21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 2b:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T41e,{"@context":"https://schema.org","@type":"TechArticle","headline":"Suspicious Sample 6bc0208ed233… — Score 38/100 — Hybrid Analysis","description":"Suspicious verdict for sample 6bc0208ed233…. Threat score 38/100. 0/27 AV engines flagged this file. 1 malicious and 5 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/6bc0208ed2339ca6746884c047ca57139f47a59878835470f9d696ee8383f2d2","keywords":["Suspicious","malware analysis","sandbox report","threat intelligence","6bc0208ed2339ca6746884c047ca57139f47a59878835470f9d696ee8383f2d2"],"about":{"@type":"SoftwareApplication","name":"3 PHISHING_CYCLE.html","applicationCategory":["html"],"identifier":"6bc0208ed2339ca6746884c047ca57139f47a59878835470f9d696ee8383f2d2","additionalType":"Suspicious sample"},"threatScore":38,"antivirusDetections":{"malicious":0,"total":27},"behavioralIndicators":{"malicious":1,"suspicious":5},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T42d5,Process "chrome.exe" (UID: 00000000-00004568) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "chrome.exe" (UID: 00000000-00004568) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "chrome.exe" (UID: 00000000-00007908) was launched with new environment variables: "CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\crashpad_1760_CLFJFNQUQXOICOQR"" Process "chrome.exe" (UID: 00000000-00003672) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, NVM_SYMLINK, PROCESSOR_LEVEL, SSLKEYLOGFILE, USERDOMAIN, LOGONSERVER, PROMPT, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, OneDrive, APPDATA, USERNAME, ProgramFiles(x86), CommonProgramFiles, CURL_CA_BUNDLE, PATHEXT, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, ProgramData, ProgramW6432, HOMEPATH, HOMEDRIVE, PROCESSOR_IDENTIFIER, USERPROFILE, CommonProgramFiles(x86), ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir" Process "chrome.exe" (UID: 00000000-00006632) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", NVM_SYMLINK="%PROGRAMFILES%\nodejs", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", USERDOMAIN="DESKTOP-FVVF82A", LOGONSERVER="%HOSTNAME%", PROMPT="$P$G", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="C:\Users\%OSUSER%\Documents\WindowsPowerShell\Modules;%PROGRAMFILES%\WindowsPowerShell\Modules;%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", USERNAME="%OSUSER%", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", CommonProgramFiles="%PROGRAMFILES%\Common Files", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL", OS="Windows_NT", COMPUTERNAME="DESKTOP-FVVF82A", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ComSpec="%WINDIR%\system32\cmd.exe", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", HOMEPATH="\Users\%OSUSER%", HOMEDRIVE="C:", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", USERPROFILE="C:\Users\%OSUSER%", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", NUMBER_OF_PROCESSORS="2", windir="C:\WINDOWS"" Process "chrome.exe" (UID: 00000000-00005072) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, NVM_SYMLINK, PROCESSOR_LEVEL, SSLKEYLOGFILE, USERDOMAIN, LOGONSERVER, PROMPT, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, OneDrive, APPDATA, USERNAME, ProgramFiles(x86), CommonProgramFiles, CURL_CA_BUNDLE, PATHEXT, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, ProgramData, ProgramW6432, HOMEPATH, HOMEDRIVE, PROCESSOR_IDENTIFIER, USERPROFILE, CommonProgramFiles(x86), ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir" Process "chrome.exe" (UID: 00000000-00007352) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", NVM_SYMLINK="%PROGRAMFILES%\nodejs", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", USERDOMAIN="DESKTOP-FVVF82A", LOGONSERVER="%HOSTNAME%", PROMPT="$P$G", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="C:\Users\%OSUSER%\Documents\WindowsPowerShell\Modules;%PROGRAMFILES%\WindowsPowerShell\Modules;%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", USERNAME="%OSUSER%", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", CommonProgramFiles="%PROGRAMFILES%\Common Files", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL", OS="Windows_NT", COMPUTERNAME="DESKTOP-FVVF82A", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ComSpec="%WINDIR%\system32\cmd.exe", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", HOMEPATH="\Users\%OSUSER%", HOMEDRIVE="C:", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", USERPROFILE="C:\Users\%OSUSER%", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", NUMBER_OF_PROCESSORS="2", windir="C:\WINDOWS"" Process "chrome.exe" (UID: 00000000-00001876) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, NVM_SYMLINK, PROCESSOR_LEVEL, SSLKEYLOGFILE, USERDOMAIN, LOGONSERVER, PROMPT, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, OneDrive, APPDATA, USERNAME, ProgramFiles(x86), CommonProgramFiles, CURL_CA_BUNDLE, PATHEXT, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, ProgramData, ProgramW6432, HOMEPATH, HOMEDRIVE, PROCESSOR_IDENTIFIER, USERPROFILE, CommonProgramFiles(x86), ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir" Process "chrome.exe" (UID: 00000000-00006872) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", NVM_SYMLINK="%PROGRAMFILES%\nodejs", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", USERDOMAIN="DESKTOP-FVVF82A", LOGONSERVER="%HOSTNAME%", PROMPT="$P$G", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="C:\Users\%OSUSER%\Documents\WindowsPowerShell\Modules;%PROGRAMFILES%\WindowsPowerShell\Modules;%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", USERNAME="%OSUSER%", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", CommonProgramFiles="%PROGRAMFILES%\Common Files", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL", OS="Windows_NT", COMPUTERNAME="DESKTOP-FVVF82A", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ComSpec="%WINDIR%\system32\cmd.exe", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", HOMEPATH="\Users\%OSUSER%", HOMEDRIVE="C:", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", USERPROFILE="C:\Users\%OSUSER%", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", NUMBER_OF_PROCESSORS="2", windir="C:\WINDOWS"" Process "chrome.exe" (UID: 00000000-00007856) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, NVM_SYMLINK, PROCESSOR_LEVEL, SSLKEYLOGFILE, USERDOMAIN, LOGONSERVER, PROMPT, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, OneDrive, APPDATA, USERNAME, ProgramFiles(x86), CommonProgramFiles, CURL_CA_BUNDLE, PATHEXT, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, ProgramData, ProgramW6432, HOMEPATH, HOMEDRIVE, PROCESSOR_IDENTIFIER, USERPROFILE, CommonProgramFiles(x86), ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir" Process "chrome.exe" (UID: 00000000-00004600) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", NVM_SYMLINK="%PROGRAMFILES%\nodejs", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", USERDOMAIN="DESKTOP-FVVF82A", LOGONSERVER="%HOSTNAME%", PROMPT="$P$G", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="C:\Users\%OSUSER%\Documents\WindowsPowerShell\Modules;%PROGRAMFILES%\WindowsPowerShell\Modules;%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", USERNAME="%OSUSER%", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", CommonProgramFiles="%PROGRAMFILES%\Common Files", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL", OS="Windows_NT", COMPUTERNAME="DESKTOP-FVVF82A", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ComSpec="%WINDIR%\system32\cmd.exe", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", HOMEPATH="\Users\%OSUSER%", HOMEDRIVE="C:", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", USERPROFILE="C:\Users\%OSUSER%", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", NUMBER_OF_PROCESSORS="2", windir="C:\WINDOWS"" Process "chrome.exe" (UID: 00000000-00002788) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, NVM_SYMLINK, PROCESSOR_LEVEL, SSLKEYLOGFILE, USERDOMAIN, LOGONSERVER, PROMPT, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, OneDrive, APPDATA, USERNAME, ProgramFiles(x86), CommonProgramFiles, CURL_CA_BUNDLE, PATHEXT, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, ProgramData, ProgramW6432, HOMEPATH, HOMEDRIVE, PROCESSOR_IDENTIFIER, USERPROFILE, CommonProgramFiles(x86), ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir" Process "chrome.exe" (UID: 00000000-00004332) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", NVM_SYMLINK="%PROGRAMFILES%\nodejs", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", USERDOMAIN="DESKTOP-FVVF82A", LOGONSERVER="%HOSTNAME%", PROMPT="$P$G", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="C:\Users\%OSUSER%\Documents\WindowsPowerShell\Modules;%PROGRAMFILES%\WindowsPowerShell\Modules;%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", USERNAME="%OSUSER%", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", CommonProgramFiles="%PROGRAMFILES%\Common Files", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL", OS="Windows_NT", COMPUTERNAME="DESKTOP-FVVF82A", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ComSpec="%WINDIR%\system32\cmd.exe", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", HOMEPATH="\Users\%OSUSER%", HOMEDRIVE="C:", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", USERPROFILE="C:\Users\%OSUSER%", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", NUMBER_OF_PROCESSORS="2", windir="C:\WINDOWS"" Process "chrome.exe" (UID: 00000000-00002028) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, NVM_SYMLINK, PROCESSOR_LEVEL, SSLKEYLOGFILE, USERDOMAIN, LOGONSERVER, PROMPT, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, OneDrive, APPDATA, USERNAME, ProgramFiles(x86), CommonProgramFiles, CURL_CA_BUNDLE, PATHEXT, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, ProgramData, ProgramW6432, HOMEPATH, HOMEDRIVE, PROCESSOR_IDENTIFIER, USERPROFILE, CommonProgramFiles(x86), ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir" Process "chrome.exe" (UID: 00000000-00003896) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", NVM_SYMLINK="%PROGRAMFILES%\nodejs", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", USERDOMAIN="DESKTOP-FVVF82A", LOGONSERVER="%HOSTNAME%", PROMPT="$P$G", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="C:\Users\%OSUSER%\Documents\WindowsPowerShell\Modules;%PROGRAMFILES%\WindowsPowerShell\Modules;%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", USERNAME="%OSUSER%", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", CommonProgramFiles="%PROGRAMFILES%\Common Files", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL", OS="Windows_NT", COMPUTERNAME="DESKTOP-FVVF82A", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ComSpec="%WINDIR%\system32\cmd.exe", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", HOMEPATH="\Users\%OSUSER%", HOMEDRIVE="C:", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", USERPROFILE="C:\Users\%OSUSER%", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", NUMBER_OF_PROCESSORS="2", windir="C:\WINDOWS"" Process "chrome.exe" (UID: 00000000-00006784) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, NVM_SYMLINK, PROCESSOR_LEVEL, SSLKEYLOGFILE, USERDOMAIN, LOGONSERVER, PROMPT, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, OneDrive, APPDATA, USERNAME, ProgramFiles(x86), CommonProgramFiles, CURL_CA_BUNDLE, PATHEXT, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, ProgramData, ProgramW6432, HOMEPATH, HOMEDRIVE, PROCESSOR_IDENTIFIER, USERPROFILE, CommonProgramFiles(x86), ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir" Process "chrome.exe" (UID: 00000000-00004784) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", NVM_SYMLINK="%PROGRAMFILES%\nodejs", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", USERDOMAIN="DESKTOP-FVVF82A", LOGONSERVER="%HOSTNAME%", PROMPT="$P$G", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="C:\Users\%OSUSER%\Documents\WindowsPowerShell\Modules;%PROGRAMFILES%\WindowsPowerShell\Modules;%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", USERNAME="%OSUSER%", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", CommonProgramFiles="%PROGRAMFILES%\Common Files", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL", OS="Windows_NT", COMPUTERNAME="DESKTOP-FVVF82A", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ComSpec="%WINDIR%\system32\cmd.exe", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", HOMEPATH="\Users\%OSUSER%", HOMEDRIVE="C:", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", USERPROFILE="C:\Users\%OSUSER%", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", NUMBER_OF_PROCESSORS="2", windir="C:\WINDOWS"" Process "chrome.exe" (UID: 00000000-00005668) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, NVM_SYMLINK, PROCESSOR_LEVEL, SSLKEYLOGFILE, USERDOMAIN, LOGONSERVER, PROMPT, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, OneDrive, APPDATA, USERNAME, ProgramFiles(x86), CommonProgramFiles, CURL_CA_BUNDLE, PATHEXT, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, ProgramData, ProgramW6432, HOMEPATH, HOMEDRIVE, PROCESSOR_IDENTIFIER, USERPROFILE, CommonProgramFiles(x86), ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir" Process "chrome.exe" (UID: 00000000-00004648) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", NVM_SYMLINK="%PROGRAMFILES%\nodejs", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", USERDOMAIN="DESKTOP-FVVF82A", LOGONSERVER="%HOSTNAME%", PROMPT="$P$G", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="C:\Users\%OSUSER%\Documents\WindowsPowerShell\Modules;%PROGRAMFILES%\WindowsPowerShell\Modules;%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", USERNAME="%OSUSER%", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", CommonProgramFiles="%PROGRAMFILES%\Common Files", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL", OS="Windows_NT", COMPUTERNAME="DESKTOP-FVVF82A", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ComSpec="%WINDIR%\system32\cmd.exe", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", HOMEPATH="\Users\%OSUSER%", HOMEDRIVE="C:", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", USERPROFILE="C:\Users\%OSUSER%", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", NUMBER_OF_PROCESSORS="2", windir="C:\WINDOWS""23:Tdf5,Spawned process "chrome.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Google\ ..." (UID: 00000000-00004568), Spawned process "chrome.exe" with commandline "--type=gpu-process --no-pre-read-main-dll --gpu-preferences=SAAA ..." (UID: 00000000-00007908), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00004304), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00003672), Spawned process "chrome.exe" with commandline "--type=renderer --no-pre-read-main-dll --video-capture-use-gpu-m ..." (UID: 00000000-00003832), Spawned process "chrome.exe" with commandline "--type=renderer --no-pre-read-main-dll --video-capture-use-gpu-m ..." (UID: 00000000-00004916), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics ..." (UID: 00000000-00006632), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=quarantine.mojom.Quarantine -- ..." (UID: 00000000-00004664), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=quarantine.mojom.Quarantine -- ..." (UID: 00000000-00002208), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00005072), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=quarantine.mojom.Quarantine -- ..." (UID: 00000000-00007352), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00001876), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=quarantine.mojom.Quarantine -- ..." (UID: 00000000-00006872), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=quarantine.mojom.Quarantine -- ..." (UID: 00000000-00002456), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=quarantine.mojom.Quarantine -- ..." (UID: 00000000-00006836), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00007856), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00002600), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=quarantine.mojom.Quarantine -- ..." (UID: 00000000-00004600), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00002788), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=quarantine.mojom.Quarantine -- ..." (UID: 00000000-00004332), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00002028), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00001364), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=quarantine.mojom.Quarantine -- ..." (UID: 00000000-00003896), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=quarantine.mojom.Quarantine -- ..." (UID: 00000000-00006344), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=quarantine.mojom.Quarantine -- ..." (UID: 00000000-00007024)24:Tdf5,Spawned process "chrome.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Google\ ..." (UID: 00000000-00004568), Spawned process "chrome.exe" with commandline "--type=gpu-process --no-pre-read-main-dll --gpu-preferences=SAAA ..." (UID: 00000000-00007908), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00004304), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00003672), Spawned process "chrome.exe" with commandline "--type=renderer --no-pre-read-main-dll --video-capture-use-gpu-m ..." (UID: 00000000-00003832), Spawned process "chrome.exe" with commandline "--type=renderer --no-pre-read-main-dll --video-capture-use-gpu-m ..." (UID: 00000000-00004916), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics ..." (UID: 00000000-00006632), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=quarantine.mojom.Quarantine -- ..." (UID: 00000000-00004664), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=quarantine.mojom.Quarantine -- ..." (UID: 00000000-00002208), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00005072), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=quarantine.mojom.Quarantine -- ..." (UID: 00000000-00007352), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00001876), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=quarantine.mojom.Quarantine -- ..." (UID: 00000000-00006872), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=quarantine.mojom.Quarantine -- ..." (UID: 00000000-00002456), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=quarantine.mojom.Quarantine -- ..." (UID: 00000000-00006836), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00007856), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00002600), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=quarantine.mojom.Quarantine -- ..." (UID: 00000000-00004600), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00002788), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=quarantine.mojom.Quarantine -- ..." (UID: 00000000-00004332), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00002028), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00001364), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=quarantine.mojom.Quarantine -- ..." (UID: 00000000-00003896), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=quarantine.mojom.Quarantine -- ..." (UID: 00000000-00006344), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=quarantine.mojom.Quarantine -- ..." (UID: 00000000-00007024)25:T5ac,The input sample is signed with a certificate issued by "CN=WE2, O=Google Trust Services, C=US" (SHA1: A4:EE:F3:BC:0C:0B:0D:8C:E9:89:12:99:8F:58:8F:3D:72:DD:A5:6E; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 4D:9A:CB:31:3D:73:DA:2E:9E:B4:51:A7:CF:63:09:AF:45:C9:93:C1; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information) The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: 56:F0:CA:31:F8:63:67:50:5F:27:3F:AE:B9:B6:AE:1E:26:77:21:4A; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R1, O=Google Trust Services LLC, C=US" (SHA1: 66:E4:16:12:60:B1:00:FE:E0:DE:28:7A:9A:52:93:B4:C2:22:4A:E6; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 08:74:54:87:E8:91:C1:9E:30:78:C1:F2:A0:7E:45:29:50:EF:36:F6; see report for more information) The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: 09:88:B4:58:98:CB:16:E7:42:DB:9C:A2:35:B9:AF:71:86:4E:CE:DC; see report for more information)26:T595,Found http requests in header "GET /time/1/current?cup2key=9:DlcfRV0I3GeSSAdztrqqiuP7BoObondO2dyqrKPDRA8&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" Found http requests in header "GET /chrome-variations/seed?osname=win&channel=stable&milestone=144" Found http requests in header "GET /v1/ohttp/hpkekeyconfig?key=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE" Found http requests in header "POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard&laf=b64bin" Found http requests in header "POST /c2dm/register3" Found http requests in header "POST /v1:GetModels?key=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE" Found http requests in header "GET /downloads?name=1767628897&target=OPTIMIZATION_TARGET_NOTIFICATION_PERMISSION_PREDICTIONS" Found http requests in header "GET /v4/threatListUpdates:fetch?$req=Ch4KDGdvb2dsZWNocm9tZRIOMTQ0LjAuNzU1OS4xMzMaDAgFEAEiBCABIAIoARoMCBAQASIEIAEgAigBGgwIARABIgQgASACKAEaDAgDEAEiBCABIAIoARoMCA4QASIEIAEgAigBGgwIBxABIgQgASACKAEaDAgBEAgiBCABIAIoBBoMCA8QASIEIAEgAigBGgwICRABIgQgASACKAEaDAgIEAEiBCABIAIoARoMCA0QASIEIAEgAigBIgIIAQ==&$ct=application/x-protobuf&key=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE" Found http requests in header "GET /tools/pso/ping?as=chrome&brand=HKFL&pid=&hl=en&events=C1I,C2I,C7I,C1S,C7S&rep=2&rlz=C1:,C2:,C7:&id=1375117AE076051ADA4CA9791DB5927747462E05FA49926AD2" Found http requests in header "POST /v2/items/-/storeMetadata:batchGet"27:T71d,Heuristic match: "blackbones.net" Heuristic match: "darknet.se" Heuristic match: "darkforums.su" Heuristic match: "forum.cc" Pattern match: "https://patched.to" Pattern match: "https://u.to/video_bastyon/gx2yig" Pattern match: "https://rutorforum.at" Pattern match: "https://clients2.google.com/cr/report" Pattern match: "https://exploit.in" Heuristic match: "temp.sh" Pattern match: "https://cardvilla.cc" Pattern match: "https://dublikat.club" Heuristic match: "bdfclub.com" Pattern match: "https://darkmoney.ag" Pattern match: "https://lolz.live" Heuristic match: "fixedfloat.com" Heuristic match: "transfer.sh" Heuristic match: "blackhatworld.com" Pattern match: "https://u.to/greymatrix_html/xr2yig" Pattern match: "https://mazafaka.cc" Heuristic match: "upload to temp.sh / transfer.sh" Pattern match: "https://altens.is/" Pattern match: "https://exploit.in/" Pattern match: "https://darkmoney.ag/" Pattern match: "https://mazafaka.cc/" Pattern match: "https://cardvilla.cc/" Pattern match: "https://patched.to/" Pattern match: "https://dublikat.club/" Pattern match: "https://lolz.live/" Pattern match: "https://rutorforum.at/" Pattern match: "https://d2web.club/" Heuristic match: "clients2.google.com" Heuristic match: "clientservices.googleapis.com" Heuristic match: "safebrowsingohttpgateway.googleapis.com" Heuristic match: "accounts.google.com" Heuristic match: "android.clients.google.com" Heuristic match: "optimizationguide-pa.googleapis.com" Pattern match: "2hatype.googleapis.com/google.privacy.webpermissionpredictions.v1.webpermissionpredictionsclientinfo" Heuristic match: "safebrowsing.googleapis.com" Heuristic match: "clients1.google.com" Heuristic match: "chromewebstore.googleapis.com" Heuristic match: "mtalk.google.com" Pattern match: "www.google.com"28:T1710,"GET /chrome-variations/seed?osname=win&channel=stable&milestone=144 HTTP/2 Host: clientservices.googleapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors If-None-Match: SMChYyMDI2MDEzMS0wMzAwMTIuNDk5MDAwEgkIABADGJABIAAaEAoIMTc2OTk0MzYSBAgCEAE=#FG5ZMGD4i5w= Sec-Fetch-Site: none A-Im: x-bm,gzip Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/x-gzip Date: Wed 10 Jun 2026 08:00:43 GMT X-Country: us Content-Security-Policy: sandbox allow-downloads allow-forms allow-modals allow-orientation-lock allow-pointer-lock allow-popups allow-popups-to-escape-sandbox allow-presentation allow-scripts allow-storage-access-by-user-activation allow-top-navigation allow-top-navigation-by-user-activation allow-top-navigation-to-custom-protocols Im: gzip X-Content-Type-Options: nosniff X-Xss-Protection: 0 X-Seed-Signature: MEYCIQCkTTijKV6Kd+X6I5LB2g6nv/6yy9MD0qDTcGHbqtwS6wIhAL5CpuVGrTa11KvNJfwILUQykejKhfcKRS68+eR0YfmW X-Frame-Options: SAMEORIGIN Cross-Origin-Opener-Policy: same-origin X-Geo-Level-1: us-il Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT....... "GET /v1/ohttp/hpkekeyconfig?key=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/2 Host: safebrowsingohttpgateway.googleapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none X-Ohttppublickey-Fst: true Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/ohttp-keys Date: Wed 10 Jun 2026 07:21:53 GMT Server: ESF X-Xss-Protection: 0 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Cache-Control: public max-age=3600 Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 Age: 2330 with no response body "GET /downloads?name=1767628897&target=OPTIMIZATION_TARGET_NOTIFICATION_PERMISSION_PREDICTIONS HTTP/2 Host: optimizationguide-pa.googleapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: navigate Sec-Fetch-Site: none X-Goog-Api-Key: AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE Accept-Language: en-US,en;q=0.9 Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: text/html; charset=UTF-8 X-Guploader-Uploadid: AJ5rDhHEzfkMTcSyK86h5aUO4CrDwyh9H5jGvfBnHNaQ04vxawK4Q1mqHHdqEIVB61_lAcGX Date: Wed 10 Jun 2026 08:00:53 GMT Server: UploadServer Expires: Thu 11 Jun 2026 08:00:53 GMT Vary: X-Goog-Api-Key Accept-Ranges: bytes Cache-Control: public max-age=86400 Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 X-Goog-Hash: crc32c=CzYSiQ== with response body ==>BINARY_CONTENT....... "GET /v4/threatListUpdates:fetch?$req=Ch4KDGdvb2dsZWNocm9tZRIOMTQ0LjAuNzU1OS4xMzMaDAgFEAEiBCABIAIoARoMCBAQASIEIAEgAigBGgwIARABIgQgASACKAEaDAgDEAEiBCABIAIoARoMCA4QASIEIAEgAigBGgwIBxABIgQgASACKAEaDAgBEAgiBCABIAIoBBoMCA8QASIEIAEgAigBGgwICRABIgQgASACKAEaDAgIEAEiBCABIAIoARoMCA0QASIEIAEgAigBIgIIAQ==&$ct=application/x-protobuf&key=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/2 Host: safebrowsing.googleapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none X-Http-Method-Override: POST Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/x-protobuf Date: Wed 10 Jun 2026 08:01:51 GMT Server: scaffolding on HTTPServer2 Content-Disposition: attachment X-Xss-Protection: 0 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT....... "GET /tools/pso/ping?as=chrome&brand=HKFL&pid=&hl=en&events=C1I,C2I,C7I,C1S,C7S&rep=2&rlz=C1:,C2:,C7:&id=1375117AE076051ADA4CA9791DB5927747462E05FA49926AD2 HTTP/2 Host: clients1.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: text/plain; charset=utf-8 Date: Wed 10 Jun 2026 08:02:11 GMT Server: GSE Expires: Wed 10 Jun 2026 08:02:11 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-Y6B3ifklo7rab5fD3U8Idw' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/download-dt/1 X-Content-Type-Options: nosniff X-Xss-Protection: 1; mode=block Content-Encoding: gzip X-Frame-Options: SAMEORIGIN Cache-Control: private max-age=0 Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT....... "POST /v2/items/-/storeMetadata:batchGet HTTP/2 Host: chromewebstore.googleapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Content-Type: application/x-protobuf Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none X-Goog-Api-Key: AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE Accept-Language: en-US,en;q=0.9 X-Http-Method-Override: GET Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/x-protobuf Date: Wed 10 Jun 2026 08:02:43 GMT Server: ESF Content-Disposition: attachment X-Xss-Protection: 0 X-Content-Type-Options: nosniff Vary: Referer Content-Encoding: gzip X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT.......29:T1dfd,"POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard&laf=b64bin HTTP/2 Host: accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 Cookie: NID=528=QhXUdaTzjFrMXE02QLVt1k2WiA2ynA_Ouitn5zVri5chg-ukoTgYHQqPwZlXVkdBvNMB26_e5gW-W6OVoS55ZRjtV0CyjY4CIiVzvFX2jlGZQ50u3H4wQZnvLRINRlqJzGWs5mxNAW9YngPdKM-e4oqI5XZZmCqH7FiypPa4aKfkIazg9A5hLQfxLf0kwtWx7tWlSSitigNSTN50bRnL1UQpfMkcsvKaFjs Origin: https://www.google.com Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" with payload::==> "504F5354202F4C6973744163636F756E74733F67707369613D3126736F757263653D4368726F6D69756D42726F77736572266A736F6E3D7374616E64617264266C61663D62363462696E20485454502F320A486F73743A206163636F756E74732E676F6F676C652E636F6D0A557365722D4167656E743A204D6F7A696C6C612F352E30202857696E646F7773204E542031302E303B2057696E36343B2078363429204170706C655765624B69742F3533372E333620284B48544D4C2C206C696B65204765636B6F29204368726F6D652F3134342E302E302E30205361666172692F3533372E33360A436F6E74656E742D547970653A206170706C69636174696F6E2F782D7777772D666F726D2D75726C656E636F6465640A5365632D46657463682D4D6F64653A206E6F2D636F72730A5365632D46657463682D536974653A206E6F6E650A4163636570742D4C616E67756167653A20656E2D55532C656E3B713D302E390A436F6F6B69653A204E49443D3532383D516858556461547A6A46724D58453032514C5674316B3257694132796E415F4F7569746E357A567269356368672D756B6F54675948517150775A6C58566B6442764E4D4232365F653567572D57364F566F5335355A526A74563043796A5934434969567A764658326A6C475A5135307533483477515A6E764C52494E526C714A7A475773356D784E415739596E6750644B4D2D65346F714935585A5A6D4371483746697970506134614B666B49617A67394135684C5166784C66306B777457783774576C5353697469674E53544E353062526E4C31555170664D6B6373764B61466A730A4F726967696E3A2068747470733A2F2F7777772E676F6F676C652E636F6D0A5072696F726974793A20753D342C20690A4163636570742D456E636F64696E673A20677A69702C206465666C6174652C2062722C207A7374640A5365632D46657463682D446573743A20656D7074790A" HTTP/2 200 OK Content-Type: application/binary Date: Wed 10 Jun 2026 08:00:43 GMT Server: ESF Expires: Mon 01 Jan 1990 00:00:00 GMT Vary: Origin Permissions-Policy: ch-ua-arch=* ch-ua-bitness=* ch-ua-full-version=* ch-ua-full-version-list=* ch-ua-model=* ch-ua-wow64=* ch-ua-form-factors=* ch-ua-platform=* ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin P3p: CP="This is not a P3P policy! See g.co/p3phelp for more info." Pragma: no-cache Strict-Transport-Security: max-age=31536000; includeSubDomains Accept-Ch: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Model Sec-CH-UA-WoW64 Sec-CH-UA-Form-Factors Sec-CH-UA-Platform Sec-CH-UA-Platform-Version Access-Control-Allow-Origin: https://www.google.com Set-Cookie: NID=532=ZtM7NqTEUuCa6d3rlbt4sj-r6lJbQO4HmtfDoyqKq55UHPi8Q9nUl6Zlhzt9L0yFGUzSdiVRAc3xv3Sw_IsSuLCQnulIMZ8OWczi9Tgmy0ru8MgX1L2bru-5PQ3852piAwxROlAXmRtRIwWE2hGyGmLxkpOLB34W3lwo4-l6uC3SrgYM8IL3VqH4NBk-dMr2XXwsUo9DqUIw7WZ6NxhvIta-_WiPmYg9_ZaDpQ; expires=Thu 10-Dec-2026 08:00:43 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Reporting-Endpoints: default="/_/IdentityListAccountsHttp/web-reports?context=eJzjUtHikmLw0pBiOHxtB5Meyy0mIyDW1PNl0wVi84n-bNZALMTDsXrzkotsAhd-dM5gVNJNyi-Mz0xJzSvJLKnMySwuSUxOzi_NKykuTi0qSy2KNzIwMjMwNTbUMzCOLzAAAL7SH5o" Access-Control-Allow-Credentials: true Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport X-Xss-Protection: 0 X-Content-Type-Options: nosniff Cache-Control: no-cache no-store max-age=0 must-revalidate Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with no response body "POST /c2dm/register3 HTTP/2 Host: android.clients.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded Authorization: AidLogin 5128682385002746151:4090087931532893237 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" with payload::==> "app=com.chrome.windows&X-subtype=com.google.chrome.fcm.invalidations-585406161706&device=5128682385002746151&scope=GCM&X-scope=GCM&gmsv=144&appid=eXQQyYA3CJ0&sender=585406161706&ttl=1209600" HTTP/2 200 OK Content-Type: text/plain; charset=UTF-8 Date: Wed 10 Jun 2026 08:00:46 GMT Server: GSE Expires: Wed 10 Jun 2026 08:00:46 GMT Content-Security-Policy: frame-ancestors 'self' X-Content-Type-Options: nosniff X-Xss-Protection: 1; mode=block Content-Encoding: gzip X-Frame-Options: SAMEORIGIN Cache-Control: private max-age=0 Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT....... "POST /v1:GetModels?key=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/2 Host: optimizationguide-pa.googleapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Content-Type: application/x-protobuf Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none X-Client-Data: CN7cygE= Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" with payload::==> "n 2h atype.googleapis.com/google.privacy.webpermissionpredictions.v1.WebPermissionPredictionsClientInfo e 2_ Wtype.googleapis.com/google.internal.chrome.optimizationguide.v1.PageTopicsModelMetadata0 g 2a Ytype.googleapis.com/google.internal.chrome.optimizationguide.v1.SegmentationModelMetadataJ n 2h atype.googleapis.com/google.privacy.webpermissionpredictions.v1.WebPermissionPredictionsClientInfo g 2a Ytype.googleapis.com/google.internal.chrome.optimizationguide.v1.SegmentationModelMetadataJ g 2a Ytype.googleapis.com/google.internal.chrome.optimizationguide.v1.SegmentationModelMetadataJ l 2f `type.googleapis.com/google.internal.chrome.optimizationguide.v1.AutocompleteScoringModelMetadata g 2a Ytype.googleapis.com/google.internal.chrome.optimizationguide.v1.SegmentationModelMetadataJ + g- 2a Ytype.googleapis.com/google.internal.chrome.optimizationguide.v1.SegmentationModelMetadataJ g. 2a Ytype.googleapis.com/google.internal.chrome.optimizationguide.v1.SegmentationModelMetadataJ*en-US2" HTTP/2 200 OK Content-Type: application/x-protobuf Date: Wed 10 Jun 2026 08:00:51 GMT Server: ESF Content-Disposition: attachment X-Xss-Protection: 0 X-Content-Type-Options: nosniff Vary: Referer Content-Encoding: gzip X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT....... "POST /v2/items/-/storeMetadata:batchGet HTTP/2 Host: chromewebstore.googleapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Content-Type: application/x-protobuf Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none X-Goog-Api-Key: AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE Accept-Language: en-US,en;q=0.9 X-Http-Method-Override: GET Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" with payload::==> "items/-4items/nmmhkkegccagdldgiimedpiccmgmieda/storeMetadata" HTTP/2 200 OK Content-Type: application/x-protobuf Date: Wed 10 Jun 2026 08:02:43 GMT Server: ESF Content-Disposition: attachment X-Xss-Protection: 0 X-Content-Type-Options: nosniff Vary: Referer Content-Encoding: gzip X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT.......2a:Tb24,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAIIElEQVR4XqXWe1ST9xkH8FRFIOSCiqv7a+f0HKcTQUEBL1ULWgaSIOGiYCkg1I5qtykMEFEHRqzcwXml2nU9Vbc6dVNBqxiSkJBASAiQG0TAG9ZLr+t0a/fHd8/7vqAshFNmf+c8J5yc5P1+nuf3e9/A401wBSoeYYHyMwSq7lHdQqC6HwFqJwI1DgRqLVioM1OZsKhNh2CqpcYbcL3GC63g5i/BVJDqcyxQDVHdZQHz1Tep+hDQYkeAxoLA1i4CGAmgR1iHCss7r2Nl1xWsMl98Mcii5qcIUf4Ti5TfIFj1BQFoAmz3txGgGsR8FQOww19tw3xNNwK0XVig60CQ3oAlRgKYr2FV9yWstp5HVN8prB04MXFIqOIJQpqfcOFK6l75CAtVDwhwn+uewv3ZcA7g39JNiE4CGNjxh3SoscR0gwVE2s8gynEKsf3HsOHe/h9GhDT/mzp/gsXKb1nAIuVXbPcLKZyZANs9jX4eE8yWlf5mAF00BSMW6tsRYmAm8Okw4DRib9Zj3cBxpBBgwz35+IhQxXcIVX5HAGb8zAS+pgl8ToCHLCBAze29v9rBds8Ez1P34BfqLsxrYQAmOgsGOgdqOgNXEd5zHpG2jwlwHEm3q7BxqBRp93dh08OcsYiw5u8RSt2HKpkJPKUJ/IPqGwpm9v4+vQ5R9wygl0Itz4Jda77GSIg2OojXscJ8CRGWs4jpO474wWqk3JUj42Eh3nrkBsB0Hqr8nsL/NQz4FkGKrzD34h3MvTRA1Y85l/sI4GTH7xo8Uv4aE50FPd2GVwnwd0T0MIB6xA+UI/lOKTI+yyHAu9jyZeZzBNu9kimu+9lnbsGv5BpEORcgLmiAb+FVTCtspLqM6fkX8PJ7jXjlr8Yx4RyAuRWVCGlXYJmpAastpxDtqEfSoBzJt4uQPrQNWQ/ewZbHqc8BoQQII4D/376AuPAaBPnXICxSQrRHC7FcB9/SNkwr1WN6aStmyNWYUaLAjN1X8LK8EbMbzC5bYMCCVg3CDJexwvQJIro+xFp7HaS95dhwawfS7r2LzPub8auHqdj6OAG8MDp4Ycr/YPapIXjnfAqfnS0QFLdDuM8M0YEeiMut8K20YhrV9Cor/Kq64Vdhgt8BHfzkCvgVXcIr57hp+LeY6KGkJYAWi3WNWGY8j3DzScTYayBzFmP9QD5SBn+LTUOb8faDVGQ/SgJvadNTzD37GF65CngX6cEv6YSg1AphmQOi8l6Iq/rgW+3EtFonplPNqKOqdWBmjRUzKzows1QNv10N+Hmjnp6KGizQKBCkvYKwtrN4teMjhHceRYy1FHGOnUhybsObt7KQcTcdWUPJePu+DLzgi19DsLsdnkUGeJd0g19qh897vRCUOSGscEJUeRPi6pvwreknRD+m1/UTohc/PWjDT+rsmFlpJIQGs8qa4K9kAE0EaMAS/cd41XASrxkPQ2KVQ+YoJMB2bBzYjPTb6ci8k8gB5vz5EabuNMJzTze85DZ4l/aCv5/qQN//Iqo4hLioFT/bdmHMbTRznwqzL9xAsOYcQrRnENb6J6ww1COioxwx3QWQWgqQ4NiKN/rTkXZrIwt4614ceH41ffAo6sLUYhs85Q547XOwCO9hhE8ZQco5hChPCX5U2ZjwkTXnw6sIVp8mwGks1b2PFfpKhBvKEW3Oh7QnFzLbFiQ7UpB6MxEZgzJk3ZaC51vpxJTdVnjssWFqiQOeezmElyuiQAt+dBn40tpxAcF/YQAfIbTlMJZpq7CyrRyvt+cj0pALiTkbcT2ZSLSm4g1nAt50SpA1GAne5CILJhNgyh47PIrthLCzCM/RiH02Cq6GT2wdfNYdGRcQpKjHIvVJAhwiQAVWtu5FhC6XAFsgMaVD1pOG9bYkmoIMqb2/RLozArxJOwmwy0YI21gEsyUMYksj+BICyI5S1Y8LCFbUYrHqMJa2HKDaj9e0OVitz0FkezbWtqchtjMVMnMikm0SJFujkGJZBd5LO62YVGR1i5g6jPCOP0KdH4Ig4X0IEk+6BQRer0WwooaepuX0XJFjecturNJsR4T2HUTq0jhAhwwykxQJ5mgCRHLXeWmHBeMhPJhJFBrhLamizo+x4YKkk/CKH/vPRdD1cgJUIUSxF0uVu7FcuR2rWrYiQpOJ11vTEN22AVJDHGSdEiR0Ro/6fgEBCq3PEJNcJ5GnZw+eT3w9hX9A9UeahPspLG4qRuiN32OJIo8AOQTIJsAmrNGkIFoXh7X6OEjbpS7f3dED3g7rWMQuBkG3ZnYD+LEHufEz4UwlfgCfcbaCWcubtmJZ86+xsjkTEaqNWKNejzUtceN+/hmCNxpRxCE8cnXgr/vDGACzHUJ6z/VSL7YKGICFKxfElDwDTYBuv3EAQtlxCNcdmzBEFF0J3/AKN593g+Ag9AyIO0Rn4PjzMzAaQGeDRcQdgyjuCETrDo+5uEhSA1FMNURrq+DLFCFcP0MAM8ZDTM26CB+6uCDxBIdwB5AxgKME4BCi2EMQSw9S1UEsqYU4poaqmgCVEES5AzCLARQMA0ZvR74J/Hh6CCXUc7fijwCIo92Nf/Qq6B6LoPLIvkZTOMwdxgQG8f8DmG1wjXO/2EmMmsYwwjPjHLcVzDMh4QQB6icIYLqvmmD4yBo5Ey4IdhIUIKBAYTwTzIUL6XfCHUAkqYNAMt6eT2SNTIPdEg4xKc8Er4zzENDvg5AmIqRQ5pULpqL3RVIGUPcjgl1X3vNtGXlqTi7shsfv2ujX8jr4v2mGb04zZuU2YdamTyYc/F/sGllehxXV9QAAAABJRU5ErkJggg==18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"schema_version":"1.0.15","sha256":"6bc0208ed2339ca6746884c047ca57139f47a59878835470f9d696ee8383f2d2","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"suspicious","threat_score":38,"unified_at_epoch_ms":1790300712846,"unified_at":"2026-09-25T01:45:12.846Z","metadata":{"hashes":{"sha256":"6bc0208ed2339ca6746884c047ca57139f47a59878835470f9d696ee8383f2d2","sha1":"ea3280ac6d077e2858571d1bec501957f47f33c1","md5":"2bf5f9a62da7d86d259845d652e6c750","sha512":"9162d6285be5e67d87e14b46f6ed7ef39ff02b4dfea02bf44bcc61fa07d1d48ec298ec1db9c600cc178d2332291e511db97c0bd1de26a1d576fb563873667641","ssdeep":"384:KX1qiznCdOqXGta++oR/DZVofSNXQJu+8utMu2ImNcAz2IH:KX1qiz0Oq1++oxZKfUgsnutjGKIH","ssdeep_chunks":["384:KX1qizn","384:X1qiznC","384:1qiznCd","384:qiznCdO","384:iznCdOq","384:znCdOqX","384:nCdOqXG","384:CdOqXGt","384:dOqXGta","384:OqXGta+","384:qXGta++","384:XGta++o","384:Gta++oR","384:ta++oR/","384:a++oR/D","384:++oR/DZ","384:+oR/DZV","384:oR/DZVo","384:R/DZVof","384:/DZVofS","384:DZVofSN","384:ZVofSNX","384:VofSNXQ","384:ofSNXQJ","384:fSNXQJu","384:SNXQJu+","384:NXQJu+8","384:XQJu+8u","384:QJu+8ut","384:Ju+8utM","384:u+8utMu","384:+8utMu2","384:8utMu2I","384:utMu2Im","384:tMu2ImN","384:Mu2ImNc","384:u2ImNcA","384:2ImNcAz","384:ImNcAz2","384:mNcAz2I","384:NcAz2IH","768:KX1qizn","768:X1qiznC","768:1qiznCd","768:qiznCdO","768:iznCdOq","768:znCdOqX","768:nCdOqXG","768:CdOqXGt","768:dOqXGta","768:OqXGta+","768:qXGta++","768:XGta++o","768:Gta++oR","768:ta++oR/","768:a++oR/D","768:++oR/DZ","768:+oR/DZV","768:oR/DZVo","768:R/DZVof","768:/DZVofS","768:DZVofSN","768:ZVofSNX","768:VofSNXQ","768:ofSNXQJ","768:fSNXQJu","768:SNXQJu+","768:NXQJu+8","768:XQJu+8u","768:QJu+8ut","768:Ju+8utM","768:u+8utMu","768:+8utMu2","768:8utMu2I","768:utMu2Im","768:tMu2ImN","768:Mu2ImNc","768:u2ImNcA","768:2ImNcAz","768:ImNcAz2","768:mNcAz2I","768:NcAz2IH","384:KX1qiz0","384:X1qiz0O","384:1qiz0Oq","384:qiz0Oq1","384:iz0Oq1+","384:z0Oq1++","384:0Oq1++o","384:Oq1++ox","384:q1++oxZ","384:1++oxZK","384:++oxZKf","384:+oxZKfU","384:oxZKfUg","384:xZKfUgs","384:ZKfUgsn","384:KfUgsnu","384:fUgsnut","384:Ugsnutj","384:gsnutjG","384:snutjGK","384:nutjGKI","384:utjGKIH"],"imphash":"Unknown"},"file_info":{"file_name":"3 PHISHING_CYCLE.html","file_type":["html"],"file_type_id":"html","file_size":17662,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1781078420000,"last_seen":1783193492000,"last_multi_scan":1783193492000}},"detections":{"summary":{"verdict":"suspicious","score":38,"tags":["proximity","extracted_domain","phishing"]},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":18},"sandbox_signatures":{"informative_count":20,"suspicious_count":5,"malicious_count":1,"total":26},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrikefalconml":{"name":"CrowdStrike Falcon ML","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"6a291994e30badd196074423"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_type":"sandbox","report_id":"6a291994e30badd196074423"}]},{"tactic":"Initial Access","technique":"Spearphishing Link","attack_id":"T1566.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1566/002","identifiers":[{"type":"suspicious","value":"External resources linked to high-risk domains"}],"sources":[{"report_type":"sandbox","report_id":"6a291994e30badd196074423"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"malicious","value":"Detected malicious domain extracted during analysis"}],"sources":[{"report_type":"sandbox","report_id":"6a291994e30badd196074423"}]},{"tactic":"Defense Evasion","technique":"Web Session Cookie","attack_id":"T1550.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1550/004","identifiers":[{"type":"informative","value":"Able to access web session cookie"}],"sources":[{"report_type":"sandbox","report_id":"6a291994e30badd196074423"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6a291994e30badd196074423"}]},{"tactic":"Defense Evasion","technique":"HTML Smuggling","attack_id":"T1027.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/006","identifiers":[{"type":"suspicious","value":"High entropy HTML file"}],"sources":[{"report_type":"sandbox","report_id":"6a291994e30badd196074423"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6a291994e30badd196074423"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes"}],"sources":[{"report_type":"sandbox","report_id":"6a291994e30badd196074423"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"}],"sources":[{"report_type":"sandbox","report_id":"6a291994e30badd196074423"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"6a291994e30badd196074423"}]},{"tactic":"Command and Control","technique":"Standard Encoding","attack_id":"T1132.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/001","identifiers":[{"type":"informative","value":"HTTP request contains Base64 encoded artifacts"}],"sources":[{"report_type":"sandbox","report_id":"6a291994e30badd196074423"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Identifies external resources in HTML content"},{"type":"suspicious","value":"GETs files from a web server"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"}],"sources":[{"report_type":"sandbox","report_id":"6a291994e30badd196074423"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6a291994e30badd196074423"}]},{"tactic":"Command and Control","technique":"Non-Standard Encoding","attack_id":"T1132.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/002","identifiers":[{"type":"suspicious","value":"POST request with content encoding in response"}],"sources":[{"report_type":"sandbox","report_id":"6a291994e30badd196074423"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6a291994e30badd196074423"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Unencrypted Non-C2 Protocol","attack_id":"T1048.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1048/003","identifiers":[{"type":"informative","value":"Data transmitted in plain text over an insecure network protocol/port"}],"sources":[{"report_type":"sandbox","report_id":"6a291994e30badd196074423"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"POSTs data to a web server"}],"sources":[{"report_type":"sandbox","report_id":"6a291994e30badd196074423"}]}],"sandbox_signatures":[{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: HTTP request contains Base64 encoded artifacts","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a291994e30badd196074423"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"Found string \"https://lolz.live\" (Indicator: \"lolz.live\"; File: \"3 PHISHING_CYCLE.html\")\n file/memory contains long string with (Indicator: \"lolz.live\"; File: \"3 PHISHING_CYCLE.html\")\n Found string \"Residential IP lists

lolz.live\" (Indicator: \"lolz.live\"; File: \"3 PHISHING_CYCLE.html\")\n Found string \"PerimeterX (Human)Real mouse recordingcardvilla.cc, lolz.live3\" (Indicator: \"lolz.live\"; File: \"3 PHISHING_CYCLE.html\")\n Found string \"

lolz.live Vishing scripts, voice clones

\" (Indicator: \"lolz.live\"; File: \"3 PHISHING_CYCLE.html\")","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"6a291994e30badd196074423"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/27 Antivirus vendors marked sample as clean (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"6a291994e30badd196074423"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"clients2.google.com\"\n \"clientservices.googleapis.com\"\n \"safebrowsingohttpgateway.googleapis.com\"\n \"accounts.google.com\"\n \"android.clients.google.com\"\n \"optimizationguide-pa.googleapis.com\"\n \"safebrowsing.googleapis.com\"\n \"clients1.google.com\"\n \"chromewebstore.googleapis.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6a291994e30badd196074423"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"142.251.157.119:443\"\n \"142.251.219.14:443\"\n \"142.251.218.206:80\"\n \"192.178.220.84:443\"\n \"216.239.34.223:443\"\n \"142.250.141.188:5228\"\n \"142.251.218.78:443\"\n \"216.239.32.223:443\"\n \"142.251.219.138:443\"\n \"142.251.218.110:443\"\n \"142.251.218.206:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6a291994e30badd196074423"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$22","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6a291994e30badd196074423"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"accounts.google.com\"\n \"android.clients.google.com\"\n \"chromewebstore.googleapis.com\"\n \"clients1.google.com\"\n \"clients2.google.com\"\n \"clientservices.googleapis.com\"\n \"mtalk.google.com\"\n \"optimizationguide-pa.googleapis.com\"\n \"safebrowsing.googleapis.com\"\n \"safebrowsingohttpgateway.googleapis.com\"\n \"www.google.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6a291994e30badd196074423"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$23","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6a291994e30badd196074423"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$24","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6a291994e30badd196074423"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$25","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6a291994e30badd196074423"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"$26","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6a291994e30badd196074423"}]},{"level":"informative","category":"Network Related","name":"Data transmitted in plain text over an insecure network protocol/port","description":"HTTP traffic to 142.251.218.206 on port 80","origin":"Network Traffic","mitre_attack_id":"T1048.003","relevance":1,"id":"network-97","sources":[{"report_type":"sandbox","report_id":"6a291994e30badd196074423"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$27","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6a291994e30badd196074423"}]},{"level":"informative","category":"Network Related","name":"HTTP request contains Base64 encoded artifacts","description":"\"9\\}t#qI +n;gr<\"\n \"{vs6x