Windows Analysis Report
https://liceogalois.co/w712969.shtml&ved=2ahUKEwiQ2rPsxpGFAxXETEEAHemID4gQFnoECBAQAQ&usg=AOvVaw0gc8NfeodrA8Seq_rkAzeZ

Overview

General Information

Sample URL:	https://liceogalois.co/w712969.shtml&ved=2ahUKEwiQ2rPsxpGFAxXETEEAHemID4gQFnoECBAQAQ&usg=AOvVaw0gc8NfeodrA8Seq_rkAzeZ
Analysis ID:	1416906
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Stores files to the Windows start menu directory

Classification

Signatures

Source: https://liceogalois.co/w712969.shtml&ved=2ahUKEwiQ2rPsxpGFAxXETEEAHemID4gQFnoECBAQAQ&usg=AOvVaw0gc8NfeodrA8Seq_rkAzeZ

HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 23.33.180.114:443 -> 192.168.2.18:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.33.180.114:443 -> 192.168.2.18:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.18:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.190.132:443 -> 192.168.2.18:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.21.200:443 -> 192.168.2.18:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.18:49706 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.180.114
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.180.114
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.180.114
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.180.114
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.180.114
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.180.114
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.180.114
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.180.114
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.180.114
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.180.114
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.180.114
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.180.114
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.180.114
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.180.114
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.180.114
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.180.114
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.180.114
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.180.114
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.190.132
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.190.132
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.190.132
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.190.132
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.190.132

Source: global traffic	HTTP traffic detected: GET /w712969.shtml&ved=2ahUKEwiQ2rPsxpGFAxXETEEAHemID4gQFnoECBAQAQ&usg=AOvVaw0gc8NfeodrA8Seq_rkAzeZ HTTP/1.1Host: liceogalois.coConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: liceogalois.coConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://liceogalois.co/w712969.shtml&ved=2ahUKEwiQ2rPsxpGFAxXETEEAHemID4gQFnoECBAQAQ&usg=AOvVaw0gc8NfeodrA8Seq_rkAzeZAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ravSZLykawa1Mbo&MD=oELhUP8x HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /client/config?cc=CH&setlang=en-CH HTTP/1.1X-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateAccept-Encoding: gzip, deflateX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-UserAgeClass: UnknownX-BM-Market: CHX-BM-DateFormat: dd/MM/yyyyX-Device-OSSKU: 48X-BM-DTZ: 60X-DeviceID: 01000A410900B03DX-BM-WindowsFlights: FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124117A5,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E,FX:12CDE644,FX:12D1574C,FX:12D281C4,FX:12E8312D,FX:12E85C75X-Search-TimeZone: Bias=-60; StandardBias=0; TimeZoneKeyName=W. Europe Standard TimeX-BM-Theme: 000000;0078d7X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAaz2EfiSxIQchUkFT51VF0UyV31%2BLJN8ZHtk52gbEEpp3TH8PtaFvDS4VM3A8TlwfkNnfAjX2scRpVDF%2B%2B%2BnELcKaa5xkxHNlkoML3JIErq6A0pOMmBIkCTNVH/FL0mQ6soVX/nHBa0rsOLwD%2BzVjuFapzQTr9IDD4IhSItvLlkSbw5axW9/v3PGWZwc0j3kpLC9TDeo19NP8GFVLZpOv/S4x%2BEwbG9AXqJpuV15b8f1IXCKHdY2kZlnwxGI4GeFI53AWqJBt20TYbr72QGGwscxFGNnO/neRGjRK8R6JeofJL8eaChNCVctC9J%2BrK2VpyQS8Pub/TkhOcHbfCkr6VkDZgAACNy67dajKbNbqAGUvZoREtfqVQET1JnymyEHLJHZQZF2iWxCtjPKFXKNbH5hbWmo3VHLevIZiEKi/0BK9jW%2BPAN6Oz3svJojk7tvw%2B/xNhhRhPGoV4tDUZBEs3Pezm2g0h4wzhDq38zHbluXuhjwdigr1LB3bb4zFCY4KCPe7w3lWTAKIb25jpJvb8c5khTjeV9d2tp1HBo3NInIxwwM0UOdf2FLzqHbF0uJVhHxX1ZLCAGJajCFieZfaqJappksXITfdY/W47irDBqTM8nYOvcPqjAP5Px26YOCsfpOJEAicqP53A4X7B91VG7roj5JLIdM9M8wvv/0x4mA9trrK/PSjFJHlRwG/t0o8S%2ByjpYFh5rrDWazVSutsAW0krIawreyhljNctg%2BCttCBEz1bcsqdgT0zJhIQVTIOQUI2DrHRKeQ9X2cjUHieWUZ5Bhk8o/LUooKAe9G1cWgdajiRkUI%2BPe8N%2B%2B3L5U4BJ1TUXPMpPyx5neVzywOUI/suRUp74k3R/IBN2Qm%2BnJ3jG/c8hX51CJGclqxBeMcZiqGkx89IB3fNw2UcAcmrwYSvB7Pyitr2QE%3D%26p%3DX-Agent-DeviceId: 01000A410900B03DX-BM-CBT: 1711614574User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045X-Device-isOptin: falseAccept-language: en-GB, en, en-USX-Device-Touch: falseX-Device-ClientSession: 710DACB0D94741BB87464334E59F0A24X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIHost: www.bing.comConnection: Keep-AliveCookie: SRCHUID=V=2&GUID=B4BB39E5F80E411D94C438C0FA7ACF94&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=de&LUT=1707317051026&IPMH=6b344233&IPMID=1707317270835&HV=1707317277; ANON=A=680C1B1A649CBD64DD40EBFCFFFFFFFF; MUID=BC76BB0020D345C1A049A4820CB4C03C; MUIDB=BC76BB0020D345C1A049A4820CB4C03C
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ravSZLykawa1Mbo&MD=oELhUP8x HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: unknown

DNS traffic detected: queries for: liceogalois.co

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4784Host: login.live.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 28 Mar 2024 08:28:58 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 28 Mar 2024 08:28:59 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49693
Source: unknown	Network traffic detected: HTTP traffic on port 49679 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49692
Source: unknown	Network traffic detected: HTTP traffic on port 49692 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	HTTPS traffic detected: 23.33.180.114:443 -> 192.168.2.18:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.33.180.114:443 -> 192.168.2.18:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.18:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.190.132:443 -> 192.168.2.18:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.21.200:443 -> 192.168.2.18:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.18:49706 version: TLS 1.2

Source: classification engine

Classification label: clean0.win@14/10@4/5

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://liceogalois.co/w712969.shtml&ved=2ahUKEwiQ2rPsxpGFAxXETEEAHemID4gQFnoECBAQAQ&usg=AOvVaw0gc8NfeodrA8Seq_rkAzeZ
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=2036,i,8529650298205695351,8277197342056155368,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=2036,i,8529650298205695351,8277197342056155368,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
239.255.255.250	unknown	Reserved	unknown	unknown	false
173.201.190.176	liceogalois.co	United States	26496	AS-26496-GO-DADDY-COM-LLCUS	false
172.253.62.147	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.18
192.168.2.4

Contacted Domains

Name	IP	Active
liceogalois.co	173.201.190.176	true
www.google.com	172.253.62.147	true

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://liceogalois.co/favicon.ico	false	Avira URL Cloud: safe	unknown

ID:	1416906
Product:	CloudBasic
Start time:	09:28:31
Start date:	28.03.2024
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 28 07:28:59 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	74E8DB292831F4C44FF9C705132DC3F7	3165140B9FBBFB60D2804BAEBE810B899631ADDC	F74CC9485BBDE4AB64096FE2BCCBC87EB20E3697ECE5C6C1CD405AB15618D234
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 28 07:28:59 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	BDBA920FEDDDD1C5F7B3496719583FC2	988416180AAD6A9EA8842D8B8E561E531C86C903	21212FB51EA0D15F7623BD08EF23C93A9175D204B1A130ADF2AFCD5EFA3D36BB
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 09:23:19 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	860036DAB6E7FF54227450C270C0D690	AF1BEC3DF07058C9CE0907C957D8CDA34DFA9AE4	D06967660E26AC267ED5BB7F0B2F39C6DC8F2E1C70D928220C71886B15A3EB01
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 28 07:28:59 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	9E13DAC78BE79785B1E66A1DB2ADE0FE	09182A6010AB963BD3FF70EB4A288ECAEDE6E1B4	565386779B0D34709468FFFEB47CF5040F7318183BBD5CDBC3516F9F9816443C
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 28 07:28:59 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	1154DFEA96387BB717D5589F9C411C98	589399A5766D544481C6A9125295AAC3110CC31C	9A15C0FF804BE58063234F251EFFC1B08CE3561CB4E084FACD5B645ADCC5AD15
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 28 07:28:59 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	F2F4FFBF2D3FDA54FDCF9B7F0536DD2B	932412AF101404AD6249B11E660CF53DD091D24D	0BC35FC4F29F60D854CB63DE5EC134F869707A561D42E45B32DF8185ADB15845
Chrome Cache Entry: 58	HTML document, ASCII text	A34AC19F4AFAE63ADC5D2F7BC970C07F	A82190FC530C265AA40A045C21770D967F4767B8	D5A89E26BEAE0BC03AD18A0B0D1D3D75F87C32047879D25DA11970CB5C4662A3
Chrome Cache Entry: 59	HTML document, ASCII text	A34AC19F4AFAE63ADC5D2F7BC970C07F	A82190FC530C265AA40A045C21770D967F4767B8	D5A89E26BEAE0BC03AD18A0B0D1D3D75F87C32047879D25DA11970CB5C4662A3

Windows Analysis Report
https://liceogalois.co/w712969.shtml&ved=2ahUKEwiQ2rPsxpGFAxXETEEAHemID4gQFnoECBAQAQ&usg=AOvVaw0gc8NfeodrA8Seq_rkAzeZ

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report https://liceogalois.co/w712969.shtml&ved=2ahUKEwiQ2rPsxpGFAxXETEEAHemID4gQFnoECBAQAQ&usg=AOvVaw0gc8NfeodrA8Seq_rkAzeZ

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
https://liceogalois.co/w712969.shtml&ved=2ahUKEwiQ2rPsxpGFAxXETEEAHemID4gQFnoECBAQAQ&usg=AOvVaw0gc8NfeodrA8Seq_rkAzeZ