Windows Analysis Report
https://us-west-2.protection.sophos.com/?d=venmo.com&u=aHR0cHM6Ly92ZW5tby5jb20vc2lnbnVwL3N0YXJ0P2VtYWlsPW5vcmVwbHkxMSU0MHdxZXJkZmQub25taWNyb3NvZnQuY29tJmludml0ZV9pZD02NjJhNzViZTNjYWMxN2E3MGE5OTA0ZmEmbnI9MSZ1dG1fbWVkaXVtPWVtYWlsJnV0bV9zb3VyY2U9cG51&p=m&i=NjI3Mjc4OTk0MGU3YTAxM2U2ZWIxMDY3&t=RTdyMWVwN0l

Overview

General Information

Sample URL:	https://us-west-2.protection.sophos.com/?d=venmo.com&u=aHR0cHM6Ly92ZW5tby5jb20vc2lnbnVwL3N0YXJ0P2VtYWlsPW5vcmVwbHkxMSU0MHdxZXJkZmQub25taWNyb3NvZnQuY29tJmludml0ZV9pZD02NjJhNzViZTNjYWMxN2E3MGE5OTA0ZmEmb
Analysis ID:	1432118

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Stores files to the Windows start menu directory

Classification

Signatures

Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.17:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.193.120.112:443 -> 192.168.2.17:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.193.120.112:443 -> 192.168.2.17:49790 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.17:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.29.10:443 -> 192.168.2.17:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.50.112.60:443 -> 192.168.2.17:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49795 version: TLS 1.2

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 29MB

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: us-west-2.protection.sophos.com
Source: global traffic	DNS traffic detected: DNS query: venmo.com
Source: global traffic	DNS traffic detected: DNS query: account.venmo.com
Source: global traffic	DNS traffic detected: DNS query: www.paypalobjects.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: jssdkcdns.mparticle.com
Source: global traffic	DNS traffic detected: DNS query: identity.mparticle.com
Source: global traffic	DNS traffic detected: DNS query: cdn.optimizely.com
Source: global traffic	DNS traffic detected: DNS query: c.paypal.com
Source: global traffic	DNS traffic detected: DNS query: www.paypal.com
Source: global traffic	DNS traffic detected: DNS query: c6.paypal.com
Source: global traffic	DNS traffic detected: DNS query: b.stats.paypal.com
Source: global traffic	DNS traffic detected: DNS query: t.paypal.com
Source: global traffic	DNS traffic detected: DNS query: lvs.stats.paypal.com
Source: global traffic	DNS traffic detected: DNS query: id.venmo.com
Source: global traffic	DNS traffic detected: DNS query: jssdks.mparticle.com

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49690
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49690 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.17:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.193.120.112:443 -> 192.168.2.17:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.193.120.112:443 -> 192.168.2.17:49790 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.17:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.29.10:443 -> 192.168.2.17:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.50.112.60:443 -> 192.168.2.17:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49795 version: TLS 1.2

Source: classification engine

Classification label: clean0.win@16/28@54/291

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://us-west-2.protection.sophos.com/?d=venmo.com&u=aHR0cHM6Ly92ZW5tby5jb20vc2lnbnVwL3N0YXJ0P2VtYWlsPW5vcmVwbHkxMSU0MHdxZXJkZmQub25taWNyb3NvZnQuY29tJmludml0ZV9pZD02NjJhNzViZTNjYWMxN2E3MGE5OTA0ZmEmbnI9MSZ1dG1fbWVkaXVtPWVtYWlsJnV0bV9zb3VyY2U9cG51&p=m&i=NjI3Mjc4OTk0MGU3YTAxM2U2ZWIxMDY3&t=RTdyMWVwN0ltVWFjZ3cvWmVHNTRWVkd1STQwUzVVNzEveWYyR0FYYXVhMD0=&h=4ce9b067fcbf486e8f27561ce3d3058e&s=AVNPUEhUT0NFTkNSWVBUSVaS8c9jSpZcrH9uvMBTWALM8OUVCaCMDIwUwmubUWsN9g
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1896,i,4217535207556734444,15616684847690701236,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1896,i,4217535207556734444,15616684847690701236,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
151.101.130.133	mparticle.map.fastly.net	United States	54113	FASTLYUS	false
52.84.150.50	venmo.com	United States	16509	AMAZON-02US	false
151.101.1.35	paypal-dynamic-2.map.fastly.net	United States	54113	FASTLYUS	false
142.250.217.238	unknown	United States	15169	GOOGLEUS	false
142.250.64.232	unknown	United States	15169	GOOGLEUS	false
35.235.122.5	stats.glb.paypal.com	United States	15169	GOOGLEUS	false
151.101.65.35	dualstack.paypal-dynamic-2.map.fastly.net	United States	54113	FASTLYUS	false
151.101.129.35	unknown	United States	54113	FASTLYUS	false
142.251.35.238	unknown	United States	15169	GOOGLEUS	false
99.84.252.10	d2t07dpvw9bt1v.cloudfront.net	United States	16509	AMAZON-02US	false
172.217.3.67	unknown	United States	15169	GOOGLEUS	false
151.101.66.133	jssdkcdns.mparticle.com	United States	54113	FASTLYUS	false
151.101.194.133	paypal.map.fastly.net	United States	54113	FASTLYUS	false
151.101.193.21	paypal-dynamic.map.fastly.net	United States	54113	FASTLYUS	false
192.178.50.67	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
23.37.16.196	unknown	United States	9299	IPG-AS-APPhilippineLongDistanceTelephoneCompanyPH	false
142.250.217.206	unknown	United States	15169	GOOGLEUS	false
151.101.1.21	unknown	United States	54113	FASTLYUS	false
108.177.11.84	unknown	United States	15169	GOOGLEUS	false
52.84.150.58	unknown	United States	16509	AMAZON-02US	false
52.84.150.34	account.venmo.com	United States	16509	AMAZON-02US	false
142.250.64.196	www.google.com	United States	15169	GOOGLEUS	false
142.250.217.174	unknown	United States	15169	GOOGLEUS	false
151.101.129.21	unknown	United States	54113	FASTLYUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
184.84.136.157	unknown	United States	16625	AKAMAI-ASUS	false

Private

IP
192.168.2.17

Contacted Domains

Name	IP	Active
mparticle.map.fastly.net	151.101.130.133	true
paypal.map.fastly.net	151.101.194.133	true
dualstack.paypal-dynamic-2.map.fastly.net	151.101.65.35	true
paypal-dynamic-2.map.fastly.net	151.101.1.35	true
account.venmo.com	52.84.150.34	true
paypal-dynamic.map.fastly.net	151.101.193.21	true
jssdks.mparticle.com	151.101.194.133	true
d2t07dpvw9bt1v.cloudfront.net	99.84.252.10	true
venmo.com	52.84.150.50	true
www.google.com	142.250.64.196	true
jssdkcdns.mparticle.com	151.101.66.133	true
stats.glb.paypal.com	35.235.122.5	true
lvs.stats.paypal.com	35.235.122.5	true
c.paypal.com	unknown	unknown
us-west-2.protection.sophos.com	unknown	unknown
c6.paypal.com	unknown	unknown
b.stats.paypal.com	unknown	unknown
id.venmo.com	unknown	unknown
www.paypal.com	unknown	unknown
cdn.optimizely.com	unknown	unknown
identity.mparticle.com	unknown	unknown
t.paypal.com	unknown	unknown
www.paypalobjects.com	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://c.paypal.com/v1/r/d/i?js_src=https://c.paypal.com/da/r/fb.js	false		high

ID:	1432118
Product:	CloudBasic
Start time:	14:22:14
Start date:	26.04.2024
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 11:23:23 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	510F4B906112460DE37F561630FC99E5	C5D8821DA272C746BBFB29845AD6DD858BDAF07C	7B868A37CAF8E10CBCBFD91AB708EBAF5DAC1DC9DD6F3CC214F9CB7AB5C34DAB
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 11:23:23 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	59EC3024B46CFF2BEB2DE8F89E96672D	30879FCC3DA8359AC6DC74706B6D1CE3B1AD5BE5	EB03679045C98B319649E437A9F4922F7706E967EE1560EBFD8613E6B562193F
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:54:41 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	EF30A6430FA0FC0B4F5D6C469BC3230F	1D2F2A331EE512A613F6543566A97759E5C0B631	C2358AC6673EA7E2D1F7B2DD64FEFF324B99EEFD358720DFCC2CC61BB6B90733
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 11:23:23 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	750C335E79E8ABCD8085064B2436C16C	61726E90517F34E6919AC9C01A482E20400550ED	66B7C00DEC186225483090B679835EBAAD9F71139E880151F26B8402CB34E5C2
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 11:23:23 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	3C6414189DCAFA8C4C2B66FFB7858CBA	860CE87B1A33CAFEDE97880ADEF0B1E984A4F0B2	6CB152EDF80A3DAB282E8827C18CCE13FA2436A32809DB1F7BACAAFB63156CD6
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 11:23:23 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	6790A56E92CCEA103C50B97C34E0C03F	D8730AFC9DE6EE99A2921DAA94C41A0F8458A8CC	6EF69E7A13AF42C3EB9B91E16DEB087D7E4D52C61019EEF465809D8E7AEF30B5
Chrome Cache Entry: 100	ASCII text, with very long lines (949)	BB949FBFF809E012431A4D973F485663	4A65C8B167A60C1DFA239D12B83F2113F7DD5CE0	E8AC132CC09DF55E9FBAC5921CC5817BF204D150653B381802DD31A89FC86A99
Chrome Cache Entry: 101	ASCII text, with very long lines (63869)	8C15583A4A43453584F560A54AD69AC5	EE1F186FBBA965DFBAD41B3D25DAB20C7C29008B	E69E6074B3E838A4BBEB4A20F2A96E77BE67703EA606415AEDEE2FA073B634C4
Chrome Cache Entry: 102	GIF image data, version 89a, 1 x 1	ACCBA0B69F352B4C9440F05891B015C5	9D01CC5DC8E042C0D4AD6CFB8B3AC38E84A5EF9F	47043E4823A6C21A8881DE789B4185355330B5804629D23F6B43DD93F5265292
Chrome Cache Entry: 103	ASCII text, with very long lines (38457)	3867690CF65CF9B04E72472455F34CF9	6972D67129AB146E710023E97F8343DFF85AFC83	A70DAA1ECB6FDD37C71466675790D54B8BB70227CD2E397DB7EBCDE9D1432FB9
Chrome Cache Entry: 104	ASCII text	F95326881ACA6EE557D3D5D8A669A8B5	BFBB8C936C2556086BBAF75F76B6B4AC5248F2A9	A5FBBC45491760741144B2D841B6CFC6A44719B155039C439AD74338B2F4346E
Chrome Cache Entry: 106	JSON data	76538B7BF4E06AC0EDBAE9D664B5AFD1	0FE395FA5D13A1FD867EB1E6BE152B8EE3431DDF	04DA9656E4EF637A466F9A1F4C9B3465F0A742190E062B356E3ED2339BA5DDDD
Chrome Cache Entry: 107	ASCII text, with very long lines (4559)	F436A7577063FA3DE7C4DA91B1098377	3F0F986B1218B6BF06E0B0C5D35BE5EBBEA42FFF	7B3DC2FE8CE9887A750BCEAB72DDB8EAA2DB8EF82B25DF6C72B0628206E15FD1
Chrome Cache Entry: 108	Unicode text, UTF-8 text, with very long lines (4450)	F9E2C1C1A5C489B8F9DDE34DE4A11B7A	5FB687488956C6E783C5732389EFDA7D9E60C71D	5055DBDA3413C24C4343563770493B6AC16B5B4417B298197F51F60D1C5BF091
Chrome Cache Entry: 109	ASCII text, with very long lines (5762)	37AADB605A5073402B4D4348108821FC	D6A53322D1CE7C096A16907CC42D623507A6DFE7	C00273097FCC653A04461C4BAF69C033C96DD9098C77AF0A3BE8E4F96EEDCC04
Chrome Cache Entry: 110	ASCII text, with very long lines (4179)	CFE352A1B01DCDB79125FEFDB5704CBD	D96020F449DD600D743FD641D2449CF021F4AFBD	5F4D5AF7FEDB938E714BC4485E0EC22AFCB5F690BD674A4634D40ADE0CD1201E
Chrome Cache Entry: 111	ASCII text, with very long lines (2343)	575B5480531DA4D14E7453E2016FE0BC	E5C5F3134FE29E60B591C87EA85951F0AEA36EE1	DE36E50194320A7D3EF1ACE9BD34A875A8BD458B253C061979DD628E9BF49AFD
Chrome Cache Entry: 112	ASCII text, with very long lines (4179)	BFC361530DBA64EB326EA8A1ABA5FA05	7DBD1BC74EFAD2F558925EDE6C2651966453CD7C	54B5012EC2E5E9BE5DDACF97AEBAB981D62915B48558E74D911EDD86B198167A
Chrome Cache Entry: 113	ASCII text, with very long lines (461)	CA89A6EBA361A01B47C6FD3283A76A03	6EFD22AB0D4BD4C801A062A60135C5C524B34EF0	EA6951F25B736EFF00E9D62AB99414EA0956F4350389337EC2DFE8C0284D72EA
Chrome Cache Entry: 114	ASCII text, with very long lines (36413), with no line terminators	C49C6FA73F057CE06A4316A972F1C2D8	B6FA8F33CD86D1495ADF8EA73898A94BD09B193A	8B340B5D80A2189043370D26C3FD88767FE0E237BA13E60CDB3BAC0C22E87474
Chrome Cache Entry: 116	Web Open Font Format (Version 2), CFF, length 25368, version 1.6553	186B9E5BE0671C3C941A2A4966BEB47A	0255BF2F48460EB212C93242740F5BEF01E858C4	1F70FF447ED799A34F4C3AE37EF1F49ED4AF71123BA2C2AEFE354565354284BE
Chrome Cache Entry: 117	ASCII text, with no line terminators	E2A244D69BD948F5AA1E6AABCE97E635	15C84419D83DA9B0F33989D85CDCB0138EC469E2	94F95366B3F5664D687C03C7E150B70AD8DA3222FA4554303224C5B1530BEC1F
Chrome Cache Entry: 93	Unicode text, UTF-8 text, with very long lines (318)	3AD1FA5B0F1C4A72D44414C819B16620	A15A051F27E9F6DEA5666D845227E6FAC541CCE1	EB76C0E09E9360F7A76D746D302F5FFE738AB07C19E52733C96568A704B3F5DD
Chrome Cache Entry: 94	Unicode text, UTF-8 text, with very long lines (844)	FC23723EC305F9E4751AFC58788A4D65	1260BE3CEC21DD05C92FAFFD93B426E473871D49	3F695DBDA1C4CD16F1EAAD764AF783B68AA0D0341E95FD2F9FA8044548E56690
Chrome Cache Entry: 95	ASCII text, with very long lines (15682)	CF41C5FE4E6A62FFDEEBBDDFA7D2B31F	BD1E5481A6F37D0D0DA3F4CEFC0E0FE466390108	ACE6EC7F9C0A5226393D6961425B6D63D580B3827DCCDD69193FEE1F61242A76
Chrome Cache Entry: 96	ASCII text	13BCEEEAF84DF39CC5FBBDDF19B3D3FB	499E4B12C5B8F8DBFA0A73B46E996817545F4AD4	4673C229C2C1D356B98C232C599AFDB44C85E7279C63C3EF962B4BA677378BA9
Chrome Cache Entry: 98	ASCII text, with very long lines (353), with no line terminators	93BE6D757F28230900FD2FFB4091E349	98FE6DA7DBB0EAC7B1D05D12C7257F99758543AB	D0675FEF3CE35AD654F94CC2B675DE2729BD86874EC0A912FEC89575700513C5
Chrome Cache Entry: 99	ASCII text, with very long lines (949)	B8F6588A6C12A45D1EBCA50D8946867F	307BE0069AD62C4A4D9FF259E0BD248AC388E7CE	BEFC6E3B96F5E0B03333722A81D84F4C266C40A5BBF25B49E4DBF94EECEC29D2

Overview

General Information

Detection

Signatures

Classification

Signatures

Compliance

Software Vulnerabilities

Networking

System Summary

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs