Windows Analysis Report
https://in.xero.com/Kw5EivBbP7cI8mUewaIbiEH2de2DrArU8XaI2H1t

Overview

General Information

Sample URL:	https://in.xero.com/Kw5EivBbP7cI8mUewaIbiEH2de2DrArU8XaI2H1t
Analysis ID:	1432216

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Stores files to the Windows start menu directory

Classification

Signatures

Source: file:///C:/Users/user/Downloads/Invoice%20INV-0003.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/Invoice%20INV-0003.pdf	HTTP Parser: No favicon

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries

Source: unknown	HTTPS traffic detected: 40.126.29.15:443 -> 192.168.2.18:49694 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.29.15:443 -> 192.168.2.18:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.50.112.18:443 -> 192.168.2.18:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.204.76.112:443 -> 192.168.2.18:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.204.76.112:443 -> 192.168.2.18:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.18:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.18:49765 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.15
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.15
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.15
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.15
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.15
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.15
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.15
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.15
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.15
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.15
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.15
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.15
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.15
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.15
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.15
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.15
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.15
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.15
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.15
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.15
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.15
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.15
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.15
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.15
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.15
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.15
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.15
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.15
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.15
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.15
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.15
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.15
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.15
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.15
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.15
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.15
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.15
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.15
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.15
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.15
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.15
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.15
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.15
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.15
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.15
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.15
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.15
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.15
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.15
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.15

Source: global traffic	DNS traffic detected: DNS query: in.xero.com
Source: global traffic	DNS traffic detected: DNS query: edge.xero.com
Source: global traffic	DNS traffic detected: DNS query: js-agent.newrelic.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: bam.nr-data.net
Source: global traffic	DNS traffic detected: DNS query: product-analytics-bff.xero.com
Source: global traffic	DNS traffic detected: DNS query: widget.intercom.io
Source: global traffic	DNS traffic detected: DNS query: js.intercomcdn.com
Source: global traffic	DNS traffic detected: DNS query: api-iam.intercom.io
Source: global traffic	DNS traffic detected: DNS query: nexus-websocket-a.intercom.io
Source: global traffic	DNS traffic detected: DNS query: www.xero.com

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49694
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 49679 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Source: unknown	HTTPS traffic detected: 40.126.29.15:443 -> 192.168.2.18:49694 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.29.15:443 -> 192.168.2.18:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.50.112.18:443 -> 192.168.2.18:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.204.76.112:443 -> 192.168.2.18:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.204.76.112:443 -> 192.168.2.18:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.18:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.18:49765 version: TLS 1.2

Source: classification engine

Classification label: clean0.win@21/42@32/176

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\Chrome\Application\Dictionaries

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://in.xero.com/Kw5EivBbP7cI8mUewaIbiEH2de2DrArU8XaI2H1t
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 --field-trial-handle=1928,i,11331534210279989602,8350307251861396448,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 --field-trial-handle=1928,i,11331534210279989602,8350307251861396448,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.189.142	unknown	United States	15169	GOOGLEUS	false
172.253.123.84	unknown	United States	15169	GOOGLEUS	false
44.214.72.116	api-iam.intercom.io	United States	14618	AMAZON-AESUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
192.178.50.46	unknown	United States	15169	GOOGLEUS	false
34.199.118.93	unknown	United States	14618	AMAZON-AESUS	false
184.84.137.134	unknown	United States	16625	AKAMAI-ASUS	false
13.226.52.91	js.intercomcdn.com	United States	16509	AMAZON-02US	false
13.32.87.112	widget.intercom.io	United States	16509	AMAZON-02US	false
35.174.127.31	nexus-websocket-a.intercom.io	United States	14618	AMAZON-AESUS	false
142.250.64.195	unknown	United States	15169	GOOGLEUS	false
172.217.15.202	unknown	United States	15169	GOOGLEUS	false
34.237.73.95	unknown	United States	14618	AMAZON-AESUS	false
142.250.64.196	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
184.84.136.204	unknown	United States	16625	AKAMAI-ASUS	false
162.247.243.29	fastly-tls12-bam.nr-data.net	United States	13335	CLOUDFLARENETUS	false
162.247.243.39	js-agent.newrelic.com	United States	13335	CLOUDFLARENETUS	false
142.250.217.195	unknown	United States	15169	GOOGLEUS	false
23.34.204.146	unknown	United States	577	BACOMCA	false

Private

IP
192.168.2.18

Contacted Domains

Name	IP	Active
fastly-tls12-bam.nr-data.net	162.247.243.29	true
widget.intercom.io	13.32.87.112	true
js-agent.newrelic.com	162.247.243.39	true
www.google.com	142.250.64.196	true
api-iam.intercom.io	44.214.72.116	true
nexus-websocket-a.intercom.io	35.174.127.31	true
js.intercomcdn.com	13.226.52.91	true
in.xero.com	unknown	unknown
edge.xero.com	unknown	unknown
www.xero.com	unknown	unknown
bam.nr-data.net	unknown	unknown
product-analytics-bff.xero.com	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://in.xero.com/m/Kw5EivBbP7cI8mUewaIbiEH2de2DrArU8XaI2H1t	false		high
about:blank	false	Avira URL Cloud: safe	low
file:///C:/Users/user/Downloads/Invoice%20INV-0003.pdf	false	Avira URL Cloud: safe	low

ID:	1432216
Product:	CloudBasic
Start time:	17:33:40
Start date:	26.04.2024
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 14:34:39 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	D28FFF2C5D4A1E5246B446A52B25F01F	DF1DEE9AB140A51A8F3EF5462193C2979DEFF4F7	2EB19F1B64DB977196D15A6177AEC9E7CAF51424CA71E14FC70EF7CC4576495E
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 14:34:39 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	564BDA49C64F7C527385B3AC888BEBD5	327804DB2785321BC7FBC6DDCAA088F98701B8B2	F33FC36496EB39B50AD4738857160E8981D156E5DD3656CAA33A13AEB21FC23B
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 09:23:19 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	E4784067795B25917EB0B8086F138D93	E5608866AFB4D52FD8FA319D32E9F33542D58170	F1B4E9CD289F9C857FE73D485968338B29E75607439F3B8AA974E949894D7FAA
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 14:34:39 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	FA887054253BDCD363ABCB103EF7F6CC	BB88FDD20094F5F38B624F428E8B8F935A052CFD	5E5BAD633AAD1C434711A571889F92CDA061281AD73A55B0B88EC2A3F7493190
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 14:34:39 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	3ABAE8891AEEC398D89E7DD08B4ECDA9	BA709CE131CDF8AA5AA86A5F48F7C7C451C521D9	87C395900DBDE58CB0AD71A7DB00A9B035CDE21EEEFE1D400C890801D4612A70
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 14:34:38 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	0CBECFACDAEC81C2A0BB98D0DCDE2B01	00A61E5438F368017B8A614343CFEF5EEA7FBA6C	12D2DF47FBF49FE9DA5BC0BFE54A8DA141F50EDA15DA31DE94FAFF3BADEA9FDC
C:\Users\user\Downloads\75ff2734-d7c5-43d9-b1cd-c1b3dadcf477.tmp	PDF document, version 1.7, 0 pages (zip deflate encoded)	9C5F7491571A09AB1EFE0033B169DE36	1B32FF08FF8DBB49E4F8585275E16377E727308D	C6F8255D4E7F511A08CACA587E1379E033A957854422F3170D783A10D81521BE
C:\Users\user\Downloads\Invoice INV-0003.pdf (copy)	PDF document, version 1.7, 0 pages (zip deflate encoded)	98A43C5F782B63E79F28218C3FD4F9AA	09B0368742E7C8C5130F13CE7B4945BC664E4A24	55FBF41BD779E5A4C5BABE1E713C722978CC9DC92F408B873976E86092F77C46
C:\Users\user\Downloads\Invoice INV-0003.pdf.crdownload	PDF document, version 1.7, 0 pages (zip deflate encoded)	98A43C5F782B63E79F28218C3FD4F9AA	09B0368742E7C8C5130F13CE7B4945BC664E4A24	55FBF41BD779E5A4C5BABE1E713C722978CC9DC92F408B873976E86092F77C46
Chrome Cache Entry: 102	gzip compressed data, from Unix, original size modulo 2^32 6952	639100358138073092E32069F4CC78A8	3D232C0EEA72AA8397AAFC8AED2A92A8DD805B4A	C4342CEFDCAC64B85B860D16B96941B207B635E3EE9A1CEDC2BB04B998C9984D
Chrome Cache Entry: 103	RIFF (little-endian) data, Web/P image	032A0E2CAC13DFCA4A5AB55BDA676D7D	BAA4EAE01777B7EF91ECBE4DF00CE211976E8FCB	7BCE0A5C00B7A985D2D4DDDE3578D9D03F521DE9176D63DD6C5338428E7F7D8D
Chrome Cache Entry: 104	GIF image data, version 89a, 1 x 1	BC32ED98D624ACB4008F986349A20D26	2D3DF8C11D2168CE2C27E0937421D11D85016361	0C9CF152A0AD00D4F102C93C613C104914BE5517AC8F8E0831727F8BFBE8B300
Chrome Cache Entry: 105	gzip compressed data, from Unix, original size modulo 2^32 209926	BAECEFD335B4E7FCE271D6E3489A58A4	3E5D1AEAE080AC213A8ACC44475EB70908B8F0C1	3E5216C5C1ECD3EF1DF3F84A9D6E32B7FC14C80B577B0BE14D426462A9B3C798
Chrome Cache Entry: 106	MS Windows icon resource - 4 icons, 64x64, 32 bits/pixel, 32x32, 32 bits/pixel	C169AEE3C6F710672AE66CDB0AE20879	CAA44FB392A6427C7E5C22437137CB771E717C53	B5107D80D618E1824D266984E1673710D3A6D766E8B3997C52E1E271FB57FA49
Chrome Cache Entry: 107	ASCII text, with no line terminators	0FD044E0690466346D751E4995808B9C	F4AFB109DC3333A95E8D6A2E48619217E65E7880	132444277310C4E22412CB4DAA9F9083D838B90227FDAC830BF6E1D4960B4083
Chrome Cache Entry: 109	gzip compressed data, from Unix, original size modulo 2^32 493458	B27B573E6B04DAED0B4144A6E206BA93	026B3BC8B3F967D7096191718F9B999C06A090AF	70371467412BCA4624E5589F75D4A2BB10581E6C4C9CE9F2520AC9DA5A60DECF
Chrome Cache Entry: 110	ASCII text, with very long lines (65536), with no line terminators	1105FE9D55F7B1FFA83FE443D17E50A5	381D1FCC886D3E2913716EC2DF8234EE2B6F7C9A	F3AAFCDD874FFCEB23AAE3F737353CD9D1E419908A7D4096586200D483805854
Chrome Cache Entry: 111	JSON data	F447C440ABF2B8AF203938329FE494F8	3E071AE6400D84FB2EBE38EAEE60E1161D9F4556	11BBA994684E05187E8CB291F03254CE7810FB3EABBC900299F078F2E584550F
Chrome Cache Entry: 112	ASCII text, with very long lines (36028), with no line terminators	7682536729AD9EA1A4DC8E24F4C7568A	52E6D0BBA139CEAF735A3A328F3A458B1450DFC9	40F537631A8EA71038827C57D604891F13938A49F5208B495D587FCB48AE6B4E
Chrome Cache Entry: 113	Unicode text, UTF-8 text, with very long lines (65535), with no line terminators	F1293D9665CF5713B80B2FB0FAB4A84E	A8C21E2D2531F842F02B75A141B2123DF17C6A9D	573C961FFC4C9ED4FFD7693640512ABCD9A31736CFD49B3EAE812DFBDB3060DB
Chrome Cache Entry: 114	gzip compressed data, from Unix, original size modulo 2^32 35428	549D63DC73C5770CA6C7ACD1ABDEAAA1	FB9655A72C0F8CEA5DAB9693F1BF14048023AAE2	53BCEF9ED6F1D7D241585FF81D0B45E4251C7962EAE0E847088C21F9FA1C24CD
Chrome Cache Entry: 115	ASCII text, with very long lines (407), with no line terminators	F1177CF4443D3D19831B79C13D365B61	4518B7E08C72FB43F4BE7D171DF77C7D57D5AB92	32D732F37F9992244ED9C68825B52E26EF70378ADA1B95D954D73B6688004F0F
Chrome Cache Entry: 116	ASCII text, with very long lines (65453)	ABA8FC826404DB533BF4C65631596F3B	258161C0490B0E1283F364C1F6ABAF166363F4D3	B04BB5BE3BDD535A6B73CDD01C3EBF491CA36E8081CCB36062B6D3195ACFD7A9
Chrome Cache Entry: 117	HTML document, ASCII text, with very long lines (30711)	D88FA49A30FCCA22BFCE8C8BCC3EF6CE	7DE11E785E49A3CE3F9CD60D9E6FEE1A126ED8FC	1BA494196E649E05B9DA7D822EBB09919BCECA8870EB2E1D0DF23A72706AAA52
Chrome Cache Entry: 118	ASCII text, with very long lines (20730), with no line terminators	3303CAC12217337505CEB26EE9C5E199	B06CC32E27FF5FAB33A0AFE4D39FDEAE09ED6627	4E05E1D81B72C19B8310BCF3CC1EAACA9EF09CA8BB5DE3777A801724A02DB6C1
Chrome Cache Entry: 119	ASCII text, with no line terminators	708FD37768AAAC4FAC6B11B43BC538A3	A47D5B07394D4447EAFE830DBC6A4ACBCB40CF33	F2205C30AB0D0A86CD0D715CF483BAFD550C0EA9D4DDB24E2C182F1D7F024144
Chrome Cache Entry: 120	PNG image data, 16 x 16, 8-bit colormap, non-interlaced	B42CB6EDE27D2B5BE4F43C79AB30B9F3	152DE95E673E17E835D94B714555C76F91FD8F16	6F59F3FEDCC6D879B48025E6ABCCCCC0934818DBE3148419DBD8D62C7C744E75
Chrome Cache Entry: 124	ASCII text, with very long lines (65536), with no line terminators	2D6E56E859C536646B2F1A76684E2227	374864AE4D33D9F9CA6941DF489A4CEDC4A572F4	BAFADF9C618FB3D866385426D8AABCBDE2E9983CDC3961CCC2A676A7D1EE438A
Chrome Cache Entry: 125	PNG image data, 729 x 733, 8-bit colormap, non-interlaced	4B2AB93362B5F9558F994FDF12E3CA7C	F74E8BE1B8F85457ECDB8BDD8C9646D497257D4E	786ECD2A5D662201E7F7C7F829763E5B39166453C1C33B253CBF9FE306EE24D9
Chrome Cache Entry: 127	ASCII text, with very long lines (583), with no line terminators	A8CCD32EEAE2573B015B4AAC7604ED0E	8C9C97BEF485EDEA6E7752BEFFD4F3D8D51AA19E	29108B508F3E3A2258B5FF26CD876D31B87D7861DCD999190E083D25228C8AB7
Chrome Cache Entry: 128	ASCII text, with very long lines (34055), with no line terminators	ED99E2C2B7E432BF1B01B17E26FEA4F1	31B19A9F34FEF2D8C779585F4477CD05A6784FAA	C64B612E535BAE0B630160E4B0054682C16C475EE18FB18CB2ACF0E92ED99A84
Chrome Cache Entry: 129	gzip compressed data, from Unix, original size modulo 2^32 13268	C0A0EB66756DE21372EDD5E5F99F5DF9	258572978DE82EDAB428A2714B1553DA021089F1	22012BC0428674906B0B13E482EDD437CC4B755A28D11F5FB304BABB4499453C
Chrome Cache Entry: 131	ASCII text, with very long lines (26008), with no line terminators	83C0A3AE20BDB338DE5F1C32594E8A28	1BB16A48E3C00715C03F6DCCFDF886543F8C28AD	24C6667BF50AF02C957012F598C561091A1C690B70C154762B8116BA887081B4
Chrome Cache Entry: 133	ASCII text, with very long lines (65441)	AC5D2DD78C2C706051D4EA4C996067E6	DE2BAA3F5D167696C2EF23022CB8E4F494587608	7B105BBD4F52B5AB66D2C0745B07D532DA2CCBB201827DD5FAB66FBCFFFD6588
Chrome Cache Entry: 134	ASCII text, with very long lines (27878), with no line terminators	538BC8521EA5CAFCEB050579168EB232	5DEA89313A89AA9D67362E17A0B2E07247A8539F	C63B42C8BFA3C682C648D0F26D20373CB994B1A80503D4CED076383452440D2D
Chrome Cache Entry: 135	gzip compressed data, from Unix, original size modulo 2^32 528370	D8BF3AF29257E33695B238D38EC1FBA0	32C53F91F004E0FE480884E3DEEEC8B72604FB8F	DF99DBA4E58104F8E3978F48BF4A4FDF0DF1D75860BA60563D0A6BEB3C7496AB
Chrome Cache Entry: 136	ASCII text, with very long lines (32010)	63E2DF852D15AB21D7FF8FC4363222E8	7EE401BA652DB0A4EC960350E17216CDA01E22FB	545156ADEAE44DADC82B98D504F805EBE77FB79C928EF34EED1057BB9D4CB8FE
Chrome Cache Entry: 137	gzip compressed data, from Unix, original size modulo 2^32 705897	D625DB79DB383FDAEF04243566C4AFCE	602DD72D8ACE3CAF67935FADFA7DBB2F8124AC80	7F3046C46346778BB29417C58A123A51E6B192997660E5AA4315B84D5ECBC5C6
Chrome Cache Entry: 94	ASCII text, with very long lines (945)	64141792105EA4861F9F33294D65AB81	506D9100CAA070005A890BD496DE64C437D6D008	21758ED084CD0E37E735722EE4F3957EA960628A29DFA6C3CE1A1D47A2D6E4F7
Chrome Cache Entry: 95	JSON data	DBF59B15D4A5DA125703BB0B4DEAE4CB	E477DAEF93864DF9755235EEE88D9A03334478A7	6CED787E68E91549ABCC12B7BE268D4CF5270F4F923BA92D665A4D67BD8F87FF
Chrome Cache Entry: 96	ASCII text, with very long lines (4706)	8F464F6B465E1BD7C723319B980B0A94	485EA8FC56E26ECFF4BB20354C3998CEB64D6766	462EC91DA5F13557F7035D0BEB94E88EA21E41DD1576F1A5E1CA66CCE7FC6989
Chrome Cache Entry: 98	ASCII text, with very long lines (630)	D86DCDBFED4C273C4742744941259902	98089A33D0CF2FA4B3E1BA9B7EEB9B8BA0AC82A7	4B4969FA4EF3594324DA2C6D78CE8766FBBC2FD121FFF395AEDF997DB0A99A06
Chrome Cache Entry: 99	ASCII text, with very long lines (4310), with no line terminators	2782DE9EC7FDCFE821022097AC9E6D6F	0F59E00EAB261F0EF58853B7A84ABE6A95793E0D	9645F1A52935F4190AD95FEB58CB7FC31D29C7D949ABEB772EDF5C8BFEA1A397

Windows Analysis Report
https://in.xero.com/Kw5EivBbP7cI8mUewaIbiEH2de2DrArU8XaI2H1t

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report https://in.xero.com/Kw5EivBbP7cI8mUewaIbiEH2de2DrArU8XaI2H1t

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
https://in.xero.com/Kw5EivBbP7cI8mUewaIbiEH2de2DrArU8XaI2H1t