Windows Analysis Report
https://agattu.plix.ai/u?mid=6601ae2964c7bd00071c13cd

Overview

General Information

Sample URL:	https://agattu.plix.ai/u?mid=6601ae2964c7bd00071c13cd
Analysis ID:	1416058
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Classification

Signatures

Source: https://agattu.plix.ai/u?mid=6601ae2964c7bd00071c13cd	HTTP Parser: No favicon
Source: https://agattu.plix.ai/u?mid=6601ae2964c7bd00071c13cd	HTTP Parser: No favicon
Source: https://agattu.plix.ai/u?mid=6601ae2964c7bd00071c13cd	HTTP Parser: No favicon

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49731 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 23.221.242.90:443 -> 192.168.2.5:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.221.242.90:443 -> 192.168.2.5:49723 version: TLS 1.2

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49731 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /u?mid=6601ae2964c7bd00071c13cd HTTP/1.1Host: agattu.plix.aiConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/unsubscribe-ui.js HTTP/1.1Host: assets.apollo.ioConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://agattu.plix.aisec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://agattu.plix.ai/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/bundle-app-production-8015-a4a05b611c31fdf0ac15.js HTTP/1.1Host: assets.apollo.ioConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://agattu.plix.ai/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/bundle-app-production-7012-2a61c6ae5d188b6c9911.js HTTP/1.1Host: assets.apollo.ioConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://agattu.plix.ai/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/bundle-app-production-8627-07fdd6b2e595c0888e76.js HTTP/1.1Host: assets.apollo.ioConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://agattu.plix.ai/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: agattu.plix.aiConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://agattu.plix.ai/u?mid=6601ae2964c7bd00071c13cdAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: X-CSRF-TOKEN=fcZtoND_CpTzUM1DY40SoF3I-HkfnqFAofsXMIwZ7vW9V3UvxaSKDEyYChry6sXRa7GJBcaPFVad_phs9nAQ2A; _leadgenie_session=TRUFgtWpIU75SU%2FoCHHs89PS81pXQcweoa%2F3Cc2FYMjybTkCZ67q9pba9vrnmBYSdv%2F%2FSvFnK1YUXVudHCNkMQ9WPD3BJF3ZExUlJ1d569gcZM1fOAG2HATlGJigbdL2xavLd9QodvZCj6na6232cve9UfNzqD7QLHS8uqHa241ezy1Q2%2BOBTFE3D%2BKvzfp2Zo8h2R2vOWY5cRymM%2Fu8a7vFplYR2lq%2FzL3lTBMLFrTmhPOnoIaw7QfZsfM3WmPSspEtLkrml5wFauEOjKEMCcKoIvG071wmb80%3D--%2Bw4stxH18yyMcNAR--BDp4AkvtU3DFBJZC5HwbEA%3D%3D; GCLB=CJ2F0dvQtYH3rAEQAw
Source: global traffic	HTTP traffic detected: GET /nr-spa-1.253.0.min.js HTTP/1.1Host: js-agent.newrelic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://agattu.plix.aisec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://agattu.plix.ai/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: agattu.plix.aiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: X-CSRF-TOKEN=fcZtoND_CpTzUM1DY40SoF3I-HkfnqFAofsXMIwZ7vW9V3UvxaSKDEyYChry6sXRa7GJBcaPFVad_phs9nAQ2A; _leadgenie_session=TRUFgtWpIU75SU%2FoCHHs89PS81pXQcweoa%2F3Cc2FYMjybTkCZ67q9pba9vrnmBYSdv%2F%2FSvFnK1YUXVudHCNkMQ9WPD3BJF3ZExUlJ1d569gcZM1fOAG2HATlGJigbdL2xavLd9QodvZCj6na6232cve9UfNzqD7QLHS8uqHa241ezy1Q2%2BOBTFE3D%2BKvzfp2Zo8h2R2vOWY5cRymM%2Fu8a7vFplYR2lq%2FzL3lTBMLFrTmhPOnoIaw7QfZsfM3WmPSspEtLkrml5wFauEOjKEMCcKoIvG071wmb80%3D--%2Bw4stxH18yyMcNAR--BDp4AkvtU3DFBJZC5HwbEA%3D%3D; GCLB=CJ2F0dvQtYH3rAEQAw
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /1/f318cdbaae?a=127348941&v=1.253.0&to=dwoPEBZaCQgDR01QQl1KF1VLUAgFD1kHQ21ZABIXBVIAOwNDB19GR0oTAQpRABY5UA9QW1g6FAoXQAcXBUcLU1c%3D&rst=4125&ck=0&s=b100e2003efc3156&ref=https://agattu.plix.ai/u&hr=0&af=err,xhr,stn,ins,spa&ap=11&be=909&fe=2284&dc=1223&fsh=1&perf=%7B%22timing%22:%7B%22of%22:1711478954827,%22n%22:0,%22f%22:4,%22dn%22:325,%22dne%22:325,%22c%22:325,%22s%22:326,%22ce%22:616,%22rq%22:616,%22rp%22:910,%22rpe%22:1163,%22di%22:1183,%22ds%22:2132,%22de%22:2132,%22dc%22:3189,%22l%22:3189,%22le%22:3193%7D,%22navigation%22:%7B%7D%7D&fp=2245&fcp=3268 HTTP/1.1Host: bam.nr-data.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/bundle-app-production-7977-3598acce02a7abed456a.js HTTP/1.1Host: assets.apollo.ioConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://agattu.plix.ai/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: unknown

DNS traffic detected: queries for: agattu.plix.ai

Source: unknown

HTTP traffic detected: POST /1/f318cdbaae?a=127348941&v=1.253.0&to=dwoPEBZaCQgDR01QQl1KF1VLUAgFD1kHQ21ZABIXBVIAOwNDB19GR0oTAQpRABY5UA9QW1g6FAoXQAcXBUcLU1c%3D&rst=4125&ck=0&s=b100e2003efc3156&ref=https://agattu.plix.ai/u&hr=0&af=err,xhr,stn,ins,spa&ap=11&be=909&fe=2284&dc=1223&fsh=1&perf=%7B%22timing%22:%7B%22of%22:1711478954827,%22n%22:0,%22f%22:4,%22dn%22:325,%22dne%22:325,%22c%22:325,%22s%22:326,%22ce%22:616,%22rq%22:616,%22rp%22:910,%22rpe%22:1163,%22di%22:1183,%22ds%22:2132,%22de%22:2132,%22dc%22:3189,%22l%22:3189,%22le%22:3193%7D,%22navigation%22:%7B%7D%7D&fp=2245&fcp=3268 HTTP/1.1Host: bam.nr-data.netConnection: keep-aliveContent-Length: 0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36content-type: text/plainAccept: */*Origin: https://agattu.plix.aiSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://agattu.plix.ai/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: chromecache_77.2.dr

String found in binary or memory: https://assets.apollo.io/js/unsubscribe-ui.js

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	HTTPS traffic detected: 23.221.242.90:443 -> 192.168.2.5:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.221.242.90:443 -> 192.168.2.5:49723 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@16/24@14/7

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2520 --field-trial-handle=2020,i,3268176836136726466,13000087644650507593,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://agattu.plix.ai/u?mid=6601ae2964c7bd00071c13cd"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2520 --field-trial-handle=2020,i,3268176836136726466,13000087644650507593,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
34.102.205.190	assets.apollo.io	United States	15169	GOOGLEUS	false
172.253.122.104	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
162.247.243.29	fastly-tls12-bam.nr-data.net	United States	13335	CLOUDFLARENETUS	false
34.28.233.175	aplolinks.com	United States	2686	ATGS-MMD-ASUS	false
162.247.243.39	js-agent.newrelic.com	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.5

