Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
OriginalMessage.txt.msg
|
CDFV2 Microsoft Outlook Message
|
initial sample
|
||
|
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin
|
ASCII text, with very long lines (65536), with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin
|
ASCII text, with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\11E0A2DA-00FA-4390-9AE9-873E19A2F295
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db
|
SQLite 3.x database, last written using SQLite version 3023002, writer version 2, read version 2, file counter 2, database
pages 1, cookie 0, schema 0, largest root page 1, unknown 0 encoding, version-valid-for 2
|
dropped
|
||
|
C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal
|
SQLite Rollback Journal
|
dropped
|
||
|
C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal
|
SQLite Write-Ahead Log, version 3007000
|
modified
|
||
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{68ED850E-C907-48B3-AC11-596E36093F34}.tmp
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1713476603617279700_DE2E8C33-E130-4737-981C-B4B608C12A1F.log
|
ASCII text, with very long lines (830), with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1713476603618109800_DE2E8C33-E130-4737-981C-B4B608C12A1F.log
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20240418T2343230438-7088.etl
|
data
|
modified
|
||
|
C:\Users\user\AppData\Local\Temp\~DFEA93DD7BD88ADF28.TMP
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Microsoft\Outlook\NoEmail.srs
|
Composite Document File V2 Document, Cannot read section info
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command
line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 18 20:43:36 2024, atime=Wed Sep 27 04:28:28
2023, length=1210144, window=hide
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command
line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 18 20:43:36 2024, atime=Wed Sep 27 04:28:28
2023, length=1210144, window=hide
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command
line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28
2023, length=1210144, window=hide
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command
line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 18 20:43:35 2024, atime=Wed Sep 27 04:28:28
2023, length=1210144, window=hide
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command
line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 18 20:43:36 2024, atime=Wed Sep 27 04:28:28
2023, length=1210144, window=hide
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command
line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 18 20:43:35 2024, atime=Wed Sep 27 04:28:28
2023, length=1210144, window=hide
|
dropped
|
||
|
C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst
|
Microsoft Outlook email folder (>=2003)
|
dropped
|
||
|
C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp
|
data
|
dropped
|
||
|
Chrome Cache Entry: 76
|
ASCII text
|
downloaded
|
||
|
Chrome Cache Entry: 78
|
HTML document, ASCII text, with CRLF line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 79
|
ASCII text, with very long lines (65447)
|
downloaded
|
||
|
Chrome Cache Entry: 80
|
ASCII text, with very long lines (7827), with no line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 81
|
PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
|
downloaded
|
||
|
Chrome Cache Entry: 82
|
HTML document, ASCII text, with very long lines (364)
|
downloaded
|
||
|
Chrome Cache Entry: 84
|
GIF image data, version 89a, 48 x 48
|
dropped
|
||
|
Chrome Cache Entry: 85
|
HTML document, ASCII text, with CRLF line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 87
|
HTML document, ASCII text
|
downloaded
|
||
|
Chrome Cache Entry: 89
|
PNG image data, 16 x 16, 8-bit colormap, non-interlaced
|
dropped
|
||
|
Chrome Cache Entry: 91
|
HTML document, ASCII text
|
downloaded
|
||
|
Chrome Cache Entry: 92
|
ASCII text, with very long lines (42414)
|
downloaded
|
||
|
Chrome Cache Entry: 93
|
PNG image data, 57 x 56, 8-bit/color RGB, non-interlaced
|
dropped
|
There are 28 hidden files, click here to show them.
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
https://defendguard.top/_mysterio_omni/?login=ap@ddcaz.com&page=null&request_type=null&page_bg=null&no_redrct=null&pcnt=null&no_psplash=null&pmax=null&vcnt=null&use_cdtimr=null
|
|||
|
https://defendguard.top/_mysterio_omni/zure/7d9a0d11cb36e12a68817aff945390de/index.php?login=YXBAZGRjYXouY29t&request_type=null&page_bg=null&no_redrct=null&pcnt=null&no_psplash=null&pmax=null
|
|||
|
http://vosmuta.click/favicon.ico
|
3.105.85.247
|
||
|
about:blank
|
|||
|
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/pgcwv/0x4AAAAAAAUZDvNEXYqNiWys/auto/normal
|
|||
|
http://vosmuta.click/control_dotcom/?login=ap@ddcaz.com&page=null&request_type=null&page_bg=null&no_redrct=null&pcnt=null&no_psplash=null&pmax=null&vcnt=null&use_cdtimr=null
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
wakandos.top
|
104.21.17.82
|
||
|
defendguard.top
|
104.21.25.137
|
||
|
a.nel.cloudflare.com
|
35.190.80.1
|
||
|
ddcaz.com
|
13.248.177.245
|
||
|
bafkreihmtitp2zhfxzglulfp5g4krdsybgqwu3k3p3dmtf72lviomgrqsu.ipfs.nftstorage.link
|
104.18.41.40
|
||
|
vosmuta.click
|
3.105.85.247
|
||
|
www3.l.google.com
|
74.125.136.100
|
||
|
nftstorage.link
|
172.64.146.216
|
||
|
cdnjs.cloudflare.com
|
104.17.25.14
|
||
|
challenges.cloudflare.com
|
104.17.2.184
|
||
|
www.google.com
|
64.233.185.99
|
||
|
ddcaz-web-1204888116.us-east-1.elb.amazonaws.com
|
44.212.141.147
|
||
|
www.ddcaz.com
|
unknown
|
||
|
translate.google.com
|
unknown
|
There are 4 hidden domains, click here to show them.
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
72.21.81.240
|
unknown
|
United States
|
||
|
20.189.173.9
|
unknown
|
United States
|
||
|
74.125.138.139
|
unknown
|
United States
|
||
|
192.168.2.17
|
unknown
|
unknown
|
||
|
192.168.2.16
|
unknown
|
unknown
|
||
|
172.64.146.216
|
nftstorage.link
|
United States
|
||
|
52.109.16.112
|
unknown
|
United States
|
||
|
104.84.231.105
|
unknown
|
United States
|
||
|
64.233.185.84
|
unknown
|
United States
|
||
|
35.190.80.1
|
a.nel.cloudflare.com
|
United States
|
||
|
104.21.17.82
|
wakandos.top
|
United States
|
||
|
104.18.41.40
|
bafkreihmtitp2zhfxzglulfp5g4krdsybgqwu3k3p3dmtf72lviomgrqsu.ipfs.nftstorage.link
|
United States
|
||
|
142.251.15.147
|
unknown
|
United States
|
||
|
74.125.138.94
|
unknown
|
United States
|
||
|
52.113.194.132
|
unknown
|
United States
|
||
|
1.1.1.1
|
unknown
|
Australia
|
||
|
142.250.105.94
|
unknown
|
United States
|
||
|
172.253.124.99
|
unknown
|
United States
|
||
|
142.250.105.95
|
unknown
|
United States
|
||
|
142.250.105.104
|
unknown
|
United States
|
||
|
104.21.25.137
|
defendguard.top
|
United States
|
||
|
239.255.255.250
|
unknown
|
Reserved
|
||
|
108.177.122.101
|
unknown
|
United States
|
||
|
52.109.44.110
|
unknown
|
United States
|
||
|
64.233.185.95
|
unknown
|
United States
|
||
|
3.105.85.247
|
vosmuta.click
|
United States
|
||
|
104.17.2.184
|
challenges.cloudflare.com
|
United States
|
||
|
64.233.185.99
|
www.google.com
|
United States
|
||
|
104.17.25.14
|
cdnjs.cloudflare.com
|
United States
|
There are 19 hidden IPs, click here to show them.