Windows Analysis Report
https://pub.marq.com/f459f366-29c1-4795-9b3e-a3c3f6e24fda/

Overview

General Information

Sample URL:	https://pub.marq.com/f459f366-29c1-4795-9b3e-a3c3f6e24fda/
Analysis ID:	1592162

Detection

Score:	21
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

AI detected suspicious URL

HTML page contains hidden javascript code

Stores files to the Windows start menu directory

Classification

Signatures

Phishing

AI detected suspicious URL

Source: URL	Joe Sandbox AI: AI detected Brand spoofing attempt in URL: https://slvraircomfort.com
Source: URL	Joe Sandbox AI: AI detected Typosquatting in URL: https://slvraircomfort.com

HTML page contains hidden javascript code

Source: https://pub.marq.com/f459f366-29c1-4795-9b3e-a3c3f6e24fda/#_0

HTTP Parser: Base64 decoded: sv=o365_1_voice&rand=TjVVUjk=&uid=USER08012025U04010806

Source: unknown	HTTPS traffic detected: 2.23.242.162:443 -> 192.168.2.18:49697 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.242.162:443 -> 192.168.2.18:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.18:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.18:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.227.215:443 -> 192.168.2.18:49753 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63

Source: global traffic	DNS traffic detected: DNS query: pub.marq.com
Source: global traffic	DNS traffic detected: DNS query: app.marq.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: analytics-pub.marq.com
Source: global traffic	DNS traffic detected: DNS query: cdn-cashy-static-assets.marq.com
Source: global traffic	DNS traffic detected: DNS query: stats.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: analytics-pub.app.marq.com
Source: global traffic	DNS traffic detected: DNS query: slvraircomfort.com

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49679 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49693
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 2.23.242.162:443 -> 192.168.2.18:49697 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.242.162:443 -> 192.168.2.18:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.18:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.18:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.227.215:443 -> 192.168.2.18:49753 version: TLS 1.2

Source: classification engine

Classification label: sus21.win@18/26@20/251

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=1992,i,10166080106252298425,1315085545750906946,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://pub.marq.com/f459f366-29c1-4795-9b3e-a3c3f6e24fda/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=1992,i,10166080106252298425,1315085545750906946,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.46	unknown	United States	15169	GOOGLEUS	false
3.93.140.3	app.marq.com	United States	14618	AMAZON-AESUS	false
142.250.186.78	unknown	United States	15169	GOOGLEUS	false
173.194.76.157	stats.g.doubleclick.net	United States	15169	GOOGLEUS	false
142.250.185.67	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
173.194.76.84	unknown	United States	15169	GOOGLEUS	false
54.204.91.219	analytics-pub.marq.com	United States	14618	AMAZON-AESUS	false
99.86.4.85	unknown	United States	16509	AMAZON-02US	false
142.251.5.156	unknown	United States	15169	GOOGLEUS	false
192.185.107.17	slvraircomfort.com	United States	46606	UNIFIEDLAYER-AS-1US	true
142.250.185.232	unknown	United States	15169	GOOGLEUS	false
216.58.206.36	www.google.com	United States	15169	GOOGLEUS	false
142.250.181.232	unknown	United States	15169	GOOGLEUS	false
99.86.4.28	d3v04nmt9jknbk.cloudfront.net	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.186.142	unknown	United States	15169	GOOGLEUS	false
18.245.60.10	cdn-cashy-static-assets.marq.com	United States	16509	AMAZON-02US	false
142.250.184.232	unknown	United States	15169	GOOGLEUS	false
216.239.36.178	unknown	United States	15169	GOOGLEUS	false
142.250.186.99	unknown	United States	15169	GOOGLEUS	false
35.171.222.254	analytics-pub.app.marq.com	United States	14618	AMAZON-AESUS	false

Private

IP
192.168.2.18

Contacted Domains

Name	IP	Active
cdn-cashy-static-assets.marq.com	18.245.60.10	true
analytics-pub.marq.com	54.204.91.219	true
www.google.com	216.58.206.36	true
d3v04nmt9jknbk.cloudfront.net	99.86.4.28	true
slvraircomfort.com	192.185.107.17	true
app.marq.com	3.93.140.3	true
analytics-pub.app.marq.com	35.171.222.254	true
stats.g.doubleclick.net	173.194.76.157	true
pub.marq.com	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://slvraircomfort.com/n/?c3Y9bzM2NV8xX3ZvaWNlJnJhbmQ9VGpWVlVqaz0mdWlkPVVTRVIwODAxMjAyNVUwNDAxMDgwNg==N0123N	false		unknown
https://pub.marq.com/f459f366-29c1-4795-9b3e-a3c3f6e24fda/#_0	false		unknown

ID:	1592162
Product:	CloudBasic
Start time:	20:58:09
Start date:	15.01.2025
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jan 15 18:58:43 2025, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	0FA405168C50F78E7EF6DAB47963A81B	8B33264C88D46B01F1C176B8FB8CA9FB99974E99	8A5B8B062577CCEE09B17F277603923FE5912F0D9AA80B857B64ABE20906EDDD
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jan 15 18:58:43 2025, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	87B439990A2EF6E4DF03F4C3A19C3D26	9CEFED503A384663DCAEAF698AB7F8AB94864266	815BB8A6BBACF6719CF88683FD76375373E56A54FEC46CB637491F7207553186
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 09:23:19 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	FBCE8AC3EEA0D43003D9447D133F90F5	E014F4DF4E0B3575F853E5A06AAFC4720F517A53	C719455DB3067081C7EDCC0E01602A03EC4686A3DC4075027EB125186D381A5E
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jan 15 18:58:42 2025, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	583BD0803479F25921F5268095D4FCA0	845BBA9EA55C0A059E0311CEE9FE335FF9912D7C	A4A703BEDAA3F6CA94FFEEDA6C54DF10049C6F3EC9D7E68028DF0E1F04444915
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jan 15 18:58:43 2025, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	02A3D77DC59526463D0EB15C39DE4E60	518B7DAA8CD7D994352E1669C14F3F1C6BF5317C	C1FD3F34B68228E89A0EFFF2331882FE420C5B9C5458E1C114A4C69B55A56580
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jan 15 18:58:42 2025, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	E73838EB84322DE79E70611A88DD84A9	D1D75AC081C8E6FC38C3A3A58FB144CA67F184A9	4DCE9D710C0D4D6E527B75B23FC956EA1862A07AD1233BA8C53F00D9674051E4
Chrome Cache Entry: 102	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 58144	80645EC96EFAEE4E97EFFEAA22C552E3	AC4C15EC431AC8436A9A83E4B7F1BB6EBA38AD89	C7B6CB863CE60101E181E0255F05372E48B16361C1B9D3FA0927F2F24F032DF1
Chrome Cache Entry: 104	ASCII text, with very long lines (2343)	575B5480531DA4D14E7453E2016FE0BC	E5C5F3134FE29E60B591C87EA85951F0AEA36EE1	DE36E50194320A7D3EF1ACE9BD34A875A8BD458B253C061979DD628E9BF49AFD
Chrome Cache Entry: 106	ASCII text, with very long lines (1305)	E9372F0EBBCF71F851E3D321EF2A8E5A	2C7D19D1AF7D97085C977D1B69DCB8B84483D87C	1259EA99BD76596239BFD3102C679EB0A5052578DC526B0452F4D42F8BCDD45F
Chrome Cache Entry: 107	ASCII text, with very long lines (821), with no line terminators	1E3905F5023861EB1288AE33B170141C	7436128DB1D269DED8397D5B02A22B62FD5E2C10	420BE7CE8B8002392E4D6A030229150F54A1AA22A56E52CAD6DF56EE1CB23B42
Chrome Cache Entry: 108	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 301175	36112B327CC80CADA0143492D7D6F4B0	054628F42BFF19CC2A13AFDA0863143A6C9C1728	D4275B611919B91BFB62574C419085046612F189132A63C7784BFE63BC32942E
Chrome Cache Entry: 109	very short file (no magic)	68B329DA9893E34099C7D8AD5CB9C940	ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC	01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
Chrome Cache Entry: 110	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 13909	FF8D9B8D9CD9DCEEF7B14D8B6515EE60	2C669AEC35BB9F751DC66BD1F3A7926BF60B3388	BFE09B27A2B52B6C0EB7A7628BE324B7D8FADE845EEAB2AB0A73769CB721BAA1
Chrome Cache Entry: 112	PNG image data, 3024 x 1700, 8-bit/color RGBA, non-interlaced	69E057BB9FA0B50BCDBEF8370B63C915	0C6D112AE6E383DFC85274B28D2DCE26504D6390	642F084D89860B0AC1570BAE32B87C5DCB2F1652CBF50F8C02D0B310AEFF1D89
Chrome Cache Entry: 113	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3127	ACEFF3D1C8B73505B46F6DB1B38713B9	7E2C4D835FEA790F9F1EAEE910D8CDF4382F0BC9	01E93C81945157BFD1516A64E39FCB1365FF8FB4B7BCD90D38B33F93A07FDF6C
Chrome Cache Entry: 85	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3322	FD7D80CB7B8CC4451BF1090C37D5BC9A	9EDA32F2212B9C01BCE9422517048056F4576B44	22635A30CA729DBFED8F407348E893768FFD68E8745C0C9E56E9096A06A9D982
Chrome Cache Entry: 86	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 52366	293233758C8D9686A755C155C1DD6915	513C46A75C9463283584CA374B3953CB4B4EA0E3	1D2624B780411A5BB7FD8153EC3606120CC94796B64D74A17A809404B788553E
Chrome Cache Entry: 87	ASCII text, with very long lines (5960)	CA85F4600258DEDBA1EABF8A64494FA4	22BCCE8D33E3BC4FA4BD6238F8B6BAF4E42BDB98	15A0EC3AED0AE35FC82D550DBABDE1ADB6401847B996DA0C1BAA4178D2126D65
Chrome Cache Entry: 88	ASCII text, with very long lines (5960)	F081C300E369EC01E30F50972C706AFC	B93D957FC01943BA1C96536F2393A44177DC90C7	2FAC01A760D124F4B9B891655FAF3AA2482AFD32400EEB1664C3EFEB4C5343D1
Chrome Cache Entry: 91	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 429880	ACDE650545ADD62208AD57544090E972	72A91DE71DB9035D31FC563CA1BAE9C10A36188F	F95FC0636DB444426B89B7D5391B2EFE7A9E79FFE0A922DA0AAD9BB47C98C7CA
Chrome Cache Entry: 92	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1704906	7755B68460A0689906B9F382381FD066	981B3C98480E6D215076EFFDE550C201220DFDBC	30A17C4C5BB1F77CA14EBEDB42CEF932C24D7A70A0ADF6E82C33E74966685817
Chrome Cache Entry: 93	XML 1.0 document, ASCII text	9A191A9D0F07C113BF330B131E05923C	BAFAFED908EF1ED1AE1E3F10EF0D0E040231EFE0	E154842C755B805732E5253581FDAC280C542281FE3C02FE889A29C2A5936AC5
Chrome Cache Entry: 94	TrueType Font data, 13 tables, 1st "GDEF", 17 names, Microsoft, language 0x409	093EE89BE9EDE30383F39A899C485A82	FDD3002E7D814EE47C1C1B8487C72C6BBB3A2D00	707FDC5C8BAB57A90061C6A8ED7B70D5FFB82FC810E994E79F90BACE890C255A
Chrome Cache Entry: 95	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 7470	7284F4E0358C3E34F12006700AEF59D9	74AC0FF418E8D0FF9BC37DFE98075B209C124963	943409287C5D7020886B3208A38312743D3DD8F4F03208331264CBC5DC1010F6
Chrome Cache Entry: 96	HTML document, ASCII text, with very long lines (358)	A8063BD37D3C8FB3176A6BF140558A4D	E32CF4B407DB3D3773DED13FF64B70FDBAD7735F	BCCB23D41C2CC69CF0C7D22C4314CA8181A513C6999B73E45307792830F4E482
Chrome Cache Entry: 99	ASCII text, with very long lines (912), with no line terminators	6BB741A257193BC93135061153E7EAFA	08475903411B0A05671348677FD440A81EA2C8F3	97F73F9EC67FE0A2304EC48B51B1B23822D714E4B2B4069EA6D23890A0A6568C

Windows Analysis Report
https://pub.marq.com/f459f366-29c1-4795-9b3e-a3c3f6e24fda/

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report https://pub.marq.com/f459f366-29c1-4795-9b3e-a3c3f6e24fda/

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
https://pub.marq.com/f459f366-29c1-4795-9b3e-a3c3f6e24fda/