Contacted Domains

Name	IP	Active
aplolinks.com	34.28.233.175	true
fastly-tls12-bam.nr-data.net	162.247.243.29	true
assets.apollo.io	34.102.205.190	true
js-agent.newrelic.com	162.247.243.39	true
www.google.com	172.253.122.104	true
fp2e7a.wpc.phicdn.net	192.229.211.108	true
bam.nr-data.net	unknown	unknown
agattu.plix.ai	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://assets.apollo.io/js/bundle-app-production-8015-a4a05b611c31fdf0ac15.js	false	Avira URL Cloud: safe	unknown
https://assets.apollo.io/js/bundle-app-production-7977-3598acce02a7abed456a.js	false	Avira URL Cloud: safe	unknown
https://js-agent.newrelic.com/nr-spa-1.253.0.min.js	false		high
https://assets.apollo.io/js/unsubscribe-ui.js	false	Avira URL Cloud: safe	unknown
https://assets.apollo.io/js/bundle-app-production-7012-2a61c6ae5d188b6c9911.js	false	Avira URL Cloud: safe	unknown
https://bam.nr-data.net/1/f318cdbaae?a=127348941&v=1.253.0&to=dwoPEBZaCQgDR01QQl1KF1VLUAgFD1kHQ21ZABIXBVIAOwNDB19GR0oTAQpRABY5UA9QW1g6FAoXQAcXBUcLU1c%3D&rst=4125&ck=0&s=b100e2003efc3156&ref=https://agattu.plix.ai/u&hr=0&af=err,xhr,stn,ins,spa&ap=11&be=909&fe=2284&dc=1223&fsh=1&perf=%7B%22timing%22:%7B%22of%22:1711478954827,%22n%22:0,%22f%22:4,%22dn%22:325,%22dne%22:325,%22c%22:325,%22s%22:326,%22ce%22:616,%22rq%22:616,%22rp%22:910,%22rpe%22:1163,%22di%22:1183,%22ds%22:2132,%22de%22:2132,%22dc%22:3189,%22l%22:3189,%22le%22:3193%7D,%22navigation%22:%7B%7D%7D&fp=2245&fcp=3268	false	Avira URL Cloud: safe	unknown
https://assets.apollo.io/js/bundle-app-production-8627-07fdd6b2e595c0888e76.js	false	Avira URL Cloud: safe	unknown
https://bam.nr-data.net/events/1/f318cdbaae?a=127348941&v=1.253.0&to=dwoPEBZaCQgDR01QQl1KF1VLUAgFD1kHQ21ZABIXBVIAOwNDB19GR0oTAQpRABY5UA9QW1g6FAoXQAcXBUcLU1c%3D&rst=15276&ck=0&s=b100e2003efc3156&ref=https://agattu.plix.ai/u&hr=0	false	Avira URL Cloud: safe	unknown
https://agattu.plix.ai/u?mid=6601ae2964c7bd00071c13cd	false		unknown
https://agattu.plix.ai/favicon.ico	false	Avira URL Cloud: safe	unknown
https://bam.nr-data.net/events/1/f318cdbaae?a=127348941&v=1.253.0&to=dwoPEBZaCQgDR01QQl1KF1VLUAgFD1kHQ21ZABIXBVIAOwNDB19GR0oTAQpRABY5UA9QW1g6FAoXQAcXBUcLU1c%3D&rst=45288&ck=0&s=b100e2003efc3156&ref=https://agattu.plix.ai/u&hr=0	false	Avira URL Cloud: safe	unknown

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Mar 26 17:49:15 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	493117541781853B7EB70F1BF6C7D4D6	C4A88E88591C1B9681B5EF44B24889A33F3BB984	C29D4F9C7ECC578FFBD81D5EAE680152038A367662869631A85ADEB84D37DDE0
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Mar 26 17:49:15 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	00A80C1FA7368677B5A199C205B700A1	472AFCDB00ABE5D4AF1EC7FC4378FE53FB4C5E33	EF9FAB4F150EF7A9586D8880C577FB2A5A82AAA1CDA7187D48CC244CBC096DD2
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	30F15A9D7774CDA833B4E134315C1982	D5ABAA779A0A52B24F898A21A84E95755DF13769	55D81A97BA1909DD6244792BC8BC93746E21F581B9A8A106416F94C8A836B052
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Mar 26 17:49:15 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	6E2A3D77CF8EB160648D030A509A2C93	6B83F6F97C11162F1F46EAD8F1A146803D517327	6E75260ACBE2651FEFADA3AAAA6AC157AFA746177E45578CC165DCB803D3759B
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Mar 26 17:49:15 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	55FC0FE059C13ACE00425FFED5F27690	3473608946D5FDFB8023A4FFAADAE712E6E3DF92	E201DA03CD84E2850521716BC4E4854F7BDCF22E6F7774085442F8F59590D92F
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Mar 26 17:49:15 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	21048BAAEF49F6A31BC8B72D8E86D064	860B239AACD8B3FF0914EF043E42555179618192	29D037950D056684FF4C13B581C9FA5DA4B931492C3BD02BF3849797B6A77041
Chrome Cache Entry: 70	gzip compressed data, was "tmpsqol5o1w", last modified: Tue Mar 26 18:28:22 2024, max compression, original size modulo 2^32 346968	2A8EA1E66DCFD6CDD8C18731011453D0	417B17DE4042977B9FB745C0D8AC3B68EE4BF4EC	34F6C306E5ECB06D1D1741DF105F0F63EA512A498766084351D9853F7FE59240
Chrome Cache Entry: 71	gzip compressed data, was "tmpaaird6q4", last modified: Tue Mar 26 17:15:58 2024, max compression, original size modulo 2^32 23756	AB78801EF93E1068BC46A40D79D065B5	41CFE6AAB7E3C20BF26EF8774D79DF8A9BBD60D0	CAB1BAED20D9BD5088D80C79199EE632BB32EE36F5A1E981E4A5E733678B7D27
Chrome Cache Entry: 72	ASCII text, with very long lines (65460)	4A6ECB6DA3C4E819773B0E3331FF5E7A	32CA19165F56AD45DF3A60882D985DA4DD34E38B	E72E22C9FD71D91300781105175767A7275AA469946F7F72CDDA5ADAA5C548E1
Chrome Cache Entry: 73	gzip compressed data, was "tmpnajcdet_", last modified: Tue Mar 26 17:15:59 2024, max compression, original size modulo 2^32 162110	3A40B8653FB7762F5A744D3B32B369C8	5386662DE6DA5BC4F197AE7129A3390BF93211AC	486212CE8C993A867FCF5DCBD32B402DFFE78FAE37FE58E8A37BD2F180DFA867
Chrome Cache Entry: 74	MS Windows icon resource - 1 icon, 16x16, 8 bits/pixel	1F5103571DCB6984D79EFD6E129D5C48	ADE1688FDA202178126ECB7A56E851D482C50FB4	0AFB297FCAF9AC134966020C8CF37AD63121529F28A509A57B3C4EE502F14E13
Chrome Cache Entry: 75	MS Windows icon resource - 1 icon, 16x16, 8 bits/pixel	1F5103571DCB6984D79EFD6E129D5C48	ADE1688FDA202178126ECB7A56E851D482C50FB4	0AFB297FCAF9AC134966020C8CF37AD63121529F28A509A57B3C4EE502F14E13
Chrome Cache Entry: 76	gzip compressed data, was "tmpctdvkv64", last modified: Tue Mar 26 17:15:56 2024, max compression, original size modulo 2^32 108698	B43EF54CDF350E857C35F6D713E6EE77	A8D0B7F706443A0AA222D4C11098C260E94ED57E	0B068FA5E1748C58D87204E75F11212AA4D649A0FE0B122B020043316F443B9E
Chrome Cache Entry: 77	HTML document, ASCII text, with very long lines (59941)	8421451604A57BA6D09BF7B34820DE5D	2FB6925996ADCADE535A13CAD2CEB4D97E4C22C9	48BAF21DD1363CE7DE2A4CD7861C23844157BA8EBEA6C38631EA75755A9D6299
Chrome Cache Entry: 78	gzip compressed data, was "tmp43awyien", last modified: Tue Mar 26 17:15:54 2024, max compression, original size modulo 2^32 10118	6C0CDA0D4D63BE50BCD2C41FB04E75C9	E4DB7223D193F1315D27DA2D202139860461A888	583760407F6F0D97CF6E0667C2B08757D5BC3775AB2ABD9279898C6C5C058371
Chrome Cache Entry: 79	JSON data	8E3DB10AF5A3E1CABE7AA67674E21188	E2314B0038DF2D49DDBE461F33A6797D4586CDE0	87ECD5BABD6FD9F4F6F796D745AA38751FAF3985E3B55F87A2F53E506FE07362

Source: https://agattu.plix.ai/u?mid=6601ae2964c7bd00071c13cd	HTTP Parser: No favicon
Source: https://agattu.plix.ai/u?mid=6601ae2964c7bd00071c13cd	HTTP Parser: No favicon
Source: https://agattu.plix.ai/u?mid=6601ae2964c7bd00071c13cd	HTTP Parser: No favicon

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49731 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 23.221.242.90:443 -> 192.168.2.5:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.221.242.90:443 -> 192.168.2.5:49723 version: TLS 1.2

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49731 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /u?mid=6601ae2964c7bd00071c13cd HTTP/1.1Host: agattu.plix.aiConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/unsubscribe-ui.js HTTP/1.1Host: assets.apollo.ioConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://agattu.plix.aisec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://agattu.plix.ai/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/bundle-app-production-8015-a4a05b611c31fdf0ac15.js HTTP/1.1Host: assets.apollo.ioConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://agattu.plix.ai/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/bundle-app-production-7012-2a61c6ae5d188b6c9911.js HTTP/1.1Host: assets.apollo.ioConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://agattu.plix.ai/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/bundle-app-production-8627-07fdd6b2e595c0888e76.js HTTP/1.1Host: assets.apollo.ioConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://agattu.plix.ai/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: agattu.plix.aiConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://agattu.plix.ai/u?mid=6601ae2964c7bd00071c13cdAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: X-CSRF-TOKEN=fcZtoND_CpTzUM1DY40SoF3I-HkfnqFAofsXMIwZ7vW9V3UvxaSKDEyYChry6sXRa7GJBcaPFVad_phs9nAQ2A; _leadgenie_session=TRUFgtWpIU75SU%2FoCHHs89PS81pXQcweoa%2F3Cc2FYMjybTkCZ67q9pba9vrnmBYSdv%2F%2FSvFnK1YUXVudHCNkMQ9WPD3BJF3ZExUlJ1d569gcZM1fOAG2HATlGJigbdL2xavLd9QodvZCj6na6232cve9UfNzqD7QLHS8uqHa241ezy1Q2%2BOBTFE3D%2BKvzfp2Zo8h2R2vOWY5cRymM%2Fu8a7vFplYR2lq%2FzL3lTBMLFrTmhPOnoIaw7QfZsfM3WmPSspEtLkrml5wFauEOjKEMCcKoIvG071wmb80%3D--%2Bw4stxH18yyMcNAR--BDp4AkvtU3DFBJZC5HwbEA%3D%3D; GCLB=CJ2F0dvQtYH3rAEQAw
Source: global traffic	HTTP traffic detected: GET /nr-spa-1.253.0.min.js HTTP/1.1Host: js-agent.newrelic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://agattu.plix.aisec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://agattu.plix.ai/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: agattu.plix.aiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: X-CSRF-TOKEN=fcZtoND_CpTzUM1DY40SoF3I-HkfnqFAofsXMIwZ7vW9V3UvxaSKDEyYChry6sXRa7GJBcaPFVad_phs9nAQ2A; _leadgenie_session=TRUFgtWpIU75SU%2FoCHHs89PS81pXQcweoa%2F3Cc2FYMjybTkCZ67q9pba9vrnmBYSdv%2F%2FSvFnK1YUXVudHCNkMQ9WPD3BJF3ZExUlJ1d569gcZM1fOAG2HATlGJigbdL2xavLd9QodvZCj6na6232cve9UfNzqD7QLHS8uqHa241ezy1Q2%2BOBTFE3D%2BKvzfp2Zo8h2R2vOWY5cRymM%2Fu8a7vFplYR2lq%2FzL3lTBMLFrTmhPOnoIaw7QfZsfM3WmPSspEtLkrml5wFauEOjKEMCcKoIvG071wmb80%3D--%2Bw4stxH18yyMcNAR--BDp4AkvtU3DFBJZC5HwbEA%3D%3D; GCLB=CJ2F0dvQtYH3rAEQAw
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /1/f318cdbaae?a=127348941&v=1.253.0&to=dwoPEBZaCQgDR01QQl1KF1VLUAgFD1kHQ21ZABIXBVIAOwNDB19GR0oTAQpRABY5UA9QW1g6FAoXQAcXBUcLU1c%3D&rst=4125&ck=0&s=b100e2003efc3156&ref=https://agattu.plix.ai/u&hr=0&af=err,xhr,stn,ins,spa&ap=11&be=909&fe=2284&dc=1223&fsh=1&perf=%7B%22timing%22:%7B%22of%22:1711478954827,%22n%22:0,%22f%22:4,%22dn%22:325,%22dne%22:325,%22c%22:325,%22s%22:326,%22ce%22:616,%22rq%22:616,%22rp%22:910,%22rpe%22:1163,%22di%22:1183,%22ds%22:2132,%22de%22:2132,%22dc%22:3189,%22l%22:3189,%22le%22:3193%7D,%22navigation%22:%7B%7D%7D&fp=2245&fcp=3268 HTTP/1.1Host: bam.nr-data.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/bundle-app-production-7977-3598acce02a7abed456a.js HTTP/1.1Host: assets.apollo.ioConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://agattu.plix.ai/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: unknown

DNS traffic detected: queries for: agattu.plix.ai

Source: unknown

Source: chromecache_77.2.dr

String found in binary or memory: https://assets.apollo.io/js/unsubscribe-ui.js

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	HTTPS traffic detected: 23.221.242.90:443 -> 192.168.2.5:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.221.242.90:443 -> 192.168.2.5:49723 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@16/24@14/7

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2520 --field-trial-handle=2020,i,3268176836136726466,13000087644650507593,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://agattu.plix.ai/u?mid=6601ae2964c7bd00071c13cd"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2520 --field-trial-handle=2020,i,3268176836136726466,13000087644650507593,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

ID:	1416058
Product:	CloudBasic
Start time:	19:48:27
Start date:	26.03.2024
Cookbook:	browseurl.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Windows Analysis Report
https://agattu.plix.ai/u?mid=6601ae2964c7bd00071c13cd

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report https://agattu.plix.ai/u?mid=6601ae2964c7bd00071c13cd

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
https://agattu.plix.ai/u?mid=6601ae2964c7bd00071c13cd