Windows Analysis Report
http://improvingpayments.com

Overview

General Information

Sample URL:	http://improvingpayments.com
Analysis ID:	1430580

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Snort IDS alert for network traffic

Stores files to the Windows start menu directory

Classification

Signatures

Source: https://improvingpayments.com/

HTTP Parser: No <meta name="author".. found

Source: https://improvingpayments.com/

HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.17:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.17:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.17:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.157.11:443 -> 192.168.2.17:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.17:49771 version: TLS 1.2

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2051948 ET CURRENT_EVENTS Balada Domain in DNS Lookup (bestresulttostart .com) 192.168.2.17:59885 -> 1.1.1.1:53
Source: Traffic	Snort IDS: 2051948 ET CURRENT_EVENTS Balada Domain in DNS Lookup (bestresulttostart .com) 192.168.2.17:53108 -> 1.1.1.1:53
Source: Traffic	Snort IDS: 2051949 ET CURRENT_EVENTS Balada Domain in TLS SNI (bestresulttostart .com) 192.168.2.17:49733 -> 193.163.7.113:443

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93

Source: unknown

DNS traffic detected: queries for: improvingpayments.com

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49690
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49690 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.17:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.17:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.17:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.157.11:443 -> 192.168.2.17:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.17:49771 version: TLS 1.2

Source: classification engine

Classification label: mal48.win@15/50@15/138

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://improvingpayments.com/
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1972,i,17185468046542733416,17312511181297517858,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1972,i,17185468046542733416,17312511181297517858,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	true
142.250.105.94	unknown	United States	15169	GOOGLEUS	false
142.250.105.84	unknown	United States	15169	GOOGLEUS	false
172.67.152.194	visit.startfinishthis.com	United States	13335	CLOUDFLARENETUS	false
142.250.105.139	unknown	United States	15169	GOOGLEUS	false
173.194.219.94	unknown	United States	15169	GOOGLEUS	false
193.163.7.113	bind.bestresulttostart.com	Denmark	1935	FR-RENATER-LIMOUSINReseauRegionalLimousinEU	true
172.253.124.95	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.9.95	unknown	United States	15169	GOOGLEUS	false
64.233.176.101	unknown	United States	15169	GOOGLEUS	false
160.153.0.14	improvingpayments.com	United States	21501	GODADDY-AMSDE	false
74.125.138.94	unknown	United States	15169	GOOGLEUS	false
64.233.185.104	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.17

Contacted Domains

Name	IP	Active
improvingpayments.com	160.153.0.14	true
visit.startfinishthis.com	172.67.152.194	true
www.google.com	64.233.185.104	true
bind.bestresulttostart.com	193.163.7.113	true
improving.patriotcbdguide.com	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://improvingpayments.com/	false		unknown

ID:	1430580
Product:	CloudBasic
Start time:	22:27:05
Start date:	23.04.2024
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Apr 23 19:27:33 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	68A53969366D96AE7B32253524DBA08A	A9E2B743BB33F6528387EA9A061AFA0122D7E7D2	7B5D5A587CD1014A979A1DC46B843F31FA847191C5BA0D78644BA79F0ACF9854
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Apr 23 19:27:33 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	6BB0AE5D7541EC6078627EBAB609BE95	F6551BDDB8590FC833AB43FA8ACEAE8DD79D2CED	F637BBD9A7B116F081E4887C177B52C55D7467238FFDD204BD950758D0E2E003
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:54:41 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	95A2791896F4CB41FF88B343C2CB99FD	950953731D5FEC2F1074F323330FCB1877CC180D	8454FE6235FC24C4A7C0589B51557CF06C05A192A43CE3E34ACEEFBDF3AE55BC
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Apr 23 19:27:33 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	A052ADED9B88FB53428B5CF2A6E09F60	D5829C7453CC70B8296783DB351B0E934557BEB0	00BC1218B2BC8896268A5C8292E749DBEB1F8D7495F3313C47AD5D35F37B8159
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Apr 23 19:27:33 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	D51578EC4F6B53CA6B2FE8DADEF5DED3	DEC4B6A0185FC25D90BBBE2C53902AE8EEABFC61	4F3FC4254B40579CAD5942FCC139F441B5733C2BA4CFB3084DED25BD40D504F7
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Apr 23 19:27:33 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	6446025FB7066BA7E73AE3E02BBA5682	9FD42DD4D80B4EF446FCE66570228F8942FD5176	B57D6C88F8D8A21DE1CCEAB18C7CF7BA034554E38570CED9BE3C4F35F6C09483
Chrome Cache Entry: 101	ASCII text, with very long lines (413), with no line terminators	CB17D4E4C3FD00800B0F561B8A057149	638201B94E04BD2082788A774DDE22696AD7402E	5ECB54F91384AF7226CB4F18F87588EDD49CEFF5BDD4A3010336E1C22CCC390D
Chrome Cache Entry: 102	ASCII text, with very long lines (1099), with no line terminators	B9444342D9DC2815E7207AA9E4FAE19B	623170F05E753A0BE0CCD74F8BD3AD64E8898CD1	D3DB8504F059A77C6FECB4DBAC858CA00B80B33AE444F8F86BF4FDA5400B5A32
Chrome Cache Entry: 104	Unicode text, UTF-8 text, with very long lines (8189)	C4E68A0F3463C0BD3C39EAB38815E881	0CE58644E9F3C5063A11453FF287C5EC096465A7	CA7DCE2391845E8AEC7DA135F33FABD10F74EED28A532AC66FD01F761FCFB42F
Chrome Cache Entry: 105	HTML document, ASCII text, with very long lines (61132), with CRLF, LF line terminators	6164F2C4AC72A2DED2A883F057AB5B12	747E3EA972027A7F4B99D3598D5B08988F512901	5C10B8231B19222EC7C908BA74A87A57A44A694F7B1471594F03BF937A42F489
Chrome Cache Entry: 106	ASCII text	A5BF64D5859EE94A3E8E93D592D6D2A0	049EB63B42DBB820B06870A430F523BF06880721	25825611ADE7CEAED7DF3862EC56DC91AD1D2BE539966EF7BBE84306E51CFB08
Chrome Cache Entry: 107	ASCII text, with no line terminators	E4F3F03809A1403455262996EBD49F26	8F31D07941D2B7EE1FDF3656E8B9FBCB5A3712BA	DF5A2E20E2A65A8D2ACB23A305949315DF437527BAC00AA329BE595C9A2E85A6
Chrome Cache Entry: 108	Web Open Font Format (Version 2), TrueType, length 12264, version 1.0	D3D668CE420AA39A809332CFA20BEE62	E88C367BE3BD76A0E1CA756B24EF896A5E9B5349	EDCA86796431C83A5C62288A256A2E33D2A1B5B91511BFD47FA8B13A405BC450
Chrome Cache Entry: 109	ASCII text, with very long lines (13479)	9FFEB32E2D9EFBF8F70CAABDED242267	3AD0C10E501AC2A9BFA18F9CD7E700219B378738	5274F11E6FB32AE0CF2DFB9F8043272865C397A7C4223B4CFA7D50EA52FBDE89
Chrome Cache Entry: 110	Web Open Font Format (Version 2), TrueType, length 33092, version 1.0	057478083C1D55EA0C2182B24F6DD72F	CAF557CD276A76992084EFC4C8857B66791A6B7F	BB2F90081933C0F2475883CA2C5CFEE94E96D7314A09433FFFC42E37F4CFFD3B
Chrome Cache Entry: 111	ASCII text, with very long lines (12198), with no line terminators	3819C3569DA71DAEC283A75483735F7E	ECD40A5CC6F0B76200C454CA880210DC301CFAB8	214674CC77ABA35AB3567B88E2739FD08E8E96C61D279559AD61874069683EA0
Chrome Cache Entry: 112	ASCII text	313A6232699B2F02296B5BE9F4A0A5F8	D9AA6F8DE96B123EA9F0546E062E340657EF0191	94F0CB222975E7939A4B4C283376FC06FBCDFCFCED990A4CFBB37BF74A29567F
Chrome Cache Entry: 113	ASCII text, with very long lines (34943), with no line terminators	C5B5A7CC2B37189F6138BCA4A785AEF3	EFCF240338645D53E5545313C127E34E2C9F9FB3	6729AF5194454B5DAE48057BF13E0C8302108D96071F5B4E74E7FD3F732A8BC5
Chrome Cache Entry: 114	ASCII text, with very long lines (3147), with no line terminators	452D788D5DDDADB1D8BB4194B046BFA8	C532F75226E2E27FD17ECD48411403A17AECF75D	27D880A933A42A50068D72128560A19FEB2C52DA76B9B5BF2A62DD1EE431B109
Chrome Cache Entry: 115	ASCII text, with very long lines (1320)	CB0E5952FBE533069CDA30292E2EF353	F46E169AD03BAC202A3109A692DA9F1F6C27AB99	B1EFC1D040CD39F97B10A044357DB6D17A2150EFE99C3A1ADED204C09B88C7A9
Chrome Cache Entry: 116	ASCII text, with very long lines (339), with no line terminators	F2A351D1597CC89F92A145B82B461890	1EBDC6F91F82C6D01332E1A5E225AD27D6EDA91E	B969721EF6FCCA6918159844304AFF2970CF511E07F17837C55E989876CD7A3B
Chrome Cache Entry: 117	ASCII text, with very long lines (59701)	51A8390B47AA0582CF2D9C96C5ADDEE2	B16A640874025D085C38119A1A02A3460F83F2DE	98CECF88A23542FA047CE46EEDB650B5C5128761ED4386C0977B847094DDFA20
Chrome Cache Entry: 118	Unicode text, UTF-8 text, with very long lines (24463)	7E539226482D5D4835F6DA6642245C3F	F367AAC9DD8C86F072E73C11C6973F53465B6161	2F4CFBBC8E5EC834092F3E40158B5A1B1551FB0B8E5BB9894335BAC7B49F913A
Chrome Cache Entry: 119	ASCII text, with very long lines (18798)	F88D5720BB454ED5D204CBDB56901F6B	F1952292FDE4B15936E9AAC16B2B9896684DB95B	726B820E44F6AB90AD991D30A4BF26D3A5D71493CBCD1FB1EFD0D14E89B9DF2A
Chrome Cache Entry: 120	PNG image data, 181 x 50, 8-bit colormap, non-interlaced	750BC5C2D986534FEDD7051F035AFF59	140F44E909AAE264F19BC17A86216D353F975F34	4392BAD1C53DF97E6DD0E7FCB04768F878545276B59F9C848D6C7F3EF1ACD38C
Chrome Cache Entry: 121	PNG image data, 293 x 80, 8-bit colormap, non-interlaced	D0BDBA05C366E7F0454F294221F0F1A5	66A21C5551C6461EE1F4A0AB54425EA05F3CCB61	EE68E53389C1262C04081307570F147182FDE7F07D3AB50B5DC9178C1CA67FE5
Chrome Cache Entry: 122	ASCII text, with very long lines (41843)	3AF7549A6B56C8C65BBEBDA33FE04160	1F9D61F1D467425720D81689E46D777785B48475	A328F40F34617B5CB97D142EAA74977767856B0269B0E3EDF5B656F827B54575
Chrome Cache Entry: 123	ASCII text, with very long lines (1391)	19D386C9004E54941C1CC61D357EFA5D	0A77594006C8D86FDCC0ADBC2B9AECAEF3869586	3BC6467A95CEC8FA516C6F5F69E1301E37E16F9BB1046FE7756729249F901B95
Chrome Cache Entry: 124	ASCII text, with very long lines (1713), with no line terminators	23B0D9051790B4A386F66FF1836815BC	0DC76A6BCAD4BDCE1B88EC6E68215733C97FC520	69A15BA379260F131F7DFA2A5414CBDC48DB661AC21D696773C7E67259255CA1
Chrome Cache Entry: 126	ASCII text, with very long lines (15371), with no line terminators	2AC1F611B613445AE97A38B92915F2AE	9FD95FF7909F9C91D8F547EF4EFF344AF6413CCC	6C8110358CE36D46A951C04242F4256F5E7B04D4C5FDE0469066C8EE9FB5EA4C
Chrome Cache Entry: 127	ASCII text, with very long lines (33305), with no line terminators	3CB598A648684B27E3D265A6990444FF	7B2095A8CA07BD3A399C44BA3541794397FED226	BEE737D0ECAD2508B9AA3D6EBA93B86EC6836453344D8B5F0090C6B13FFDB633
Chrome Cache Entry: 128	ASCII text, with very long lines (771), with no line terminators	2399EF783701F73C399589AE95298B0F	3E1F2A7AC9DCB2B50B1F1CF768441E46FD9F62EE	2DEA57483641F8762937DFD9B09126A9B21C88BD3D7486186003E0BBB9043145
Chrome Cache Entry: 129	ASCII text, with very long lines (38436)	DAC3BC08A99787138AF9B083E33B363F	943167BDA215C2CC27569C56952F577BB3240F6C	61EFDDBAC8C465A7AC3B014E0BD5D26826CD2A0AD036D3CF3861EDB6CB502AC3
Chrome Cache Entry: 131	ASCII text, with very long lines (18114), with no line terminators	17021088D1E5BF6D919F1EEF0E7C9EDB	24009D663FA269F6E85368F0F0E314681CBA36E7	149712C16718936D2B7AD4C16D10E89DE23C9C3B1C157158B533B961F2BF644D
Chrome Cache Entry: 132	Unicode text, UTF-8 text, with very long lines (1646)	2395C81E72A52F14588816B4F72A7F17	711357E8D49C28BE7605FCFBF881B90567DECEE1	EA14D1B1233E6CBC9B1A156AC532F076F7ADAFC309726FCA7BF8833F882AC872
Chrome Cache Entry: 133	HTML document, ASCII text, with very long lines (1238)	9E8F56E8E1806253BA01A95CFC3D392C	A8AF90D7482E1E99D03DE6BF88FED2315C5DD728	2595496FE48DF6FCF9B1BC57C29A744C121EB4DD11566466BC13D2E52E6BBCC8
Chrome Cache Entry: 134	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced	F9293EDB781BCFC3D86EE678A784C9FF	596BD48C510C90A958C6B60B09494D41C9F41502	B46B6BB22DC946A587F7DF72E3ED54B8E7F1ED971F6EE4520FC0561292FF73AA
Chrome Cache Entry: 135	ASCII text, with very long lines (59904), with no line terminators	9093E0C93D6FF18C21CDAC4B6170DD89	21AFDCAE27345B403D5A3F92B6E6491BDC784653	823113963CA9249AF9C19815593344A05AEC2BB85F6AAA6EDEE914E2B6CE44AA
Chrome Cache Entry: 136	ASCII text, with very long lines (4918)	4823637838D1B4C2FEA531ABB3AFCCE1	898E97D64A51CA26B2824CAA2AD831F68705A441	4DE82973751E1A4E2996C44C92020C354FA7E5CA4D76EE1AE53A1425B9B628E4
Chrome Cache Entry: 137	ASCII text, with very long lines (15752)	B976B651932BFD25B9DDB5B7693D88A7	7FCB7CB5C11227F9213B1E08A07D0212209E1432	4E6CE5444C7F396CEF0EB1FA3611034151E485DD06FBE5573A5583E1EEBC98C3
Chrome Cache Entry: 138	ASCII text, with very long lines (10069)	19B95EE2269F49A3AA96A550F548D98B	F7E1B5D987DB7974CDC3A74CE53E9F3285E6ABA3	AC0C54BA0F76834FDA4621C42D0ACC752CD7500EF2B039AFD91A882E2AE54562
Chrome Cache Entry: 139	Unicode text, UTF-8 text, with very long lines (36419)	5FA33164A5E68ABCF75E51B6A29AC0F5	A23D1D5269FEC85EA8366F836D94CD2113B4802F	9616C2E19B686804FE1EFED0D503A3BE2F0BB6F909E31750E5D01D3377778437
Chrome Cache Entry: 140	C source, ASCII text, with very long lines (4014), with no line terminators	84CDF2AF726EA0AD5C67B7EC6479E363	BBA43108F022EAA28A7637C1ED7B7CB287D1691D	8A3820962C15D26C4CDC9EFF4F8C66ED29F96E353B7893285CB14962D6A6956D
Chrome Cache Entry: 141	ASCII text, with very long lines (31328)	2FEC937CAB990CE421DA1A2CFD88A4EC	390BB264F357F2115FA2DCA78000674128844A51	09B3633DA7ECB14FA7028F4D023C34ED5B4DEB93DE6C7EA03C83693C1CB0EB21
Chrome Cache Entry: 142	ASCII text, with very long lines (12876), with no line terminators	BCAD7781B3E74DB2565B8424C45232CD	41B0D94434EF667897C06E1184B703064FFCEDA1	D622534D53D3AC1095AF275F0B30274FCD835785577DF2DDE6D9398E6F7A2C8F
Chrome Cache Entry: 143	ASCII text, with very long lines (13785)	58D15C8061659EF77D42E8C5D3FF4984	4FEFB78331EE102E720C03A36265F3B286DF3457	709F60C4E7BE64193C1EFF6ACA024338E157DA87200E114E84B061BFED693F98
Chrome Cache Entry: 96	ASCII text, with very long lines (65496)	14AAE242012E8A0114CD278B66023400	C9E14F21772E08F065A5DF7988943070D08A4032	11A9015A1AA0195411CD9CF874386967BBA2F1E663403D7685ED16673DDAACE6
Chrome Cache Entry: 97	ASCII text, with very long lines (65447)	826EB77E86B02AB7724FE3D0141FF87C	79CD3587D565AFE290076A8D36C31C305A573D18	CB6F2D32C49D1C2B25E9FFC9AAAFA3F83075346C01BCD4AE6EB187392A4292CF
Chrome Cache Entry: 98	ASCII text, with very long lines (1572)	D2F4C92DB038787FDE54C44AC984C40C	EAA0E134343505681B1C76BDA9393329AC30432B	C2C8352EB0FDDA76CB1A3F19D958AEE2B88BAE4DB3B3F41CC75892493A856593
Chrome Cache Entry: 99	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1536x512, components 3	7BB3A4F9B14404E12FF1B819D9CDF344	5441DFE8D98D43BFA9960E62444871C0E15E002B	6D881E87E4467CEA670E8468944FB074C27F877485F773AFB146A73548237F9C

Windows Analysis Report
http://improvingpayments.com

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report http://improvingpayments.com

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
http://improvingpayments.com