Windows Analysis Report
https://solve-page.github.io/remove

Overview

General Information

Sample URL:	https://solve-page.github.io/remove
Analysis ID:	1446162
Infos:

Detection

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Phishing site detected (based on favicon image match)

Stores files to the Windows start menu directory

Classification

Signatures

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://solve-page.github.io/remove	Avira URL Cloud: detection malicious, Label: phishing
Source: https://solve-page.github.io/remove	SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social Engineering

Antivirus detection for URL or domain

Source: https://solve-page.github.io/remove/index-user.css

Avira URL Cloud: Label: phishing

Phishing

Phishing site detected (based on favicon image match)

Source: https://solve-page.github.io/remove/

Matcher: Template: facebook matched with high similarity

Source: https://detailed-video-29b30.web.app/detailed%20video.mp4

HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 23.211.8.90:443 -> 192.168.2.5:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.211.8.90:443 -> 192.168.2.5:49726 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /remove HTTP/1.1Host: solve-page.github.ioConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /remove/ HTTP/1.1Host: solve-page.github.ioConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /remove/index-user.css HTTP/1.1Host: solve-page.github.ioConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://solve-page.github.io/remove/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /remove/AAABAAMAEBAAAAEAIABoBAAANgAAACAgAAABACAAKBEAAJ4EAAAwMAAAAQAgAGgmAADGFQAAKAAAABAAAAAgAAAAAQAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/wAAAZdXOiyYVzpPmFc6T5dXOiz/AAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAQEAEmFo5b5hYO+GYWTv/mFk7/5hZO/+YWTv/mFg74ZhaOW+AQEAEAAAAAAAAAAAAAAAAAAAAAAAAAACWWjwRmFg7wphZO/+YWTv/oWhN/7uRff+ufWb/mFk7/5hZO/+YWTv/mFg7wpZaPBEAAAAAAAAAAAAAAACAQEAEmFg7wphZO/+YWTv/mFk7/7SGcP//////2sS5/5hZO/+YWTv/mFk7/5hZO/+YWDvCgEBABAAAAAAAAAAAmFo5b5hZO/+YWTv/mFk7/5hZO/+0hnD//////9rEuf+YWTv/mFk7/5hZO/+YWTv/mFk7/5haOW8AAAAA/wAAAZhYO+GYWTv/mFk7/5hZO/+YWTv/tIZw///////axLn/mFk7/5hZO/+YWTv/mFk7/5hZO/+YWDvh/wAAAZdXOiyYWTv/mFk7/5hZO/+YWTv/mFk7/7SGcP//////2sS5/5hZO/+YWTv/mFk7/5hZO/+YWTv/mFk7/5dXOiyYVzpPmFk7/5hZO/+YWTv/mFk7/6x6Yv/Nr6D//////+fY0f+6kX3/qnZd/5hZO/+YWTv/mFk7/5hZO/+YVzpPmFc6T5hZO/+YWTv/mFk7/5hZO//VvLD//////////////////////9G1qP+YWTv/mFk7/5hZO/+YWTv/mFc6T5dXOiyYWTv/mFk7/5hZO/+YWTv/tYhz/9fAtP//////7ODb/8iomP+1iHL/mFk7/5hZO/+YWTv/mFk7/5dXOiz/AAABmFg74ZhZO/+YWTv/mFk7/5hZO/+0hnD//////9rEuv+YWTv/mFk7/5hZO/+YWTv/mFk7/5hYO+H/AAABAAAAAJhaOW+YWTv/mFk7/5hZO/+YWTv/rnxk///////x6eX/xKGQ/7CAav+YWTv/mFk7/5hZO/+YWjlvAAAAAAAAAACAQEAEmFg7wphZO/+YWTv/mFk7/5haPP/i0Mj////////////TuKz/mFk7/5hZO/+YWDvCgEBABAAAAAAAAAAAAAAAAJZaPBGYWDvCmFk7/5hZO/+YWTv/mVo8/7CAaf+6kHz/qnZd/5hZO/+YWDvCllo8EQAAAAAAAAAAAAAAAAAAAAAAAAAAgEBABJhaOW+YWDvhmFk7/5hZO/+YWTv/mFk7/5hYO+GYWjlvgEBABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/wAAAZdXOiyYVzpPmFc6T5dXOiz/AAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKAAAACAAAABAAAAAAQAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACZZjMFm1g7PZdZOnOYWTqVl1k6p5dZOqeYWTqVl1k6c5tYOz2ZZjMFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACZWTkol1k7mJhZO++YWTv/mFk7/5hZO/+YWTv/mFk7/5hZO/+YWTv/mFk7/5hZO++XWTuYmVk5KAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACPYEAQmFg6mZhZO/yYWTv/mFk7/5hZO/+YWTv/mFk7/5hZO/+YWTv/mFk7/5hZO/+YWTv/mFk7/5hZO/+YWTv8mFg6mY9gQBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmFg7NJhYO+GYWTv/mFk7/5hZO/+YWTv/mFk7/5hZO/+YWTv/mFk7/5hZO/+YWTv/mFk7/5hZO/+YWTv/mFk7/5hZO/+YWTv/mFg74ZhYOzQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJhZO0WZWTv0mFk7/5hZO/+YWTv/mFk7/5hZO/+YWTv/vpeE/97KwP/eysD/3srA/6x6Yv+YWTv/mFk7/5hZO/+YWTv/mFk7/5hZO/+YWTv/mVk79JhZO0UAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACVVzo1mVk79JhZO/+YWTv/mFk7/5hZO/+YWTv/mFk7/5hZO//Qs6b/////////////////tol0/5hZO/+YWTv/mFk7/5hZO/+YWTv/mFk7/5hZO/+YWTv/mVk79JVXOjUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAn2BAEJhYO+GYWTv/mFk7/5hZO/+YWTv/mFk7/5hZO/+YWTv/mFk7/9Czpv////////////////+2iXT/mFk7/5hZO/+YWTv/mFk7/5hZO/+YWTv/mFk7/5hZO/+YWTv/mFg74Z9gQBAAAAAAAAAA
Source: global traffic	HTTP traffic detected: GET /wikipedia/commons/6/6c/Facebook_Logo_2023.png HTTP/1.1Host: upload.wikimedia.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://solve-page.github.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /wikipedia/commons/6/6c/Facebook_Logo_2023.png HTTP/1.1Host: upload.wikimedia.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /detailed%20video.mp4 HTTP/1.1Host: detailed-video-29b30.web.appConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /detailed%20video.mp4 HTTP/1.1Host: detailed-video-29b30.web.appConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept-Encoding: identity;q=1, ;q=0sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: videoReferer: https://detailed-video-29b30.web.app/detailed%20video.mp4Accept-Language: en-US,en;q=0.9Range: bytes=0-

Source: global traffic	DNS traffic detected: DNS query: solve-page.github.io
Source: global traffic	DNS traffic detected: DNS query: cdn.glitch.global
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: upload.wikimedia.org
Source: global traffic	DNS traffic detected: DNS query: detailed-video-29b30.web.app

Source: chromecache_77.2.dr	String found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
Source: chromecache_79.2.dr	String found in binary or memory: https://bugs.chromium.org/p/chromium/issues/detail?id=935729
Source: chromecache_79.2.dr	String found in binary or memory: https://bugs.chromium.org/p/chromium/issues/detail?id=999088
Source: chromecache_79.2.dr	String found in binary or memory: https://bugs.webkit.org/show_bug.cgi?id=195016)
Source: chromecache_79.2.dr	String found in binary or memory: https://bugs.webkit.org/show_bug.cgi?id=201297)
Source: chromecache_79.2.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=190655)
Source: chromecache_84.2.dr	String found in binary or memory: https://cdn.glitch.global/38680663-fd6c-4cfc-921a-6d69fd66649d/images-removebg-preview.png?v=1704368
Source: chromecache_84.2.dr	String found in binary or memory: https://cdn.glitch.global/cbf8be26-0413-4201-9418-b298e829656a/download%20(1).jfif?v=1698098011376
Source: chromecache_84.2.dr	String found in binary or memory: https://detailed-video-29b30.web.app/detailed%20video.mp4
Source: chromecache_79.2.dr	String found in binary or memory: https://github.com/jensimmons/cssremedy/issues/14#issuecomment-634934210)
Source: chromecache_79.2.dr	String found in binary or memory: https://github.com/mozdevs/cssremedy/issues/14)
Source: chromecache_79.2.dr	String found in binary or memory: https://github.com/mozdevs/cssremedy/issues/4)
Source: chromecache_79.2.dr	String found in binary or memory: https://github.com/mozilla/gecko-dev/blob/2f9eacd9d3d995c937b4251a5557d95d494c9be1/layout/style/res/
Source: chromecache_79.2.dr	String found in binary or memory: https://github.com/tailwindcss/tailwindcss/pull/116)
Source: chromecache_79.2.dr	String found in binary or memory: https://github.com/tailwindlabs/tailwindcss/issues/3300)
Source: chromecache_84.2.dr	String found in binary or memory: https://submit-form.com/q3iZxmmCh
Source: chromecache_79.2.dr	String found in binary or memory: https://tailwindcss.com
Source: chromecache_84.2.dr	String found in binary or memory: https://upload.wikimedia.org/wikipedia/commons/6/6c/Facebook_Logo_2023.png

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 23.211.8.90:443 -> 192.168.2.5:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.211.8.90:443 -> 192.168.2.5:49726 version: TLS 1.2

Source: classification engine

Classification label: mal64.phis.win@19/39@14/7

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2472 --field-trial-handle=2388,i,1911422598299977246,9961358223997480364,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://solve-page.github.io/remove"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4216 --field-trial-handle=2388,i,1911422598299977246,9961358223997480364,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2472 --field-trial-handle=2388,i,1911422598299977246,9961358223997480364,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4216 --field-trial-handle=2388,i,1911422598299977246,9961358223997480364,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.185.132	www.google.com	United States	15169	GOOGLEUS	false
185.199.109.153	solve-page.github.io	Netherlands	54113	FASTLYUS	false
199.36.158.100	detailed-video-29b30.web.app	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.15.59.240	upload.wikimedia.org	Netherlands	14907	WIKIMEDIAUS	false

Private

IP
192.168.2.4
192.168.2.5

Contacted Domains

Name	IP	Active
www.google.com	142.250.185.132	true
solve-page.github.io	185.199.109.153	true
upload.wikimedia.org	185.15.59.240	true
detailed-video-29b30.web.app	199.36.158.100	true
fp2e7a.wpc.phicdn.net	192.229.221.95	true
windowsupdatebg.s.llnwi.net	87.248.202.1	true
cdn.glitch.global	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://detailed-video-29b30.web.app/detailed%20video.mp4	false		unknown
https://upload.wikimedia.org/wikipedia/commons/6/6c/Facebook_Logo_2023.png	false	Avira URL Cloud: safe	unknown
https://solve-page.github.io/remove/index-user.css	false	Avira URL Cloud: phishing	unknown
https://solve-page.github.io/remove/	true		unknown
https://solve-page.github.io/remove	true		unknown

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed May 22 21:15:01 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	42A9556BE534E4436EE7F56AF6E5D0FE	42021A130AB70D4BD2CD82BBF40D2C33EA385CE9	CFC5469164B4248F4283D28DA42EBCB025CC8F91F8493443FD5C67AB32B71872
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed May 22 21:15:01 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	E0255F7B4C8535BD58035DA37D49087B	EC81E76B397EEE242648201538A092F03FC182FA	14BAC6D7AA9FA53192104E16B28FCCCF1BAAC2A714F73B63C7A9BBD84A97B556
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	CD87889216A320064D2F6667F41F1FF9	CE7ABBDA138CAC198AAFA13D2AC583EA998EB85B	D1BFBA792E912D8AACE166D53FCF456D5B1943D2304DDF7439D549A2FC463600
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed May 22 21:15:01 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	72D04A78C352A70DC793EF540DF8CD07	482929CA729EEA80C7F848CD888F3F616FBA9A27	6E7788124ED7758A2F9C55880CE8966C602B092BCE67D004D52F5333F401B53A
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed May 22 21:15:01 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	17D1BAB5228DA889AA96407975C64C96	5D786A417A82D3007A89CC131685322532279615	AE8E64F2552D4C0314113FACB54E8C30ABA1462AE49E39B9B4A184A2D1FD9855
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed May 22 21:15:01 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	88A217C38F6D4A7D5798E5F25E75CB00	07677622AB54882203A30C1DFCEB57F585E14B2B	299F3627ED8BABAE3147097343D870DE556FA2371A8D2D91E6945F3E1CF18B8B
Chrome Cache Entry: 72	PNG image data, 2084 x 2084, 8-bit/color RGBA, non-interlaced	E4DA23704F27C9DF07E6C21A13E28BFD	AF6F06778B34A6B7844168F257FFF50611BC7DD9	2ADFD474D91FD20C51084309ED000C1AE6CC7F5F70AF14D375930F5A71301308
Chrome Cache Entry: 73	PNG image data, 2084 x 2084, 8-bit/color RGBA, non-interlaced	E4DA23704F27C9DF07E6C21A13E28BFD	AF6F06778B34A6B7844168F257FFF50611BC7DD9	2ADFD474D91FD20C51084309ED000C1AE6CC7F5F70AF14D375930F5A71301308
Chrome Cache Entry: 74	data	B1C79A8E6ABEA922D4A06146FBE1FAC5	B77BDA0D25D6FE43F6605459C7FE213E44EA3AF5	7AC7A0C37BCE6ACB4A34AE3D998E50EB2001B9C76A836756115CC08D5A51A361
Chrome Cache Entry: 75	data	73246004079A58489FAE5EAF2B135370	C2DFB987F7BD899B2015FDCBC5BC997BF2658996	6BFB6651D02208ED2C8B100234AD6DECCD340DBA766F7691871A00999608DB11
Chrome Cache Entry: 76	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 466x275, components 3	50AB27EE56B456F752C3AB47D593B6ED	121479561AA5F11F6E88915A20F4C3C97A2AE035	A6AACA4023DAAA66AEB85FA91A18A688FF46621ACB7BB5CED681BEA5BD13C75F
Chrome Cache Entry: 77	ISO Media, MP4 v2 [ISO 14496-14]	DD3247B63BD73BEF167A104CF6B93F90	207290BC761ABC79EFD11EAD3743BFF2DD167296	DA64764314B16BD5D578F4BE773E7FFF23381537300CDAEF2A5059F6C6A78E69
Chrome Cache Entry: 78	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 466x275, components 3	50AB27EE56B456F752C3AB47D593B6ED	121479561AA5F11F6E88915A20F4C3C97A2AE035	A6AACA4023DAAA66AEB85FA91A18A688FF46621ACB7BB5CED681BEA5BD13C75F
Chrome Cache Entry: 79	ASCII text	7616967CBB9D6FB41CC888E53048EC3F	EA21BDA6ABCE5AD82D2BB03EBF00943105D1567F	51A5BFE2C0863B87AB76777C871FADCD1DD32A0B1485560725814887EB13F325
Chrome Cache Entry: 80	data	F0044FFDB2DBB3C4ADED0262C8462EC1	B8E6F197CA5C7DFE982579AC0C7E3191D5393517	E450B34620FF2C0F529B7FBB3749AD0240806EEF9688E8074DFFFAEDDE1717CC
Chrome Cache Entry: 81	ASCII text, with no line terminators	C007DDDC907F9C73114F6D2583526E3A	929C162E5D29BB5C80EAAFF10D841B7F92FBB7A2	2B7814C2FFD118D77F9DF62DFDBF9816B88278BD6FAD30AE4F68730BC616BB74
Chrome Cache Entry: 82	PNG image data, 225 x 224, 8-bit/color RGBA, non-interlaced	4E51E07483C97F85A2F8EFA893633AC7	F63C4174F2E4C85C6A7AD0EE5F10316EDE74F802	780218A74810758B68FB25F47896CCC39A8E5FB97A7E1003BC14EB24EAB108C9
Chrome Cache Entry: 83	data	DC51B15FE5907CFCA8AB02DB1D7BFC68	922052E3AA790BF3D995EA034DB510F395C1EBCC	F274CEB8DCEC3984BF15B97F7D2A00A655CB6B55C43F9435D61D8DEA3531E716
Chrome Cache Entry: 84	HTML document, ASCII text, with very long lines (35922)	AB2A644665CEC326388C63C3ECAC19BB	AAADDCF37C3FEE068751FAD42AFEBE75B9610B95	F573DE895CFC2D92746B9253DE19F8222388DC9F44373FFB4264656B9B16C96B
Chrome Cache Entry: 85	PNG image data, 225 x 224, 8-bit/color RGBA, non-interlaced	4E51E07483C97F85A2F8EFA893633AC7	F63C4174F2E4C85C6A7AD0EE5F10316EDE74F802	780218A74810758B68FB25F47896CCC39A8E5FB97A7E1003BC14EB24EAB108C9
Chrome Cache Entry: 86	data	4BAA0ADE1B489EB24A83E1585862F9F0	CDEDAEA4EB3B5BED2F411E1EEC3D8D7B8ACEADAB	F6E405A4F20D7819D423AC0F6CA965ADE98642B984A4ABAF6759AD11B0538CEF
Chrome Cache Entry: 87	ASCII text, with no line terminators	E06C387C193DE08A9E889BAE6C33CAA0	204F9792EAA0B809FECA59F462ED47EE32543830	3C61E05D4FD5150E07EB08721BF4CC97FCAD7D6FA5E8CC057DD90D5D72CAD160
Chrome Cache Entry: 88	data	33A366DBE497A29AA27D4AFD7F761768	5ABED6A3175232E38D12ABF2E0837714B6589678	BA598BA4C859D13F6C2430CEBFE4A76B7D7DCADFAA1A5C4CD3CC63D3A5A850D0
Chrome Cache Entry: 89	data	F522F816E11F5F32037C23DF00A2FAAB	5D6C4B05E25969A463F2A2A2DC1BDC392325D274	2C0CC4BD0BCBC9EA8390D951ACAD53C253B8B88D28ABF5DED7C9F43620A9F5AD

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://solve-page.github.io/remove	Avira URL Cloud: detection malicious, Label: phishing
Source: https://solve-page.github.io/remove	SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social Engineering

Antivirus detection for URL or domain

Source: https://solve-page.github.io/remove/index-user.css

Avira URL Cloud: Label: phishing

Phishing

Phishing site detected (based on favicon image match)

Source: https://solve-page.github.io/remove/

Matcher: Template: facebook matched with high similarity

Source: https://detailed-video-29b30.web.app/detailed%20video.mp4

HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 23.211.8.90:443 -> 192.168.2.5:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.211.8.90:443 -> 192.168.2.5:49726 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /remove HTTP/1.1Host: solve-page.github.ioConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /remove/ HTTP/1.1Host: solve-page.github.ioConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /remove/index-user.css HTTP/1.1Host: solve-page.github.ioConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://solve-page.github.io/remove/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /remove/AAABAAMAEBAAAAEAIABoBAAANgAAACAgAAABACAAKBEAAJ4EAAAwMAAAAQAgAGgmAADGFQAAKAAAABAAAAAgAAAAAQAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/wAAAZdXOiyYVzpPmFc6T5dXOiz/AAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAQEAEmFo5b5hYO+GYWTv/mFk7/5hZO/+YWTv/mFg74ZhaOW+AQEAEAAAAAAAAAAAAAAAAAAAAAAAAAACWWjwRmFg7wphZO/+YWTv/oWhN/7uRff+ufWb/mFk7/5hZO/+YWTv/mFg7wpZaPBEAAAAAAAAAAAAAAACAQEAEmFg7wphZO/+YWTv/mFk7/7SGcP//////2sS5/5hZO/+YWTv/mFk7/5hZO/+YWDvCgEBABAAAAAAAAAAAmFo5b5hZO/+YWTv/mFk7/5hZO/+0hnD//////9rEuf+YWTv/mFk7/5hZO/+YWTv/mFk7/5haOW8AAAAA/wAAAZhYO+GYWTv/mFk7/5hZO/+YWTv/tIZw///////axLn/mFk7/5hZO/+YWTv/mFk7/5hZO/+YWDvh/wAAAZdXOiyYWTv/mFk7/5hZO/+YWTv/mFk7/7SGcP//////2sS5/5hZO/+YWTv/mFk7/5hZO/+YWTv/mFk7/5dXOiyYVzpPmFk7/5hZO/+YWTv/mFk7/6x6Yv/Nr6D//////+fY0f+6kX3/qnZd/5hZO/+YWTv/mFk7/5hZO/+YVzpPmFc6T5hZO/+YWTv/mFk7/5hZO//VvLD//////////////////////9G1qP+YWTv/mFk7/5hZO/+YWTv/mFc6T5dXOiyYWTv/mFk7/5hZO/+YWTv/tYhz/9fAtP//////7ODb/8iomP+1iHL/mFk7/5hZO/+YWTv/mFk7/5dXOiz/AAABmFg74ZhZO/+YWTv/mFk7/5hZO/+0hnD//////9rEuv+YWTv/mFk7/5hZO/+YWTv/mFk7/5hYO+H/AAABAAAAAJhaOW+YWTv/mFk7/5hZO/+YWTv/rnxk///////x6eX/xKGQ/7CAav+YWTv/mFk7/5hZO/+YWjlvAAAAAAAAAACAQEAEmFg7wphZO/+YWTv/mFk7/5haPP/i0Mj////////////TuKz/mFk7/5hZO/+YWDvCgEBABAAAAAAAAAAAAAAAAJZaPBGYWDvCmFk7/5hZO/+YWTv/mVo8/7CAaf+6kHz/qnZd/5hZO/+YWDvCllo8EQAAAAAAAAAAAAAAAAAAAAAAAAAAgEBABJhaOW+YWDvhmFk7/5hZO/+YWTv/mFk7/5hYO+GYWjlvgEBABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/wAAAZdXOiyYVzpPmFc6T5dXOiz/AAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKAAAACAAAABAAAAAAQAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACZZjMFm1g7PZdZOnOYWTqVl1k6p5dZOqeYWTqVl1k6c5tYOz2ZZjMFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACZWTkol1k7mJhZO++YWTv/mFk7/5hZO/+YWTv/mFk7/5hZO/+YWTv/mFk7/5hZO++XWTuYmVk5KAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACPYEAQmFg6mZhZO/yYWTv/mFk7/5hZO/+YWTv/mFk7/5hZO/+YWTv/mFk7/5hZO/+YWTv/mFk7/5hZO/+YWTv8mFg6mY9gQBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmFg7NJhYO+GYWTv/mFk7/5hZO/+YWTv/mFk7/5hZO/+YWTv/mFk7/5hZO/+YWTv/mFk7/5hZO/+YWTv/mFk7/5hZO/+YWTv/mFg74ZhYOzQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJhZO0WZWTv0mFk7/5hZO/+YWTv/mFk7/5hZO/+YWTv/vpeE/97KwP/eysD/3srA/6x6Yv+YWTv/mFk7/5hZO/+YWTv/mFk7/5hZO/+YWTv/mVk79JhZO0UAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACVVzo1mVk79JhZO/+YWTv/mFk7/5hZO/+YWTv/mFk7/5hZO//Qs6b/////////////////tol0/5hZO/+YWTv/mFk7/5hZO/+YWTv/mFk7/5hZO/+YWTv/mVk79JVXOjUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAn2BAEJhYO+GYWTv/mFk7/5hZO/+YWTv/mFk7/5hZO/+YWTv/mFk7/9Czpv////////////////+2iXT/mFk7/5hZO/+YWTv/mFk7/5hZO/+YWTv/mFk7/5hZO/+YWTv/mFg74Z9gQBAAAAAAAAAA
Source: global traffic	HTTP traffic detected: GET /wikipedia/commons/6/6c/Facebook_Logo_2023.png HTTP/1.1Host: upload.wikimedia.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://solve-page.github.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /wikipedia/commons/6/6c/Facebook_Logo_2023.png HTTP/1.1Host: upload.wikimedia.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /detailed%20video.mp4 HTTP/1.1Host: detailed-video-29b30.web.appConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /detailed%20video.mp4 HTTP/1.1Host: detailed-video-29b30.web.appConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept-Encoding: identity;q=1, ;q=0sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: videoReferer: https://detailed-video-29b30.web.app/detailed%20video.mp4Accept-Language: en-US,en;q=0.9Range: bytes=0-

Source: global traffic	DNS traffic detected: DNS query: solve-page.github.io
Source: global traffic	DNS traffic detected: DNS query: cdn.glitch.global
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: upload.wikimedia.org
Source: global traffic	DNS traffic detected: DNS query: detailed-video-29b30.web.app

Source: chromecache_77.2.dr	String found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
Source: chromecache_79.2.dr	String found in binary or memory: https://bugs.chromium.org/p/chromium/issues/detail?id=935729
Source: chromecache_79.2.dr	String found in binary or memory: https://bugs.chromium.org/p/chromium/issues/detail?id=999088
Source: chromecache_79.2.dr	String found in binary or memory: https://bugs.webkit.org/show_bug.cgi?id=195016)
Source: chromecache_79.2.dr	String found in binary or memory: https://bugs.webkit.org/show_bug.cgi?id=201297)
Source: chromecache_79.2.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=190655)
Source: chromecache_84.2.dr	String found in binary or memory: https://cdn.glitch.global/38680663-fd6c-4cfc-921a-6d69fd66649d/images-removebg-preview.png?v=1704368
Source: chromecache_84.2.dr	String found in binary or memory: https://cdn.glitch.global/cbf8be26-0413-4201-9418-b298e829656a/download%20(1).jfif?v=1698098011376
Source: chromecache_84.2.dr	String found in binary or memory: https://detailed-video-29b30.web.app/detailed%20video.mp4
Source: chromecache_79.2.dr	String found in binary or memory: https://github.com/jensimmons/cssremedy/issues/14#issuecomment-634934210)
Source: chromecache_79.2.dr	String found in binary or memory: https://github.com/mozdevs/cssremedy/issues/14)
Source: chromecache_79.2.dr	String found in binary or memory: https://github.com/mozdevs/cssremedy/issues/4)
Source: chromecache_79.2.dr	String found in binary or memory: https://github.com/mozilla/gecko-dev/blob/2f9eacd9d3d995c937b4251a5557d95d494c9be1/layout/style/res/
Source: chromecache_79.2.dr	String found in binary or memory: https://github.com/tailwindcss/tailwindcss/pull/116)
Source: chromecache_79.2.dr	String found in binary or memory: https://github.com/tailwindlabs/tailwindcss/issues/3300)
Source: chromecache_84.2.dr	String found in binary or memory: https://submit-form.com/q3iZxmmCh
Source: chromecache_79.2.dr	String found in binary or memory: https://tailwindcss.com
Source: chromecache_84.2.dr	String found in binary or memory: https://upload.wikimedia.org/wikipedia/commons/6/6c/Facebook_Logo_2023.png

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 23.211.8.90:443 -> 192.168.2.5:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.211.8.90:443 -> 192.168.2.5:49726 version: TLS 1.2

Source: classification engine

Classification label: mal64.phis.win@19/39@14/7

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2472 --field-trial-handle=2388,i,1911422598299977246,9961358223997480364,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://solve-page.github.io/remove"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4216 --field-trial-handle=2388,i,1911422598299977246,9961358223997480364,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2472 --field-trial-handle=2388,i,1911422598299977246,9961358223997480364,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4216 --field-trial-handle=2388,i,1911422598299977246,9961358223997480364,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

ID:	1446162
Product:	CloudBasic
Start time:	00:14:15
Start date:	23.05.2024
Cookbook:	browseurl.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Windows Analysis Report
https://solve-page.github.io/remove

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report https://solve-page.github.io/remove

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
https://solve-page.github.io/remove