Windows Analysis Report https://net-mpp-201-malakamenesbe.duckdns.org/kamalapene

AV Detection:

Antivirus / Scanner detection for submitted sample

Source: https://net-mpp-201-malakamenesbe.duckdns.org/kamalapene

SlashNext: detection malicious, Label: Fake Login Page type: Phishing & Social Engineering

Phishing:

No HTML title found

Source: https://net-mpp-201-malakamenesbe.duckdns.org/kamalapene/signin.php?84.17.52.45	HTTP Parser: HTML title missing
Source: https://net-mpp-201-malakamenesbe.duckdns.org/kamalapene/signin.php?84.17.52.45	HTTP Parser: HTML title missing

HTML body contains low number of good links

Source: https://net-mpp-201-malakamenesbe.duckdns.org/kamalapene/signin.php?84.17.52.45	HTTP Parser: Number of links: 0
Source: https://net-mpp-201-malakamenesbe.duckdns.org/kamalapene/signin.php?84.17.52.45	HTTP Parser: Number of links: 0

Invalid T&C link found

Source: https://net-mpp-201-malakamenesbe.duckdns.org/kamalapene/signin.php?84.17.52.45	HTTP Parser: Invalid link: Need help?
Source: https://net-mpp-201-malakamenesbe.duckdns.org/kamalapene/signin.php?84.17.52.45	HTTP Parser: Invalid link: Gift card terms
Source: https://net-mpp-201-malakamenesbe.duckdns.org/kamalapene/signin.php?84.17.52.45	HTTP Parser: Invalid link: Terms of Use
Source: https://net-mpp-201-malakamenesbe.duckdns.org/kamalapene/signin.php?84.17.52.45	HTTP Parser: Invalid link: Need help?
Source: https://net-mpp-201-malakamenesbe.duckdns.org/kamalapene/signin.php?84.17.52.45	HTTP Parser: Invalid link: Gift card terms
Source: https://net-mpp-201-malakamenesbe.duckdns.org/kamalapene/signin.php?84.17.52.45	HTTP Parser: Invalid link: Terms of Use

META author tag missing

Source: https://net-mpp-201-malakamenesbe.duckdns.org/kamalapene/signin.php?84.17.52.45	HTTP Parser: No <meta name="author".. found
Source: https://net-mpp-201-malakamenesbe.duckdns.org/kamalapene/signin.php?84.17.52.45	HTTP Parser: No <meta name="author".. found

META copyright tag missing

Source: https://net-mpp-201-malakamenesbe.duckdns.org/kamalapene/signin.php?84.17.52.45	HTTP Parser: No <meta name="copyright".. found
Source: https://net-mpp-201-malakamenesbe.duckdns.org/kamalapene/signin.php?84.17.52.45	HTTP Parser: No <meta name="copyright".. found

Compliance:

Creates license or readme file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Temp\2804_941807809\LICENSE.txt

Jump to behavior

Creates a directory in C:\Program Files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic			Jump to behavior

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 157.245.249.180:443 -> 192.168.2.3:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 157.245.249.180:443 -> 192.168.2.3:49791 version: TLS 1.2

Networking:

Uses dynamic DNS services

Source: unknown

DNS query: name: net-mpp-201-malakamenesbe.duckdns.org

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Found strings which match to known social media urls

Source: Ruleset Data.0.dr	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: Filtering Rules.0.dr	String found in binary or memory: www.facebook.com/ajax/ads/ equals www.facebook.com (Facebook)
Source: Filtering Rules.0.dr	String found in binary or memory: www.facebook.com0 equals www.facebook.com (Facebook)

Tries to download or post to a non-existing HTTP route (HTTP/1.1 404 Not Found / 503 Service Unavailable / 403 Forbidden)

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 28 Oct 2021 06:11:28 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1

URLs found in memory or binary data

Source: angular.js.0.dr	String found in binary or memory: http://angularjs.org
Source: data_3.2.dr	String found in binary or memory: http://crl.pki.goog/gsr1/gsr1.crl0;
Source: data_3.2.dr	String found in binary or memory: http://crl.pki.goog/gtsr1/gtsr1.crl0W
Source: data_3.2.dr	String found in binary or memory: http://crls.pki.goog/gts1c3/QOvJ0N1sT2A.crl0
Source: data_3.2.dr	String found in binary or memory: http://crls.pki.goog/gts1c3/QqFxbi9M48c.crl0
Source: data_3.2.dr	String found in binary or memory: http://crls.pki.goog/gts1c3/zdATt0Ex_Fk.crl0
Source: angular.js.0.dr	String found in binary or memory: http://errors.angularjs.org/1.6.4-local
Source: pnacl_public_x86_64_pnacl_sz_nexe.0.dr	String found in binary or memory: http://llvm.org/):
Source: data_3.2.dr	String found in binary or memory: http://ocsp.pki.goog/gsr10)
Source: data_3.2.dr	String found in binary or memory: http://ocsp.pki.goog/gts1c301
Source: data_3.2.dr	String found in binary or memory: http://ocsp.pki.goog/gtsr100
Source: data_3.2.dr	String found in binary or memory: http://pki.goog/gsr1/gsr1.crt02
Source: data_3.2.dr	String found in binary or memory: http://pki.goog/repo/certs/gts1c3.der0
Source: data_3.2.dr	String found in binary or memory: http://pki.goog/repo/certs/gts1c3.der0M
Source: data_3.2.dr	String found in binary or memory: http://pki.goog/repo/certs/gtsr1.der04
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: http://tools.ietf.org/html/rfc1950
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01
Source: d6e28031-8585-4c84-afcb-ec9adaa9e953.tmp.2.dr, cde1ba53-169a-4594-82d7-cecf5b6f9d1c.tmp.2.dr, manifest.json.0.dr	String found in binary or memory: https://accounts.google.com
Source: craw_window.js.0.dr	String found in binary or memory: https://accounts.google.com/MergeSession
Source: d6e28031-8585-4c84-afcb-ec9adaa9e953.tmp.2.dr, cde1ba53-169a-4594-82d7-cecf5b6f9d1c.tmp.2.dr, manifest.json.0.dr	String found in binary or memory: https://apis.google.com
Source: mirroring_common.js.0.dr	String found in binary or memory: https://apis.google.com/js/client.js
Source: mirroring_common.js.0.dr	String found in binary or memory: https://castedumessaging-pa.googleapis.com/v1
Source: pnacl_public_x86_64_libcrt_platform_a.0.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-clang.git
Source: pnacl_public_x86_64_libcrt_platform_a.0.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-llvm.git
Source: d6e28031-8585-4c84-afcb-ec9adaa9e953.tmp.2.dr, cde1ba53-169a-4594-82d7-cecf5b6f9d1c.tmp.2.dr	String found in binary or memory: https://clients2.google.com
Source: mirroring_hangouts.js.0.dr, mirroring_cast_streaming.js.0.dr	String found in binary or memory: https://clients2.google.com/cr/report
Source: manifest.json1.0.dr, manifest.json3.0.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: d6e28031-8585-4c84-afcb-ec9adaa9e953.tmp.2.dr, cde1ba53-169a-4594-82d7-cecf5b6f9d1c.tmp.2.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://clients6.google.com
Source: pnacl_public_x86_64_ld_nexe.0.dr	String found in binary or memory: https://code.google.com/p/nativeclient/issues/entry
Source: pnacl_public_x86_64_ld_nexe.0.dr	String found in binary or memory: https://code.google.com/p/nativeclient/issues/entry%s:
Source: cde1ba53-169a-4594-82d7-cecf5b6f9d1c.tmp.2.dr	String found in binary or memory: https://content-autofill.googleapis.com
Source: data_1.2.dr	String found in binary or memory: https://content-autofill.googleapis.com/v1/pages/Chc2LjEuMTcxNS4xNDQyL2VuIChHR0xMKRIUCaYJdt8Tu0J-Egk
Source: data_1.2.dr	String found in binary or memory: https://content-autofill.googleapis.com/v1/pages/Chc2LjEuMTcxNS4xNDQyL2VuIChHR0xMKRIfCcc6T4C8hby9Egk
Source: manifest.json.0.dr	String found in binary or memory: https://content.googleapis.com
Source: mirroring_cast_streaming.js.0.dr, common.js.0.dr	String found in binary or memory: https://crash.corp.google.com/samples?reportid=&q=
Source: LICENSE.txt.0.dr	String found in binary or memory: https://creativecommons.org/.
Source: LICENSE.txt.0.dr	String found in binary or memory: https://creativecommons.org/compatiblelicenses
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://creativecommons.org/publicdomain/zero/1.0/.
Source: data_3.2.dr, data_2.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/apps-themes
Source: data_2.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/apps-themesCross-Origin-Resource-Policy:
Source: data_3.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/apps-themescross-origin-resource-policy:cross-origincross-origin-open
Source: data_3.2.dr, data_2.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/recaptcha
Source: data_2.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/recaptchaCross-Origin-Resource-Policy:
Source: data_3.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/recaptchacross-origin-resource-policy:cross-origincross-origin-opener
Source: data_2.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/apps-themes
Source: data_2.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/recaptcha
Source: Reporting and NEL.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/recaptchaX
Source: Reporting and NEL.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/recaptcha_
Source: 62c06b56-f470-4cfd-b7df-d0cd6fe7ad7e.tmp.2.dr, d6e28031-8585-4c84-afcb-ec9adaa9e953.tmp.2.dr, cde1ba53-169a-4594-82d7-cecf5b6f9d1c.tmp.2.dr, 86a8fd55-41b9-4eb8-bcb3-47a468b062b6.tmp.2.dr	String found in binary or memory: https://dns.google
Source: mirroring_common.js.0.dr	String found in binary or memory: https://docs.google.com
Source: LICENSE.txt.0.dr	String found in binary or memory: https://easylist.to/)
Source: manifest.json.0.dr	String found in binary or memory: https://feedback.googleusercontent.com
Source: d6e28031-8585-4c84-afcb-ec9adaa9e953.tmp.2.dr	String found in binary or memory: https://fonts.googleapis.com
Source: manifest.json.0.dr	String found in binary or memory: https://fonts.googleapis.com;
Source: d6e28031-8585-4c84-afcb-ec9adaa9e953.tmp.2.dr, cde1ba53-169a-4594-82d7-cecf5b6f9d1c.tmp.2.dr	String found in binary or memory: https://fonts.gstatic.com
Source: Network Action Predictor.0.dr	String found in binary or memory: https://fonts.gstatic.com/
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v18/mem5YaGs126MiZpBA-UN7rgOUuhp.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v18/mem8YaGs126MiZpBA-UFVZ0b.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v18/mem8YaGs126MiZpBA-UFVZ0b.woff2D
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2%a
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmWUlfBBc4.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmWUlfBBc4.woff2d
Source: manifest.json.0.dr	String found in binary or memory: https://fonts.gstatic.com;
Source: material_css_min.css.0.dr	String found in binary or memory: https://github.com/angular/material
Source: LICENSE.txt.0.dr	String found in binary or memory: https://github.com/easylist)
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://github.com/madler/zlib/blob/master/zlib.h
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://hangouts.clients6.google.com
Source: manifest.json.0.dr	String found in binary or memory: https://hangouts.google.com/
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://hangouts.google.com/hangouts/_/logpref
Source: mirroring_common.js.0.dr	String found in binary or memory: https://meet.google.com
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://meetings.clients6.google.com
Source: 000003.log4.0.dr	String found in binary or memory: https://net-mpp-201-malakamenesbe.duckdns.org
Source: Network Action Predictor.0.dr	String found in binary or memory: https://net-mpp-201-malakamenesbe.duckdns.org/
Source: data_1.2.dr	String found in binary or memory: https://net-mpp-201-malakamenesbe.duckdns.org/favicon.ico
Source: Current Session.0.dr, History.0.dr	String found in binary or memory: https://net-mpp-201-malakamenesbe.duckdns.org/kamalapene
Source: Current Session.0.dr, data_2.2.dr	String found in binary or memory: https://net-mpp-201-malakamenesbe.duckdns.org/kamalapene/
Source: History Provider Cache.0.dr	String found in binary or memory: https://net-mpp-201-malakamenesbe.duckdns.org/kamalapene/2
Source: data_2.2.dr	String found in binary or memory: https://net-mpp-201-malakamenesbe.duckdns.org/kamalapene/Content-Length:
Source: History.0.dr	String found in binary or memory: https://net-mpp-201-malakamenesbe.duckdns.org/kamalapene/Watch
Source: data_1.2.dr	String found in binary or memory: https://net-mpp-201-malakamenesbe.duckdns.org/kamalapene/page1/css/1.png
Source: data_1.2.dr	String found in binary or memory: https://net-mpp-201-malakamenesbe.duckdns.org/kamalapene/page1/css/2.jpg
Source: data_1.2.dr	String found in binary or memory: https://net-mpp-201-malakamenesbe.duckdns.org/kamalapene/page1/css/2.jpgG
Source: data_1.2.dr	String found in binary or memory: https://net-mpp-201-malakamenesbe.duckdns.org/kamalapene/page1/css/css.css
Source: data_1.2.dr	String found in binary or memory: https://net-mpp-201-malakamenesbe.duckdns.org/kamalapene/page1/css/nicepage.css
Source: data_1.2.dr	String found in binary or memory: https://net-mpp-201-malakamenesbe.duckdns.org/kamalapene/page1/css/nicepage.cssq
Source: data_1.2.dr	String found in binary or memory: https://net-mpp-201-malakamenesbe.duckdns.org/kamalapene/page1/css/nicepage.js
Source: data_1.2.dr	String found in binary or memory: https://net-mpp-201-malakamenesbe.duckdns.org/kamalapene/page1/css/unnamed6.png
Source: Current Session.0.dr	String found in binary or memory: https://net-mpp-201-malakamenesbe.duckdns.org/kamalapene/signin.php
Source: Current Session.0.dr	String found in binary or memory: https://net-mpp-201-malakamenesbe.duckdns.org/kamalapene/signin.php?84.17.52.45
Source: History.0.dr	String found in binary or memory: https://net-mpp-201-malakamenesbe.duckdns.org/kamalapene/signin.php?84.17.52.45Logg
Source: data_1.2.dr	String found in binary or memory: https://net-mpp-201-malakamenesbe.duckdns.org/kamalapene/unlock.php
Source: History.0.dr	String found in binary or memory: https://net-mpp-201-malakamenesbe.duckdns.org/kamalapene/unlock.phpLogg
Source: History Provider Cache.0.dr	String found in binary or memory: https://net-mpp-201-malakamenesbe.duckdns.org/kamalapene2
Source: History.0.dr	String found in binary or memory: https://net-mpp-201-malakamenesbe.duckdns.org/kamalapeneWatch
Source: mirroring_common.js.0.dr	String found in binary or memory: https://networktraversal.googleapis.com/v1alpha
Source: d6e28031-8585-4c84-afcb-ec9adaa9e953.tmp.2.dr, cde1ba53-169a-4594-82d7-cecf5b6f9d1c.tmp.2.dr	String found in binary or memory: https://ogs.google.com
Source: craw_window.js.0.dr, manifest.json3.0.dr	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: data_3.2.dr	String found in binary or memory: https://pki.goog/repository/0
Source: d6e28031-8585-4c84-afcb-ec9adaa9e953.tmp.2.dr, cde1ba53-169a-4594-82d7-cecf5b6f9d1c.tmp.2.dr	String found in binary or memory: https://play.google.com
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://preprod-hangouts-googleapis.sandbox.google.com
Source: cde1ba53-169a-4594-82d7-cecf5b6f9d1c.tmp.2.dr	String found in binary or memory: https://r4---sn-4g5e6nss.gvt1.com
Source: data_1.2.dr	String found in binary or memory: https://r4---sn-4g5e6nss.gvt1.com/edgedl/chrome/dict/en-us-9-0.bdic?cms_redirect=yes&mh=I2&mip=84.17
Source: cde1ba53-169a-4594-82d7-cecf5b6f9d1c.tmp.2.dr	String found in binary or memory: https://redirector.gvt1.com
Source: data_1.2.dr	String found in binary or memory: https://redirector.gvt1.com/edgedl/chrome/dict/en-us-9-0.bdic
Source: craw_window.js.0.dr, manifest.json3.0.dr	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: d6e28031-8585-4c84-afcb-ec9adaa9e953.tmp.2.dr, cde1ba53-169a-4594-82d7-cecf5b6f9d1c.tmp.2.dr	String found in binary or memory: https://ssl.gstatic.com
Source: messages.json41.0.dr, feedback.html.0.dr	String found in binary or memory: https://support.google.com/chromecast/answer/2998456
Source: messages.json41.0.dr, feedback.html.0.dr	String found in binary or memory: https://support.google.com/chromecast/troubleshooter/2995236
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://www-googleapis-staging.sandbox.google.com
Source: 000003.log4.0.dr	String found in binary or memory: https://www.google.com
Source: QuotaManager.0.dr	String found in binary or memory: https://www.google.com/
Source: QuotaManager.0.dr	String found in binary or memory: https://www.google.com//.
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/accounts/OAuthLogin?issueuberauth=1
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/cleardot.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/dot2.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/x2.gif
Source: craw_background.js.0.dr	String found in binary or memory: https://www.google.com/intl/en-US/chrome/blank.html
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://www.google.com/log?format=json&hasfast=true
Source: data_1.2.dr	String found in binary or memory: https://www.google.com/recaptcha/api.js
Source: data_1.2.dr	String found in binary or memory: https://www.google.com/recaptcha/api2/
Source: Current Session.0.dr	String found in binary or memory: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LemFfccAAAAAIylO-e15IOQPxopFUGBXNw3Kwqu&co=aHR0
Source: data_1.2.dr	String found in binary or memory: https://www.google.com/recaptcha/api2/webworker.js?hl=en&v=YhkYx1k-yvvb8OonJPmOpoJY
Source: data_1.2.dr	String found in binary or memory: https://www.google.com/recaptcha/api2/webworker.js?hl=en&v=YhkYx1k-yvvb8OonJPmOpoJYI
Source: feedback_script.js.0.dr	String found in binary or memory: https://www.google.com/tools/feedback
Source: Current Session.0.dr	String found in binary or memory: https://www.google.com5-https://net-mpp-201-malakamenesbe.duckdns.org
Source: Current Session.0.dr	String found in binary or memory: https://www.google.com5-https://net-mpp-201-malakamenesbe.duckdns.orgh
Source: manifest.json.0.dr	String found in binary or memory: https://www.google.com;
Source: Current Session.0.dr	String found in binary or memory: https://www.google.comh
Source: d6e28031-8585-4c84-afcb-ec9adaa9e953.tmp.2.dr, craw_window.js.0.dr, craw_background.js.0.dr, cde1ba53-169a-4594-82d7-cecf5b6f9d1c.tmp.2.dr	String found in binary or memory: https://www.googleapis.com
Source: manifest.json3.0.dr	String found in binary or memory: https://www.googleapis.com/
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/calendar.readonly
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/cast-edu-messaging
Source: manifest.json3.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json3.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/clouddevices
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/hangouts
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/hangouts.readonly
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/meetings
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.peopleapi.readwrite
Source: manifest.json3.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json3.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/userinfo.email
Source: mirroring_common.js.0.dr	String found in binary or memory: https://www.googleapis.com/calendar/v3
Source: mirroring_common.js.0.dr	String found in binary or memory: https://www.googleapis.com/hangouts/v1
Source: d6e28031-8585-4c84-afcb-ec9adaa9e953.tmp.2.dr, cde1ba53-169a-4594-82d7-cecf5b6f9d1c.tmp.2.dr	String found in binary or memory: https://www.gstatic.com
Source: common.js.0.dr	String found in binary or memory: https://www.gstatic.com/hangouts_echo_detector/release/%
Source: data_1.2.dr	String found in binary or memory: https://www.gstatic.com/recaptcha/api2/logo_48.png
Source: data_1.2.dr	String found in binary or memory: https://www.gstatic.com/recaptcha/api2/logo_48.pngQ
Source: data_1.2.dr	String found in binary or memory: https://www.gstatic.com/recaptcha/releases/YhkYx1k-yvvb8OonJPmOpoJY/recaptcha__en.js
Source: data_1.2.dr	String found in binary or memory: https://www.gstatic.com/recaptcha/releases/YhkYx1k-yvvb8OonJPmOpoJY/recaptcha__en.js.
Source: data_1.2.dr	String found in binary or memory: https://www.gstatic.com/recaptcha/releases/YhkYx1k-yvvb8OonJPmOpoJY/styles__ltr.css
Source: data_1.2.dr	String found in binary or memory: https://www.gstatic.com/recaptcha/releases/YhkYx1k-yvvb8OonJPmOpoJY/styles__ltr.cssCgkKBw1TWkfFGgA=
Source: manifest.json.0.dr	String found in binary or memory: https://www.gstatic.com;

Posts data to webserver

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: clients2.google.com

Downloads files from webservers via HTTP

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-85.0.4183.121Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /kamalapene HTTP/1.1Host: net-mpp-201-malakamenesbe.duckdns.orgConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /kamalapene/ HTTP/1.1Host: net-mpp-201-malakamenesbe.duckdns.orgConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api.js HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://net-mpp-201-malakamenesbe.duckdns.org/kamalapene/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2 HTTP/1.1Host: fonts.gstatic.comConnection: keep-aliveOrigin: https://www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LemFfccAAAAAIylO-e15IOQPxopFUGBXNw3Kwqu&co=aHR0cHM6Ly9uZXQtbXBwLTIwMS1tYWxha2FtZW5lc2JlLmR1Y2tkbnMub3JnOjQ0Mw..&hl=en&v=YhkYx1k-yvvb8OonJPmOpoJY&size=invisible&cb=3ec1f65yv3otAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2 HTTP/1.1Host: fonts.gstatic.comConnection: keep-aliveOrigin: https://www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LemFfccAAAAAIylO-e15IOQPxopFUGBXNw3Kwqu&co=aHR0cHM6Ly9uZXQtbXBwLTIwMS1tYWxha2FtZW5lc2JlLmR1Y2tkbnMub3JnOjQ0Mw..&hl=en&v=YhkYx1k-yvvb8OonJPmOpoJY&size=invisible&cb=3ec1f65yv3otAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: net-mpp-201-malakamenesbe.duckdns.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://net-mpp-201-malakamenesbe.duckdns.org/kamalapene/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=76b2b209bcad21f078e70dee4d6485ff
Source: global traffic	HTTP traffic detected: GET /crx/blobs/Acy1k0bLIjHsvnKaKN_oRpVaYYvFs25d7GKYF1WXrT6yizCMksBO0c_ggE0B6tx6HPRHe6q1GOEe3_NcIbSiGG8kXeLMUY0sAKVvC6R89zvKM13s5VqoAMZSmuUgjQL5vlygJuArQghXXE_qTL7NlQ/extension_8520_615_0_5.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /kamalapene/signin.php?84.17.52.45 HTTP/1.1Host: net-mpp-201-malakamenesbe.duckdns.orgConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://net-mpp-201-malakamenesbe.duckdns.org/kamalapene/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=76b2b209bcad21f078e70dee4d6485ff
Source: global traffic	HTTP traffic detected: GET /kamalapene/signin.php?84.17.52.45 HTTP/1.1Host: net-mpp-201-malakamenesbe.duckdns.orgConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://net-mpp-201-malakamenesbe.duckdns.org/kamalapene/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=76b2b209bcad21f078e70dee4d6485ff
Source: global traffic	HTTP traffic detected: GET /kamalapene/signin.php?84.17.52.45 HTTP/1.1Host: net-mpp-201-malakamenesbe.duckdns.orgConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://net-mpp-201-malakamenesbe.duckdns.org/kamalapene/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=76b2b209bcad21f078e70dee4d6485ff
Source: global traffic	HTTP traffic detected: GET /kamalapene/page1/css/nicepage.css HTTP/1.1Host: net-mpp-201-malakamenesbe.duckdns.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://net-mpp-201-malakamenesbe.duckdns.org/kamalapene/signin.php?84.17.52.45Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=76b2b209bcad21f078e70dee4d6485ff
Source: global traffic	HTTP traffic detected: GET /kamalapene/page1/css/css.css HTTP/1.1Host: net-mpp-201-malakamenesbe.duckdns.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://net-mpp-201-malakamenesbe.duckdns.org/kamalapene/signin.php?84.17.52.45Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=76b2b209bcad21f078e70dee4d6485ff
Source: global traffic	HTTP traffic detected: GET /kamalapene/page1/css/nicepage.js HTTP/1.1Host: net-mpp-201-malakamenesbe.duckdns.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://net-mpp-201-malakamenesbe.duckdns.org/kamalapene/signin.php?84.17.52.45Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=76b2b209bcad21f078e70dee4d6485ff
Source: global traffic	HTTP traffic detected: GET /kamalapene/page1/css/1.png HTTP/1.1Host: net-mpp-201-malakamenesbe.duckdns.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://net-mpp-201-malakamenesbe.duckdns.org/kamalapene/signin.php?84.17.52.45Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=76b2b209bcad21f078e70dee4d6485ff
Source: global traffic	HTTP traffic detected: GET /kamalapene/page1/css/unnamed6.png HTTP/1.1Host: net-mpp-201-malakamenesbe.duckdns.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://net-mpp-201-malakamenesbe.duckdns.org/kamalapene/signin.php?84.17.52.45Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=76b2b209bcad21f078e70dee4d6485ff
Source: global traffic	HTTP traffic detected: GET /kamalapene/page1/css/2.jpg HTTP/1.1Host: net-mpp-201-malakamenesbe.duckdns.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://net-mpp-201-malakamenesbe.duckdns.org/kamalapene/page1/css/nicepage.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=76b2b209bcad21f078e70dee4d6485ff
Source: global traffic	HTTP traffic detected: GET /kamalapene/page1/css/1.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: net-mpp-201-malakamenesbe.duckdns.org
Source: global traffic	HTTP traffic detected: GET /kamalapene/page1/css/unnamed6.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: net-mpp-201-malakamenesbe.duckdns.org

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 157.245.249.180:443 -> 192.168.2.3:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 157.245.249.180:443 -> 192.168.2.3:49791 version: TLS 1.2

System Summary:

Spawns processes

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --start-maximized --enable-automation 'https://net-mpp-201-malakamenesbe.duckdns.org/kamalapene'
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1544,1267013876570044374,13186876607125913018,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1916 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1544,1267013876570044374,13186876607125913018,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1916 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior

Found detection on Joe Sandbox Cloud Basic with higher score

Source: https://net-mpp-201-malakamenesbe.duckdns.org/kamalapene

Joe Sandbox Cloud Basic: Detection: clean Score: 0

Perma Link

Creates files inside the program directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\Chrome\Application\Dictionaries

Jump to behavior

Creates files inside the user directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-617ABD9A-AF4.pma

Jump to behavior

Creates temporary files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Temp\1686e55c-1df9-480e-a029-b0f3846af7b6.tmp

Jump to behavior

Classification label

Source: classification engine

Classification label: mal52.troj.win@34/257@6/9

SQL strings found in memory and binary data

Source: QuotaManager.0.dr

Binary or memory string: CREATE TABLE HostQuotaTable(host TEXT NOT NULL, type INTEGER NOT NULL, quota INTEGER DEFAULT 0, UNIQUE(host, type));

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Creates a directory in C:\Program Files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic			Jump to behavior

Persistence and Installation Behavior:

Creates license or readme file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Temp\2804_941807809\LICENSE.txt

Jump to behavior