Windows Analysis Report
https://docs.google.com/forms/d/e/1FAIpQLScaqr8AS5UHJLhHgsk75Su6KzT5rrqw0atzmeeQYQGFlm3rfA/viewform?usp=sf_link

Overview

General Information

Sample URL:	https://docs.google.com/forms/d/e/1FAIpQLScaqr8AS5UHJLhHgsk75Su6KzT5rrqw0atzmeeQYQGFlm3rfA/viewform?usp=sf_link
Analysis ID:	1426959
Infos:

Detection

HTMLPhisher

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Yara detected HtmlPhish20

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Classification

Signatures

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://docs.google.com/forms/d/e/1FAIpQLScaqr8AS5UHJLhHgsk75Su6KzT5rrqw0atzmeeQYQGFlm3rfA/viewform?usp=sf_link

SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social Engineering

Phishing

Yara detected HtmlPhish20

Source: Yara match	File source: 1.1.pages.csv, type: HTML
Source: Yara match	File source: 1.2.pages.csv, type: HTML
Source: Yara match	File source: 0.0.pages.csv, type: HTML

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49807 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 23.220.189.216:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.220.189.216:443 -> 192.168.2.5:49738 version: TLS 1.2

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49807 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /forms/d/e/1FAIpQLScaqr8AS5UHJLhHgsk75Su6KzT5rrqw0atzmeeQYQGFlm3rfA/viewform?usp=sf_link HTTP/1.1Host: docs.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /qT4DCK2LKzecwlfH_KeT8lBWadfqlPRvtivdMZMXcGG_CRS6ybKJf354o1nOBIOo9cGaLyG9Hl0fQk80G8iXQQ-KdATcPkutqm7QbF2qJLD5-IB7cID4YmTX8GmGDBYxkQ=w580 HTTP/1.1Host: lh5.googleusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://docs.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /qT4DCK2LKzecwlfH_KeT8lBWadfqlPRvtivdMZMXcGG_CRS6ybKJf354o1nOBIOo9cGaLyG9Hl0fQk80G8iXQQ-KdATcPkutqm7QbF2qJLD5-IB7cID4YmTX8GmGDBYxkQ=w580 HTTP/1.1Host: lh5.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=513=bhlSL5-tCs06dGzJ_ubECKPpZvhsaGvxY9K5TSeThR1zaE1ZCyetXXezefgSMi0sqqrEJcnnkZpK1HDU1YxzU07b1TkbsCf_GUQjzBpxsRKgzwErAXuQXlzqT84qb-4iLutL3Vv8akDb4mml8rljezpKkm81gc8rFQIscuShyYs
Source: global traffic	HTTP traffic detected: GET /forms/d/e/1FAIpQLScaqr8AS5UHJLhHgsk75Su6KzT5rrqw0atzmeeQYQGFlm3rfA/font/getmetadata HTTP/1.1Host: docs.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: S=spreadsheet_forms=Mv8NASN1Y4oBjURy6aTsMSDQrxWUaLWk5kAkIsNLD9Q; COMPASS=spreadsheet_forms=CjIACWuJVwpxX915tM7kAkmnxOi1Coy775IBzhFmYRrOqRol50CNjUVIrP7o8kNiMzgxDxD8lfuwBhpDAAlriVcWvXgNjAWVt8A9d_iozQ2rLasZkIxkcnEx2ZCA7SrYnVj7yawjZKuoRkeApne0qFmqziYMb1fshkuQk57k5g==; NID=513=bhlSL5-tCs06dGzJ_ubECKPpZvhsaGvxY9K5TSeThR1zaE1ZCyetXXezefgSMi0sqqrEJcnnkZpK1HDU1YxzU07b1TkbsCf_GUQjzBpxsRKgzwErAXuQXlzqT84qb-4iLutL3Vv8akDb4mml8rljezpKkm81gc8rFQIscuShyYs
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=513=bhlSL5-tCs06dGzJ_ubECKPpZvhsaGvxY9K5TSeThR1zaE1ZCyetXXezefgSMi0sqqrEJcnnkZpK1HDU1YxzU07b1TkbsCf_GUQjzBpxsRKgzwErAXuQXlzqT84qb-4iLutL3Vv8akDb4mml8rljezpKkm81gc8rFQIscuShyYs
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=513=bhlSL5-tCs06dGzJ_ubECKPpZvhsaGvxY9K5TSeThR1zaE1ZCyetXXezefgSMi0sqqrEJcnnkZpK1HDU1YxzU07b1TkbsCf_GUQjzBpxsRKgzwErAXuQXlzqT84qb-4iLutL3Vv8akDb4mml8rljezpKkm81gc8rFQIscuShyYs

Source: chromecache_169.2.dr

String found in binary or memory: gf=u(["https://sandbox.google.com/tools/feedback/"]),hf=u(["https://www.google.cn/tools/feedback/"]),jf=u(["https://help.youtube.com/tools/feedback/"]),kf=u(["https://asx-frontend-staging.corp.google.com/inapp/"]),lf=u(["https://asx-frontend-staging.corp.google.com/tools/feedback/"]),mf=u(["https://localhost.corp.google.com/inapp/"]),nf=u(["https://localhost.proxy.googlers.com/inapp/"]),of=S(Qe),pf=[S(Re),S(Se)],qf=[S(Te),S(Ue),S(Ve),S(We),S(Xe),S(Ye),S(Ze),S($e),S(af),S(bf)],rf=[S(cf),S(df)],sf= equals www.youtube.com (Youtube)

Source: unknown

DNS traffic detected: queries for: docs.google.com

Source: unknown

HTTP traffic detected: POST /forms/d/e/1FAIpQLScaqr8AS5UHJLhHgsk75Su6KzT5rrqw0atzmeeQYQGFlm3rfA/naLogImpressions HTTP/1.1Host: docs.google.comConnection: keep-aliveContent-Length: 3312sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-Same-Domain: 1Content-Type: application/x-www-form-urlencoded;charset=UTF-8sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://docs.google.comX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://docs.google.com/forms/d/e/1FAIpQLScaqr8AS5UHJLhHgsk75Su6KzT5rrqw0atzmeeQYQGFlm3rfA/viewform?usp=sf_linkAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: S=spreadsheet_forms=Mv8NASN1Y4oBjURy6aTsMSDQrxWUaLWk5kAkIsNLD9Q; COMPASS=spreadsheet_forms=CjIACWuJVwpxX915tM7kAkmnxOi1Coy775IBzhFmYRrOqRol50CNjUVIrP7o8kNiMzgxDxD8lfuwBhpDAAlriVcWvXgNjAWVt8A9d_iozQ2rLasZkIxkcnEx2ZCA7SrYnVj7yawjZKuoRkeApne0qFmqziYMb1fshkuQk57k5g==; NID=513=n_Mar_v_mKLhZYjVpoEhaWDS384RMtjiOvZVYL_ygeA9AU9i-hWHxhSNPfXDoerUqVWll0RRr_onOZWi7V8HlSX3ayrortYC1xshPfLwuWcT27qk5-mbCovyJ3S1tzFTN7-V2A4m3H1Evu6lUlCqlVkKKIAiUsllObgltL0k6nk

Source: chromecache_169.2.dr	String found in binary or memory: http://localhost.corp.google.com/inapp/
Source: chromecache_169.2.dr	String found in binary or memory: http://localhost.proxy.googlers.com/inapp/
Source: chromecache_169.2.dr	String found in binary or memory: https://apis.google.com/js/client.js
Source: chromecache_169.2.dr	String found in binary or memory: https://asx-frontend-autopush.corp.google.co.uk/inapp/
Source: chromecache_169.2.dr	String found in binary or memory: https://asx-frontend-autopush.corp.google.co.uk/tools/feedback/
Source: chromecache_169.2.dr	String found in binary or memory: https://asx-frontend-autopush.corp.google.com/inapp/
Source: chromecache_169.2.dr	String found in binary or memory: https://asx-frontend-autopush.corp.google.com/tools/feedback/
Source: chromecache_169.2.dr	String found in binary or memory: https://asx-frontend-autopush.corp.google.de/inapp/
Source: chromecache_169.2.dr	String found in binary or memory: https://asx-frontend-autopush.corp.google.de/tools/feedback/
Source: chromecache_169.2.dr	String found in binary or memory: https://asx-frontend-autopush.corp.youtube.com/inapp/
Source: chromecache_169.2.dr	String found in binary or memory: https://asx-frontend-autopush.corp.youtube.com/tools/feedback/
Source: chromecache_169.2.dr	String found in binary or memory: https://asx-frontend-staging.corp.google.com/inapp/
Source: chromecache_169.2.dr	String found in binary or memory: https://asx-frontend-staging.corp.google.com/tools/feedback/
Source: chromecache_169.2.dr	String found in binary or memory: https://asx-help-frontend-autopush.corp.youtube.com/inapp/
Source: chromecache_169.2.dr	String found in binary or memory: https://asx-help-frontend-autopush.corp.youtube.com/tools/feedback/
Source: chromecache_169.2.dr	String found in binary or memory: https://feedback-pa.clients6.google.com
Source: chromecache_169.2.dr	String found in binary or memory: https://feedback.googleusercontent.com/resources/annotator.css
Source: chromecache_169.2.dr	String found in binary or memory: https://feedback.googleusercontent.com/resources/render_frame2.html
Source: chromecache_169.2.dr	String found in binary or memory: https://feedback2-test.corp.google.com/inapp/%
Source: chromecache_169.2.dr	String found in binary or memory: https://feedback2-test.corp.google.com/tools/feedback/%
Source: chromecache_169.2.dr	String found in binary or memory: https://feedback2-test.corp.googleusercontent.com/inapp/%
Source: chromecache_169.2.dr	String found in binary or memory: https://feedback2-test.corp.googleusercontent.com/tools/feedback/%
Source: chromecache_190.2.dr, chromecache_189.2.dr	String found in binary or memory: https://fonts.google.com/license/googlerestricted
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/googlesans/v58/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RP
Source: chromecache_196.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/materialiconsextended/v151/kJEjBvgX7BgnkSrUwT8UnLVc38YydejYY-oE_LvJ.woff
Source: chromecache_190.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/productsans/v19/pxiDypQkot1TnFhsFMOfGShVE9eOcEg.woff2)
Source: chromecache_190.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/productsans/v19/pxiDypQkot1TnFhsFMOfGShVF9eO.woff2)
Source: chromecache_190.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/productsans/v19/pxiDypQkot1TnFhsFMOfGShVFNeOcEg.woff2)
Source: chromecache_190.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/productsans/v19/pxiDypQkot1TnFhsFMOfGShVGdeOcEg.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOkCnqEu92Fr1Mu51xEIzIFKw.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOkCnqEu92Fr1Mu51xFIzIFKw.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOkCnqEu92Fr1Mu51xGIzIFKw.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOkCnqEu92Fr1Mu51xHIzIFKw.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOkCnqEu92Fr1Mu51xIIzI.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOkCnqEu92Fr1Mu51xLIzIFKw.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOkCnqEu92Fr1Mu51xMIzIFKw.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fABc4EsA.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBxc4EsA.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fCBc4EsA.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fCRc4EsA.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fChc4EsA.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fCxc4EsA.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fABc4EsA.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBBc4.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBxc4EsA.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fCBc4EsA.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fCRc4EsA.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fChc4EsA.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fCxc4EsA.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfABc4EsA.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBxc4EsA.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfCBc4EsA.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfCRc4EsA.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfChc4EsA.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfCxc4EsA.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4WxKOzY.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu5mxKOzY.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu72xKOzY.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu7GxKOzY.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu7WxKOzY.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu7mxKOzY.woff2)
Source: chromecache_169.2.dr	String found in binary or memory: https://gstatic.com/uservoice/surveys/resources/
Source: chromecache_169.2.dr	String found in binary or memory: https://help.youtube.com/tools/feedback/
Source: chromecache_169.2.dr	String found in binary or memory: https://localhost.corp.google.com/inapp/
Source: chromecache_169.2.dr	String found in binary or memory: https://localhost.proxy.googlers.com/inapp/
Source: chromecache_159.2.dr, chromecache_154.2.dr	String found in binary or memory: https://play.google.com
Source: chromecache_147.2.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_169.2.dr	String found in binary or memory: https://sandbox.google.com/inapp/
Source: chromecache_169.2.dr	String found in binary or memory: https://sandbox.google.com/inapp/%
Source: chromecache_169.2.dr	String found in binary or memory: https://sandbox.google.com/tools/feedback/
Source: chromecache_169.2.dr	String found in binary or memory: https://sandbox.google.com/tools/feedback/%
Source: chromecache_169.2.dr	String found in binary or memory: https://scone-pa.clients6.google.com
Source: chromecache_159.2.dr, chromecache_154.2.dr	String found in binary or memory: https://ssl.gstatic.com/docs/common/cleardot.gif
Source: chromecache_159.2.dr, chromecache_154.2.dr	String found in binary or memory: https://ssl.gstatic.com/docs/forms/draft_responses_onboarding.png
Source: chromecache_169.2.dr	String found in binary or memory: https://stagingqual-feedback-pa-googleapis.sandbox.google.com
Source: chromecache_159.2.dr, chromecache_154.2.dr	String found in binary or memory: https://support.google.com
Source: chromecache_169.2.dr	String found in binary or memory: https://support.google.com/
Source: chromecache_169.2.dr	String found in binary or memory: https://support.google.com/inapp/
Source: chromecache_169.2.dr	String found in binary or memory: https://support.google.com/inapp/%
Source: chromecache_169.2.dr	String found in binary or memory: https://test-scone-pa-googleapis.sandbox.google.com
Source: chromecache_147.2.dr	String found in binary or memory: https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=
Source: chromecache_169.2.dr	String found in binary or memory: https://www.google.cn/tools/feedback/
Source: chromecache_169.2.dr	String found in binary or memory: https://www.google.cn/tools/feedback/%
Source: chromecache_159.2.dr, chromecache_154.2.dr	String found in binary or memory: https://www.google.com
Source: chromecache_169.2.dr	String found in binary or memory: https://www.google.com/tools/feedback
Source: chromecache_169.2.dr	String found in binary or memory: https://www.google.com/tools/feedback/
Source: chromecache_169.2.dr	String found in binary or memory: https://www.google.com/tools/feedback/%
Source: chromecache_169.2.dr	String found in binary or memory: https://www.google.com/tools/feedback/help_panel_binary.js
Source: chromecache_159.2.dr, chromecache_154.2.dr	String found in binary or memory: https://www.gstatic.com/feedback/js/help/prod/service/lazy.min.js
Source: chromecache_169.2.dr	String found in binary or memory: https://www.gstatic.com/uservoice/feedback/client/web/
Source: chromecache_169.2.dr	String found in binary or memory: https://www.gstatic.com/uservoice/surveys/resources/
Source: chromecache_159.2.dr, chromecache_154.2.dr	String found in binary or memory: https://youtube.com/embed/
Source: chromecache_159.2.dr, chromecache_154.2.dr	String found in binary or memory: https://youtube.com/embed/?rel=0

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 23.220.189.216:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.220.189.216:443 -> 192.168.2.5:49738 version: TLS 1.2

Source: classification engine

Classification label: mal56.phis.win@16/191@16/10

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 --field-trial-handle=2220,i,18086223595071496100,9062713011887786877,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://docs.google.com/forms/d/e/1FAIpQLScaqr8AS5UHJLhHgsk75Su6KzT5rrqw0atzmeeQYQGFlm3rfA/viewform?usp=sf_link"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 --field-trial-handle=2220,i,18086223595071496100,9062713011887786877,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.253.124.101	unknown	United States	15169	GOOGLEUS	false
172.217.215.102	play.google.com	United States	15169	GOOGLEUS	false
142.250.105.132	unknown	United States	15169	GOOGLEUS	false
142.250.105.147	www.google.com	United States	15169	GOOGLEUS	false
173.194.219.132	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
64.233.177.138	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.9.101	unknown	United States	15169	GOOGLEUS	false
142.250.9.100	docs.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.5

Contacted Domains

Name	IP	Active
docs.google.com	142.250.9.100	true
bg.microsoft.map.fastly.net	199.232.214.172	true
play.google.com	172.217.215.102	true
www.google.com	142.250.105.147	true
googlehosted.l.googleusercontent.com	173.194.219.132	true
fp2e7a.wpc.phicdn.net	192.229.211.108	true
lh5.googleusercontent.com	unknown	unknown

Contacted URLs

Name	Malicious	Reputation
https://docs.google.com/forms/d/e/1FAIpQLScaqr8AS5UHJLhHgsk75Su6KzT5rrqw0atzmeeQYQGFlm3rfA/naLogImpressions	false	high
https://docs.google.com/forms/d/e/1FAIpQLScaqr8AS5UHJLhHgsk75Su6KzT5rrqw0atzmeeQYQGFlm3rfA/viewform	false	high
https://lh5.googleusercontent.com/qT4DCK2LKzecwlfH_KeT8lBWadfqlPRvtivdMZMXcGG_CRS6ybKJf354o1nOBIOo9cGaLyG9Hl0fQk80G8iXQQ-KdATcPkutqm7QbF2qJLD5-IB7cID4YmTX8GmGDBYxkQ=w580	false	high
https://docs.google.com/forms/d/e/1FAIpQLScaqr8AS5UHJLhHgsk75Su6KzT5rrqw0atzmeeQYQGFlm3rfA/viewform?usp=sf_link	false	high
https://play.google.com/log?format=json&hasfast=true&authuser=0	false	high
https://docs.google.com/forms/d/e/1FAIpQLScaqr8AS5UHJLhHgsk75Su6KzT5rrqw0atzmeeQYQGFlm3rfA/font/getmetadata	false	high

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Apr 16 17:01:15 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	6C55F29D48A26B4923CF70751D1464FB	CE83BD5B09981F13B411A02F489CE5E8814D5DA7	ACFC35CC12FABD8A10632C12544827FFB3991D925CE01E310D5F274F2C0A8AF9
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Apr 16 17:01:15 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	1EE6BE67143205190E730EEF6F9AE80C	A08F5F48F7EDCFD18A77A4EFA2BC605CA633FF6D	E5C70B980CA20518351495ADDFB62F69586AA4E9DB027311C0EAC909E3122C26
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	1AD22900F74E296D17D739A1F898A5EA	6FB8DA5475739DA5E21C9155C523778C95BACAAA	AF82A986F48906A9578023E068AD564A6E335FE364BB31EFE5B4C0BC80DF5ED1
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Apr 16 17:01:15 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	97737FC86CDDA30DDCF2AC860AE305AD	5499D5DDE16C7D9A8328F3E9B7090C1F335AF98A	F15916003D9AE7905B5D243FA0D45FBE6E5A40ABE5BB39D1C94C7B595CBF2CED
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Apr 16 17:01:15 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	CFFE66CE4412DF9308F51A4DECF677FD	3045D06DE0F39354C1ADD5CA0A036BC4A6F7F7D5	825E360233C1C019F57ED426656BD48321C38A595C8BAE28536DBB861E14B2F6
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Apr 16 17:01:15 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	EB4C69FD3114AD4F00A7042C4190CF1D	5DE63881CCB7E4071E8DF310D4E5E256DACDF5DE	5BE0516B5B45B6DB6176ACD1352C7A8C3BD61017A873C1A12F8255179EBF6D30
Chrome Cache Entry: 107	Web Open Font Format (Version 2), TrueType, length 58012, version 1.0	E88455150169496390368F9DCFC709C6	672607F20C14829A1071441C031A8411196CFEA8	133BB5C5AF6B43D96660FF65F46464F2A03F7D0DEEB8E2A1F8E0AA7CE6770120
Chrome Cache Entry: 108	Web Open Font Format (Version 2), TrueType, length 1360, version 1.0	248816E2428823AA2BA6B223B82EC73B	EC8DD868A619356C0E30606ECA110A239CA0D83D	4524691B7547D0D9F1A34FF172D940BEDAFD7725A14A5BD1121807B7D993BFFA
Chrome Cache Entry: 109	Web Open Font Format (Version 2), TrueType, length 129672, version 1.0	B99D3A0689113C5D84E45F23E390F679	B5B7C86B351934F4D3C07B5CCAE3EC18C3AC5C41	10B6FC407AD68085B7EA80A7F03939ED11B4AD702C3067FF89BCD8EE26320EA6
Chrome Cache Entry: 110	Web Open Font Format (Version 2), TrueType, length 31456, version 1.0	8787E52101C989DEA9FEA21E232FA45B	F112710595BAA904A62B68C2066DD34D7103E1E8	D5C4965A6E9C89DEE7D1389167C821976BFBF55D80E7DCDDFBCB5400B1AE01C9
Chrome Cache Entry: 111	Web Open Font Format (Version 2), TrueType, length 72784, version 1.0	583001AD11A97BA3804A9A3A221B8A5A	241ED8DC2DE73915B7A1C483C8093D3E7AC68710	8CC3CCE7B52175A0E42F8B92D45322EBAA709D227F9EC52643E75410FDA94B06
Chrome Cache Entry: 112	Web Open Font Format (Version 2), TrueType, length 42132, version 1.0	2661BDA6D2BA62A920BE11952BB94849	7C1EE90488041D444D2289AE42C06D1958F34584	ADD6DDD7FEE32D58EBA385983AB7DCC9657AD97CDBD4BF4594DB38675847EDB4
Chrome Cache Entry: 113	Web Open Font Format (Version 2), TrueType, length 4196, version 1.0	92CFF5BF3D47970DEFEF49EBF56448DB	163E2B870500AC648A075A008408C9FA73922953	AFD7B4CE1230FC5D6CB58DAEBEED6BCD09EBEE1E4414367596BC3BB33F62444C
Chrome Cache Entry: 114	Web Open Font Format (Version 2), TrueType, length 64068, version 1.0	EFD94F0EB81E50A5F75CFAC73257EFC2	E8C4E0A66E8BA85DE2BDACA59CBCC55CED60BBCA	3A6C1001C36D7F2F8AD4DF369BAF38217AF3ADAAE94A5625651C05F4C3A38BD3
Chrome Cache Entry: 115	Web Open Font Format (Version 2), TrueType, length 1756, version 1.0	075859BE4E4F07F19A698D12C3BEADDE	C82E3BAB6BA88F4C4BB791C570E8D007ED3554DC	6C00994F426CDCA41EB2FBD87B0F3610E37ACB3D641B4297A5CFA3E969CD95EE
Chrome Cache Entry: 116	GIF image data, version 89a, 1 x 1	FC94FB0C3ED8A8F909DBC7630A0987FF	56D45F8A17F5078A20AF9962C992CA4678450765	2DFE28CBDB83F01C940DE6A88AB86200154FD772D568035AC568664E52068363
Chrome Cache Entry: 117	Web Open Font Format (Version 2), TrueType, length 1664, version 1.0	F19AC4E354F2BCE2E6341B804767E11A	A197ACF3FA097BFBAD358400BD07EAD8865F6FCC	A631F36B97689FFB94AFDAEF8032E78479D469894A2B18F007DEA806DC1172B3
Chrome Cache Entry: 118	Web Open Font Format (Version 2), TrueType, length 45536, version 1.0	3C33061F3F982F2234262844D0FEE4CA	C4BB9DD654244A9EEBE0D6F12ED4C4E853B18252	6504F1B88B6DE335A0FC2D1802EF8B000F6569792F509D4635128DC0915D6D70
Chrome Cache Entry: 119	Web Open Font Format (Version 2), TrueType, length 39708, version 1.0	F311A35802EF8FA61FA06206EF76278C	6179B813223849FAEB0835B285A05E5B2A8A4AD4	FF8C9A38C906236A4025B752DA6A83403DF53F22F0FB8B88155B7B04A5229904
Chrome Cache Entry: 120	Web Open Font Format (Version 2), TrueType, length 58892, version 1.0	386F2237074CC59495783195EA1F1295	81B3014B28B6E7EF2FDB39ED73D18EE38F1C36A5	66A070C331573AA324FA2DEAC1A1B42B2D58E9660268555EE382D857E651E33F
Chrome Cache Entry: 121	Web Open Font Format (Version 2), TrueType, length 37488, version 1.0	2A7652831C7699009E0C25DABF93430A	6B0A143D883AFB8FF3CA2BF55B448AF8B68F2F89	C3525FCA875BF7203E92F116E0C5532DD5B5FE0F0CA5E12C6C4C8B9BD77566E2
Chrome Cache Entry: 122	Web Open Font Format (Version 2), TrueType, length 64164, version 1.0	8C548F65E1DC239D9F8F4F3F52457E59	9A1F4B732127BB53F1F17EA6C905A886A456FD62	1382DECC32857B4DC59FAAFDF57088D9F6917B18ECE82CC47F84010224008C05
Chrome Cache Entry: 123	Web Open Font Format (Version 2), TrueType, length 44316, version 1.0	F4B0DF592BED06B7E1AC275945D8EE61	DBD15D6534D7ADEF8E4AABA1A89E7A2CE22B16FD	C8FB82DF9421FA2DE18E11B89200EECCB188DAB713331F06C6C8782AD5CE5437
Chrome Cache Entry: 124	Web Open Font Format (Version 2), TrueType, length 2568, version 1.0	573C8C3F244F4286999EB16FBEE73181	464EC7F469B0F944BEAF09607C0205ED1C529018	A817A663EE912CCF67F30D9CDDFB563E15EFDABB3DE65FE491ABDFBEA5C6578F
Chrome Cache Entry: 125	Web Open Font Format (Version 2), TrueType, length 60648, version 1.0	0E46400F3E919D0CB74068D448D9DAA9	BE7343C9CFB3CE5388F38F2A8D302ED8AE8C7D6D	9FC62F0847BBEB2B050932BC04E8D60087955E2BBE3659FBE89408F4C62F2F7D
Chrome Cache Entry: 126	Web Open Font Format (Version 2), TrueType, length 36840, version 1.0	3603078A7B178210AC17285E145B4A8C	D57FD925F10C47D039FCDA3CC8A2A12D23E134C5	DCBAF64460B4DB78BA16EE6230D2C90215DDA58CE8C285348D624FE32DBC470E
Chrome Cache Entry: 127	Web Open Font Format (Version 2), TrueType, length 41676, version 1.0	C619C10C85CA3DD6D4B57CC59BA2A32A	92A0D8AC165CF6788BE6259F901FBA1994886D91	C129C2C42B2F1D5AF9BD5B9858F0EBA8215EE3EBF61FBC99866E107B2C0AF4B5
Chrome Cache Entry: 128	Web Open Font Format (Version 2), TrueType, length 2484, version 1.0	C56AF54151FDE28A48DACD2AC2987E99	4D9C23BE615F29828E8D5E1907712C50F4C88D5B	171D4C2505AE91856B2FE01EF5154D89FEEC1591421B5EE67F6EF8C0F50649C6
Chrome Cache Entry: 129	Web Open Font Format (Version 2), TrueType, length 65812, version 1.0	8C92254EDE49AB537884A853E7AC56C3	EB98395FD58E3D9433502FE0C11DACA0D2963C0C	7C7C81EC43FFC35A71567094E98836D7545681A399618661C8F1EB202B580206
Chrome Cache Entry: 130	SVG Scalable Vector Graphics image	CECA603BD198568DAB00E6DFC3120706	871C637521103DCE8F6DF9AAC0D1B62900D511B8	F4AF84EFE90891185D9B29A841181CA9D26D7560864EA47B6CD709D3B964AEE3
Chrome Cache Entry: 131	Web Open Font Format (Version 2), TrueType, length 40412, version 1.0	7332D3B0FA7568125CE6FE9EC4D55151	1822E1EF270F935E5FF8EF83BBE8D0C27CA3CC55	17406C4E4926C81DCD8F3832B79428CCF82F5A3AF17C03AFD0E37F13413851B7
Chrome Cache Entry: 132	Web Open Font Format (Version 2), TrueType, length 50476, version 1.0	EE26C64C3B9B936CC1636071584D1181	8EFBC8A10D568444120CC0ADF001B2D74C3A2910	D4D175F498B00516C629CE8AF152CBE745D73932FA58CC9FDFC8E4B49C0DA368
Chrome Cache Entry: 133	Web Open Font Format (Version 2), TrueType, length 41284, version 1.0	87595E01EADD10489540C2BC9532C831	E3EA9372FC50308AFB080F0AA0C1B544873E7896	BED2897761BB0A09F1993AB40B94D35B1E2B3C57039379B888503C6EAC7DCE70
Chrome Cache Entry: 134	Web Open Font Format (Version 2), TrueType, length 1416, version 1.0	E2D07BCC7B3C68F09F3517CD26B496A9	1BC266CB846B248865B43E53CCD7C8117A70B7BA	CC93B0C6CCF01063B9788530CA2389636059624B18599DE8EDEF8D4054255474
Chrome Cache Entry: 135	Web Open Font Format (Version 2), TrueType, length 25980, version 1.0	6570CEF7695DD91E8B3AD396ED61B8B8	B08DE546AA39A155EBB0CD3CF3109C753C66E20F	081A9357E5DA041FC09DBEF6C0ABAA986251670AACBC6029228D37F34FD1FE25
Chrome Cache Entry: 136	PNG image data, 580 x 145, 8-bit/color RGB, non-interlaced	533E7ED51E76CBD396BB57E34CC18D75	BE7B14F24564B5C26BFD4EE3D7970BA76561565A	782521A17181A779E4441883841FC1149CD539A520DC25EE957AB2ED86678C69
Chrome Cache Entry: 137	Web Open Font Format (Version 2), TrueType, length 1516, version 1.0	314C94C93E0D293F63A2C41F8E82C852	A648B285460C78DEADB882996F09FD75D8ECAB74	CDAAE795074CED24AD382F9F21C4F2E3443D3DC27BF6F75AB5CB43D54F23F009
Chrome Cache Entry: 138	Web Open Font Format (Version 2), TrueType, length 143084, version 1.0	ED1D9A18900837130495E4370CEEFF49	554473D248C976CD3A37453A89BF338DDEEAF519	3E92624FF29D44C47F313D24E815F4F9B1EE01CEB5700F6FC9EB3BAA215159F6
Chrome Cache Entry: 139	Web Open Font Format (Version 2), TrueType, length 46840, version 1.0	FA1ADF616690586A617E2F265AB761B0	802AF2A60A925A68A50C3BD3C157D284E1B51362	28AFB7554B3B29A5587799EACC92FD889378089FD568E5C8430B41D83D012B3E
Chrome Cache Entry: 140	Web Open Font Format (Version 2), TrueType, length 3576, version 1.0	3451C91ABE3E05F03BBA52CE59A258E7	19FAFD4F56FECDC013D8AF0DEE6C51E9A338FA5B	D4BA92453033372B440E5E762EEDEC60DEC8B3C32008F599B1C7F46376D64216
Chrome Cache Entry: 141	Web Open Font Format (Version 2), TrueType, length 55204, version 1.0	303F0DEE25055EA1A1C53F8C44B83EDF	552AB5948D02D19FF851777D58DBE0DCF836681C	DB8FAFFB5E867554C1AB9B0EDD0E11E8B5A3D4B9842D860A11646371C2B84D79
Chrome Cache Entry: 142	Web Open Font Format (Version 2), TrueType, length 50664, version 1.0	2EAE80C528D1D7A39C57805DE3E9C799	37ED517E2F44EF14D8F2C4679F9EAD44B050759F	46B9F52EC517DDFAC84DD566720D00CF3C54AEFF1D543AA9C95FFF830985FA13
Chrome Cache Entry: 143	Web Open Font Format (Version 2), TrueType, length 26936, version 1.0	E6846A793FEDDD3CA0729750A64EE6F1	6BBC22C3FCF60036CE9CA0C5DCE899FAA86EDC33	5EE1925DE22BAA2EF5BCB426A76DA601C7A094D4D87CC8703B80DB62AC2452C1
Chrome Cache Entry: 144	Web Open Font Format (Version 2), TrueType, length 40184, version 1.0	1C31342F0BE5BC0E2B1549932CDE2F81	A5AAB8D96192515329B7D888CFC5B7B113FAD53D	184819CFD66EEE3BBF756A609A0EA8034F09DCF8C68CD817B08358D8E5579CA3
Chrome Cache Entry: 145	SVG Scalable Vector Graphics image	A822F7940848253BF0E865FB2FC13E4C	99F18D336B50CB46A8922B2E949FF70D00AE8FFE	3908569E5E84C285A80BC29A268EDC394E4F60AD3D25BE8E8A8027E360E0CB7D
Chrome Cache Entry: 146	Web Open Font Format (Version 2), TrueType, length 2708, version 1.0	B12C8BACB108B452B1DBB90C3D1FF1D0	ECF97F8E8FDA216564CFF508D3B9E126D8666372	588A0396D786BB25120D5B559B9D546C3F276BC5E17E9D6ED1AD609DC0871CDE
Chrome Cache Entry: 147	ASCII text, with very long lines (987)	E9E5145FA860AD9BBCC128EDEFBEC141	796389B30BD540A3A950FD9AC625A53513E669EF	9D2F1611808FBBE108F7A490C5E450335EEE6A04257374BDC3F6514F0F9699AE
Chrome Cache Entry: 148	Web Open Font Format (Version 2), TrueType, length 57612, version 1.0	10D2BDFD7A17F5E0210C90D99A8B5ABB	89CF52504233C328782A7250F56DAD603FA74A91	D8977152B314FCD5D04BEC050367C0AAFA91899501593E9ECB0D6090CDAC29A6
Chrome Cache Entry: 149	Web Open Font Format (Version 2), TrueType, length 32644, version 1.0	3F02E1AEEA84F97C26CE78E796009467	3A86908B3E689621F23A326A8F3FD4B794599C00	68425336934A956337B4593A3D47D51D2970D03AC4A9C9FC795596F13EB21775
Chrome Cache Entry: 150	Web Open Font Format (Version 2), TrueType, length 58200, version 1.0	895A08A8F8DE0B5D91F3F6999243B76A	3FB36CEC53FDFD5CE97CBD34FDD0A6E5D8255B50	AADA1AC84EDC0A0F678A12E87B835B9C5A71FC4CEC407CA0420C6561CB53A439
Chrome Cache Entry: 151	GIF image data, version 89a, 1 x 1	FC94FB0C3ED8A8F909DBC7630A0987FF	56D45F8A17F5078A20AF9962C992CA4678450765	2DFE28CBDB83F01C940DE6A88AB86200154FD772D568035AC568664E52068363
Chrome Cache Entry: 152	Web Open Font Format (Version 2), TrueType, length 41288, version 1.0	C2016E340130CA6E2ABB66D40055B6F4	9A999B20475FE5CA7314918BE5BC09555EA44022	347B8E3E68694A70F4B024CDBEE7FB7ED5F98C19D0DAFEF6B8F237191C796F03
Chrome Cache Entry: 153	SVG Scalable Vector Graphics image	CECA603BD198568DAB00E6DFC3120706	871C637521103DCE8F6DF9AAC0D1B62900D511B8	F4AF84EFE90891185D9B29A841181CA9D26D7560864EA47B6CD709D3B964AEE3
Chrome Cache Entry: 154	ASCII text, with very long lines (1719)	656CF8E2FCFD15A273CDC124B13E3C3A	3245EF1BA8511E07FEE7AA622DD2D405476895BA	499DFD24617DB33B6715AB482BE4B89083D19234509556901754B35BD1AB2A43
Chrome Cache Entry: 155	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	8DF19EC399BE913884590015105AA584	5502576575AFF37A626934FA655C124291C58AD6	D48A0F5A08249E1768C06ACA31C16D50D1216434E1C91BA322CF5521577A59E3
Chrome Cache Entry: 156	Web Open Font Format (Version 2), TrueType, length 3640, version 1.0	421B045B5EB019D56F6407AE63E57A92	F0D0D18A1887D371B18C1B06B99AD2D3C0923E8D	5DCEBB5EC80A2DDAB469A77F1A37412C34205EF76D054131083B0BF663B786FB
Chrome Cache Entry: 157	ASCII text, with no line terminators	A8E27102A1CE1D07830AF90CCDCC4FFB	7BFB4129ACCC162BD59C87C82DCBC466A1EFB67A	9D74AAEEB1C0BB10BC61061A5AE467C4D3F27EC51E9AD47342E8D46B3E8BE6CF
Chrome Cache Entry: 158	Web Open Font Format (Version 2), TrueType, length 4344, version 1.0	E5A3502E3717398EE835D98F84874738	75C4C2D0F1A2EDA7E16A16293BA840E19991EF1A	E5ACBE17FD4E63CCA2CE1B72E482FC2411D27D9D534476AD7F0108B9DF087FCE
Chrome Cache Entry: 159	ASCII text, with very long lines (1719)	656CF8E2FCFD15A273CDC124B13E3C3A	3245EF1BA8511E07FEE7AA622DD2D405476895BA	499DFD24617DB33B6715AB482BE4B89083D19234509556901754B35BD1AB2A43
Chrome Cache Entry: 160	Web Open Font Format (Version 2), TrueType, length 99952, version 1.0	4DC58D8C42A13CD77CF2CD978F639388	221EDE548E9E9CF711595D6511C73CD8EA4EB595	B93F4669CC09016E4D1AD1836A4CD1EBCF832C22979E5FA11DB4F7C3620223AE
Chrome Cache Entry: 161	Web Open Font Format (Version 2), TrueType, length 50264, version 1.0	AB5E010EBED9BCFB98CDB5BD47D3E430	5D1AA4B896BF05AFE8978F74E2E88A53B0D9BB6E	B5477EC958C9F1F06AF0D54F50633B66C76C5E010450283C5620CFC79E57E963
Chrome Cache Entry: 162	GIF image data, version 89a, 1 x 1	FC94FB0C3ED8A8F909DBC7630A0987FF	56D45F8A17F5078A20AF9962C992CA4678450765	2DFE28CBDB83F01C940DE6A88AB86200154FD772D568035AC568664E52068363
Chrome Cache Entry: 163	ASCII text, with very long lines (609)	A095427B34EFE6E0C191C9CBBAF0285A	3150FA9DAAAF4AD8A9CAE665B14BE0190EB2F9BE	352E802ACD377569DB3C94023F070323FA2FEB19796AA9CD0D07DCE99B926D5C
Chrome Cache Entry: 164	Web Open Font Format (Version 2), TrueType, length 17368, version 1.0	ABE083D96B58EB02ADA8B7C30D7B09F2	61447D66D13A8C8F4335696777A85C438C46F749	DB0424FB67FB52E7E538490240CC7FB9C05AA076333A4968F3DEE30B825DABF9
Chrome Cache Entry: 165	Web Open Font Format (Version 2), TrueType, length 64656, version 1.0	28E2B282CBDDE4FBEF925AA25DF6FEA3	764C6B373670D221C28CD5DA0584FCEB1C444905	B1DE6EAC3059CA778E6D2367182C7F11EDC81E09971E56F788DB308A674EA7EC
Chrome Cache Entry: 166	ASCII text, with very long lines (609)	A095427B34EFE6E0C191C9CBBAF0285A	3150FA9DAAAF4AD8A9CAE665B14BE0190EB2F9BE	352E802ACD377569DB3C94023F070323FA2FEB19796AA9CD0D07DCE99B926D5C
Chrome Cache Entry: 167	SVG Scalable Vector Graphics image	A822F7940848253BF0E865FB2FC13E4C	99F18D336B50CB46A8922B2E949FF70D00AE8FFE	3908569E5E84C285A80BC29A268EDC394E4F60AD3D25BE8E8A8027E360E0CB7D
Chrome Cache Entry: 168	Web Open Font Format (Version 2), TrueType, length 1528, version 1.0	EB7377208715318B001D920F049E318B	9E428185FC78B5F18B11D1B29353433939B08B5B	10505DF86B3638BE7B5707A542C0C7C80ED856F14E037BB1C64BFAF712B0AB75
Chrome Cache Entry: 169	ASCII text, with very long lines (3383)	4D95791A35AE95BD11B6F6D7E880FF93	23F70202A367D2B280F2560BBEC29B1C9EEE5E66	15CE60AE9FDB72F42E3C0BAF6010B4B1C55CB5F80F22E430D21BFC1D6886EC7A
Chrome Cache Entry: 170	Web Open Font Format (Version 2), TrueType, length 41584, version 1.0	71151932FDCC1AC7E09BF80A592DDA78	7049019D7FA6D570CA9B57525224313656B36E8D	68C3F849762D80F759A7702F52B6F9C432173951D7D5E830C98CEDFDEBA5E53E
Chrome Cache Entry: 171	Web Open Font Format (Version 2), TrueType, length 41220, version 1.0	C8D3E0F677AC007C9FADBA09A1C4C7BC	83389D80FDF1BEE58E69DB1F38968404EAC57846	A9ED2DC63202E8E1E06CC22EB23D39212A36034D90DBC76274EC7F85DEB1D3C2
Chrome Cache Entry: 172	Web Open Font Format (Version 2), TrueType, length 100756, version 1.0	4498A1A925FD2D5630BA89B78739E194	C757EDCF6538B1F0968F69A7618C564DCAF7150A	54EFCB5570863B2329C2C677749C85C7ED337F5C16BF38CAEA17807196150293
Chrome Cache Entry: 173	Web Open Font Format (Version 2), TrueType, length 54324, version 1.0	D776DFF67B276751D9FD003633687662	C33022ABBF684C1A59263AABA2EC52AC40BF7951	C33E230ED8AA87EB62C341B5CD33E65B59C9E65231B2DE468B68E95E4EDA1CD9
Chrome Cache Entry: 174	Web Open Font Format (Version 2), TrueType, length 84892, version 1.0	0F0BE34D30705D3F21ECCBBFBFCBE983	96A0C04F6610AE014FC1179641861C1A96DD6DD0	E05FD4C39D2671D0FEBCF551364287A41D4889CA4692817722459FF34940AC81
Chrome Cache Entry: 175	Web Open Font Format (Version 2), TrueType, length 126552, version 1.0	AF8FF37FA5C0E048BF57FEC5436A89C9	033DDBD8AF527542E878AB76EE8151586C2EFCD5	8CA1EEE7725D016477DDDD403B78C514438B1D2CD58545B4BC9FD6DB9647D83D
Chrome Cache Entry: 176	Web Open Font Format (Version 2), TrueType, length 37800, version 1.0	2B097CB2DC262C764A2C97D4E233918D	83DB49B6B6DDA13ADC82726197CC2B243EF647DC	7615AED2ED8F1361D3ABA2B6CE6612468463E660E8BD4A4302B24C113EC57308
Chrome Cache Entry: 177	Web Open Font Format (Version 2), TrueType, length 116720, version 1.0	BBCBEB66044A15CC9E191D3056B88045	013496B3A81A2C3B4DEE88618D2E2588ADB3AE93	FD8BED74936B7B0F1745B3B117CAB8BE5EC9405FB4771226270462E670B8D9FE
Chrome Cache Entry: 178	Web Open Font Format (Version 2), TrueType, length 57236, version 1.0	212D9F17F0F5D037532FA3B8FC14B8DE	C332A9F57F2C7931F2A930B5D91BCF244E38FC42	53B183E10D8C5DB234637E82BEF4014117BD41C956C69AF55FA0165A7BE31666
Chrome Cache Entry: 179	Web Open Font Format (Version 2), TrueType, length 54776, version 1.0	381DC2442717E08C09385CC42E39F1A9	EFC24EA7BC8753F4B897BAC010507940EE194DAD	A4208A4184A14E8638F7B807E3B3C9E96FB1E1D7690FA9C2AE8216B763DD3A0C
Chrome Cache Entry: 180	Web Open Font Format (Version 2), TrueType, length 34108, version 1.0	C15D33A9508923BE839D315A999AB9C7	D17F6E786A1464E13D4EC8E842F4EB121B103842	65C99D3B9F1A1B905046E30D00A97F2D4D605E565C32917E7A89A35926E04B98
Chrome Cache Entry: 181	Web Open Font Format (Version 2), TrueType, length 1260, version 1.0	1A6FBA681A50BD6E9A060D45AB00573F	831C29D7A7E1F28B71AA147727B310742EEC8B57	80083BB74056D4EA185160DD596DE5A63D5ED834778A5D7F7E4E843BA4421345
Chrome Cache Entry: 182	Web Open Font Format (Version 2), TrueType, length 37632, version 1.0	1FFAA430DEB705DF128762D9990F8EFE	847F8CA1CF199A602AEF0EF42AEBF5F825584E19	2706DFABCBAAF2DEE90C3A10C168D5F5691CE787DCAE9E77CD038F66B08FC4BA
Chrome Cache Entry: 183	Web Open Font Format (Version 2), TrueType, length 43772, version 1.0	36338672609C9EC1D83AF4E1AFF7B0AD	287BF3611440E9377DD71C0620AA63448D632F06	E268433F792E81D03D24617E0A4D6ECB5728278A805E7D12493E06802AA671A7
Chrome Cache Entry: 184	Web Open Font Format (Version 2), TrueType, length 5044, version 1.0	5E37F6030CF935F9CBD3FF5A22E08D2E	C77AE7DD7501F4F578884BC034004F8619FC3D17	867352B1C82C47D71A11744E3886441A848780DCA87928BAC596E5F3473BFAA3
Chrome Cache Entry: 185	HTML document, Unicode text, UTF-8 text, with very long lines (1136)	FBE36EB2EECF1B90451A3A72701E49D2	AE56EA57C52D1153CEC33CEF91CF935D2D3AF14D	E8F2DED5D74C0EE5F427A20B6715E65BC79ED5C4FC67FB00D89005515C8EFE63
Chrome Cache Entry: 186	ASCII text, with very long lines (65536), with no line terminators	3334EAFC0E38C0F16EA38BAF89590BBD	8A6ADC66135BAD504A8387B6D126CB1386E4E02F	206636DF41EAD342F215CEF0B276583B343270C36A107BE4CDAF1D277EE0EF10
Chrome Cache Entry: 187	Web Open Font Format (Version 2), TrueType, length 15744, version 1.0	15D9F621C3BD1599F0169DCF0BD5E63E	7CA9C5967F3BB8BFFEAB24B639B49C1E7D03FA52	F6734F8177112C0839B961F96D813FCB189D81B60E96C33278C1983B6F419615
Chrome Cache Entry: 188	GIF image data, version 89a, 1 x 1	FC94FB0C3ED8A8F909DBC7630A0987FF	56D45F8A17F5078A20AF9962C992CA4678450765	2DFE28CBDB83F01C940DE6A88AB86200154FD772D568035AC568664E52068363
Chrome Cache Entry: 189	ASCII text	2FB51BE2239DC5AE6F913682D04F6811	8D9E320BD37C3D710C303165EF87EA0BBF77DDC3	F52286592A63CC22E694471EA8351A84E9C6BF73B65032606DE17F3E81749A15
Chrome Cache Entry: 190	ASCII text	B939B48641DD382769F5A921A51354D1	3E649193F051D481FCA5EB499FCB451ED6DB14C2	87DE156E2BD6004CC029BDEC39839C051DC935899C041DD6CA96E98C2585C402
Chrome Cache Entry: 191	Web Open Font Format (Version 2), TrueType, length 47364, version 1.0	FCC676E93787A8D472AD00BF7F158D88	A28C8050BAA6E17C6ADEC60BCA582715403D500B	1F6B8D8F7D462DC42D48B29E68062A707890AA2DD700C947806949F63D79694A
Chrome Cache Entry: 192	Web Open Font Format (Version 2), TrueType, length 72264, version 1.0	6D84E4EF296F36703DC075606D0368DD	BB24CE1F7C7F3A1FF54F9B40899BF7BB17DA3226	9D81818EE4513A1DBC74D17B8DCEC5AA730A70CECA96B75A68AD007554E01CC2
Chrome Cache Entry: 193	PNG image data, 580 x 145, 8-bit/color RGB, non-interlaced	533E7ED51E76CBD396BB57E34CC18D75	BE7B14F24564B5C26BFD4EE3D7970BA76561565A	782521A17181A779E4441883841FC1149CD539A520DC25EE957AB2ED86678C69
Chrome Cache Entry: 194	Web Open Font Format (Version 2), TrueType, length 64888, version 1.0	2334C1055671C09E04BDF4E0FF516B06	C944288E5E4DB93B86A8272E9DC5A7141A84CF1B	CB1D125975DA6683E4DB07394E5035B0CDE2782B389341BB577D2A274262E839
Chrome Cache Entry: 195	Web Open Font Format (Version 2), TrueType, length 35060, version 1.0	0360DBC6E8C09DCE9183A1FD78F3BE2E	6CD4B65A94707AE941D78B12F082C968CB05EC92	2DB6BC36808D43FA89029C652636E206FA3E889B35ECF71814AB85F8BA944AF3
Chrome Cache Entry: 196	ASCII text	1868068BDC2622CF2C4C607102970B6A	B254679B639C5D7F26BA8662A70E5D7587333ECD	354AA87B02FCDDFAFEE3DB7BA65775E92D271256B7CE8DF3C0BB43467EBA7B3F
Chrome Cache Entry: 197	Web Open Font Format (Version 2), TrueType, length 50340, version 1.0	90F0B37F809B546F34189807169E9A76	EE8C931951DF57CD7B7C8758053C72EBEBF22297	9DCACF1D025168EE2F84AAF40BAD826F08B43C94DB12EB59DBE2A06A3E98BFB2
Chrome Cache Entry: 198	Web Open Font Format (Version 2), TrueType, length 4280, version 1.0	35F2221688A86314A271F11BBF8E76BD	2E56E5FCCE211EEA8CA3709E0A8B33DD89CEDA92	3C1D1B09AF9EA0E4A497CF8F1BAAF915BB032ECA2AE369869566282D156CB25D
Chrome Cache Entry: 199	Web Open Font Format (Version 2), TrueType, length 105776, version 1.0	DF1878BEEF6F76B3B8B9C3A479BFA5CB	5724CF8D410C6BD487A002A14386231C29C933C6	C7B73DC2A43D6620B4AE7B1E05EEA2342CF309352B4DCAADEB4491C5B72468E5
Chrome Cache Entry: 200	Web Open Font Format (Version 2), TrueType, length 42296, version 1.0	20A5ED564FE91199A53645DD2A8F8BCE	878AB8E8E2A0BBDE4F47359D625DB2B81F7AC0A1	3109801208D4C4B75FF98BB721D0AEE286293C2F0D2F47F778DCFAD779E9F5EE
Chrome Cache Entry: 201	Web Open Font Format (Version 2), TrueType, length 1420, version 1.0	F8FB2BDE26ED2B7A60BA773D42DD2150	70871B9E74126289901A00F44B8271849A125DBD	9DAA921A21820750F7FE6223AC35072394F99209C374409981F6EFD1B2E3DCD5
Chrome Cache Entry: 202	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	8DF19EC399BE913884590015105AA584	5502576575AFF37A626934FA655C124291C58AD6	D48A0F5A08249E1768C06ACA31C16D50D1216434E1C91BA322CF5521577A59E3
Chrome Cache Entry: 203	Web Open Font Format (Version 2), TrueType, length 44980, version 1.0	A32CAE41AA72AD6CA75FF8B5A7A11606	FC29CA3935D5F85C169448D7CC6410C2560D92BC	33EA7445E374A6AAB69F4E13DDBC9FC0E356C731E2D1F093619B93D4281BBE2E

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://docs.google.com/forms/d/e/1FAIpQLScaqr8AS5UHJLhHgsk75Su6KzT5rrqw0atzmeeQYQGFlm3rfA/viewform?usp=sf_link

SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social Engineering

Phishing

Yara detected HtmlPhish20

Source: Yara match	File source: 1.1.pages.csv, type: HTML
Source: Yara match	File source: 1.2.pages.csv, type: HTML
Source: Yara match	File source: 0.0.pages.csv, type: HTML

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49807 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 23.220.189.216:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.220.189.216:443 -> 192.168.2.5:49738 version: TLS 1.2

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49807 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /forms/d/e/1FAIpQLScaqr8AS5UHJLhHgsk75Su6KzT5rrqw0atzmeeQYQGFlm3rfA/viewform?usp=sf_link HTTP/1.1Host: docs.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /qT4DCK2LKzecwlfH_KeT8lBWadfqlPRvtivdMZMXcGG_CRS6ybKJf354o1nOBIOo9cGaLyG9Hl0fQk80G8iXQQ-KdATcPkutqm7QbF2qJLD5-IB7cID4YmTX8GmGDBYxkQ=w580 HTTP/1.1Host: lh5.googleusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://docs.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /qT4DCK2LKzecwlfH_KeT8lBWadfqlPRvtivdMZMXcGG_CRS6ybKJf354o1nOBIOo9cGaLyG9Hl0fQk80G8iXQQ-KdATcPkutqm7QbF2qJLD5-IB7cID4YmTX8GmGDBYxkQ=w580 HTTP/1.1Host: lh5.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=513=bhlSL5-tCs06dGzJ_ubECKPpZvhsaGvxY9K5TSeThR1zaE1ZCyetXXezefgSMi0sqqrEJcnnkZpK1HDU1YxzU07b1TkbsCf_GUQjzBpxsRKgzwErAXuQXlzqT84qb-4iLutL3Vv8akDb4mml8rljezpKkm81gc8rFQIscuShyYs
Source: global traffic	HTTP traffic detected: GET /forms/d/e/1FAIpQLScaqr8AS5UHJLhHgsk75Su6KzT5rrqw0atzmeeQYQGFlm3rfA/font/getmetadata HTTP/1.1Host: docs.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: S=spreadsheet_forms=Mv8NASN1Y4oBjURy6aTsMSDQrxWUaLWk5kAkIsNLD9Q; COMPASS=spreadsheet_forms=CjIACWuJVwpxX915tM7kAkmnxOi1Coy775IBzhFmYRrOqRol50CNjUVIrP7o8kNiMzgxDxD8lfuwBhpDAAlriVcWvXgNjAWVt8A9d_iozQ2rLasZkIxkcnEx2ZCA7SrYnVj7yawjZKuoRkeApne0qFmqziYMb1fshkuQk57k5g==; NID=513=bhlSL5-tCs06dGzJ_ubECKPpZvhsaGvxY9K5TSeThR1zaE1ZCyetXXezefgSMi0sqqrEJcnnkZpK1HDU1YxzU07b1TkbsCf_GUQjzBpxsRKgzwErAXuQXlzqT84qb-4iLutL3Vv8akDb4mml8rljezpKkm81gc8rFQIscuShyYs
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=513=bhlSL5-tCs06dGzJ_ubECKPpZvhsaGvxY9K5TSeThR1zaE1ZCyetXXezefgSMi0sqqrEJcnnkZpK1HDU1YxzU07b1TkbsCf_GUQjzBpxsRKgzwErAXuQXlzqT84qb-4iLutL3Vv8akDb4mml8rljezpKkm81gc8rFQIscuShyYs
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=513=bhlSL5-tCs06dGzJ_ubECKPpZvhsaGvxY9K5TSeThR1zaE1ZCyetXXezefgSMi0sqqrEJcnnkZpK1HDU1YxzU07b1TkbsCf_GUQjzBpxsRKgzwErAXuQXlzqT84qb-4iLutL3Vv8akDb4mml8rljezpKkm81gc8rFQIscuShyYs

Source: chromecache_169.2.dr

Source: unknown

DNS traffic detected: queries for: docs.google.com

Source: unknown

Source: chromecache_169.2.dr	String found in binary or memory: http://localhost.corp.google.com/inapp/
Source: chromecache_169.2.dr	String found in binary or memory: http://localhost.proxy.googlers.com/inapp/
Source: chromecache_169.2.dr	String found in binary or memory: https://apis.google.com/js/client.js
Source: chromecache_169.2.dr	String found in binary or memory: https://asx-frontend-autopush.corp.google.co.uk/inapp/
Source: chromecache_169.2.dr	String found in binary or memory: https://asx-frontend-autopush.corp.google.co.uk/tools/feedback/
Source: chromecache_169.2.dr	String found in binary or memory: https://asx-frontend-autopush.corp.google.com/inapp/
Source: chromecache_169.2.dr	String found in binary or memory: https://asx-frontend-autopush.corp.google.com/tools/feedback/
Source: chromecache_169.2.dr	String found in binary or memory: https://asx-frontend-autopush.corp.google.de/inapp/
Source: chromecache_169.2.dr	String found in binary or memory: https://asx-frontend-autopush.corp.google.de/tools/feedback/
Source: chromecache_169.2.dr	String found in binary or memory: https://asx-frontend-autopush.corp.youtube.com/inapp/
Source: chromecache_169.2.dr	String found in binary or memory: https://asx-frontend-autopush.corp.youtube.com/tools/feedback/
Source: chromecache_169.2.dr	String found in binary or memory: https://asx-frontend-staging.corp.google.com/inapp/
Source: chromecache_169.2.dr	String found in binary or memory: https://asx-frontend-staging.corp.google.com/tools/feedback/
Source: chromecache_169.2.dr	String found in binary or memory: https://asx-help-frontend-autopush.corp.youtube.com/inapp/
Source: chromecache_169.2.dr	String found in binary or memory: https://asx-help-frontend-autopush.corp.youtube.com/tools/feedback/
Source: chromecache_169.2.dr	String found in binary or memory: https://feedback-pa.clients6.google.com
Source: chromecache_169.2.dr	String found in binary or memory: https://feedback.googleusercontent.com/resources/annotator.css
Source: chromecache_169.2.dr	String found in binary or memory: https://feedback.googleusercontent.com/resources/render_frame2.html
Source: chromecache_169.2.dr	String found in binary or memory: https://feedback2-test.corp.google.com/inapp/%
Source: chromecache_169.2.dr	String found in binary or memory: https://feedback2-test.corp.google.com/tools/feedback/%
Source: chromecache_169.2.dr	String found in binary or memory: https://feedback2-test.corp.googleusercontent.com/inapp/%
Source: chromecache_169.2.dr	String found in binary or memory: https://feedback2-test.corp.googleusercontent.com/tools/feedback/%
Source: chromecache_190.2.dr, chromecache_189.2.dr	String found in binary or memory: https://fonts.google.com/license/googlerestricted
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/googlesans/v58/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RP
Source: chromecache_196.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/materialiconsextended/v151/kJEjBvgX7BgnkSrUwT8UnLVc38YydejYY-oE_LvJ.woff
Source: chromecache_190.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/productsans/v19/pxiDypQkot1TnFhsFMOfGShVE9eOcEg.woff2)
Source: chromecache_190.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/productsans/v19/pxiDypQkot1TnFhsFMOfGShVF9eO.woff2)
Source: chromecache_190.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/productsans/v19/pxiDypQkot1TnFhsFMOfGShVFNeOcEg.woff2)
Source: chromecache_190.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/productsans/v19/pxiDypQkot1TnFhsFMOfGShVGdeOcEg.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOkCnqEu92Fr1Mu51xEIzIFKw.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOkCnqEu92Fr1Mu51xFIzIFKw.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOkCnqEu92Fr1Mu51xGIzIFKw.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOkCnqEu92Fr1Mu51xHIzIFKw.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOkCnqEu92Fr1Mu51xIIzI.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOkCnqEu92Fr1Mu51xLIzIFKw.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOkCnqEu92Fr1Mu51xMIzIFKw.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fABc4EsA.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBxc4EsA.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fCBc4EsA.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fCRc4EsA.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fChc4EsA.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fCxc4EsA.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fABc4EsA.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBBc4.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBxc4EsA.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fCBc4EsA.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fCRc4EsA.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fChc4EsA.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fCxc4EsA.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfABc4EsA.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBxc4EsA.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfCBc4EsA.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfCRc4EsA.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfChc4EsA.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfCxc4EsA.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4WxKOzY.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu5mxKOzY.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu72xKOzY.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu7GxKOzY.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu7WxKOzY.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu7mxKOzY.woff2)
Source: chromecache_169.2.dr	String found in binary or memory: https://gstatic.com/uservoice/surveys/resources/
Source: chromecache_169.2.dr	String found in binary or memory: https://help.youtube.com/tools/feedback/
Source: chromecache_169.2.dr	String found in binary or memory: https://localhost.corp.google.com/inapp/
Source: chromecache_169.2.dr	String found in binary or memory: https://localhost.proxy.googlers.com/inapp/
Source: chromecache_159.2.dr, chromecache_154.2.dr	String found in binary or memory: https://play.google.com
Source: chromecache_147.2.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_169.2.dr	String found in binary or memory: https://sandbox.google.com/inapp/
Source: chromecache_169.2.dr	String found in binary or memory: https://sandbox.google.com/inapp/%
Source: chromecache_169.2.dr	String found in binary or memory: https://sandbox.google.com/tools/feedback/
Source: chromecache_169.2.dr	String found in binary or memory: https://sandbox.google.com/tools/feedback/%
Source: chromecache_169.2.dr	String found in binary or memory: https://scone-pa.clients6.google.com
Source: chromecache_159.2.dr, chromecache_154.2.dr	String found in binary or memory: https://ssl.gstatic.com/docs/common/cleardot.gif
Source: chromecache_159.2.dr, chromecache_154.2.dr	String found in binary or memory: https://ssl.gstatic.com/docs/forms/draft_responses_onboarding.png
Source: chromecache_169.2.dr	String found in binary or memory: https://stagingqual-feedback-pa-googleapis.sandbox.google.com
Source: chromecache_159.2.dr, chromecache_154.2.dr	String found in binary or memory: https://support.google.com
Source: chromecache_169.2.dr	String found in binary or memory: https://support.google.com/
Source: chromecache_169.2.dr	String found in binary or memory: https://support.google.com/inapp/
Source: chromecache_169.2.dr	String found in binary or memory: https://support.google.com/inapp/%
Source: chromecache_169.2.dr	String found in binary or memory: https://test-scone-pa-googleapis.sandbox.google.com
Source: chromecache_147.2.dr	String found in binary or memory: https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=
Source: chromecache_169.2.dr	String found in binary or memory: https://www.google.cn/tools/feedback/
Source: chromecache_169.2.dr	String found in binary or memory: https://www.google.cn/tools/feedback/%
Source: chromecache_159.2.dr, chromecache_154.2.dr	String found in binary or memory: https://www.google.com
Source: chromecache_169.2.dr	String found in binary or memory: https://www.google.com/tools/feedback
Source: chromecache_169.2.dr	String found in binary or memory: https://www.google.com/tools/feedback/
Source: chromecache_169.2.dr	String found in binary or memory: https://www.google.com/tools/feedback/%
Source: chromecache_169.2.dr	String found in binary or memory: https://www.google.com/tools/feedback/help_panel_binary.js
Source: chromecache_159.2.dr, chromecache_154.2.dr	String found in binary or memory: https://www.gstatic.com/feedback/js/help/prod/service/lazy.min.js
Source: chromecache_169.2.dr	String found in binary or memory: https://www.gstatic.com/uservoice/feedback/client/web/
Source: chromecache_169.2.dr	String found in binary or memory: https://www.gstatic.com/uservoice/surveys/resources/
Source: chromecache_159.2.dr, chromecache_154.2.dr	String found in binary or memory: https://youtube.com/embed/
Source: chromecache_159.2.dr, chromecache_154.2.dr	String found in binary or memory: https://youtube.com/embed/?rel=0

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 23.220.189.216:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.220.189.216:443 -> 192.168.2.5:49738 version: TLS 1.2

Source: classification engine

Classification label: mal56.phis.win@16/191@16/10

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 --field-trial-handle=2220,i,18086223595071496100,9062713011887786877,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://docs.google.com/forms/d/e/1FAIpQLScaqr8AS5UHJLhHgsk75Su6KzT5rrqw0atzmeeQYQGFlm3rfA/viewform?usp=sf_link"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 --field-trial-handle=2220,i,18086223595071496100,9062713011887786877,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

ID:	1426959
Product:	CloudBasic
Start time:	20:00:23
Start date:	16.04.2024
Cookbook:	browseurl.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Windows Analysis Report
https://docs.google.com/forms/d/e/1FAIpQLScaqr8AS5UHJLhHgsk75Su6KzT5rrqw0atzmeeQYQGFlm3rfA/viewform?usp=sf_link

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report https://docs.google.com/forms/d/e/1FAIpQLScaqr8AS5UHJLhHgsk75Su6KzT5rrqw0atzmeeQYQGFlm3rfA/viewform?usp=sf_link

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
https://docs.google.com/forms/d/e/1FAIpQLScaqr8AS5UHJLhHgsk75Su6KzT5rrqw0atzmeeQYQGFlm3rfA/viewform?usp=sf_link