Play interactive tourEdit tour

Windows Analysis Report
https://docs.google.com/presentation/d/e/2PACX-1vQLIu1X0IVnxZJYibfHTDtGdl4umjzrNQRqM8P15_pKuHsxivDaDjKXey0w5atKnGomwg17E-2HUJIW/pub?start=false&loop=false&delayms=3000&slide=id.p

Overview

General Information

Sample URL:	https://docs.google.com/presentation/d/e/2PACX-1vQLIu1X0IVnxZJYibfHTDtGdl4umjzrNQRqM8P15_pKuHsxivDaDjKXey0w5atKnGomwg17E-2HUJIW/pub?start=false&loop=false&delayms=3000&slide=id.p
Analysis ID:	635351
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

HTML body contains low number of good links

No HTML title found

Classification

×

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Phishing

HTML body contains low number of good links

Source: https://docs.google.com/presentation/d/e/2PACX-1vQLIu1X0IVnxZJYibfHTDtGdl4umjzrNQRqM8P15_pKuHsxivDaDjKXey0w5atKnGomwg17E-2HUJIW/pub?start=false&loop=false&delayms=3000&slide=id.p	HTTP Parser: Number of links: 0
Source: https://docs.google.com/presentation/d/e/2PACX-1vQLIu1X0IVnxZJYibfHTDtGdl4umjzrNQRqM8P15_pKuHsxivDaDjKXey0w5atKnGomwg17E-2HUJIW/pub?start=false&loop=false&delayms=3000&slide=id.p	HTTP Parser: Number of links: 0

No HTML title found

Source: https://docs.google.com/presentation/d/e/2PACX-1vQLIu1X0IVnxZJYibfHTDtGdl4umjzrNQRqM8P15_pKuHsxivDaDjKXey0w5atKnGomwg17E-2HUJIW/pub?start=false&loop=false&delayms=3000&slide=id.p	HTTP Parser: HTML title missing
Source: https://docs.google.com/presentation/d/e/2PACX-1vQLIu1X0IVnxZJYibfHTDtGdl4umjzrNQRqM8P15_pKuHsxivDaDjKXey0w5atKnGomwg17E-2HUJIW/pub?start=false&loop=false&delayms=3000&slide=id.p	HTTP Parser: HTML title missing

META author tag missing

Source: https://docs.google.com/presentation/d/e/2PACX-1vQLIu1X0IVnxZJYibfHTDtGdl4umjzrNQRqM8P15_pKuHsxivDaDjKXey0w5atKnGomwg17E-2HUJIW/pub?start=false&loop=false&delayms=3000&slide=id.p	HTTP Parser: No <meta name="author".. found
Source: https://docs.google.com/presentation/d/e/2PACX-1vQLIu1X0IVnxZJYibfHTDtGdl4umjzrNQRqM8P15_pKuHsxivDaDjKXey0w5atKnGomwg17E-2HUJIW/pub?start=false&loop=false&delayms=3000&slide=id.p	HTTP Parser: No <meta name="author".. found

META copyright tag missing

Source: https://docs.google.com/presentation/d/e/2PACX-1vQLIu1X0IVnxZJYibfHTDtGdl4umjzrNQRqM8P15_pKuHsxivDaDjKXey0w5atKnGomwg17E-2HUJIW/pub?start=false&loop=false&delayms=3000&slide=id.p	HTTP Parser: No <meta name="copyright".. found
Source: https://docs.google.com/presentation/d/e/2PACX-1vQLIu1X0IVnxZJYibfHTDtGdl4umjzrNQRqM8P15_pKuHsxivDaDjKXey0w5atKnGomwg17E-2HUJIW/pub?start=false&loop=false&delayms=3000&slide=id.p	HTTP Parser: No <meta name="copyright".. found

Compliance

Creates a directory in C:\Program Files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic			Jump to behavior

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 172.217.168.65:443 -> 192.168.2.3:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.203.100:443 -> 192.168.2.3:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.36.158.100:443 -> 192.168.2.3:49924 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.36.158.100:443 -> 192.168.2.3:49923 version: TLS 1.2

Networking

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: clients2.google.com

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900

Downloads files from webservers via HTTP

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-85.0.4183.121Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /presentation/d/e/2PACX-1vQLIu1X0IVnxZJYibfHTDtGdl4umjzrNQRqM8P15_pKuHsxivDaDjKXey0w5atKnGomwg17E-2HUJIW/pub?start=false&loop=false&delayms=3000&slide=id.p HTTP/1.1Host: docs.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2 HTTP/1.1Host: fonts.gstatic.comConnection: keep-aliveOrigin: https://docs.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://docs.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2 HTTP/1.1Host: fonts.gstatic.comConnection: keep-aliveOrigin: https://docs.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://docs.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /QQO41zWHBvsX36RgqffQ_Q8VKfebeqv6pKrya5ykZ7U3gtz6GuLzEANegUUvsan5C0uMtw-4NjCuShXWV75hTooEURcwc7XPdy3eBByKuPgDkT48ZSwM5OK9YnkTz77CV7XkHuXuImvHBwo HTTP/1.1Host: lh3.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://docs.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /QQO41zWHBvsX36RgqffQ_Q8VKfebeqv6pKrya5ykZ7U3gtz6GuLzEANegUUvsan5C0uMtw-4NjCuShXWV75hTooEURcwc7XPdy3eBByKuPgDkT48ZSwM5OK9YnkTz77CV7XkHuXuImvHBwo HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh3.googleusercontent.com
Source: global traffic	HTTP traffic detected: GET /url?q=https://accounts.appsgsuite-tunneldrive.tk/eEBrdljc&sa=D&source=editors&ust=1653677947346759&usg=AOvVaw3QU4sK3cAcPp4ymAmsc8mY HTTP/1.1Host: www.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=mTsMIPZRhvSZkLxUg0Zl73ABHi-3PG40VnXj8ujTpOJPOrYf9dQdzUr80tLAfv0Cg7Nze-cAoRN2LSg3aFzK2D5pfO_fWcwb2W1Fy3IOtOll36PY-3KK_I-raNwAnP0XHmJi6AcqtW4QEfx1QKliJeDtiVCEcWrqXCHCc1mSDmU; CONSENT=PENDING+524
Source: global traffic	HTTP traffic detected: GET /images/phishing_logo.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: www.google.com
Source: global traffic	HTTP traffic detected: GET /gtag/js?id=UA-150292050-1 HTTP/1.1Host: www.googletagmanager.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://safebrowsing.google.com/safebrowsing/report_error/?tpl=websearch&url=https://accounts.appsgsuite-tunneldrive.tk/eEBrdljc&hl=enAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tools/firefox/common/moz-header-bg-top.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: www.google.com
Source: global traffic	HTTP traffic detected: GET /tools/firefox/common/moz-header-bg-bottom.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: www.google.com
Source: global traffic	HTTP traffic detected: GET /safe-browsing/overview HTTP/1.1Host: transparencyreport.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=mTsMIPZRhvSZkLxUg0Zl73ABHi-3PG40VnXj8ujTpOJPOrYf9dQdzUr80tLAfv0Cg7Nze-cAoRN2LSg3aFzK2D5pfO_fWcwb2W1Fy3IOtOll36PY-3KK_I-raNwAnP0XHmJi6AcqtW4QEfx1QKliJeDtiVCEcWrqXCHCc1mSDmU; CONSENT=PENDING+524; __Secure-ENID=5.SE=GZjPJiK_TLJA5Cocy9nfr7W4p-MMxNGsecoURQCSiZSoSGssOps8IG1Vm1eISsoFqsR79aYLz_UO8dklyjfWBG-xcwOmmTWyC-uN21rU9cqlByEvAUC2SjfACKKeGHF7igtT3lX1Mj8e6tu-9PJLch6pHU6gC3sm54mxNxa-Bn0
Source: global traffic	HTTP traffic detected: GET /favicon.ico?v1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: www.google.com
Source: global traffic	HTTP traffic detected: GET /images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: www.google.com
Source: global traffic	HTTP traffic detected: GET /images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: www.google.comIf-Modified-Since: Tue, 22 Oct 2019 18:30:00 GMT
Source: global traffic	HTTP traffic detected: GET /images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: www.google.comIf-Modified-Since: Tue, 22 Oct 2019 18:30:00 GMT
Source: global traffic	HTTP traffic detected: GET /web/fundamentals/security/hacked HTTP/1.1Host: developers.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=mTsMIPZRhvSZkLxUg0Zl73ABHi-3PG40VnXj8ujTpOJPOrYf9dQdzUr80tLAfv0Cg7Nze-cAoRN2LSg3aFzK2D5pfO_fWcwb2W1Fy3IOtOll36PY-3KK_I-raNwAnP0XHmJi6AcqtW4QEfx1QKliJeDtiVCEcWrqXCHCc1mSDmU; CONSENT=PENDING+524; __Secure-ENID=5.SE=GZjPJiK_TLJA5Cocy9nfr7W4p-MMxNGsecoURQCSiZSoSGssOps8IG1Vm1eISsoFqsR79aYLz_UO8dklyjfWBG-xcwOmmTWyC-uN21rU9cqlByEvAUC2SjfACKKeGHF7igtT3lX1Mj8e6tu-9PJLch6pHU6gC3sm54mxNxa-Bn0
Source: global traffic	HTTP traffic detected: GET /hacked/ HTTP/1.1Host: web.devConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /css/next.css?v=30010cda HTTP/1.1Host: web.devConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://web.dev/hacked/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /css/legacy-rollout.css?v=c92bcb17 HTTP/1.1Host: web.devConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://web.dev/hacked/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fonts/google-sans/regular/latin.woff2 HTTP/1.1Host: web.devConnection: keep-aliveOrigin: https://web.devUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://web.dev/hacked/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fonts/google-sans/bold/latin.woff2 HTTP/1.1Host: web.devConnection: keep-aliveOrigin: https://web.devUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://web.dev/hacked/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fonts/material-icons/regular.woff2 HTTP/1.1Host: web.devConnection: keep-aliveOrigin: https://web.devUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://web.dev/hacked/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/app.js?v=145f0867 HTTP/1.1Host: web.devConnection: keep-aliveOrigin: https://web.devUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/content.js?v=00db7c42 HTTP/1.1Host: web.devConnection: keep-aliveOrigin: https://web.devUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/kheDArv5csY6rvQUJDbWRscckLr1/INhVTTPZ65TEBG9N4Qpz.gif?auto=format&w=845 HTTP/1.1Host: web-dev.imgix.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://web.dev/hacked/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/index-a8636400.js HTTP/1.1Host: web.devConnection: keep-aliveOrigin: https://web.devUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://web.dev/js/content.js?v=00db7c42Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/index-d1373fab.js HTTP/1.1Host: web.devConnection: keep-aliveOrigin: https://web.devUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://web.dev/js/content.js?v=00db7c42Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/index-793a397e.js HTTP/1.1Host: web.devConnection: keep-aliveOrigin: https://web.devUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://web.dev/js/content.js?v=00db7c42Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/store-1afdb64d.js HTTP/1.1Host: web.devConnection: keep-aliveOrigin: https://web.devUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://web.dev/js/content.js?v=00db7c42Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/lockup-color.png HTTP/1.1Host: web.devConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://web.dev/hacked/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /vi_webp/mbJvL61DOZg/hqdefault.webp HTTP/1.1Host: i.ytimg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://web.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-126406676-2&cid=1778341496.1653706916&jid=207518192&_u=YEBAAAAAAAAAAC~&z=1572055668 HTTP/1.1Host: www.google.co.ukConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://web.dev/hacked/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /manifest.webmanifest HTTP/1.1Host: web.devConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://web.dev/hacked/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/favicon.ico HTTP/1.1Host: web.devConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://web.dev/hacked/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _ga=GA1.2.1778341496.1653706916; _gid=GA1.2.1189465226.1653706916; _gat=1
Source: global traffic	HTTP traffic detected: GET /images/android-chrome-192x192.png HTTP/1.1Host: web.devConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://web.dev/hacked/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _ga=GA1.2.1778341496.1653706916; _gid=GA1.2.1189465226.1653706916; _gat=1
Source: global traffic	HTTP traffic detected: GET /images/favicon-32x32.png HTTP/1.1Host: web.devConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://web.dev/hacked/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _ga=GA1.2.1778341496.1653706916; _gid=GA1.2.1189465226.1653706916; _gat=1
Source: global traffic	HTTP traffic detected: GET /images/favicon-16x16.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: web.dev
Source: global traffic	HTTP traffic detected: GET /images/lockup-color.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: web.dev
Source: global traffic	HTTP traffic detected: GET /safebrowsing/report_error/?tpl=websearch&url=https://accounts.appsgsuite-tunneldrive.tk/eEBrdljc HTTP/1.1Host: www.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Tries to download or post to a non-existing HTTP route (HTTP/1.1 404 Not Found / 503 Service Unavailable / 403 Forbidden)

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundVary: OriginCross-Origin-Resource-Policy: cross-originContent-Type: image/webpDate: Fri, 27 May 2022 18:01:57 GMTExpires: Fri, 27 May 2022 18:02:27 GMTCache-Control: public, max-age=30X-Content-Type-Options: nosniffServer: sffeContent-Length: 552X-XSS-Protection: 0Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"Connection: close

URLs found in memory or binary data

Source: 98ec5fff-17af-491e-a764-2aa173100102.tmp.1.dr, 83a243a1-c135-46b4-bf83-15965a96d979.tmp.1.dr	String found in binary or memory: https://accounts.google.com
Source: craw_window.js.0.dr	String found in binary or memory: https://accounts.google.com/MergeSession
Source: 98ec5fff-17af-491e-a764-2aa173100102.tmp.1.dr, 83a243a1-c135-46b4-bf83-15965a96d979.tmp.1.dr	String found in binary or memory: https://apis.google.com
Source: 98ec5fff-17af-491e-a764-2aa173100102.tmp.1.dr, 83a243a1-c135-46b4-bf83-15965a96d979.tmp.1.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json.0.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 98ec5fff-17af-491e-a764-2aa173100102.tmp.1.dr, 83a243a1-c135-46b4-bf83-15965a96d979.tmp.1.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: 98ec5fff-17af-491e-a764-2aa173100102.tmp.1.dr	String found in binary or memory: https://content-autofill.googleapis.com
Source: c5292198-ab1a-48a7-9e6e-848ebbc14452.tmp.1.dr, 98ec5fff-17af-491e-a764-2aa173100102.tmp.1.dr, 83a243a1-c135-46b4-bf83-15965a96d979.tmp.1.dr, e8f43554-03a4-435b-91a2-a1351137ac6d.tmp.1.dr	String found in binary or memory: https://dns.google
Source: 98ec5fff-17af-491e-a764-2aa173100102.tmp.1.dr	String found in binary or memory: https://docs.google.com
Source: History Provider Cache.0.dr	String found in binary or memory: https://docs.google.com/presentation/d/e/2PACX-1vQLIu1X0IVnxZJYibfHTDtGdl4umjzrNQRqM8P15_pKuHsxivDaD
Source: 98ec5fff-17af-491e-a764-2aa173100102.tmp.1.dr, 83a243a1-c135-46b4-bf83-15965a96d979.tmp.1.dr	String found in binary or memory: https://fonts.googleapis.com
Source: 98ec5fff-17af-491e-a764-2aa173100102.tmp.1.dr, 83a243a1-c135-46b4-bf83-15965a96d979.tmp.1.dr	String found in binary or memory: https://fonts.gstatic.com
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
Source: 98ec5fff-17af-491e-a764-2aa173100102.tmp.1.dr	String found in binary or memory: https://lh3.googleusercontent.com
Source: 98ec5fff-17af-491e-a764-2aa173100102.tmp.1.dr, 83a243a1-c135-46b4-bf83-15965a96d979.tmp.1.dr	String found in binary or memory: https://ogs.google.com
Source: craw_window.js.0.dr, manifest.json.0.dr	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: 98ec5fff-17af-491e-a764-2aa173100102.tmp.1.dr, 83a243a1-c135-46b4-bf83-15965a96d979.tmp.1.dr	String found in binary or memory: https://play.google.com
Source: 98ec5fff-17af-491e-a764-2aa173100102.tmp.1.dr	String found in binary or memory: https://r1---sn-4g5lznle.gvt1.com
Source: 98ec5fff-17af-491e-a764-2aa173100102.tmp.1.dr	String found in binary or memory: https://redirector.gvt1.com
Source: 98ec5fff-17af-491e-a764-2aa173100102.tmp.1.dr	String found in binary or memory: https://safebrowsing.google.com
Source: craw_window.js.0.dr, manifest.json.0.dr	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: 98ec5fff-17af-491e-a764-2aa173100102.tmp.1.dr, 83a243a1-c135-46b4-bf83-15965a96d979.tmp.1.dr	String found in binary or memory: https://ssl.gstatic.com
Source: 98ec5fff-17af-491e-a764-2aa173100102.tmp.1.dr	String found in binary or memory: https://transparencyreport.google.com
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://www-googleapis-staging.sandbox.google.com
Source: 98ec5fff-17af-491e-a764-2aa173100102.tmp.1.dr	String found in binary or memory: https://www.google-analytics.com
Source: 98ec5fff-17af-491e-a764-2aa173100102.tmp.1.dr, 83a243a1-c135-46b4-bf83-15965a96d979.tmp.1.dr	String found in binary or memory: https://www.google.com
Source: manifest.json.0.dr	String found in binary or memory: https://www.google.com/
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/accounts/OAuthLogin?issueuberauth=1
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/cleardot.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/dot2.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/x2.gif
Source: craw_background.js.0.dr	String found in binary or memory: https://www.google.com/intl/en-US/chrome/blank.html
Source: History Provider Cache.0.dr	String found in binary or memory: https://www.google.com/url?q=https://accounts.appsgsuite-tunneldrive.tk/eEBrdljc&sa=D&source=editors
Source: 98ec5fff-17af-491e-a764-2aa173100102.tmp.1.dr, craw_window.js.0.dr, craw_background.js.0.dr, 83a243a1-c135-46b4-bf83-15965a96d979.tmp.1.dr	String found in binary or memory: https://www.googleapis.com
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: 98ec5fff-17af-491e-a764-2aa173100102.tmp.1.dr	String found in binary or memory: https://www.googletagmanager.com
Source: 98ec5fff-17af-491e-a764-2aa173100102.tmp.1.dr, 83a243a1-c135-46b4-bf83-15965a96d979.tmp.1.dr	String found in binary or memory: https://www.gstatic.com

Posts data to webserver

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 172.217.168.65:443 -> 192.168.2.3:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.203.100:443 -> 192.168.2.3:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.36.158.100:443 -> 192.168.2.3:49924 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.36.158.100:443 -> 192.168.2.3:49923 version: TLS 1.2

System Summary

Creates temporary files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Temp\6ddc5cac-2887-4c30-9d88-b56971765644.tmp

Jump to behavior

Classification label

Source: classification engine

Classification label: clean1.win@39/101@19/16

Spawns processes

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "https://docs.google.com/presentation/d/e/2PACX-1vQLIu1X0IVnxZJYibfHTDtGdl4umjzrNQRqM8P15_pKuHsxivDaDjKXey0w5atKnGomwg17E-2HUJIW/pub?start=false&loop=false&delayms=3000&slide=id.p
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1600,12104884464461412917,7261113528987720669,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1944 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1600,12104884464461412917,7261113528987720669,131072 --lang=en-US --service-sandbox-type=audio --enable-audio-service-sandbox --mojo-platform-channel-handle=6136 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1600,12104884464461412917,7261113528987720669,131072 --lang=en-US --service-sandbox-type=video_capture --enable-audio-service-sandbox --mojo-platform-channel-handle=6100 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1600,12104884464461412917,7261113528987720669,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1944 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1600,12104884464461412917,7261113528987720669,131072 --lang=en-US --service-sandbox-type=audio --enable-audio-service-sandbox --mojo-platform-channel-handle=6136 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1600,12104884464461412917,7261113528987720669,131072 --lang=en-US --service-sandbox-type=video_capture --enable-audio-service-sandbox --mojo-platform-channel-handle=6100 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Creates files inside the program directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\Chrome\Application\Dictionaries

Jump to behavior

Creates files inside the user directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-6291905B-17B8.pma

Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Creates a directory in C:\Program Files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic			Jump to behavior

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.