Edit tour

Windows Analysis Report
Technical Spec.html

Overview

General Information

Sample Name:	Technical Spec.html
Analysis ID:	1307215
MD5:	1b8cf418350e7fb52616531a30931cc0
SHA1:	1c7016257b55c69eea053cffb82f87eedbcf5c03
SHA256:	0c72c354be5cded5cca5718a5f83f1f144880233da5aeffd6206bb79e1fce17a
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

HTML file submission containing password form

Suspicious Javascript code found in HTML file

Phishing site detected (based on logo match)

None HTTPS page querying sensitive user data (password, username or email)

HTML body contains password input but no form action

HTML page contains hidden URLs or javascript code

HTML body with high number of embedded images detected

HTML body contains low number of good links

HTML title does not match URL

IP address seen in connection with other malware

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5292 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\Technical Spec.html MD5: 8D1C4713ACB7CC2AAAEE4477C58A80BA)

chrome.exe (PID: 5544 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=1880,i,12395186336236501141,1887735438801238278,262144 /prefetch:8 MD5: 8D1C4713ACB7CC2AAAEE4477C58A80BA)

cleanup

HTTP Parser: Base64 decoded: :rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"><rdf:Description rdf:about="uuid:faf5bdd5-ba3d-11da-ad31-d33d75182f1b" xmlns:dc="http://purl.org/dc/elements/1.1/"/><rdf:Description rdf:about="uuid:faf5bdd5-ba3d-11da-ad31-d33d75182f1b" xmlns:xmp="http:/...

Source: Technical Spec.html	HTTP Parser: Total embedded image size: 196126
Source: file:///C:/Users/user/Desktop/Technical%20Spec.html	HTTP Parser: Total embedded image size: 196126

Source: Technical Spec.html	HTTP Parser: Number of links: 0
Source: file:///C:/Users/user/Desktop/Technical%20Spec.html	HTTP Parser: Number of links: 0

Source: Technical Spec.html	HTTP Parser: Title: does not match URL
Source: file:///C:/Users/user/Desktop/Technical%20Spec.html	HTTP Parser: Title: does not match URL

Source: Technical Spec.html	HTTP Parser: <input type="password" .../> found
Source: file:///C:/Users/user/Desktop/Technical%20Spec.html	HTTP Parser: <input type="password" .../> found

Source: Technical Spec.html	HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/user/Desktop/Technical%20Spec.html	HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/user/Desktop/Technical%20Spec.html	HTTP Parser: No <meta name="author".. found

Source: Technical Spec.html	HTTP Parser: No favicon
Source: file:///C:/Users/user/Desktop/Technical%20Spec.html	HTTP Parser: No favicon
Source: file:///C:/Users/user/Desktop/Technical%20Spec.html	HTTP Parser: No favicon

Source: Technical Spec.html	HTTP Parser: No <meta name="copyright".. found
Source: file:///C:/Users/user/Desktop/Technical%20Spec.html	HTTP Parser: No <meta name="copyright".. found
Source: file:///C:/Users/user/Desktop/Technical%20Spec.html	HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1529049173\LICENSE.txt

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_BITS_5292_1846078490	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_774638055	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_774638055\optimization-hints.pb	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_774638055\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_774638055\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_774638055\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_774638055\manifest.fingerprint	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_BITS_5292_17115723	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1466566541	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1466566541\keys.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1466566541\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1466566541\LICENSE	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1466566541\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1466566541\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1466566541\manifest.fingerprint	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_BITS_5292_1225477312	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_BITS_5292_93783779	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1529049173	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1529049173\LICENSE.txt	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1529049173\Filtering Rules	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1529049173\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1529049173\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1529049173\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1529049173\manifest.fingerprint	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_BITS_5292_538055734	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1266310572	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1266310572\crl-set	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1266310572\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1266310572\LICENSE	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1266310572\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1266310572\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1266310572\manifest.fingerprint	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_BITS_5292_2074355590	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1996625029	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1996625029\ssl_error_assistant.pb	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1996625029\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1996625029\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1996625029\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1996625029\manifest.fingerprint	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_BITS_5292_52248532	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_48498969	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_48498969\download_file_types.pb	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_48498969\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_48498969\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_48498969\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_48498969\manifest.fingerprint	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_BITS_5292_1599589186	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_2084609994	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_2084609994\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_2084609994\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_2084609994\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_2084609994\manifest.fingerprint	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_BITS_5292_156871884	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_35640493	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_35640493\kp_pinslist.pb	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_35640493\ct_config.pb	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_35640493\crs.pb	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_35640493\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_35640493\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_35640493\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_35640493\manifest.fingerprint	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_BITS_5292_1288067786	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1566901044	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1566901044\Preload Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1566901044\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1566901044\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1566901044\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1566901044\manifest.fingerprint	Jump to behavior

Source: Joe Sandbox View

IP Address: 151.101.1.229 151.101.1.229

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713

Source: kp_pinslist.pb.0.dr

String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)

Source: chromecache_265.1.dr	String found in binary or memory: http://blindsignals.com/index.php/2009/07/jquery-delay/
Source: chromecache_265.1.dr	String found in binary or memory: http://bugs.jquery.com/ticket/12282#comment:15
Source: chromecache_265.1.dr	String found in binary or memory: http://bugs.jquery.com/ticket/12359
Source: kp_pinslist.pb.0.dr	String found in binary or memory: http://clients3.google.com/cert_upload_json
Source: Technical Spec.html	String found in binary or memory: http://collinswilly-001-site1.gtempurl.com/api/process
Source: ct_config.pb.0.dr	String found in binary or memory: http://crbug.com/10733952
Source: ct_config.pb.0.dr	String found in binary or memory: http://crbug.com/1315126
Source: crs.pb.0.dr	String found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
Source: crs.pb.0.dr	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: crs.pb.0.dr	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl0
Source: crs.pb.0.dr	String found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: crs.pb.0.dr	String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: crs.pb.0.dr	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: kp_pinslist.pb.0.dr	String found in binary or memory: http://csp.yahoo.com/beacon/csp?src=yahoocom-hpkp-report-only
Source: chromecache_265.1.dr	String found in binary or memory: http://dev.w3.org/csswg/cssom/#resolved-values
Source: chromecache_265.1.dr	String found in binary or memory: http://erik.eae.net/archives/2007/07/27/18.54.15/#comment-102291
Source: chromecache_265.1.dr	String found in binary or memory: http://fluidproject.org/blog/2008/01/09/getting-setting-and-removing-tabindex-values-with-javascript
Source: chromecache_265.1.dr	String found in binary or memory: http://helpful.knobs-dials.com/index.php/Component_returned_failure_code:_0x80040111_(NS_ERROR_NOT_A
Source: chromecache_265.1.dr	String found in binary or memory: http://javascript.nwbox.com/IEContentLoaded/
Source: chromecache_265.1.dr	String found in binary or memory: http://jquery.com/
Source: chromecache_265.1.dr	String found in binary or memory: http://jquery.org/license
Source: chromecache_265.1.dr	String found in binary or memory: http://json.org/json2.js
Source: chromecache_265.1.dr	String found in binary or memory: http://jsperf.com/getall-vs-sizzle/2
Source: crs.pb.0.dr	String found in binary or memory: http://ocsp.accv.es0
Source: kp_pinslist.pb.0.dr	String found in binary or memory: http://report-example.test/test
Source: crs.pb.0.dr	String found in binary or memory: http://repository.swisssign.com/0
Source: chromecache_265.1.dr	String found in binary or memory: http://sizzlejs.com/
Source: chromecache_265.1.dr	String found in binary or memory: http://weblogs.java.net/blog/driscoll/archive/2009/09/08/eval-javascript-global-context
Source: crs.pb.0.dr	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
Source: crs.pb.0.dr	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
Source: crs.pb.0.dr	String found in binary or memory: http://www.accv.es/legislacion_c.htm0U
Source: crs.pb.0.dr	String found in binary or memory: http://www.accv.es00
Source: crs.pb.0.dr	String found in binary or memory: http://www.cert.fnmt.es/dpcs/0
Source: crs.pb.0.dr	String found in binary or memory: http://www.firmaprofesional.com/cps0
Source: crs.pb.0.dr	String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: Technical Spec.html	String found in binary or memory: https://ajax.aspnetcdn.com/ajax/jquery/jquery-1.9.1.js
Source: chromecache_265.1.dr	String found in binary or memory: https://bugs.webkit.org/show_bug.cgi?id=29084
Source: chromecache_265.1.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=491668
Source: chromecache_265.1.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=649285
Source: Technical Spec.html	String found in binary or memory: https://cdn.jsdelivr.net/npm/bootstrap
Source: manifest.json2.0.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: ct_config.pb.0.dr	String found in binary or memory: https://crbug.com/12966352
Source: ct_config.pb.0.dr	String found in binary or memory: https://crbug.com/13526092
Source: ct_config.pb.0.dr	String found in binary or memory: https://crbug.com/7036992
Source: ct_config.pb.0.dr	String found in binary or memory: https://crbug.com/7037002
Source: ct_config.pb.0.dr	String found in binary or memory: https://crbug.com/7963332
Source: ct_config.pb.0.dr	String found in binary or memory: https://crbug.com/8016242
Source: ct_config.pb.0.dr	String found in binary or memory: https://crbug.com/8333502
Source: ct_config.pb.0.dr	String found in binary or memory: https://crbug.com/8881302
Source: ct_config.pb.0.dr	String found in binary or memory: https://crbug.com/8890332
Source: ct_config.pb.0.dr	String found in binary or memory: https://crbug.com/9636932
Source: LICENSE.txt.0.dr	String found in binary or memory: https://creativecommons.org/.
Source: LICENSE.txt.0.dr	String found in binary or memory: https://creativecommons.org/compatiblelicenses
Source: ct_config.pb.0.dr	String found in binary or memory: https://ct.cloudflare.com/logs/nimbus2023/2
Source: ct_config.pb.0.dr	String found in binary or memory: https://ct.cloudflare.com/logs/nimbus2024/2
Source: ct_config.pb.0.dr	String found in binary or memory: https://ct.googleapis.com/logs/argon2023/2
Source: ct_config.pb.0.dr	String found in binary or memory: https://ct.googleapis.com/logs/eu1/xenon2024/2
Source: ct_config.pb.0.dr	String found in binary or memory: https://ct.googleapis.com/logs/us1/argon2024/2
Source: ct_config.pb.0.dr	String found in binary or memory: https://ct.googleapis.com/logs/xenon2023/2
Source: ct_config.pb.0.dr	String found in binary or memory: https://ct.trustasia.com/log2023/2
Source: ct_config.pb.0.dr	String found in binary or memory: https://ct2024.trustasia.com/log2024/2
Source: chromecache_265.1.dr	String found in binary or memory: https://developer.mozilla.org/en-US/docs/CSS/display
Source: chromecache_265.1.dr	String found in binary or memory: https://developer.mozilla.org/en/Security/CSP)
Source: LICENSE.txt.0.dr	String found in binary or memory: https://easylist.to/)
Source: chromecache_266.1.dr, chromecache_267.1.dr	String found in binary or memory: https://getbootstrap.com/)
Source: LICENSE.txt.0.dr	String found in binary or memory: https://github.com/easylist)
Source: chromecache_265.1.dr	String found in binary or memory: https://github.com/jquery/jquery/pull/764
Source: chromecache_266.1.dr, chromecache_267.1.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/main/LICENSE)
Source: chromecache_266.1.dr	String found in binary or memory: https://github.com/twbs/bootstrap/graphs/contributors)
Source: ct_config.pb.0.dr	String found in binary or memory: https://mammoth.ct.comodo.com/B
Source: ct_config.pb.0.dr	String found in binary or memory: https://nessie2023.ct.digicert.com/log/2
Source: ct_config.pb.0.dr	String found in binary or memory: https://nessie2024.ct.digicert.com/log/2
Source: ct_config.pb.0.dr	String found in binary or memory: https://nessie2025.ct.digicert.com/log/2
Source: ct_config.pb.0.dr	String found in binary or memory: https://oak.ct.letsencrypt.org/2023/2
Source: ct_config.pb.0.dr	String found in binary or memory: https://oak.ct.letsencrypt.org/2024h1/2
Source: ct_config.pb.0.dr	String found in binary or memory: https://oak.ct.letsencrypt.org/2024h2/2
Source: keys.json.0.dr	String found in binary or memory: https://polyset.xyz
Source: keys.json.0.dr	String found in binary or memory: https://pst-issuer.hcaptcha.com
Source: ct_config.pb.0.dr	String found in binary or memory: https://sabre.ct.comodo.com/B
Source: keys.json.0.dr	String found in binary or memory: https://trusttoken.dev
Source: crs.pb.0.dr	String found in binary or memory: https://wwww.certigna.fr/autorites/0m
Source: ct_config.pb.0.dr	String found in binary or memory: https://yeti2023.ct.digicert.com/log/2
Source: ct_config.pb.0.dr	String found in binary or memory: https://yeti2024.ct.digicert.com/log/2
Source: ct_config.pb.0.dr	String found in binary or memory: https://yeti2025.ct.digicert.com/log/2

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CONSENT=PENDING+904; SOCS=CAISHAgCEhJnd3NfMjAyMjA4MDgtMF9SQzEaAmVuIAEaBgiAvOuXBg; AEC=Ad49MVGiijyX5dxPFAKxKYso-rIS24Ht-Pxs5fU9hHrAzfASnm-jqdQE1g; NID=511=WyMJovC2uA2AEbHQkGfP-KDdYCeg5Q7Mv6gxYT-qeugtrnXImrhmp1SixwS4ydh_E8Z0hdfCLAXvg2WUqsBSfqpx5SFvCCoeGeevqlEfkoxYi9FTISb8Cu7rr5rf9PyyNbLqf2QbxG7ja7jAB6UJQd5CPvMGcYUasORCRKRL1-arNYzfADAWHJvBLXml-Km_uewDreOyJ-MjxAI-i38Tl6LXI3zB

Source: unknown

DNS traffic detected: queries for: clients2.google.com

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=115.0.5790.171&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-115.0.5790.171Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /npm/bootstrap@5.1.3/dist/css/bootstrap.min.css HTTP/1.1Host: cdn.jsdelivr.netConnection: keep-alivesec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /npm/bootstrap@5.1.3/dist/js/bootstrap.bundle.min.js HTTP/1.1Host: cdn.jsdelivr.netConnection: keep-alivesec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\Technical Spec.html
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=1880,i,12395186336236501141,1887735438801238278,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=1880,i,12395186336236501141,1887735438801238278,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\chrome_BITS_5292_1846078490

Jump to behavior

Source: classification engine

Classification label: mal52.phis.winHTML@40/43@10/7

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_BITS_5292_1846078490	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_774638055	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_774638055\optimization-hints.pb	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_774638055\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_774638055\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_774638055\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_774638055\manifest.fingerprint	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_BITS_5292_17115723	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1466566541	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1466566541\keys.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1466566541\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1466566541\LICENSE	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1466566541\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1466566541\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1466566541\manifest.fingerprint	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_BITS_5292_1225477312	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_BITS_5292_93783779	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1529049173	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1529049173\LICENSE.txt	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1529049173\Filtering Rules	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1529049173\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1529049173\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1529049173\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1529049173\manifest.fingerprint	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_BITS_5292_538055734	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1266310572	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1266310572\crl-set	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1266310572\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1266310572\LICENSE	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1266310572\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1266310572\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1266310572\manifest.fingerprint	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_BITS_5292_2074355590	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1996625029	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1996625029\ssl_error_assistant.pb	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1996625029\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1996625029\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1996625029\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1996625029\manifest.fingerprint	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_BITS_5292_52248532	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_48498969	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_48498969\download_file_types.pb	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_48498969\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_48498969\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_48498969\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_48498969\manifest.fingerprint	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_BITS_5292_1599589186	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_2084609994	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_2084609994\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_2084609994\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_2084609994\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_2084609994\manifest.fingerprint	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_BITS_5292_156871884	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_35640493	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_35640493\kp_pinslist.pb	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_35640493\ct_config.pb	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_35640493\crs.pb	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_35640493\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_35640493\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_35640493\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_35640493\manifest.fingerprint	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_BITS_5292_1288067786	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1566901044	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1566901044\Preload Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1566901044\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1566901044\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1566901044\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1566901044\manifest.fingerprint	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1529049173\LICENSE.txt

Jump to behavior

Stealing of Sensitive Information

HTML file submission containing password form

Source: file:///C:/Users/user/Desktop/Technical%20Spec.html

HTTP Parser: file:///C:/Users/user/Desktop/Technical%20Spec.html

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	2 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	3 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	4 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	1 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
http://crl.dhimyotis.com/certignarootca.crl0	0%	URL Reputation	safe
http://crl.securetrust.com/SGCA.crl0	0%	URL Reputation	safe
https://polyset.xyz	0%	URL Reputation	safe
http://fluidproject.org/blog/2008/01/09/getting-setting-and-removing-tabindex-values-with-javascript	0%	URL Reputation	safe
http://crl.securetrust.com/STCA.crl0	0%	URL Reputation	safe
http://blindsignals.com/index.php/2009/07/jquery-delay/	0%	URL Reputation	safe
https://wwww.certigna.fr/autorites/0m	0%	URL Reputation	safe
http://ocsp.accv.es0	0%	URL Reputation	safe
https://trusttoken.dev	0%	URL Reputation	safe
http://report-example.test/test	0%	URL Reputation	safe
https://ct2024.trustasia.com/log2024/2	0%	Avira URL Cloud	safe
https://crbug.com/7037002	0%	Avira URL Cloud	safe
https://crbug.com/13526092	0%	Avira URL Cloud	safe
https://crbug.com/9636932	0%	Avira URL Cloud	safe
https://crbug.com/7036992	0%	Avira URL Cloud	safe
https://crbug.com/12966352	0%	Avira URL Cloud	safe
http://crbug.com/1315126	0%	Avira URL Cloud	safe
https://crbug.com/8016242	0%	Avira URL Cloud	safe
https://pst-issuer.hcaptcha.com	0%	URL Reputation	safe
https://crbug.com/8333502	0%	Avira URL Cloud	safe
http://crl.xrampsecurity.com/XGCA.crl0	0%	URL Reputation	safe
http://crl.certigna.fr/certignarootca.crl01	0%	URL Reputation	safe
http://www.accv.es00	0%	URL Reputation	safe
http://erik.eae.net/archives/2007/07/27/18.54.15/#comment-102291	0%	URL Reputation	safe
https://crbug.com/8890332	0%	Avira URL Cloud	safe
http://javascript.nwbox.com/IEContentLoaded/	0%	URL Reputation	safe
https://crbug.com/8881302	0%	Avira URL Cloud	safe
http://crbug.com/10733952	0%	Avira URL Cloud	safe
https://ct.trustasia.com/log2023/2	0%	Avira URL Cloud	safe
https://crbug.com/7963332	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
jsdelivr.map.fastly.net	151.101.1.229	true	false	unknown
accounts.google.com	142.251.40.205	true	false	high
www.google.com	142.250.72.100	true	false	high
clients.l.google.com	142.251.41.14	true	false	high
clients2.google.com	unknown	unknown	false	high
cdn.jsdelivr.net	unknown	unknown	false	high
ajax.aspnetcdn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=115.0.5790.171&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1	false	high
https://cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/css/bootstrap.min.css	false	high
file:///C:/Users/user/Desktop/Technical%20Spec.html	false	low
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false	high
https://cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/js/bootstrap.bundle.min.js	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://cdn.jsdelivr.net/npm/bootstrap	Technical Spec.html	false		high
http://jquery.org/license	chromecache_265.1.dr	false		high
https://ct2024.trustasia.com/log2024/2	ct_config.pb.0.dr	false	Avira URL Cloud: safe	unknown
https://ajax.aspnetcdn.com/ajax/jquery/jquery-1.9.1.js	Technical Spec.html	false		high
http://sizzlejs.com/	chromecache_265.1.dr	false		high
http://crl.dhimyotis.com/certignarootca.crl0	crs.pb.0.dr	false	URL Reputation: safe	unknown
http://clients3.google.com/cert_upload_json	kp_pinslist.pb.0.dr	false		high
http://www.firmaprofesional.com/cps0	crs.pb.0.dr	false		high
https://easylist.to/)	LICENSE.txt.0.dr	false		high
http://repository.swisssign.com/0	crs.pb.0.dr	false		high
https://crbug.com/8016242	ct_config.pb.0.dr	false	Avira URL Cloud: safe	unknown
http://crl.securetrust.com/SGCA.crl0	crs.pb.0.dr	false	URL Reputation: safe	unknown
https://polyset.xyz	keys.json.0.dr	false	URL Reputation: safe	unknown
http://jsperf.com/getall-vs-sizzle/2	chromecache_265.1.dr	false		high
http://fluidproject.org/blog/2008/01/09/getting-setting-and-removing-tabindex-values-with-javascript	chromecache_265.1.dr	false	URL Reputation: safe	unknown
http://crl.securetrust.com/STCA.crl0	crs.pb.0.dr	false	URL Reputation: safe	unknown
https://bugs.webkit.org/show_bug.cgi?id=29084	chromecache_265.1.dr	false		high
https://creativecommons.org/compatiblelicenses	LICENSE.txt.0.dr	false		high
http://blindsignals.com/index.php/2009/07/jquery-delay/	chromecache_265.1.dr	false	URL Reputation: safe	unknown
http://bugs.jquery.com/ticket/12282#comment:15	chromecache_265.1.dr	false		high
http://crbug.com/1315126	ct_config.pb.0.dr	false	Avira URL Cloud: safe	unknown
https://crbug.com/7036992	ct_config.pb.0.dr	false	Avira URL Cloud: safe	unknown
http://dev.w3.org/csswg/cssom/#resolved-values	chromecache_265.1.dr	false		high
https://github.com/easylist)	LICENSE.txt.0.dr	false		high
https://creativecommons.org/.	LICENSE.txt.0.dr	false		high
https://github.com/twbs/bootstrap/graphs/contributors)	chromecache_266.1.dr	false		high
https://mammoth.ct.comodo.com/B	ct_config.pb.0.dr	false		high
http://www.quovadisglobal.com/cps0	crs.pb.0.dr	false		high
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0	crs.pb.0.dr	false		high
https://crbug.com/9636932	ct_config.pb.0.dr	false	Avira URL Cloud: safe	unknown
https://crbug.com/13526092	ct_config.pb.0.dr	false	Avira URL Cloud: safe	unknown
https://oak.ct.letsencrypt.org/2024h2/2	ct_config.pb.0.dr	false		high
https://ct.cloudflare.com/logs/nimbus2024/2	ct_config.pb.0.dr	false		high
https://github.com/jquery/jquery/pull/764	chromecache_265.1.dr	false		high
https://crbug.com/7037002	ct_config.pb.0.dr	false	Avira URL Cloud: safe	unknown
http://bugs.jquery.com/ticket/12359	chromecache_265.1.dr	false		high
https://crbug.com/12966352	ct_config.pb.0.dr	false	Avira URL Cloud: safe	unknown
https://crbug.com/8333502	ct_config.pb.0.dr	false	Avira URL Cloud: safe	unknown
http://www.accv.es/legislacion_c.htm0U	crs.pb.0.dr	false		high
http://json.org/json2.js	chromecache_265.1.dr	false		high
https://github.com/twbs/bootstrap/blob/main/LICENSE)	chromecache_266.1.dr, chromecache_267.1.dr	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=649285	chromecache_265.1.dr	false		high
https://wwww.certigna.fr/autorites/0m	crs.pb.0.dr	false	URL Reputation: safe	unknown
http://ocsp.accv.es0	crs.pb.0.dr	false	URL Reputation: safe	unknown
https://trusttoken.dev	keys.json.0.dr	false	URL Reputation: safe	unknown
https://crbug.com/8881302	ct_config.pb.0.dr	false	Avira URL Cloud: safe	unknown
https://getbootstrap.com/)	chromecache_266.1.dr, chromecache_267.1.dr	false		high
http://weblogs.java.net/blog/driscoll/archive/2009/09/08/eval-javascript-global-context	chromecache_265.1.dr	false		high
https://crbug.com/8890332	ct_config.pb.0.dr	false	Avira URL Cloud: safe	unknown
https://developer.mozilla.org/en-US/docs/CSS/display	chromecache_265.1.dr	false		high
https://sabre.ct.comodo.com/B	ct_config.pb.0.dr	false		high
http://report-example.test/test	kp_pinslist.pb.0.dr	false	URL Reputation: safe	unknown
https://ct.trustasia.com/log2023/2	ct_config.pb.0.dr	false	Avira URL Cloud: safe	unknown
http://crbug.com/10733952	ct_config.pb.0.dr	false	Avira URL Cloud: safe	unknown
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0	crs.pb.0.dr	false		high
https://pst-issuer.hcaptcha.com	keys.json.0.dr	false	URL Reputation: safe	unknown
https://developer.mozilla.org/en/Security/CSP)	chromecache_265.1.dr	false		high
http://crl.xrampsecurity.com/XGCA.crl0	crs.pb.0.dr	false	URL Reputation: safe	unknown
http://crl.certigna.fr/certignarootca.crl01	crs.pb.0.dr	false	URL Reputation: safe	unknown
https://ct.cloudflare.com/logs/nimbus2023/2	ct_config.pb.0.dr	false		high
https://oak.ct.letsencrypt.org/2024h1/2	ct_config.pb.0.dr	false		high
https://oak.ct.letsencrypt.org/2023/2	ct_config.pb.0.dr	false		high
http://www.accv.es00	crs.pb.0.dr	false	URL Reputation: safe	unknown
http://erik.eae.net/archives/2007/07/27/18.54.15/#comment-102291	chromecache_265.1.dr	false	URL Reputation: safe	unknown
http://helpful.knobs-dials.com/index.php/Component_returned_failure_code:_0x80040111_(NS_ERROR_NOT_A	chromecache_265.1.dr	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=491668	chromecache_265.1.dr	false		high
https://crbug.com/7963332	ct_config.pb.0.dr	false	Avira URL Cloud: safe	unknown
http://collinswilly-001-site1.gtempurl.com/api/process	Technical Spec.html	false		high
http://www.cert.fnmt.es/dpcs/0	crs.pb.0.dr	false		high
http://csp.yahoo.com/beacon/csp?src=yahoocom-hpkp-report-only	kp_pinslist.pb.0.dr	false		high
http://javascript.nwbox.com/IEContentLoaded/	chromecache_265.1.dr	false	URL Reputation: safe	unknown
http://jquery.com/	chromecache_265.1.dr	false		high
https://clients2.google.com/service/update2/crx	manifest.json2.0.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
151.101.1.229	jsdelivr.map.fastly.net	United States	54113	FASTLYUS	false
142.251.40.205	accounts.google.com	United States	15169	GOOGLEUS	false
142.251.41.14	clients.l.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.72.100	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.1
192.168.2.4

General Information

Joe Sandbox Version:	38.0.0 Beryl
Analysis ID:	1307215
Start date and time:	2023-09-11 12:32:29 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 10m 25s
Hypervisor based Inspection enabled:	false
Report type:	light
Cookbook file name:	defaultwindowshtmlcookbook.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Run name:	Potential for more IOCs and behavior
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	Technical Spec.html
Detection:	MAL
Classification:	mal52.phis.winHTML@40/43@10/7
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .html

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe
TCP Packets have been reduced to 100
Excluded IPs from analysis (whitelisted): 142.250.80.35, 152.199.4.33, 34.104.35.123, 142.250.72.106, 142.250.80.10, 142.250.80.42, 142.250.80.74, 142.250.80.106, 142.250.176.202, 142.251.40.202, 142.251.40.234, 172.217.165.138, 142.250.65.170, 142.250.65.202, 142.250.65.234, 142.250.81.234, 142.251.41.10, 142.251.32.106, 142.251.35.170, 142.251.40.99
Excluded domains from analysis (whitelisted): www.bing.com, mscomajax.vo.msecnd.net, edgedl.me.gvt1.com, cs22.wpc.v0cdn.net, update.googleapis.com, tse1.mm.bing.net, clientservices.googleapis.com, displaycatalog.mp.microsoft.com, arc.msn.com, optimizationguide-pa.googleapis.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: Technical Spec.html

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1558
Entropy (8bit):	5.11458514637545
Encrypted:	false
SSDEEP:	48:OBOCrYJ4rYJVwUCLHDy43HV713XEyMmZ3teTHn:LCrYJ4rYJVwUCHZ3Z13XtdUTH
MD5:	EE002CB9E51BB8DFA89640A406A1090A
SHA1:	49EE3AD535947D8821FFDEB67FFC9BC37D1EBBB2
SHA-256:	3DBD2C90050B652D63656481C3E5871C52261575292DB77D4EA63419F187A55B
SHA-512:	D1FDCC436B8CA8C68D4DC7077F84F803A535BF2CE31D9EB5D0C466B62D6567B2C59974995060403ED757E92245DB07E70C6BDDBF1C3519FED300CC5B9BF9177C
Malicious:	false
Reputation:	high, very likely benign file
Preview:	// Copyright 2015 The Chromium Authors. All rights reserved..//.// Redistribution and use in source and binary forms, with or without.// modification, are permitted provided that the following conditions are.// met:.//.// * Redistributions of source code must retain the above copyright.// notice, this list of conditions and the following disclaimer..// * Redistributions in binary form must reproduce the above.// copyright notice, this list of conditions and the following disclaimer.// in the documentation and/or other materials provided with the.// distribution..// * Neither the name of Google Inc. nor the names of its.// contributors may be used to endorse or promote products derived from.// this software without specific prior written permission..//.// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS.// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT.// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR.// A PARTICULAR

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1266310572\_metadata\verified_contents.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1511
Entropy (8bit):	5.983945625786441
Encrypted:	false
SSDEEP:	24:pZRj/flTU3YrTkTjoYl7aoX06lWn26J+rpfwN06oXPH3prYliSQiAMwkyV:p/hUIrT27ak06lW2I+rD6kPXpr6iSQL/
MD5:	6652FA6FF9997BB0AA34A9352D2BA814
SHA1:	6F5009ABCB4CC20768BDCD65D145F8546F6D9A4E
SHA-256:	34FE63A63FC8EFA6FE7254ED32B0578ABC96BE4B9C6EC9D0F1A0626CEF396EDC
SHA-512:	3A73F758B221B5FD04C1D1FACCEACF9CA24DEAB6001BE6E734BB1F8B8EE1F5281603EA0408C74DF0ABB78D5805F1BCE52078FB6648DA78510ECBC8543ACDD9BC
Malicious:	false
Reputation:	low
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJMSUNFTlNFIiwicm9vdF9oYXNoIjoiUGIwc2tBVUxaUzFqWldTQnctV0hIRkltRlhVcExiZDlUcVkwR2ZHSHBWcyJ9LHsicGF0aCI6ImNybC1zZXQiLCJyb290X2hhc2giOiJGTVVwNlFRZDczTjVWZDdqYUU2Rzdyc0Q0LVI1dEZCU2ZIdGxhRHRSM2VNIn0seyJwYXRoIjoibWFuaWZlc3QuanNvbiIsInJvb3RfaGFzaCI6IlFkZ3hJSG10eDV0X3NxY1Q1LVViVmpxRS1wT3JGRGxpRFEyZVZ1QWZQVzgifV0sImZvcm1hdCI6InRyZWVoYXNoIiwiaGFzaF9ibG9ja19zaXplIjo0MDk2fV0sIml0ZW1faWQiOiJoZm5rcGltbGhoZ2llYWRkZ2ZlbWpob2ZtZmJsbW5pYiIsIml0ZW1fdmVyc2lvbiI6IjgyMzIiLCJwcm90b2NvbF92ZXJzaW9uIjoxfQ","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"kdPBT3vO_KPvtSdwwwlZQI9vqUl5YhhtqZ1c2cyZfDOQwoTqHYJiix-nTZ0U2L5TPFYElmGSJ1Izih6P7DpSdA5Z7r4XEe0SBTytuxEMSbgQbinoT5NaYaUQclzPUoekeGITCeo15dAYqpSXf-_nEJEvDltSatzKcs1_J6FWNpgwvcj4r1UHFBgXwmiL3x0E89FKqEpyZeutEIJZU3D9Ci9a4OFoeOISRTMgkRk4et0Ol6YWEQobxTn3OTc4pZNBwII

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1266310572\crl-set

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	23617
Entropy (8bit):	7.834230739893216
Encrypted:	false
SSDEEP:	384:u26XPK12vsBUiZetscfm8/ca3PgQXForZxK0ehJ0tspr6FZ7iUv2xBRmNDO9iK6e:uf9kvosE9ca3YQXFoVE0MJ0WpWXFeRmM
MD5:	F303FC1C1E9DC6988C6619EE4993067C
SHA1:	C432B316E0C1BF83DDFF819DA25B241EE97FC218
SHA-256:	327489661376705F7CA2195C74B9A99356BC1DE7510C8F85DE4FCE041C14D8B1
SHA-512:	64499DA07EB977BF46A9BF3A48BAA180FACF89161F04A1A0E53D6D62F5069EAE91B807EC49C48EA29A19A1F02C9AA093C728F271A79AE28827E73C933433A44C
Malicious:	false
Preview:	..{"Version":0,"ContentType":"CRLSet","Sequence":8232,"DeltaFrom":0,"NumParents":215,"BlockedSPKIs":["Jdoa1Yu/z7In2HI7GFfUwY57qnQXtPnv+TZrXoafizk=","li5LVLuYp+5dX+uWM/mR08MwDpUU2t57DU+CjHlPjoc=","yP3cdcsb27WMB7TqhHKH9iZlndZrwQomrdm1dbOgo40=","BN3pqpp59hSYaCMl+ghwJ2cH+5ypU4QSC0aJMmhJT8k=","6of0Yt7v/713daoqS34Py5HCLu5t9p7ZAQDMxzsxFHY=","xj1oxkihi3dkHEJ6Zp1hyXaKVfT80DIurJbFdwApnPE=","ev5LBxovH0b4upRKJtWE1ZYLkvtIw7obfKuEkF8yqs0=","tbqN1/iVZMKInT1kU8hJmMd4JJGbZOoINapimGWRvlA=","wO0gU0a7veButWD1zuAqNjTiR0p+ds+PvvVjuxF90OM=","eBpM8ukkUvPuAdDDgaQhTzkEFlw5CtvWH80RJE4Jstw=","/NdsyiNH5c1bOTR/Uc9DZUtpor/JBzZwpr5H2HAebg4=","lo26afv/Fb83YgiUMa3lp+rUt+rxvnACaBC8V9HGT24=","fNKVt1VEgIq9lAlGbwg3xarcAuM7YVDGZE3goJZZ8jw=","9Sk9R+041MMbLULe47WzrOl8omyirANl42Iu6AITH7s=","nFmjzK6kaZhCsGjPxSz5RdtRmGlXyDLNsYynOEn7ue4=","OUz/WJ5okxLPwHHuC8Gf5MYGIWzlQ0Kd5tti5C27O8E=","NuqWEoyJg5+2IfitDh7gucIgb2Kre02ixnZYk8m3ztI=","pqyh7JgJzFtIIf+dKcXr5lGWC5Gx8ZzIm1Xvh4GKlQk=","MO/kE4JHbDOA8C9+I+ZrovhnsFnuHqaHlrRBuFtdElY=","r1kVG

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1266310572\manifest.fingerprint

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	3.816339954651471
Encrypted:	false
SSDEEP:	3:ST23e6xGFEEng49CiSvANwK1V:SyZAtnhjSvAD1V
MD5:	2F21489B71491EBEB1E3C2EF65BA2B28
SHA1:	8A20B28E140DADC382E451A6DC38291BC77AC9A8
SHA-256:	D4BB91EB3103556F40104B3BCD6BD9B2D6FC0EA5D4F16E122AE04AD3895C81CB
SHA-512:	EFAA774964A5B82C1D3D149B40DB94E0143A0EE52822CFD949747E00C23B28B0B02F02D2B88F6FBAF8FD6AAD978C4425D3D095BBAD6E8697C8C0CA251F10C6CB
Malicious:	false
Preview:	1.67ffe7674a531def76f982abd8ebae18f22e75a028e5aa71667ee3068fc16b00

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1266310572\manifest.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	94
Entropy (8bit):	4.760520139428324
Encrypted:	false
SSDEEP:	3:rR6TAulhFphifFJ8TS8QKLBJhFgS1z:F6VlMETS8/0S1z
MD5:	9F5552CB032FBA08EA5D4B826A162FD1
SHA1:	C70B7B6DE6FBC15DFAB05207E2159031CB7F9DBB
SHA-256:	41D8312079ADC79B7FB2A713E7E51B563A84FA93AB1439620D0D9E56E01F3D6F
SHA-512:	D4D30DB83F44CA86E4647898B8BC09A695B2817EECE0E1E3989C723DEB3E19C41920CE21FC787D62F50CE2F1AEEDDEBC6F933AB4B01352DAAEACF95CACA22A95
Malicious:	false
Preview:	{. "manifest_version": 2,. "name": "crl-set-9568529144704506009.data",. "version": "8232".}

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1466566541\LICENSE

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1558
Entropy (8bit):	5.11458514637545
Encrypted:	false
SSDEEP:	48:OBOCrYJ4rYJVwUCLHDy43HV713XEyMmZ3teTHn:LCrYJ4rYJVwUCHZ3Z13XtdUTH
MD5:	EE002CB9E51BB8DFA89640A406A1090A
SHA1:	49EE3AD535947D8821FFDEB67FFC9BC37D1EBBB2
SHA-256:	3DBD2C90050B652D63656481C3E5871C52261575292DB77D4EA63419F187A55B
SHA-512:	D1FDCC436B8CA8C68D4DC7077F84F803A535BF2CE31D9EB5D0C466B62D6567B2C59974995060403ED757E92245DB07E70C6BDDBF1C3519FED300CC5B9BF9177C
Malicious:	false
Preview:	// Copyright 2015 The Chromium Authors. All rights reserved..//.// Redistribution and use in source and binary forms, with or without.// modification, are permitted provided that the following conditions are.// met:.//.// * Redistributions of source code must retain the above copyright.// notice, this list of conditions and the following disclaimer..// * Redistributions in binary form must reproduce the above.// copyright notice, this list of conditions and the following disclaimer.// in the documentation and/or other materials provided with the.// distribution..// * Neither the name of Google Inc. nor the names of its.// contributors may be used to endorse or promote products derived from.// this software without specific prior written permission..//.// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS.// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT.// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR.// A PARTICULAR

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1466566541\_metadata\verified_contents.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1862
Entropy (8bit):	6.007795404172325
Encrypted:	false
SSDEEP:	48:p/hUksmAdtpkakrNx9vNmUBQjoktzT4hIZ1Di:R9fQtia4LVmV8SzJZc
MD5:	1D63DDAD86600A3CAD88D67A6CB132C7
SHA1:	11A475F32BC8125564E19D76065D46FDBFF6F1C3
SHA-256:	78933430FF577532242F8FA44C9E87D3A4D30F08B0FBC5AF48663ABB16F5F52E
SHA-512:	AE69344AE3EA0322ECFB6AB99EDF65F7B35D40D06EE5541A38992CA0397738FDD97839B816AD20A19DE0EE2D6EDD9E436657AE0A007CD0DA4157FA1C0B139E8E
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJMSUNFTlNFIiwicm9vdF9oYXNoIjoiUGIwc2tBVUxaUzFqWldTQnctV0hIRkltRlhVcExiZDlUcVkwR2ZHSHBWcyJ9LHsicGF0aCI6ImtleXMuanNvbiIsInJvb3RfaGFzaCI6InZHRU95OXF6d1JUVnd0SHFRMWM2MnhnZERLWHBQOWVZTG1KTnJwYW9DanMifSx7InBhdGgiOiJtYW5pZmVzdC5qc29uIiwicm9vdF9oYXNoIjoiQmxfMVZtRVJfbHZvZ3Z1aU9wd0JuQV9nay1FMzliWmJTaGtsRl9ZM0tDUSJ9XSwiZm9ybWF0IjoidHJlZWhhc2giLCJoYXNoX2Jsb2NrX3NpemUiOjQwOTZ9XSwiaXRlbV9pZCI6ImtpYWJoYWJqZGJramRwamJwaWdmb2RiZGptYmdsY29vIiwiaXRlbV92ZXJzaW9uIjoiMjAyMy45LjQuMSIsInByb3RvY29sX3ZlcnNpb24iOjF9","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"XLjrDhE6Thv44duSFoWCww_40gcqA5ZgZntFYdJaTz9l8fQpOXypVs1wlcpjuVzVAT_ujBw2cky8Wo6HiF3_PdAe07nj8CV0G4huWzTKq6jbkUgvzrhZLypce5rn1-QG56RY3V34vOlCDaGr3fB1hGFdNy5sWyttY8z9ur9zS43pO0iI7pnbaeJbKcaG_PU3iJJF-tMrBMW3tXcEdyJ0ukz4SbTrVGM0HBPaFfG4gX_Ea4_Ws_582Cl6e

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1466566541\keys.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3785
Entropy (8bit):	5.9760383777426895
Encrypted:	false
SSDEEP:	48:YDsaFVa7e+LaC8MRxFp9PCCJEMYhWYEWCi60PKEy/++taBDETAo7Usjcs3CFOL3h:UDyi+m0plhYvPuW+ozdswsDm4+y
MD5:	4C5679DCB8C4DEDFECBE6CF659A4BB19
SHA1:	32654A6213F24DAD48271D725CA8FC3F3B342CDD
SHA-256:	BC610ECBDAB3C114D5C2D1EA43573ADB181D0CA5E93FD7982E624DAE96A80A3B
SHA-512:	C638A465540711E75C601F6F9ADE444D596A9CDD7894E39A58E0896926CD9CE95F637E4BA66850F89FAFBA73E7D4564F296E7F2EF3551CFB0F0CA7948E354975
Malicious:	false
Preview:	{"https://polyset.xyz":{"PrivateStateTokenV1VOPRF":{"batchsize":1,"id":1,"keys":{"1":{"Y":"AAAAAQQ7W5gOubJT3kTpzNGsekT9RZPXgXGrOMB2+QPw/ZzAuLrM3kc8eyHuTc1KmKjH4sh5+ev5GCI4HVVd46o6rWvNvk0iZQtVuUPhT8X54Ajebng8v5zUnpnPuTjGqlc7+MM=","expiry":"1725389687915000"}},"protocol_version":"PrivateStateTokenV1VOPRF"}},"https://pst-issuer.hcaptcha.com":{"PrivateStateTokenV1VOPRF":{"batchsize":1,"id":1,"keys":{"0":{"Y":"AAAAAAQn0iKkl4Xm6zKsIwQxrjdWuG5y1Dx/HhjZEzg5gzHs/bMzXRC4YqKI8JtrTOg1kzZLcQT4hDYmeuEnGZRSS4ZBtEVwnbk72AH9CB3041g+A2Y8AvXdrBZyBJaswydxU70=","expiry":"1691836104000000"},"102":{"Y":"AAAAZgStKBZhkdiDfCd2M72lOVQEm/8Gs8OokCr6q689DfraBUy2OAqS3fT3CRtHcIFsHHWTmFKfYNYbhDV9lOTeJiwGh/o2c5kSPczpgca9LEoJoNvCttwUfhzApxRQipTktSs=","expiry":"1699612104000000"},"118":{"Y":"AAAAdgTPJ4DSXNbDsSzd0lau1l+PDvS7j7rvWaXeb8Dq+bVbsHi49gWgtAmOvEhrx7qqlsMbowW9oFp+8hpMz0iPetfzNlpZ/rgchHMVGA2mAcUUD6hZpLFwi/WzzjPNzNjghiU=","expiry":"1694428104000000"},"134":{"Y":"AAAAhgQdOOxzj3+ff1GYbZKKas301vAlY5T1+HuRLecI7+aSpZHiJD

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1466566541\manifest.fingerprint

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	3.8008506520558254
Encrypted:	false
SSDEEP:	3:SbzQRXmduB0RgWjQVRtUSqRGn:SnQR1b37tUSqRGn
MD5:	CD5C5BE8BB4AF01A611849D1A2C6DB93
SHA1:	54F31907FE7801B6BA896F84F8380D102B5ED18F
SHA-256:	2B0AA4025B5A730B4E82B9C8F68DC7EF2862AB9E06392F4D2E58045E4436F5BD
SHA-512:	B49A0FE14C66CC52E70330738712816D3645F19AF215B4F85C97F5D27290C595E19B39636AEF2E8E2C6F7AC160180EF9641F5DEBAB16F6B23394E56EF885F336
Malicious:	false
Preview:	1.d777e561d401292893abda887af337f2d2e9755e47dd4a42402130484d09429b

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1466566541\manifest.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	78
Entropy (8bit):	4.461657354427988
Encrypted:	false
SSDEEP:	3:rR6TAulhFphifFIPgS1Cc/:F6VlMyPgS1Cc/
MD5:	443A81033B27A223C24CF48E4D9AAE1D
SHA1:	9ED8E922D5DF302FD3D603E56E4376277FE999EC
SHA-256:	065FF5566111FE5BE882FBA23A9C019C0FE093E137F5B65B4A192517F6372824
SHA-512:	6428762F32CA76D822C3C84FAE2F11B9F2EECDCA43BFD50DAC4AC1CC39FB58A8936695393FF48360477EB03B8BFF8D5BD8EA1697257B07ED687A7AEA062C84B8
Malicious:	false
Preview:	{. "manifest_version": 2,. "name": "trustToken",. "version": "2023.9.4.1".}

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1529049173\Filtering Rules

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	69553
Entropy (8bit):	5.52691718018853
Encrypted:	false
SSDEEP:	1536:ka8qvNfUcbKG02Sl+XeMKPsNZgAswyO+BOK+IAhxLMBoyZK:lvNMcbn02w+lycgAjz+YKvAhxEoyZK
MD5:	4E79F99222C8AA2B00F8B66CC5E4270B
SHA1:	8DA8A30DE6CF19325B67D50EB778E57ED3ED04C4
SHA-256:	BA0FCB562204929BB9639CE90E91625B49321845EC8940776A53DA4FC093BBA1
SHA-512:	CBE59C405A7B94E561982294029F87D7027F505218AF2E607A08EE35E0D4B53A846019BF7A9F00583C454FE2D4A83993F5C7BB787258180155269746D0ACB3B2
Malicious:	false
Preview:	............0.8.@.R.-728x90...........0.8.@.R.adtdp.com^..........0.8.@.R.sdbvveonb1.com^..........0.8.@.R.yomeno.xyz^..........0.8.@.R.yellowblue.io^..........0.8.@.R.ad999.biz^..........0.8.@.R._468_60...........0.8.@.R..adbutler-..........0.8.@.R.hdbcode.com^.-...........konograma.com..0.8.@.R./adserver..,........0.8.@.R.mysmth.net/nForum//ADAgent_..........0.8.@.R.indoleads.com^.%......0.8.@.R.discordapp.com/banners/.E...........daum.net0.8.@.R)daumcdn.net/adfit/static/ad-native.min.js.(........0.8.@.R.looker.com/api/internal/.#........0.8.@.R.broadstreetads.com^..........0.8.@.R./banner.cgi?..........0.8.@.R./in/track?data=.!......0.8.@.R.linkbucks.com/tmpl/..........0.8.@.R.ezojs.com^..........0.8.@.R.clicktripz.com^.Q...........weatherbug.net0.8.@.R/web-ads.pulse.weatherbug.net/api/ads/targeting/.(........*...ads.ae..0.8.@.R./upload/ads/..........0.8.@.R.-ad-manager/.#........0.8.@.R.searchad.naver.com^..........0.8.@.R./page-links-to/dist/new-tab.js........0.8.@.R.files.sla

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1529049173\LICENSE.txt

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	24623
Entropy (8bit):	4.588307081140814
Encrypted:	false
SSDEEP:	384:mva5sf5dXrCN7tnBxpxkepTqzazijFgZk231Py9zD6WApYbm0:mvagXreRnTqzazWgj0v6XqD
MD5:	D33AAA5246E1CE0A94FA15BA0C407AE2
SHA1:	11D197ACB61361657D638154A9416DC3249EC9FB
SHA-256:	1D4FF95CE9C6E21FE4A4FF3B41E7A0DF88638DD449D909A7B46974D3DFAB7311
SHA-512:	98B1B12FF0991FD7A5612141F83F69B86BC5A89DD62FC472EE5971817B7BBB612A034C746C2D81AE58FDF6873129256A89AA8BB7456022246DC4515BAAE2454B
Malicious:	false
Preview:	EasyList Repository Licences.... Unless otherwise noted, the contents of the EasyList repository.. (https://github.com/easylist) is dual licensed under the GNU General.. Public License version 3 of the License, or (at your option) any later.. version, and Creative Commons Attribution-ShareAlike 3.0 Unported, or.. (at your option) any later version. You may use and/or modify the files.. as permitted by either licence; if required, "The EasyList authors.. (https://easylist.to/)" should be attributed as the source of the.. material. All relevant licence files are included in the repository..... Please be aware that files hosted externally and referenced in the.. repository, including but not limited to subscriptions other than.. EasyList, EasyPrivacy, EasyList Germany and EasyList Italy, may be.. available under other conditions; permission must be granted by the.. respective copyright holders to authorise the use of their material.......Creative Commons Attribut

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1529049173\_metadata\verified_contents.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1529
Entropy (8bit):	5.977290792405794
Encrypted:	false
SSDEEP:	24:pZRj/flTHY/2rYuM/0kYbK33S/fJ9njeT3fzkaoXp4+hgArdUQrcQPM00Ec5ToXZ:p/h4/oYudbKHE8TLkakeAr5kEc5kLiRe
MD5:	8963F922FD8A2398DDF8A2110EF38ED9
SHA1:	1C933A5F7448DC5A4D3FC4184CA39194C7248CE5
SHA-256:	4431EFD885A6180D1791CA8BD73825979764604876248708D291F5C308BC8525
SHA-512:	BB3A6A824F02FC72FB016C8714D04BCC1F92D54F76CDC542BABF1D6D6DD075F6D396BB5A58136A91F013ABD02375B9A1E90A055044DC96078415B7155C3EE1C9
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJGaWx0ZXJpbmcgUnVsZXMiLCJyb290X2hhc2giOiJSTTJIVXJFbW1qcWZuVGhkOW5XemR3Y3ltOXJtN1NoZDMtcEZoMDloakdVIn0seyJwYXRoIjoiTElDRU5TRS50eHQiLCJyb290X2hhc2giOiIyaWswNmk0TFlCdVNHNWphRGFIS253NE9pdnVSRzZsQ0JKMVk0TGtzRFJJIn0seyJwYXRoIjoibWFuaWZlc3QuanNvbiIsInJvb3RfaGFzaCI6IjlJWXZ5c01kVUFxOC1TNXA0RXBqMVZRRGFoRnZ4NkcxemtrQXFYZnhnSUkifV0sImZvcm1hdCI6InRyZWVoYXNoIiwiaGFzaF9ibG9ja19zaXplIjo0MDk2fV0sIml0ZW1faWQiOiJnY21qa21nZGxnbmtrY29jbW9laW1pbmFpam1tam5paSIsIml0ZW1fdmVyc2lvbiI6IjkuNDguMCIsInByb3RvY29sX3ZlcnNpb24iOjF9","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"gZwdcsDi8v8b7fOHFQHW7XILADshqFz_EBvNPby9FkNl19TTdFNcO8hnvndpBXlsO2zQk5FoIQf3ManYbsuNou--1SKSwJQt_nNdLJulv1CZydfGovMAibyGR-Vr-P1HIpRP-zZO1UBpWLMx5W9UBsd1E1obEOnCgZveuk2CdC_s8U7FeDteD_6Ab-0dVlQrD5h-NLfTz08NrLWinsLmgjWs0aZ1K8zhbiYFjhsTTwkB83hYY

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1529049173\manifest.fingerprint

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	3.950257764683233
Encrypted:	false
SSDEEP:	3:SXrRVXQkQUnBgdBf8HVBHGHn:SbztBgdBELwn
MD5:	1EFEBEC186A9D8843B56079F970505D6
SHA1:	34D167A9F5302EA4DAE12E79B6ADACB9BE8B6764
SHA-256:	BD7EC9A59677BADB47462EC67DAB685F214D542B7EC5829418FAFE400FC1EE79
SHA-512:	B5AA000B31A5F8E70BC82F22CCE8F4B3B062458C3F6737D64C714B4D35EEAC0EB85CDDD806173C7F43934233ED6356DA14FE5B862AB059DC98804A504311841D
Malicious:	false
Preview:	1.283f61dc5c8c0f4f6ca2979adb45d79401932496f88f528e55cf40eff6badbcb

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1529049173\manifest.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	114
Entropy (8bit):	4.56489413033116
Encrypted:	false
SSDEEP:	3:rR6TAulhFphifFHXG7LGMdv5HcDKhtUJKS10PY:F6VlMZWuMt5SKPS10g
MD5:	0759A1DC1411E07A494D5856DCB9E817
SHA1:	48BE8F53D0537490DC9DC7DE53E1A4E3E9648D87
SHA-256:	F4862FCAC31D500ABCF92E69E04A63D554036A116FC7A1B5CE4900A977F18082
SHA-512:	4061A0606CC2B4E9A38621BD1F58789787DC521727AC859A904E665C36B95531FF6C44CED552B4ED16AD765640B7C5FD4E0C396D0CB2434F43FABEA9E1681479
Malicious:	false
Preview:	{. "manifest_version": 2,. "name": "Subresource Filtering Rules",. "ruleset_format": 1,. "version": "9.48.0".}

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1566901044\Preload Data

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	16778
Entropy (8bit):	4.9275961707136515
Encrypted:	false
SSDEEP:	192:f7YDGKkiYWkm/irzSgirslBAw8a0GklUH8ya2UR1TEK2NnkfQ7BQJlh:jYDTYPm/I9XlBAw8NGke5fshct6vh
MD5:	35CC7B1EF8E2FEBD3BADE4FCFC0FDD6B
SHA1:	5C99840B246D52E4CA8BB56A7320E1C07118A258
SHA-256:	3A452CD4F2109FF6486A36596D42A70CE0579F434935B4C899FE3FB3FC1202B4
SHA-512:	7653E2C071927C91AC86254DC6FF0FC989419F1C4953E87FF822BEBC46A4AFF971A4A65EA9E58A8B44B8AC06A721D112320F7C78DB81ADC4CE4B8D562C32B999
Malicious:	false
Preview:	....100biografiy.ru......1337x.unblockit.page......1337x.unblockit.pet......1progs.ru......24sedam.rs......4systems.ru......50style.pl......7learn.com......8a.pl......admmuji.ru......all-audio.pro......allo.ua......altarena.ru......americansongwriter.com......analyticsindiamag.com......animepahe.com......animepahe.ru......animixplay.sc......anonyviet.com......antyweb.pl......anysex.com......anzalweb.ir......auralcrave.com......avtika.ru......ayther.fr......baikiemtra.com......bandung.kompas.com......bestofsenior.com......beszamel.se.pl......bigl.ua......biguz.net......bilgi90.com......bingoschool.ru......biz.today.ua......bizflycloud.vn......biznes.interia.pl......blavity.com......bluemediafile.sbs......bluemediafiles.com......boombo.biz......boredomtreatment.com......br.millenium.gg......brobible.com......bschool.careers360.com......btrending.com......buh.ru......burdastyle.ru......businessinsider.com.pl......buzzday.info......bystock.me......carsandyachts.com......ceotudent.com......

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1566901044\_metadata\verified_contents.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1769
Entropy (8bit):	6.015472313709475
Encrypted:	false
SSDEEP:	48:p/hMByfRhakbQsilffrtzVwlIWpuTkMVRwrHI:RsyfraCQnr1eILvVRwjI
MD5:	915DD053C9D61F71FA20C03CF583C596
SHA1:	64F142268DC99807D95FA4D1BA69EE76DEABFD40
SHA-256:	E53BCD5EE2046DE111FD9F15CDD6CE7BDF746FE543A48A7305185A0553DD3A1D
SHA-512:	65B15662E33ABC1F880C567FB9CC15D2965492C0E96409D3E20916A901B503C52011FF6A7213E82DD4771B3ABB3C59CE79C4849BC33F17DE0CFF84A8CED54AB3
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJQcmVsb2FkIERhdGEiLCJyb290X2hhc2giOiJ5blk2UFBQcU8zOVVVeUlZY3JLdVhwUU8yUmtjS0hIVlFRN2VqTXJDVUh3In0seyJwYXRoIjoibWFuaWZlc3QuanNvbiIsInJvb3RfaGFzaCI6ImtrOFFEUUZab2wwcVlpWGhrOG43c0tHMk1xZ0RvMUFIVEIyRGpzM2V5TDQifV0sImZvcm1hdCI6InRyZWVoYXNoIiwiaGFzaF9ibG9ja19zaXplIjo0MDk2fV0sIml0ZW1faWQiOiJnZ2trZWhnYm5manBlZ2dmcGxlZWFrcGlkYmtpYmJtbiIsIml0ZW1fdmVyc2lvbiI6IjIwMjIuMTIuMTYuNzc5IiwicHJvdG9jb2xfdmVyc2lvbiI6MX0","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"UbFi8YEafzoPiA9S6jBdAUYhpI3UJSHfdyugD6CTSyXhDSboF_dVVNE0Qu31T_6HVvoufIrM6Yq3kT_8LFdbmOh4nAfd0WjsTBu1wGuN2pQWuQW3in6dLGW6DdRJMi1zBFbn-VFWscuesOSRVYjjxhocmrvYwdlsSXwkQNFjs3FUWVlxB_UXEl89eXdycs9ITYVfay1Esbu3zmlZfiJH0rICtkFqkgarRMR8bbIGOpQghrukJ9coiq8KFJgntQNGsEuUW7y7s6Z1Wdz-DyLdUpxATKdMcO98soq0k4Vk3jnf2_-j7x8cIzoXWeWdIHQ24vjuu0BBReSJoOn3DCbsbM

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1566901044\manifest.fingerprint

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	3.6986501450349536
Encrypted:	false
SSDEEP:	3:SkXDRBhDcSc8k6DMVE+gESXuvBhSd:SEhDKaDygEkuZhSd
MD5:	C479CD0BE6AE6D19A0D76AD8D639EE4D
SHA1:	B3C7D2D47F1A27B878BCDAC6F2FAF78D3FCBB064
SHA-256:	7EB34DBB0FAD3B692C5C110A87D829E88512BE26176FCAEA6802353E5D9911E4
SHA-512:	F9ECD8EFCEC108C47FD97AA70FD09C1E608F161F8DDDBDB1E82DA7BB568B23FF38A2961153956B92475DB5C2E72B498C68B246261AB800E8AC7B1D76E2A1A521
Malicious:	false
Preview:	1.ed2f4d0fa9d2f99837719f80e3990498314290c6a294a72296ddcada784dd278

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1566901044\manifest.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	110
Entropy (8bit):	4.626932384026503
Encrypted:	false
SSDEEP:	3:rR6TAulhFphifFv3ahFFKfHyX/tUJKS1iUBIY:F6VlM1cKfHyFPS1uY
MD5:	02A1141A8348043FEFDBAEB928EF9F4E
SHA1:	2CA475E66E8441B04F699CFE6DC6D1C6ABC3A6D6
SHA-256:	924F100D0159A25D2A6225E193C9FBB0A1B632A803A350074C1D838ECDDEC8BE
SHA-512:	C47AF02F09C3B7339F8EA267C87B490C73DD2257E52E2D66D877B188ED3D8C07B4A9B490BC70499F616B1098CA28CB5B6229C67FB73A4027923B7EFF82B4F8F3
Malicious:	false
Preview:	{. "manifest_version": 2,. "name": "Crowd Deny",. "preload_data_format": 1,. "version": "2022.12.16.779".}

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1996625029\_metadata\verified_contents.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1765
Entropy (8bit):	6.016932513650603
Encrypted:	false
SSDEEP:	48:p/hKAGj0FnAp7XgNGIaku9E5tPJXaWqkbszesM:R5Gj0FAlsaBmfPsRD3M
MD5:	6D1D175F88B64546105E3E7C31D1129A
SHA1:	75A1B56F55BB62B05365A0FDBFC7941DE77CBFAF
SHA-256:	A0BC246E8E160A9BB32FA60F4E7A04D148A17125F426509466031E07731FDF81
SHA-512:	5C80908331E30C7EAD67F7F6C5AB064B07626FD9C58925A0D2124D66B25C5AE2F218BDACFB68AFCB332E88EB297CFB7E0A7A9E5E1E54C9B7A510FEF095F9B54F
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJtYW5pZmVzdC5qc29uIiwicm9vdF9oYXNoIjoiSUxrUllPSmhIVEZacllLRmN5UC12SkJrVjNWbWVLdHo4d1hEb2VPWjBZMCJ9LHsicGF0aCI6InNzbF9lcnJvcl9hc3Npc3RhbnQucGIiLCJyb290X2hhc2giOiJyRFZLUnlPcXBQQnI3RGhkM2VTazBKZzYxUlJXOVNzeHFBYU95WDFiWHFjIn1dLCJmb3JtYXQiOiJ0cmVlaGFzaCIsImhhc2hfYmxvY2tfc2l6ZSI6NDA5Nn1dLCJpdGVtX2lkIjoiZ2lla2NtbWxua2xlbmxhb21wcGtwaGtuam1ubnBuZWgiLCJpdGVtX3ZlcnNpb24iOiI3IiwicHJvdG9jb2xfdmVyc2lvbiI6MX0","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"nBdNk-7bgnEftAs4hWaHwF1Lk9pt7Eh6pcqe2gyNsE7VnVRp-H27tm1RFAF4htCUlXNJxX6YY-MUiK2DqJpQ3c73KDaFV8DcnadQfcXO3Lbrw7jLYSUaSdzujPkTyhuFcq_BhK0KWiIJ0aJgh7nVOBfAa5AbE6oFlLKMB2Ls0gmzS1-a5hUIu4rw2h9r9jkr6gLYbein5Jk2hdwW3u-1GNjyki4dftG2iZNAI8VhUf5gnCiF4AHCnYSGJsM0RGkmO_HJIzgwpQpP3RDsG2ioeKgxL-kcHhjXWOj3uVGyxpp1FkyHGkeGuqpFZMAxx3CEBiOtFj7i3iQxkgEW-E3uMKI3yA

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1996625029\manifest.fingerprint

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	3.9570514164363635
Encrypted:	false
SSDEEP:	3:SVCBGERJd9WaHpYx4eiXoA:SVCwERJdVMiXd
MD5:	C6ABF42CB5AF869629971C2E42A87FD5
SHA1:	6EB0FAE28D9466E76FA12E31FE6CDADD3ACCE4D1
SHA-256:	D281AFDA759075F4CB7D7CEEC4A3CB2AF135213B4D691F27090E13F238486AD1
SHA-512:	EDDF7E4883E82718743C589E8F2E48BEAD948428E730231FEFADAD380853343332BC56C9DC61C963B3F537CD4865B06FF330CEF012B152CEA35F8A0AA2C7B56D
Malicious:	false
Preview:	1.fd515ec0dc30d25a09641b8b83729234bc50f4511e35ce17d24fd996252eaace

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1996625029\manifest.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	76
Entropy (8bit):	4.169145448714876
Encrypted:	false
SSDEEP:	3:rR6TAulhFphifFY8Wypv/KS1f:F6VlMQyBSS1f
MD5:	4AAA0ED8099ECC1DA778A9BC39393808
SHA1:	0E4A733A5AF337F101CFA6BEA5EBC153380F7B05
SHA-256:	20B91160E2611D3159AD82857323FEBC906457756678AB73F305C3A1E399D18D
SHA-512:	DFA942C35E1E5F62DD8840C97693CDBFD6D71A1FD2F42E26CB75B98BB6A1818395ECDF552D46F07DFF1E9C74F1493A39E05B14E3409963EFF1ADA88897152879
Malicious:	false
Preview:	{. "manifest_version": 2,. "name": "sslErrorAssistant",. "version": "7".}

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1996625029\ssl_error_assistant.pb

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	2816
Entropy (8bit):	6.108955364911366
Encrypted:	false
SSDEEP:	48:jkbh6AW2Bfc3osI6Hc3+XgU+EVeY55J4gXM/QDH4yq2dxckdfmkM:jkbhM2a3pntgQVb8Ylq2di
MD5:	E2F792C9E2DD86F39E8286B2EAD2FC70
SHA1:	8A32867614D2A23E473ED642056DED8E566687F9
SHA-256:	AC354A4723AAA4F06BEC385DDDE4A4D0983AD51456F52B31A8068EC97D5B5EA7
SHA-512:	6A7AF0CA1EFA65A89A9CA3B8DF0D2E24F21D91673C60CDFEEB02D33647442B01D535497249542F40E66E0D2DD3E9F8ED1F4A201FD97138D07A2B71366737E580
Malicious:	false
Preview:	...5.3sha256/fjZPHewEHTrMDX3I1ecEIeoy3WFxHyGplOLv28kIbtI=.5.3sha256/m/nBiLhStttu1YmOz7Y3D2u1iB1dV2CbIfFa3R2YW5M=.5.3sha256/8Iuf4xRbVCmCMQTJn3rxlglIO1IOKoyuSUgmXyfaIKs=.5.3sha256/8IHdrS+r6IWzSMcRcD/GA6mBxk1ECX8tGRW0rtGWILE=.5.3sha256/k/2eeJTznE32mblA/du19wpVDSIReFX44M8wXa2JY30=.5.3sha256/urWd7jMwR6DJgvWhp6xfRHF5b/cba3iG0ggXtTR6AfM=.5.3sha256/IJPCDSE5tM9H3nuD5m6RU2i9KDdPXVn4qmC/ULlcZzc=.5.3sha256/0Gy8RMdbxHNWR2GQJ62QKDXORYf5JmMmnr1FJFPYpzM=.5.3sha256/8tTICtyaxIQrdbYYDdgZhTN0OpM9kYndvoImtw1Ys5E=.5.3sha256/F7HIlsaG0bpJW8CzYekRbtFqLVTTGqwvuwPDqnlLct0=.5.3sha256/zaV2Aw1A742R1+WpXWvL5atsJbGmeSS6dzZOfe6f1Yw=.5.3sha256/UwOkRGMlP0K/mKNJdpQ0sTg2ean9Tje8UTOvFYzt1GE=.5.3sha256/w7KUXE4/BAo1YVZdO3mBsrMpu4IQuN0mhUXUI//agVU=.5.3sha256/JnPvGqEn36FjHQlBXtG1uWwNtdMj1o2ojR/asqyypNk=.5.3sha256/AUSXlKDCf1X30WhWeAWbjToABfBkJrKWPL6KwEi5VH0=.5.3sha256/zSyVjjFJMIeXK0ktVTIjewwr6U5OePRqyY/nEXTI4P8=.5.3sha256/9dcHlrXN2WV/ehbEdMxMZ8IV4qvGejCtNC5r6nfTviM=.5.3sha256/E+0WZLGSIe5nddlVKZ5fYzaNHHCE3hNqi/OWZD3iKgA=.5.3sha2

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_2084609994\_metadata\verified_contents.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1311
Entropy (8bit):	5.994124843308637
Encrypted:	false
SSDEEP:	24:pZRj/flT16TP/XVmddLH7aoXRD1Kd/fcEqLsboXzLeD0l3jXauPHn:p/hoTP/AdR7akRDIfcEqQbkzLeQl3bFv
MD5:	C1A97DC660C2981012E8722EAC79C493
SHA1:	74A9D7DDBE7FAB2539EA85663A0511EB2C9BD3D1
SHA-256:	6E16D5A1471DC84F7025967209AAEE97F77E0EA44ABC3C7C9AA881033BB2FD12
SHA-512:	7D2814EF8B96A94FE51B6BF5353D08F727E03B3A08618F595D67306B105D671C1D057E2FCA6A277D88CD31DB2E36AE16F3815D68F0EDCC45EA675E3E5BDE11DA
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJtYW5pZmVzdC5qc29uIiwicm9vdF9oYXNoIjoidTFGQlVURzJJakVRRDJ2OGxHOTNHTmVCd2RpLVhIWTNDdHJUTzhRYlJhMCJ9XSwiZm9ybWF0IjoidHJlZWhhc2giLCJoYXNoX2Jsb2NrX3NpemUiOjQwOTZ9XSwiaXRlbV9pZCI6Imxsa2dqZmZjZHBmZm1oaWFrbWZjZGNibG9oY2NwZm1vIiwiaXRlbV92ZXJzaW9uIjoiMS4wLjAuMTQiLCJwcm90b2NvbF92ZXJzaW9uIjoxfQ","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"VrLqHTp6FqUHYFAqYZrfAAQei7A8GDnaFaXlqm2TiVeiL_eDX3IpEWPlfvKG7uoK9LjhPTwi46WN4EtY5C8-sIDVtLQ6T7kMUx4F83Xmf7KNZ5I53LdBCwvy0PMk2muC8VGUki0O27hd4EZQNiRASYuljMDwCHZoxrFzxYgjXsD0pTAwH9uZvuRzQLx29x7Z4qqIZ9zQcFyEI2TsrwS1uHxYmykgfQqyII70LhiHnKO1ojKK5_BUakHz8RWi3VLEtvKlrmHqwzT7FvTJ3PpFwf8zLDg6eHbNfPWiQMFyd6GRJF5RnZ7IiFJymvSbSITXt1pvOtz3YbGL8VXyX606gw"},{"header":{"kid":"webstore"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"LgZZPDr7zit83JQn8p1h6sOZkp31ifQTQesvR

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_2084609994\manifest.fingerprint

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	3.766537583775669
Encrypted:	false
SSDEEP:	3:SW3J8PmUrliUdEWXZEXyuWpn:SWZAmkwnWXeiuWp
MD5:	623DD9CE673F169638DC67F9350323A1
SHA1:	CF2C7F0474B0683DABD879324C1BF90D7A8649B9
SHA-256:	0E88911EBB7A8E8F17855C56D1807420E591452C75F63C733EAFACEDDFC34148
SHA-512:	6829D3CC547D9D2A774E289EBDCA804F4DCCBE28065689126C1FD62784F04F370F0D18FFAF283E21BFA7F2754297389ED6E498313F1C6EC072AF61F9BEC882FC
Malicious:	false
Preview:	1.3e4f959036fef1cae2b1f426864a23f11caae1c96a2816523f2daf4213c3cc73

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_2084609994\manifest.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	4.68789412936714
Encrypted:	false
SSDEEP:	6:zeXC6WQpVyTJCAEIfd26VO9bIA6VDHs/C6wrhKXkGqvHiV4JQVm01LwyAGI/zqSe:0eTJCAEQLO9hQADgK0Gus4Jg1LqGikf
MD5:	A0E87B96DC04DFC4DA746714A04C3A26
SHA1:	4D6A38E8138C5E7CAE0F1A26DA0CA85D6B96B74C
SHA-256:	BB51415131B62231100F6BFC946F7718D781C1D8BE5C76370ADAD33BC41B45AD
SHA-512:	3A4CCA531A413BBB18AD15F795CA354F7D1F8FB91F373A1C45D7652308AEAD31381BC26071B18984BBDFAE5AFE25C042252CAAB6C77341D2DD9A1CC57FC24785
Malicious:	false
Preview:	{. "description" : "Origin Trials public key updates and disabled features list",. "manifest_version" : 2,. "minimum_chrome_version" : "55",. "name" : "Origin Trials Updates",. "origin-trials" : . {. "disabled-features" : . [. "WebGPU". ]. },. "update_url" : "https://clients2.google.com/service/update2/crx",. "version" : "1.0.0.14".}

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_35640493\_metadata\verified_contents.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1968
Entropy (8bit):	6.023835678557244
Encrypted:	false
SSDEEP:	48:p/hl2etCI1Dfup28xNG1J7akwbh+1ey2K6E0Dd2v+FnFVjk42mwp:RTtRDG4X7aDM1e/lDdXFFVjsX
MD5:	63CCBC89C2F9B44F0992FFC169E03EC6
SHA1:	D071D55D73B4B89A2AF6722235107571DCCAB16C
SHA-256:	1DB7469767CE8FC7E0304AAAC7321F0ACF1ACE97E48ACE57C11EECCF72234199
SHA-512:	7D8983C2998E694FB86BA9D95BEAB45842F11F620BEA65F8DBCCC59C040227C4DDC0C807D80152BC461AE29BE5F5D9264581CA22FDAD8D9666F2AD61A0E36F26
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJjcnMucGIiLCJyb290X2hhc2giOiJ6WUk1eFp1Tm81b3I1bE9Ba1pXZXUwUzJ3NzZpOUh4bnVIdVh2Y01fWmlnIn0seyJwYXRoIjoiY3RfY29uZmlnLnBiIiwicm9vdF9oYXNoIjoid1cyLWRXVXE1MFplYmg0OUJOUVhLZ0JtUjltbkxZbWtDUW1QRS1CUjZROCJ9LHsicGF0aCI6ImtwX3BpbnNsaXN0LnBiIiwicm9vdF9oYXNoIjoiMzk1ZHpfRzdkNXdDenpCS1VZUXBUdUlvRkdrR0xNZnZBSEgxMlRfUTBfRSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJaLTJZVUdaN0lxNkdXb3ZrTkk1Nkk0WHZWN3dVRmhjWWhmM1NaQ29DdDB3In1dLCJmb3JtYXQiOiJ0cmVlaGFzaCIsImhhc2hfYmxvY2tfc2l6ZSI6NDA5Nn1dLCJpdGVtX2lkIjoiZWZuaW9qbG5qbmRtY2JpaWVlZ2tpY2Fkbm9lY2pqZWYiLCJpdGVtX3ZlcnNpb24iOiI3MDAiLCJwcm90b2NvbF92ZXJzaW9uIjoxfQ","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"mUVEURlr0zqHHUm_Z091TPUX574rWad8yu2NOTqhQlP6eZWRyx69RzVvpjlrAuqYxs16--zZ9BVyVNu8a8qxYVzNdPSIU2vV0BFBE3ESuPYSfNCJoarIWfyLM0cdNQxsw8PxSO1rLGp0EW8

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_35640493\crs.pb

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	144381
Entropy (8bit):	7.683742708206516
Encrypted:	false
SSDEEP:	3072:WuF3J25pko1iBr9UFfbVEshw7X/mT/hIek6wpL8:X3J25pu59ibVErDK51k6wpL8
MD5:	A6D40AE583F1EAFDBEEE35DDCAE8506F
SHA1:	BD0364BFFA76570E608FC9E1C8B7559DF42044A4
SHA-256:	760B2C3D16B445D27A85CBA18BFE13AEF5F71068E46234F82EFC0647D74934D5
SHA-512:	CC583D9DD0AA94BB24B92829596B732A38E0604D385F782229F86D2E26DA28332FE0F1F1CC8E2CBDDBC55AD29E29449379899B5BA3F73BD4CBEE204E5B3F5F79
Malicious:	false
Preview:	.....2.23.140.1.1...0...0..........W...B...0....H........0k1.0...U....IT1.0...U....Milan1#0!..U....Actalis S.p.A./033585209671'0%..U....Actalis Authentication Root CA0...110922112202Z..300922112202Z0k1.0...U....IT1.0...U....Milan1#0!..U....Actalis S.p.A./033585209671'0%..U....Actalis Authentication Root CA0.."0....H.............0...........).,....P.oQ;..Z..H8..........@?..h....-.....V.m......_.l... ...Q.iM..Zo/.D~....X.....EG.'.....!..A-/L.(....".Ve..T..C).9Fx.0#...}.W.].kHL...Z[:.."?.'3[....].7..l.zG"D5.......}f._aQ"U..F..=.5b....[....0&......G...9.......OP......<e...$....T>.:v$O.!.......G .....h...z...STy.........>.m.%...Ba.J.....e...9..<.....Z.Y...{..N.OYE..^(_..?E...o...wZ.o......J.J..D!.1EaPN...5\|L................z.tU.h....bd.m.....W............~..S.4P(X..Pq.0..xc.....+...9.^.. ..{....V....;...]...L+.....K......c0a0...U......R.:.xf..{8p....6.0...U.......0....0...U.#..0...R.:.xf..{8p....6.0...U...........0....H..............{r..`.IL.X.....dH..X

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_35640493\ct_config.pb

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	41216
Entropy (8bit):	7.858106596467348
Encrypted:	false
SSDEEP:	768:5FYDaFagC8C3KCp4B2lyzVgzjYdeF+aXIolVeQVPe3i+nQC26lpCuA89q:G3KIlyiXYgrXIoiZFQCPpfk
MD5:	77AF48078F60918D7E91A33F68DB9F7F
SHA1:	1DD534112F9D1AF0A3C7B3ACF6540291FF5D996D
SHA-256:	4E570938DBE890082A145EBC21A9660EF9352B0D8900E83CF1195D3B37BA99AD
SHA-512:	8F2D9341D411C435ED9160955E0D1C3B9577127EEA6157BC57A3CECEA8F73CA510B5611A9206AB3DCAE14E65D010ADEB521C2DE8F578082C2C8B7C055853E8E9
Malicious:	false
Preview:	..1........... .)..Google..google-ct-logs@googlegroups.comi..Cloudflare..ct-logs@cloudflare.com..mihir@cloudflare.com..dkozlov@cloudflare.com..leland@cloudflare.com...DigiCert..ctops@digicert.com...Sectigo..ctops@sectigo.com$..Let's Encrypt..sre@letsencrypt.org,..TrustAsia..trustasia-ct-logs@trustasia.com2....Google 'Argon2023' log.\|MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE0JCPZFJOQqyEti5M8j13ALN3CAVHqkVM4yyOcKWCu2yye5yYeqDpEXYoALIgtM3TmHtNlifmt+4iatGwLpF3eA==.,6D7Q2j71BjUy51covIlryQPTy9ERa+zraeF3fW0GvW4= ...)https://ct.googleapis.com/logs/argon2023/2...............B...........J...Google..........https://crbug.com/8890332....Google 'Argon2024' log.\|MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEHblsqctplMVc5ramA7vSuNxUQxcomQwGAVAdnWTAWUYr3MgDHQW0LagJ95lB7QT75Ve6JgT2EVLOFGU7L3YrwA==.,7s3QZNXbGs7FXLedtM0TojKHRny87N7DUUhZRnEftZs= ...-https://ct.googleapis.com/logs/us1/argon2024/2...............B..........J...Google..........https://crbug.com/8890332....Google 'Xenon2023' log.\|MFkwEwYHKoZI

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_35640493\kp_pinslist.pb

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	14802
Entropy (8bit):	5.35202183082279
Encrypted:	false
SSDEEP:	192:tEWjB+vK5yk0VpngQ5jlMUfFwnIl3yALG:tEWWK5y9VpngQ5jlMUfFwnIliALG
MD5:	1C39F4535CDD5255004E5F69C6CF8BCC
SHA1:	9A975997D618A3D7CE92EFDC25AFDB51A0D7EA2E
SHA-256:	8959574719E6039FB62310BA67E2DD17BC332847FC33B107C0F5EEAF20B4521B
SHA-512:	B1F812B61CAAA325E587F306C92CF69BEECE52ACB2ABF8AC6E9AD4BD6D8FE021196AE1D600834C290D843608510FA3EB7063FCA942F6C51BD0FE573E314CB98C
Malicious:	false
Preview:	..........I..test. ................................".http://report-example.test/test.....google. .....U!..c.X.w_..%gu..`.....&.. a..M.......,}..........p$.I...;. .........@.L.RJ./w..._....h.z.g. U.}...y$(....Q."[.:U..&.(.e>.... Ay...ttw..&@..=.,.....,.`.@.wCH. .G.e>^..u......uD.....6mPi...CG. .'.U{K.\|.0_.=S.....I...^'.. w.=. ....f..E..o...._.j..9h.U.... Ho....s. '.....2..2T...S(..... ..b.H.....Z..Z'..!.nP....."+http://clients3.google.com/cert_upload_json.....tor. .==...A..\Q....0.?Q.?.....8.3. Z..G".T....r$R...X.K.pPc....._. m..%0..........PP..o#Cu.Dq..8... .p..7g..W..Rm.....[vmB]..T...K.. .W...G.O.}g^...Q....).l......9.. `.uuD}..k}....$..@o.......an... .... .....`..........7..2n..6+. ..Sl.t..4.T..+.Y...A.....X....(m. .T^!.G$...T.94..IfJY.ma_.w..-......facebook. ...M.G..z.!.*..S@j:.&...k..rD.. ........{:.pDn.).`.A......c... .3= ..B...#oNP..7..s.~%M..E.M.. !.~.&9E.Y.?.s.A9.<AO.<..~..).;. ....m...].......2.[.....A.&.... ....;..."..\|Tx.....

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_35640493\manifest.fingerprint

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	3.797717226366122
Encrypted:	false
SSDEEP:	3:SSUkdJCHG6LuJKq+:SSUUJEG6UKq+
MD5:	69611B2395FF96EFE23746EE844D8C35
SHA1:	D04F610946B4CD225E2A45A97373F016208DDEF2
SHA-256:	9B352821C48A643C4E4A46CE0022BCBC41C5CDE82C09C1AC720B2D6709D4A91B
SHA-512:	4BF90CC90D8AC84C8A4E7771232A78F62F55624F23E324C1B21E4BF4633FB1BA339356D5E506AF6A85CFAA3908B50AFCB786C65D39080F7918AF24A5943FF1C7
Malicious:	false
Preview:	1.7c120b5c8a042478d2ccc787e13e7eb3d689e8c0ac98b4d3c9ee34e22825db89

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_35640493\manifest.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.291695148425389
Encrypted:	false
SSDEEP:	3:rR6TAulhFphifFdoJhFgS1v:F6VlMAJ0S1v
MD5:	FCE1938B76185C7F596BF2E979060507
SHA1:	65993D52237C3342809E222712A87A408B6467EB
SHA-256:	67ED9850667B22AE865A8BE4348E7A2385EF57BC1416171885FDD2642A02B74C
SHA-512:	C6EE7229AB3153ADD2BAAEE56351DFD516AE2BA0C3D6C6398875E203A7622059CF3B30AF4472A3AE5C72EB18FA6FE26EEF2819FD791BD0C07BB1CC8F1E85CFF1
Malicious:	false
Preview:	{. "manifest_version": 2,. "name": "pkiMetadata",. "version": "700".}

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_48498969\_metadata\verified_contents.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	5.980084400737043
Encrypted:	false
SSDEEP:	24:pZRj/flTm6MZsGpqY9EpFpNHzkaoXpkwaapI17xtI2txpoXVnnyfI0FeCosSUhfx:p/hYsI1Kp/NTkakuw7pIztI2PpkVnnyx
MD5:	0A5C7B5830C28F8CEC3C85DE04AAEA75
SHA1:	85C88630ABDB06E3D9EB1A5F38E397123BA85F9C
SHA-256:	DAA7678974977C8CBE37F3AEE19FE1FA577B20D7522B65D89CDA13FFEDCEA1EF
SHA-512:	637F47585B9C128EA32902B25FFD99C73D800200229D6CE5E0A727AE234F942FCF251097C409B4C730E08C071FF4A8869EA7C954F4833DE3DEE46D66AAA27C7C
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJkb3dubG9hZF9maWxlX3R5cGVzLnBiIiwicm9vdF9oYXNoIjoiNXRLc2thMDcwV1V6MTJpeWM4Q2dYbXhhMklPSUw4Z3ltTGVrZC1fTldMUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJjTjJra1JmUXU4OGxrRmlXUWJpeTJGbTcwSkFOQlg2d2gtdkVYTzhxaEQ0In1dLCJmb3JtYXQiOiJ0cmVlaGFzaCIsImhhc2hfYmxvY2tfc2l6ZSI6NDA5Nn1dLCJpdGVtX2lkIjoia2hhb2llYm5ka29qbG1wcGVlbWpoYnBiYW5kaWxqcGUiLCJpdGVtX3ZlcnNpb24iOiI2MiIsInByb3RvY29sX3ZlcnNpb24iOjF9","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"gp0-KlkdvHRhUNaIFPe-DExX3mTiqXe3WkpSatv4cJudS09wTEmdOxmbE6ZaDmXq3Nm39xmfwasWZQ3DcFJ-hmxPWuVW0pruO1mJQqRTSInDO7ogDzr0sUbO19-8h50LpYpDmHk4RFXzD7nxWGMaM9wNyVAPa07sEOHaNLVNya8fBMSZao9YsV-GOyHwdIYs-0w7tTTaM4XCW1BjyMPJHT4DTJIoC6gZqfqVK6gxAeDYsAjCf0CWHRuvyfUanZbCwnIcD94_4XAndlAW-3zg4KxMsIjts6V2014W5Qk7iSetjhT5NDilBUVW66md51biQdnWb5pccT4LIwynEr8OSw"},

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_48498969\download_file_types.pb

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	7904
Entropy (8bit):	5.137436758330804
Encrypted:	false
SSDEEP:	192:d0aEW8SsWk/pvtHB3Nf5Y10k6QKEa4pmiCL1YdPnz1QRsO6v:d0aEW8SsWk/pvtHB3Nf5YKk6QKEa4pmc
MD5:	0FF8575064B6D7A56F3001D9587753C6
SHA1:	8306D8ED0ECEE68C46F3822766D52466457652CB
SHA-256:	A0ACD30FE02B911E75A65DD509F0E02F30D8209A350A07212C37FB4593C6B161
SHA-512:	5744A19AD4DE79F07C2B6320F664464B2B3D41FC23BDC7FFC17F5B52F189554ECA2CC4B8142F68A9A502E9E07104D4D50871497DF1A1D99EC095F41401AFF8B5
Malicious:	false
Preview:	.>...#<....jpg... ..........jpeg... ..........mp3... ..........mp4... ..........png... ..........csv... ..........ica... ..........gif... ..........txt... ..........package... ..........tif... ..........webp... ..........mkv... ..........wav... ..........mov... ..........avif... ..........swf.D ..........spl.E ..........crx.. ..........001..... ..........7z.4.. ......0.....ace..... ..........arc..... ..........arj.:.. ..........b64..... ..........balz..... ..........bhx..... ..........bin..... ......0.....bz..... ..........bz2.8.. ..........bzip2..... ..........cab.... ..........cpio.@.. ..........fat..... ..........gz.6.. ..........gzip..... ..........hfs..... ..........hqx..... ..........iso..... ......0.....lha.<.. ..........lpaq1..... ..........lpaq5..... ..........lpaq8..... ..........lzh.;.. ..........lzma.?.. ..........mim..... ..........ntfs..... ..........paq8f..... ..........paq8jd..... ..........paq8l..... ..........paq8o....

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_48498969\manifest.fingerprint

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	3.8525575232206095
Encrypted:	false
SSDEEP:	3:S+EHwUQFz0WTSRRTlXXQsQOUCfV:S7HwjRTyZ+OfV
MD5:	C991DE7228A38CEC6C9B4ABC292945C6
SHA1:	D28C3050406C4C332CB5C0FFB555EA1E12B168CD
SHA-256:	27746857C31DEAC5078F6FE8F0C6F8CD91BF470C8CFA24A0328E4AED6FCC84A3
SHA-512:	41840F815E600120418E069DC03230F8E11ACF44FE35D5996A143F889CC7FC1FD5D6FA88097EF8F4C8047415B01097299848934269F684366CD05F0177D2BA35
Malicious:	false
Preview:	1.a2abb5cf57d3ad529ade67df01567446c6c6a5225b29715119e17c0e0aea6c03

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_48498969\manifest.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	76
Entropy (8bit):	4.321353297326329
Encrypted:	false
SSDEEP:	3:rR6TAulhFphifFRxJ1KnOFgS1jA:F6VlMDf1KqgS1U
MD5:	BA13A3F354BCE03A658AEFD551ED4A92
SHA1:	F5A7F65C1F975729D652DC0A9F3D477970976434
SHA-256:	70DDA49117D0BBCF2590589641B8B2D859BBD0900D057EB087EBC45CEF2A843E
SHA-512:	8FDAB1EDD401E495401EE1FF0AD3333D0785F4988002E669C9DF1C92698A0C03BFD2454E510C97DF4D45825E03744EF69B55A7B562500BD5F07025A0007D379C
Malicious:	false
Preview:	{. "manifest_version": 2,. "name": "fileTypePolicies",. "version": "62".}

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_774638055\_metadata\verified_contents.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1766
Entropy (8bit):	6.002550968886683
Encrypted:	false
SSDEEP:	48:p/hbAOXVAjyJkkkakrPGhi3ZQ1j9XREdl5Jk3pVdnJEX:RHVWasw0ZQ1jNcl5JE/EX
MD5:	F1F12F90F2E797B4259436F1D6E89570
SHA1:	1F5B7603D3C734333EB1163832264E57FFCB6E64
SHA-256:	72794391388437C4CD31437FB836554C6F874034185847FD8CFDC5A9D828131F
SHA-512:	8C843945F9D55444742CA0ACCBD139D9F61813D227A35ED65BCCC89207BD0E776DE8DA85DD97A8BADD081D1133A757C23215437DD8A3EC8D399582974C3D255F
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJtYW5pZmVzdC5qc29uIiwicm9vdF9oYXNoIjoiSDVDblRHcjJ4VmJkYVg5NXlYckdxLTg5b182WUszQ296dWp0U3VRZ25VayJ9LHsicGF0aCI6Im9wdGltaXphdGlvbi1oaW50cy5wYiIsInJvb3RfaGFzaCI6Ii11NGgwbXU3RXFobDE0Ry1MdXdGdGxHWVBrendvaDJIbFd0TFRVcS00dlEifV0sImZvcm1hdCI6InRyZWVoYXNoIiwiaGFzaF9ibG9ja19zaXplIjo0MDk2fV0sIml0ZW1faWQiOiJsbWVsZ2xlamhlbWVqZ2lucGJvYWdkZGdkZmJlcGdtcCIsIml0ZW1fdmVyc2lvbiI6IjQxMSIsInByb3RvY29sX3ZlcnNpb24iOjF9","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"uVAgTMiorvR2lsI83KK7fiJFuh9PVkPMUfqeKLmEGzJOo_Xk4oHAa9G2GcOKhZLvEUGfjdTYIvNi1eguc9CVpYvCLdAhtWTPzm8K8eha4Da1gLADX9unPPviT_PRPcWlk9ssryX9q1ZT6qrI69ra8mjQFkG5Q0oAee0goFhrw-iIDYa-OvRWkLSWPX5xtP5NIEsEMqVnKpJCLUYNehnbXNFtWqHWT18maUkfnhsAjsujrWJVF-dgzZoqMwykneHZZK9acSHuhFxnOarLYcCuwvQgiN6vN5Iy3qEYK44JT66JrDrAqjBczlOMcGquPk5UtoDOiCadT-7lsMsjkHYAxD0FE

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_774638055\manifest.fingerprint

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	3.9322715372939436
Encrypted:	false
SSDEEP:	3:SQ0ZRcAGikEtI2OWdzGUs9odl:SQ0ZRxUE+2OavsW/
MD5:	10E00EC3DF7540701159312934549D27
SHA1:	E8DBC37936B3AD080CD8AD8E1748493B852400CD
SHA-256:	06B3135A33DDEFD7C76E4CB2603F97101EA5C9F149AFB1891BF81F11C1013F0B
SHA-512:	3AB702D8F66C7DF015CE3546DEFEAD60097547A8D5A34E15FFE0C2C930D0AE32C4B2F174EFBA95C3B67A82773E049E47C8A84CC1595201B3E9C5A2336143C534
Malicious:	false
Preview:	1.5e228394649ecebbaaaef585317f74d8e238738486231c105bda186a1c801b3d

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_774638055\manifest.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	108
Entropy (8bit):	4.437123144152123
Encrypted:	false
SSDEEP:	3:rR6TAulhFphifFzIe4/+S1H3HcDKhtH8tAn:F6VlMQ/+S1XSKH8tAn
MD5:	6AEC6B8F5478F055F13B7EDB36435D70
SHA1:	5FBD457C153ED76B2C0A9B40251F393B235953E8
SHA-256:	1F90A74C6AF6C556DD697F79C97AC6ABEF3DA3FE982B70A8CEE8ED4AE4209D49
SHA-512:	7023B0E36DD59F333016991EF8741377376F4F10874A593FE0BE9FDCC3465DF3704BBEA6D823425CFCA2693B2B6F24B971399C5FEF86A71AE7B7FF93055EFD72
Malicious:	false
Preview:	{. "manifest_version": 2,. "name": "Optimization Hints",. "version": "411",. "ruleset_format": "1.0.0".}

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_774638055\optimization-hints.pb

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	42178
Entropy (8bit):	7.994666121141728
Encrypted:	true
SSDEEP:	768:Dw3mtVGhG/jQMA2nILkKMT1rp/VAt19LeptzWm/OgOvY56xRrVkSSfSna0:Dw6MijvVIwKM/dAtryVvOvY56xMSYSa0
MD5:	1A444692861DD5CEFF8BBFE6D0C650C0
SHA1:	EE025B40B9EBC116F21C94BAA9E01EF8B4A0C772
SHA-256:	9441A6D14CEB221B28E0B0EA8FD76C1D398B5D33B5C053CE3C54E5E8207FC363
SHA-512:	32DF841795359DAC4A4167239870BFC3D5F286749199981A4909F83D9E0E1820B613C5938FC2928822CD60D1FDBA7729932DA354AFAFA8A336A2BCF9DAC6D790
Malicious:	false
Preview:	............2....-..i\.BB....p-...?.S..H.q.z.B9.&....D.....L0..j....R.5..I}.:~..$.c"o......6Gp.....O..o..E...v...u8.HE.....z.\4r......D..@....v.C...%.........u.T.2.\1..s.U$...5.=X.^..W..(...5n..m.....[1..#.r.~).\.$..&.g.C.p.....@..M8.........+.o.i.RV.{M.4.,..N....o6...1.z....5q.'..{QC.y..B.._..V..8.>......c.K<...J..N}:......s.f....y....i...:y.........{e.`..e..\}.a.w~v...!.u......RD.H0...H...(.:.G/.~...H+/W....G2.7.J..{...m..r....P.Z.uh..@...G...4.W...e.0.?...5.....]e....?o.FMg.Z\....`WM..=...i.O....r........D.&.I.C.H!t....3...L..9.......8G......Lm.sy..H...T.....5n]...m.X.r..cg.eO....[.5..1g._..i....1.(.:...V...~.t....n..=.3.Z...6P.o...n\|E...CQ..1.......Mk.u.X..@....5]...q2.]..G]..,D.V....8..![..-.L\|..[[.(..A....@M..R?..A..\7d...~K........f..'.P..5..7nf3P..E(^\|with\|\.)google(adservices\|usercontent\|plex\|video\|prod\|apis)?(\.\|$).(shopping\|store)\.google\.com0.....$.......(.r.^...k...EN....[...m.$..ds0.................?.....g@:W...(...&

Chrome Cache Entry: 265

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	268381
Entropy (8bit):	5.072141999174343
Encrypted:	false
SSDEEP:	6144:UvD8eq9mPKl4OfKcknEHZciGhjZPdDwjdwTJFPk78vmAnhZSxwI14i:UE4OfcaZhfOeATG14i
MD5:	08C235D357750C657AC1DB7D1CF656A9
SHA1:	9257AFD2D46C3A189EC0D40A45722701D47E9CA5
SHA-256:	7BD80D06C01C0340C1B9159B9B4A197DB882CA18CBAC8E9B9AA025E68F998D40
SHA-512:	D62700E7A1FF41F9D6326CA024BA2BE1D391BC8FBB2AEAE0F427D74837899B230940BF7C2DF3D193F5300A68BB3686706D4C31328234B5CDA026A1BF52EF9E70
Malicious:	false
URL:	https://ajax.aspnetcdn.com/ajax/jquery/jquery-1.9.1.js
Preview:	/!. jQuery JavaScript Library v1.9.1. * http://jquery.com/. . Includes Sizzle.js. * http://sizzlejs.com/. . Copyright 2005, 2012 jQuery Foundation, Inc. and other contributors. * Released under the MIT license. * http://jquery.org/license. . Date: 2013-2-4. */.(function( window, undefined ) {..// Can't do this because several apps including ASP.NET trace.// the stack via arguments.caller.callee and Firefox dies if.// you try to trace through "use strict" call chains. (#13335).// Support: Firefox 18+.//"use strict";.var..// The deferred used on DOM ready..readyList,...// A central reference to the root jQuery(document)..rootjQuery,...// Support: IE<9..// For `typeof node.method` instead of `node.method !== undefined`..core_strundefined = typeof undefined,...// Use the correct document accordingly with window argument (sandbox)..document = window.document,..location = window.location,...// Map over jQuery in case of overwrite.._jQuery = window.jQuery,...// Map over the $ in c

Chrome Cache Entry: 266

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65299)
Category:	downloaded
Size (bytes):	78129
Entropy (8bit):	5.197397473920562
Encrypted:	false
SSDEEP:	1536:pppbTNR2t4NEdiK5J2w8gGzjJVPOW7tI+r9ixR2nwZY:T36WJr9ixi
MD5:	7CCD9D390D31AF98110F74F842EA9B32
SHA1:	A85E681624C91A106A514C31EACF80DE817B2CC3
SHA-256:	F5210FA3E7F0245A4C51EB7F280092C0EF99FDD28C45E17DAB8CC5854FDF4FD3
SHA-512:	A5AC783258178C710F7C2C1C24B4218A063BF8DF2BB7A6D5BD62C5C9432EC5286FD7BD17E774D1CC63E63E4666181864FA38A447C581338CA5EC0F563071EABE
Malicious:	false
URL:	https://cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/js/bootstrap.bundle.min.js
Preview:	/!. Bootstrap v5.1.3 (https://getbootstrap.com/). * Copyright 2011-2021 The Bootstrap Authors (https://github.com/twbs/bootstrap/graphs/contributors). * Licensed under MIT (https://github.com/twbs/bootstrap/blob/main/LICENSE). */.!function(t,e){"object"==typeof exports&&"undefined"!=typeof module?module.exports=e():"function"==typeof define&&define.amd?define(e):(t="undefined"!=typeof globalThis?globalThis:t\|\|self).bootstrap=e()}(this,(function(){"use strict";const t="transitionend",e=t=>{let e=t.getAttribute("data-bs-target");if(!e\|\|"#"===e){let i=t.getAttribute("href");if(!i\|\|!i.includes("#")&&!i.startsWith("."))return null;i.includes("#")&&!i.startsWith("#")&&(i=`#${i.split("#")[1]}`),e=i&&"#"!==i?i.trim():null}return e},i=t=>{const i=e(t);return i&&document.querySelector(i)?i:null},n=t=>{const i=e(t);return i?document.querySelector(i):null},s=e=>{e.dispatchEvent(new Event(t))},o=t=>!(!t\|\|"object"!=typeof t)&&(void 0!==t.jquery&&(t=t[0]),void 0!==t.nodeType),r=t=>o(t)?t.jquer

Chrome Cache Entry: 267

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65306)
Category:	downloaded
Size (bytes):	163873
Entropy (8bit):	5.058104233525069
Encrypted:	false
SSDEEP:	1536:4t04T8if0W8DsEBpy0cuJBf2rIWE5e0VUpz600I4fM:4t04/0VUpz600I4fM
MD5:	94994C66FEC8C3468B269DC0CC242151
SHA1:	EC16BD19BF4AE9BC2E2336AC409A503BBBDAACAD
SHA-256:	62F74B1CF824A89F03554C638E719594C309B4D8A627A758928C0516FA7890AB
SHA-512:	190194D1F30C8B6DFCB80F9AFDB75625FA5418A52405D81F15D8019BBD92510E817B25A3A18FEDA27D2D1231FE3921FD88FE037E1FBB1CCD08F5FE5E4742FFE3
Malicious:	false
URL:	https://cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/css/bootstrap.min.css
Preview:	@charset "UTF-8";/!. Bootstrap v5.1.3 (https://getbootstrap.com/). * Copyright 2011-2021 The Bootstrap Authors. * Copyright 2011-2021 Twitter, Inc.. * Licensed under MIT (https://github.com/twbs/bootstrap/blob/main/LICENSE). */:root{--bs-blue:#0d6efd;--bs-indigo:#6610f2;--bs-purple:#6f42c1;--bs-pink:#d63384;--bs-red:#dc3545;--bs-orange:#fd7e14;--bs-yellow:#ffc107;--bs-green:#198754;--bs-teal:#20c997;--bs-cyan:#0dcaf0;--bs-white:#fff;--bs-gray:#6c757d;--bs-gray-dark:#343a40;--bs-gray-100:#f8f9fa;--bs-gray-200:#e9ecef;--bs-gray-300:#dee2e6;--bs-gray-400:#ced4da;--bs-gray-500:#adb5bd;--bs-gray-600:#6c757d;--bs-gray-700:#495057;--bs-gray-800:#343a40;--bs-gray-900:#212529;--bs-primary:#0d6efd;--bs-secondary:#6c757d;--bs-success:#198754;--bs-info:#0dcaf0;--bs-warning:#ffc107;--bs-danger:#dc3545;--bs-light:#f8f9fa;--bs-dark:#212529;--bs-primary-rgb:13,110,253;--bs-secondary-rgb:108,117,125;--bs-success-rgb:25,135,84;--bs-info-rgb:13,202,240;--bs-warning-rgb:255,193,7;--bs-danger-rgb:220,53

Static File Info

General

File type:	HTML document, Unicode text, UTF-8 text, with very long lines (18379), with CRLF line terminators
Entropy (8bit):	5.96754732627986
TrID:	HyperText Markup Language (15015/1) 20.56% HyperText Markup Language (12001/1) 16.44% HyperText Markup Language (12001/1) 16.44% HyperText Markup Language (11501/1) 15.75% HyperText Markup Language (11501/1) 15.75%
File name:	Technical Spec.html
File size:	203'074 bytes
MD5:	1b8cf418350e7fb52616531a30931cc0
SHA1:	1c7016257b55c69eea053cffb82f87eedbcf5c03
SHA256:	0c72c354be5cded5cca5718a5f83f1f144880233da5aeffd6206bb79e1fce17a
SHA512:	d4490dc6b609cb033eae53527bea51d42bc72521aebd02c5db7fff9771b51e6740b62d3b2826d8db621677eb51825c10d1e6ef67587ef7f64d51463b41cc27f5
SSDEEP:	3072:ujDxGCsjlWpbWURXggD8d3ZgD6IQRKc3nr/uhly266bs+E/JWj0x9+gVB74BZE:EM9Gxwggdpk6IoB/ay266Mu0jP3CE
TLSH:	8F14F13D1E8BAE63131346E970DE6CCB9E2D978B9012459578CE2593BFE9C3091EF148
File Content Preview:	<!DOCTYPE html>..<html>..<head>.. <meta charset="utf-8" />.. <title></title>.. <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/css/bootstrap.min.css" rel="stylesheet">.. <script src="https://cdn.jsdelivr.net/npm/bootstrap@5.1.3/d

Network Behavior

Network Port Distribution

Total Packets: 56
• 443 (HTTPS)
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 11, 2023 12:33:33.354353905 CEST	49711	443	192.168.2.3	142.251.41.14
Sep 11, 2023 12:33:33.354404926 CEST	443	49711	142.251.41.14	192.168.2.3
Sep 11, 2023 12:33:33.354485035 CEST	49711	443	192.168.2.3	142.251.41.14
Sep 11, 2023 12:33:33.356204033 CEST	49711	443	192.168.2.3	142.251.41.14
Sep 11, 2023 12:33:33.356230021 CEST	443	49711	142.251.41.14	192.168.2.3
Sep 11, 2023 12:33:33.361650944 CEST	49713	443	192.168.2.3	151.101.1.229
Sep 11, 2023 12:33:33.361706018 CEST	443	49713	151.101.1.229	192.168.2.3
Sep 11, 2023 12:33:33.361769915 CEST	49713	443	192.168.2.3	151.101.1.229
Sep 11, 2023 12:33:33.362066031 CEST	49714	443	192.168.2.3	151.101.1.229
Sep 11, 2023 12:33:33.362097979 CEST	443	49714	151.101.1.229	192.168.2.3
Sep 11, 2023 12:33:33.362155914 CEST	49714	443	192.168.2.3	151.101.1.229
Sep 11, 2023 12:33:33.363192081 CEST	49715	443	192.168.2.3	142.251.40.205
Sep 11, 2023 12:33:33.363214970 CEST	443	49715	142.251.40.205	192.168.2.3
Sep 11, 2023 12:33:33.363276958 CEST	49715	443	192.168.2.3	142.251.40.205
Sep 11, 2023 12:33:33.364203930 CEST	49713	443	192.168.2.3	151.101.1.229
Sep 11, 2023 12:33:33.364234924 CEST	443	49713	151.101.1.229	192.168.2.3
Sep 11, 2023 12:33:33.364471912 CEST	49714	443	192.168.2.3	151.101.1.229
Sep 11, 2023 12:33:33.364500999 CEST	443	49714	151.101.1.229	192.168.2.3
Sep 11, 2023 12:33:33.364612103 CEST	49715	443	192.168.2.3	142.251.40.205
Sep 11, 2023 12:33:33.364650011 CEST	443	49715	142.251.40.205	192.168.2.3
Sep 11, 2023 12:33:33.567864895 CEST	443	49711	142.251.41.14	192.168.2.3
Sep 11, 2023 12:33:33.570031881 CEST	49711	443	192.168.2.3	142.251.41.14
Sep 11, 2023 12:33:33.570072889 CEST	443	49711	142.251.41.14	192.168.2.3
Sep 11, 2023 12:33:33.570914984 CEST	443	49711	142.251.41.14	192.168.2.3
Sep 11, 2023 12:33:33.571042061 CEST	49711	443	192.168.2.3	142.251.41.14
Sep 11, 2023 12:33:33.573071957 CEST	443	49711	142.251.41.14	192.168.2.3
Sep 11, 2023 12:33:33.573153973 CEST	49711	443	192.168.2.3	142.251.41.14
Sep 11, 2023 12:33:33.606111050 CEST	443	49713	151.101.1.229	192.168.2.3
Sep 11, 2023 12:33:33.615283012 CEST	443	49714	151.101.1.229	192.168.2.3
Sep 11, 2023 12:33:33.638870955 CEST	49714	443	192.168.2.3	151.101.1.229
Sep 11, 2023 12:33:33.638930082 CEST	443	49714	151.101.1.229	192.168.2.3
Sep 11, 2023 12:33:33.641303062 CEST	443	49714	151.101.1.229	192.168.2.3
Sep 11, 2023 12:33:33.641498089 CEST	49714	443	192.168.2.3	151.101.1.229
Sep 11, 2023 12:33:33.647028923 CEST	49713	443	192.168.2.3	151.101.1.229
Sep 11, 2023 12:33:33.648021936 CEST	49713	443	192.168.2.3	151.101.1.229
Sep 11, 2023 12:33:33.648057938 CEST	443	49713	151.101.1.229	192.168.2.3
Sep 11, 2023 12:33:33.649008036 CEST	49711	443	192.168.2.3	142.251.41.14
Sep 11, 2023 12:33:33.649272919 CEST	443	49711	142.251.41.14	192.168.2.3
Sep 11, 2023 12:33:33.649920940 CEST	443	49713	151.101.1.229	192.168.2.3
Sep 11, 2023 12:33:33.650026083 CEST	49713	443	192.168.2.3	151.101.1.229
Sep 11, 2023 12:33:33.652561903 CEST	49714	443	192.168.2.3	151.101.1.229
Sep 11, 2023 12:33:33.652780056 CEST	443	49714	151.101.1.229	192.168.2.3
Sep 11, 2023 12:33:33.654198885 CEST	49713	443	192.168.2.3	151.101.1.229
Sep 11, 2023 12:33:33.654432058 CEST	443	49713	151.101.1.229	192.168.2.3
Sep 11, 2023 12:33:33.659333944 CEST	49711	443	192.168.2.3	142.251.41.14
Sep 11, 2023 12:33:33.659363985 CEST	443	49711	142.251.41.14	192.168.2.3
Sep 11, 2023 12:33:33.660075903 CEST	49714	443	192.168.2.3	151.101.1.229
Sep 11, 2023 12:33:33.660101891 CEST	443	49714	151.101.1.229	192.168.2.3
Sep 11, 2023 12:33:33.660242081 CEST	49713	443	192.168.2.3	151.101.1.229
Sep 11, 2023 12:33:33.660284042 CEST	443	49713	151.101.1.229	192.168.2.3
Sep 11, 2023 12:33:33.696948051 CEST	443	49715	142.251.40.205	192.168.2.3
Sep 11, 2023 12:33:33.697423935 CEST	49715	443	192.168.2.3	142.251.40.205
Sep 11, 2023 12:33:33.697449923 CEST	443	49715	142.251.40.205	192.168.2.3
Sep 11, 2023 12:33:33.698972940 CEST	49711	443	192.168.2.3	142.251.41.14
Sep 11, 2023 12:33:33.699753046 CEST	443	49715	142.251.40.205	192.168.2.3
Sep 11, 2023 12:33:33.699857950 CEST	49715	443	192.168.2.3	142.251.40.205
Sep 11, 2023 12:33:33.699955940 CEST	49714	443	192.168.2.3	151.101.1.229
Sep 11, 2023 12:33:33.700189114 CEST	49713	443	192.168.2.3	151.101.1.229
Sep 11, 2023 12:33:33.702339888 CEST	49715	443	192.168.2.3	142.251.40.205
Sep 11, 2023 12:33:33.702876091 CEST	49715	443	192.168.2.3	142.251.40.205
Sep 11, 2023 12:33:33.702883959 CEST	443	49715	142.251.40.205	192.168.2.3
Sep 11, 2023 12:33:33.703706980 CEST	443	49715	142.251.40.205	192.168.2.3
Sep 11, 2023 12:33:33.743010044 CEST	49715	443	192.168.2.3	142.251.40.205
Sep 11, 2023 12:33:33.743037939 CEST	443	49715	142.251.40.205	192.168.2.3
Sep 11, 2023 12:33:33.777096987 CEST	443	49711	142.251.41.14	192.168.2.3
Sep 11, 2023 12:33:33.777760983 CEST	443	49711	142.251.41.14	192.168.2.3
Sep 11, 2023 12:33:33.777858973 CEST	49711	443	192.168.2.3	142.251.41.14
Sep 11, 2023 12:33:33.780536890 CEST	443	49713	151.101.1.229	192.168.2.3
Sep 11, 2023 12:33:33.782985926 CEST	49715	443	192.168.2.3	142.251.40.205
Sep 11, 2023 12:33:33.788289070 CEST	49711	443	192.168.2.3	142.251.41.14
Sep 11, 2023 12:33:33.788315058 CEST	443	49711	142.251.41.14	192.168.2.3
Sep 11, 2023 12:33:33.792943001 CEST	443	49713	151.101.1.229	192.168.2.3
Sep 11, 2023 12:33:33.792958021 CEST	443	49713	151.101.1.229	192.168.2.3
Sep 11, 2023 12:33:33.792995930 CEST	443	49713	151.101.1.229	192.168.2.3
Sep 11, 2023 12:33:33.793015003 CEST	443	49713	151.101.1.229	192.168.2.3
Sep 11, 2023 12:33:33.793028116 CEST	49713	443	192.168.2.3	151.101.1.229
Sep 11, 2023 12:33:33.793030024 CEST	443	49713	151.101.1.229	192.168.2.3
Sep 11, 2023 12:33:33.793064117 CEST	443	49713	151.101.1.229	192.168.2.3
Sep 11, 2023 12:33:33.793087959 CEST	443	49713	151.101.1.229	192.168.2.3
Sep 11, 2023 12:33:33.793092012 CEST	49713	443	192.168.2.3	151.101.1.229
Sep 11, 2023 12:33:33.793150902 CEST	49713	443	192.168.2.3	151.101.1.229
Sep 11, 2023 12:33:33.795391083 CEST	443	49714	151.101.1.229	192.168.2.3
Sep 11, 2023 12:33:33.795512915 CEST	443	49714	151.101.1.229	192.168.2.3
Sep 11, 2023 12:33:33.795572042 CEST	443	49714	151.101.1.229	192.168.2.3
Sep 11, 2023 12:33:33.795587063 CEST	49714	443	192.168.2.3	151.101.1.229
Sep 11, 2023 12:33:33.795604944 CEST	443	49714	151.101.1.229	192.168.2.3
Sep 11, 2023 12:33:33.795669079 CEST	49714	443	192.168.2.3	151.101.1.229
Sep 11, 2023 12:33:33.795857906 CEST	443	49714	151.101.1.229	192.168.2.3
Sep 11, 2023 12:33:33.795938969 CEST	443	49714	151.101.1.229	192.168.2.3
Sep 11, 2023 12:33:33.795993090 CEST	49714	443	192.168.2.3	151.101.1.229
Sep 11, 2023 12:33:33.796011925 CEST	443	49714	151.101.1.229	192.168.2.3
Sep 11, 2023 12:33:33.798391104 CEST	443	49714	151.101.1.229	192.168.2.3
Sep 11, 2023 12:33:33.798521042 CEST	49714	443	192.168.2.3	151.101.1.229
Sep 11, 2023 12:33:33.798541069 CEST	443	49714	151.101.1.229	192.168.2.3
Sep 11, 2023 12:33:33.801402092 CEST	443	49714	151.101.1.229	192.168.2.3
Sep 11, 2023 12:33:33.801491976 CEST	49714	443	192.168.2.3	151.101.1.229
Sep 11, 2023 12:33:33.801515102 CEST	443	49714	151.101.1.229	192.168.2.3
Sep 11, 2023 12:33:33.805016041 CEST	443	49714	151.101.1.229	192.168.2.3
Sep 11, 2023 12:33:33.805149078 CEST	49714	443	192.168.2.3	151.101.1.229
Sep 11, 2023 12:33:33.805170059 CEST	443	49714	151.101.1.229	192.168.2.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 11, 2023 12:33:33.253462076 CEST	61261	53	192.168.2.3	8.8.8.8
Sep 11, 2023 12:33:33.253902912 CEST	51674	53	192.168.2.3	8.8.8.8
Sep 11, 2023 12:33:33.259012938 CEST	56452	53	192.168.2.3	8.8.8.8
Sep 11, 2023 12:33:33.259371042 CEST	59489	53	192.168.2.3	8.8.8.8
Sep 11, 2023 12:33:33.259814978 CEST	51739	53	192.168.2.3	8.8.8.8
Sep 11, 2023 12:33:33.260234118 CEST	63604	53	192.168.2.3	8.8.8.8
Sep 11, 2023 12:33:33.260847092 CEST	60000	53	192.168.2.3	8.8.8.8
Sep 11, 2023 12:33:33.261194944 CEST	54193	53	192.168.2.3	8.8.8.8
Sep 11, 2023 12:33:33.350558996 CEST	53	51674	8.8.8.8	192.168.2.3
Sep 11, 2023 12:33:33.352241993 CEST	53	61261	8.8.8.8	192.168.2.3
Sep 11, 2023 12:33:33.356698036 CEST	53	51739	8.8.8.8	192.168.2.3
Sep 11, 2023 12:33:33.357903957 CEST	53	63481	8.8.8.8	192.168.2.3
Sep 11, 2023 12:33:33.359447956 CEST	53	60000	8.8.8.8	192.168.2.3
Sep 11, 2023 12:33:33.360296965 CEST	53	54193	8.8.8.8	192.168.2.3
Sep 11, 2023 12:33:33.360430002 CEST	53	63604	8.8.8.8	192.168.2.3
Sep 11, 2023 12:33:34.269042969 CEST	53	61636	8.8.8.8	192.168.2.3
Sep 11, 2023 12:33:36.916086912 CEST	51854	53	192.168.2.3	8.8.8.8
Sep 11, 2023 12:33:36.916534901 CEST	57282	53	192.168.2.3	8.8.8.8
Sep 11, 2023 12:33:37.007567883 CEST	53	57282	8.8.8.8	192.168.2.3
Sep 11, 2023 12:33:37.013011932 CEST	53	51854	8.8.8.8	192.168.2.3
Sep 11, 2023 12:33:48.964545965 CEST	53	55108	8.8.8.8	192.168.2.3
Sep 11, 2023 12:34:32.291253090 CEST	53	50056	8.8.8.8	192.168.2.3
Sep 11, 2023 12:35:41.597904921 CEST	53	60737	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 11, 2023 12:33:33.253462076 CEST	192.168.2.3	8.8.8.8	0x547b	Standard query (0)	clients2.google.com	A (IP address)	IN (0x0001)	false
Sep 11, 2023 12:33:33.253902912 CEST	192.168.2.3	8.8.8.8	0x4d73	Standard query (0)	clients2.google.com	65	IN (0x0001)	false
Sep 11, 2023 12:33:33.259012938 CEST	192.168.2.3	8.8.8.8	0xd16b	Standard query (0)	ajax.aspnetcdn.com	A (IP address)	IN (0x0001)	false
Sep 11, 2023 12:33:33.259371042 CEST	192.168.2.3	8.8.8.8	0x8426	Standard query (0)	ajax.aspnetcdn.com	65	IN (0x0001)	false
Sep 11, 2023 12:33:33.259814978 CEST	192.168.2.3	8.8.8.8	0x540b	Standard query (0)	cdn.jsdelivr.net	A (IP address)	IN (0x0001)	false
Sep 11, 2023 12:33:33.260234118 CEST	192.168.2.3	8.8.8.8	0x8469	Standard query (0)	cdn.jsdelivr.net	65	IN (0x0001)	false
Sep 11, 2023 12:33:33.260847092 CEST	192.168.2.3	8.8.8.8	0x46fa	Standard query (0)	accounts.google.com	A (IP address)	IN (0x0001)	false
Sep 11, 2023 12:33:33.261194944 CEST	192.168.2.3	8.8.8.8	0xc638	Standard query (0)	accounts.google.com	65	IN (0x0001)	false
Sep 11, 2023 12:33:36.916086912 CEST	192.168.2.3	8.8.8.8	0x96ba	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Sep 11, 2023 12:33:36.916534901 CEST	192.168.2.3	8.8.8.8	0x5e14	Standard query (0)	www.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 11, 2023 12:33:33.350394964 CEST	8.8.8.8	192.168.2.3	0x8426	No error (0)	ajax.aspnetcdn.com	mscomajax.vo.msecnd.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 11, 2023 12:33:33.350558996 CEST	8.8.8.8	192.168.2.3	0x4d73	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 11, 2023 12:33:33.352241993 CEST	8.8.8.8	192.168.2.3	0x547b	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 11, 2023 12:33:33.352241993 CEST	8.8.8.8	192.168.2.3	0x547b	No error (0)	clients.l.google.com		142.251.41.14	A (IP address)	IN (0x0001)	false
Sep 11, 2023 12:33:33.356698036 CEST	8.8.8.8	192.168.2.3	0x540b	No error (0)	cdn.jsdelivr.net	jsdelivr.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 11, 2023 12:33:33.356698036 CEST	8.8.8.8	192.168.2.3	0x540b	No error (0)	jsdelivr.map.fastly.net		151.101.1.229	A (IP address)	IN (0x0001)	false
Sep 11, 2023 12:33:33.356698036 CEST	8.8.8.8	192.168.2.3	0x540b	No error (0)	jsdelivr.map.fastly.net		151.101.65.229	A (IP address)	IN (0x0001)	false
Sep 11, 2023 12:33:33.356698036 CEST	8.8.8.8	192.168.2.3	0x540b	No error (0)	jsdelivr.map.fastly.net		151.101.129.229	A (IP address)	IN (0x0001)	false
Sep 11, 2023 12:33:33.356698036 CEST	8.8.8.8	192.168.2.3	0x540b	No error (0)	jsdelivr.map.fastly.net		151.101.193.229	A (IP address)	IN (0x0001)	false
Sep 11, 2023 12:33:33.359447956 CEST	8.8.8.8	192.168.2.3	0x46fa	No error (0)	accounts.google.com		142.251.40.205	A (IP address)	IN (0x0001)	false
Sep 11, 2023 12:33:33.360430002 CEST	8.8.8.8	192.168.2.3	0x8469	No error (0)	cdn.jsdelivr.net	jsdelivr.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 11, 2023 12:33:33.360985994 CEST	8.8.8.8	192.168.2.3	0xd16b	No error (0)	ajax.aspnetcdn.com	mscomajax.vo.msecnd.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 11, 2023 12:33:37.007567883 CEST	8.8.8.8	192.168.2.3	0x5e14	No error (0)	www.google.com			65	IN (0x0001)	false
Sep 11, 2023 12:33:37.013011932 CEST	8.8.8.8	192.168.2.3	0x96ba	No error (0)	www.google.com		142.250.72.100	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

clients2.google.com

cdn.jsdelivr.net

accounts.google.com

Target ID:	0
Start time:	12:33:30
Start date:	11/09/2023
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\Technical Spec.html
Imagebase:	0x7ff67bb30000
File size:	3'219'224 bytes
MD5 hash:	8D1C4713ACB7CC2AAAEE4477C58A80BA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	12:33:31
Start date:	11/09/2023
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=1880,i,12395186336236501141,1887735438801238278,262144 /prefetch:8
Imagebase:	0x7ff67bb30000
File size:	3'219'224 bytes
MD5 hash:	8D1C4713ACB7CC2AAAEE4477C58A80BA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

File Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Disassembly

⊘No disassembly

Source: Technical Spec.html	HTTP Parser: location.href
Source: Technical Spec.html	HTTP Parser: window.location

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Technical Spec.html

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Persistence and Installation Behavior

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1266310572\LICENSE

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1266310572\_metadata\verified_contents.json

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1266310572\crl-set

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1266310572\manifest.fingerprint

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1266310572\manifest.json

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1466566541\LICENSE

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1466566541\_metadata\verified_contents.json

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1466566541\keys.json

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1466566541\manifest.fingerprint

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1466566541\manifest.json

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1529049173\Filtering Rules

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1529049173\LICENSE.txt

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1529049173\_metadata\verified_contents.json

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1529049173\manifest.fingerprint

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1529049173\manifest.json

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1566901044\Preload Data

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1566901044\_metadata\verified_contents.json

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1566901044\manifest.fingerprint

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1566901044\manifest.json

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1996625029\_metadata\verified_contents.json

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1996625029\manifest.fingerprint

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1996625029\manifest.json

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_1996625029\ssl_error_assistant.pb

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_2084609994\_metadata\verified_contents.json

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_2084609994\manifest.fingerprint

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_2084609994\manifest.json

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5292_35640493\_metadata\verified_contents.json

Windows Analysis Report
Technical Spec.html