Windows Analysis Report
https://u8411862.ct.sendgrid.net/ls/click?upn=u001.L4PK-2B0-2BuGt9pUFq-2FA3Op7Q-2F-2F9qb88t-2BRGAR6VDZa-2FLvCRsA1Ac7AajOPJIbQO7IP307a6xjNpvY8ZU7zRp9oyg-3D-3DE1Fg_CPebASiKsSpOAa3SLW44RsJxX9ZLglP0y4de2rxHefrHjZqY5SRIy9wKYZ9ERHf3zKK6o7ixiO4r4HIIwwj5RfSWrFWq-2FUbkZI-2FrBFl28oYsoQhEIuqeOt-2BjCiFlWuLC4rDo

Overview

General Information

Sample URL:	https://u8411862.ct.sendgrid.net/ls/click?upn=u001.L4PK-2B0-2BuGt9pUFq-2FA3Op7Q-2F-2F9qb88t-2BRGAR6VDZa-2FLvCRsA1Ac7AajOPJIbQO7IP307a6xjNpvY8ZU7zRp9oyg-3D-3DE1Fg_CPebASiKsSpOAa3SLW44RsJxX9ZLglP0y4de2r
Analysis ID:	1558824

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

HTML body contains low number of good links

HTML title does not match URL

Stores files to the Windows start menu directory

Classification

Signatures

HTML body contains low number of good links

Source: https://imsoidc.bentley.com/connect/authorize?client_id=user-management&redirect_uri=https%3A%2F%2Fusermanagement.bentley.com%2Fsignin-oidc&response_type=code%20id_token&scope=openid%20profile%20email%20user-management%20bentley-admin-api%20notification-service-20%20entitlement-search-service-2576%20ulas-product-information-2727%20agreements-2354&response_mode=form_post&nonce=638676423667396039.NzBlOWM4OTktOTFhYi00YmJkLTllNzYtMzZhZDhmYzUwMjAyOGMzOTFjZWQtZWViNC00ZTY5LWJmYzAtZGY1MjI5MDQ1YWUx&state=CfDJ8MKYeJ71b-9CueOVG07N9iuuFB_F8DYbFtOXu-nqWIKfVwrRunsryiib8HbqolyrqXBrmvhgbkw7frWWlLhwmjMt7bgN3FangX4Dz1SztrjK7cGoabkyPWoklfgcxi9A8bzWMxF61RuLoLSs53aCNfETg918YY7i_6rXM3441WSupl62Ng9vJSY-0XdEVq3ZLsvkErC1clObAEcdYx-PWnoL9bcMmhx8kBo_heWPKoCJLwhq_k8f-_kBzYS4bixJ8M2jsAbGeQJLYAFIfCPvfKY7bpEC5dBrWXy7SD5wLICnRVZ1eHhlrfua00aSIKyFHg&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=5.6.0.0

HTTP Parser: Number of links: 0

HTML title does not match URL

HTTP Parser: Title: Sign In does not match URL

HTTP Parser: No <meta name="author".. found

HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.68:443 -> 192.168.2.16:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.209.177:443 -> 192.168.2.16:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49727 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197

Source: global traffic	DNS traffic detected: DNS query: u8411862.ct.sendgrid.net
Source: global traffic	DNS traffic detected: DNS query: usermanagement.bentley.com
Source: global traffic	DNS traffic detected: DNS query: imsoidc.bentley.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: connect-cdn.bentley.com

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.68:443 -> 192.168.2.16:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.209.177:443 -> 192.168.2.16:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49727 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@18/13@12/145

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1948,i,1431956949486948433,14882087812796552089,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://u8411862.ct.sendgrid.net/ls/click?upn=u001.L4PK-2B0-2BuGt9pUFq-2FA3Op7Q-2F-2F9qb88t-2BRGAR6VDZa-2FLvCRsA1Ac7AajOPJIbQO7IP307a6xjNpvY8ZU7zRp9oyg-3D-3DE1Fg_CPebASiKsSpOAa3SLW44RsJxX9ZLglP0y4de2rxHefrHjZqY5SRIy9wKYZ9ERHf3zKK6o7ixiO4r4HIIwwj5RfSWrFWq-2FUbkZI-2FrBFl28oYsoQhEIuqeOt-2BjCiFlWuLC4rDomVqHzNhdvSab-2F-2Fw8d5IAtmQQI0BdCul9u12mfWcV4mFdLlsTdv9empaAUbuFjvZWnyaUm8GOERw44MojSA-3D-3D"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1948,i,1431956949486948433,14882087812796552089,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.185.99	unknown	United States	15169	GOOGLEUS	false
142.250.185.206	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
142.250.186.163	unknown	United States	15169	GOOGLEUS	false
142.250.186.174	unknown	United States	15169	GOOGLEUS	false
167.89.115.58	u8411862.ct.sendgrid.net	United States	11377	SENDGRIDUS	false
20.105.232.11	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
52.59.10.51	prod.ims.bentley.proofidcloud.com	United States	16509	AMAZON-02US	false
172.217.18.106	unknown	United States	15169	GOOGLEUS	false
152.199.21.175	sni1gl.wpc.nucdn.net	United States	15133	EDGECASTUS	false
64.233.184.84	unknown	United States	15169	GOOGLEUS	false
172.217.16.196	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16
192.168.2.5

Contacted Domains

Name	IP	Active
prod.ims.bentley.proofidcloud.com	52.59.10.51	true
www.google.com	172.217.16.196	true
u8411862.ct.sendgrid.net	167.89.115.58	true
sni1gl.wpc.nucdn.net	152.199.21.175	true
imsoidc.bentley.com	unknown	unknown
connect-cdn.bentley.com	unknown	unknown
usermanagement.bentley.com	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://imsoidc.bentley.com/connect/authorize?client_id=user-management&redirect_uri=https%3A%2F%2Fusermanagement.bentley.com%2Fsignin-oidc&response_type=code%20id_token&scope=openid%20profile%20email%20user-management%20bentley-admin-api%20notification-service-20%20entitlement-search-service-2576%20ulas-product-information-2727%20agreements-2354&response_mode=form_post&nonce=638676423667396039.NzBlOWM4OTktOTFhYi00YmJkLTllNzYtMzZhZDhmYzUwMjAyOGMzOTFjZWQtZWViNC00ZTY5LWJmYzAtZGY1MjI5MDQ1YWUx&state=CfDJ8MKYeJ71b-9CueOVG07N9iuuFB_F8DYbFtOXu-nqWIKfVwrRunsryiib8HbqolyrqXBrmvhgbkw7frWWlLhwmjMt7bgN3FangX4Dz1SztrjK7cGoabkyPWoklfgcxi9A8bzWMxF61RuLoLSs53aCNfETg918YY7i_6rXM3441WSupl62Ng9vJSY-0XdEVq3ZLsvkErC1clObAEcdYx-PWnoL9bcMmhx8kBo_heWPKoCJLwhq_k8f-_kBzYS4bixJ8M2jsAbGeQJLYAFIfCPvfKY7bpEC5dBrWXy7SD5wLICnRVZ1eHhlrfua00aSIKyFHg&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=5.6.0.0	false		unknown

ID:	1558824
Product:	CloudBasic
Start time:	20:45:37
Start date:	19.11.2024
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 19 18:46:05 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	7DA018B2B0EC18DA0EC5DD7685A3A0A7	D9E56B0A08CFE295944010AFB2F020D1EB292182	487DBDD3F0E212D2289375AE2D16384ED62956BD6622E1A2EC85C048CE516383
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 19 18:46:05 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	1534D6CEA1362CE90F16D29EFF4EF964	1D92E15D2B1D84D83EBD96425F6B09E102740C7E	4BA15A59E5A84137014731B7A37F9A1D644443DC0157EBF8813984A997401F25
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	975F6FDB3719FC0456193A03AE302D28	CE978BB020C7F3E391939995B4BA88257F8211BB	D8DC0CF069ABA501ECA693390A3B0FDA549C504E0288AFF6DF0D2BF577892629
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 19 18:46:05 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	1DC6EF0CAC795DABB2BAAD2ECF724186	0CAB94AB087C3190D5AFB34F9E67A23438C166D3	8640648F14DEFA4C59F434681126474505724890EE6972D1992F82A545F9319D
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 19 18:46:05 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	CD8572D5DE4DC8DD04982AB8CA6F60ED	F34F0A2036C3E8A10A7DD4EDEA75D2AFE81A963D	31D051F0AD847DABFFC0A71F2CFD02EC60FA3F504F7235B32D1C06173CE64066
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 19 18:46:05 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	2523D48F552C181664EC0CF85ECAD59C	443DDAE5961A0660719D83DEADEB4B0D0605DFB6	7A235D8C8FA7AC940A57E6733A96BF141E048E6804F8FC026FF6388E0C16D7B6
Chrome Cache Entry: 67	ASCII text, with no line terminators	AE51FBC3D399F749B61F9BDF72563826	EC6F460E2F5743D38DD184B43CB3ED60B52F8110	CCE094DF4D24E9B75D6329FE80DDF2BC29EEE4AAF1282D10EA173DE7F6A842CE
Chrome Cache Entry: 68	ASCII text, with very long lines (505)	751ACB8BC400000AB915573523CE3AEC	41AF039A53702C10161BA9A526B68485ADD3E8DC	D766DB52A53ABBA4083FE9E4808926018A87E13291DE5A901C2686A6670134D1
Chrome Cache Entry: 71	SVG Scalable Vector Graphics image	225DEEC88DD9EE4CCD1BD878F159050F	F623190B386DEE074D4AD444F38AD46C1B9AE23C	EDF53B579279A1E8C6D76ED0720DD6F6397DE5551EB45D7CAA785D1086EDBF54
Chrome Cache Entry: 72	ASCII text	1A3A651FFED94057E873D07A03443381	47F0CB3DAE634E453224F90A449B11164322B488	82FC24301A47A186C834EB5768AD3677E9A8E554ED6A5BA1BD23948D42EEF33C
Chrome Cache Entry: 73	ASCII text	11869A7766C53E9BF26B1E5AFF87B642	43B06942524741D0EFEDFDD63D77B449ECB52274	93111A91E20370B69963D9DA39FA922A2F32CF2C192E469E82ED72459FAA640D
Chrome Cache Entry: 74	MS Windows icon resource - 4 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel	87A3E2C2EB0FC326219DB1D093CA895A	EB3D1E824F60D9BD67DD2FBCCA72AE4A744545DF	508681DA935F3835C0006E8BF21D360EBE8611300C2B8ECBC88BB3D9CD5918C0
Chrome Cache Entry: 75	ASCII text, with very long lines (706)	261BC00926ACBE4F634FA87B614E2A79	EA39A6435E1E9CB4FE32208B81B53C2C52921CA4	FEC59CEA24FBCE3079E4FE268B7E57CF4B31222E1F8372331247CAA8B6589FC7

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs