| URL: | http://www.googal.com |
| Full analysis: | https://app.any.run/tasks/e495eff9-b31b-48b3-8576-927f2e4aa5b5 |
| Verdict: | No threats detected |
| Analysis date: | November 20, 2019, 15:24:07 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MD5: | FB5DE38DAD50ED6D3E0F75E5BCF5B76B |
| SHA1: | 7BFF7A4812E03118C21E2E79AC95F56CBDFDFF8A |
| SHA256: | AE9481C759667475C13F868D57129461EC9B61B4B722756F87BCF6E8C6EFCB27 |
| SSDEEP: | 3:N1KJS4cLdIn:Cc4cZIn |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 584 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1036,2249942421517559100,7704110724703682479,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=7306711272670090819 --mojo-platform-channel-handle=4336 --ignored=" --type=renderer " /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 75.0.3770.100 Modules
| |||||||||||||||
| 1160 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1036,2249942421517559100,7704110724703682479,131072 --enable-features=PasswordImport --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=15379731025991032038 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2236 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 75.0.3770.100 Modules
| |||||||||||||||
| 1524 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1036,2249942421517559100,7704110724703682479,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=17364441404310686440 --mojo-platform-channel-handle=4044 --ignored=" --type=renderer " /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 75.0.3770.100 Modules
| |||||||||||||||
| 1732 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=75.0.3770.100 --initial-client-data=0x7c,0x80,0x84,0x78,0x88,0x6d90a9d0,0x6d90a9e0,0x6d90a9ec | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 75.0.3770.100 Modules
| |||||||||||||||
| 1756 | "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://www.googal.com" | C:\Program Files\Google\Chrome\Application\chrome.exe | explorer.exe | ||||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 75.0.3770.100 Modules
| |||||||||||||||
| 2064 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1036,2249942421517559100,7704110724703682479,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=10825796225734279273 --mojo-platform-channel-handle=3596 --ignored=" --type=renderer " /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 75.0.3770.100 Modules
| |||||||||||||||
| 2080 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1036,2249942421517559100,7704110724703682479,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=6123564056862264581 --mojo-platform-channel-handle=4352 --ignored=" --type=renderer " /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 75.0.3770.100 Modules
| |||||||||||||||
| 2444 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1036,2249942421517559100,7704110724703682479,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=14841105756733664651 --mojo-platform-channel-handle=3460 --ignored=" --type=renderer " /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 75.0.3770.100 Modules
| |||||||||||||||
| 2532 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1036,2249942421517559100,7704110724703682479,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=5724520918172907051 --mojo-platform-channel-handle=3804 --ignored=" --type=renderer " /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 75.0.3770.100 Modules
| |||||||||||||||
| 2600 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1036,2249942421517559100,7704110724703682479,131072 --enable-features=PasswordImport --disable-gpu-sandbox --use-gl=disabled --gpu-preferences=KAAAAAAAAADgAAAgAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=15024802942556733137 --mojo-platform-channel-handle=3344 /prefetch:2 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 75.0.3770.100 Modules
| |||||||||||||||
| (PID) Process: | (1756) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
| Operation: | write | Name: | failed_count |
Value: 0 | |||
| (PID) Process: | (1756) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
| Operation: | write | Name: | state |
Value: 2 | |||
| (PID) Process: | (1756) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty |
| Operation: | write | Name: | StatusCodes |
Value: | |||
| (PID) Process: | (1756) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty |
| Operation: | write | Name: | StatusCodes |
Value: 01000000 | |||
| (PID) Process: | (1756) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
| Operation: | write | Name: | state |
Value: 1 | |||
| (PID) Process: | (2732) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes |
| Operation: | write | Name: | 1756-13218737064230000 |
Value: 259 | |||
| (PID) Process: | (1756) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96} |
| Operation: | write | Name: | dr |
Value: 1 | |||
| (PID) Process: | (1756) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome |
| Operation: | write | Name: | UsageStatsInSample |
Value: 0 | |||
| (PID) Process: | (1756) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes |
| Operation: | delete value | Name: | 1512-13197841398593750 |
Value: 0 | |||
| (PID) Process: | (1756) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes |
| Operation: | delete value | Name: | 1756-13218737064230000 |
Value: 259 | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1756 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB\LOG.old | — | |
MD5:— | SHA256:— | |||
| 1756 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\7567731c-c2bf-445d-9083-145ea031a449.tmp | — | |
MD5:— | SHA256:— | |||
| 1756 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000020.dbtmp | — | |
MD5:— | SHA256:— | |||
| 1756 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG.old~RF39aa15.TMP | text | |
MD5:— | SHA256:— | |||
| 1756 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old | — | |
MD5:— | SHA256:— | |||
| 1756 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.old~RF39a9e6.TMP | text | |
MD5:— | SHA256:— | |||
| 1756 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old~RF39a9a8.TMP | text | |
MD5:— | SHA256:— | |||
| 1756 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_1 | — | |
MD5:— | SHA256:— | |||
| 1756 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old | text | |
MD5:— | SHA256:— | |||
| 1756 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.old | text | |
MD5:— | SHA256:— | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
3948 | chrome.exe | GET | 302 | 172.217.18.110:80 | http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvOTRmQUFXVHlhaGJaUTdMLWtCSkNJUl9ZQQ/1.0.0.5_nmmhkkegccagdldgiimedpiccmgmieda.crx | US | html | 511 b | whitelisted |
3948 | chrome.exe | GET | 200 | 2.16.186.64:80 | http://i3.cdn-image.com/__media__/pics/26872/search.png | unknown | image | 522 b | whitelisted |
3948 | chrome.exe | GET | 200 | 199.191.50.39:80 | http://www14.googal.com/Migraine_Pain_Relief.cfm?fp=gwWiACXcgxCjrWORhG9fiBcif0fA2HmikO%2F9DpTmOsav%2FiWppXp7AJ1My5xGnFitM%2FXsF35EqzXm%2FeK7grR8vDSStCWCJ68ER%2Bu9cRCSJggdO3OYD%2FmclACTEOsQp%2FcmrUyC5Ag16ZSG%2F1%2Fabxfz9cbBgbhduYcb7RaJ8qyjjq7BCx1%2FIlZCwqtaHZIHQY7ueoBerxjK7ktrVZJzOJWBYg%3D%3D&maxads=0&kld=1040&prvtof=QgCElAaU7XRUMFl5MyDEBSSPfRVREJYj6wZbggylUzu2cBfKl6VMLvNhujTIFYiHTkm80hvYHiczb9vBU7cl%2FbsUfMbtP02RawLxGvWs1C7ht2SBkc%2FrnKjSGNfB3HfEoRtkIgTgIXsSNyN%2FBYrokiAYKfZoyImC%2BeqDMYZ1JSk%3D&yprpnd=kNhh24CeQsFXzz1SWOZ3rHV%2BZB%2Fsajr4DaIqL68fDyo%3D&&kt=112&&ki=19222924&ktd=0&kld=1040&kp=1&bd=0%23720%231280%231%230%23523%23310 | VG | html | 4.61 Kb | malicious |
3948 | chrome.exe | GET | 200 | 199.191.50.39:80 | http://www14.googal.com/sk-logabpstatus.php?a=YjRWYWE0Q2sybE5aL0pSeGM0Q3dUOTk5d2FINktDSS9ya01wV05BbEtOUHJGZXRraVVzeVRiQWVtNEZzbEd5dldRR2I5bkxiWHU5MTdsS0tmcDRIWXR2a3I1VHVHY29iRldmczlVeGh1ZG89&b=false | VG | text | 346 b | malicious |
3948 | chrome.exe | GET | 200 | 199.191.50.39:80 | http://www14.googal.com/px.js?ch=2 | VG | text | 346 b | malicious |
3948 | chrome.exe | GET | 200 | 2.16.186.64:80 | http://i3.cdn-image.com/__media__/pics/26872/bg2.png | unknown | image | 105 Kb | whitelisted |
3948 | chrome.exe | GET | 200 | 84.15.64.140:80 | http://r1---sn-cpux-8ov6.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvOTRmQUFXVHlhaGJaUTdMLWtCSkNJUl9ZQQ/1.0.0.5_nmmhkkegccagdldgiimedpiccmgmieda.crx?cms_redirect=yes&mip=85.206.166.82&mm=28&mn=sn-cpux-8ov6&ms=nvh&mt=1574263409&mv=m&mvi=0&pl=23&shardbypass=yes | LT | crx | 293 Kb | whitelisted |
3948 | chrome.exe | GET | 404 | 199.191.50.39:80 | http://www14.googal.com/favicon.ico | VG | text | 30 b | malicious |
3948 | chrome.exe | GET | 200 | 2.16.186.64:80 | http://i2.cdn-image.com/__media__/pics/26872/bg2.png | unknown | image | 105 Kb | whitelisted |
3948 | chrome.exe | GET | 200 | 199.191.50.39:80 | http://www14.googal.com/Contact_Lens.cfm?fp=%2BO6mkT%2B8G9r8ObMujuuitMEjUv97sgANDAWKhqdB7xO5S9uV745LRbmyBGxj9SVkyqY7bHLMFC7buXAl36Lm0FaJge3XoX5KF3b4EGCT2i7aieReRq5WcShA2sPZ93hSJNbsw1Sf%2FzJK%2Ft0Sc3sAIj%2BoXdm6j%2BBrB%2F2WfINAJR7Uwka5WOZwL84IAXTG5C59M3tcZLNftNKO%2FEO%2FMHtYUQ%3D%3D&maxads=0&kld=1040&yprpnd=kNhh24CeQsFXzz1SWOZ3rHV%2BZB%2Fsajr4DaIqL68fDyo%3D&prvtof=QgCElAaU7XRUMFl5MyDEBSSPfRVREJYj6wZbggylUzu2cBfKl6VMLvNhujTIFYiHTkm80hvYHiczb9vBU7cl%2FbsUfMbtP02RawLxGvWs1C7ht2SBkc%2FrnKjSGNfB3HfEoRtkIgTgIXsSNyN%2FBYrokiAYKfZoyImC%2BeqDMYZ1JSk%3D&&&kt=112&&ki=6837160&ktd=0&kld=1040&kp=1&bd=0%23720%231280%231%230%23558%23255 | VG | html | 4.61 Kb | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
3948 | chrome.exe | 216.58.207.35:443 | clientservices.googleapis.com | Google Inc. | US | whitelisted |
3948 | chrome.exe | 45.79.19.196:80 | www.googal.com | Linode, LLC | US | malicious |
3948 | chrome.exe | 172.217.18.100:443 | www.google.com | Google Inc. | US | whitelisted |
3948 | chrome.exe | 2.16.186.64:80 | i4.cdn-image.com | Akamai International B.V. | — | whitelisted |
3948 | chrome.exe | 172.217.16.206:443 | clients1.google.com | Google Inc. | US | whitelisted |
3948 | chrome.exe | 172.217.18.99:443 | ssl.gstatic.com | Google Inc. | US | whitelisted |
3948 | chrome.exe | 172.217.18.110:80 | redirector.gvt1.com | Google Inc. | US | whitelisted |
3948 | chrome.exe | 172.217.22.33:443 | clients2.googleusercontent.com | Google Inc. | US | whitelisted |
3948 | chrome.exe | 84.15.64.140:80 | r1---sn-cpux-8ov6.gvt1.com | UAB Bite Lietuva | LT | whitelisted |
3948 | chrome.exe | 84.15.64.141:80 | r2---sn-cpux-8ov6.gvt1.com | UAB Bite Lietuva | LT | whitelisted |
Domain | IP | Reputation |
|---|---|---|
www.googal.com |
| malicious |
clientservices.googleapis.com |
| whitelisted |
accounts.google.com |
| shared |
www14.googal.com |
| malicious |
www.google.com |
| malicious |
i4.cdn-image.com |
| whitelisted |
i3.cdn-image.com |
| whitelisted |
i1.cdn-image.com |
| whitelisted |
clients1.google.com |
| whitelisted |
ssl.gstatic.com |
| whitelisted |