Windows Analysis Report
http://ramonagemauricie.com

Overview

General Information

Sample URL:	http://ramonagemauricie.com
Analysis ID:	1544214

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Stores files to the Windows start menu directory

Classification

Signatures

Source: https://ramonagemauricie.com/lander	HTTP Parser: No favicon
Source: https://ramonagemauricie.com/lander	HTTP Parser: No favicon
Source: https://ramonagemauricie.com/lander	HTTP Parser: No favicon
Source: https://ramonagemauricie.com/lander	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.16:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.16:49768 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: ramonagemauricie.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /lander HTTP/1.1Host: ramonagemauricie.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Referer: http://ramonagemauricie.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: ramonagemauricie.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: btloader.com
Source: global traffic	DNS traffic detected: DNS query: img1.wsimg.com
Source: global traffic	DNS traffic detected: DNS query: syndicatedsearch.goog
Source: global traffic	DNS traffic detected: DNS query: ad-delivery.net
Source: global traffic	DNS traffic detected: DNS query: ad.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: api.aws.parking.godaddy.com
Source: global traffic	DNS traffic detected: DNS query: widget.trustpilot.com
Source: global traffic	DNS traffic detected: DNS query: afs.googleusercontent.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.16:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.16:49768 version: TLS 1.2

Source: classification engine

Classification label: clean0.win@20/29@46/332

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1812,i,7366509178343545828,327122771764508283,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://ramonagemauricie.com"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1812,i,7366509178343545828,327122771764508283,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.26.3.70	ad-delivery.net	United States	13335	CLOUDFLARENETUS	false
142.250.185.206	unknown	United States	15169	GOOGLEUS	false
3.225.91.219	unknown	United States	14618	AMAZON-AESUS	false
54.204.129.214	gddomainparking.com	United States	14618	AMAZON-AESUS	false
216.58.206.78	unknown	United States	15169	GOOGLEUS	false
216.58.206.38	ad.doubleclick.net	United States	15169	GOOGLEUS	false
52.222.236.60	widget.trustpilot.com	United States	16509	AMAZON-02US	false
142.250.185.142	unknown	United States	15169	GOOGLEUS	false
142.250.185.162	unknown	United States	15169	GOOGLEUS	false
142.250.184.206	syndicatedsearch.goog	United States	15169	GOOGLEUS	false
142.250.186.33	unknown	United States	15169	GOOGLEUS	false
104.22.75.216	btloader.com	United States	13335	CLOUDFLARENETUS	false
142.250.186.35	unknown	United States	15169	GOOGLEUS	false
142.250.186.78	unknown	United States	15169	GOOGLEUS	false
142.250.185.67	unknown	United States	15169	GOOGLEUS	false
104.26.2.70	unknown	United States	13335	CLOUDFLARENETUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
23.38.98.114	unknown	United States	16625	AKAMAI-ASUS	false
216.58.212.132	unknown	United States	15169	GOOGLEUS	false
142.250.185.134	unknown	United States	15169	GOOGLEUS	false
74.125.71.84	unknown	United States	15169	GOOGLEUS	false
142.250.185.193	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.185.196	www.google.com	United States	15169	GOOGLEUS	false
142.250.185.130	unknown	United States	15169	GOOGLEUS	false
52.222.236.94	unknown	United States	16509	AMAZON-02US	false
104.22.74.216	unknown	United States	13335	CLOUDFLARENETUS	false
3.33.130.190	ramonagemauricie.com	United States	8987	AMAZONEXPANSIONGB	false

Private

IP
192.168.2.16

Contacted Domains

Name	IP	Active
gddomainparking.com	54.204.129.214	true
ramonagemauricie.com	3.33.130.190	true
syndicatedsearch.goog	142.250.184.206	true
ad.doubleclick.net	216.58.206.38	true
www.google.com	142.250.185.196	true
btloader.com	104.22.75.216	true
widget.trustpilot.com	52.222.236.60	true
googlehosted.l.googleusercontent.com	142.250.185.193	true
ad-delivery.net	104.26.3.70	true
img1.wsimg.com	unknown	unknown
afs.googleusercontent.com	unknown	unknown
api.aws.parking.godaddy.com	unknown	unknown

Contacted URLs

Name	Malicious	Reputation
http://ramonagemauricie.com/	false	unknown
http://ramonagemauricie.com/lander	false	unknown
https://ramonagemauricie.com/lander	false	unknown

ID:	1544214
Product:	CloudBasic
Start time:	03:34:14
Start date:	29.10.2024
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 29 01:34:47 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	83F97BDEAA0060E4D925C9F4B9C19138	4191100790D48C8059EC6C182A927C4EB7F70E09	621F68830E137656FB647387F1C6038600CF4749A3F3E5EDE900D9506E897E74
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 29 01:34:47 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	2712F7C86AB6C64F51F30BCBEED0F6E9	416093E9C1B02C6F690A687B76BE71F1BB90643C	8CDF4A7EF3AD1D6E61799AE1972B2D9F1542DF22C0121308516471B5852562CC
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	C9B150B4EEEF670ACC01BAF26909F93B	98C5CE3076C200624A415EB66DD6CA14FCEA01B7	5D01B30495C3805D1C27E9915A33E50E346550BC959AAA6E1DE7C43FFB9E077E
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 29 01:34:47 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	3051DFE7994AF94C41BB79E221BD5491	6D06C040F58E66B3B16F42FF65D3E77E5F5D677B	B35ADA6006B172F7CFD245AAF0A3E1902BA91A1942C401624650D3CC2E9C614E
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 29 01:34:47 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	A54DA0CF07D8B2EF4BEA1CD6F77DB0D7	A067C5ADD90872C4FD7F9D603F8DC6CC140B710A	07F52EEC32C5D49ED9F0B61D3DB3A40C3B840914FF1174007C015372A35A48D2
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 29 01:34:47 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	6B32BCD50620FEFA38F0874AE4171C22	10FBA6654786A5C2D57B48710D0FFFEF4304EED1	D4F6883A9F8C77E1B91EA72A15C554D6CF3FB556942CA7B948CBB80BA30E2880
Chrome Cache Entry: 101	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 7751	BBD26C541B063878DDDB6095C1F82221	AD7402097C8A410E880016BF77B037E2DEF9A09F	D7CC9429D7DDDE82E2F3D9390E483CA72489B153A4356A401456411D5B40FA9A
Chrome Cache Entry: 102	ASCII text, with very long lines (60343)	78CB756AA06B07C207880F7B4FBB721A	6F96C8D80D2281AFE016F345BDC448255740622E	CB666C470A82988DA4F29BEF5B1F8F3E1D4119FAFC9E78538CC0E74F17C8C338
Chrome Cache Entry: 104	ASCII text, with very long lines (394), with no line terminators	52C00D44E90BC388B396EDBD90D1F0C4	03EB1801E039BB94F5B51E89762B021400242912	EB17A59BD90553EB4570C3A088EB5A89B1EEEB3B0B8852F192764040F29CDCCC
Chrome Cache Entry: 106	Web Open Font Format (Version 2), TrueType, length 34852, version 1.0	0E8EEFB4549A2EDF26C560CB9845952E	8D0B1718AACAD934FD0043C87CBC54AA091396BF	7F653B3CE9D3277457FC6DA4EDB246AE2F6C913F088C42DCB8CD2E96267AA21A
Chrome Cache Entry: 107	GIF image data, version 89a, 1 x 1	AD4B0F606E0F8465BC4C4C170B37E1A3	50B30FD5F87C85FE5CBA2635CB83316CA71250D7	CF4724B2F736ED1A0AE6BC28F1EAD963D9CD2C1FD87B6EF32E7799FC1C5C8BDA
Chrome Cache Entry: 108	HTML document, ASCII text, with very long lines (12926)	303AE67635D08797D7780050EB3A1CC6	B21E1B2779D4D6EC2E1EAAF90C3128BA41AE835C	565DB2A7B52A1E3AC98358F23A227C4574A2EECD617C8919E9B7C0CA6B68C40C
Chrome Cache Entry: 109	MS Windows icon resource - 2 icons, 16x16, 16 colors, 32x32, 16 colors	4123CE1E1732F202F60292941FF1487D	9F12B11BDE582DAE37CE8C160537D919C561C464	D961B08E4321250926DE6F79087594975FE20AD1518DE8F91EB711AF5D1A6EF8
Chrome Cache Entry: 74	HTML document, ASCII text, with very long lines (619)	D86444D1B873D4C7F7D87BD5970B850D	B69244BFA768CEAD2C78FF4D51F26C5D70B0BD92	341EC4459D1BC099FA6CAD73C1AAA22D800A36F9E0496BDC932983941460E13E
Chrome Cache Entry: 75	ASCII text	6AA91841B259A6C32E2F779E08C588C4	BB09ACE026B11CDEE001BDA5E630F74FE39D49AE	A216AE8B4E5F92C6D428BEE4E515F445FB1633B620290DDFD1C1C73B0E3A6B4A
Chrome Cache Entry: 77	SVG Scalable Vector Graphics image	11B3089D616633CA6B73B57AA877EEB4	07632F63E06B30D9B63C97177D3A8122629BDA9B	809FB4619D2A2F1A85DBDA8CC69A7F1659215212D708A098D62150EEE57070C1
Chrome Cache Entry: 78	ASCII text, with very long lines (1932)	8A0129D000CA584D54C1C80AA013947A	A67A4066A73C5881CD3EEA6E55A220D4E8077EA4	0EA9EA9FC59F245C2C361B322E0B70CFBC3CFA4DD243DC0E28F7FF7C558EB2B3
Chrome Cache Entry: 79	HTML document, ASCII text, with no line terminators	E89F75F918DBDCEE28604D4E09DD71D7	F9D9055E9878723A12063B47D4A1A5F58C3EB1E9	6DC9C7FC93BB488BB0520A6C780A8D3C0FB5486A4711ACA49B4C53FAC7393023
Chrome Cache Entry: 80	ASCII text, with very long lines (1932)	4B045B3610C67169D7D9EB018DEA8176	191B80D8BE0E23EAE36ADAC73EB50D4BE551DEBC	082F615C9824B5870F58E277F609A662086DD5CE7CB15020F494B2846EA902CD
Chrome Cache Entry: 82	ASCII text, with very long lines (65465)	888C1E954D8F5C1BA90402C3FDF39209	6328F5FEAB3EB9B3F988A139341A19DEEF2B208A	E513D7EA8BF12E7872AFFFD0793BBE9D2DB074F6FB013A10A6DE9BCCB4789A7D
Chrome Cache Entry: 84	SVG Scalable Vector Graphics image	6751E07E0F93BD43AB90822F4B2EB62A	D1D0C6F0B4697B0A4E61FFBF171E8C60EAC7C832	FF563F41765DA081FE9FD40E8BB33A623DF033B10050A8AE8C1B46E15107D8F1
Chrome Cache Entry: 85	JSON data	078B7D97B586C270B3AA48B266B88953	F66069DAB18563E70EA5DD8D71B281F6286CD5F8	98E77A6B20AE229F59519A003DB10D29E2B8455F9F825DD52AAABC5315A371F4
Chrome Cache Entry: 86	Web Open Font Format (Version 2), TrueType, length 30480, version 1.0	0E7E5F9D3A8EF121149827180B790B5C	0E9F9333078E5DF9245630FF6F68BA1D9DA3C403	E8E147E15907F25CAD69B2BCF060213EFAD4ED04E0D36374715CBCA17B2AFC1C
Chrome Cache Entry: 88	ASCII text, with very long lines (3809)	3F821ADA778691E677AEF2CEA8C4B4F6	643E7B729B25C2F800469623191DC837798E9D50	7510035D553A99FBF93EB67737B2DF057CE096FA1ED7AAD83CFD559E11F2320D
Chrome Cache Entry: 91	JSON data	3F25917CA1D5E8AFAE8C1ED7CE165BF6	2FF7D3FF345B01D95E43D199C0E1EB131B2001B8	DE69AC3FC779BEE7CC21240107461533A4A85CF58F5CB8B53FF85BB4583CA3A3
Chrome Cache Entry: 92	ASCII text, with very long lines (394), with no line terminators	237AEF0EEA68EDCC16AC69DEE122489B	F0591956DE48D9B7FB3AEA0B35A0FB9ABB5B574E	811B08CE5F636C67C72223C6E9F5F3E1B9AEB50B68F42FC9590A5394D0D39158
Chrome Cache Entry: 93	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 55734	732769F238A36CB44705F2D6A18312EE	4145A129B7285EF794924619940D72DB4C03F1A0	AC450BC0F8F949594349262A4F1AFCCD1B1B2DB4B8AE231BEB3D23F673120035
Chrome Cache Entry: 96	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 23675	7D4644D89E45FE92623BDD628E60E8DD	D6A382A2C9E8A122C5153E7387B303D23933C331	5BF58CB55CE5F279F07D496F813404160FC8161C6924D4B51FE35ECE51AC9A8B
Chrome Cache Entry: 97	ASCII text, with very long lines (1932)	7F9EE154C62ADB807783527673E92C8F	98225F162092186A3B445AB1C9B01E9FAC0D9728	5ACC6923E160653583F53C5863D79F02E955052CA9F8FB84E3B53F095294A475

Windows Analysis Report
http://ramonagemauricie.com

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report http://ramonagemauricie.com

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
http://ramonagemauricie.com