Windows Analysis Report
https://www.cognitoforms.com/f/89SrSs1MAk62CkEup_jijw/1

Overview

General Information

Sample URL:	https://www.cognitoforms.com/f/89SrSs1MAk62CkEup_jijw/1
Analysis ID:	1543819

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

Detected non-DNS traffic on DNS port

Stores files to the Windows start menu directory

Classification

Signatures

Source: https://www.cognitoforms.com/f/89SrSs1MAk62CkEup_jijw/1	HTTP Parser: No favicon
Source: https://www.cognitoforms.com/f/89SrSs1MAk62CkEup_jijw/1	HTTP Parser: No favicon
Source: https://www.cognitoforms.com/f/89SrSs1MAk62CkEup_jijw/1	HTTP Parser: No favicon
Source: https://www.cognitoforms.com/f/89SrSs1MAk62CkEup_jijw/	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.17:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.160.17:443 -> 192.168.2.17:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.209.150:443 -> 192.168.2.17:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.17:49786 version: TLS 1.2

Detected non-DNS traffic on DNS port

Source: global traffic	TCP traffic: 192.168.2.17:49769 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:49769 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:49769 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:49769 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:49769 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:49769 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:49769 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:49769 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:49769 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:49769 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:49769 -> 1.1.1.1:53

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108

Source: global traffic	DNS traffic detected: DNS query: www.cognitoforms.com
Source: global traffic	DNS traffic detected: DNS query: static.cognitoforms.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.17:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.160.17:443 -> 192.168.2.17:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.209.150:443 -> 192.168.2.17:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.17:49786 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@22/21@14/142

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1864,i,4995266594684654653,12391274895027543249,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.cognitoforms.com/f/89SrSs1MAk62CkEup_jijw/1"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1864,i,4995266594684654653,12391274895027543249,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.184.195	unknown	United States	15169	GOOGLEUS	false
142.250.186.78	unknown	United States	15169	GOOGLEUS	false
142.250.184.196	www.google.com	United States	15169	GOOGLEUS	false
34.104.35.123	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
142.250.186.170	unknown	United States	15169	GOOGLEUS	false
13.107.246.45	s-part-0017.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.246.60	s-part-0032.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.185.227	unknown	United States	15169	GOOGLEUS	false
64.233.166.84	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.217.18.110	unknown	United States	15169	GOOGLEUS	false
20.246.218.104	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
192.168.2.17

Contacted Domains

Name	IP	Active
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true
www.google.com	142.250.184.196	true
s-part-0032.t-0009.t-msedge.net	13.107.246.60	true
static.cognitoforms.com	unknown	unknown
www.cognitoforms.com	unknown	unknown

Contacted URLs

Name	Malicious	Reputation
https://www.cognitoforms.com/f/89SrSs1MAk62CkEup_jijw/	false	unknown
https://www.cognitoforms.com/f/89SrSs1MAk62CkEup_jijw	false	unknown
https://www.cognitoforms.com/f/89SrSs1MAk62CkEup_jijw/1	false	unknown

ID:	1543819
Product:	CloudBasic
Start time:	14:15:14
Start date:	28.10.2024
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 28 12:15:50 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	38D96C4571628AE5AAF03593C49278AA	D375CB97F66E4F3C8EED0B53912A1B4899112B4E	B419BFFA017D0E9AFEC2AEFDAC9E8928252A059D4E554C4D23DDEF5D01C655F8
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 28 12:15:50 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	0DCFEC9FD743DF896C17390EFEC758F8	120BB1146A50F3E40D32BCDBA8B7DBE991FACDF9	50DBDA34BD17FBB46B92E39FB08E9A15F028CF62D87DC67D6025A1CED973B817
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:54:41 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	F2A64AF072CE7990824AC45C2DC186FF	397D21DD9F82748BBFF7531201604070EE4FAD35	4EE60BE227FE3EF949F346FB712180DF1F06B20213A44866CAFCFA3F4AE763EB
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 28 12:15:50 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	CE2D359B04BBD1EBE6669358154EE01A	C34C0A51FC77096B0C35BDCC13049CBE130D9061	53DAED991D2A6E7070C48B487FA70A4185F2B2FF7359BE8A738EC4AE67A986DF
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 28 12:15:50 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	E80FE8A85B0CF668722671C2D13ABA43	50320FAC68A391FA5F1869B0A2624F1DB1B88ACB	3D9741388C8552F0515D5D0F3D0A6B302B3A3F6BC9F75F650CBB213D0666C935
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 28 12:15:49 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	0957EB66F433B8C2E9D355BAA9C86551	0FA85733BAFD957305439F1AB9D41734BF37E2FD	3A2713770B8526539E3BF29984F7A978ED12EC6359BDB2618C66A6DD8622DE5D
Chrome Cache Entry: 181	Unicode text, UTF-8 text, with very long lines (65101), with no line terminators	5A18B75385B0F64AA87EE78A83A15259	6A8E7D13BEB38A3DBEEAC3D9E9E9B6A93BA73A08	60ACD8DFC35F3BB0A9AC5411A3BEE9917D7F419ED4A191552F5F014BE45CCBCC
Chrome Cache Entry: 182	ASCII text, with very long lines (39312)	EF072583499E257374CACCE6C37BCDBA	165F92A3D9EB0F3E8E9D8A72B4073D8FDBE8D116	E794275C97E6A98A13D56014D452490CE843D0A7288280CA3E6DACD10F7C7F80
Chrome Cache Entry: 183	ASCII text, with very long lines (1893)	AFBFF60E932873C833E98556814B22A0	8480AA37DF7D8F87A100C0D853FC92E805396268	058344CBF7956B7D9F5475B532B69BF7F85A2E67C125E573E96091A2D244469C
Chrome Cache Entry: 185	ASCII text	8F3A5EC3A3248757F6ED8F79C62EDAA8	F5D0F35176604E8701A14C99A71FBF783B445B2B	638CF9529CC2C71A14419D4C2C370BC1AA62F108C762899894BED1CA83FD7ADF
Chrome Cache Entry: 186	ASCII text, with very long lines (2816)	87E459DB552E7BC22DAE9BF9C032C9E7	3CB341FEE44EEBADBA891DFD539E27A7D7F9DFAE	E84826CC4AD4DD82E9B05A2344DD0E22C94F2923256770F03D584309B125CC3E
Chrome Cache Entry: 187	Unicode text, UTF-8 text, with very long lines (45374)	22B89CB8D4B0B6F96F5EAFFDA3D25F14	6109B9DD617893F71656B1E05402C65B6AB54C4C	96B6F4360E432582F885A96B2E1B838F60988C94482077541B574AF03421E4CA
Chrome Cache Entry: 189	ASCII text, with very long lines (2646)	0CF07A837EEE40DCAA5B786932A2F721	2C18C4340278CAA0AED059F4CDB4116219EB64F3	F567EE269EB22F0B481B538694630A6777FBFBAE69123DB613281BE11B05D891
Chrome Cache Entry: 190	Unicode text, UTF-8 (with BOM) text, with very long lines (62184)	BA170AF4B60D81715DA00A07957F8AE9	75ED0FE1C9D935811EDD16B7C5ACD7CCE1872C07	3262AC74F8715952A914EA5C29E48AC6CF38E6508487A1CA0B489C7B8327560E
Chrome Cache Entry: 191	ASCII text, with very long lines (62817)	F1F6A6A03628CCD4C35A00039DD4C597	6DB38A13EEF88D6DC19CE45C19A4E4B031BF1C3C	0AF100FE9355716D6F20A6F9D2B7E13F005537D9354FB18927FB699C8EAEBC9E
Chrome Cache Entry: 194	ASCII text, with CRLF line terminators	9CAD3F90A4F5186F732A0B9BD8E522C4	05A97960F4E4F24776345A3F5FEA6558B1384494	1CA4C29158F1F930B2CF696A87F1A5C6E242EFB401E6CEC78E0986A7F732C55C
Chrome Cache Entry: 196	ASCII text, with very long lines (65536), with no line terminators	E439281962FE12ED337FFAB3532387E5	2A85787FF482DF00CFABB4151F110BAED5D21B87	B9D90D3ABBCEC1E3F74B6ED505AEA699EF059A43B8391F16835DF1C36231265E
Chrome Cache Entry: 197	Web Open Font Format (Version 2), TrueType, length 16324, version 1.0	F43FA5B4F6366EAE0039E4E49DB645DE	D7FEC074BA8B6E69BEC4A995EA722D3D1513AD43	0AA6A7045A55DDCB25BBEE4D1EDCB864081CF59F7FC9BDC1ADA22A32ED4AD3AD
Chrome Cache Entry: 198	ASCII text, with very long lines (54925)	BA2CC9B47697FCF9BE11C02062BE38CE	D9C231E6219937BA290FAFBC990564A8E51D5B04	F3F6361C51629C7175215EB1994D6E436F0C41DE81B50852DA80EF8BF3692E99
Chrome Cache Entry: 200	HTML document, ASCII text, with very long lines (9567), with CRLF line terminators	EF9E14EEC28D07CDFFD33392916955EB	65E75719FDD7D75A3840ADD4A3371FF967320195	F7BB0A3CDD32BDF4E74B0263241281A6DAF4212C5D69B14FFB502D8664950B93
Chrome Cache Entry: 204	ASCII text, with very long lines (65536), with no line terminators	E72C5A30C7BEA868F2CDE4D48080AD50	EC55A75DACEADF116C6F2E03E64A301057BEE94E	0DB68FA88A1E85263CE8538637BD9859A2720D3A3999F25E190E4E57D56EC9C6

Windows Analysis Report
https://www.cognitoforms.com/f/89SrSs1MAk62CkEup_jijw/1

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report https://www.cognitoforms.com/f/89SrSs1MAk62CkEup_jijw/1

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
https://www.cognitoforms.com/f/89SrSs1MAk62CkEup_jijw/1