Windows Analysis Report
HTTP://ta.trs.cn/c/1.gif?event=mousedown&sr=1280720&br=12411163&dpr=1.5000&clicktype=2&mpId=5062&cs=lubf7tjh_5062_bc07&cu=lubf7tjh_5062_2crz&pv=5062_lubfq5xe_37wk&url=http://sanfrancisco.china-consulate.gov.cn/eng/lgjs/ContactUs/&e_tu=http://sanfrancisco.china-consulate.gov.cn/chn&e_td=sanfrancisc

Overview

General Information

Sample URL:	HTTP://ta.trs.cn/c/1.gif?event=mousedown&sr=1280720&br=12411163&dpr=1.5000&clicktype=2&mpId=5062&cs=lubf7tjh_5062_bc07&cu=lubf7tjh_5062_2crz&pv=5062_lubfq5xe_37wk&url=http://sanfrancisco.china-consu
Analysis ID:	1417177
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Classification

Signatures

Source: http://ta.trs.cn/c/1.gif?event=mousedown&sr=1280*720&br=1241*1163&dpr=1.5000&clicktype=2&mpId=5062&cs=lubf7tjh_5062_bc07&cu=lubf7tjh_5062_2crz&pv=5062_lubfq5xe_37wk&url=http://sanfrancisco.china-consulate.gov.cn/eng/lgjs/ContactUs/&e_tu=http://sanfrancisco.china-consulate.gov.cn/chn&e_td=sanfrancisco.china-consulate.gov.cn&e_tp=http&e_tx=../../images/top.jpg&e_tn=area&e_iac=1&e_et=mouseup&e_nd=Ly8qW0BpZD0nTWFwJ10vYXJlYQ==&e_etd=71&x=998&y=10&x2=369

HTTP Parser: No favicon

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49724 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 23.209.58.93:443 -> 192.168.2.5:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.209.58.93:443 -> 192.168.2.5:49718 version: TLS 1.2

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49724 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.58.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.58.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.58.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.58.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.58.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.58.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.58.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.58.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.58.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.58.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.58.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.58.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.58.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.58.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.58.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.58.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.58.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.58.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /c/1.gif?event=mousedown&sr=1280720&br=12411163&dpr=1.5000&clicktype=2&mpId=5062&cs=lubf7tjh_5062_bc07&cu=lubf7tjh_5062_2crz&pv=5062_lubfq5xe_37wk&url=http://sanfrancisco.china-consulate.gov.cn/eng/lgjs/ContactUs/&e_tu=http://sanfrancisco.china-consulate.gov.cn/chn&e_td=sanfrancisco.china-consulate.gov.cn&e_tp=http&e_tx=../../images/top.jpg&e_tn=area&e_iac=1&e_et=mouseup&e_nd=Ly8qW0BpZD0nTWFwJ10vYXJlYQ==&e_etd=71&x=998&y=10&x2=369 HTTP/1.1Host: ta.trs.cnConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: ta.trs.cnConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8Referer: http://ta.trs.cn/c/1.gif?event=mousedown&sr=1280720&br=1241*1163&dpr=1.5000&clicktype=2&mpId=5062&cs=lubf7tjh_5062_bc07&cu=lubf7tjh_5062_2crz&pv=5062_lubfq5xe_37wk&url=http://sanfrancisco.china-consulate.gov.cn/eng/lgjs/ContactUs/&e_tu=http://sanfrancisco.china-consulate.gov.cn/chn&e_td=sanfrancisco.china-consulate.gov.cn&e_tp=http&e_tx=../../images/top.jpg&e_tn=area&e_iac=1&e_et=mouseup&e_nd=Ly8qW0BpZD0nTWFwJ10vYXJlYQ==&e_etd=71&x=998&y=10&x2=369Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: _trs_gv=g_lubf7tjh_5062_2crz

Source: unknown

DNS traffic detected: queries for: ta.trs.cn

Source: unknown

HTTP traffic detected: POST /threshold/xls.aspx HTTP/1.1Origin: https://www.bing.comReferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: */*Accept-Language: en-CHContent-type: text/xmlX-Agent-DeviceId: 01000A410900D492X-BM-CBT: 1696428841X-BM-DateFormat: dd/MM/yyyyX-BM-DeviceDimensions: 784x984X-BM-DeviceDimensionsLogical: 784x984X-BM-DeviceScale: 100X-BM-DTZ: 120X-BM-Market: CHX-BM-Theme: 000000;0078d7X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66EX-Device-ClientSession: DB0AFB19004F47BC80E5208C7478FF22X-Device-isOptin: falseX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-Device-OSSKU: 48X-Device-Touch: falseX-DeviceID: 01000A410900D492X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,staticshX-MSEdge-ExternalExpType: JointCoordX-PositionerType: DesktopX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateX-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard TimeX-UserAgeClass: UnknownAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comContent-Length: 2484Connection: Keep-AliveCache-Control: no-cacheCookie: MUID=2F4E96DB8B7049E59AD4484C3C00F7CF; _SS=SID=1A6DEABB468B65843EB5F91B47916435&CPID=1711645592757&AC=1&CPH=d1a4eb75; _EDGE_S=SID=1A6DEABB468B65843EB5F91B47916435; SRCHUID=V=2&GUID=3D32B8AC657C4AD781A584E283227995&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231004; SRCHHPGUSR=SRCHLANG=en&IPMH=986d886c&IPMID=1696428841029&HV=1696428756; CortanaAppUID=5A290E2CC4B523E2D8B5E2E3E4CB7CB7; MUIDB=2F4E96DB8B7049E59AD4484C3C00F7CF

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 28 Mar 2024 17:06:49 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveServer: nginx/1.22.0Vary: Accept-EncodingContent-Encoding: gzipData Raw: 61 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 41 0a c2 30 10 45 f7 82 77 18 0f 90 a6 2d 5d 0e d9 88 05 17 ba f1 04 a9 33 36 81 34 91 18 c1 de de 54 5b 10 d7 2e 5d 0d f3 e7 fd c7 a0 49 83 53 eb 15 1a d6 a4 30 d9 e4 58 35 65 03 c7 90 a0 0d 77 4f 28 df 21 ca 17 92 d1 2e d0 38 cd 33 fb c4 51 a1 a9 be 1b 39 41 39 9f 27 77 86 e6 cd f7 d6 3f 64 55 d4 75 51 7e 22 72 91 ca e5 a1 8d 10 a0 e1 aa 89 ac ef 21 05 20 7b d3 9d 63 38 9c f6 3b d0 9e 60 6b 62 18 18 2e d1 b2 27 37 02 c7 18 62 6e f4 0c 42 fc 15 bf 56 3c 01 7f 9c d3 6f 2b 02 00 00 0d 0a Data Ascii: aeA0Ew-]364T[.]IS0X5ewO(!.83Q9A9'w?dUuQ~"r! {c8;`kb.'7bnBV<o+

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724

Source: unknown	HTTPS traffic detected: 23.209.58.93:443 -> 192.168.2.5:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.209.58.93:443 -> 192.168.2.5:49718 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@16/8@4/4

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 --field-trial-handle=2368,i,17427900061271599603,4557120256687689452,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "HTTP://ta.trs.cn/c/1.gif?event=mousedown&sr=1280720&br=12411163&dpr=1.5000&clicktype=2&mpId=5062&cs=lubf7tjh_5062_bc07&cu=lubf7tjh_5062_2crz&pv=5062_lubfq5xe_37wk&url=http://sanfrancisco.china-consulate.gov.cn/eng/lgjs/ContactUs/&e_tu=http://sanfrancisco.china-consulate.gov.cn/chn&e_td=sanfrancisco.china-consulate.gov.cn&e_tp=http&e_tx=../../images/top.jpg&e_tn=area&e_iac=1&e_et=mouseup&e_nd=Ly8qW0BpZD0nTWFwJ10vYXJlYQ==&e_etd=71&x=998&y=10&x2=369"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 --field-trial-handle=2368,i,17427900061271599603,4557120256687689452,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.31.105	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
120.53.131.129	ta.trs.cn	China	45090	CNNIC-TENCENT-NET-APShenzhenTencentComputerSystemsCompa	false

Private

IP
192.168.2.5

Contacted Domains

Name	IP	Active
ta.trs.cn	120.53.131.129	true
www.google.com	142.250.31.105	true
fp2e7a.wpc.phicdn.net	192.229.211.108	true

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://ta.trs.cn/c/1.gif?event=mousedown&sr=1280720&br=12411163&dpr=1.5000&clicktype=2&mpId=5062&cs=lubf7tjh_5062_bc07&cu=lubf7tjh_5062_2crz&pv=5062_lubfq5xe_37wk&url=http://sanfrancisco.china-consulate.gov.cn/eng/lgjs/ContactUs/&e_tu=http://sanfrancisco.china-consulate.gov.cn/chn&e_td=sanfrancisco.china-consulate.gov.cn&e_tp=http&e_tx=../../images/top.jpg&e_tn=area&e_iac=1&e_et=mouseup&e_nd=Ly8qW0BpZD0nTWFwJ10vYXJlYQ==&e_etd=71&x=998&y=10&x2=369	false		unknown
http://ta.trs.cn/favicon.ico	false	Avira URL Cloud: safe	unknown

ID:	1417177
Product:	CloudBasic
Start time:	18:05:59
Start date:	28.03.2024
Cookbook:	browseurl.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 28 16:06:49 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	FBE1303D31D1CD62F89F4A0781CBD94A	73FF79F8AAACFF229F29B2CA178C4539EB0D12CD	5C09981F1E3D80E61EC5E9180DC30FF7598B6C74A23D5843E8E0B5B2E4141D0D
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 28 16:06:49 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	A46A46B361DB945056E045E0A0A13167	CEF4A5490F8862ED301B203060020F913746DC76	190BF36D19B5291D99515C11236A1E4327EC44082B99ECC19440C738ACBC7139
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	F9FF69096C7F99E64157BC3BFF3D44AE	60FD0568A53609153C5973AA6F9927EFA0573CB4	3E6796A75DEAE2E9DE3C20E5917B47AF0EA3D674493AE38D317F836A390958E7
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 28 16:06:49 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	C8E8EE15EE54E2B8CF423625C6585FA5	002900ADEE238327C47DC9E61DB57BECBF70F5FB	D97E4F49528783573518075AA14B85F61C39B4DE3B7AF8F62209DE2F37C60137
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 28 16:06:49 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	642530679CEED737DC7351CDE2B33A16	4CE792FC9AA952EF57C965418964003DF541C6B1	33FDBEF570F6FFC2FCB1A8891781CCE8F5D8CA3E42477C9ADD4412A5E3978D92
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 28 16:06:49 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	93CED63B77521EA4517768BF4B27ED0C	E76A552A6B9579F0EF4978D14E48A024531E3294	FBBEE2EE6BA94562B15BD8B2F379060B091253890357AD08BF44908E4DEBB2F8
Chrome Cache Entry: 59	gzip compressed data, from Unix, original size modulo 2^32 555	20C0810FEE7D342C0041ED5475F7B725	3BC10ED11C792AACBAA09F2CB97BA3DE685E6D78	6F18FD4755BBABAA498203ABDE0FC7CFCE92812F69267FCDD2EC3CB598E9D4E2

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs