Windows Analysis Report
https://www.research.net/tr/v1/te/akU_2BQc2vAhAsa_2B264x1g6_2FSdSvKedPmeZkblcZEtqvWWcHQCCZfFPeYTO7s7GTl_2BHoTT1ElLj3bLqta9CqvgtfIfU5JwCeniRwF_2Bvxrbs83YCeD25PdeafcZkN9JO2JJ4iG5TDlyG9wrw5tiL2LoOuYFRLEkjxufslh6kYG9PEUv62pSoByi7ocLvbdThPWjpQjrzFXcqIE3U_2FNsGtwSL97WwZQGDjiaC8wYdDRWitDMHJGTuAVdpQCxhZ_2B8

Overview

General Information

Sample URL:	https://www.research.net/tr/v1/te/akU_2BQc2vAhAsa_2B264x1g6_2FSdSvKedPmeZkblcZEtqvWWcHQCCZfFPeYTO7s7GTl_2BHoTT1ElLj3bLqta9CqvgtfIfU5JwCeniRwF_2Bvxrbs83YCeD25PdeafcZkN9JO2JJ4iG5TDlyG9wrw5tiL2LoOuYFRLEk
Analysis ID:	1544651

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Detected non-DNS traffic on DNS port

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Classification

Signatures

Source: https://www.research.net/r/?sm=MeeKO1NBiu_2FVNCxLo1_2BcIKxGw5enwPdP_2FhO_2FhM0N7ujsHCvZRnEXEpxEJRPB0mHI

HTTP Parser: No favicon

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 40.126.31.73:443 -> 192.168.2.18:51287 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.18:49691 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.18:49695 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.18:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.18:51281 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.73:443 -> 192.168.2.18:51282 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.73:443 -> 192.168.2.18:51283 version: TLS 1.2

Detected non-DNS traffic on DNS port

Source: global traffic	TCP traffic: 192.168.2.18:51278 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.18:51278 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.18:51278 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.18:51278 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.18:51278 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.18:51278 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.18:51278 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.18:51278 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.18:51278 -> 1.1.1.1:53

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 40.126.31.73:443 -> 192.168.2.18:51287 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: www.research.net
Source: global traffic	DNS traffic detected: DNS query: prod.smassets.net
Source: global traffic	DNS traffic detected: DNS query: secure.surveymonkey.com
Source: global traffic	DNS traffic detected: DNS query: cdn.smassets.net
Source: global traffic	DNS traffic detected: DNS query: cdn.signalfx.com
Source: global traffic	DNS traffic detected: DNS query: surveymonkey-assets.s3.amazonaws.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: bam-cell.nr-data.net

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51282 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49696
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49695
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51280
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51283
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51284
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51281
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51282
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51280 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51287
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51285
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51286
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51289
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51285 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51289 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49679 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51283 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51286 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51284 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51287 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 51281 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.18:49691 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.18:49695 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.18:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.18:51281 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.73:443 -> 192.168.2.18:51282 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.73:443 -> 192.168.2.18:51283 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@22/29@20/227

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=2040,i,8068645123174380243,11792144260210494075,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.research.net/tr/v1/te/akU_2BQc2vAhAsa_2B264x1g6_2FSdSvKedPmeZkblcZEtqvWWcHQCCZfFPeYTO7s7GTl_2BHoTT1ElLj3bLqta9CqvgtfIfU5JwCeniRwF_2Bvxrbs83YCeD25PdeafcZkN9JO2JJ4iG5TDlyG9wrw5tiL2LoOuYFRLEkjxufslh6kYG9PEUv62pSoByi7ocLvbdThPWjpQjrzFXcqIE3U_2FNsGtwSL97WwZQGDjiaC8wYdDRWitDMHJGTuAVdpQCxhZ_2B8eaa6"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=2040,i,8068645123174380243,11792144260210494075,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.184.195	unknown	United States	15169	GOOGLEUS	false
34.104.35.123	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
18.239.18.30	cdn.signalfx.com	United States	16509	AMAZON-02US	false
142.250.185.132	www.google.com	United States	15169	GOOGLEUS	false
142.250.185.238	unknown	United States	15169	GOOGLEUS	false
18.238.243.55	d15akbylw3vqc5.cloudfront.net	United States	16509	AMAZON-02US	false
162.247.243.30	fastly-tls12-bam-cell.nr-data.net	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
18.173.205.24	unknown	United States	3	MIT-GATEWAYSUS	false
142.250.185.174	unknown	United States	15169	GOOGLEUS	false
18.173.205.119	unknown	United States	3	MIT-GATEWAYSUS	false
52.217.123.1	s3-w.us-east-1.amazonaws.com	United States	16509	AMAZON-02US	false
142.250.185.142	unknown	United States	15169	GOOGLEUS	false
18.173.205.26	unknown	United States	3	MIT-GATEWAYSUS	false
142.250.186.131	unknown	United States	15169	GOOGLEUS	false
64.233.184.84	unknown	United States	15169	GOOGLEUS	false
216.58.212.163	unknown	United States	15169	GOOGLEUS	false
142.250.185.74	unknown	United States	15169	GOOGLEUS	false
18.244.18.107	d2yx97y2ukjhui.cloudfront.net	United States	16509	AMAZON-02US	false

Private

IP
192.168.2.18

Contacted Domains

Name	IP	Active
s3-w.us-east-1.amazonaws.com	52.217.123.1	true
d2yx97y2ukjhui.cloudfront.net	18.244.18.107	true
cdn.signalfx.com	18.239.18.30	true
www.google.com	142.250.185.132	true
fastly-tls12-bam-cell.nr-data.net	162.247.243.30	true
d15akbylw3vqc5.cloudfront.net	18.238.243.55	true
cdn.smassets.net	unknown	unknown
surveymonkey-assets.s3.amazonaws.com	unknown	unknown
prod.smassets.net	unknown	unknown
www.research.net	unknown	unknown
bam-cell.nr-data.net	unknown	unknown
secure.surveymonkey.com	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.research.net/r/?sm=MeeKO1NBiu_2FVNCxLo1_2BcIKxGw5enwPdP_2FhO_2FhM0N7ujsHCvZRnEXEpxEJRPB0mHI	false		unknown

ID:	1544651
Product:	CloudBasic
Start time:	16:03:12
Start date:	29.10.2024
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 29 14:03:49 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	85B8C86046410360EBBEF948CCD08A37	E6CB3CC00C85DE1DB5C22E1A4112C62926901FA3	2C5D7BF7CEB9D6755C1A83FB95E611697594B67A3408A917249B71EC1C755384
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 29 14:03:49 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	CADF9B27E54BAF9E8436BCA372E4DEC0	4BFD69BD16FD54BAC7DA96ADB7E6C11EB5B26BCE	675D4C509E965A3431B3ECF21AAB9418DD8CE304CFE6D28DF5F275434AEDA20A
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 09:23:19 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	E2BCE15A52AEF7CE909BBA2A776DE49B	1A2BBC4A3EEE22F25AB1710928F5D8E920D4A860	24B6E6357AF144B6447F22FBC305CCD5DF5648A146EF4A63D425E6FB985DDE71
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 29 14:03:49 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	AF1C92DDF9521383D6B4C2EF324B4200	B6F3D56ABF37EC0817AAF8F96D2E5FA0BBCE06F8	B4A4C7B95B94B8AE339E3DD39B759E92CCA3161DE09BF40770514B6399295B15
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 29 14:03:49 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	8EF1C2D2BCF9ED218037FAF8913411BB	896BE64E0E53B4E46CDC543F18AAA3B43ECA8641	64EAC5DA90F8DDB518533BE772B4B0271622D13FF0724A39637F322C604CF143
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 29 14:03:49 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	4F9551E708CD8DB76315BE7C04164DE7	EB88DC57A3EF47336AC396DF0944F4B4FE953B8B	EC2950D2A5BBEE1396904E743FC57C13943B57C1D407658C1CED0102F5AD2269
Chrome Cache Entry: 173	HTML document, Unicode text, UTF-8 text, with very long lines (737)	86AD4482847E7938449CED5B0EDD8C0E	64F2564F175E5351D9D6201A8B6DB74491DBE9F9	5F1DC887F8FA3248914156F87010FA7B70875C40F5C77DE95956BB83ADA63C3E
Chrome Cache Entry: 174	ASCII text, with very long lines (1981)	8A01E80A9745FCAB040B8D3E21AE309B	E9F5F2F70BD100740172786504CFD8030181681E	1CD7E62FF882C836349AF2D26CCB1FEA31B0B8E3F9F2A66FFB21B32685D00B7A
Chrome Cache Entry: 175	ASCII text, with very long lines (65536), with no line terminators	EF0F0B28D8E5BAD7258B80DFB3CC6019	44C89F32B4C8B4C87446013D3EB34DEC3FE54C6F	5AEFCC68FF56D078478FC4E14F24140C2EBA2BFA03F79AC7C8897A1A4B67E1C4
Chrome Cache Entry: 176	ASCII text, with very long lines (888)	88A0E6FA32F05EA1239A2A316DA7B4FE	EBA2DCB801634B5500D3FBA839E5F0723F7B7AE1	DB6E9BACE9F2B705A8BE600F376A20BBFEC7B3B1E7570EAA93860BE3D4234748
Chrome Cache Entry: 177	ASCII text, with very long lines (65536), with no line terminators	5633758FBA045DBF21531BB15A71758C	9DE1EE01ADAF459EC0BA0E25E9C3E22CBC548771	608BCADB768801C50E1BDE3A1338427F3566C738E65F108CCC63FC75F1AB52FC
Chrome Cache Entry: 178	ASCII text, with very long lines (1146)	F139D7A0984B454090A4571E8823A91B	3EF52E483443B2DF77057F6B81F86F32D6C8EE50	5F780B27CAA4EE4D21A77B3CD34D9BAA39D50AA2408056EE46C7FD4AACB959C8
Chrome Cache Entry: 179	Unicode text, UTF-8 (with BOM) text, with very long lines (63680)	2D09D544FF99B887E9F597CA431A04C1	90FC7EB19DB95EAED5F47D0CF86014257C84C066	F7881A75620E37C46C00FDE1B869BCF805E3B90248EFB3CD2AA086127A7E963F
Chrome Cache Entry: 180	ASCII text, with very long lines (1572)	4BCE3A9D790FCB1B3DEC0A44D383E467	5FC47506CC45BC9A34DFF28C2D2CB18AF249DF5F	069712C53EB43FA9F55E61ABC5B07011191301F8CBD509D170552FEC4B0B29C5
Chrome Cache Entry: 181	MS Windows icon resource - 1 icon, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel	930A57A5A5776E91F784F25B017387EB	97D110F5281AF19FF7F8DBBB09F5436D3B460BE6	67283FBD34FC8BB394256C6D1D6F6CE5EF6EAD71E19A201FC20C956746500780
Chrome Cache Entry: 183	ASCII text, with very long lines (5128)	614C8463EA474A81E0F9592F3C4FE62B	84A3ED8222FFD3B19654102FC99A70A9C9A705A8	6E24336B2C46212F552712F9388860EB4D01F99C94614919D30C03DF806B5899
Chrome Cache Entry: 184	ASCII text, with very long lines (25690), with no line terminators	A165823CE19E210D098673CD3A500BE3	A7E865FE0E1DF069BE679A674D2C183ABD9F2008	46363740103D99445256B74206AA302BA5F543ADE69AC31901E2E7647878EC33
Chrome Cache Entry: 185	ASCII text, with very long lines (65536), with no line terminators	A17EEAE3257239C918EDEA1E7466D0D2	1994BC3B72C6FC130688FFD593C913EA05558187	6345EDE1DE8AE9EC09A174BEDB7158651B5045415C20C38D8A135F8C382557F8
Chrome Cache Entry: 186	ASCII text, with very long lines (7813), with no line terminators	67A5A705D74F10700725BE0B6833695B	2F793AD459CA77CE3792D41DDFF73547196BBD9C	FC521D717EFA4D5E9BD31C098C23E046947B0958F12677833FDF657C74E80EF9
Chrome Cache Entry: 187	gzip compressed data, from Unix, original size modulo 2^32 187170	FCC8D9D68D7DE728ED6743FA4AA2EFBF	8C7C669643FB00410769CBA2C22EF3042A73103E	48D6F0D622A49BB7BB9B1905485B36A2D72C581C3D5DCEDC51E49B7ACAE144FB
Chrome Cache Entry: 190	ASCII text, with very long lines (65536), with no line terminators	79BF5E00DA507C39D2F93CE54DA07750	75A7552F10D7994CACCCE4364E7B15833CDA05A9	71A62BB3150B7A5F2691E992657AB8368FC08FFEBC9567B475A4B5B4E7C4618C
Chrome Cache Entry: 193	ASCII text, with very long lines (65536), with no line terminators	84FAE22FB6A8F1FCAC39A208BCA4578B	DF7A5B0EDB134CCAE3C81A570E79BFFC3E7C11C5	D24877BB8B5685F1DA651FC9A824F1ECB24503230C74F349B7AC0EC3ABFBBC88
Chrome Cache Entry: 195	Unicode text, UTF-8 (with BOM) text, with very long lines (65522), with no line terminators	BD187E279A19BA1B30B721B1CACC94C7	B1A2DE551AB1B9FD5C4F7CED5C0C1BBA41306E44	34555AF86377792C0F50917B086F0065E78E5073F7237181C92C04B4E7FAE114
Chrome Cache Entry: 197	ASCII text, with very long lines (1486), with no line terminators	9284B18C548D4050834CA2C7A36CFD86	94ED1E5897536CA4971B08134C710961F3E1C3E3	C838DD3C52E27FED208897F8AA9657677B57CC6ED73FE229F7AAE5D572E5CA29
Chrome Cache Entry: 198	ASCII text, with very long lines (65536), with no line terminators	A68D6ACC0C7F3DE0989F242559189C1D	3E58577321FC9F5657D03F4A24B6B8B82DDD41AE	77E870DD37A97AFF3FF09BA46E00F023CDA7FCE3E4791E3103D4E5B401009333
Chrome Cache Entry: 199	ASCII text, with very long lines (65536), with no line terminators	D1D9B522BEC6CA372DB5FC822380CF51	9AE42C1F8A775E52341B122B34D1E228DD3FD90E	B115BD8641BC7DBFF0AEFF4C2055971C9F0C243FE7AFBC4675FCC35A804BE2F4
Chrome Cache Entry: 201	ASCII text, with very long lines (11718)	751CBE6BE6301F55497E493877FD9B6B	EED26322B1B47AD84579A786C4C93A64D4443C99	C9069A8C96318CD499F103903E980952B53FF2E1432D550B5135FEBA59A283DA
Chrome Cache Entry: 202	Web Open Font Format (Version 2), TrueType, length 34775, version 1.0	13244BD99451605C61B32C9617162C1F	0E76A3A33245D9276580C0B4D8ECAC07D9936E66	C7E022D03458278AABB7CE6892DDEEF5736041DE037D0D64ADEDC2EB1D82850B
Chrome Cache Entry: 203	Web Open Font Format, TrueType, length 49040, version 2.0	E9D8205FE803D030B9A100A62489A9F4	2C4F29168FC62888AB469E98B939421CF1454B50	B1E3C25979AF743AB65B319CA301B8B37E4CE4BB4F40B95F5DE5E22840874718

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs