Windows Analysis Report
https://turbocards.com//wp-content/ledt/

Overview

General Information

Sample URL:	https://turbocards.com//wp-content/ledt/
Analysis ID:	1532350

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Stores files to the Windows start menu directory

Classification

Signatures

Source: https://wordpress-44086035828.devrimsdemo.com/contact/?redirection=details	HTTP Parser: No favicon
Source: https://wordpress-44086035828.devrimsdemo.com/contact/?redirection=details	HTTP Parser: No favicon
Source: https://wordpress-44086035828.devrimsdemo.com/contact/?redirection=details	HTTP Parser: No favicon
Source: https://wordpress-44086035828.devrimsdemo.com/contact/?redirection=details	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49736 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212

Source: global traffic	DNS traffic detected: DNS query: turbocards.com
Source: global traffic	DNS traffic detected: DNS query: wordpress-44086035828.devrimsdemo.com
Source: global traffic	DNS traffic detected: DNS query: www.smartsuppchat.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: bootstrap.smartsuppchat.com
Source: global traffic	DNS traffic detected: DNS query: widget-v3.smartsuppcdn.com
Source: global traffic	DNS traffic detected: DNS query: translations.smartsuppcdn.com
Source: global traffic	DNS traffic detected: DNS query: websocket-visitors.smartsupp.com

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49736 version: TLS 1.2

Source: classification engine

Classification label: clean0.win@18/21@30/185

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1988,i,279075549384836302,15906471619428326256,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://turbocards.com//wp-content/ledt/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1988,i,279075549384836302,15906471619428326256,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.185.78	unknown	United States	15169	GOOGLEUS	false
199.16.173.48	turbocards.com	United States	2635	AUTOMATTICUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
142.250.186.163	unknown	United States	15169	GOOGLEUS	false
195.181.170.19	1857279285.rsc.cdn77.org	United Kingdom	60068	CDN77GB	false
195.181.170.18	1087630013.rsc.cdn77.org	United Kingdom	60068	CDN77GB	false
128.199.2.230	wordpress-44086035828.devrimsdemo.com	United Kingdom	396425	UCCS-UNIVERSITY-OF-COLORADO-COLORADO-SPRINGSUS	false
142.250.185.227	unknown	United States	15169	GOOGLEUS	false
18.194.185.123	websocket-visitors.smartsupp.com	United States	16509	AMAZON-02US	false
212.102.56.179	1161431244.rsc.cdn77.org	Italy	60068	CDN77GB	false
142.250.186.106	unknown	United States	15169	GOOGLEUS	false
52.29.129.13	bootstrap.smartsuppchat.com	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.185.131	unknown	United States	15169	GOOGLEUS	false
64.233.184.84	unknown	United States	15169	GOOGLEUS	false
142.250.184.238	unknown	United States	15169	GOOGLEUS	false
142.250.184.228	www.google.com	United States	15169	GOOGLEUS	false
195.181.175.40	unknown	United Kingdom	60068	CDN77GB	false
169.150.255.184	unknown	United States	2711	SPIRITTEL-ASUS	false

Private

IP
192.168.2.16

Contacted Domains

Name	IP	Active
1857279285.rsc.cdn77.org	195.181.170.19	true
1087630013.rsc.cdn77.org	195.181.170.18	true
turbocards.com	199.16.173.48	true
websocket-visitors.smartsupp.com	18.194.185.123	true
www.google.com	142.250.184.228	true
bootstrap.smartsuppchat.com	52.29.129.13	true
1161431244.rsc.cdn77.org	212.102.56.179	true
wordpress-44086035828.devrimsdemo.com	128.199.2.230	true
www.smartsuppchat.com	unknown	unknown
translations.smartsuppcdn.com	unknown	unknown
widget-v3.smartsuppcdn.com	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://wordpress-44086035828.devrimsdemo.com/contact/?redirection=details	false		unknown

ID:	1532350
Product:	CloudBasic
Start time:	01:17:58
Start date:	13.10.2024
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Oct 12 22:18:29 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	EC1C2C586CBDF914BE2446E25858D230	8BA4AA100D40E751A12F700F7833B8A2D5E92554	49E3E5D4FEEBFC1EF98FB13FC9BFC787513EEA2E38477CED31F36C2E4DDF5A71
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Oct 12 22:18:29 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	99F97A762B65AB5FEB0B2BF4F05AE91A	A81BED52ADF3B48AA27E7812CE25A08042ADEA94	2B999815D0EFCFA5790210210D04F0AABFC50B7A415142807890E221B8AE2001
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	A4461E0DB500C40BAF4ADDD73FA4DA9B	1DB147E94369EAE74F7C27699E84E51CF5419163	E111054B2E49176943EE430A8F987D0946A7509F27ABF86DB0875D40169F51EB
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Oct 12 22:18:29 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	BB196C65498DDE6FF136202CA1169D6D	D7315357D0FF791C321EAA2F5B63E14C952645A1	78C39DE7BCC51AC916E30C9A5A5F64D28C9F3DE1E235AD2F93C2143471077E9B
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Oct 12 22:18:29 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	30F3CB565064E7CCAEEE3E5EFD98B521	EC159A8CACA8C987B12F36EE987F6F15B0D6AEC9	A4A58498336D6694B61783855DC7F394A87021D2C74E90098BD492E3C377FF77
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Oct 12 22:18:29 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	59D57A89758521CCC733AC4BEB8E0520	EAF951FBF9908771F972F781DA16D3B98A588F75	52142B029DF32A3E79CE18F3F77C786646F79B56C6FEFA3F6E1B5F26C4BCDBE8
Chrome Cache Entry: 74	JSON data	B6B20ECA05E09FDE02DD863F13E28224	E792A54BC62AF7353DDF84919E00FB19D0E8F952	0EF42F8DEF3CC8772D41B435E8C71C90A717D2B72766C0AAABFD8E30F1333EC1
Chrome Cache Entry: 79	JSON data	61C26B1DEB17ECEC2491046BE587BC58	9E7DF505BF21CD1A9462395EF3F930CBB985B5DE	B2613395561B3B74F58EA58345C7F298F8FDAB3C2BFF2C640D680106EE52C42C
Chrome Cache Entry: 80	ASCII text, with very long lines (32239)	74933ECF026F6C2353521D0F8253805D	50C738BFCE09380A65553EB246A39B651FA0A35E	C013669D16F3438247C82591C3A7E6189B5DF4FBC1330EBFD1A602D43FCD1351
Chrome Cache Entry: 82	ASCII text, with very long lines (33104)	E8D13DE7AD743E4DF59CA29D8ADB58B2	E20C628496872638870761D977EC5C0A0CF586F6	B8BA9D2EE885BC6CCC44CBD30E36D8B087494A9FFCE3CB16F2B82D5C2D8C1E00
Chrome Cache Entry: 83	ASCII text, with very long lines (17340)	20BD039804DCEB618B76EA9C7FF988FA	8EF7D38B2B1B537DEBC18AE6C3ADAF7D63C9D2E0	94C24B0DF45989AD3E0726DC61EFC2671235A109B00DF4F282372C7F1A39D099
Chrome Cache Entry: 84	ASCII text	BEFD8A398792E305B7FFD4A176B5B585	9E667BF3CA36885674A0410D0A4C5EB9CFE513C4	E70B03EEC37D9C4BA1BCDAC4AF99A47E0281860C88F015C2902E0B0949445B27
Chrome Cache Entry: 87	RIFF (little-endian) data, Web/P image	2EC2C757C514EAC6CEF786AA7377AE3A	72D65EFF7FAE41AD9FAF55D257F363A7C4247B58	C00EF5DCE3988872B0476D75B77E7E54CD965D4E5A5025A3609E4F37068E03F7
Chrome Cache Entry: 88	ASCII text, with very long lines (65299)	90C4B26D3DF2873954E05029AFCA8793	1369E33B050A4D7D37B00FCAB8168CCD26485656	073254AFBFC06331B8B548B7FC0532B4FFE2CFDD588368DCC338E7ABD50810E1
Chrome Cache Entry: 89	Unicode text, UTF-8 text, with very long lines (65342)	22FD4EEF025C7994ECC38A46F2D3D6A4	D60A3A89156225D8F1B27CCEC6460D97839A3CD2	26DB49828D6701FCFCE37A96DA6EC3F0ED481ABAE49C8C9969A575B064413CAD
Chrome Cache Entry: 91	JSON data	88FF695C2BE07E759D464ECCEBB7FA15	DB4EE7389DFFBF5340FFF892446455E4D7C5571C	891A5F2142DF39FADE48DAB51204B5CC5BB5DE382FC2E578D809D368E547669D
Chrome Cache Entry: 92	HTML document, Unicode text, UTF-8 text, with very long lines (16428)	67BC6C7E48A1CF6CBAB6BF2FE7376D96	84A7A0ED6AEA50279AC0E431D38A3C6182AA8D9E	13D95A76706655DCA5B1C65C13C58ED804702D24D2030255AC66CC69F8779A93
Chrome Cache Entry: 93	RIFF (little-endian) data, Web/P image	2A8F10FB5AA211785C5C9FF20BAAC551	3E56C05003BAA332F5FF80C865BF2ACAD40A4A62	4625804D779791ACE6DA8A0E4766E337E095A11DD2687781BA0729A226FC5505
Chrome Cache Entry: 94	HTML document, Unicode text, UTF-8 text, with very long lines (312)	8BE2EE8694BFDA2BAEAAA868C2698A46	9D2B0ECF55D24BEB74F1751484D29D98896529ED	85EB2B27686AD51EBECC69543ABEEEFBCEDAB9674CAD1DCC2CBE6E8F0BB247F9
Chrome Cache Entry: 95	ASCII text	545813869D7D7C5DA8886100CD024182	69B11FCBC3316FBA7B04A7DA7958C7046B241371	EC34B6213AC38D00A879E30FE141B37C9BA2EA49C7C9EFBD7A35E8FDDFCEE2EE
Chrome Cache Entry: 97	Web Open Font Format (Version 2), TrueType, length 18536, version 1.0	8EFF0B8045FD1959E117F85654AE7770	227FEE13CEB7C410B5C0BB8000258B6643CB6255	89978E658E840B927DDDB5CB3A835C7D8526ECE79933BD9F3096B301FE1A8571

Windows Analysis Report
https://turbocards.com//wp-content/ledt/

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report https://turbocards.com//wp-content/ledt/

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
https://turbocards.com//wp-content/ledt/