Windows Analysis Report
https://starmicronics.com/support/download/starprnt-intelligence-software-setup-exe-file-v3-6-0a/#unlock

AV Detection

Source: C:\Users\user\Downloads\Unconfirmed 761557.crdownload

Avira: detection malicious, Label: TR/Encoder.diukz

Source: C:\Users\user\Downloads\StarPRNT_PSA_3.6a_setup.EXE (copy)	Virustotal: Detection: 14%			Perma Link
Source: C:\Users\user\Downloads\StarPRNT_PSA_3.6a_setup.EXE (copy)	ReversingLabs: Detection: 18%
Source: C:\Users\user\Downloads\Unconfirmed 761557.crdownload	ReversingLabs: Detection: 18%
Source: C:\Users\user\Downloads\Unconfirmed 761557.crdownload	Virustotal: Detection: 14%			Perma Link

Phishing

Source: https://starmicronics.com/support/download/starprnt-intelligence-software-setup-exe-file-v3-6-0a/#unlock	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-MVB48PL
Source: https://starmicronics.com/support/download/starprnt-intelligence-software-setup-exe-file-v3-6-0a/#unlock	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-MVB48PL
Source: https://starmicronics.com/support/download/starprnt-intelligence-software-setup-exe-file-v3-6-0a/#unlock	HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/649810871?random=1714036509589&cv=11&fst=1714036509589&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44o0v885466289za200&gcd=13l3l3l3l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fstarmicronics.com%2Fsupport%2Fdownload%2Fstarprnt-intelligence-software-setup-exe-file-v3-6-0a%2F&hn=www.googleadservices.com&frm=0&tiba=StarPRNT%20Intelligence%20Software%20Setup%20EXE%20File%20V3.6.0a%20-%20Global%20Support%20Center&did=dZTQ1Zm&gdid=dZTQ1Zm&npa=0&pscdl=noapi&auid=35269872.1714036510&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config
Source: https://starmicronics.com/support/download/starprnt-intelligence-software-setup-exe-file-v3-6-0a/#unlock	HTTP Parser: Iframe src: https://starmicronics.com/support/?__wpdmlo=2832&&REFERRER=https://starmicronics.com/support/download/starprnt-intelligence-software-setup-exe-file-v3-6-0a/#unlock
Source: https://starmicronics.com/support/download/starprnt-intelligence-software-setup-exe-file-v3-6-0a/#unlock	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-MVB48PL
Source: https://starmicronics.com/support/download/starprnt-intelligence-software-setup-exe-file-v3-6-0a/#unlock	HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/649810871?random=1714036509589&cv=11&fst=1714036509589&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44o0v885466289za200&gcd=13l3l3l3l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fstarmicronics.com%2Fsupport%2Fdownload%2Fstarprnt-intelligence-software-setup-exe-file-v3-6-0a%2F&hn=www.googleadservices.com&frm=0&tiba=StarPRNT%20Intelligence%20Software%20Setup%20EXE%20File%20V3.6.0a%20-%20Global%20Support%20Center&did=dZTQ1Zm&gdid=dZTQ1Zm&npa=0&pscdl=noapi&auid=35269872.1714036510&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config

Source: https://starmicronics.com/support/download/starprnt-intelligence-software-setup-exe-file-v3-6-0a/#unlock

HTTP Parser: <input type="password" .../> found but no <form action="...

Source: https://starmicronics.com/support/download/starprnt-intelligence-software-setup-exe-file-v3-6-0a/#unlock

HTTP Parser: Total embedded SVG size: 364194

Source: https://starmicronics.com/support/download/starprnt-intelligence-software-setup-exe-file-v3-6-0a/#unlock

HTTP Parser: Title: StarPRNT Intelligence Software Setup EXE File V3.6.0a - Global Support Center does not match URL

Source: https://starmicronics.com/support/download/starprnt-intelligence-software-setup-exe-file-v3-6-0a/#unlock

HTTP Parser: <input type="password" .../> found

Source: https://starmicronics.com/support/download/starprnt-intelligence-software-setup-exe-file-v3-6-0a/#unlock	HTTP Parser: No favicon
Source: https://starmicronics.com/support/download/starprnt-intelligence-software-setup-exe-file-v3-6-0a/#unlock	HTTP Parser: No favicon
Source: https://starmicronics.com/support/download/starprnt-intelligence-software-setup-exe-file-v3-6-0a/#unlock	HTTP Parser: No favicon
Source: https://starmicronics.com/support/?__wpdmlo=2832&&REFERRER=https://starmicronics.com/support/download/starprnt-intelligence-software-setup-exe-file-v3-6-0a/#unlock	HTTP Parser: No favicon
Source: https://starmicronics.com/support/?__wpdmlo=2832&&REFERRER=https://starmicronics.com/support/download/starprnt-intelligence-software-setup-exe-file-v3-6-0a/#unlock	HTTP Parser: No favicon

Source: https://starmicronics.com/support/download/starprnt-intelligence-software-setup-exe-file-v3-6-0a/#unlock	HTTP Parser: No <meta name="author".. found
Source: https://starmicronics.com/support/download/starprnt-intelligence-software-setup-exe-file-v3-6-0a/#unlock	HTTP Parser: No <meta name="author".. found
Source: https://starmicronics.com/support/download/starprnt-intelligence-software-setup-exe-file-v3-6-0a/#unlock	HTTP Parser: No <meta name="author".. found

Source: https://starmicronics.com/support/download/starprnt-intelligence-software-setup-exe-file-v3-6-0a/#unlock	HTTP Parser: No <meta name="copyright".. found
Source: https://starmicronics.com/support/download/starprnt-intelligence-software-setup-exe-file-v3-6-0a/#unlock	HTTP Parser: No <meta name="copyright".. found
Source: https://starmicronics.com/support/download/starprnt-intelligence-software-setup-exe-file-v3-6-0a/#unlock	HTTP Parser: No <meta name="copyright".. found

Compliance

Source:

Binary string: wextract.pdb source: StarPRNT_PSA_3.6a_setup.EXE, 0000000D.00000000.1704133237.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Unconfirmed 761557.crdownload.0.dr, bc1c1098-2c1a-48d8-a5a8-03f400a2a42a.tmp.0.dr

Networking

Source: chromecache_243.1.dr	String found in binary or memory: Math.round(p);v["gtm.videoCurrentTime"]=Math.round(q);v["gtm.videoElapsedTime"]=Math.round(f);v["gtm.videoPercent"]=r;v["gtm.videoVisible"]=t;return v},Qj:function(){e=zb()},sd:function(){d()}}};var dc=ka(["data-gtm-yt-inspected-"]),AC=["www.youtube.com","www.youtube-nocookie.com"],BC,CC=!1; equals www.youtube.com (Youtube)
Source: chromecache_243.1.dr	String found in binary or memory: c?"runIfCanceled":"runIfUncanceled",[]);if(!g.length)return!0;var h=iA(a,c,e);M(121);if("https://www.facebook.com/tr/"===h["gtm.elementUrl"])return M(122),!0;if(d&&f){for(var m=Jb(b,g.length),n=0;n<g.length;++n)g[n](h,m);return m.done}for(var p=0;p<g.length;++p)g[p](h,function(){});return!0},lA=function(){var a=[],b=function(c){return pb(a,function(d){return d.form===c})};return{store:function(c,d){var e=b(c);e?e.button=d:a.push({form:c,button:d})},get:function(c){var d=b(c);return d?d.button:null}}}, equals www.facebook.com (Facebook)
Source: chromecache_243.1.dr	String found in binary or memory: e||f||g.length||h.length))return;var n={Xg:d,Vg:e,Wg:f,Ih:g,Jh:h,ye:m,Ab:b},p=D.YT,q=function(){IC(n)};if(p)return p.ready&&p.ready(q),b;var r=D.onYouTubeIframeAPIReady;D.onYouTubeIframeAPIReady=function(){r&&r();q()};I(function(){for(var t=H.getElementsByTagName("script"),u=t.length,v=0;v<u;v++){var w=t[v].getAttribute("src");if(LC(w,"iframe_api")||LC(w,"player_api"))return b}for(var x=H.getElementsByTagName("iframe"),y=x.length,A=0;A<y;A++)if(!CC&&JC(x[A],n.ye))return tc("https://www.youtube.com/iframe_api"), equals www.youtube.com (Youtube)
Source: chromecache_323.1.dr, chromecache_310.1.dr	String found in binary or memory: return b}yC.J="internal.enableAutoEventOnTimer";var dc=ka(["data-gtm-yt-inspected-"]),AC=["www.youtube.com","www.youtube-nocookie.com"],BC,CC=!1; equals www.youtube.com (Youtube)
Source: chromecache_243.1.dr	String found in binary or memory: var NB=function(a,b,c,d,e){var f=Jz("fsl",c?"nv.mwt":"mwt",0),g;g=c?Jz("fsl","nv.ids",[]):Jz("fsl","ids",[]);if(!g.length)return!0;var h=Fz(a,"gtm.formSubmit",g),m=a.action;m&&m.tagName&&(m=a.cloneNode(!1).action);M(121);if("https://www.facebook.com/tr/"===m)return M(122),!0;h["gtm.elementUrl"]=m;h["gtm.formCanceled"]=c;null!=a.getAttribute("name")&&(h["gtm.interactedFormName"]=a.getAttribute("name"));e&&(h["gtm.formSubmitElement"]=e,h["gtm.formSubmitElementText"]=e.value);if(d&&f){if(!uy(h,vy(b, equals www.facebook.com (Facebook)

Source: chromecache_248.1.dr	String found in binary or memory: http://api.jqueryui.com/position/
Source: chromecache_315.1.dr	String found in binary or memory: http://hilios.github.io/jQuery.countdown/)
Source: chromecache_346.1.dr	String found in binary or memory: http://hubs.ly/H0702_H0
Source: chromecache_248.1.dr	String found in binary or memory: http://jquery.org/license
Source: chromecache_248.1.dr	String found in binary or memory: http://jqueryui.com
Source: chromecache_315.1.dr	String found in binary or memory: http://masonry.desandro.com
Source: chromecache_315.1.dr	String found in binary or memory: http://robert-fleischmann.de)
Source: chromecache_315.1.dr	String found in binary or memory: http://tutorialzine.com/2011/09/shuffle-letters-effect-jquery/
Source: chromecache_318.1.dr, chromecache_329.1.dr	String found in binary or memory: http://www.hubspot.com
Source: chromecache_243.1.dr, chromecache_310.1.dr	String found in binary or memory: https://adservice.google.com/pagead/regclk
Source: chromecache_243.1.dr, chromecache_310.1.dr	String found in binary or memory: https://adservice.googlesyndication.com/pagead/regclk
Source: chromecache_244.1.dr	String found in binary or memory: https://bugs.chromium.org/p/chromium/issues/detail?id=378607
Source: chromecache_244.1.dr	String found in binary or memory: https://bugs.chromium.org/p/chromium/issues/detail?id=449857
Source: chromecache_244.1.dr	String found in binary or memory: https://bugs.chromium.org/p/chromium/issues/detail?id=470258
Source: chromecache_244.1.dr	String found in binary or memory: https://bugs.chromium.org/p/chromium/issues/detail?id=589347
Source: chromecache_244.1.dr	String found in binary or memory: https://bugs.jquery.com/ticket/13393
Source: chromecache_244.1.dr	String found in binary or memory: https://bugs.webkit.org/show_bug.cgi?id=136851
Source: chromecache_244.1.dr	String found in binary or memory: https://bugs.webkit.org/show_bug.cgi?id=137337
Source: chromecache_244.1.dr	String found in binary or memory: https://bugs.webkit.org/show_bug.cgi?id=29084
Source: chromecache_244.1.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=687787
Source: chromecache_323.1.dr, chromecache_243.1.dr, chromecache_310.1.dr	String found in binary or memory: https://cct.google/taggy/agent.js
Source: chromecache_358.1.dr, chromecache_281.1.dr	String found in binary or memory: https://cdn1.iconfinder.com/data/icons/hawcons/32/698558-icon-47-note-important-512.png
Source: chromecache_234.1.dr	String found in binary or memory: https://clients1.google.com/complete/search
Source: chromecache_244.1.dr	String found in binary or memory: https://developer.mozilla.org/en-US/docs/CSS/display
Source: chromecache_244.1.dr	String found in binary or memory: https://drafts.csswg.org/cssom/#common-serializing-idioms
Source: chromecache_244.1.dr	String found in binary or memory: https://drafts.csswg.org/cssom/#resolved-values
Source: chromecache_244.1.dr	String found in binary or memory: https://drafts.csswg.org/selectors/#relational
Source: chromecache_338.1.dr, chromecache_229.1.dr, chromecache_341.1.dr, chromecache_319.1.dr, chromecache_259.1.dr, chromecache_343.1.dr	String found in binary or memory: https://fontawesome.com
Source: chromecache_338.1.dr, chromecache_229.1.dr, chromecache_341.1.dr, chromecache_319.1.dr, chromecache_259.1.dr, chromecache_343.1.dr	String found in binary or memory: https://fontawesome.com/license/free
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOiCnqEu92Fr1Mu51QrEz0dL_nz.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOiCnqEu92Fr1Mu51QrEz4dL_nz.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOiCnqEu92Fr1Mu51QrEz8dL_nz.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOiCnqEu92Fr1Mu51QrEzAdLw.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOiCnqEu92Fr1Mu51QrEzMdL_nz.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOiCnqEu92Fr1Mu51QrEzQdL_nz.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOiCnqEu92Fr1Mu51QrEzwdL_nz.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOjCnqEu92Fr1Mu51S7ACc-CsTKlA.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOjCnqEu92Fr1Mu51S7ACc0CsTKlA.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOjCnqEu92Fr1Mu51S7ACc1CsTKlA.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOjCnqEu92Fr1Mu51S7ACc2CsTKlA.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOjCnqEu92Fr1Mu51S7ACc3CsTKlA.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOjCnqEu92Fr1Mu51S7ACc5CsTKlA.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOjCnqEu92Fr1Mu51S7ACc6CsQ.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOjCnqEu92Fr1Mu51TLBCc-CsTKlA.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOjCnqEu92Fr1Mu51TLBCc0CsTKlA.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOjCnqEu92Fr1Mu51TLBCc1CsTKlA.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOjCnqEu92Fr1Mu51TLBCc2CsTKlA.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOjCnqEu92Fr1Mu51TLBCc3CsTKlA.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOjCnqEu92Fr1Mu51TLBCc5CsTKlA.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOjCnqEu92Fr1Mu51TLBCc6CsQ.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOjCnqEu92Fr1Mu51TjASc-CsTKlA.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOjCnqEu92Fr1Mu51TjASc0CsTKlA.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOjCnqEu92Fr1Mu51TjASc1CsTKlA.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOjCnqEu92Fr1Mu51TjASc2CsTKlA.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOjCnqEu92Fr1Mu51TjASc3CsTKlA.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOjCnqEu92Fr1Mu51TjASc5CsTKlA.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOjCnqEu92Fr1Mu51TjASc6CsQ.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOjCnqEu92Fr1Mu51TzBic-CsTKlA.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOjCnqEu92Fr1Mu51TzBic0CsTKlA.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOjCnqEu92Fr1Mu51TzBic1CsTKlA.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOjCnqEu92Fr1Mu51TzBic2CsTKlA.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOjCnqEu92Fr1Mu51TzBic3CsTKlA.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOjCnqEu92Fr1Mu51TzBic5CsTKlA.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOjCnqEu92Fr1Mu51TzBic6CsQ.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOkCnqEu92Fr1MmgVxEIzIFKw.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOkCnqEu92Fr1MmgVxFIzIFKw.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOkCnqEu92Fr1MmgVxGIzIFKw.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOkCnqEu92Fr1MmgVxHIzIFKw.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOkCnqEu92Fr1MmgVxIIzI.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOkCnqEu92Fr1MmgVxLIzIFKw.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOkCnqEu92Fr1MmgVxMIzIFKw.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOkCnqEu92Fr1Mu51xEIzIFKw.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOkCnqEu92Fr1Mu51xFIzIFKw.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOkCnqEu92Fr1Mu51xGIzIFKw.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOkCnqEu92Fr1Mu51xHIzIFKw.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOkCnqEu92Fr1Mu51xIIzI.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOkCnqEu92Fr1Mu51xLIzIFKw.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOkCnqEu92Fr1Mu51xMIzIFKw.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fABc4EsA.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBxc4EsA.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fCBc4EsA.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fCRc4EsA.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fChc4EsA.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fCxc4EsA.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fABc4EsA.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBBc4.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBxc4EsA.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fCBc4EsA.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fCRc4EsA.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fChc4EsA.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fCxc4EsA.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfABc4EsA.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBxc4EsA.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfCBc4EsA.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfCRc4EsA.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfChc4EsA.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfCxc4EsA.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmYUtfABc4EsA.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmYUtfBBc4.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmYUtfBxc4EsA.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmYUtfCBc4EsA.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmYUtfCRc4EsA.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmYUtfChc4EsA.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmYUtfCxc4EsA.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4WxKOzY.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu5mxKOzY.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu72xKOzY.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu7GxKOzY.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu7WxKOzY.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu7mxKOzY.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/robotoslab/v34/BngMUXZYTXPIvIBgJJSb6ufA5qW54A.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/robotoslab/v34/BngMUXZYTXPIvIBgJJSb6ufB5qW54A.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/robotoslab/v34/BngMUXZYTXPIvIBgJJSb6ufC5qW54A.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/robotoslab/v34/BngMUXZYTXPIvIBgJJSb6ufD5qW54A.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/robotoslab/v34/BngMUXZYTXPIvIBgJJSb6ufJ5qW54A.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/robotoslab/v34/BngMUXZYTXPIvIBgJJSb6ufN5qU.woff2)
Source: chromecache_286.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/robotoslab/v34/BngMUXZYTXPIvIBgJJSb6ufO5qW54A.woff2)
Source: chromecache_224.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/rubik/v28/iJWZBXyIfDnIV5PNhY1KTN7Z-Yh-B4iFU0U1Z4Y.woff2)
Source: chromecache_224.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/rubik/v28/iJWZBXyIfDnIV5PNhY1KTN7Z-Yh-B4iFUkU1Z4Y.woff2)
Source: chromecache_224.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/rubik/v28/iJWZBXyIfDnIV5PNhY1KTN7Z-Yh-B4iFV0U1.woff2)
Source: chromecache_224.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/rubik/v28/iJWZBXyIfDnIV5PNhY1KTN7Z-Yh-B4iFVUU1Z4Y.woff2)
Source: chromecache_224.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/rubik/v28/iJWZBXyIfDnIV5PNhY1KTN7Z-Yh-B4iFWUU1Z4Y.woff2)
Source: chromecache_224.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/rubik/v28/iJWZBXyIfDnIV5PNhY1KTN7Z-Yh-B4iFWkU1Z4Y.woff2)
Source: chromecache_223.1.dr, chromecache_301.1.dr	String found in binary or memory: https://getbootstrap.com/)
Source: chromecache_290.1.dr	String found in binary or memory: https://github.com/john-doherty/swiped-events
Source: chromecache_244.1.dr	String found in binary or memory: https://github.com/jquery/jquery/pull/557)
Source: chromecache_244.1.dr	String found in binary or memory: https://github.com/jquery/sizzle/issues/157)
Source: chromecache_244.1.dr	String found in binary or memory: https://github.com/jquery/sizzle/issues/299)
Source: chromecache_244.1.dr	String found in binary or memory: https://github.com/jquery/sizzle/pull/225
Source: chromecache_244.1.dr	String found in binary or memory: https://github.com/jrburke/requirejs/wiki/Updating-existing-libraries#wiki-anon
Source: chromecache_303.1.dr	String found in binary or memory: https://github.com/microsoft/clarity
Source: chromecache_302.1.dr	String found in binary or memory: https://github.com/selectize/selectize.js
Source: chromecache_223.1.dr, chromecache_301.1.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: chromecache_223.1.dr, chromecache_301.1.dr	String found in binary or memory: https://github.com/twbs/bootstrap/graphs/contributors)
Source: chromecache_244.1.dr	String found in binary or memory: https://github.com/whatwg/html/issues/2369
Source: chromecache_350.1.dr	String found in binary or memory: https://github.com/zloirock/core-js
Source: chromecache_350.1.dr	String found in binary or memory: https://github.com/zloirock/core-js/blob/v3.32.0/LICENSE
Source: chromecache_310.1.dr	String found in binary or memory: https://google.com
Source: chromecache_310.1.dr	String found in binary or memory: https://googleads.g.doubleclick.net
Source: chromecache_244.1.dr	String found in binary or memory: https://html.spec.whatwg.org/#nonce-attributes
Source: chromecache_244.1.dr	String found in binary or memory: https://html.spec.whatwg.org/#strip-and-collapse-whitespace
Source: chromecache_244.1.dr	String found in binary or memory: https://html.spec.whatwg.org/multipage/forms.html#category-listed
Source: chromecache_244.1.dr	String found in binary or memory: https://html.spec.whatwg.org/multipage/forms.html#concept-fe-disabled
Source: chromecache_244.1.dr	String found in binary or memory: https://html.spec.whatwg.org/multipage/forms.html#concept-option-disabled
Source: chromecache_244.1.dr	String found in binary or memory: https://html.spec.whatwg.org/multipage/scripting.html#selector-disabled
Source: chromecache_244.1.dr	String found in binary or memory: https://html.spec.whatwg.org/multipage/scripting.html#selector-enabled
Source: chromecache_244.1.dr	String found in binary or memory: https://html.spec.whatwg.org/multipage/syntax.html#attributes-2
Source: chromecache_244.1.dr	String found in binary or memory: https://infra.spec.whatwg.org/#strip-and-collapse-ascii-whitespace
Source: chromecache_315.1.dr	String found in binary or memory: https://isotope.metafizzy.co
Source: chromecache_244.1.dr	String found in binary or memory: https://jquery.com/
Source: chromecache_244.1.dr	String found in binary or memory: https://jquery.org/license
Source: chromecache_318.1.dr	String found in binary or memory: https://js-na1.hs-scripts.com/22657350.js
Source: chromecache_346.1.dr	String found in binary or memory: https://js.hs-analytics.net/analytics/1714036500000/22657350.js
Source: chromecache_329.1.dr	String found in binary or memory: https://js.hs-banner.com/v2
Source: chromecache_346.1.dr	String found in binary or memory: https://js.hs-banner.com/v2/22657350/banner.js
Source: chromecache_346.1.dr	String found in binary or memory: https://js.hsadspixel.net/fb.js
Source: chromecache_346.1.dr	String found in binary or memory: https://js.hscollectedforms.net/collectedforms.js
Source: chromecache_346.1.dr	String found in binary or memory: https://js.usemessages.com/conversations-embed.js
Source: chromecache_296.1.dr	String found in binary or memory: https://jsfiddle.net/6spj1059/
Source: chromecache_244.1.dr	String found in binary or memory: https://jsperf.com/getall-vs-sizzle/2
Source: chromecache_260.1.dr	String found in binary or memory: https://knowledgebase.ajaxsearchpro.com/other/javascript-api
Source: chromecache_310.1.dr	String found in binary or memory: https://pagead2.googlesyndication.com
Source: chromecache_323.1.dr, chromecache_243.1.dr, chromecache_310.1.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=tcfe
Source: chromecache_244.1.dr	String found in binary or memory: https://promisesaplus.com/#point-48
Source: chromecache_244.1.dr	String found in binary or memory: https://promisesaplus.com/#point-54
Source: chromecache_244.1.dr	String found in binary or memory: https://promisesaplus.com/#point-57
Source: chromecache_244.1.dr	String found in binary or memory: https://promisesaplus.com/#point-59
Source: chromecache_244.1.dr	String found in binary or memory: https://promisesaplus.com/#point-61
Source: chromecache_244.1.dr	String found in binary or memory: https://promisesaplus.com/#point-64
Source: chromecache_244.1.dr	String found in binary or memory: https://promisesaplus.com/#point-75
Source: chromecache_290.1.dr	String found in binary or memory: https://stackoverflow.com/questions/16348031/disable-scrolling-when-touch-moving-certain-element
Source: chromecache_243.1.dr	String found in binary or memory: https://stats.g.doubleclick.net/g/collect
Source: chromecache_243.1.dr	String found in binary or memory: https://stats.g.doubleclick.net/g/collect?v=2&
Source: chromecache_252.1.dr	String found in binary or memory: https://swiperjs.com
Source: chromecache_323.1.dr, chromecache_243.1.dr, chromecache_310.1.dr	String found in binary or memory: https://td.doubleclick.net
Source: chromecache_310.1.dr	String found in binary or memory: https://www.google.com
Source: chromecache_246.1.dr	String found in binary or memory: https://www.google.com/pagead/1p-user-list/649810871/?random
Source: chromecache_310.1.dr	String found in binary or memory: https://www.googleadservices.com
Source: chromecache_323.1.dr, chromecache_243.1.dr, chromecache_310.1.dr	String found in binary or memory: https://www.googletagmanager.com
Source: chromecache_243.1.dr	String found in binary or memory: https://www.merchant-center-analytics.goog
Source: chromecache_243.1.dr	String found in binary or memory: https://www.youtube.com/iframe_api

System Summary

Source: Unconfirmed 761557.crdownload.0.dr

Static PE information: Resource name: RT_RCDATA type: Microsoft Cabinet archive data, many, 194613639 bytes, 6 files, at 0x2c +A "Data_x64.cab" +A "Data_x86.cab", ID 12446, number 1, 9721 datablocks, 0x1503 compression

Source: bc1c1098-2c1a-48d8-a5a8-03f400a2a42a.tmp.0.dr

Static PE information: No import functions for PE file found

Source: bc1c1098-2c1a-48d8-a5a8-03f400a2a42a.tmp.0.dr

Static PE information: Data appended to the last section found

Source: classification engine

Classification label: mal56.win@23/282@0/55

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: C:\Windows\System32\rundll32.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://starmicronics.com/support/download/starprnt-intelligence-software-setup-exe-file-v3-6-0a/#unlock
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1956,i,18249929711046413500,14323128779850085663,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5580 --field-trial-handle=1956,i,18249929711046413500,14323128779850085663,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Users\user\Downloads\StarPRNT_PSA_3.6a_setup.EXE "C:\Users\user\Downloads\StarPRNT_PSA_3.6a_setup.EXE"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Users\user\Downloads\StarPRNT_PSA_3.6a_setup.EXE "C:\Users\user\Downloads\StarPRNT_PSA_3.6a_setup.EXE"
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: unknown	Process created: C:\Users\user\Downloads\StarPRNT_PSA_3.6a_setup.EXE "C:\Users\user\Downloads\StarPRNT_PSA_3.6a_setup.EXE"
Source: unknown	Process created: C:\Users\user\Downloads\StarPRNT_PSA_3.6a_setup.EXE "C:\Users\user\Downloads\StarPRNT_PSA_3.6a_setup.EXE"
Source: unknown	Process created: C:\Users\user\Downloads\StarPRNT_PSA_3.6a_setup.EXE "C:\Users\user\Downloads\StarPRNT_PSA_3.6a_setup.EXE"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1956,i,18249929711046413500,14323128779850085663,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5580 --field-trial-handle=1956,i,18249929711046413500,14323128779850085663,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source:

Binary string: wextract.pdb source: StarPRNT_PSA_3.6a_setup.EXE, 0000000D.00000000.1704133237.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Unconfirmed 761557.crdownload.0.dr, bc1c1098-2c1a-48d8-a5a8-03f400a2a42a.tmp.0.dr

Data Obfuscation

Source: bc1c1098-2c1a-48d8-a5a8-03f400a2a42a.tmp.0.dr

Static PE information: real checksum: 0xb9dd996 should be: 0x77da

Persistence and Installation Behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\Downloads\StarPRNT_PSA_3.6a_setup.EXE (copy)			Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\Downloads\bc1c1098-2c1a-48d8-a5a8-03f400a2a42a.tmp			Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\Downloads\Unconfirmed 761557.crdownload			Jump to dropped file

Boot Survival

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Source: C:\Windows\System32\rundll32.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior