Windows Analysis Report
https://email.nationalgeographic.com/T/v600000192d461b369a965aaf4bbe5cfc0/b0a141541c854b2b0000021ef3a0bcf0/b0a14154-1c85-4b2b-a826-24f74eee951f?dU=v0G4RBKTXg2GtTHJDsy7ii3waBSrIwMXGZJ7x_OARFKFQAIe3mwx22JG_r9Sy1LWLGyMVrrFIdudbYjwKGAKz6iTAgyV5XAM3SbSN-FzJU9XXpFWtSFRxbGw4nHcgLdnvWYAVcbDlQyQtE1-NmUBs

Overview

General Information

Sample URL:	https://email.nationalgeographic.com/T/v600000192d461b369a965aaf4bbe5cfc0/b0a141541c854b2b0000021ef3a0bcf0/b0a14154-1c85-4b2b-a826-24f74eee951f?__dU__=v0G4RBKTXg2GtTHJDsy7ii3waBSrIwMXGZJ7x_OARFKFQAIe3
Analysis ID:	1545107

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

HTML body with high number of embedded SVGs detected

HTML page contains string obfuscation

Stores files to the Windows start menu directory

Classification

Signatures

HTML body with high number of embedded SVGs detected

Source: https://privacychoices.thewaltdisneycompany.com/manage?ee=mgLwiTAsmx8AAAGSWcOkSwEqxr8G9BnmRjE8tQU37C%2FR5amsImFHddte6mpL1mSYNKIEueIttnXBWW9iNxTNgRcePYfDOPA%2FnXkdVvXE4qVu&campaignid=b0a14154-1c85-4b2b-a826-24f74eee951f&langpref=en-us&source=PCM_M&rid=CDB33B20B2C4F23C75331940E996C8D7&cmpid=org=ngp::mc=crm-email::src=ngp::cmp=editorial::add=Daily_NL_Monday_History_20241028&langPref=en-US

HTTP Parser: Total embedded SVG size: 103043

HTML page contains string obfuscation

Source: https://privacychoices.thewaltdisneycompany.com/resources/analytics/prod/utag.js

HTTP Parser: Found new string: script //tealium universal tag - utag.loader ut4.0.201811270012, Copyright 2018 Tealium.com Inc. All Rights Reserved..var utag_condload=false;try{(function(){function ul(src,a,b){a=document;b=a.createElement('script');b.language='javascript';b.type='text/javascript';b.src=src;a.getElementsByTagName('head')[0].appendChild(b)};if((""+document.cookie).match("utag_env_disney_dtss-permission-center=(\/\/tags\.tiqcdn\.com\/utag\/disney\/[^\S;]*)")){if(RegExp.$1.indexOf("/prod/")===-1){var s=RegExp.$1;while(s.indexOf("%")!=-1){s=decodeURIComponent(s);}s=s.replace(/\.\./g,"");ul(s);utag_condload=true;__tealium_default_path='//privacychoices.thewaltdisneycompany.com/resources/analytics/prod/';}}})();}catch(e){};if(typeof utag=="undefined"&&!utag_condload){var utag={id:"disney.dtss-permission-center",o:{},sender:{},send:{},rpt:{ts:{a:new Date()}},dbi:[],db_log:[],loader:{q:[],lc:0,f:{},p:0,ol:0,wq:[],lq:[],bq:{},bk:{},rf:0,ri:0,rp:0,rq:[],ready_q:[],sendq:{"pending":0},run_ready_q:function(){for(var i=0;i<utag.loader.ready_q....

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.16:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.16:49751 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200

Source: global traffic	DNS traffic detected: DNS query: email.nationalgeographic.com
Source: global traffic	DNS traffic detected: DNS query: privacychoices.thewaltdisneycompany.com
Source: global traffic	DNS traffic detected: DNS query: fast.fonts.net
Source: global traffic	DNS traffic detected: DNS query: cdn.registerdisney.go.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: tags.tiqcdn.com
Source: global traffic	DNS traffic detected: DNS query: sw88.go.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.16:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.16:49751 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@18/24@22/190

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 --field-trial-handle=1992,i,16613948786829333205,13691959373357222691,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://email.nationalgeographic.com/T/v600000192d461b369a965aaf4bbe5cfc0/b0a141541c854b2b0000021ef3a0bcf0/b0a14154-1c85-4b2b-a826-24f74eee951f?__dU__=v0G4RBKTXg2GtTHJDsy7ii3waBSrIwMXGZJ7x_OARFKFQAIe3mwx22JG_r9Sy1LWLGyMVrrFIdudbYjwKGAKz6iTAgyV5XAM3SbSN-FzJU9XXpFWtSFRxbGw4nHcgLdnvWYAVcbDlQyQtE1-NmUBscmA==&__F__=v0fUYvj"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 --field-trial-handle=1992,i,16613948786829333205,13691959373357222691,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
172.217.18.4	www.google.com	United States	15169	GOOGLEUS	false
216.58.206.78	unknown	United States	15169	GOOGLEUS	false
74.125.71.84	unknown	United States	15169	GOOGLEUS	false
142.250.185.227	unknown	United States	15169	GOOGLEUS	false
63.140.62.17	go.com.ssl.d1.sc.omtrdc.net	United States	15224	OMNITUREUS	false
63.140.62.27	unknown	United States	15224	OMNITUREUS	false
13.33.187.116	dzfq4ouujrxm8.cloudfront.net	United States	16509	AMAZON-02US	false
159.127.198.37	email.nationalgeographic.com	United States	19137	EPSILON-INTERACTIVEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
13.33.187.32	unknown	United States	16509	AMAZON-02US	false
142.250.186.110	unknown	United States	15169	GOOGLEUS	false
52.35.22.192	epcui-appli-gbdbpiganme9-1602070907.us-west-2.elb.amazonaws.com	United States	16509	AMAZON-02US	false
104.102.48.97	unknown	United States	16625	AKAMAI-ASUS	false
142.250.186.42	unknown	United States	15169	GOOGLEUS	false
104.16.40.28	fast.fonts.net	United States	13335	CLOUDFLARENETUS	false
142.250.186.99	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16
192.168.2.4

Contacted Domains

Name	IP	Active
fast.fonts.net	104.16.40.28	true
email.nationalgeographic.com	159.127.198.37	true
www.google.com	172.217.18.4	true
epcui-appli-gbdbpiganme9-1602070907.us-west-2.elb.amazonaws.com	52.35.22.192	true
go.com.ssl.d1.sc.omtrdc.net	63.140.62.17	true
dzfq4ouujrxm8.cloudfront.net	13.33.187.116	true
privacychoices.thewaltdisneycompany.com	unknown	unknown
tags.tiqcdn.com	unknown	unknown
sw88.go.com	unknown	unknown
cdn.registerdisney.go.com	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://privacychoices.thewaltdisneycompany.com/manage?ee=mgLwiTAsmx8AAAGSWcOkSwEqxr8G9BnmRjE8tQU37C%2FR5amsImFHddte6mpL1mSYNKIEueIttnXBWW9iNxTNgRcePYfDOPA%2FnXkdVvXE4qVu&campaignid=b0a14154-1c85-4b2b-a826-24f74eee951f&langpref=en-us&source=PCM_M&rid=CDB33B20B2C4F23C75331940E996C8D7&cmpid=org=ngp::mc=crm-email::src=ngp::cmp=editorial::add=Daily_NL_Monday_History_20241028&langPref=en-US	false		unknown

ID:	1545107
Product:	CloudBasic
Start time:	05:52:26
Start date:	30.10.2024
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 30 03:52:54 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	92E923939468A5A4B5DA204979F40C00	B92EB8F15045F4344B71CBD35CA0A153C13950DD	A6FAFF57E6B6124CB8B670DD961414A3ECD50C40680459FE6CD37E9F718B817A
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 30 03:52:54 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	BFED41EF7702E7F175C5706AB916C75D	B0D8BDB7BB92CA82EBEAA17D5D877DAFA88B2E7A	AAFB027EBF888A6FD680B8143CB1CD065F19595005C4C7DA86ACC52931119C94
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	8CC98B96D190201FA0ABF4213480CBC7	5171C4628B2350795A9536E3EFBDD8014EAE7BB8	915ECFE58E707569A744FA88C7C558DDF6F0FD02D06EDDF025F2A5B84491D316
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 30 03:52:53 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	E30F39B0E8573BF94F47A7D6397045C8	B8B92C9CC03790B1579FDA47DE2CD38B2B507458	E6D9B06F0B674576348CB6392A087C8779356AEEB9DBC1378914EF38EF582D57
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 30 03:52:54 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	0508070690CAF71BD17A5301EA5CDD65	4680C1EE70F9DE877FF23185247F10BD6A54DB3D	77E3349AB1E54509A998EB7E092B6B19D54181D9D5A5A36834C8E129C0843213
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 30 03:52:53 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	0AD13DE8B0DD05BD7C46E4128697380A	0048F37533EA51AC4EACA0E1D6E0CD5E9011BC15	5BC35D6540181EC956BD2CF734AD42E13D7B0F8DB5555E9E361A65759C27F616
Chrome Cache Entry: 75	ASCII text, with very long lines (32055)	F78B0F13FAB58D1D255667EC01B13291	B95F46EF12E6689ECB3E93FD991F4DCB0850C395	0F7A5AC612D50AE7A04FFE20F16D22791098B40A0D118822E7C681AA3459DA0D
Chrome Cache Entry: 76	JSON data	63A2584DE4DEAB7CF36023E4BEEBADB6	75B03C0A928A49418FC45E85BF24465AA0EAE858	45FF02C379C723D3F69585BDA55624B8E4D548CE7E0D401010A0F1054DF98644
Chrome Cache Entry: 77	ASCII text, with very long lines (12528)	AB7AEEC94BB3F98585E4F0CEA6F4B2C7	A6FEDC822F9CE614782467F5A2C6267D1FDE8C90	513468C6DD032E2E6DD79651B5453DF5D9E33E7D4CCFD835B44EAA2A1227DF4F
Chrome Cache Entry: 78	Web Open Font Format (Version 2), TrueType, length 24648, version 0.0	6582BF953A86281FEFE137C104650500	4C8CCC56FD6A632A2C6B478E4CBF7A480BA23DEC	DDD0EF3969A8FE8E74303A68E23A42017302163556F72D9CCCFC0F1CF615B6A8
Chrome Cache Entry: 80	Web Open Font Format (Version 2), TrueType, length 18428, version 1.0	EECD612FA5F3095CB55C6B24AFEA0C19	09C6579033B509596A0280B7B9D409FA89022715	446D2C488253B49A62319B809A1AFA6F942A8521E4C7B13DCDE1B72B630878A2
Chrome Cache Entry: 81	ASCII text, with no line terminators	7BC0EE636B3B83484FC3B9348863BD22	EBBFFB7D7EA5362A22BFA1BAB0BFDEB1617CD610	A2C2339691FC48FBD14FB307292DFF3E21222712D9240810742D7DF0C6D74DFB
Chrome Cache Entry: 82	HTML document, ASCII text, with very long lines (1466)	45552B338CBE49D2100D01B64F88C40F	3EE15D5BD96AA6EB8D2CB82D1B67F5E8EA477828	07E4C9EAD69073625286C276E029040FDEC38F9C54559D9A5C6615B1C471354D
Chrome Cache Entry: 83	ASCII text, with no line terminators	DD0E41619E3E11CDCF4C7508A13916D5	6732131D429E1AD9F604160FB44815B702309824	EA22796AB2325D2EFDA63AD84D798B1F4B3419D6337CFB24C4560E34EEFE8B54
Chrome Cache Entry: 84	ASCII text	0BE964EF68C798C32136CF76996E8C50	C1FDE1EB8BEC59459E4E32E2EE7B7D36AB868826	279AB98B90CFD1A0A825519843A5A520E2B44CFA84E751C7793F177B092512E8
Chrome Cache Entry: 85	ASCII text, with very long lines (1642), with CRLF line terminators	C420A601E4928BCFE6377EF6B5C716F3	E181815F509E8F22EC528A53164AFDAD5297E5B0	4E77A41AB74E23754001C74DB092A30B45D9303BCD9700A686064A76BEFC3240
Chrome Cache Entry: 87	Web Open Font Format (Version 2), TrueType, length 26080, version 0.0	6136E05B5B1B2748C67A5E9E29A752FC	BAA4A61A16E46102F290BD7B63B3BA50770EAE0B	4B3A5E9E68E0A41245BE2AF724B0D350AD1328F6496D1B6B73620BF22FE3E359
Chrome Cache Entry: 88	Unicode text, UTF-8 (with BOM) text, with very long lines (39408)	0C457A1A1960E04962F1183470EC2D77	B53C00B17B3CFF98807DC460B601A93FBB1EAE37	B353784B461E54F841FBB22785FAC617B4A32220F514E782521A4145878D1214
Chrome Cache Entry: 89	Web Open Font Format (Version 2), TrueType, length 18148, version 1.0	ACA5631983A98FDE993196E350B3274E	3D185A9A89D24109FFB47DDE6268B3B1FF3F66EA	06F337FB04772FC10B70A824E4D9A24889C7473F9530A9ED9C599E9F6719FCFF
Chrome Cache Entry: 92	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced	6169315CF572A63643756B015A26ADF4	0AA5205BF925BCCA66A647FC954A3F38D181D34C	E12CDADC9DD9980063AD0547B6E63D76075D2478076154950100F568C9774236
Chrome Cache Entry: 93	ASCII text, with very long lines (4099)	6B222D432A9E3D8EB9BCDF807378549C	5E072DDA30AF70738D6376263778B6409BABA0F2	BF8877F4ADC4A991BD91B6970280EC44984818882B602669124C79801DD4AD27
Chrome Cache Entry: 94	JSON data	BEC64EDD4B0B568E80E2A7E0DB3FB855	075614B43AB9379DBFFE852B54721B8769CA6D75	F499CD5F56DC75346F037937FDA240AEACED5E5DE238CBBFC9231D6C84F356B5
Chrome Cache Entry: 95	HTML document, ASCII text, with very long lines (399)	2822756050B8611E3BB0096BD1D5E347	C924C66E57EB213FE94A568B74255E0971197D44	7ED828047ED5FB9CF6BA051C63EF08B663CFECDE49E47F57B746EDF04F1B3A62
Chrome Cache Entry: 96	Web Open Font Format (Version 2), TrueType, length 25660, version 0.0	0A3B8E4BB89545084EF612BCAF5DB19B	CFFF9F749FA5A21F5375F735CFDFC6C63992B653	F958FD6669821599B8B4272ECFCDF02DB39CF798251DFA82FDD117EAD1AA8A24

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs