Windows Analysis Report
https://zohoinvoicepay.com/invoice/fabiomadeira/secure?CInvoiceID=2-10fe63d8f4ea881832bdb201bcbb401b09368b448d5ffe83bcea3bf8639fc3eb3c56d4f653ed8669f4551644d82911b13dd52dce89617e5718eb62800c59473c98e1fb71080bbb7a

Overview

General Information

Sample URL:	https://zohoinvoicepay.com/invoice/fabiomadeira/secure?CInvoiceID=2-10fe63d8f4ea881832bdb201bcbb401b09368b448d5ffe83bcea3bf8639fc3eb3c56d4f653ed8669f4551644d82911b13dd52dce89617e5718eb62800c59473c98e1
Analysis ID:	1559002

Detection

Score:	21
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

AI detected suspicious URL

Detected non-DNS traffic on DNS port

Stores files to the Windows start menu directory

Classification

Signatures

Phishing

AI detected suspicious URL

Source: Email	Joe Sandbox AI: AI detected Brand spoofing attempt in URL: https://zohoinvoicepay.com
Source: Email	Joe Sandbox AI: AI detected Typosquatting in URL: https://zohoinvoicepay.com

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.206:443 -> 192.168.2.16:52743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:52744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:52745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:52746 version: TLS 1.2

Source: chrome.exe

Memory has grown: Private usage: 18MB later: 40MB

Detected non-DNS traffic on DNS port

Source: global traffic	TCP traffic: 192.168.2.16:52742 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:52742 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:52742 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:52742 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:52742 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:52742 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:52742 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:52742 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:52742 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:52742 -> 162.159.36.2:53

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50

Source: global traffic	DNS traffic detected: DNS query: zohoinvoicepay.com
Source: global traffic	DNS traffic detected: DNS query: webfonts.zoho.com
Source: global traffic	DNS traffic detected: DNS query: static.zohocdn.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: invoice.zoho.com
Source: global traffic	DNS traffic detected: DNS query: 206.23.85.13.in-addr.arpa

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52750
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 52744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52745
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52746
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 52745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.206:443 -> 192.168.2.16:52743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:52744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:52745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:52746 version: TLS 1.2

Source: classification engine

Classification label: sus21.win@17/19@18/158

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1992,i,2299189150562884862,9207125014017148512,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://zohoinvoicepay.com/invoice/fabiomadeira/secure?CInvoiceID=2-10fe63d8f4ea881832bdb201bcbb401b09368b448d5ffe83bcea3bf8639fc3eb3c56d4f653ed8669f4551644d82911b13dd52dce89617e5718eb62800c59473c98e1fb71080bbb7a"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1992,i,2299189150562884862,9207125014017148512,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
136.143.190.145	invoice.zoho.com	United States	2639	ZOHO-ASUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
108.177.15.84	unknown	United States	15169	GOOGLEUS	false
142.250.74.206	unknown	United States	15169	GOOGLEUS	false
216.58.206.78	unknown	United States	15169	GOOGLEUS	false
216.58.206.67	unknown	United States	15169	GOOGLEUS	false
172.217.18.3	unknown	United States	15169	GOOGLEUS	false
142.250.185.138	unknown	United States	15169	GOOGLEUS	false
142.250.185.227	unknown	United States	15169	GOOGLEUS	false
89.36.170.147	h2-stratus.zohocdn.com	Switzerland	41913	COMPUTERLINEComputerlineSchlierbachSwitzerlandCH	false
136.143.191.224	zohoinvoicepay.com	United States	2639	ZOHO-ASUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.186.164	unknown	United States	15169	GOOGLEUS	false
136.143.191.104	zs-lc1-25-h2.zoho.com	United States	2639	ZOHO-ASUS	false
172.217.16.132	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16

Contacted Domains

Name	IP	Active
zohoinvoicepay.com	136.143.191.224	true
invoice.zoho.com	136.143.190.145	true
h2-stratus.zohocdn.com	89.36.170.147	true
www.google.com	172.217.16.132	true
zs-lc1-25-h2.zoho.com	136.143.191.104	true
webfonts.zoho.com	unknown	unknown
206.23.85.13.in-addr.arpa	unknown	unknown
static.zohocdn.com	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://zohoinvoicepay.com/invoice/fabiomadeira/secure?CInvoiceID=2-10fe63d8f4ea881832bdb201bcbb401b09368b448d5ffe83bcea3bf8639fc3eb3c56d4f653ed8669f4551644d82911b13dd52dce89617e5718eb62800c59473c98e1fb71080bbb7a#/securepayment	false		unknown

ID:	1559002
Product:	CloudBasic
Start time:	02:57:29
Start date:	20.11.2024
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 20 00:57:59 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	E66EF6A58458C2DC8C602405E45D5B94	872A0EDCB9BC3F38246BA59C6115B157A256A58E	49EDADE76A1C0F024FD975BD5EDD208B6E05176054D9425D1DC23E75430700E7
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 20 00:57:59 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	9428D25B86169C87AB11679C10C9D1A4	B920BAF147FB23EC3CFAAAB54B0B69E7596F3321	4D37572751522F69D214563ED3B2CC7BCA57B926106DD002C457E6395D069F55
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	A89882CA7B4D6098068E6511E7C7DAD6	01A6661C5B64A387A9C4B01EA9CAC23B06078AF7	5C9CE11A3F582D2B0DCDA0A707170030EE3E3AFE89BCCB9879722ED92EB95C21
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 20 00:57:59 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	E3F8274D8A6CDBDB7D43E643C675460D	6BA1D2E0E622F991FD17A84041106329D51AD908	32CA96F28252F5830125415C7033245B454294155EC113FF44D9043B3CC4509A
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 20 00:57:59 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	87DCB06C207CEA5DF9A93DC404EF2507	A26ABF075065DDF43FB757C11B98C846F8B6A850	EBD50136FB504E64533F8A20F72EC699BB61FB205D1E3600409015EC1D502A5D
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 20 00:57:59 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	0289852890714A23676F09DD1D478A81	B9861107F86B9851479A0DCF53FCC259ED53F79D	DECB6383BC7BE5902B3E1D7276609B50132ED3454488D15265F075E93B8B10C7
Chrome Cache Entry: 74	Web Open Font Format (Version 2), TrueType, length 20692, version 3.1245	9F5621C6D1F0EA9F75D764BC1A1F5AE2	0FC9B81097BED708090BA96878629C64D283D3B2	44B0C043656308DCA9B5645163EC4637D8B6C966D93B485DD3525420B6129E7D
Chrome Cache Entry: 75	Unicode text, UTF-8 text, with very long lines (39202), with NEL line terminators	77F511A31E7523EEFA5A6E408ADEC355	F034139E258CA871707132FDAF20A4E4D4A5EED2	F9FA75137CCC162D3AB8312B634CB01E5638132AB608A6A68C3B48AB7D2F8698
Chrome Cache Entry: 77	ASCII text, with very long lines (1219)	C3CB5066947AC58DDAC7046BFAC6EB21	1E1DDC69E0A23494E864D41EA17DBF2A3BE41132	26B80BE2BCC2F17C9BB6F3646AE9EFE3DB7426A53007D65F1DE00D500A62D4CF
Chrome Cache Entry: 79	ASCII text	3E0403187D2B6477C484D5B403858737	70B4DBEC38D378DD9F04A0CEB09C38D1B132D651	1F9A68DC3941B4C0783AA489329CE41201CD84A0B95C59B874D9104A35DBC8D7
Chrome Cache Entry: 80	Unicode text, UTF-8 text, with very long lines (65521), with no line terminators	021571E3BF6BF2B63F3B04E2E6606A71	E01272362A50B4F5894852857455F8C0FC92ABE9	231D47EF36A8375B2CD17D91FE24D271A9CB12A6D01EAFBA7E8BA8C87040EDA0
Chrome Cache Entry: 82	Unicode text, UTF-8 text, with very long lines (65533), with no line terminators	81BB36F572E0D5AAA3AD5524966E1546	627F571F107868BB8EF5CCBED98DC540D064812D	709611ECB6B2F61E33E246B1F421DD25C75AE1F3FEDE5E5EAA8B50C211E2D58A
Chrome Cache Entry: 83	ASCII text, with very long lines (65536), with no line terminators	336403A2C5BC11F2BA374B4E719FB2CD	E092BB601E70FB0C8092CF25B90A9FE48BAD5E47	740D1AC5D1B2E17A7BEC025CB305CCC4B5FCFB0ECFBCD32185203F2E0CA367EF
Chrome Cache Entry: 84	MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel	A14127B9F9EFD6E514747A5D71D45CCE	5FC6829133736C56C6356FC88119E89B399FBAE2	05B7469CF3B84581156C6FFD1AB613454026305097EB4D3DAC6DAB4531ECEAC6
Chrome Cache Entry: 85	Web Open Font Format (Version 2), TrueType, length 21320, version 3.1245	56010365F3ED3D7D743796877F3C47C1	2F899431ABC687B3D16FE01CA4C38BCF60B2A9A2	69EB0494D55402351D6C0BC16F8A6890C05BD65B9F908B51C90FEF3E17CC3ADD
Chrome Cache Entry: 87	Web Open Font Format (Version 2), TrueType, length 16832, version 1.6554	472CFE0F002A296A76A18B4FEB1FEEAB	D0DE4C75E4CFA7C355BA391FFA9F8D5A09AFE870	3A187761967861DAE1C14CA8D1C57D967DB1567AED9FCB6ECDBC4B0E645D01BC
Chrome Cache Entry: 88	PNG image data, 593 x 585, 8-bit/color RGBA, non-interlaced	670B15E6A4AA68089C2D2339CA07F560	F0D1F49C975175D1919327378D3BD64AA63D6188	256D711A0B61630407BF76787BCD209E5F0B18D0C1EB3515EB4474FD7D68EAC7
Chrome Cache Entry: 89	ASCII text, with very long lines (65536), with no line terminators	7545DFF833E14FEAC2DEDA030FFC19AD	E341711253CDAA36EF75B83B1C6357466946D093	346E0743DFB14EF00EE3027D0E8315E8594B6AB424887ED771AE4A041D31CE9B
Chrome Cache Entry: 90	Web Open Font Format (Version 2), TrueType, length 16292, version 1.6554	B1ADC32F8FF56E59C7C7B8F2D90AC332	D110058D172BD3DC5FB622B1225B13AAE6A4FD77	F4271FB7CE599A61119B6D6BD5082D52728D4E65EDD4DE6B8B2814F7D93503F4

Windows Analysis Report
https://zohoinvoicepay.com/invoice/fabiomadeira/secure?CInvoiceID=2-10fe63d8f4ea881832bdb201bcbb401b09368b448d5ffe83bcea3bf8639fc3eb3c56d4f653ed8669f4551644d82911b13dd52dce89617e5718eb62800c59473c98e1fb71080bbb7a

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report https://zohoinvoicepay.com/invoice/fabiomadeira/secure?CInvoiceID=2-10fe63d8f4ea881832bdb201bcbb401b09368b448d5ffe83bcea3bf8639fc3eb3c56d4f653ed8669f4551644d82911b13dd52dce89617e5718eb62800c59473c98e1fb71080bbb7a

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
https://zohoinvoicepay.com/invoice/fabiomadeira/secure?CInvoiceID=2-10fe63d8f4ea881832bdb201bcbb401b09368b448d5ffe83bcea3bf8639fc3eb3c56d4f653ed8669f4551644d82911b13dd52dce89617e5718eb62800c59473c98e1fb71080bbb7a