Windows Analysis Report
nuno.palmeiro-validate.html

Phishing

Source: Yara match

File source: 25855.0.pages.csv, type: HTML

Source: Yara match

File source: nuno.palmeiro-validate.html, type: SAMPLE

Source: file:///C:/Users/user/Desktop/nuno.palmeiro-validate.html

Matcher: Template: microsoft matched

Source: file:///C:/Users/user/Desktop/nuno.palmeiro-validate.html

Matcher: Found strong image similarity, brand: Microsoft image: 25855.0.img.1.gfk.csv EE236805D05E24861CE1B6B0E7D94B8D

Source: file:///C:/Users/user/Desktop/nuno.palmeiro-validate.html	HTTP Parser: Has password / email / username input fields
Source: file:///C:/Users/user/Desktop/nuno.palmeiro-validate.html	HTTP Parser: Has password / email / username input fields

Source: file:///C:/Users/user/Desktop/nuno.palmeiro-validate.html	HTTP Parser: HTML title missing
Source: file:///C:/Users/user/Desktop/nuno.palmeiro-validate.html	HTTP Parser: HTML title missing

Source: file:///C:/Users/user/Desktop/nuno.palmeiro-validate.html	HTTP Parser: Number of links: 0
Source: file:///C:/Users/user/Desktop/nuno.palmeiro-validate.html	HTTP Parser: Number of links: 0

Source: file:///C:/Users/user/Desktop/nuno.palmeiro-validate.html	HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/user/Desktop/nuno.palmeiro-validate.html	HTTP Parser: No <meta name="author".. found

Source: file:///C:/Users/user/Desktop/nuno.palmeiro-validate.html	HTTP Parser: No <meta name="copyright".. found
Source: file:///C:/Users/user/Desktop/nuno.palmeiro-validate.html	HTTP Parser: No <meta name="copyright".. found

Compliance

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Temp\4284_439174981\LICENSE.txt

Jump to behavior

Source: unknown	HTTPS traffic detected: 151.101.112.193:443 -> 192.168.2.4:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.112.193:443 -> 192.168.2.4:49779 version: TLS 1.2

Networking

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View	IP Address: 151.101.112.193 151.101.112.193
Source: Joe Sandbox View	IP Address: 151.101.112.193 151.101.112.193

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Source: Ruleset Data.1.dr	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: Filtering Rules.1.dr, Ruleset Data.1.dr	String found in binary or memory: www.facebook.com/ajax/ads/ equals www.facebook.com (Facebook)
Source: Filtering Rules.1.dr	String found in binary or memory: www.facebook.com0 equals www.facebook.com (Facebook)

Source: angular.js.1.dr	String found in binary or memory: http://angularjs.org
Source: angular.js.1.dr	String found in binary or memory: http://errors.angularjs.org/1.6.4-local
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: http://tools.ietf.org/html/rfc1950
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01
Source: 342bf28f-5413-4f8f-b788-0d8675d43684.tmp.3.dr, manifest.json2.1.dr, 9f438101-4c53-43b0-8035-ce389d001772.tmp.3.dr, ab740f59-d7b9-4369-9a8a-3b84e3cd5b87.tmp.3.dr	String found in binary or memory: https://accounts.google.com
Source: craw_window.js.1.dr	String found in binary or memory: https://accounts.google.com/MergeSession
Source: 342bf28f-5413-4f8f-b788-0d8675d43684.tmp.3.dr, ab740f59-d7b9-4369-9a8a-3b84e3cd5b87.tmp.3.dr	String found in binary or memory: https://ajax.googleapis.com
Source: data_1.3.dr	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js
Source: 342bf28f-5413-4f8f-b788-0d8675d43684.tmp.3.dr, manifest.json2.1.dr, 9f438101-4c53-43b0-8035-ce389d001772.tmp.3.dr, ab740f59-d7b9-4369-9a8a-3b84e3cd5b87.tmp.3.dr	String found in binary or memory: https://apis.google.com
Source: mirroring_common.js.1.dr	String found in binary or memory: https://apis.google.com/js/client.js
Source: mirroring_common.js.1.dr	String found in binary or memory: https://castedumessaging-pa.googleapis.com/v1
Source: 342bf28f-5413-4f8f-b788-0d8675d43684.tmp.3.dr, 9f438101-4c53-43b0-8035-ce389d001772.tmp.3.dr, ab740f59-d7b9-4369-9a8a-3b84e3cd5b87.tmp.3.dr	String found in binary or memory: https://clients2.google.com
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: https://clients2.google.com/cr/report
Source: manifest.json0.1.dr, manifest.json2.1.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 342bf28f-5413-4f8f-b788-0d8675d43684.tmp.3.dr, 9f438101-4c53-43b0-8035-ce389d001772.tmp.3.dr, ab740f59-d7b9-4369-9a8a-3b84e3cd5b87.tmp.3.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: https://clients6.google.com
Source: manifest.json2.1.dr	String found in binary or memory: https://content.googleapis.com
Source: common.js.1.dr, mirroring_cast_streaming.js.1.dr	String found in binary or memory: https://crash.corp.google.com/samples?reportid=&q=
Source: LICENSE.txt.1.dr	String found in binary or memory: https://creativecommons.org/.
Source: LICENSE.txt.1.dr	String found in binary or memory: https://creativecommons.org/compatiblelicenses
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: https://creativecommons.org/publicdomain/zero/1.0/.
Source: data_3.3.dr	String found in binary or memory: https://csp.withgoogle.com/csp/hosted-libraries-pushers
Source: data_3.3.dr	String found in binary or memory: https://csp.withgoogle.com/csp/hosted-libraries-pushersCross-Origin-Resource-Policy:
Source: data_3.3.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers
Source: 342bf28f-5413-4f8f-b788-0d8675d43684.tmp.3.dr, 96d37696-3451-440f-991e-4fee5726742d.tmp.3.dr, ff162f2e-ac68-41a7-8875-09813a5a9d80.tmp.3.dr, 9f438101-4c53-43b0-8035-ce389d001772.tmp.3.dr, ab740f59-d7b9-4369-9a8a-3b84e3cd5b87.tmp.3.dr	String found in binary or memory: https://dns.google
Source: mirroring_common.js.1.dr	String found in binary or memory: https://docs.google.com
Source: LICENSE.txt.1.dr	String found in binary or memory: https://easylist.to/)
Source: manifest.json2.1.dr	String found in binary or memory: https://feedback.googleusercontent.com
Source: 342bf28f-5413-4f8f-b788-0d8675d43684.tmp.3.dr, 9f438101-4c53-43b0-8035-ce389d001772.tmp.3.dr, ab740f59-d7b9-4369-9a8a-3b84e3cd5b87.tmp.3.dr	String found in binary or memory: https://fonts.googleapis.com
Source: manifest.json2.1.dr	String found in binary or memory: https://fonts.googleapis.com;
Source: 342bf28f-5413-4f8f-b788-0d8675d43684.tmp.3.dr, 9f438101-4c53-43b0-8035-ce389d001772.tmp.3.dr, ab740f59-d7b9-4369-9a8a-3b84e3cd5b87.tmp.3.dr	String found in binary or memory: https://fonts.gstatic.com
Source: manifest.json2.1.dr	String found in binary or memory: https://fonts.gstatic.com;
Source: angular.js.1.dr, material_css_min.css.1.dr	String found in binary or memory: https://github.com/angular/material
Source: LICENSE.txt.1.dr	String found in binary or memory: https://github.com/easylist)
Source: craw_background.js.1.dr, craw_window.js.1.dr	String found in binary or memory: https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: https://github.com/madler/zlib/blob/master/zlib.h
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: https://hangouts.clients6.google.com
Source: manifest.json2.1.dr	String found in binary or memory: https://hangouts.google.com/
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: https://hangouts.google.com/hangouts/_/logpref
Source: data_1.3.dr	String found in binary or memory: https://i.imgur.com/UeUQRKC.png
Source: data_1.3.dr	String found in binary or memory: https://i.imgur.com/h8YEvNH.png
Source: mirroring_common.js.1.dr	String found in binary or memory: https://meet.google.com
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: https://meetings.clients6.google.com
Source: mirroring_common.js.1.dr	String found in binary or memory: https://networktraversal.googleapis.com/v1alpha
Source: 342bf28f-5413-4f8f-b788-0d8675d43684.tmp.3.dr, 9f438101-4c53-43b0-8035-ce389d001772.tmp.3.dr, ab740f59-d7b9-4369-9a8a-3b84e3cd5b87.tmp.3.dr	String found in binary or memory: https://ogs.google.com
Source: manifest.json0.1.dr, craw_window.js.1.dr	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: 342bf28f-5413-4f8f-b788-0d8675d43684.tmp.3.dr, 9f438101-4c53-43b0-8035-ce389d001772.tmp.3.dr, ab740f59-d7b9-4369-9a8a-3b84e3cd5b87.tmp.3.dr	String found in binary or memory: https://play.google.com
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: https://preprod-hangouts-googleapis.sandbox.google.com
Source: 9f438101-4c53-43b0-8035-ce389d001772.tmp.3.dr	String found in binary or memory: https://r5---sn-h0jeln7l.gvt1.com
Source: 342bf28f-5413-4f8f-b788-0d8675d43684.tmp.3.dr, 9f438101-4c53-43b0-8035-ce389d001772.tmp.3.dr, ab740f59-d7b9-4369-9a8a-3b84e3cd5b87.tmp.3.dr	String found in binary or memory: https://redirector.gvt1.com
Source: manifest.json0.1.dr, craw_window.js.1.dr	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: 342bf28f-5413-4f8f-b788-0d8675d43684.tmp.3.dr, 9f438101-4c53-43b0-8035-ce389d001772.tmp.3.dr, ab740f59-d7b9-4369-9a8a-3b84e3cd5b87.tmp.3.dr	String found in binary or memory: https://ssl.gstatic.com
Source: messages.json83.1.dr, messages.json19.1.dr, messages.json52.1.dr, feedback.html.1.dr, messages.json80.1.dr, messages.json22.1.dr, messages.json37.1.dr, messages.json34.1.dr, messages.json54.1.dr, messages.json17.1.dr, messages.json3.1.dr, messages.json85.1.dr, messages.json20.1.dr, messages.json38.1.dr, messages.json4.1.dr, messages.json87.1.dr, messages.json86.1.dr, messages.json69.1.dr, messages.json1.1.dr, messages.json18.1.dr, messages.json39.1.dr	String found in binary or memory: https://support.google.com/chromecast/answer/2998456
Source: messages.json83.1.dr, messages.json19.1.dr, messages.json52.1.dr, feedback.html.1.dr, messages.json80.1.dr, messages.json22.1.dr, messages.json37.1.dr, messages.json34.1.dr, messages.json54.1.dr, messages.json17.1.dr, messages.json3.1.dr, messages.json85.1.dr, messages.json20.1.dr, messages.json38.1.dr, messages.json4.1.dr, messages.json87.1.dr, messages.json86.1.dr, messages.json69.1.dr, messages.json1.1.dr, messages.json18.1.dr, messages.json39.1.dr	String found in binary or memory: https://support.google.com/chromecast/troubleshooter/2995236
Source: craw_background.js.1.dr, craw_window.js.1.dr	String found in binary or memory: https://www-googleapis-staging.sandbox.google.com
Source: 342bf28f-5413-4f8f-b788-0d8675d43684.tmp.3.dr, manifest.json2.1.dr, 9f438101-4c53-43b0-8035-ce389d001772.tmp.3.dr, ab740f59-d7b9-4369-9a8a-3b84e3cd5b87.tmp.3.dr	String found in binary or memory: https://www.google.com
Source: manifest.json0.1.dr	String found in binary or memory: https://www.google.com/
Source: craw_window.js.1.dr	String found in binary or memory: https://www.google.com/accounts/OAuthLogin?issueuberauth=1
Source: craw_window.js.1.dr	String found in binary or memory: https://www.google.com/images/cleardot.gif
Source: craw_window.js.1.dr	String found in binary or memory: https://www.google.com/images/dot2.gif
Source: craw_window.js.1.dr	String found in binary or memory: https://www.google.com/images/x2.gif
Source: craw_background.js.1.dr	String found in binary or memory: https://www.google.com/intl/en-US/chrome/blank.html
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: https://www.google.com/log?format=json&hasfast=true
Source: feedback_script.js.1.dr	String found in binary or memory: https://www.google.com/tools/feedback
Source: manifest.json2.1.dr	String found in binary or memory: https://www.google.com;
Source: 342bf28f-5413-4f8f-b788-0d8675d43684.tmp.3.dr, craw_background.js.1.dr, craw_window.js.1.dr, 9f438101-4c53-43b0-8035-ce389d001772.tmp.3.dr, ab740f59-d7b9-4369-9a8a-3b84e3cd5b87.tmp.3.dr	String found in binary or memory: https://www.googleapis.com
Source: manifest.json0.1.dr	String found in binary or memory: https://www.googleapis.com/
Source: manifest.json2.1.dr	String found in binary or memory: https://www.googleapis.com/auth/calendar.readonly
Source: manifest.json2.1.dr	String found in binary or memory: https://www.googleapis.com/auth/cast-edu-messaging
Source: manifest.json0.1.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json0.1.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json2.1.dr	String found in binary or memory: https://www.googleapis.com/auth/clouddevices
Source: manifest.json2.1.dr	String found in binary or memory: https://www.googleapis.com/auth/hangouts
Source: manifest.json2.1.dr	String found in binary or memory: https://www.googleapis.com/auth/hangouts.readonly
Source: manifest.json2.1.dr	String found in binary or memory: https://www.googleapis.com/auth/meetings
Source: manifest.json2.1.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.peopleapi.readwrite
Source: manifest.json0.1.dr	String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json0.1.dr	String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: manifest.json2.1.dr	String found in binary or memory: https://www.googleapis.com/auth/userinfo.email
Source: mirroring_common.js.1.dr	String found in binary or memory: https://www.googleapis.com/calendar/v3
Source: mirroring_common.js.1.dr	String found in binary or memory: https://www.googleapis.com/hangouts/v1
Source: 342bf28f-5413-4f8f-b788-0d8675d43684.tmp.3.dr, 9f438101-4c53-43b0-8035-ce389d001772.tmp.3.dr, ab740f59-d7b9-4369-9a8a-3b84e3cd5b87.tmp.3.dr	String found in binary or memory: https://www.gstatic.com
Source: common.js.1.dr	String found in binary or memory: https://www.gstatic.com/hangouts_echo_detector/release/%
Source: manifest.json2.1.dr	String found in binary or memory: https://www.gstatic.com;

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8

Source: unknown

DNS traffic detected: queries for: accounts.google.com

Source: global traffic	HTTP traffic detected: GET /h8YEvNH.png HTTP/1.1Host: i.imgur.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-GB&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-85.0.4183.121Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /UeUQRKC.png HTTP/1.1Host: i.imgur.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /h8YEvNH.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: i.imgur.com
Source: global traffic	HTTP traffic detected: GET /UeUQRKC.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: i.imgur.com
Source: global traffic	HTTP traffic detected: GET /crx/blobs/Acy1k0bLIjHsvnKaKN_oRpVaYYvFs25d7GKYF1WXrT6yizCMksBO0c_ggE0B6tx6HPRHe6q1GOEe3_NcIbSiGG8kXeLMUY0sAKVvC6R89zvKM13s5VqoAMZSmuUgjQL5vlygJuArQghXXE_qTL7NlQ/extension_8520_615_0_5.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8

Source: unknown	HTTPS traffic detected: 151.101.112.193:443 -> 192.168.2.4:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.112.193:443 -> 192.168.2.4:49779 version: TLS 1.2

System Summary

Source: file:///C:/Users/user/Desktop/nuno.palmeiro-validate.html

Tab title: Sign in to your Microsoft account

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "C:\Users\user\Desktop\nuno.palmeiro-validate.html
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1568,6117690780338458555,14944996718431420838,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1916 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1568,6117690780338458555,14944996718431420838,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1916 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-61F3178F-10BC.pma

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Temp\a10a1713-ebdd-4877-9ccb-e17001a9fa84.tmp

Jump to behavior

Source: classification engine

Classification label: mal68.phis.winHTML@33/263@5/7

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next

Persistence and Installation Behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Temp\4284_439174981\LICENSE.txt

Jump to behavior