Windows Analysis Report
https://litnet.com/out?signature=2c1f4fb3a510da55&verify=f0d85a74515d878f9714518b56f64f83c3d478981c8004fd8a36ff05f77ed04b&litnet=domain&url=https://cloudflare-ipfs.com/ipfs/QmbbUyKXzZMtLWL65JBbfeA8HRigpuDZ9sk5XT4xvfvyVx?filename=reqistrer-serversNonniiii.html#YXN0cmlkLnd1cnN0ZXJAaWxlZGVmcmFuY2UuZnI=

Overview

General Information

Sample URL:	https://litnet.com/out?signature=2c1f4fb3a510da55&verify=f0d85a74515d878f9714518b56f64f83c3d478981c8004fd8a36ff05f77ed04b&litnet=domain&url=https://cloudflare-ipfs.com/ipfs/QmbbUyKXzZMtLWL65JBbfeA8HRi
Analysis ID:	1447735
Infos:

Detection

HTMLPhisher

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Yara detected HtmlPhish10

AI detected suspicious javascript

Found iframes

HTML body contains low number of good links

HTML body contains password input but no form action

HTML page contains hidden URLs or javascript code

HTML title does not match URL

Stores files to the Windows start menu directory

Classification

Signatures

Phishing

AI detected phishing page

LLM: Score: 9 brands: ILEDEFRANCE Reasons: The URL is highly suspicious as it uses an IPFS (InterPlanetary File System) link, which is uncommon for legitimate websites. The domain does not match the legitimate domain name associated with the brand 'ILEDEFRANCE'. The page contains a login form, which is a common feature in phishing sites to steal credentials. The use of social engineering techniques is evident as the page advises users to verify their email account for security reasons, which can prompt users to enter their credentials without suspicion. DOM: 2.1.pages.csv

Yara detected HtmlPhish10

Source: Yara match	File source: 2.1.pages.csv, type: HTML
Source: Yara match	File source: dropped/chromecache_77, type: DROPPED

AI detected suspicious javascript

LLM: Score: 8 Reasons: The code contains a base64-encoded URL that, when decoded, points to a potentially suspicious site (nocodeform.io). The presence of a login error message and a default site title related to webmail login suggests that this script could be part of a phishing attempt to steal user credentials. Additionally, the use of a base64-encoded URL is a common tactic to obfuscate malicious links. DOM: 2.1.pages.csv

Found iframes

Source: https://cloudflare-ipfs.com/ipfs/QmbbUyKXzZMtLWL65JBbfeA8HRigpuDZ9sk5XT4xvfvyVx?filename=reqistrer-serversNonniiii.html&websrc=VdxUl9l9zz9XJUazwJikOsjZCy5xrbQZ7OVNeXhc52YIF3n6teWakuErye5Lp0boBSXwWXPPcrt2v1N1oDwJ7DqvaRZXhzb3Fpn9e0VGkVPZvn90ZkklbK4Xq0Nfd1KUur7oUeGmQg30odhhzIJk95v7I8xTFNCLFUV7p4rUnFMrndGnNZsXO4ZBACm4nwXN6StffF3RFuH3Y2uNRVeXDomF3rLkAu6nwmeafhHsuEy7wFCaUMoMwifyYbmW5s3f1Kk8GhkPGgIxEQQMHYpy8tHUwVIaAo1ar8NTFgTSPyMhjY&dispatch=683&id=793243#YXN0cmlkLnd1cnN0ZXJAaWxlZGVmcmFuY2UuZnI=

HTTP Parser: Iframe src: https://www.iledefrance.fr

HTML body contains low number of good links

HTTP Parser: Number of links: 0

HTML body contains password input but no form action

HTTP Parser: <input type="password" .../> found but no <form action="...

HTML page contains hidden URLs or javascript code

HTTP Parser: Base64 decoded: https://nocodeform.io/f/65fb2a8c6ec87b8eaeaf62c0

HTML title does not match URL

HTTP Parser: Title: Sign in iledefrance account does not match URL

HTTP Parser: <input type="password" .../> found

HTTP Parser: No <meta name="author".. found

HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.16:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.16:49737 version: TLS 1.2

Source: chrome.exe

Memory has grown: Private usage: 27MB later: 35MB

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27

Source: global traffic	DNS traffic detected: DNS query: litnet.com
Source: global traffic	DNS traffic detected: DNS query: cloudflare-ipfs.com
Source: global traffic	DNS traffic detected: DNS query: ik.imagekit.io
Source: global traffic	DNS traffic detected: DNS query: cdn.jsdelivr.net
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: maxcdn.bootstrapcdn.com
Source: global traffic	DNS traffic detected: DNS query: logo.clearbit.com
Source: global traffic	DNS traffic detected: DNS query: www.iledefrance.fr
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.16:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.16:49737 version: TLS 1.2

Source: classification engine

Classification label: mal60.phis.win@16/18@22/201

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://litnet.com/out?signature=2c1f4fb3a510da55&verify=f0d85a74515d878f9714518b56f64f83c3d478981c8004fd8a36ff05f77ed04b&litnet=domain&url=https://cloudflare-ipfs.com/ipfs/QmbbUyKXzZMtLWL65JBbfeA8HRigpuDZ9sk5XT4xvfvyVx?filename=reqistrer-serversNonniiii.html#YXN0cmlkLnd1cnN0ZXJAaWxlZGVmcmFuY2UuZnI=
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1968,i,10356222934595195562,2819351198065839367,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1968,i,10356222934595195562,2819351198065839367,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
217.147.199.227	idf-edge-proxies-01.cloud.alfa-safety.net	France	25540	ALPHALINK-ASFR	false
142.250.186.35	unknown	United States	15169	GOOGLEUS	false
104.17.24.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
142.250.185.67	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
104.18.17.118	litnet.com	United States	13335	CLOUDFLARENETUS	false
108.177.15.84	unknown	United States	15169	GOOGLEUS	false
151.101.129.229	jsdelivr.map.fastly.net	United States	54113	FASTLYUS	false
142.250.185.110	unknown	United States	15169	GOOGLEUS	false
18.239.36.13	unknown	United States	16509	AMAZON-02US	false
18.65.39.61	unknown	United States	3	MIT-GATEWAYSUS	false
104.18.11.207	maxcdn.bootstrapcdn.com	United States	13335	CLOUDFLARENETUS	false
172.217.23.110	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
18.239.36.50	d26p066pn2w0s0.cloudfront.net	United States	16509	AMAZON-02US	false
142.250.181.228	www.google.com	United States	15169	GOOGLEUS	false
18.66.218.102	d28h3jm4r3crf8.cloudfront.net	United States	3	MIT-GATEWAYSUS	false
142.250.186.42	unknown	United States	15169	GOOGLEUS	false
104.17.64.14	cloudflare-ipfs.com	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.16
192.168.2.7

Contacted Domains

Name	IP	Active
jsdelivr.map.fastly.net	151.101.129.229	true
d26p066pn2w0s0.cloudfront.net	18.239.36.50	true
cdnjs.cloudflare.com	104.17.24.14	true
maxcdn.bootstrapcdn.com	104.18.11.207	true
cloudflare-ipfs.com	104.17.64.14	true
www.google.com	142.250.181.228	true
d28h3jm4r3crf8.cloudfront.net	18.66.218.102	true
litnet.com	104.18.17.118	true
idf-edge-proxies-01.cloud.alfa-safety.net	217.147.199.227	true
www.iledefrance.fr	unknown	unknown
ik.imagekit.io	unknown	unknown
cdn.jsdelivr.net	unknown	unknown
logo.clearbit.com	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
about:blank	false	Avira URL Cloud: safe	unknown

ID:	1447735
Product:	CloudBasic
Start time:	00:28:49
Start date:	27.05.2024
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun May 26 21:29:17 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	3435E770AD0681F7B27469E87D0EDE7C	27A03892CD5EBE87B769DD81AF286127C3AE0AAF	8C077095B715DC3535CCAC24640F47A443F7CC35BC9E0B0A74BD902588821B1B
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun May 26 21:29:17 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	00570FE2937037120CA2AFD0A401B158	2A49D7E42849D4C5CCC0307BB07398F1FEE18A06	4CA9996579CAD9D8466D7014B3F3AF5BA0518189151030F1E1A4226CECD4EF00
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	675D736C5566573AA0C173A170121F51	7D0B981679C9E3627C76E7144F7826D99CB80314	DEE2E35AD30EEE97AA63598419A543D050A6F3ABC18EC6915DC762E1DBAAD61D
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun May 26 21:29:16 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	9C0B18A6BD8BB60252114D866B7A214F	FB75FD717A268C571245D47937AE8CD49409ADC0	B75DD35062FE0C16215A50EA5F9D0BD327C3C3FC1342C841D66D4C1AE74A80F9
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun May 26 21:29:17 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	9C7F7CC5A5ED38C71899C5C2560D9145	D985B56010E174F2A660A77CAE4E3B380C9E13E6	E202C879E4F87BC4E7CFC800923DD2A60AFA9C3E2D562B892260E49485BF91BE
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun May 26 21:29:16 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	C00048294724E50C3CB78529B4875721	64425606A0B99D7EBA5411F7D509DF1003E96806	8CC077086858D698D414DCCE268ECC56D53D1B512AC6EA5DFD172C1EB00FB269
Chrome Cache Entry: 77	HTML document, ASCII text, with very long lines (959)	D8E1139BE606690FF7B0B4F15D8FFB71	77892DFB41AF531A13E83B97B2219546879F70A1	DB2DE11FA3D8CDCD2F0A43D1DFD4B791388F38F3DE5F675B65C6FFA3E1A61337
Chrome Cache Entry: 78	GIF image data, version 89a, 200 x 200	D536D58EA2F4CFE5D5B734E7893FB09E	77C5E9FCBB33EB9B6DF808AA86F50E0542E5162F	669C17CDE38DD0AB9673DE77A674C5B192E934399BBEE3EBED65BD70B05BFF5F
Chrome Cache Entry: 79	ASCII text, with very long lines (4143)	9BECC40FB1D85D21D0CA38E2F7069511	AE854B04025DB8B7F48FDD6DEDF41E77EAE44394	A9705DFC47C0763380D851AB1801BE6F76019F6B67E40E9B873F8B4A0603F7A9
Chrome Cache Entry: 80	ASCII text, with very long lines (65447)	8FB8FEE4FCC3CC86FF6C724154C49C42	B82D238D4E31FDF618BAE8AC11A6C812C03DD0D4	FF1523FB7389539C84C65ABA19260648793BB4F5E29329D2EE8804BC37A3FE6E
Chrome Cache Entry: 81	HTML document, Unicode text, UTF-8 text, with very long lines (630)	B4D868755161D10C910A08D2B5E8E82A	872667F1FBE5AC62D617F88D8EAD744774765D1C	536C4D32C0413E181512D11B077A60A056AD6E6F27CDFAE0ED05B8A17F0A63ED
Chrome Cache Entry: 82	ASCII text, with no line terminators	75FD0092DBCE82A231F7C5CADD761467	AF095A884D6698AD6483A621B95D5A5E7316A96B	C59AE101AB7C0F6198F5A4A14F57D320B138601E0C0E92129FBF194B322B61D6
Chrome Cache Entry: 83	ASCII text, with very long lines (65449)	FB192338844EFE86EC759A40152FCB8E	E55DF1F7D6C288EE73D439BAB26DD006FFEE7AF3	29296CCACAA9ED35ED168FC51E36F54FD6F8DB9C7786BBF38CC59A27229BA5C2
Chrome Cache Entry: 84	PNG image data, 128 x 128, 8-bit/color RGB, non-interlaced	D979552FC3D4BAEB70B72A63827678CD	3C89BEABC2562A85744FC89B68563FA71AC09720	31D8D9222E413C11847331F45A6B0A0E7EE17B541916B007B451FEA9DFF049A3
Chrome Cache Entry: 85	ASCII text, with very long lines (48664)	14D449EB8876FA55E1EF3C2CC52B0C17	A9545831803B1359CFEED47E3B4D6BAE68E40E99	E7ED36CEEE5450B4243BBC35188AFABDFB4280C7C57597001DE0ED167299B01B
Chrome Cache Entry: 87	ASCII text, with very long lines (19015)	70D3FDA195602FE8B75E0097EED74DDE	C3B977AA4B8DFB69D651E07015031D385DED964B	A52F7AA54D7BCAAFA056EE0A050262DFC5694AE28DEE8B4CAC3429AF37FF0D66
Chrome Cache Entry: 88	ASCII text, with no line terminators	A273B53D0A9A7ECCE7E5099471BB3A24	49BEB7C9EDD58288B47F2F216933A7792CC65863	A3C2EFA08FA04B5E92729AF65257604E0066EC68AE95CB9926D8C293CD2BA94F
Chrome Cache Entry: 90	ASCII text, with very long lines (14271)	70489D9432EF978DB53BEBDA3E9F4C14	F24D0BCC36027BCE45C86ACFBA57B248EDB6A3F9	24B9A49D375465E659DBAECB3FDA81FBF0D3EEDBF138E29CB5229E502D8A4FA1

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs