Windows Analysis Report
https://equifax.secure.virtru.com/start/?c=experiment&t=emailtemplate2019-09&s=WFADevOps%40equifax.com&p=ad830fe6-1ef5-467e-8767-71b894c7a923#v=3.0.0&d=https%3A%2F%2Fapi.virtru.com%2Fstorage%2Fapi%2Fpolicies%2Fad830fe6-1ef5-467e-8767-71b894c7a923%2Fdata%2Fmetadata&dk=zj5sd1RYE7oBWsww99m8Ub9Z49b3tl8d

Overview

General Information

Sample URL:	https://equifax.secure.virtru.com/start/?c=experiment&t=emailtemplate2019-09&s=WFADevOps%40equifax.com&p=ad830fe6-1ef5-467e-8767-71b894c7a923#v=3.0.0&d=https%3A%2F%2Fapi.virtru.com%2Fstorage%2Fapi%2Fp
Analysis ID:	1431857

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Stores files to the Windows start menu directory

Classification

Signatures

Source: https://equifax.secure.virtru.com/secure-reader/initial-loader	HTTP Parser: No favicon
Source: https://equifax.secure.virtru.com/secure-reader/initial-loader	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.16:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.16:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.16:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.16:49776 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157

Source: global traffic	DNS traffic detected: DNS query: equifax.secure.virtru.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: api.virtru.com
Source: global traffic	DNS traffic detected: DNS query: rum.browser-intake-datadoghq.com
Source: global traffic	DNS traffic detected: DNS query: api.amplitude.com

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49696
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 49696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.16:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.16:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.16:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.16:49776 version: TLS 1.2

Source: classification engine

Classification label: clean0.win@13/25@16/88

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://equifax.secure.virtru.com/start/?c=experiment&t=emailtemplate2019-09&s=WFADevOps%40equifax.com&p=ad830fe6-1ef5-467e-8767-71b894c7a923#v=3.0.0&d=https%3A%2F%2Fapi.virtru.com%2Fstorage%2Fapi%2Fpolicies%2Fad830fe6-1ef5-467e-8767-71b894c7a923%2Fdata%2Fmetadata&dk=zj5sd1RYE7oBWsww99m8Ub9Z49b3tl8dYxvfG%2BC1tHs%3D
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1976,i,5457600201943539609,7870095458948727040,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1976,i,5457600201943539609,7870095458948727040,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
34.160.98.162	static-gcp.virtru.com	United States	2686	ATGS-MMD-ASUS	false
3.233.153.122	alb-logs-http-rum-pub-s0-1171131448.us-east-1.elb.amazonaws.com	United States	14618	AMAZON-AESUS	false
142.250.105.138	unknown	United States	15169	GOOGLEUS	false
130.211.46.139	api-gcp.virtru.com	United States	15169	GOOGLEUS	false
44.239.44.141	unknown	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
64.233.177.103	www.google.com	United States	15169	GOOGLEUS	false
142.251.15.84	unknown	United States	15169	GOOGLEUS	false
142.250.9.94	unknown	United States	15169	GOOGLEUS	false
52.32.35.160	api.amplitude.com	United States	16509	AMAZON-02US	false
74.125.138.94	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16

Contacted Domains

Name	IP	Active
api-gcp.virtru.com	130.211.46.139	true
alb-logs-http-rum-pub-s0-1171131448.us-east-1.elb.amazonaws.com	3.233.153.122	true
static-gcp.virtru.com	34.160.98.162	true
api.amplitude.com	52.32.35.160	true
www.google.com	64.233.177.103	true
equifax.secure.virtru.com	unknown	unknown
rum.browser-intake-datadoghq.com	unknown	unknown
api.virtru.com	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://equifax.secure.virtru.com/secure-reader/initial-loader	false		high

ID:	1431857
Product:	CloudBasic
Start time:	21:48:59
Start date:	25.04.2024
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 18:49:27 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	EB011BD9A1AA7832F23F30C242FED248	8D9AE63EAB72CAC8628C23AF90253A4713DB0961	0DB722BA7909E8FCF6DF05261F6BD8089B61043479AD76593BDE8488F5640257
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 18:49:27 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	E753F51E69B8B1E009303D2F350A262B	4E1060BE70178E6CE0F0846ED90315B42FAC02A7	5FC486CB86C6A43A30B9671537CFF7A6C623A34C1956D4F3EF27C4DEAF016F2E
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	04DFC9084956180B83CBE7869B20EB58	4015995A735A3908B369F580616BCD710878618E	BC7029ADDAD4B5552EED53DD7EB9096BAD18E2B097168C11D3C64B5CF477E472
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 18:49:27 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	45CDE376D4E4B035A0AABCF270D61C49	F9EFC7642687E792B10C7F3A133E962D7F92B0B7	376EF7A2F0E57DDFFF3EFF9FF2F7094841B865B28FD9ECF6E15B969EF727EA70
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 18:49:27 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	716758D2DEBDE2C0C09C0DAB7646F9D6	3567A760A83F1512D6B20A1B272E72FC9E44AC23	DBFA6DC86A77E27340BDD6E1860A2FAE0840A96D795E74233F719060848371EF
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 18:49:27 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	BF0A7EEAA99D641D55B8F25B8558E980	03EA3D192BAB6BF7070B448B725A2DDBC83A49E2	E24FA126A6A9657DCF25608FC6A849869504BA093096C4445D7EA12A30B82A36
Chrome Cache Entry: 70	ASCII text, with very long lines (29186)	F64F85BC0413453773899BB055F10AAF	CA73826494AC1A82A0F826A59580B0D7EBFBEA2E	0454CEAD2E524C23DAE6A6E5A1D1A695EE721789241B919FB4B4B9D3A50E6A6D
Chrome Cache Entry: 71	ASCII text, with no line terminators	E1B468C52D580BB0C563F7DDAC593474	D41AF16632A19F7BEB11A6471387F576EB3D3BA7	179F1CEA3A0D7D6A99E2A7C10A0B27AE9831C71978051A3EDB0743203DA8C10A
Chrome Cache Entry: 72	ASCII text, with very long lines (54527), with no line terminators	8FCC638D03AB732103B0F2767676B1B5	1E93F857FAEA1D1BC15C59149E27D628308EA2C6	F35C1E0F3A509F0EA022D277B957EEEF07CCD3BD63C997C13625338AD892E645
Chrome Cache Entry: 74	ASCII text, with very long lines (3671)	28B3CD7D4C7196F6EDAFA232CBD32797	6B4B178D67937C6966E752E0A56C325D6DCCFC21	15D823B10278A49249DDD25B901116994A322163482A66846A4A671B92B5DA6A
Chrome Cache Entry: 75	PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced	2B4CB92F976837DBB0F7F07BD78653D8	B2CE2C78F1AA730E9FE06E40372100B294E90EDF	2364AC34D390B125F4A0B83DADA45C0FA3A1B21AF1CE3ACF0DABE0B7DCE9A54A
Chrome Cache Entry: 76	Web Open Font Format (Version 2), TrueType, length 29496, version 3.0	0FB1ACB9CECCFF4D6F268D9F250AD869	336CC8BA85028400CE05755721F804D880BF0376	AB6BBCB407D72C0CD61ED9443258CA444218F51F6888AC5B4A348BA1A47A636F
Chrome Cache Entry: 78	Web Open Font Format (Version 2), TrueType, length 18520, version 1.6619	D7E772D9CED800743BAF55C89775FE36	D9C4E30B48DEB99F4D1729D708A6B8B9CBEC2ACD	FDD0E0F871A88EDAE3D5354B5DF7963F2E1DE8220F488B486599EEBA9C3375AF
Chrome Cache Entry: 79	SVG Scalable Vector Graphics image	D1EC2AD747082FCA617EECD4E566AF30	E9DC23258086D4320D0A16C3FD96794A8C468B6F	55FE0CA09C9529BCDC4DD2D69548C9FE3C47DBB1421A7AF192AC0B5949A7A8F8
Chrome Cache Entry: 80	ASCII text, with very long lines (507)	F565AF8EC9641F9456FD4205B0B4E96B	BD93EDFE68E062EDBBAF7176EA6378E527511E24	FE7E0E7467E8632B55B775142FE136580FA68F97C5993624E63A5FB1045BE997
Chrome Cache Entry: 82	data	DBB91F33C54A06B06235190964E71805	3A4F461B21F2D90513AEBD8925B09AB355A9CA66	D6AB0072E95F055A818D8F7851E5A2A8E6DF3E96A43D5BE6A8DDEE8731E3CDDA
Chrome Cache Entry: 83	Web Open Font Format (Version 2), TrueType, length 17780, version 1.0	84E180D228A5B965D875DFBDC927585D	BB019E6460C5B982ECDB77FB5D2D1474078AB889	D094038EC1D1EFDC963CA50983AECD020850172AC5A1788DE0109A97C3EA4B8B
Chrome Cache Entry: 84	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced	BAC74ED9FEA111B59DAD625F896D45FB	92E271374B61DF20E9ADC7F16A3ADE55AEE84EC2	E03C98224E2F2A54FEDBC1BB893CEB5D74813DD4A5059691717C853D966C4885
Chrome Cache Entry: 87	Web Open Font Format (Version 2), TrueType, length 29500, version 1.0	E401CA1A904C9D6106463C9D1C6504CB	C310F6CC3E71105966A88B94BD4712949071FF23	AE4062D312ECC61F8304F4F54B6B5086478DA465FCBBEBA7BDB7CCF1D43A3DC5
Chrome Cache Entry: 88	ASCII text, with very long lines (2410), with no line terminators	6309C5370D0A08498FFDC6D0075A9C88	5AA61DE4001E772244835735A8879B9D97117BFB	F9E722CBF849616CD0CFF51DC6659A338179F2BEB6BBE31357FA1AE598FAD1B3
Chrome Cache Entry: 90	ASCII text, with very long lines (19783)	E3F60FD31BB1CC4A7DF1AFF7608B8535	4C604099EFC7A46D39A7DDE49FF2BAC52EDBAB03	F3129CA7ACC922F43FC3B273961BDD2DD0434F94B0E6C6C0678EE062B5FB06B6
Chrome Cache Entry: 92	SVG Scalable Vector Graphics image	9EF91386798C6ABB4602C619F5EDA683	7C230774B15881473A05EB12C792723FAE6F9301	15BB1D6258B54F62DB530F3593AF554DC144EC781C13FBCA041CBF033F2E8C6B
Chrome Cache Entry: 93	Unicode text, UTF-8 text, with very long lines (65470)	A7066401D0A02EB97B43C5B3E8E9CF46	7E465471ED4DD0B056358483573FED5B11291D34	1FF8AE21FB33FF55C33C930E9C9604624E020F17DB0ACCD31473603DFF1EEC94
Chrome Cache Entry: 94	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel	2CFA2C928C0659D098B57E7E4FE8CF41	4E2D4440AE5B7843172BBF646AFEDEDDD69A8F0E	4E6D777AF1F5B3BEB973A4CEC2E1DAC00BC1DFFB7F797AAA71B3B4BC5E5164C3
Chrome Cache Entry: 95	Unicode text, UTF-8 text, with very long lines (28162), with no line terminators	0CF82A0336D612CDDA6B71C44F03D069	490E13BA49AE932D29B3218766B32C23CFF2ED18	9C67BF758CF68B031501F76051E074B6A7B3466B978D92037F12F9A10AA195E3

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs