Windows Analysis Report
https://name10-safelinks-protection-outlook-com-url-atp-redirect.details-info.co/XVTNJOTVUdXQzTjgzNUZYMm9meHV6RHZGTnpRWmZlSlRaOGs3QlVKUlVrTmU5SlU5TXExenpsNHdTUnpiSW4xVTgxU0dZK0FnRnpwdnUxVmFzb0NkV3FmejZlb0kxak9KT2poRnI1VE5waTc3Y1dVR2pPOCtHVDZ4QTA5cUNqRHVsVUxrQnNmSU1ZTHZpSnlTWnJmdEx1V0RXampkZ0FHam5PcH

Overview

General Information

Sample URL:	https://name10-safelinks-protection-outlook-com-url-atp-redirect.details-info.co/XVTNJOTVUdXQzTjgzNUZYMm9meHV6RHZGTnpRWmZlSlRaOGs3QlVKUlVrTmU5SlU5TXExenpsNHdTUnpiSW4xVTgxU0dZK0FnRnpwdnUxVmFzb0NkV3Fmej
Analysis ID:	1592159
Infos:

Detection

Score:	20
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected suspicious URL

Stores files to the Windows start menu directory

Classification

Signatures

Phishing

AI detected suspicious URL

Source: URL	Joe Sandbox AI: AI detected Brand spoofing attempt in URL: https://name10-safelinks-protection-outlook-com-url-atp-redirect.details-info.co
Source: URL	Joe Sandbox AI: AI detected Typosquatting in URL: https://name10-safelinks-protection-outlook-com-url-atp-redirect.details-info.co

Source: https://name10-safelinks-protection-outlook-com-url-atp-redirect.details-info.co/XVTNJOTVUdXQzTjgzNUZYMm9meHV6RHZGTnpRWmZlSlRaOGs3QlVKUlVrTmU5SlU5TXExenpsNHdTUnpiSW4xVTgxU0dZK0FnRnpwdnUxVmFzb0NkV3FmejZlb0kxak9KT2poRnI1VE5waTc3Y1dVR2pPOCtHVDZ4QTA5cUNqRHVsVUxrQnNmSU1ZTHZpSnlTWnJmdEx1V0RXampkZ0FHam5PcHJ0aUh4dGgzK0cwaGp1a

HTTP Parser: No favicon

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /XVTNJOTVUdXQzTjgzNUZYMm9meHV6RHZGTnpRWmZlSlRaOGs3QlVKUlVrTmU5SlU5TXExenpsNHdTUnpiSW4xVTgxU0dZK0FnRnpwdnUxVmFzb0NkV3FmejZlb0kxak9KT2poRnI1VE5waTc3Y1dVR2pPOCtHVDZ4QTA5cUNqRHVsVUxrQnNmSU1ZTHZpSnlTWnJmdEx1V0RXampkZ0FHam5PcHJ0aUh4dGgzK0cwaGp1a HTTP/1.1Host: name10-safelinks-protection-outlook-com-url-atp-redirect.details-info.coConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: name10-safelinks-protection-outlook-com-url-atp-redirect.details-info.coConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://name10-safelinks-protection-outlook-com-url-atp-redirect.details-info.co/XVTNJOTVUdXQzTjgzNUZYMm9meHV6RHZGTnpRWmZlSlRaOGs3QlVKUlVrTmU5SlU5TXExenpsNHdTUnpiSW4xVTgxU0dZK0FnRnpwdnUxVmFzb0NkV3FmejZlb0kxak9KT2poRnI1VE5waTc3Y1dVR2pPOCtHVDZ4QTA5cUNqRHVsVUxrQnNmSU1ZTHZpSnlTWnJmdEx1V0RXampkZ0FHam5PcHJ0aUh4dGgzK0cwaGp1aAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: name10-safelinks-protection-outlook-com-url-atp-redirect.details-info.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIk6HLAQj2mM0BCIWgzQEI3L3NAQiSys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=det&oit=1&cp=3&pgcl=4&gs_rn=42&psi=szkXRHhDH0lZPj4w&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIk6HLAQj2mM0BCIWgzQEI3L3NAQiSys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: name10-safelinks-protection-outlook-com-url-atp-redirect.details-info.co
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: classification engine

Classification label: sus20.win@18/22@6/4

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2032 --field-trial-handle=1952,i,12233032423343914190,16600221749640921859,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://name10-safelinks-protection-outlook-com-url-atp-redirect.details-info.co/XVTNJOTVUdXQzTjgzNUZYMm9meHV6RHZGTnpRWmZlSlRaOGs3QlVKUlVrTmU5SlU5TXExenpsNHdTUnpiSW4xVTgxU0dZK0FnRnpwdnUxVmFzb0NkV3FmejZlb0kxak9KT2poRnI1VE5waTc3Y1dVR2pPOCtHVDZ4QTA5cUNqRHVsVUxrQnNmSU1ZTHZpSnlTWnJmdEx1V0RXampkZ0FHam5PcHJ0aUh4dGgzK0cwaGp1a"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2032 --field-trial-handle=1952,i,12233032423343914190,16600221749640921859,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.217.18.4	www.google.com	United States	15169	GOOGLEUS	false
3.98.135.159	name10-safelinks-protection-outlook-com-url-atp-redirect.details-info.co	United States	16509	AMAZON-02US	false

Private

IP
192.168.2.16

Contacted Domains

Name	IP	Active
www.google.com	172.217.18.4	true
name10-safelinks-protection-outlook-com-url-atp-redirect.details-info.co	3.98.135.159	true

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=det&oit=1&cp=3&pgcl=4&gs_rn=42&psi=szkXRHhDH0lZPj4w&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://name10-safelinks-protection-outlook-com-url-atp-redirect.details-info.co/XVTNJOTVUdXQzTjgzNUZYMm9meHV6RHZGTnpRWmZlSlRaOGs3QlVKUlVrTmU5SlU5TXExenpsNHdTUnpiSW4xVTgxU0dZK0FnRnpwdnUxVmFzb0NkV3FmejZlb0kxak9KT2poRnI1VE5waTc3Y1dVR2pPOCtHVDZ4QTA5cUNqRHVsVUxrQnNmSU1ZTHZpSnlTWnJmdEx1V0RXampkZ0FHam5PcHJ0aUh4dGgzK0cwaGp1a	false		unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://name10-safelinks-protection-outlook-com-url-atp-redirect.details-info.co/favicon.ico	false	Avira URL Cloud: safe	unknown

ID:	1592159
Product:	CloudBasic
Start time:	20:54:12
Start date:	15.01.2025
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jan 15 18:54:41 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	36724F66C6EC0F324D8C038F9FE9A22D	66131D8B39B3AD28F31DD51859808F6A64DA70B2	CB1FC2BE94C13AB5342BEE1811AE5C27A9B9B661A3E9810FE8944C12CCB59158
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jan 15 18:54:41 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	F6C22C6474B87E91DA247E3ACA471FB4	4514D90B35C17D2A79156AE627388964C0DC459C	ABDF08FBB403F4B15E4BDFE2BA554EB1CE9E84A5B61F096065A0369E3F4AAD73
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	44DAAECE9BEBF2651D7970C9884250B2	1F9A01F53F0BFD789E85D337A3F2190499214378	41EEA449D5A770716EC03200E3F9D28161848D6461EF5D743415EE6209200D0F
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jan 15 18:54:41 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	00C109470C63679267775FF588CB2E39	C2CE70FD2E77048B618B546BFA3DB99F4676F23F	6BFDCD3613FFC5805822D698177E5B09D1D64E50E1C573CDCEE0D19840B75015
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jan 15 18:54:41 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	74496C52C3D8085DB92ACB15EE8E28F6	6308FE8228BA5B55569F2F38F0DE306A509BEF9C	CA3CB52FE4348B647C7E5D187ACBD44813AFC95E2511233261118CC7252E8520
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jan 15 18:54:41 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	A4CB1410C3136A1038F883B0F0BE389E	7B5D84202BA7502D49214D5FE147F2C5AEB58BC6	40FF6B3416E2444A4A462EDF645FEA505D8B43409E843A3EF48B8720BD997459
Chrome Cache Entry: 61	GIF image data, version 89a, 1 x 1	AD4B0F606E0F8465BC4C4C170B37E1A3	50B30FD5F87C85FE5CBA2635CB83316CA71250D7	CF4724B2F736ED1A0AE6BC28F1EAD963D9CD2C1FD87B6EF32E7799FC1C5C8BDA
Chrome Cache Entry: 62	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 64x64, components 3	79F3E9D4BA05A9A5A22CF07B98E201F0	C5ECCA2803F3C2B77BA00050E80297067A30CC1A	E16ADB589C3689CCD55E9CB9980A6C5D1EFD161C795EFB0106B02DB492AAC92B
Chrome Cache Entry: 63	ASCII text, with very long lines (820)	799BD7A9DE56010EA63C2E74A9845D38	85A1A1538791FAE7875F1D54C62D4162C4A4D703	9CE40676299274D354C7B80F514944EB23C66B938A7CCC0FA4A2F734C4871ECE
Chrome Cache Entry: 64	PNG image data, 64 x 64, 8-bit colormap, non-interlaced	87CBE3536916D37D82FF6948C208A955	622E4B5E3354ABFBD96829FA2237CC144A8BD299	2E0280B01BC51E106B26BB88618C7D15A948AFAD22A0B6AAEEF48482EF2D5FDA
Chrome Cache Entry: 65	HTML document, ASCII text	2C42775B2A328C445B7122B571378437	1C0EFD0B31BC40AA0BCF66EA226A708E1DF98B70	01A432B43B929122A2C355002BAF21A439B54020A72BF041B481053E3AF0138B
Chrome Cache Entry: 66	PNG image data, 64 x 49, 8-bit colormap, non-interlaced	3EFA7757BF6E074387349FA1CA0E509D	621911A64296D76080B16067BD83169F236640F9	47B04349A125B9E1A032CE2154C28D1AD3680D98958B688DDC7376EF62B204D0
Chrome Cache Entry: 67	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 64x22, components 3	2F3910B90A5BAC3872B7FC7EA643575D	676B8BD81B18833AC0D403B010A4E9379A2C0F42	78AEF26DEF8ABAFB325D662D7D054141A3B321997E2C6083F6B4F04CAA43E59F
Chrome Cache Entry: 68	ASCII text, with very long lines (2303)	8CEABA37CC3F2B538EC1F1EE03BD7700	F49461D9F14CDD5DA9438CF257B7D9F4B78FCE3D	5653C049D0450CE7C6A7BB17C0920CC9E4D8A1D6AF4C36461477B52C496C46EF

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Networking

System Summary

Boot Survival

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs