Edit tour

Windows Analysis Report
http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/?affsub2=es2

Overview

General Information

Sample URL:	http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/?affsub2=es2
Analysis ID:	1638223
Infos:

Detection

Score:	64
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

AI detected suspicious Javascript

HTML page contains suspicious javascript code

Creates files inside the system directory

Deletes files inside the Windows folder

HTML page contains hidden javascript code

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6216 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 6448 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2040,i,3827704001359153027,9759873984629800320,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7140 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/?affsub2=es2" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/?affsub2=es2

Avira URL Cloud: detection malicious, Label: malware

Antivirus detection for URL or domain

Source: http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/common/style_css/bootstrap.css	Avira URL Cloud: Label: malware
Source: http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/homepage-logo.svg	Avira URL Cloud: Label: malware
Source: http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/assets/img/gallery-EPU2.webp	Avira URL Cloud: Label: malware
Source: http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/posts/16_11_2024/Ventilation-real-4e222-1.webp	Avira URL Cloud: Label: malware
Source: http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/common/style_css/fonts/bootstrap-icons.woff2?dd67030699838ea613ee6dbda90effa6	Avira URL Cloud: Label: malware
Source: http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/common/style_css/bootstrap-icons.css	Avira URL Cloud: Label: malware
Source: http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/common/style_css/jquery.fancybox.min.css	Avira URL Cloud: Label: malware
Source: http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/assets/img/gallery-EPU1.webp	Avira URL Cloud: Label: malware
Source: http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/common/js_files/jquery.min.js	Avira URL Cloud: Label: malware
Source: http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/assets/img/gallery-EPU0.webp	Avira URL Cloud: Label: malware
Source: http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/common/js_files/script.js	Avira URL Cloud: Label: malware
Source: http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/common/js_files/jquery.fancybox.min.js	Avira URL Cloud: Label: malware
Source: http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/assets/img/elegant_bg-2024-11-12_15-06-190.webp	Avira URL Cloud: Label: malware
Source: http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/assets/img/gallery-EPU4.webp	Avira URL Cloud: Label: malware
Source: http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/assets/img/gallery-EPU5.webp	Avira URL Cloud: Label: malware
Source: http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/assets/img/user_avatar-RHta-2.webp	Avira URL Cloud: Label: malware
Source: http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/assets/img/avatar_photo-2024-11-05_15-06-0.webp	Avira URL Cloud: Label: malware
Source: http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/assets/img/user_avatar-RHta-1.webp	Avira URL Cloud: Label: malware
Source: http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/assets/img/elegant_bg-2024-11-12_15-06-191.webp	Avira URL Cloud: Label: malware
Source: http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/assets/img/user_avatar-RHta-0.webp	Avira URL Cloud: Label: malware
Source: http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/assets/img/gallery-EPU3.webp	Avira URL Cloud: Label: malware

Phishing

AI detected suspicious Javascript

Source: 0.1..script.csv

Joe Sandbox AI: Detected suspicious JavaScript with source url: http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3... This script demonstrates high-risk behavior, including dynamic code execution and potential data exfiltration. The use of `atob` to decode a URL and redirect the user to an unknown location is a strong indicator of malicious intent.

HTML page contains suspicious javascript code

Source: http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/?affsub2=es2

HTTP Parser: window.location.href = atob(

Source: http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/?affsub2=es2

HTTP Parser: Base64 decoded: /crp/gfh63g4h54j4h

Source: http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/?affsub2=es2

HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 142.250.185.68:443 -> 192.168.2.16:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.164:443 -> 192.168.2.16:49733 version: TLS 1.2

Source: chrome.exe

Memory has grown: Private usage: 8MB later: 40MB

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.184.195
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.184.195
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.184.195
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.184.195
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.184.195
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.184.195
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.184.195
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /crp/gfh53g4h54j4h/a3ccg4n2/?affsub2=es2 HTTP/1.1Host: zeit-zu-investieren.ccConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /crp/gfh53g4h54j4h/a3ccg4n2/common/js_files/jquery.min.js HTTP/1.1Host: zeit-zu-investieren.ccConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Referer: http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/?affsub2=es2Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /crp/gfh53g4h54j4h/a3ccg4n2/common/style_css/bootstrap.css HTTP/1.1Host: zeit-zu-investieren.ccConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/?affsub2=es2Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /crp/gfh53g4h54j4h/a3ccg4n2/common/style_css/bootstrap-icons.css HTTP/1.1Host: zeit-zu-investieren.ccConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/?affsub2=es2Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /crp/gfh53g4h54j4h/a3ccg4n2/common/style_css/jquery.fancybox.min.css HTTP/1.1Host: zeit-zu-investieren.ccConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/?affsub2=es2Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /crp/gfh53g4h54j4h/a3ccg4n2/homepage-logo.svg HTTP/1.1Host: zeit-zu-investieren.ccConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/?affsub2=es2Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /crp/gfh53g4h54j4h/a3ccg4n2/posts/16_11_2024/Ventilation-real-4e222-1.webp HTTP/1.1Host: zeit-zu-investieren.ccConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/?affsub2=es2Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /crp/gfh53g4h54j4h/a3ccg4n2/common/js_files/jquery.fancybox.min.js HTTP/1.1Host: zeit-zu-investieren.ccConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Referer: http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/?affsub2=es2Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /crp/gfh53g4h54j4h/a3ccg4n2/assets/img/gallery-EPU0.webp HTTP/1.1Host: zeit-zu-investieren.ccConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/?affsub2=es2Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /crp/gfh53g4h54j4h/a3ccg4n2/assets/img/gallery-EPU1.webp HTTP/1.1Host: zeit-zu-investieren.ccConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/?affsub2=es2Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /crp/gfh53g4h54j4h/a3ccg4n2/assets/img/gallery-EPU2.webp HTTP/1.1Host: zeit-zu-investieren.ccConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/?affsub2=es2Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /crp/gfh53g4h54j4h/a3ccg4n2/common/js_files/script.js HTTP/1.1Host: zeit-zu-investieren.ccConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Referer: http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/?affsub2=es2Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /crp/gfh53g4h54j4h/a3ccg4n2/common/style_css/fonts/bootstrap-icons.woff2?dd67030699838ea613ee6dbda90effa6 HTTP/1.1Host: zeit-zu-investieren.ccConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Origin: http://zeit-zu-investieren.ccAccept: /Referer: http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/common/style_css/bootstrap-icons.cssAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /crp/gfh53g4h54j4h/a3ccg4n2/homepage-logo.svg HTTP/1.1Host: zeit-zu-investieren.ccConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /crp/gfh53g4h54j4h/a3ccg4n2/posts/16_11_2024/Ventilation-real-4e222-1.webp HTTP/1.1Host: zeit-zu-investieren.ccConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /crp/gfh53g4h54j4h/a3ccg4n2/assets/img/elegant_bg-2024-11-12_15-06-190.webp HTTP/1.1Host: zeit-zu-investieren.ccConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/?affsub2=es2Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /crp/gfh53g4h54j4h/a3ccg4n2/assets/img/gallery-EPU2.webp HTTP/1.1Host: zeit-zu-investieren.ccConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /crp/gfh53g4h54j4h/a3ccg4n2/assets/img/gallery-EPU1.webp HTTP/1.1Host: zeit-zu-investieren.ccConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /crp/gfh53g4h54j4h/a3ccg4n2/assets/img/gallery-EPU0.webp HTTP/1.1Host: zeit-zu-investieren.ccConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /maps/embed?origin=mfe&pb=!1m3!2m1!1s1019,+Canterbury+Trail,+Georgetown,+78626,+United+States!6i8!3m1!1sen!5m1!1sen HTTP/1.1Host: www.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Browser-Channel: stableX-Browser-Year: 2025X-Browser-Validation: wTKGXmLo+sPWz1JKKbFzUyHly1Q=X-Browser-Copyright: Copyright 2025 Google LLC. All rights reserved.X-Client-Data: CLbgygE=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: iframeSec-Fetch-Storage-Access: activesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: http://zeit-zu-investieren.cc/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /crp/gfh53g4h54j4h/a3ccg4n2/assets/img/gallery-EPU3.webp HTTP/1.1Host: zeit-zu-investieren.ccConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/?affsub2=es2Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /crp/gfh53g4h54j4h/a3ccg4n2/assets/img/gallery-EPU4.webp HTTP/1.1Host: zeit-zu-investieren.ccConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/?affsub2=es2Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /crp/gfh53g4h54j4h/a3ccg4n2/assets/img/gallery-EPU5.webp HTTP/1.1Host: zeit-zu-investieren.ccConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/?affsub2=es2Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /crp/gfh53g4h54j4h/a3ccg4n2/assets/img/user_avatar-RHta-0.webp HTTP/1.1Host: zeit-zu-investieren.ccConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/?affsub2=es2Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /crp/gfh53g4h54j4h/a3ccg4n2/assets/img/avatar_photo-2024-11-05_15-06-0.webp HTTP/1.1Host: zeit-zu-investieren.ccConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/?affsub2=es2Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /crp/gfh53g4h54j4h/a3ccg4n2/assets/img/user_avatar-RHta-1.webp HTTP/1.1Host: zeit-zu-investieren.ccConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/?affsub2=es2Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /crp/gfh53g4h54j4h/a3ccg4n2/assets/img/gallery-EPU4.webp HTTP/1.1Host: zeit-zu-investieren.ccConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /crp/gfh53g4h54j4h/a3ccg4n2/assets/img/user_avatar-RHta-2.webp HTTP/1.1Host: zeit-zu-investieren.ccConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/?affsub2=es2Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /crp/gfh53g4h54j4h/a3ccg4n2/assets/img/user_avatar-RHta-0.webp HTTP/1.1Host: zeit-zu-investieren.ccConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /crp/gfh53g4h54j4h/a3ccg4n2/assets/img/elegant_bg-2024-11-12_15-06-191.webp HTTP/1.1Host: zeit-zu-investieren.ccConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/?affsub2=es2Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /crp/gfh53g4h54j4h/a3ccg4n2/assets/img/gallery-EPU5.webp HTTP/1.1Host: zeit-zu-investieren.ccConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /crp/gfh53g4h54j4h/a3ccg4n2/assets/img/avatar_photo-2024-11-05_15-06-0.webp HTTP/1.1Host: zeit-zu-investieren.ccConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /crp/gfh53g4h54j4h/a3ccg4n2/assets/img/gallery-EPU3.webp HTTP/1.1Host: zeit-zu-investieren.ccConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /crp/gfh53g4h54j4h/a3ccg4n2/assets/img/elegant_bg-2024-11-12_15-06-190.webp HTTP/1.1Host: zeit-zu-investieren.ccConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /crp/gfh53g4h54j4h/a3ccg4n2/assets/img/user_avatar-RHta-2.webp HTTP/1.1Host: zeit-zu-investieren.ccConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /crp/gfh53g4h54j4h/a3ccg4n2/assets/img/user_avatar-RHta-1.webp HTTP/1.1Host: zeit-zu-investieren.ccConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /crp/gfh53g4h54j4h/a3ccg4n2/assets/img/elegant_bg-2024-11-12_15-06-191.webp HTTP/1.1Host: zeit-zu-investieren.ccConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /r/gsr1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: /If-Modified-Since: Tue, 07 Jan 2025 07:28:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog
Source: global traffic	HTTP traffic detected: GET /r/r4.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: /If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog

Source: global traffic	DNS traffic detected: DNS query: zeit-zu-investieren.cc
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: maps.google.com
Source: global traffic	DNS traffic detected: DNS query: beacons.gcp.gvt2.com
Source: global traffic	DNS traffic detected: DNS query: beacons.gvt2.com
Source: global traffic	DNS traffic detected: DNS query: beacons2.gvt2.com
Source: global traffic	DNS traffic detected: DNS query: beacons3.gvt2.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49673
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49679 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767

Source: unknown	HTTPS traffic detected: 142.250.185.68:443 -> 192.168.2.16:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.164:443 -> 192.168.2.16:49733 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir6216_2058993317

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir6216_2058993317

Source: classification engine

Classification label: mal64.phis.win@23/32@43/194

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2040,i,3827704001359153027,9759873984629800320,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/?affsub2=es2"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2040,i,3827704001359153027,9759873984629800320,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:3
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Extra Window Memory Injection	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Extra Window Memory Injection	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/?affsub2=es2	100%	Avira URL Cloud	malware

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/common/style_css/bootstrap.css	100%	Avira URL Cloud	malware
http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/homepage-logo.svg	100%	Avira URL Cloud	malware
http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/assets/img/gallery-EPU2.webp	100%	Avira URL Cloud	malware
http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/posts/16_11_2024/Ventilation-real-4e222-1.webp	100%	Avira URL Cloud	malware
http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/common/style_css/fonts/bootstrap-icons.woff2?dd67030699838ea613ee6dbda90effa6	100%	Avira URL Cloud	malware
http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/common/style_css/bootstrap-icons.css	100%	Avira URL Cloud	malware
http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/common/style_css/jquery.fancybox.min.css	100%	Avira URL Cloud	malware
http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/assets/img/gallery-EPU1.webp	100%	Avira URL Cloud	malware
http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/common/js_files/jquery.min.js	100%	Avira URL Cloud	malware
http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/assets/img/gallery-EPU0.webp	100%	Avira URL Cloud	malware
http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/common/js_files/script.js	100%	Avira URL Cloud	malware
http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/common/js_files/jquery.fancybox.min.js	100%	Avira URL Cloud	malware
http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/assets/img/elegant_bg-2024-11-12_15-06-190.webp	100%	Avira URL Cloud	malware
https://www.google.com/maps/embed?origin=mfe&pb=!1m3!2m1!1s1019,+Canterbury+Trail,+Georgetown,+78626,+United+States!6i8!3m1!1sen!5m1!1sen	0%	Avira URL Cloud	safe
http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/assets/img/gallery-EPU4.webp	100%	Avira URL Cloud	malware
http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/assets/img/gallery-EPU5.webp	100%	Avira URL Cloud	malware
http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/assets/img/user_avatar-RHta-2.webp	100%	Avira URL Cloud	malware
http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/assets/img/avatar_photo-2024-11-05_15-06-0.webp	100%	Avira URL Cloud	malware
http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/assets/img/user_avatar-RHta-1.webp	100%	Avira URL Cloud	malware
http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/assets/img/elegant_bg-2024-11-12_15-06-191.webp	100%	Avira URL Cloud	malware
http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/assets/img/user_avatar-RHta-0.webp	100%	Avira URL Cloud	malware
http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/assets/img/gallery-EPU3.webp	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
beacons3.gvt2.com	142.250.185.67	true	false	high
zeit-zu-investieren.cc	45.11.92.141	true	true	unknown
beacons-handoff.gcp.gvt2.com	142.251.143.35	true	false	high
maps.google.com	142.250.185.110	true	false	high
www.google.com	142.250.185.68	true	false	high
beacons2.gvt2.com	142.250.179.67	true	false	high
beacons.gvt2.com	142.251.143.67	true	false	high
beacons6.gvt2.com	172.217.16.195	true	false	high
beacons.gcp.gvt2.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/common/style_css/bootstrap-icons.css	true	Avira URL Cloud: malware	unknown
http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/assets/img/gallery-EPU5.webp	true	Avira URL Cloud: malware	unknown
http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/assets/img/gallery-EPU2.webp	true	Avira URL Cloud: malware	unknown
http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/homepage-logo.svg	true	Avira URL Cloud: malware	unknown
http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/common/style_css/bootstrap.css	true	Avira URL Cloud: malware	unknown
http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/common/style_css/jquery.fancybox.min.css	true	Avira URL Cloud: malware	unknown
http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/?affsub2=es2	true		unknown
http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/assets/img/avatar_photo-2024-11-05_15-06-0.webp	true	Avira URL Cloud: malware	unknown
http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/posts/16_11_2024/Ventilation-real-4e222-1.webp	true	Avira URL Cloud: malware	unknown
http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/common/js_files/jquery.min.js	true	Avira URL Cloud: malware	unknown
http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/assets/img/user_avatar-RHta-1.webp	true	Avira URL Cloud: malware	unknown
http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/common/style_css/fonts/bootstrap-icons.woff2?dd67030699838ea613ee6dbda90effa6	true	Avira URL Cloud: malware	unknown
http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/assets/img/elegant_bg-2024-11-12_15-06-191.webp	true	Avira URL Cloud: malware	unknown
http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/assets/img/gallery-EPU0.webp	true	Avira URL Cloud: malware	unknown
http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/assets/img/gallery-EPU3.webp	true	Avira URL Cloud: malware	unknown
https://www.google.com/maps/embed?origin=mfe&pb=!1m3!2m1!1s1019,+Canterbury+Trail,+Georgetown,+78626,+United+States!6i8!3m1!1sen!5m1!1sen	false	Avira URL Cloud: safe	unknown
http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/assets/img/gallery-EPU1.webp	true	Avira URL Cloud: malware	unknown
http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/assets/img/user_avatar-RHta-2.webp	true	Avira URL Cloud: malware	unknown
http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/assets/img/gallery-EPU4.webp	true	Avira URL Cloud: malware	unknown
http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/common/js_files/script.js	true	Avira URL Cloud: malware	unknown
http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/assets/img/user_avatar-RHta-0.webp	true	Avira URL Cloud: malware	unknown
http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/common/js_files/jquery.fancybox.min.js	true	Avira URL Cloud: malware	unknown
http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/assets/img/elegant_bg-2024-11-12_15-06-190.webp	true	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.67	unknown	United States	15169	GOOGLEUS	false
142.250.185.68	www.google.com	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
216.58.206.74	unknown	United States	15169	GOOGLEUS	false
142.251.5.84	unknown	United States	15169	GOOGLEUS	false
216.58.206.78	unknown	United States	15169	GOOGLEUS	false
142.250.185.110	maps.google.com	United States	15169	GOOGLEUS	false
142.250.185.138	unknown	United States	15169	GOOGLEUS	false
142.250.185.238	unknown	United States	15169	GOOGLEUS	false
142.250.185.227	unknown	United States	15169	GOOGLEUS	false
142.250.181.227	unknown	United States	15169	GOOGLEUS	false
45.11.92.141	zeit-zu-investieren.cc	Russian Federation	40676	AS40676US	true
142.250.186.164	unknown	United States	15169	GOOGLEUS	false
142.250.186.142	unknown	United States	15169	GOOGLEUS	false
142.250.184.227	unknown	United States	15169	GOOGLEUS	false
216.58.212.163	unknown	United States	15169	GOOGLEUS	false
142.250.184.234	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16
192.168.2.7
192.168.2.5
192.168.2.23

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1638223
Start date and time:	2025-03-14 10:04:45 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/?affsub2=es2
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal64.phis.win@23/32@43/194

Warnings

Exclude process from analysis (whitelisted): svchost.exe
Excluded IPs from analysis (whitelisted): 216.58.206.78, 216.58.212.163, 142.250.185.238, 142.251.5.84, 142.250.184.238, 142.250.181.238, 142.250.185.142, 172.217.18.14, 142.250.184.234, 142.250.186.67
Excluded domains from analysis (whitelisted): fonts.googleapis.com, clients2.google.com, accounts.google.com, redirector.gvt1.com, fonts.gstatic.com, clientservices.googleapis.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/?affsub2=es2

Created / dropped Files

Chrome Cache Entry: 100

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 600x600, Suserng: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	33326
Entropy (8bit):	7.994185063306593
Encrypted:	true
SSDEEP:
MD5:	7E3C36ABCC7D4F30F28A01D719C4BC49
SHA1:	519556FDD6EA712870409F347880DA8364BF751F
SHA-256:	404CAB205A4E4543063C9E138CCC4A9E8E2E4C022C37300348B41414F8CB9CB2
SHA-512:	23C069E1BEA150DEF9C3C8F1D953C119F041479A746920A4DB077158B960F857B5DC2F73A670861CAFD8CC15BDFE1F92A9D488839D1AFD7C15CEE5C7385CB8A8
Malicious:	false
Reputation:	unknown
URL:	http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/assets/img/user_avatar-RHta-0.webp
Preview:	RIFF&...WEBPVP8 ....pC...X.X.>Q$.E..!"....p..gn.+....d....+.b.b}z.[..K.l..,g.........E^q~....PuM.Pz....;...%...o.c.../..............g.......c.G.......z.._v...5.....7...........@.....y....O.'T...h..B.L.....1.du)oF.Y@.Cx.p....z..Q...),h.N..!..........b.}...C.G...x.G...4....6Z?.......(.d1=....k........lF.A..3f.V..-..O...7.....#.].".DR.......G.3..%..T.....J.....S.;.,...Y..M I..^....3...&....B..-........F......./.....u.E....5..'.6.>.-..^N....d["...E ...pQ.....e@...X.K.....&..oh.=../Sk....i..d..J.V....Nq..{...Lgtn.o..9...0...8[W.l4.M>J%x.c~.........q.....7.my...........:a.....;\|f}.k\|..f....@<9.A....a_1..]..._.)g>M4....}M..e._.$..e<.{....s..o6b"..8-..bP.#.Y&....D..,..2d.......^..X.Qo.eHZ+G_w..I.....I...}7.P..x...s..{......K.........O{M+.\|..3@...e..Z".6..w.B.7....aY.@*b..)..i..U...+5j....A.....p!..6.Q..P>....-...P(..tS...)t.....z.]v.......n..nwq....G..S.H.f..K..fi).{X..2B.0.%I.Z..0.X.. ._.:.-.XC.q==..r....ax.r/.pX.\...U......Dm%(.

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1087)
Category:	downloaded
Size (bytes):	2946
Entropy (8bit):	5.46572521740437
Encrypted:	false
SSDEEP:
MD5:	2EBD2B75B06FA287B8ED7079ED471843
SHA1:	2BE0B9D113659E90C147890EB4004BA9D717A1A2
SHA-256:	42131E3DDBB898F7CC2BD2B13C23AB3E9CB8564570973438394B57AE30A51985
SHA-512:	BB8CB0D373D677EF49E47803DAA25102D210049741D1204251A6C836F6949DAD0B106CFD9BD4DE2449C2FB3186079832287063EFF2473B923279BB150B5EC45F
Malicious:	false
Reputation:	unknown
URL:	https://maps.googleapis.com/maps-api-v3/api/js/60/4/geometry.js
Preview:	google.maps.__gjsload__('geometry', function(_){var Kpa=function(a,b){return Math.abs(_.Wk(b-a,-180,180))},Lpa=function(a,b,c,d,e){if(!d){c=Kpa(a.lng(),c)/Kpa(a.lng(),b.lng());if(!e)return e=Math.sin(_.lk(a.lat())),e=Math.log((1+e)/(1-e))/2,b=Math.sin(_.lk(b.lat())),_.mk(2Math.atan(Math.exp(e+c(Math.log((1+b)/(1-b))/2-e)))-Math.PI/2);a=e.fromLatLngToPoint(a);b=e.fromLatLngToPoint(b);return e.fromPointToLatLng(new _.$m(a.x+c(b.x-a.x),a.y+c(b.y-a.y))).lat()}e=_.lk(a.lat());a=_.lk(a.lng());d=_.lk(b.lat());b=_.lk(b.lng());c=_.lk(c);return _.Wk(_.mk(Math.atan2(Math.sin(e).Math.cos(d)Math.sin(c-b)-Math.sin(d)Math.cos(e)Math.sin(c-a),Math.cos(e)Math.cos(d)Math.sin(a-b))),-90,90)},Mpa=function(a,b){a=new _.Ol(a,!1);b=new _.Ol(b,!1);return a.equals(b)},Npa=function(a,b,c){a=_.Sl(a);c=c\|\|1E-9;const d=_.Wk(a.lng(),-180,180),e=b instanceof _.Or,f=!!b.get("geodesic"),g=b.get("latLngs");b=b.get("map");b=!f&&b?b.getProjection():null;for(let r=0,u=g.getLength();r<u;++r){const w=g.getAt(r),x=

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3552)
Category:	downloaded
Size (bytes):	32343
Entropy (8bit):	5.576826427318878
Encrypted:	false
SSDEEP:
MD5:	D4C56AA6504707666C864C83519E17E9
SHA1:	BCC60CEE4DB3AA99D9062ADCFEEBD5E835229590
SHA-256:	DBDC3638A12A0325B735875E40460431AC22943D072A99D0BC572E13FB57B9DE
SHA-512:	220025C64EC06DD50506EBF2E8CC9AF8B8BB293AB635430DF25C193830AC4D4808058226423F3CC3A1D181E9C872EAEC74F05FD3E311AD3260A0F1B7D3D4D701
Malicious:	false
Reputation:	unknown
URL:	https://maps.googleapis.com/maps-api-v3/api/js/60/4/onion.js
Preview:	google.maps.__gjsload__('onion', function(_){var lWa,mWa,nWa,oWa,EP,HP,GP,rWa,sWa,tWa,qWa,uWa,JP,vWa,wWa,xWa,zWa,BWa,CWa,EWa,FWa,IWa,KWa,MWa,OWa,QWa,RWa,PWa,PP,QP,OP,RP,WWa,XWa,YWa,ZWa,aXa,$Wa,SP,iXa,hXa,VP,nXa,oXa,pXa,mXa,sXa,tXa,vXa,YP,zXa,AXa,BXa,uXa,wXa,xXa,CXa,DXa,XP,MXa,NXa,QXa,PXa,RXa,SXa,WP,TXa,$P,aQ,UXa;.lWa=function(a,b){let c=0,d=0;for(;_.eE(a)&&a.Fg!=4;)a.Hg!==16\|\|c?a.Hg!==26\|\|d?_.gE(a):c?(d=-1,_.kf(a,c,b)):(d=a.Ig,_.hE(a)):(c=_.jf(a.Eg),d&&(a.Eg.setCursor(d),d=0));if(a.Hg!==12\|\|!d\|\|!c)throw Error("Malformed binary bytes for message set");};mWa=function(a,b){const c=a.length,d=typeof a==="string"?a.split(""):a;for(let e=0;e<c;e++)if(e in d&&b.call(void 0,d[e],e,a))return!0;return!1};nWa=function(a,b){_.ck(a.Gg,1,b)};oWa=function(a,b){_.ck(a.Gg,2,b)};EP=function(){pWa\|\|(pWa=[_.T,_.S,_.U])};.HP=function(a){_.lI.call(this,a,FP);GP(a)};GP=function(a){_.CH(a,FP)\|\|(_.BH(a,FP,{entity:0,gn:1},["div",,1,0,[" ",["div",,1,1,[" ",["div",576,1,2,"Dutch Cheese Cakes"]," "]]," ",["div",,1

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	98255
Entropy (8bit):	4.785098083739527
Encrypted:	false
SSDEEP:
MD5:	1D14AC4000DC4A8D3557B256248D9000
SHA1:	9EE496CC9BAAAE58B98E7FC1EB46E3578DAF8143
SHA-256:	4FFA6BEA4304D2EDA418683F56261685ED47BF00995039F27E5AD62D53938D2D
SHA-512:	CB098F6EEC464B8709EC6C70097F9B089C1E79EC6DD38ED9614D873F9D9658A6E9267178FD9CDFAF6068D7D2780963D766695E56EB10F5DFFF441E5BAB444FEF
Malicious:	false
Reputation:	unknown
URL:	http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/common/style_css/bootstrap-icons.css
Preview:	/!. Bootstrap Icons v1.11.3 (https://icons.getbootstrap.com/). * Copyright 2019-2024 The Bootstrap Authors. * Licensed under MIT (https://github.com/twbs/icons/blob/main/LICENSE). /..@font-face {. font-display: block;. font-family: "bootstrap-icons";. src: url("./fonts/bootstrap-icons.woff2?dd67030699838ea613ee6dbda90effa6") format("woff2"),.url("./fonts/bootstrap-icons.woff?dd67030699838ea613ee6dbda90effa6") format("woff");.}...bi::before,.[class^="bi-"]::before,.[class=" bi-"]::before {. display: inline-block;. font-family: bootstrap-icons !important;. font-style: normal;. font-weight: normal !important;. font-variant: normal;. text-transform: none;. line-height: 1;. vertical-align: -.125em;. -webkit-font-smoothing: antialiased;. -moz-osx-font-smoothing: grayscale;.}...bi-123::before { content: "\f67f"; }..bi-alarm-fill::before { content: "\f101"; }..bi-alarm::before { content: "\f102"; }..bi-align-bottom::before { content: "\f103"; }..bi-align-center::before { cont

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (10821)
Category:	downloaded
Size (bytes):	11971
Entropy (8bit):	5.911974436252161
Encrypted:	false
SSDEEP:
MD5:	37CF506E94E304347479920DD0301870
SHA1:	A85481FBACFAD4D2B58FD6FC2EF8A8141A444BD8
SHA-256:	A32DFE2B07E7DCCBC11411B723ACF6FB9605D9C11567A6891B39553ABC92BE31
SHA-512:	C66A582BB3E9F5C86EB68A4C996B8C71EF51C4DC66C36630DAB6F24FA34CECC2F4CF72F2A683AB7B4D5064BC68DB283722C2261D9C2EE6847E494631F5781FF5
Malicious:	false
Reputation:	unknown
URL:	"https://maps.googleapis.com/maps/api/js?client=google-maps-embed&paint_origin=&libraries=geometry,search&v=weekly&loading=async&language=en&callback=onApiLoad"
Preview:	..window.google = window.google \|\| {};.google.maps = google.maps \|\| {};.(function() {. var rules = {. createHTML: function(src) {. return src;. },. createScriptURL: function(src) {. return src;. }. };. var ttPolicy;. . try {. ttPolicy = window.trustedTypes.createPolicy('google-maps-api-loader', rules);. } catch(e) {. ttPolicy = rules;. }. . function getScript(src) {. var a, nonce = ((a = document.querySelector("script[nonce]")) == null ? void 0 : a.nonce) \|\| "";. var s = document.createElement('script');. . s.src = ttPolicy.createScriptURL(src);. s.nonce = nonce;. document.head.appendChild(s);. }. . var modules = google.maps.modules = {};. google.maps.__gjsload__ = function(name, text) {. modules[name] = text;. };. . google.maps.Load = function(apiLoad) {. delete google.maps.Load;. apiLoad([0.009999999776482582,[null,[["https://khms0.googleapis.com/kh?v=995\u0026hl=en\u0026gl=US\u0026","https://khms1.googleapis.com/k

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 650x433, Suserng: [none]x[none], YUV color, decoders should clamp
Category:	dropped
Size (bytes):	70354
Entropy (8bit):	7.997229701934639
Encrypted:	true
SSDEEP:
MD5:	BB7A00E641928BA0D9CD84B2139F6F12
SHA1:	18D43A6FCE0F01C49D3E274427E9EFE610AB48B4
SHA-256:	FC710E48B6CBDDC9294371EBC3F6E658FC3FAD829C18D686AE6D5FEF58E3B1A7
SHA-512:	CEED632CB4B003F3A12556F0EBCF9B4C0FDD423BAF06F5FE02579992BFB30FF9DC3ADF1CB752960886A6E26180355BE77EA01B0F5BE260C642F18A9C2FE04EBE
Malicious:	false
Reputation:	unknown
Preview:	RIFF....WEBPVP8 ....P........>m..F."!.+......c;..G....z..g$.....\|<.s......5.?d{....D......O....)NP~...).B........Xw../.?k.C.......=../.O......=............`....C.i...}.......pO....z....C.}..W...Y..........y>..........%..o.e!]wn4.!..^m..t."w{oj-YD.O.O..d{..P..]4...V...3.t..F.e,\|.X..W..I..Zp....$.F.i2.d).0M).dI..j.....6.2..T....#...k.KS.a#..9.v..g...Xj.......".!w..1.L...D...E..YA.....L....&m..FV.]..8.:..1X.DxM...-.u..x...LHj.A....!@.Q..i....-.~.].O..:r.,.Z^X.H{@..u.m"c!......[.h&............7..w..rr.)......`..a#.X..6....o.E.}3m..t..M..KTpC..l(.+#..@.v..X.zW...)...WB.......?UO#.y~r.17.............2.V?..U.{d.x.:.k..y.:9}.o.}_.F.T...o.Z.7......u.>u(v......L...mj..)....tv)....._..A.J.....`...}B_>.Q...m.k...yFN.:.S......OF....nu\b....]..wFF.T....q..k=i...mB..p)...O.S.t..zW...m..D.V.....e...B4DR.]...&..l(...O.7....@p5..k.:,/.......O.....:R.8........].WcxF.L...c.lA...s'..`k.m.>>.7...-Lg...<.`#N....{..3!.Z).Z.BLA..'.]..\|..o....Q..u....>...T.....v(.4

Chrome Cache Entry: 119

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	3
Entropy (8bit):	1.584962500721156
Encrypted:	false
SSDEEP:
MD5:	8A80554C91D9FCA8ACB82F023DE02F11
SHA1:	5F36B2EA290645EE34D943220A14B54EE5EA5BE5
SHA-256:	CA3D163BAB055381827226140568F3BEF7EAAC187CEBD76878E0B63E9E442356
SHA-512:	CA4B6DEFB8ADCC010050BC8B1BB8F8092C4928B8A0FBA32146ABCFB256E4D91672F88CA2CDF6210E754E5B8AC5E23FB023806CCD749AC8B701F79A691F03C87A
Malicious:	false
Reputation:	unknown
URL:	https://maps.googleapis.com/maps/api/mapsjs/gen_204?csp_test=true
Preview:	{}.

Chrome Cache Entry: 120

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 770x513, Suserng: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	53276
Entropy (8bit):	7.996327468079799
Encrypted:	true
SSDEEP:
MD5:	B59D870BA982F8751253D064EA0582AA
SHA1:	BAFB80DFF8E54966D3AA76D6F73D822A2070298F
SHA-256:	35E3062451E5EA0A1BCB136B8B1347DD40587FE590D880D040469D76017227F6
SHA-512:	F7CDAF2ACC68F44DB4BCB7723B9C2A1175861094B5F2870728A071FF454D5E6151D5016A4DA77CFEF158E8588A991EBC0B37AF08DB16C6570961961A46C1E206
Malicious:	false
Reputation:	unknown
URL:	http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/posts/16_11_2024/Ventilation-real-4e222-1.webp
Preview:	RIFF....WEBPVP8 ....PI.......>m0.G."..'.L....em.6..T.....O0om6A_=....g%.9.$...'.[....?..Q.^}....N..]...?........S......>............).....s......7....a.....3....k...........O.?...e}.......u....k._.......w......_r}C.k...~].....A_.......{..O........}..^.......s.?....T...........zy........&c.5n.^..$....Y>.$t..v(.O...&.....q(g..o.[.u.7@.h.-...d.Lz....f.A.36e.~SI...D.F..bnk.)s...M..PN..)...f._C.....M....`A..;TF\....[,5S.........R..U`1......S.K...b..^H...a.8.........7.M.S.?.......\..p..Ob6.............1..S1.....x.q.mj.w{......,r...h.(..%).q[{.g1Z..{d\^&..n.......?f.D..m5..F....1....<..0Wb_.....wS...~.........).&..3.S>.D..q..,^H^._...j)1.g.U.~.'}q..#\|..U.Y...=&~..>..w.~...D...gN..%..n.S(..{=T. 7...dW..S.V..h...a]O..B.@@8aZz{...4..9.6....Y..Q..O...;.e.}.....H.#..{...]_.3.^g..l..I<..h.7J.Q..."..A./.Fo..8..f...d5.T[.7.[.U..'-..Y..K.h_L'......ol.fm.J.#.uP....8l..b.._$Z..2. ..i./'9f.?...U......J.pT...F...k.I..(.4.%.tg>...uS....Dtv6a....Q...o.

Chrome Cache Entry: 122

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 600x600, Suserng: [none]x[none], YUV color, decoders should clamp
Category:	dropped
Size (bytes):	56870
Entropy (8bit):	7.997299945306364
Encrypted:	true
SSDEEP:
MD5:	7C5FCB105F73A91199E5CA75437A6C0B
SHA1:	3D938A358D0CC1E114E714A427FDBE8CFCF63E8B
SHA-256:	3D39A72307CA5D9376591F2967D4C0CE329C047B199255E7AF8A032275C58900
SHA-512:	4DFEED650F04724871814703896FC2288B8E8441C19F70A0284EB885A45C7394E20229D8D3B4878A45FA3FE370A0D5476C7FE35E96517D5CC70C5A871FB4224E
Malicious:	false
Reputation:	unknown
Preview:	RIFF....WEBPVP8 .........X.X.>Q$.E..!!&.khp..ek..\J.H.g..Jd...k..\.9.._...~m.....F..m.....S..Go........m....v.7....m.'....U...o...}....{.........K.;....oP...:...<.?...\|M~..^.......?5.J..._.~..7...H.N.......'......g...G..........o....;...S.......S.....}7..._.O..o..~..../...?..?........S......~.`.S...g.?.....?..o.....i...w.{.q`...E..;...... .{..]...yl.k8[.. :[.......=.2=.w..0dV=..7.....r.k.l.}L@......#.`.vM3...N.).D.Q.q..Y.......P=.....m$b....K...x.TB.,.....'#r..;R..K$w.N;...JRp.~.s4.D...y0k..,....B.2..ig....f.?.Zy....J..&.o8.....$.N..>.~....T.#i.g.m.O...$.^oWJ..D....FZ...E<.....D.,d...:_..0.s../^u^....t....._Ru...-...b..)c6.g,. ...(.x....qoT_2.W..K.../q.b......f..x).s.q......5..oVu......H..L...D.w.....5i....z....b......CA..m......e..G.N.``".....B..7..a...N[X.}.,7G........6".V..E.A.A.iW......_....#oQ8Ou.D...E^...G..!n...J..g.K..l.+..Q...Nb5"LTL..!4......~...D...N.h.../.a\|O.}\."%?....7...A.P...~.qQ...v..e...W..J....p.,h#+N..o..^...HTcg.T...C..Aj.F

Chrome Cache Entry: 123

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 600x600, Suserng: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	33480
Entropy (8bit):	7.994213611229128
Encrypted:	true
SSDEEP:
MD5:	BA1B198260152FE1CCCFC03405A4584D
SHA1:	DDBACD54DCC7C7EFA1C5394A7EFC7D813DD80AB0
SHA-256:	91D1A85790A99C064AD9C3244B2A0292140DC75968A5E12B861637232DAB80C7
SHA-512:	BB18ED664F81BD87BB999274E03E3C98726031C0CB2532F3C20D663759097D8B099AA82F7FCEE51C4B9C1C824CEE94CC8DE953D5D7A651C864A863D490A28E2F
Malicious:	false
Reputation:	unknown
URL:	http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/assets/img/user_avatar-RHta-2.webp
Preview:	RIFF....WEBPVP8 .........X.X.>Q&.F..!.#.9Pp..i[,.Q..............5..........w.]9.5............]...Q.co..u....m.F..................'.\[.......?........S.{.\|?...........?..S..........;.....8.bo..~U.......P..k.)I...,o..lC.\.+?....Aw.E.................=....{....Oh.mF...\.r.....T`^=..J.N@..=.N...6j..<l\w%.C...b.e.z,..b..+.i.u;.I..T.S.\|e..G..>-....Q;.Et.i....../.+....iU.!7.k.&.........DW..B...W..o. ..M..i.%.k.(..&$.+........JP...9.tf....M:......7.S..#.._]}=..V~..{...@.d`...Kz...G.;.L..R.k....$+9....7h!..2.....\..]T`..i...H.T..\|..v.6..W..h_...aR.?,..yi.8S..F...U..........N.......2^9g..~.#M?..1]..r.....#..{.......9A..k.c..Iu.{.?.=.\...#d.%.a....@.j.... 7....x...Oj...^=..:x+......Y./.....)._.."..t.8$QT=..X.?.......P.~.G3......_wj0.[.'K..../...]q...y..v.....r..4..w+..>.....k.t4WX..,o{&]...$...!m..}...Ikj[......@...C.P>x.5S.$..k.A..uN..3....as....{.D3.:.J..6.Ld....#....C..X.5.........S.ymQ_..i...q:...q.;..$]hN...f....)a.^fA...t..f.T.p&9

Chrome Cache Entry: 124

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	5772
Entropy (8bit):	5.501201589462824
Encrypted:	false
SSDEEP:
MD5:	ABBAA272304F302B51084A451FFE7DAE
SHA1:	4F30F97F10502F580324D269E82DA30CCFB98908
SHA-256:	15A5EE82EBDA5AA1EAB84759B10AE104478212211971EC31BC3A8439B51C7104
SHA-512:	28A43EED3AC0E0A0DA75E6E59300BEBB3E4F0B1062E25132E6EA044B148601E99C5E5CF45AE05E1A4D4CCB2E3FF4D3D7F94806DDF229D468E7D7A6A2E99DB43F
Malicious:	false
Reputation:	unknown
URL:	https://fonts.googleapis.com/css2?family=Big+Shoulders+Stencil+Display:wght@400;500;600;700&display=swap
Preview:	/* vietnamese /.@font-face {. font-family: 'Big Shoulders Stencil Display';. font-style: normal;. font-weight: 400;. font-display: swap;. src: url(https://fonts.gstatic.com/s/bigshouldersstencildisplay/v29/6aeq4LS6U6pR_bp5b_t2ugOhHWFcxSGP9ttD96KCb8xPyviY0nI5zw.woff2) format('woff2');. unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+0300-0301, U+0303-0304, U+0308-0309, U+0323, U+0329, U+1EA0-1EF9, U+20AB;.}./ latin-ext /.@font-face {. font-family: 'Big Shoulders Stencil Display';. font-style: normal;. font-weight: 400;. font-display: swap;. src: url(https://fonts.gstatic.com/s/bigshouldersstencildisplay/v29/6aeq4LS6U6pR_bp5b_t2ugOhHWFcxSGP9ttD96KCb8xPyviZ0nI5zw.woff2) format('woff2');. unicode-range: U+0100-02BA, U+02BD-02C5, U+02C7-02CC, U+02CE-02D7, U+02DD-02FF, U+0304, U+0308, U+0329, U+1D00-1DBF, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C0, U+2113, U+2C60-2C7F, U+A720-A7FF;.}./ latin */.@font-face {. font

Chrome Cache Entry: 125

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (875)
Category:	downloaded
Size (bytes):	3508
Entropy (8bit):	5.301121972532377
Encrypted:	false
SSDEEP:
MD5:	8A82A948D3AF8EDB15629C355138744F
SHA1:	2B0AC27E1F9C3EE0F289FABC47532D5F18D1388B
SHA-256:	2A4D831311E6DE00CFF32AAEA8C476E3AB77E1298B3385AB2DA36817285346E0
SHA-512:	77F83B1C7A683BFB061CC6BDB455AE28ABA5628A2349E4963BFDF9611A6557F95C45BB478985FD62929681892F773CDD5C7E59E62A0A5C9AC2880AB23555443E
Malicious:	false
Reputation:	unknown
URL:	https://maps.googleapis.com/maps-api-v3/api/js/60/4/search_impl.js
Preview:	google.maps.__gjsload__('search_impl', function(_){var Lxb=function(a,b){_.ck(a.Gg,1,b)},Mxb=function(a,b){_.ck(a.Gg,3,b)},Oxb=function(a){if(_.Mo[15]){var b=a.Ig;const c=a.Ig=a.getMap();b&&a.Eg&&(a.Hg?(b=b.__gm.gk,b.set(b.get().Un(a.Eg))):a.Eg&&_.kXa(a.Eg,b)&&((a.Fg\|\|[]).forEach(_.dm),a.Fg=null));if(c){b=new _.Gy;const d=a.get("layerId").split("\|");b.layerId=d[0];for(let e=1;e<d.length;++e){const [f,...g]=d[e].split(":");b.parameters[f]=g.join(":")}a.get("spotlightDescription")&&(b.spotlightDescription=new _.Lx(a.get("spotlightDescription")));a.get("paintExperimentIds")&&.(b.paintExperimentIds=a.get("paintExperimentIds").slice(0));a.get("styler")&&(b.styler=new _.Hx(a.get("styler")));a.get("roadmapStyler")&&(b.roadmapStyler=new _.Hx(a.get("roadmapStyler")));a.get("travelMapRequest")&&(b.travelMapRequest=new _.dpa(a.get("travelMapRequest")));a.get("mapsApiLayer")&&(b.mapsApiLayer=new _.Mx(a.get("mapsApiLayer")));a.get("mapFeatures")&&(b.mapFeatures=a.get("mapFeatures"));a.get("clickabl

Chrome Cache Entry: 126

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (31972)
Category:	downloaded
Size (bytes):	68253
Entropy (8bit):	5.351880637556216
Encrypted:	false
SSDEEP:
MD5:	49A6B4D019A934BCF83F0C397EBA82D8
SHA1:	6181412E73966696D08E1E5B1243A572D0F22BA6
SHA-256:	CADDA460CCB4C3C01BB45F3D5976F63F5ADF8DC3FF1D31CB4FBD3DED4F18E5BF
SHA-512:	B94465F995CC06B17803019A5A611EB73ADDF89E7FF0D464580BC9C79B1B3D24AE39BD1B64BA9FFAD3B39E239B3B4D018C76BF743EE0B9BF6808630B3D01ED40
Malicious:	false
Reputation:	unknown
URL:	http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/common/js_files/jquery.fancybox.min.js
Preview:	// ==================================================.// fancyBox v3.5.7.//.// Licensed GPLv3 for open source use.// or fancyBox Commercial License for commercial use.//.// http://fancyapps.com/fancybox/.// Copyright 2019 fancyApps.//.// ==================================================.!function(t,e,n,o){"use strict";function i(t,e){var o,i,a,s=[],r=0;t&&t.isDefaultPrevented()\|\|(t.preventDefault(),e=e\|\|{},t&&t.data&&(e=h(t.data.options,e)),o=e.$target\|\|n(t.currentTarget).trigger("blur"),(a=n.fancybox.getInstance())&&a.$trigger&&a.$trigger.is(o)\|\|(e.selector?s=n(e.selector):(i=o.attr("data-fancybox")\|\|"",i?(s=t.data?t.data.items:[],s=s.length?s.filter('[data-fancybox="'+i+'"]'):n('[data-fancybox="'+i+'"]')):s=[o]),r=n(s).index(o),r<0&&(r=0),a=n.fancybox.open(s,e,r),a.$trigger=o))}if(t.console=t.console\|\|{info:function(t){}},n){if(n.fn.fancybox)return void console.info("fancyBox already initialized");var a={closeExisting:!1,loop:!1,gutter:50,keyboard:!0,preventCaptionOverlap:!0,arrows:

Chrome Cache Entry: 127

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	285313
Entropy (8bit):	5.053810035814701
Encrypted:	false
SSDEEP:
MD5:	304FD509939802B85C4FFE9D58F3498F
SHA1:	E82D537CEB3A36761D6F9725CB8023FE4AC18655
SHA-256:	126ADD89639E7AC92DFF67C061C2E32486ECCA91D0D1D1ED8F1BC5EE34596A27
SHA-512:	029AC435A1FC089B7989848A337F3AE5D7DF702A052912E71941B390E5F976F359E957DF7CB1B1C9A275A3656882DEFE9509AD625644F444A1F5929A5153BE45
Malicious:	false
Reputation:	unknown
URL:	http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/common/js_files/jquery.min.js
Preview:	/!. jQuery JavaScript Library v3.7.1. * https://jquery.com/. . Copyright OpenJS Foundation and other contributors. * Released under the MIT license. * https://jquery.org/license. . Date: 2023-08-28T13:37Z. */.( function( global, factory ) {..."use strict";...if ( typeof module === "object" && typeof module.exports === "object" ) {....// For CommonJS and CommonJS-like environments where a proper `window`...// is present, execute the factory and get jQuery....// For environments that do not have a `window` with a `document`...// (such as Node.js), expose a factory as module.exports....// This accentuates the need for the creation of a real `window`....// e.g. var jQuery = require("jquery")(window);...// See ticket trac-14549 for more info....module.exports = global.document ?....factory( global, true ) :....function( w ) {.....if ( !w.document ) {......throw new Error( "jQuery requires a window with a document" );.....}.....return factory( w );....};..} else {...factory( global

Chrome Cache Entry: 129

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	7743
Entropy (8bit):	5.402301641320615
Encrypted:	false
SSDEEP:
MD5:	24A494ABD80E69BA22599CB1ABCE07FD
SHA1:	4D5D6F6CEE65E510ADB572E570DE70A3AF7FEC42
SHA-256:	AD9890C4CF6A32E393E9B21374061F4163BBD346C6DC2956E55E7E3F4C8292A5
SHA-512:	00624CD1A417D4F8979A125A15FBA016B7D231E5C1A08E6C259A1E9D0C75556D8700B50A18579CE19C69F799738B75DCDE76D2FBDD418B17522B0404CF6E9C10
Malicious:	false
Reputation:	unknown
URL:	"https://fonts.googleapis.com/css2?family=Crimson+Text:ital,wght@0,400;0,600;0,700;1,400;1,600;1,700&display=swap"
Preview:	/* vietnamese /.@font-face {. font-family: 'Crimson Text';. font-style: italic;. font-weight: 400;. font-display: swap;. src: url(https://fonts.gstatic.com/s/crimsontext/v19/wlpogwHKFkZgtmSR3NB0oRJfajheK_Zt3Q.woff2) format('woff2');. unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+0300-0301, U+0303-0304, U+0308-0309, U+0323, U+0329, U+1EA0-1EF9, U+20AB;.}./ latin-ext /.@font-face {. font-family: 'Crimson Text';. font-style: italic;. font-weight: 400;. font-display: swap;. src: url(https://fonts.gstatic.com/s/crimsontext/v19/wlpogwHKFkZgtmSR3NB0oRJfajhfK_Zt3Q.woff2) format('woff2');. unicode-range: U+0100-02BA, U+02BD-02C5, U+02C7-02CC, U+02CE-02D7, U+02DD-02FF, U+0304, U+0308, U+0329, U+1D00-1DBF, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C0, U+2113, U+2C60-2C7F, U+A720-A7FF;.}./ latin */.@font-face {. font-family: 'Crimson Text';. font-style: italic;. font-weight: 400;. font-display: swap;. src: url(http

Chrome Cache Entry: 130

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (9284)
Category:	downloaded
Size (bytes):	278470
Entropy (8bit):	5.423101325684964
Encrypted:	false
SSDEEP:
MD5:	EEDBBB80231A00F3E9C48AF0618C23C6
SHA1:	C8B9CBFEFE7FAEEDEDCAD7928E7C6326352D2406
SHA-256:	5FE0A073ACE2F50344B1222B26540AFB741B7DB359714AEEBDA229FAE7B5DB03
SHA-512:	C09726CADA3CA1CD549C3BA6132195D8A58EE9CA5D0EAF97A8DA7897C2C0E1AD100432BBF160CAC1097658B50ECD4A63014B9A8BE6E4FE8210C7BD729B18A312
Malicious:	false
Reputation:	unknown
URL:	https://maps.googleapis.com/maps-api-v3/api/js/60/4/common.js
Preview:	google.maps.__gjsload__('common', function(_){var nia,pia,ria,sia,tia,uia,wia,Eia,Jia,Kia,Lia,qt,Nia,Mia,Pia,Via,Wia,Zia,At,$ia,Bt,aja,Ct,bja,Dt,Gt,It,dja,eja,gja,hja,jja,ku,lja,nja,oja,vu,sja,tja,ev,Cja,Eja,Dja,Ija,Jja,Gv,Mja,Nja,Oja,Kv,Qv,Rja,Rv,Wv,Sja,Xv,Tja,$v,Yja,Zja,hw,$ja,aka,Tka,Uka,rla,vla,wla,xla,yla,zla,Ey,Dla,Fy,Ela,Fla,Hla,Jla,Ila,Lla,Kla,Gla,Mla,Ola,Qla,Yla,bma,cma,lma,jma,az,bz,nma,oma,pma,qma,ls,jia,Js,Is,qia,oia,rma,yia,tma,uma,Iy,Jy,Nla,Hy,ay,Bia,Dia,Cia,Rla,jz,wma,Bma,Sia,Uia,Gma,xx,Jma,Kma,pja,pu;_.ks=function(a){return!!a.handled};._.kia=function(){ls\|\|(ls=new jia);return ls};_.ms=function(a){var b=_.kia();b.Eg.has(a);return new _.lia(()=>{performance.now()>=b.Hg&&b.reset();const c=b.Fg.has(a),d=b.Ig.has(a);c\|\|d?c&&!d&&b.Fg.set(a,"over_ttl"):(b.Fg.set(a,_.Dm()),b.Ig.add(a));return b.Fg.get(a)})};._.mia=function(a,b){function c(e){for(;d<a.length;){const f=a.charAt(d++),g=_.vc[f];if(g!=null)return g;if(!_.gb(f))throw Error("Unknown base64 encoding at char: "+f);}ret

Chrome Cache Entry: 132

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 85044, version 1.0
Category:	downloaded
Size (bytes):	85044
Entropy (8bit):	7.997149031473659
Encrypted:	true
SSDEEP:
MD5:	316400C09C0560B3812E58B3124BBF15
SHA1:	2314D4D73DD9ED7AA2F9D18D45E71CA0440AC0A9
SHA-256:	856B3F9E0DF4F7061C8948021C7CC6E6263D96C48161E7FE9E4FBEFD0C69A085
SHA-512:	D410D293CBD3FC7198C171D72C137D3032D0D1D8C8108AAA20DD273E745EA3DF928242CFA2FE5A095AF36E43EF3883FADB3794295DBA6403F61D575E659FFB81
Malicious:	false
Reputation:	unknown
URL:	http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/common/style_css/fonts/bootstrap-icons.woff2?dd67030699838ea613ee6dbda90effa6
Preview:	wOF2......L4..........K............................4.V...p...(..2.6.$..T..X.. ..j...Q[.3.......wU...`.6.2L.F.......(:D..I/z.I.....'....G.m......_'..............y7..%.\|B.Y...g.w...v.=.A..U..VJ....PSB..\|j...."O..ibR..;rO.\\\/().R.e:..............;rw3...W}.<....T!`..=.m'.>.Fr..E.H..yN2TI...z.M.........o..l[.F5.m.\_.v.A2..~.}.u...g)....G...R7.;$^K..~O.n.>.S\...Y.O...n._...Bv`...s..:L....).#.....f..`..@...b.@....$..ak..Z.....n.[k.5......6n...]...C...{,......y..:\|b4[..8..FwEx.h..].M..N.+.-.....0.b_).G..lk..M@.I.O....a&...d .lv(....=7..."..('........+..8..R.:...K.j@...n.....~...........C....I}..O9!h....../xj}....,.8......7.[<..]?.(G;....?.G.pl?P%.A&.d.[.....~z...ko1....!R.x.Dk..6<..I.....v`....N.`..@.M..].E..x.....7..o..ABH.M.6.C.p-...5.'..B]8..s....3./'..'....%w.w..,..\...2.....0.BH.Q.e.E.. V....*..Q........Z./Z.U.vlj...S...k..-..)..U..Y..Y.....lF...n......B..urO...y?...#!..$..-5=.Hi.dk...A.5!.R...{.q..3)..[..M.n.....8bG\..Z.z....E!..s...

Chrome Cache Entry: 133

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (12795), with no line terminators
Category:	downloaded
Size (bytes):	12795
Entropy (8bit):	5.023138147083958
Encrypted:	false
SSDEEP:
MD5:	A2D42584292F64C5827E8B67B1B38726
SHA1:	1BE9B79BE02A1CFC5D96C4A5E0FEB8F472BABD95
SHA-256:	5736E3EEC0C34BFC288854B7B8D2A8F1E22E9E2E7DAE3C8D1AD5DFB2D4734AD0
SHA-512:	1FD8EB6628A8A5476C2E983DE00DF7DC47EE9A0501A4EF4C75BC52B5D7884E8F8A10831A35F1CDBF0CA38C325BF8444F6914BA0E9C9194A6EF3D46AC348B51CB
Malicious:	false
Reputation:	unknown
URL:	http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/common/style_css/jquery.fancybox.min.css
Preview:	body.compensate-for-scrollbar{overflow:hidden}.fancybox-active{height:auto}.fancybox-is-hidden{left:-9999px;margin:0;position:absolute!important;top:-9999px;visibility:hidden}.fancybox-container{-webkit-backface-visibility:hidden;height:100%;left:0;outline:none;position:fixed;-webkit-tap-highlight-color:transparent;top:0;-ms-touch-action:manipulation;touch-action:manipulation;transform:translateZ(0);width:100%;z-index:99992}.fancybox-container *{box-sizing:border-box}.fancybox-bg,.fancybox-inner,.fancybox-outer,.fancybox-stage{bottom:0;left:0;position:absolute;right:0;top:0}.fancybox-outer{-webkit-overflow-scrolling:touch;overflow-y:auto}.fancybox-bg{background:#1e1e1e;opacity:0;transition-duration:inherit;transition-property:opacity;transition-timing-function:cubic-bezier(.47,0,.74,.71)}.fancybox-is-open .fancybox-bg{opacity:.9;transition-timing-function:cubic-bezier(.22,.61,.36,1)}.fancybox-caption,.fancybox-infobar,.fancybox-navigation .fancybox-button,.fancybox-toolbar{direction:lt

Chrome Cache Entry: 134

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (557)
Category:	downloaded
Size (bytes):	179612
Entropy (8bit):	5.618955961633512
Encrypted:	false
SSDEEP:
MD5:	582A2A4B5625BAFB0D39CE7C18E79492
SHA1:	FE9C5AF8C2F15E776504ABB3EBB2634515B48FCD
SHA-256:	2C7330D0FB6EC7FB399168B167CAFC7E1186688782C4BB8A9EE089D0AC7A6843
SHA-512:	2EE46C0C09A6E50ABA689F27BBB3E5CE9A2E0F6E1242BE8A1B259D8C0E639F51E677ECC34D2991FC738C1D6F5557012DF6DE04967699332DDF342F25B8EE1B2F
Malicious:	false
Reputation:	unknown
URL:	https://maps.googleapis.com/maps-api-v3/api/js/60/4/util.js
Preview:	google.maps.__gjsload__('util', function(_){/.. Copyright 2024 Google, Inc. SPDX-License-Identifier: MIT./.var cxa,dxa,exa,fxa,gxa,ixa,jxa,lxa,XD,YD,ZD,mxa,aE,dE,fE,qxa,rxa,oE,sxa,txa,vxa,rE,xxa,sE,yxa,Axa,tE,Cxa,Bxa,Exa,Fxa,Gxa,Hxa,Ixa,Jxa,Kxa,Lxa,Mxa,Nxa,Oxa,Pxa,Qxa,Rxa,Sxa,Txa,Uxa,Vxa,Wxa,Xxa,AE,$xa,DE,aya,bya,cya,dya,eya,fya,gya,hya,iya,jya,kya,mya,oya,qya,sya,uya,wya,yya,Aya,Cya,Eya,Fya,Gya,Hya,Iya,Jya,Kya,Lya,Mya,EE,Nya,Oya,Pya,Qya,FE,GE,Rya,Sya,Uya,IE,JE,Vya,Wya,Xya,Yya,Zya,$ya,aza,bza,KE,LE,cza,dza,eza,fza,gza,ME,hza,iza,jza,NE,kza,lza,mza,nza,oza,pza,qza,rza,sza,tza,uza,vza,wza,xza,yza,zza,Aza,.Bza,Cza,Dza,Fza,Gza,Hza,Jza,Nza,Oza,Rza,Uza,Vza,Wza,Xza,Yza,pF,qF,aAa,sF,tF,uF,cAa,dAa,eAa,xF,yF,fAa,gAa,CF,iAa,jAa,DF,lAa,qAa,rAa,IF,vAa,zAa,AAa,BAa,LF,CAa,DAa,FAa,GAa,HAa,IAa,JAa,OF,LAa,QAa,WF,SAa,TAa,WAa,qG,XAa,rG,YAa,ZAa,$Aa,aBa,tG,cBa,bBa,dBa,fBa,hBa,jBa,nBa,lBa,oBa,mBa,sBa,rBa,uG,vG,tBa,uBa,wG,xG,yG,AG,BG,CG,wBa,EG,FG,xBa,GG,yBa,HG,IG,zBa,JG,KG,ABa,LG,GBa,KBa,MBa,NBa,OBa,NG,OG,P

Chrome Cache Entry: 138

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 26052, version 1.0
Category:	downloaded
Size (bytes):	26052
Entropy (8bit):	7.9912777033346245
Encrypted:	true
SSDEEP:
MD5:	79F4A05271DF2557331188959E000767
SHA1:	E72E4F7D2E58634CA69DABCFCCB2C87D92A953D0
SHA-256:	DED83489ADAEEC098EE0D639252E72BE7DE219F759B939BA4B2E606E5E68B272
SHA-512:	4CEA6F906EB49CBD0202B049BA22694A4E6F4D05D19F62FCF2E26A5F9157ABE090F08FB5F55F0D7C676D7E133FEEE3C2DB0A59FE97EAEC5E5CD78FA580405D39
Malicious:	false
Reputation:	unknown
URL:	https://fonts.gstatic.com/s/crimsontext/v19/wlpogwHKFkZgtmSR3NB0oRJfajhRK_Y.woff2
Preview:	wOF2......e..........e`.............................<..8.`..\|.r...........P.....6.$.... ..:.....K.B.....n...S_.D.l....6.FD.q..EGS......!..M-.?...a..IU.^<...."..]k.[.y.s`.-...Fb...H.6..QH.m....HW.}...w..EC....#...k.:.^..e.2,..!.,+...FP....%b..:&..\|.]\|....IN..S..w..mRpi.jL'.t..\..:.......v.[..X..1X2.6:.D....\|}#.......o}y.o...j.g....."E..H.0qH.D....EU.r=...Q".@H4....H.EH...!q.a.......b.R).O,...\E.e\>.Q.l...u.. HE$.@a03...:......yJ...KU..s.{S..n.e..%..Bh... ..t..I.....2...f.W.1h.1K......G..5......~.....JX.......CZJ.!..t...VW=.0G9...._.x.U. .G...\|gwV.sRz....... ...=.."....H_..2.XVD.Is.Y.@p.0.5.N.{\|~....X..~.v.>7...w.@..m.0.......U...{...@..-.`.El...S.%.y..H..2<... k.../....@r.&...u.'..V3?..J......*T<....GB.-.Z.@.jpP....._V...!...I..Y.c^.......a...f........~`7....u..$...m.n.z{'......8.\| ..0X.....Td..R:6.e. .9k..Ef...k..Ks.A...g-..'8""q.{...{,C.n.....0..J..V)...$..)6.. ..e,.8."D..@?...B....z.\..]7.axQ...C.m........`...@...n`q....V `<....8+E.>_.

Chrome Cache Entry: 139

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (906)
Category:	downloaded
Size (bytes):	2673
Entropy (8bit):	5.289995026181556
Encrypted:	false
SSDEEP:
MD5:	DD4903BD251C0BE35B2A704627EE2350
SHA1:	59555D96A0DB96029AEFD090F0CB14F2CCA3B9F7
SHA-256:	7EAD621A451AE6F5AF9A1224EA24C0EA6A9B9B7E737AD92E3108C509D7278D83
SHA-512:	CA5182A00A8CDEA6BA26D1C9C182839490232AF7D006A40D0D04940DC4845570F5632E0E8BA69FB1A405CE0EB5F1D2474A77FD614E570805E89E4AAB9C7C9A2C
Malicious:	false
Reputation:	unknown
URL:	https://maps.googleapis.com/maps-api-v3/api/js/60/4/search.js
Preview:	google.maps.__gjsload__('search', function(_){var nta=function(){},fD=function(a){this.setValues(a);_.Hk("search_impl")},pta=function(a){let b=_.on,c=-1;a.tiles.forEach(e=>{e.zoom>c&&(b=e.ji,c=e.zoom)});if(c===-1)return[];const d=[];a.Wu().forEach(e=>{e.a&&e.a.length>=2&&d.push(new ota(e,b,c))});return d},qta=function(a){const b=[];a.data.forEach(c=>{b.push(...pta(c))});return b};_.Ka(nta,_.pm);var rta={["1"]:{}},ota=class{constructor(a,b,c){this.nn=b;this.zoom=c;this.bounds=this.anchor=null;this.Eg=rta;this.source=a;this.featureId=this.source.id\|\|"0";this.infoWindowOffset=(this.source.io\|\|[]).length===2?new google.maps.Point(this.source.io[0],this.source.io[1]):null}getAnchor(){if(!this.anchor){const a=1<<this.zoom;this.anchor=_.On(new _.io((this.nn.x256+this.source.a[0])/a,(this.nn.y256+this.source.a[1])/a)).toJSON()}return this.anchor}getCompleteBounds(){return this.getBounds().reduce((a,.b)=>{a.extendByBounds(b);return a},_.Zn(0,0,0,0))}getBounds(){if(this.bounds===null){this.bou

Chrome Cache Entry: 140

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (608)
Category:	downloaded
Size (bytes):	3452
Entropy (8bit):	5.333645885683573
Encrypted:	false
SSDEEP:
MD5:	D7F74099180D57494A08E2DD5EEE37A1
SHA1:	BEA13C8E6533A1F73DE0968026F10C5C2CC89A42
SHA-256:	A7DE596B1913214ACDB10A1CBE33DF7C0783034A42EEB86D449E4FA6389176AF
SHA-512:	28DE00DFE89B0C5CCBF398DA3B270B8E2F99A1EA8B63EA01BE0D91DFAA7283D7997C1279EF4071404561D4B43FAD0E05A5FAE1CB1FEF15AE1F68E4C17264BE81
Malicious:	false
Reputation:	unknown
URL:	https://maps.googleapis.com/maps-api-v3/api/js/60/4/overlay.js
Preview:	google.maps.__gjsload__('overlay', function(_){var Swa=function(){},ND=function(a){a.TA=a.TA\|\|new Swa;return a.TA},Twa=function(a){this.Eg=new _.zo(()=>{const b=a.TA;if(a.getPanes()){if(a.getProjection()){if(!b.Hg&&a.onAdd)a.onAdd();b.Hg=!0;a.draw()}}else{if(b.Hg)if(a.onRemove)a.onRemove();else a.remove();b.Hg=!1}},0)},Vwa=function(a,b){const c=ND(a);let d=c.Fg;d\|\|(d=c.Fg=new Twa(a));_.hc(c.Eg\|\|[],_.dm);var e=c.Ig=c.Ig\|\|new _.Ipa;const f=b.__gm;e.bindTo("zoom",f);e.bindTo("offset",f);e.bindTo("center",f,"projectionCenterQ");e.bindTo("projection",.b);e.bindTo("projectionTopLeft",f);e=c.Kg=c.Kg\|\|new Uwa(e);e.bindTo("zoom",f);e.bindTo("offset",f);e.bindTo("projection",b);e.bindTo("projectionTopLeft",f);a.bindTo("projection",e,"outProjection");a.bindTo("panes",f);e=()=>_.Ao(d.Eg);c.Eg=[_.bm(a,"panes_changed",e),_.bm(f,"zoom_changed",e),_.bm(f,"offset_changed",e),_.bm(b,"projection_changed",e),_.bm(f,"projectioncenterq_changed",e)];_.Ao(d.Eg);b instanceof _.Em?(_.Um(b,"Ox"),_.N(b,148440)):b

Chrome Cache Entry: 142

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 25184, version 1.0
Category:	downloaded
Size (bytes):	25184
Entropy (8bit):	7.992071869095497
Encrypted:	true
SSDEEP:
MD5:	23EEC75BA54D389A0188ABBB596B7614
SHA1:	DAA4672AD515A108325F52116E9A49AAB8CDD5FA
SHA-256:	538C7067580F457DD3DD98EBAABEB19405C12BDD01674D3DB8FD9948EE73C862
SHA-512:	6A50E67D032474B8DB85942578F819F804F2FE19B1629D9F53605A81C87ADFDD3064E73B395B8D79051F966654444AC99CB59BD0019C205CAC4810A54AF14042
Malicious:	false
Reputation:	unknown
URL:	https://fonts.gstatic.com/s/crimsontext/v19/wlp2gwHKFkZgtmSR3NB0oRJfbwhT.woff2
Preview:	wOF2......b`..........a..............................j..D.`..\|.r........x........6.$.... ..B..{..K.I....$.<.h.{/cD.l.....f.j.8.B.....%.~....p.JS...I.P....#.s.F..Y...t.3"..ah......a...u<..G..1...>....Y.K.u.Q.tu".......DT.......s.....R.X........^.{.....#..jA..V@...#jeo3{~k..m.?s..{..V...[`..&.8H3. ..pXC.B..........x8.....y.....nR.4....n!.?...=..k....2oD. .....e6.u.h....4....;V.4e...........'H.....PU.a.19.Y.m.6../...t....Q-...j.u.s.NMh.....V}....8...72y..N.wf.e.}%.4.v.$...X.......W.UD..Q...B0.V..vaD.j...f..B....!..V....%../(X..u&.S.<.....K....~Q..2..fm...._+m....<w.(..OE......;....0.......D.H...XE..g...j_..(.'..a....Q....;l..-.9=p...<.4..4.R6..>.. B..+.....$.eRN.DR......!..W.r9.m.E.l......G..U......K.WON...R...9.?..~Z..$}s=.@QJ...e....2.Z..F.%..$.^..]..<o..R.D.X..R 2..........R$..!.0..3.!.C.)X%..9C...0...(H..T.)L.VdFc.L....?i ..P.7.7.8M".......8...1=,...G...-.)m.....N.8...o.P..-.<.......?..l<..3iOX#...f..>.\|9...dIn.u..axm{.ei.g.m..T...zlo.

Chrome Cache Entry: 145

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 925x617, Suserng: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	49044
Entropy (8bit):	7.996026369858628
Encrypted:	true
SSDEEP:
MD5:	E58DBDD32330B774D84251493C4D5BEB
SHA1:	E614CBC5A5A2562F48AB4803A41FD94766DBDDBE
SHA-256:	5267DE379AC4FE3F217BD13EA4D11AF6C5D48E57DE606FDE7BD192E05852BEC3
SHA-512:	4B67D18E02F083B0783742792853BBF1819E8DBBC953369E07C1959CFD33CEB2895BB90571B75F13F99EDC673CB093C14B2EE0A70486F258C4EDEE8570EDDA81
Malicious:	false
Reputation:	unknown
URL:	http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/assets/img/gallery-EPU5.webp
Preview:	RIFF....WEBPVP8 .....o...*..i.>m0.H$".+..{.p..enK.zU....y.S.aO.>.?..f.o....1..g.........-...r..y........3.!.g.sk.....}.~..`.......?].h~.?....af......:.........`..?..[..o.........?.z{..t..........+~.........w.....z.........._.O..........aff.....mz.....%.[.d......]._s....B...\|YOo:T.......f.%.........oa.....2.T.~H6..p.k.a.Tm;....-..6..lY..8.f.].I.4......F\|\|.z.3a..25......f.L......@.e"..h...@.....A.Q..<..OV..We.2...a$....q.>c....O.`.....'G.Bi...j.{+.-...1.k...u..G..m@p:...0=.L .}T....{&.<)..J=6R..No...Zt..W.......e....l..f.....9{[.U).....O...n..8.B..i.K.. \...iy....X0.B..,W.....n'e.PB....?.Q.ly.....c.,....Mi....-.<..7o..E4!..F....z>T.>8{{.W.-.Y....Q?...}k...O.%.Z7a.U ..=.6......k...!...............8.\S1..U.....D.......99.#-..$.a.8..kx..NO....D.g;.T.z....<.\|DI.C.3.F.)j..I3..m..."l....s.pe..VN.A!........E.IW.-8.P5..p..p.B.U...B..H..@.[x<.u..X.._....@G.g..j..@EM{. 0....x...{G..9yb...~.&.....O.. @\|..=....~.'...Y.C..n.)..........o.!..]

Chrome Cache Entry: 146

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 25540, version 1.0
Category:	downloaded
Size (bytes):	25540
Entropy (8bit):	7.991502685547295
Encrypted:	true
SSDEEP:
MD5:	19AB149056827F64D640FA3D65F4E536
SHA1:	754C09533C5B386067E762AE85F39C345EC10915
SHA-256:	60B9B9640FC716ABD752DF41F38AD81052F4905E42BE2FF3C1F78E851863AEE0
SHA-512:	E382CFCF784EF72503CCD007642F5B3E285DE7B5515CD76457855896034B7EE26908A1F491527B9FE7A603A6627FB3DB0FC9618CDBD52724B8F4D309F7DE33D1
Malicious:	false
Reputation:	unknown
URL:	https://fonts.gstatic.com/s/crimsontext/v19/wlppgwHKFkZgtmSR3NB0oRJX1C1GDNNQ.woff2
Preview:	wOF2......c..........c_.............................v..D.`..\|.r........H..s.....6.$.... ....q..K....l.J..U!E...(.8.?P02P7......I:.a.@U{V..LNdDm}.ikp.Z-..........Wl..@g.i..$..f.{.O......;ea.;..@"......^XH\^....>...=......3.m.Or..Av._=....I9.......yw......7.I.'.S.D). -...s .V..5...mnFo.s.nN..=oj:3/..wA.N..D.8B!.R+.B..pp.V.S.h8.Z..M..].G:.~vE..,....L.d..1.W..........v....$.`....ln.5..+%.......2.<.+....4G..1JGA\|A,S...............I...j..n......Y.J!;.........PmVU...=-.z..H`L..#g.....h.<q.........;...YxVV..>g....9.F ..2..)q.R...eZ......h$.".n9..._.w.l..4....p..!...E..!%.B!c...6../..)..v.Dov .a..".p._n.PDt......IAs........F.X.*..[. 5-O.v..Y.t....u...U.nT7.F7@..Rj.2$......Y..4y..9.k...h......H..R..3.u..>.....y<....?W.w..;g.).. W..G.`3?.....S.V...0.SBG...p..v.i!Y..&.0.M....=~;...,rB..;........g......w..M\..S......!..w......k.o.8..4{oP...X.p)..D.b2.....W.T....,.k..1 DT...@.f@..3.AP4`z..x....6.zfxp/...z..P:"..Z.o.....I.G\|.?......................m..GP.

Chrome Cache Entry: 148

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (1249)
Category:	downloaded
Size (bytes):	2206
Entropy (8bit):	5.273591375889605
Encrypted:	false
SSDEEP:
MD5:	0DC409ED9387901716C1A55D71E6CF50
SHA1:	820183498E8A73FF5593FFACA0333A657C2580E6
SHA-256:	2E460938533D3D31C6DA3964FA21CC672F9B373F7C160DDCA6EF816FA3F49113
SHA-512:	8589F8EAEA369DFC8B622928B5BDCC244439EDD63DF232B4A66F5D848D250E98F8C29FCCC07E69499DE5D9055D8ECC5C6CC302F44CF48F9D4CC80F770A2C2685
Malicious:	false
Reputation:	unknown
URL:	"https://www.google.com/maps/embed?origin=mfe&pb=!1m3!2m1!1s1019,+Canterbury+Trail,+Georgetown,+78626,+United+States!6i8!3m1!1sen!5m1!1sen"
Preview:	<!DOCTYPE html>.<html>. <head>. <style type="text/css">. html, body, #mapDiv {. height: 100%;. margin: 0;. padding: 0;. }. </style>. </head>. <body>. <div id="mapDiv"></div>. . <script nonce="5S-FIvQcRcysEE3kdAZmTQ">. function onEmbedLoad() {. initEmbed([null,null,null,null,null,[[[2,"spotlit",null,null,null,null,null,[null,null,null,null,null,null,null,null,null,null,11,null,[null,null,null,null,null,null,null,null,null,null,null,null,null,1]]]],null,null,[[null,null,null,null,null,null,null,null,null,null,null,null,null,[[["9675094258350859365","7893033150131366226"],"/g/11c2dfly0b",null,[306223274,3318297937],null,null,null,1,null,null,null,null,null,null,"gcid:compound_building"],0,null,null,null,0,null,0]]]],null,["en"],[null,null,null,"/maps/api/js/ApplicationService.GetEntityDetails","/maps/embed/upgrade204",null,"/maps/embed/record204"],null,null,null,null,null,null,null,null,"WfHTZ-X7JJTxi-gPp4_J0As",null,null,null

Chrome Cache Entry: 149

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (854)
Category:	downloaded
Size (bytes):	238767
Entropy (8bit):	5.569053023110954
Encrypted:	false
SSDEEP:
MD5:	A6A8F82C5701D25A8829EFEE1E9EADB9
SHA1:	C00D5265EB719D2C80BD6F64926DCEBCF4C98032
SHA-256:	6E3202AF9C34699E8727B48AF5AA1DF38B10815D1A5DD49BE8176B9026321A1D
SHA-512:	30C94D463962A088E182D8A3EDB3C026BE6C6245A3D9A7EA66DF836105EF75D7B2E028B8432752AC5BF821AA19DD5FE29E093B8ADE87080FBCC59CEA337B98C3
Malicious:	false
Reputation:	unknown
URL:	https://maps.googleapis.com/maps-api-v3/api/js/60/4/main.js
Preview:	(function(_){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././.. Copyright Google LLC. SPDX-License-Identifier: Apache-2.0././.. Copyright 2019 Google LLC. SPDX-License-Identifier: BSD-3-Clause././.. Copyright 2017 Google LLC. SPDX-License-Identifier: BSD-3-Clause././..Math.uuid.js (v1.4).http://www.broofa.com.mailto:robert@broofa.com.Copyright (c) 2010 Robert Kieffer.Dual licensed under the MIT and GPL licenses../.var ma,pa,na,va,baa,caa,Za,bb,Zb,bc,wc,Oc,Sc,Vc,hd,Dd,Pd,faa,gaa,ie,jaa,maa,je,laa,kaa,iaa,haa,ke,naa,se,ue,te,xe,ye,qaa,lf,qf,Cf,vaa,zf,Af,xaa,Of,yaa,Xf,ag,lg,zaa,Aaa,Baa,ng,pg,rg,mg,Kg,Iaa,Kaa,Qg,Rg,Sg,Ug,Zg,Laa,eh,ch,Maa,Xg,Naa,jh,lh,mh,qh,oh,uh,ph,Paa,vh,Qaa,Saa,Uaa,Vaa,wh,Hh,Ih,yh,Gh,Yaa,Lh,Kh,Ph,Qh,Rh,Th,Sh,Zaa,aba,bba,ri,Ti,cba,Si,dba,fba,pk,ok,Ak,Bk,Ck,hba,Ek,Fk,iba,Dk,gba,Pk,jba,ll,rl,Jl,Ll,lba,Nl,nba,Vl,qba,tba,em,sm,um,qm,Jm,Sm,Bba,Vm,Ym,Zm,an,dn,Gba,gn,Iba,Lba,Nba,Mba,nn,Pba,qn,sn,Qba,.Rba,An,Wba,En,Yba,$ba,aca,In,bca,P

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	2087
Entropy (8bit):	5.028903414406507
Encrypted:	false
SSDEEP:
MD5:	6A1B7F865D6D3E9B6ACA4E8131CC6DE7
SHA1:	AA3233B9AB089872097C9C0AEEC67A8D2ABF1E1D
SHA-256:	3B0E141D28AF87F144EA808CC6C8F906172BE3E690976DF5694BB3233A614956
SHA-512:	DDA1A125510C5CC41250A1C1D057A51EBF3014EB6BC7C2E848FD3448C36268D4ED5FF7BB3CBBB5CC8EC6A082B042B6662FB1E8A634881BF3A11A8862EE70BE28
Malicious:	false
Reputation:	unknown
URL:	http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/common/js_files/script.js
Preview:	$(document).ready(function() {..$('.fanboxy').each(function() {. $(this).attr('href', $(this).children('img').attr('src'));.});..if($('.content-img').hasClass('float-none')){. $('.content-img').css({'max-width':'100%','clip-path':'none','shape-outside':'none','margin':'0 auto 20px auto'});.}..if($('.about-bg').css('right') == '0px'){. $('.about-container').css('flex-direction','row-reverse');.}..if($('.team-and-comment').css('flex-direction') == 'column'){. $('.team, .comment').css('width','100%');. $('.team-box').css({'display':'flex','gap':'30px'});. $('.team-card').css('width','50%');. $('.team-and-comment').css('gap','50px');.}..if($('.footer-light-container').css('flex-direction') == 'row' \|\| $('.footer-light-container').css('flex-direction') == 'row-reverse'){. $('.contact-list').css({'width':'40%','flex-direction':'column','gap':'20px','justify-content':'center','gap':'30px','padding':'0'});. $('.contact-item').css({'width':'100%','display':'flex','ali

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4740)
Category:	downloaded
Size (bytes):	248669
Entropy (8bit):	5.686294869113514
Encrypted:	false
SSDEEP:
MD5:	BCBE9096CBAF6ECA90ABFCDC069C13E2
SHA1:	79FF4A339DE8CE3D99A3B5A34BCE1A51D7FD46E1
SHA-256:	489B33ED727742A6091A792D3A476C9B9A703001F5B3ACE10AB4A3C502A72CA0
SHA-512:	CF512DE45108DA27128895340E2943644807A48EFB6493C6372852A63F440BC41222102EC8FE078FE1F14F96C9525FC267FBE2C38400C6641EC93A08440F0D16
Malicious:	false
Reputation:	unknown
URL:	https://maps.gstatic.com/maps-api-v3/embed/js/60/4/init_embed.js
Preview:	(function() {'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function ca(a){return function(){return this[a]}}function da(a){return function(){return a}}var n;function fa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ha=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ia(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var ja=ia(this);function p(a,b){if(b)a:{var c=ja;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ha(c,a,{configurable:!0,writable:!0,value:b})}}.p("Symbol",function(a){function b(f){if(this instanceo

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 600x600, Suserng: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	123218
Entropy (8bit):	7.998599689807692
Encrypted:	true
SSDEEP:
MD5:	15D31BE6656E3D73EB6C1F3972FD8354
SHA1:	9BC196DC443A612C1BD799AD493A7A0E22A3EF9A
SHA-256:	6434F977C1A67500434BFCA38CAED40020C976C478562CC5C1F33FC2C78C0DE9
SHA-512:	65A71CD622B302E5728556ED73F5867AF0229A6E9C89FDC14AD87B415E448A1D65A1161BB681AAAEA1BC5E2BC6319E7F270683FB21485495D1E5B6D6387BB290
Malicious:	false
Reputation:	unknown
URL:	http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/assets/img/user_avatar-RHta-1.webp
Preview:	RIFFJ...WEBPVP8 >....F...X.X.>E..D"....&.(.D...P..3."....+/..t...-x..U....g....A.u.a...{ m.OG.-..[...t..._].w...{....>a.G........>...z.._.7.3...../.oR...^....p...w...;...{....j.......3...../.q.I...W..W...oko.^............O..~W...3.?............].}O...?.?......G.?..Q.g...............o........m......m....?...._....?.z...._._.....p...O......F.........c...?....L.....w.+...._...........O...G.....~K~.............-..\.N57.....=...y}. .j~..;...o.baL........rT.^%Os.......K..odX.J..C..#..e..5.z^.>.`.a.!%..cU.lk...7}6.z..xS....+..w........Db&..0.K...U;.......'..x..(s....y.:.....A....DM...&..#..C.>.^.!{....1....<.V........{........2.SM.$/=2.4.x...v.b.W...I..F.$..18.).;K...M.....[4_A.9..m...q.0....f.W.{..x.7.ML..R.\|@...a.L......>..h\|.o.g..V8..ly.8S' ...+...?.....6x...j.}O7...,...H.n..'.TQ........1...........4...HM.FF...@.o8-...ah%.Eg.u!....G...&..sf....z.....R:&y...g..{....r6D..%.<..G....k.....&...P.S...h~l.!i..P.o..t_5...]G.....x.X\0..WQ...L.6e.Q..,..

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 54804
Category:	downloaded
Size (bytes):	13146
Entropy (8bit):	7.9829792746621955
Encrypted:	false
SSDEEP:
MD5:	91873C6A27D0AC29926F5A0EB384E0BD
SHA1:	22E6FC6C9B49B98E78C6BAC882F0C07BAEC33CDE
SHA-256:	6906A91EC24772441B7D51758774513F6B700DA45136AE850EA9CC8B60B4C532
SHA-512:	4D4CCF26AF0E1A4E5A1E0933F7AFCAC8573839159F38F8A622D4FAEAFAC7B60036DC311866B874985F667CD9402C36232C306DDED2B9FFC3F30D0FFCD9A9CFAA
Malicious:	false
Reputation:	unknown
URL:	http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/?affsub2=es2
Preview:	...........}kw.....z...P.4.O.(.bI.#'M..7yc.=mW.^..I.$...d...?.g.......']=lc..\....g.G..~........o.,..........?.l.....?.A.{........./........ap...I..E.$X..M8Nf...:..M.a.G.p.x.zt..E.E.l...&.<..~....."\.^....\|..w.;._..;....h................_...?...._.o.....Q.....o..~2...?.g.......k?~.9.g...G.._D.(~.m.&. x.....0.}.-.^...{...)z.....Q...........4z..f..W....}.y.'..........(.H...8.._F1J.....4\|..%."....L0.......q....n.......D./...O...A....w.$.........y.T.-...~..&\....<.......:..h....._....?....Q...c...C.x.}..k.......Jg....Y.&......u8...{.p:k...........\`.0;...IO@s.E....C.......j...ur{...R....o.k.y .'&w.X}.0.q.;..v.z.^...l..u......5...`.jX..l.(N.\Y}}...S..b.^..M@.3...^.y..f..E.IKf^...g_..I..=.i..1...6..g(..d......=.Z-..E.(..o;.y.\|..y#Nn!.fA..G.I......q{.EI...U..lL..&..2~P[Z.N.T.....J.V.....Q:.Y....v{.i...Q4....L..=..m..p$.x#..8.t....).$..B..T>.$.Qb.O.^...s..V\|=mx...*J...F.W.S.]....P.....o./.."......$.!$...t......t.v.........<.....0^......_5JD.

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 1920x1332, Suserng: [none]x[none], YUV color, decoders should clamp
Category:	dropped
Size (bytes):	470430
Entropy (8bit):	7.999613624675269
Encrypted:	true
SSDEEP:
MD5:	46FBA8580604F76ED033FB7ABDA509A9
SHA1:	45A982892C24728AC1D441A5846615713A61ADC8
SHA-256:	98A0DD833D08BFB7415B47CD5E598F4F2BBC56534B398C827515DA6C7B436A25
SHA-512:	9D94DFF1982DC8674145401F79A13D80A5007B2563B2145487B22234868BA9CA9AAE4448A99D95F758B0BD71040D7E459690BC4A8AEB343C6F2D7D18319DB5D1
Malicious:	false
Reputation:	unknown
Preview:	RIFF.-..WEBPVP8 .-...d.....4.>m0.G.".!.s.....gh.l.>..s..f..m..c....g.N..-.9.W.......?.z/. .6G..%t....J.#.nI..."...O.2.J..}....o...}Ct.....Q...c...??.kA....p.S..........o.W...W........7..-.._.<.._..._..e...o..k.W.....?.~.z..[....w.......?....../J.....?......3.7.;.....W.........................G.O.?..a.o...S.+.w.O._.?w.......C........q~..........d.3D..q8^R....~.....nb.......v^.r.~91.D.m....gdKN...l#.D.3...m......-.....z......W.Z."Y.5Z.s.+...F.\|..[.....-..8..b...o8.E.......i(l....8...\.,.VsE...j..+..(c...(...9>K..seG5.<f...E<4v/>\T..x.l.X.].R.v._...h.g7/...[.8..'.[.:.T.u.]q.s...x...../...8.~P3Q...,..`.........aY...p...xn<..H(......9.WI.....s.C.9......o. N.._.&/.....Y3.~.u.X^........).Z...ji z..&h..T....i..eX..P...V)....W.!~.......!5.$.wd...P..k...W....x3..)............cn=...m#.._'..h'....p?.#sM..oo...f....P&...`$?H.-......G~..:.J{CGG.....;..-.5.v..I..WuQ...6.q.b..eG...U0...?"Wy.7":..].].:hR...Ebr..M.[.....'.t$..N..!VC.....$.p.Z._....'....

Static File Info

⊘No static file info

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/?affsub2=es2

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Created / dropped Files

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 106

Chrome Cache Entry: 119

Chrome Cache Entry: 120

Chrome Cache Entry: 122

Chrome Cache Entry: 123

Chrome Cache Entry: 124

Chrome Cache Entry: 125

Chrome Cache Entry: 126

Chrome Cache Entry: 127

Chrome Cache Entry: 129

Chrome Cache Entry: 130

Chrome Cache Entry: 132

Chrome Cache Entry: 133

Chrome Cache Entry: 134

Chrome Cache Entry: 138

Chrome Cache Entry: 139

Chrome Cache Entry: 140

Chrome Cache Entry: 142

Chrome Cache Entry: 145

Chrome Cache Entry: 146

Chrome Cache Entry: 148

Chrome Cache Entry: 149

Chrome Cache Entry: 94

Chrome Cache Entry: 95

Chrome Cache Entry: 96

Chrome Cache Entry: 97

Chrome Cache Entry: 99

Static File Info

Windows Analysis Report
http://zeit-zu-investieren.cc/crp/gfh53g4h54j4h/a3ccg4n2/?affsub2=es2