swapDemo_firstVar is 26, swapDemo_secondVar is 19..swapDemo_firstVar = swapDemo_firstVar - swapDemo_secondVar;.// and finally:.// now variable values are: swapDemo_firstVar is 7, swapDemo_secondVar is 19 :)..../*..See Google, it is JavaScript indeed. Would y

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (10848), with no line terminators
Category:	downloaded
Size (bytes):	10848
Entropy (8bit):	4.989718667161909
Encrypted:	false
SSDEEP:	96:E6viVXOG+izp59enW4SU0bMEEhoSoe1nzo7UHHNeHdJpQK5DneP+pbIcOVCoNhGU:SNZWnoeNcvHdDIPgY6ELK2
MD5:	8366C26CC273587D0E3C3545CCAFC608
SHA1:	346D4F7061F2AAC1A2893F34AC31423C8E78EDA3
SHA-256:	AC4F4A3305865DC108B43E38D74E21CDC7FB3A4D46BC0D8F6B9AB2DBCE444C48
SHA-512:	E057AA4CF415E87D9876299537964B7A860CF1EA094635E19B0C30ED8C8B6624DE6CED11872A386414A98DAC912AE455757C915F33C8041493B9C71EBA6CB5BD
Malicious:	false
Reputation:	low
URL:	https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/css/styles.min.css
Preview:	@import url(https://fonts.googleapis.com/css2?family=Roboto:wght@400&display=swap);body,html{height:100%}body.signIn{background:#fff}body.signIn .singIn-bg{display:flex;align-items:center;width:100%;height:100%;text-align:center;flex-direction:column}body.signIn .singIn-bg .background_top{max-width:100%;width:1024px}body.signIn .singIn-bg .logo_top{margin-top:23px;margin-bottom:30px}body.signIn .singIn-bg .form-signin{width:100%;max-width:1024px;margin:0 auto;background:#efefef;padding:40px 0}body.signIn .singIn-bg .form-signin form{display:flex;flex-direction:column;align-items:center}body.signIn .singIn-bg .form-signin form .logo{margin-bottom:1.5rem!important}@media (max-width:431px){body.signIn .singIn-bg .form-signin form .logo{max-width:80%}}body.signIn .singIn-bg .form-signin form h1{color:#000;font-size:26px;font-weight:500!important;margin-bottom:2rem!important}body.signIn .singIn-bg .form-signin form .form-floating{position:relative;padding-bottom:1.5rem;min-width:330px}@medi

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1076x1274, components 3
Category:	downloaded
Size (bytes):	157233
Entropy (8bit):	7.828518880185778
Encrypted:	false
SSDEEP:	3072:1iLu7dE99AO8fyrFqWY5fAPZ4UidW5DbDjeopJGjApSJZHYbJ:x709AOT05I+rdCLK3jhQ
MD5:	7705573FF00CBE21B270488F4C69CDAA
SHA1:	A9FE44AEE4250106206238215A8A52902BE4DEA7
SHA-256:	CAE876D0E44274E953B5CAE70E5215A21B177B8D2896DE2AEEA6530EFBA6411B
SHA-512:	DB0AF549B6C33794C15321D69A6D689B66883D66D9E8FFF40326678A0609AC447BC33BA771D99C589D14D096C75BCCE6EEB20E1BCAF65EDC56BED1B628E0EB0C
Malicious:	false
Reputation:	low
URL:	https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/img/logo.jpg
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................4.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..M..(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	453
Entropy (8bit):	5.4631838475597725
Encrypted:	false
SSDEEP:	6:TMVBdojsMbdgXRxVnzVEnVWBrmaKmc4slZKYnic4sf35Ht/sUgqOeMVERINxIiHv:TMHdwsMi/nzVPK/KYf3Zt/spNl4iHv
MD5:	9BDF81A2C57C62EBC808E3051636FD80
SHA1:	6760FDAECFA139212FED4D6C51A731608818A828
SHA-256:	FC0E3CE72A4D2D7243A6241ADB725C9FB75F6EEF167B4DE8330DD5D64F8F50A4
SHA-512:	10BC5452B20A5C7333FA714EC53428788807AD691416F668D2A3B7E902B3C9DE3C01AF6A4A758A89BB5E2F6F2B6F6D2E3C69197C564F3085146A8B3327573715
Malicious:	false
Reputation:	low
URL:	https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/img/pic1-3.svg
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Generator: Adobe Illustrator 23.0.6, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->..<svg version="1.1" id="...._1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"... width="13.1px" height="66px" viewBox="0 0 13.1 66" style="enable-background:new 0 0 13.1 66;" xml:space="preserve">..<path d="M5,0v66H0V0H5z"/>..<path d="M13,26v40H8V26H13z"/>..</svg>..

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	289
Entropy (8bit):	5.220860257912112
Encrypted:	false
SSDEEP:	6:aIeVM2ABmommYuu+57PmLGc+OHcMkvYEcXmqiztWEmi/FFeYh:SV+comGu0D1OivX1gch
MD5:	DC8B142A5DF824CC31F9B92D368F7094
SHA1:	661D5E53868D5826119678C524829AFC24F522DF
SHA-256:	27B8407F573791670106EC5905E74BF70AF8A5152FCABB7B9907BBBE9DCD6B77
SHA-512:	225349937948DD7E876B76A4545B7729A289B7C330BD4F2756F7746EC2D3EF772E25C6301A53EBE76E7F42BF88D4986DA6F5B54FCBC8EAA4166833743FD7FD06
Malicious:	false
Reputation:	low
URL:	https://mrt.response-check.top/mpi.php?rim=tlczs5qdc&xyr=touz&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&chh2pve49=u8Y0610Y
Preview:	<div>. <h1></h1>. <p></p>.</div>....<script type='text/javascript'> window.location.href='https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/index.php?rim=tlczs5qdc&xyr=touz&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&chh2pve49=u8Y0610Y' </script>

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 22 x 22
Category:	downloaded
Size (bytes):	1191
Entropy (8bit):	6.4656239153974715
Encrypted:	false
SSDEEP:	12:dr+rJS3NYWFz//w4x1qVG7iyX+Zfw/gIgsydjk1/LAinhjQ3i6YFkQ5FG:drsJS3NrFDY4x1IqX0fw/5cmlhjQ98c
MD5:	FC212AEDF7AA6B680225AB7E9C6A5B8F
SHA1:	BEE6C9E55324D2F0809FF42C9FC283E1FBE1CE39
SHA-256:	F34A3B7A468FE25416791A63831CF9ED92A2985B57C5F5BB4AD30DD7D873B852
SHA-512:	2BFA281F33C9F9A03BD7CC8BD5F3689365DF900507D47D4492906C08D448C3F70DF7DD4A9A6BC6E4584783FFC01864B10D1DCEAC1425E4AC0A1A5B3D2A7DC479
Malicious:	false
Reputation:	low
URL:	https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/botdetect/public/bdc-sound-icon.gif
Preview:	GIF89a.......000.......................................lll............................SSS............EEE...............kkk...888...[[[...........................]]]......vvv.........\|\|\|.................MMM.......fff.................```iii...GGG...........................EEE.........LLL...QQQ.........iiipppqqq555...........sssyyyrrr......QQQ.................rrrJJJ...}}}..........MMM..............>>>.................;;;.............................................___......NNN......www.......{{{........................................................................................................................................................................................................................................................................!.......,............S.L........,(.......@Q.....X..)..C.,........*-X....R+.h. s$....4.....3...P.bEN....`....2@L8..b..(..2MzsS..Bb..C"..=jfDX.)...q.`.....m.x...._.o7t.C......d.R.....:.U..G.,d.....C.. B.P......xXsJ..0}

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 22 x 22
Category:	downloaded
Size (bytes):	1170
Entropy (8bit):	5.892091590438216
Encrypted:	false
SSDEEP:	12:dgPAZcIneL9wbicervWvdbrPkzTz4wGOtbifl4BpU01a7OgC+FQawt:dyhY69GiXSvdUznhGyXIPChv
MD5:	86190A82D56DF324E9C499B07D3AB768
SHA1:	C57C250EFF55C3D02E924F810714893A7ABFEF5C
SHA-256:	7106A845473C9DF48F3C2D4737F9CB2804310AEC8CF1B35BBD15551A3A05BF4E
SHA-512:	D5B974962A293D49C62C58CEB5B3765CFB93E8BC5583FB9B9464E720D005954501538BD63C65BD71370FF323DAE682CEDE6FABBE57A8C31F567FBDA3726F0285
Malicious:	false
Reputation:	low
URL:	https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/botdetect/public/bdc-reload-icon.gif
Preview:	GIF89a.......000.........666..................SSS..............................DDD.........JJJ.........QQQ.....................NNN......>>>]]].....................qqqjjj...\\\............rrr.......///...VVV@@@...cccRRR...QQQ.........yyysss.......EEEjjj\|\|\|bbbCCCgggZZZ.........^^^.........ggg...PPP@@@......pppIII......\\\...WWW..............fffhhh.......zzz...ccc...ZZZGGG}}}......QQQ...........aaa___................................................................................................................................................................................................................................................................................................................................................................................!.......,..............\........,8.......@.A....X.pDM...,.........H..f..C.Vr. ..H..:D...G.6v...b....;..,.@...a.>e.#..2X..P....._?.U......r-.....h.....B...,@.....1.@9..6x-.u.v....d.H.....x.x.@..Z.$.......D...X.....k

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 20612, version 1.0
Category:	downloaded
Size (bytes):	20612
Entropy (8bit):	7.987601598791172
Encrypted:	false
SSDEEP:	384:k5Eu+yl5Y9RpwjjmD/8Qu+POP9w+oB7rezldH9W4EMs8qCr9WvS80M8T4PTEXPFw:YEu+/Jw3FF+WP9DC/ez79jcCrb8BK4Eq
MD5:	B07DA7AA3E4F363C5CDBC11312239E8C
SHA1:	47BF5B2F24EA4A4CAAFCCC89B9D2A6677EF9E3B8
SHA-256:	E44C11F4834BDD4D6B6DA7B8EE5EAEBC8ACB41250CD6BCE5CC82EA8262140EAA
SHA-512:	420729406B315D8AF34B62B78F39E763F5CF33CBF94467457B393FDE0573DD7FFC6A23F25680988F9B82A4A3B719876FF76F3E1DB047CE82615F544FC3A82532
Malicious:	false
Reputation:	low
URL:	https://fonts.gstatic.com/s/roboto/v47/KFOMCnqEu92Fr1ME7kSn66aGLdTylUAMQXC89YmC2DPNWubEbVmUiAo.woff2
Preview:	wOF2......P........P..P..............................6..t.`?STAT^..B..~........`..i..X..6.$..,. ..x. ..N.F.%...q.6...@n.%.....BYG......7...G.....8...l'D&.0..9.....%.d.p..f-.2JE."I...N.`.....M.R.....9...6iO.^.....<.3.>.....qQ9..f...+4.L...2z..i......6..m....Qs.%.l....7.I:&..$b..4R.5....h..Y5.<...........,..X....q.6...7b.8GTO F.Eb.....].!@.:.4..$...5.Fu.2R.i.0w.....6m.c...NTd...-.@.......FMs.&...6.]..1.k]...n.......`.\|..(fO.hKE$/s!...~....e..UM..Zr....r.C..&J......S@..../.rH..a..h..<..?...1.v....y..+d1.:1...U....$...Vd....L......:.=...l.U.y..M..)..A.J.x/O.q....t...[{..Y.=.D...WU.P.j.2I.d........o.._-yZ^..ul-z.0H.....g.A.......R.e..dyA..${H.8.....9".=.e<`....BN9Nv7;. .....P5...4..-cL.1-.&..Z.h..W-`.w...eG....X.X..Xju...\.BV....jNU....<\|-...r.!Y.d....O....2..ovP....B2H....N(.>t...:IJ.;..r....p'...!..{dt,.8..J.._.;.[.....L...P..B.,F....k._c......(qg.....c.Gq........\|Z.V.5.=....X.....2\|.>...7D&..+...bH.<H.\|H.BH..H.rH.jH.zH...!Ga......(&."K5......`c

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	145
Entropy (8bit):	4.704615049227211
Encrypted:	false
SSDEEP:	3:YLAfHTNQaJ9WHI0NQWLilKLJp4RSQ7CRyBYFgeHOWEBLN:YWzNQaJANQWLccpRQeRIeHOWEBLN
MD5:	801979FA7AD47817B102D559E90B885B
SHA1:	EB849847FDE819718DFB9612F2181391327B49E7
SHA-256:	1D5EFAEACF37BD5E8474DA0833683FA69BE27D9CA33D771835465C2DF59C0468
SHA-512:	D30F03C026D289977596C5D00460C76ADC7729E5207B8473DB39F82591FE4AAC836F30D417D1885583B6BC28A0D091773A0F8011113BC9E105E84BCB0CF7C820
Malicious:	false
Reputation:	low
Preview:	{"name":"Method Not Allowed","message":"Method Not Allowed. This URL can only handle the following request methods: POST.","code":0,"status":405}

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 22 x 22
Category:	downloaded
Size (bytes):	1083
Entropy (8bit):	7.939822191104927
Encrypted:	false
SSDEEP:	24:dJtIsQAQ8Ic44Yo4bo4Y4ofXQLo4LoXgMXI7gAgXIL1C0Ay5dIXWAQIwl:p3nfXP3nfXfX/HXPX/HXaC0AyDQQR
MD5:	A97BFD93EA9EC02B04D746648FD909D6
SHA1:	7CEEB57C8F327587AC79ED6B8B9B6C334D926ED1
SHA-256:	96AA0E2304D5F823DEFCE8F2EE99EDDF59CAB3A49159B7B7470886D468B66AC1
SHA-512:	063E8267C8245C04FAB3D7E1D239C0DBED2E66E53A8BA5803ADB814491ABF30254D3CBD918359AE2445974F6FE6A0324C122C817FA1ABD041A90729F97F21320
Malicious:	false
Reputation:	low
URL:	https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/botdetect/public/bdc-reload-disabled-icon.gif
Preview:	GIF89a....................................................................................................... !!!"""###$$$%%%&&&'''((()))**+++,,,---...///000111222333444555666777888999:::;;;<<<===>>>???@@@AAABBBCCCDDDEEEFFFGGGHHHIIIJJJKKKLLLMMMNNNOOOPPPQQQRRRSSSTTTUUUVVVWWWXXXYYYZZZ[[[\\\]]]^^^___```aaabbbcccdddeeefffggghhhiiijjjkkklllmmmnnnooopppqqqrrrssstttuuuvvvwwwxxxyyyzzz{{{\|\|\|}}}~~~...................................................................................................................................................................................................................................................................................................................................................................................................!.......,.......................,........H."........6..q.{.O_.a.~.....Cv...I.&.].z...Sd.3..,.3......r.4i/`....W.(.\.1=J.).........b......)._.r.:o^.e..6.Z.`.s..G7W.`..[...\......0^u...v....B..u.\....7U^..h

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	3611
Entropy (8bit):	4.90892673332111
Encrypted:	false
SSDEEP:	48:eylnenIUqn1D17rFT/A5eKi1fZd1YOypxU:eyleIlagKKBd1YO2xU
MD5:	78141454F16AC3DB94FB912285AAB253
SHA1:	2B647A5570AFE9C7E10F6B103487708C9A5035C0
SHA-256:	26502ECAD502D81B20A0F6AC7F5724F8711F5E26FD7589A73D1CD155B97A878C
SHA-512:	65DC02912F3399FD62DB245A08C0FE7350398D9FBCAE69FF88B7AA8C2AE6CDBEB34BCF8024FE35B5EC1F6316726A22CC3F6AA95AD6FE15A15BF66196FBF2494A
Malicious:	false
Reputation:	low
URL:	https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/botdetect/public/bdc-layout-stylesheet.css?t=1741791044
Preview:	.BDC_CaptchaDiv {. padding: 0 !important;. margin: 0 !important;. overflow: visible !important;.}...BDC_CaptchaImageDiv {. margin: 0 !important;. padding: 0 !important;. display: -moz-inline-stack;. display: inline-block !important;. vertical-align: top !important;. zoom: 1 !important;. display: inline !important;.}...BDC_CaptchaIconsDiv {. text-align: left !important;. margin: 0 2px -4px 2px !important;. padding: 0 !important;. display: -moz-inline-stack;. display: inline-block !important;. vertical-align: top !important;. zoom: 1 !important;. display: inline !important;.}...BDC_CaptchaDiv a:link, .BDC_CaptchaDiv a:visited, .BDC_CaptchaDiv a:focus, .BDC_CaptchaDiv a:hover, .BDC_CaptchaDiv a:active {. margin: 0 !important;. padding: 0 !important;. background-color: transparent !important;. border: none !important;. text-decoration: none !important;. outline: none !important;. -moz-outline-style: none !important;. display: -moz-inline-stack;. display: inline

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1046
Entropy (8bit):	4.762583310981761
Encrypted:	false
SSDEEP:	24:GfwuIKAjrG7KH42HBm402P28HBN0KPI8HBNic2PI6PHBUi+LZpuw:RFBPG7442HBm40Y28HBN0cI8HBNicYIT
MD5:	FF5B97880EE056D0620C253BC2910D3F
SHA1:	80B0E051C4DCD7FF44D099317B9B14BDB91D73AA
SHA-256:	EAC0EC918CD74C051F4C5C83CDFE60C12A3BF2FD44A0472661FAFAB04777E9F9
SHA-512:	84E412A229E4A08DB5811F50D3E883DDA8701A07207934951A139643E9B240B899B68FD99FAC1406E8607E653AEC1CBF203C8F2A75ECC65D3379E9C07CD2843F
Malicious:	false
Reputation:	low
URL:	https://remote.captcha.com/include.js?i=DSdFLpCLdukM1CE-jgQNC9zKESlcuxRZL05PWRsxoiIEK5O6IDlOSonnabb6CIaPI0SQU2TD3hRFtbVG0F2e0LkY-4b0bUxJsHpBJNEYq8p7PiQwDijt4l1tF9-x032A8Cszdz0JwcaLphSFsKwwbmn2sHLgZzCnJfC4m34lBHVT_dlOGsYT6e4rF07wNLO57f30Wmcau9ZG-rT_WrkKx772e-_P1cJFAZ_6UDQBdcmSzzFx98VlF_jM2-A
Preview:	/..Google was indexing this file while it was empty -- probably because it couldn't figure out that an empty file can be intentionally empty JavaScript file -- despite being invoked as such..So OK, hopefully Google will be smarter with this version of it...BotDetect Team../...// This JavaScript code snippet shows how to swap two variables without using a third temporary variable..var swapDemo_firstVar = 19;.var swapDemo_secondVar = 7;.// variable values are: swapDemo_firstVar is 19, swapDemo_secondVar is 7..swapDemo_firstVar = swapDemo_firstVar + swapDemo_secondVar;.// now variable values are: swapDemo_firstVar is 26, swapDemo_secondVar is 7..swapDemo_secondVar = swapDemo_firstVar - swapDemo_secondVar;.// now variable values are: swapDemo_firstVar is 26, swapDemo_secondVar is 19..swapDemo_firstVar = swapDemo_firstVar - swapDemo_secondVar;.// and finally:.// now variable values are: swapDemo_firstVar is 7, swapDemo_secondVar is 19 :)..../*..See Google, it is JavaScript indeed. Would y

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65306)
Category:	downloaded
Size (bytes):	162764
Entropy (8bit):	5.059608283390532
Encrypted:	false
SSDEEP:	1536:RtawT8if0W8DsEBpy0cuJBf2rIWn5e0VUpz600I4fM:Rtawy0VUpz600I4fM
MD5:	A91522297DD4A21A2477BC684738CA11
SHA1:	05921697396C15245504FC4CEC16EC534C8ECFFF
SHA-256:	B0071CD7CCEF32768966B353E2FF09D13E07AB31148944E5545803232C2341E9
SHA-512:	E8A639B3A508E49ED2558B990784BF0993323F296ACB2359728DFBE8D33667C49BF0EC44769D367B58E42A4FF06712049A343A0D10840619E2FA0A6BF5CE2DBC
Malicious:	false
Reputation:	low
URL:	https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/css/bootstrap.min.css
Preview:	@charset "UTF-8";/!. Bootstrap v5.1.1 (https://getbootstrap.com/). * Copyright 2011-2021 The Bootstrap Authors. * Copyright 2011-2021 Twitter, Inc.. * Licensed under MIT (https://github.com/twbs/bootstrap/blob/main/LICENSE). */:root{--bs-blue:#0d6efd;--bs-indigo:#6610f2;--bs-purple:#6f42c1;--bs-pink:#d63384;--bs-red:#dc3545;--bs-orange:#fd7e14;--bs-yellow:#ffc107;--bs-green:#198754;--bs-teal:#20c997;--bs-cyan:#0dcaf0;--bs-white:#fff;--bs-gray:#6c757d;--bs-gray-dark:#343a40;--bs-gray-100:#f8f9fa;--bs-gray-200:#e9ecef;--bs-gray-300:#dee2e6;--bs-gray-400:#ced4da;--bs-gray-500:#adb5bd;--bs-gray-600:#6c757d;--bs-gray-700:#495057;--bs-gray-800:#343a40;--bs-gray-900:#212529;--bs-primary:#0d6efd;--bs-secondary:#6c757d;--bs-success:#198754;--bs-info:#0dcaf0;--bs-warning:#ffc107;--bs-danger:#dc3545;--bs-light:#f8f9fa;--bs-dark:#212529;--bs-primary-rgb:13,110,253;--bs-secondary-rgb:108,117,125;--bs-success-rgb:25,135,84;--bs-info-rgb:13,202,240;--bs-warning-rgb:255,193,7;--bs-danger-rgb:220,53

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 22 x 22
Category:	downloaded
Size (bytes):	1071
Entropy (8bit):	5.456081951539905
Encrypted:	false
SSDEEP:	24:dmFOmITA4e/k3QkGTqqF3rkuBDFJ8Dvw5iYHcBEDWb:oFOmT1/kcH2M5iYHcBEqb
MD5:	5363D08FC530C3BAE37BE3D4EEA066C7
SHA1:	6F974C9E483A8265D749559DB1C02EFC458559A9
SHA-256:	F3BDD2185C191359C53405A2108EEA8ED242F94B9E87832A23FF703E809F2915
SHA-512:	115EE9F765C986313358A4117B2C1ECE02628D7B1AD5A4105BA533B1EC8A0BBA90E74B6A34CC86C26365C4C2217C0A874DD33660117315A9E9C6688CE5DED2C9
Malicious:	false
Reputation:	low
URL:	https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/botdetect/public/bdc-sound-disabled-icon.gif
Preview:	GIF89a...................................................................

Source: https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/index.php?rim=tlczs5qdc&xyr=touz&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&ID=u8Y0610Y	Joe Sandbox AI: Score: 7 Reasons: The URL 'cityofmarion.in.gov.marion-police-department.reference-check.top' contains multiple subdomains and an unusual domain extension '.top', which is often used in phishing., The legitimate domain for the City of Marion, Indiana, is likely 'cityofmarion.in.gov'. The additional segments 'marion-police-department' and 'reference-check' are suspicious and not typical for a government site., The brand 'Marion Police' is not widely recognized outside its local context, making it difficult to classify as 'known' or 'wellknown'., The presence of 'reference-check' in the URL suggests a potential phishing attempt to gather personal information under the guise of a police department check., The domain structure suggests an attempt to mimic a legitimate government site while redirecting to a potentially malicious domain. DOM: 0.1.pages.csv
Source: https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/index.php?rim=tlczs5qdc&xyr=touz&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&ID=u8Y0610Y	Joe Sandbox AI: Score: 7 Reasons: The URL 'cityofmarion.in.gov.marion-police-department.reference-check.top' contains multiple subdomains and an unusual domain extension '.top', which is often used in phishing., The legitimate domain for the City of Marion, Indiana, is likely 'cityofmarion.in.gov'., The presence of 'marion-police-department' and 'reference-check' as subdomains is suspicious and suggests an attempt to mimic a legitimate site., The brand 'Marion Police' is not widely recognized outside its local context, making it 'unknown' in terms of global brand recognition., The use of a '.top' domain extension is uncommon for government-related websites, which typically use '.gov'. DOM: 0.2.pages.csv
Source: https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/index.php?rim=tlczs5qdc&xyr=touz&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&ID=u8Y0610Y	Joe Sandbox AI: Score: 9 Reasons: The URL 'cityofmarion.in.gov.marion-police-department.reference-check.top' contains multiple subdomains and an unusual domain extension '.top', which is not typical for government websites., The legitimate domain for the City of Marion, Indiana, is likely 'cityofmarion.in.gov'., The presence of 'marion-police-department' as a subdomain and 'reference-check' in the URL is suspicious and suggests a phishing attempt., The '.top' domain extension is often used in phishing sites due to its low cost and less strict registration requirements., The brand 'Marion Police' is associated with a known entity, the Marion Police Department, which would typically use a '.gov' domain. DOM: 0.5.pages.csv

Source: Yara match	File source: 0.10.pages.csv, type: HTML
Source: Yara match	File source: 0.9.pages.csv, type: HTML
Source: Yara match	File source: 0.11.pages.csv, type: HTML
Source: Yara match	File source: 0.3.pages.csv, type: HTML
Source: Yara match	File source: 0.0.pages.csv, type: HTML
Source: Yara match	File source: 0.8.pages.csv, type: HTML
Source: Yara match	File source: 0.2.pages.csv, type: HTML
Source: Yara match	File source: 0.1.pages.csv, type: HTML
Source: Yara match	File source: 0.5.pages.csv, type: HTML
Source: Yara match	File source: 0.6.pages.csv, type: HTML
Source: Yara match	File source: 0.7.pages.csv, type: HTML
Source: Yara match	File source: 0.4.pages.csv, type: HTML
Source: Yara match	File source: 0.12.pages.csv, type: HTML

Source: https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/index.php?rim=tlczs5qdc&xyr=touz&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&ID=u8Y0610Y	HTTP Parser: No favicon
Source: https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/index.php?rim=tlczs5qdc&xyr=touz&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&ID=u8Y0610Y	HTTP Parser: No favicon
Source: https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/index.php?rim=tlczs5qdc&xyr=touz&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&ID=u8Y0610Y	HTTP Parser: No favicon
Source: https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/index.php?rim=tlczs5qdc&xyr=touz&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&ID=u8Y0610Y	HTTP Parser: No favicon
Source: https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/index.php?rim=tlczs5qdc&xyr=touz&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&ID=u8Y0610Y	HTTP Parser: No favicon
Source: https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/index.php?rim=tlczs5qdc&xyr=touz&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&ID=u8Y0610Y	HTTP Parser: No favicon
Source: https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/index.php?rim=tlczs5qdc&xyr=touz&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&ID=u8Y0610Y	HTTP Parser: No favicon
Source: https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/index.php?rim=tlczs5qdc&xyr=touz&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&ID=u8Y0610Y	HTTP Parser: No favicon
Source: https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/index.php?rim=tlczs5qdc&xyr=touz&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&ID=u8Y0610Y	HTTP Parser: No favicon
Source: https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/index.php?rim=tlczs5qdc&xyr=touz&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&ID=u8Y0610Y	HTTP Parser: No favicon
Source: https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/index.php?rim=tlczs5qdc&xyr=touz&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&ID=u8Y0610Y	HTTP Parser: No favicon
Source: https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/index.php?rim=tlczs5qdc&xyr=touz&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&ID=u8Y0610Y	HTTP Parser: No favicon
Source: https://cityofmarion.in.gov.marion-police-department.reference-check.top/online-download/index.php?rim=tlczs5qdc&xyr=touz&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&ID=u8Y0610Y	HTTP Parser: No favicon

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.186.131
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.186.131
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: atechelectricalengr.com
Source: global traffic	DNS traffic detected: DNS query: mrt.response-check.top
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: cityofmarion.in.gov.marion-police-department.reference-check.top
Source: global traffic	DNS traffic detected: DNS query: remote.captcha.com

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://atechelectricalengr.com/mpd/?rim=tlczs5qdc&xyr=touz&t=nbvaz8e57bgik9d&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&chh2pve49=u8Y0610Y

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 64

Chrome Cache Entry: 65

Chrome Cache Entry: 66

Chrome Cache Entry: 67

Chrome Cache Entry: 68

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Chrome Cache Entry: 79

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Chrome Cache Entry: 82

Chrome Cache Entry: 83

Chrome Cache Entry: 84

Chrome Cache Entry: 85

Chrome Cache Entry: 86

Chrome Cache Entry: 87

Chrome Cache Entry: 88

Chrome Cache Entry: 89

Chrome Cache Entry: 90

Chrome Cache Entry: 91

Windows Analysis Report
https://atechelectricalengr.com/mpd/?rim=tlczs5qdc&xyr=touz&t=nbvaz8e57bgik9d&kti=jj4jd3jmzzna7&mso=559hb800tw4jljj6zf&chh2pve49=u8Y0610Y