Windows Analysis Report
https://firebasestorage.googleapis.com/v0/b/beast7-d96c5.appspot.com/o/redirectgeo%20-%20ES%20BBQ%202.htm?alt=media&token=eadf3df4-ffcd-49cd-a601-dc91c9420bb3

Overview

General Information

Sample URL:	https://firebasestorage.googleapis.com/v0/b/beast7-d96c5.appspot.com/o/redirectgeo%20-%20ES%20BBQ%202.htm?alt=media&token=eadf3df4-ffcd-49cd-a601-dc91c9420bb3
Analysis ID:	1543735

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Stores files to the Windows start menu directory

Classification

Signatures

Source: https://firebasestorage.googleapis.com/v0/b/beast7-d96c5.appspot.com/o/redirectgeo%20-%20ES%20BBQ%202.htm?alt=media&token=eadf3df4-ffcd-49cd-a601-dc91c9420bb3	HTTP Parser: No favicon
Source: https://www.google.com/	HTTP Parser: No favicon
Source: https://www.google.com/	HTTP Parser: No favicon
Source: https://www.google.com/	HTTP Parser: No favicon
Source: https://www.google.com/	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49796 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212

Source: global traffic	DNS traffic detected: DNS query: g10498469755.co
Source: global traffic	DNS traffic detected: DNS query: google.com
Source: global traffic	DNS traffic detected: DNS query: cdn.prod.website-files.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: ogs.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49796 version: TLS 1.2

Source: classification engine

Classification label: clean0.win@18/40@24/244

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1892,i,16408627090209725124,13882016901138540655,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://firebasestorage.googleapis.com/v0/b/beast7-d96c5.appspot.com/o/redirectgeo%20-%20ES%20BBQ%202.htm?alt=media&token=eadf3df4-ffcd-49cd-a601-dc91c9420bb3"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1892,i,16408627090209725124,13882016901138540655,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.46	plus.l.google.com	United States	15169	GOOGLEUS	false
142.250.184.195	unknown	United States	15169	GOOGLEUS	false
142.250.186.78	google.com	United States	15169	GOOGLEUS	false
142.250.110.84	unknown	United States	15169	GOOGLEUS	false
142.250.185.67	unknown	United States	15169	GOOGLEUS	false
142.250.74.202	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
216.58.212.138	unknown	United States	15169	GOOGLEUS	false
216.58.212.131	unknown	United States	15169	GOOGLEUS	false
104.18.160.117	cdn.prod.website-files.com	United States	13335	CLOUDFLARENETUS	false
142.250.186.163	unknown	United States	15169	GOOGLEUS	false
216.58.206.67	unknown	United States	15169	GOOGLEUS	false
142.250.185.238	unknown	United States	15169	GOOGLEUS	false
34.120.31.228	g10498469755.co	United States	15169	GOOGLEUS	false
142.250.185.202	unknown	United States	15169	GOOGLEUS	false
216.58.206.46	www3.l.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.185.163	unknown	United States	15169	GOOGLEUS	false
142.250.185.164	unknown	United States	15169	GOOGLEUS	false
142.250.184.206	play.google.com	United States	15169	GOOGLEUS	false
142.250.186.42	unknown	United States	15169	GOOGLEUS	false
142.250.74.196	www.google.com	United States	15169	GOOGLEUS	false
172.217.16.142	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16

Contacted Domains

Name	IP	Active
google.com	142.250.186.78	true
www3.l.google.com	216.58.206.46	true
plus.l.google.com	142.250.186.46	true
play.google.com	142.250.184.206	true
cdn.prod.website-files.com	104.18.160.117	true
www.google.com	142.250.74.196	true
g10498469755.co	34.120.31.228	true
ogs.google.com	unknown	unknown
apis.google.com	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.google.com/	false		unknown

ID:	1543735
Product:	CloudBasic
Start time:	10:52:35
Start date:	28.10.2024
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 28 08:53:02 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	206ADE53EB6A02B4AE1023CE8881CEB6	84CA7C1B30E0EB6707A4AAB6B8DCC683564936FF	24F36C991589B6156B35BAE4A8D06F6D94FF3736427941EAA6598B7802FA3752
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 28 08:53:02 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	B5AB2DEDE57E439017AC5B91C6249950	A13C0901C6F2261717D40DA00F9C6BFD1D03BC7D	FB97877F4B264D5D1D7304FAAD9B56CA54A1093D8BB3970A51B0370DEA367C02
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	EDE300D9761FAB9870D5226006BE252B	BCF07B85A63A7FDBDDC8BB07B665AA7CF5514504	C40BFA8D4AD8ADAFC89BB68C7DC647FC2634210C813227171645C0A24E90EF1C
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 28 08:53:02 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	49EB8D34368BFC185CD87DCBD21ACC86	2C2A93E786B91E8A2B08BCFA3D02A64DFC8D53E5	5F1613255E01F301E0EE0741E84F8466FDD8311F6CDEFEA6C92905B2B6109035
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 28 08:53:02 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	8EC62C681A5567753838EEEA9FD7D07B	F462FD0A209917C566BDD3B3758BDFA5AF1B80B4	9EA6FBD7F5F6A06F36B81B740C8EFE5EF83A71BED167A48A679D58FB0E15055F
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 28 08:53:02 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	7BEB26746EB0398EC4E1A28E113FB9DD	8DA14C381D77C79ED35979EDF8F2E2B856D438ED	0E7A8FD571372477CC207D941FD1237D6A945813D4683323FFBF90686F0E4A81
Chrome Cache Entry: 101	Web Open Font Format (Version 2), TrueType, length 52280, version 1.0	F61F0D4D0F968D5BBA39A84C76277E1A	AA3693EA140ECA418B4B2A30F6A68F6F43B4BEB2	57147F08949ABABE7DEEF611435AE418475A693E3823769A25C2A39B6EAD9CCC
Chrome Cache Entry: 102	ASCII text	02AE273841421E2EABDD79F570618DC3	7E9E02B4D09119FD7D81AD6B86EB87E12A8C51AC	FD8F036E1BEE1D4AEAA41706182E3B403BD5A2345E1385A5AE60BB1CF24DA373
Chrome Cache Entry: 104	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced	6282A05D151E7D0446C655D1892475E2	B2B05F319DA0E73250200AE9BB518A318D6B4C5D	4CAB9CF78FD7C85AE2236CDD47B905FA4173F664946DFAB008591B3CFE4280B7
Chrome Cache Entry: 105	HTML document, ASCII text, with very long lines (13691)	47EA41DABE157B2C9650CC30593605FA	C08E61FC51E317FDB629D5A2C1DDF14E523B1DB7	BB32321C8F503C82B2246D451D3670C59D1289456CCDE2F820FCFFC52D79F99C
Chrome Cache Entry: 107	ASCII text, with very long lines (6297)	34AAF464D55E55B8EFAA1518CA1975C4	4456D22CE71DD6BC206BDC6E816531CFA2B57E9A	854D22392E91E2BDA4D7AC336A87E52672FFF6B0035A6BC9CDCAF547135E64DF
Chrome Cache Entry: 108	MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel	F3418A443E7D841097C714D69EC4BCB8	49263695F6B0CDD72F45CF1B775E660FDC36C606	6DA5620880159634213E197FAFCA1DDE0272153BE3E4590818533FAB8D040770
Chrome Cache Entry: 109	ASCII text	B67CF2D947B692CD8D2071258B571F53	0AD6F4192130768067C4255A0BADADEFECA8BAAA	9466FC30CA7D6BE6E385FA218B5AA71A69912C18A25744E6EFC3DEFA252DAB16
Chrome Cache Entry: 110	HTML document, ASCII text, with CRLF line terminators	6FA7F746F51322F0680B55476D9CD4A8	A19589840118247AC517B9C4E7BD61299930E185	561410D561988D2B36E73B2AC4BB109C67C88A6BF862D52CCC5E52CC5EE040CF
Chrome Cache Entry: 111	ASCII text, with very long lines (1521)	42C55AC61D3DC31CC01F17703D60FA16	9C057FCD41C079BCAD70E64C0B6EDE81CDEEDDB8	A45B2F2A7ED5B6E1D3CB116DCCDC20FFAA05A3D4CBDD47BE3DA7BE24EC9845B7
Chrome Cache Entry: 112	ASCII text, with very long lines (1302)	A5D33473ED0997C008D1C053E0773EBE	FEB4CB89145601A0141CC5869BEDF9AE7CD5CB80	14C27BB0224FCF89A43B444B427DABE3D0AF184CAA7B6B4990CE228C51AE01C1
Chrome Cache Entry: 113	ASCII text, with very long lines (621)	82B36D0DF5EFB11B1247BF58D0F53B73	D2381508AB596698AB2FADE0634A432984E639C4	FE4E42C191A0491B4BDD5E953A6EC3804415DECB98E53B9E35DF5AA4A5A10F4D
Chrome Cache Entry: 116	ASCII text	A3B58B135AB3723169610B4DE2BD006D	60751E1BF6A77286A89FA36503C818311B382F07	92CAC372ECEFC54A5CE198338BD1C21FCA6F8EED9131CA0AE50D862DBBCE9295
Chrome Cache Entry: 117	ASCII text, with very long lines (766)	601F70E857A6953CBDA4B9CE9BC98A18	F560E43C98CFE8641EE7DC773E5152910EFC8C9F	F61D46987F8A646B3FB3356F84E69831FB269C8426D6971924E7154CEC957759
Chrome Cache Entry: 119	ASCII text, with no line terminators	BEEDCB4EB0A559E6CE2D1E20D38CB330	A04EE9801770C0E81B170D7992EC3735E878AA58	6E9D99B87595B07B10676B68EBE9AA8B63DF7D9A74F59CC91EED60EA1FBDC6EF
Chrome Cache Entry: 120	ASCII text, with very long lines (3521)	08D44C8857573C459C2098F02BC251F8	D4BD0C4B428EBD184C5C1EA6C331BA1C87EC8B92	9830BAE24B5950DAED52A956FFB1D0F170C1E8ABADCC7EA3458C4DE893ACB3CA
Chrome Cache Entry: 121	ASCII text, with very long lines (7408)	1ED292E65706B01E63C364311884A2AC	4541FC8918E26266FD2D676AAA59CB193B0516AF	C3C05B93B9AA0CE06AC15BF580A878177EB039FE44B9D4D24933228CBF98DD88
Chrome Cache Entry: 122	RIFF (little-endian) data, Web/P image	C3DFF0D9F30EC0BCF4DEC9524505916B	4B378403ACBEBC3747E08C69B5FD7770A850C9EB	73D788F86BE22112BB53762545989C0F1BBDB7343161130952C9BA3834FF81E3
Chrome Cache Entry: 123	ASCII text, with very long lines (589)	9F810AA0EF12543DB9BAAA37ADC937B0	E9A1278D08198AAFEE5437D8EE93D6B786C03487	3D00166142B7768869FE895A4524C0CE09BBB2EE6DA5BC64A5C9FFE85D44355F
Chrome Cache Entry: 124	HTML document, Unicode text, UTF-8 text, with very long lines (1136)	FBE36EB2EECF1B90451A3A72701E49D2	AE56EA57C52D1153CEC33CEF91CF935D2D3AF14D	E8F2DED5D74C0EE5F427A20B6715E65BC79ED5C4FC67FB00D89005515C8EFE63
Chrome Cache Entry: 125	ASCII text, with very long lines (1281)	AF2B61C14E81AED046BD457370689B3E	BC9B2DC5798AD22FD9DD4B3E3D1FB7F2B5E29085	C6C7767D9C19E031954167DF691194A7B560C10CE31F3EE507CF1FBC50BA76C6
Chrome Cache Entry: 127	ASCII text, with very long lines (2287)	484184FA115B901608813FF9AD662D66	03940204713774B0333168624F38E1C8F38CD9A7	3705D85A13B50B2C1A500E16A40EF349D62D3F06A847A903C31A2444F6063D03
Chrome Cache Entry: 131	ASCII text	3F630FB1EDF44612ECF63D507C33FA61	D3F731A8265F9A623951BCA038263F294D3847F4	7516B2C734C70CDA56C27E775546811E0DB3A7580F531BA14DE0C1834D9204B0
Chrome Cache Entry: 133	Web Open Font Format (Version 2), TrueType, length 15344, version 1.0	5D4AEB4E5F5EF754E307D7FFAEF688BD	06DB651CDF354C64A7383EA9C77024EF4FB4CEF8	3E253B66056519AA065B00A453BAC37AC5ED8F3E6FE7B542E93A9DCDCC11D0BC
Chrome Cache Entry: 134	ASCII text, with very long lines (550)	886BE6C3817524F0A9C670AA712F7963	C535C66BF3FA4F69290DB50DD6DFA26C3539198C	401A366F7B672D735595C59AC319BD3F937CB36FCFCE187044BB738F50B265D4
Chrome Cache Entry: 140	ASCII text, with very long lines (1689), with no line terminators	45DD7BD58C9F085DA52FA16A2A150066	9B5CF4B288EDE14AE8834F3EF2A58145B8EC8CBC	0D5C53FCC37C7A2CE26367BBE6197FCD9272DD7EBC81823D088A4DFFF5AE599B
Chrome Cache Entry: 141	SVG Scalable Vector Graphics image	CDAA6F978EB8AE6A3F06C302576E516A	DBE242ED2BF0F09E6F3D433238A3A3C66088CDBE	EB28B704465A04EA324D59B3F0F6BBF0D870BCE9744F1B8AA25C077BEF05443D
Chrome Cache Entry: 87	ASCII text, with very long lines (4232), with no line terminators	DA43A25BD1F9DD99ABEEE97AE6E6BCA6	FAF739B5A3ACE85BABEF8AF8C123C7B140D5222A	FC42CAFE3E110C38CB62AB04E51E2F806F308D3ED3F95C9E3AB5D0B7B3C9978A
Chrome Cache Entry: 88	ASCII text, with very long lines (960)	3AD81844EDFBFE7698ECC0E114A0F680	494710FF611ED4C997F3DE7B46D12050C84C9314	954DD56F9F4399D43A1BBA4D69E901F47EFBCB66650A02C60D630E16089A0E3A
Chrome Cache Entry: 90	ASCII text, with very long lines (10109), with no line terminators	E67394A50AD30DD0A4FC371B2F9F2A36	3167C010A7C76D0F9054980C819815BB0E291F2D	487FBC096FEB40C5D01414F5FE41A2A175411C1712E761A97BFD69A57C4FE664
Chrome Cache Entry: 91	JSON data	CB2C992FFBC6B5F12E7BE00540BE7E55	977BA74C9F6482B062705BD28E50BF68122C34A5	9783A9508B9B7CB2115BA836C7C2FAE42BC8C8A9A676B40784D3434AE2022080
Chrome Cache Entry: 92	PNG image data, 272 x 92, 8-bit/color RGBA, non-interlaced	8F9327DB2597FA57D2F42B4A6C5A9855	1737D3DFB411C07B86ED8BD30F5987A4DC397CC1	5776CD87617EACEC3BC00EBCF530D1924026033EDA852F706C1A675A98915826
Chrome Cache Entry: 93	ASCII text, with very long lines (526)	0DD87837E5E9C0B4B80F34AA25C1D259	0D12A3253AE7800E5A6E42B3BA221AA0302000A1	2A4166342767E63CE34855AAAEDA613BBCF5D7F116B67F5F24FAA8F096A8619D
Chrome Cache Entry: 98	HTML document, ASCII text, with very long lines (32553)	F3422A35446544C286FC7C335CFFD168	F6BAF9DE80161CBF421B3A5D782D5C42C8EBD12F	0FD0CFF8E42470710BFA10B80B7C8496854E4432E93F1D67A334C2A825318226
Chrome Cache Entry: 99	ASCII text, with very long lines (615)	C3176A95DD26A7D1BDA416C455DA4602	9F9A6236EF34D915479CEEFB3DD8CB038E808DF4	50F218FBE63BEF6584DF5368F4589C7164D099E5D287A56B3F130D53B747F141

Windows Analysis Report
https://firebasestorage.googleapis.com/v0/b/beast7-d96c5.appspot.com/o/redirectgeo%20-%20ES%20BBQ%202.htm?alt=media&token=eadf3df4-ffcd-49cd-a601-dc91c9420bb3

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report https://firebasestorage.googleapis.com/v0/b/beast7-d96c5.appspot.com/o/redirectgeo%20-%20ES%20BBQ%202.htm?alt=media&token=eadf3df4-ffcd-49cd-a601-dc91c9420bb3

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
https://firebasestorage.googleapis.com/v0/b/beast7-d96c5.appspot.com/o/redirectgeo%20-%20ES%20BBQ%202.htm?alt=media&token=eadf3df4-ffcd-49cd-a601-dc91c9420bb3