Windows Analysis Report
https://nftstorage.link/ipfs/bafkreihmtitp2zhfxzglulfp5g4krdsybgqwu3k3p3dmtf72lviomgrqsu?login=ap@ddcaz.com

Overview

General Information

Sample URL:	https://nftstorage.link/ipfs/bafkreihmtitp2zhfxzglulfp5g4krdsybgqwu3k3p3dmtf72lviomgrqsu?login=ap@ddcaz.com
Analysis ID:	1428444

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

HTML page contains hidden URLs or javascript code

Stores files to the Windows start menu directory

URL contains potential PII (phishing indication)

Classification

Signatures

HTML page contains hidden URLs or javascript code

Source: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/8vg65/0x4AAAAAAAUZDvNEXYqNiWys/auto/normal

HTTP Parser: Base64 decoded: http://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/8vg65/0x4AAAAAAAUZDvNEXYqNiWys/auto/normal

URL contains potential PII (phishing indication)

Source: https://nftstorage.link/ipfs/bafkreihmtitp2zhfxzglulfp5g4krdsybgqwu3k3p3dmtf72lviomgrqsu?login=ap@ddcaz.com	Sample URL: PII: ap@ddcaz.com
Source: https://nftstorage.link/ipfs/bafkreihmtitp2zhfxzglulfp5g4krdsybgqwu3k3p3dmtf72lviomgrqsu?login=ap@ddcaz.com	Sample URL: PII: ap@ddcaz.com
Source: https://nftstorage.link/ipfs/bafkreihmtitp2zhfxzglulfp5g4krdsybgqwu3k3p3dmtf72lviomgrqsu?login=ap@ddcaz.com	Sample URL: PII: ap@ddcaz.com
Source: https://nftstorage.link/ipfs/bafkreihmtitp2zhfxzglulfp5g4krdsybgqwu3k3p3dmtf72lviomgrqsu?login=ap@ddcaz.com	Sample URL: PII: ap@ddcaz.com
Source: https://nftstorage.link/ipfs/bafkreihmtitp2zhfxzglulfp5g4krdsybgqwu3k3p3dmtf72lviomgrqsu?login=ap@ddcaz.com	Sample URL: PII: ap@ddcaz.com
Source: https://nftstorage.link/ipfs/bafkreihmtitp2zhfxzglulfp5g4krdsybgqwu3k3p3dmtf72lviomgrqsu?login=ap@ddcaz.com	Sample URL: PII: ap@ddcaz.com
Source: https://nftstorage.link/ipfs/bafkreihmtitp2zhfxzglulfp5g4krdsybgqwu3k3p3dmtf72lviomgrqsu?login=ap@ddcaz.com	Sample URL: PII: ap@ddcaz.com
Source: https://nftstorage.link/ipfs/bafkreihmtitp2zhfxzglulfp5g4krdsybgqwu3k3p3dmtf72lviomgrqsu?login=ap@ddcaz.com	Sample URL: PII: ap@ddcaz.com
Source: https://nftstorage.link/ipfs/bafkreihmtitp2zhfxzglulfp5g4krdsybgqwu3k3p3dmtf72lviomgrqsu?login=ap@ddcaz.com	Sample URL: PII: ap@ddcaz.com
Source: https://nftstorage.link/ipfs/bafkreihmtitp2zhfxzglulfp5g4krdsybgqwu3k3p3dmtf72lviomgrqsu?login=ap@ddcaz.com	Sample URL: PII: ap@ddcaz.com
Source: https://nftstorage.link/ipfs/bafkreihmtitp2zhfxzglulfp5g4krdsybgqwu3k3p3dmtf72lviomgrqsu?login=ap@ddcaz.com	Sample URL: PII: ap@ddcaz.com
Source: https://nftstorage.link/ipfs/bafkreihmtitp2zhfxzglulfp5g4krdsybgqwu3k3p3dmtf72lviomgrqsu?login=ap@ddcaz.com	Sample URL: PII: ap@ddcaz.com

Source: https://defendguard.top/_mysterio_omni/?login=ap@ddcaz.com&page=null&request_type=null&page_bg=null&no_redrct=null&pcnt=null&no_psplash=null&pmax=null&vcnt=null&use_cdtimr=null	HTTP Parser: No favicon
Source: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/8vg65/0x4AAAAAAAUZDvNEXYqNiWys/auto/normal	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.16:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.16:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.16:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.16:49763 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /control_dotcom/?login=ap@ddcaz.com&page=null&request_type=null&page_bg=null&no_redrct=null&pcnt=null&no_psplash=null&pmax=null&vcnt=null&use_cdtimr=null HTTP/1.1Host: vosmuta.clickConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: unknown

DNS traffic detected: queries for: nftstorage.link

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747

Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.16:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.16:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.16:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.16:49763 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@18/17@26/201

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://nftstorage.link/ipfs/bafkreihmtitp2zhfxzglulfp5g4krdsybgqwu3k3p3dmtf72lviomgrqsu?login=ap@ddcaz.com
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=2032,i,14778199674943808372,13306175376740835996,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=2032,i,14778199674943808372,13306175376740835996,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
142.250.105.94	unknown	United States	15169	GOOGLEUS	false
142.250.105.138	unknown	United States	15169	GOOGLEUS	false
172.253.124.138	unknown	United States	15169	GOOGLEUS	false
172.67.134.71	defendguard.top	United States	13335	CLOUDFLARENETUS	false
172.253.124.94	unknown	United States	15169	GOOGLEUS	false
172.253.124.95	unknown	United States	15169	GOOGLEUS	false
104.21.25.137	unknown	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
64.233.185.84	unknown	United States	15169	GOOGLEUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
142.250.9.147	unknown	United States	15169	GOOGLEUS	false
3.105.85.247	vosmuta.click	United States	16509	AMAZON-02US	false
104.17.2.184	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
104.21.17.82	wakandos.top	United States	13335	CLOUDFLARENETUS	false
104.18.41.40	bafkreihmtitp2zhfxzglulfp5g4krdsybgqwu3k3p3dmtf72lviomgrqsu.ipfs.nftstorage.link	United States	13335	CLOUDFLARENETUS	false
108.177.122.104	www.google.com	United States	15169	GOOGLEUS	false
64.233.176.106	unknown	United States	15169	GOOGLEUS	false
142.251.15.105	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16
192.168.2.4

Contacted Domains

Name	IP	Active
wakandos.top	104.21.17.82	true
defendguard.top	172.67.134.71	true
a.nel.cloudflare.com	35.190.80.1	true
bafkreihmtitp2zhfxzglulfp5g4krdsybgqwu3k3p3dmtf72lviomgrqsu.ipfs.nftstorage.link	104.18.41.40	true
vosmuta.click	3.105.85.247	true
nftstorage.link	104.18.41.40	true
challenges.cloudflare.com	104.17.2.184	true
www.google.com	108.177.122.104	true

Contacted URLs

Name	Malicious	Reputation
https://defendguard.top/_mysterio_omni/?login=ap@ddcaz.com&page=null&request_type=null&page_bg=null&no_redrct=null&pcnt=null&no_psplash=null&pmax=null&vcnt=null&use_cdtimr=null	false	unknown
https://defendguard.top/_mysterio_omni/?login=ap@ddcaz.com	false	unknown
about:blank	false	low
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/8vg65/0x4AAAAAAAUZDvNEXYqNiWys/auto/normal	false	high
http://vosmuta.click/control_dotcom/?login=ap@ddcaz.com&page=null&request_type=null&page_bg=null&no_redrct=null&pcnt=null&no_psplash=null&pmax=null&vcnt=null&use_cdtimr=null	false	unknown

ID:	1428444
Product:	CloudBasic
Start time:	23:52:10
Start date:	18.04.2024
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 18 20:52:36 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	B9E178B4BE3A58FA13FD5492991F1D38	3395E8D74A2153FA0C8FC142C6FC0793139B3526	21AA7A00D9E7F74A611CD57A4D83ABB4EC861BFC3C42E5486CA6C44AC087753F
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 18 20:52:36 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	71F542E36EDC46E94827ADA7444A382E	5DA9611FA5A54A2C2A1D3B7FDC90342BFAEA7E0A	FDD39E7DE0845F1EC6193F54EF66676D84DECED484E54E78C9BC1FB5FB4DD54F
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	3C036A3C06D1194F7361A828E2627E3F	EA3658258B07FFCB505ECEC096BC33616AC020EE	0654C57FBDAD8190044273E11603DE5B45CAE458861AC5D2054BAC1788A4AB1C
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 18 20:52:36 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	213E69EB9BA43019EC98A08C14B4AE67	0125E5D2464AAEC0341D06BCE406192416A809FE	EA7467B2105A9B4601D0C2D61517972C32B9A2D4FB2CCE4C6EB33ABC52F2AF26
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 18 20:52:36 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	3C4ED0C6C8D77B5BFCB7B2A8BC624439	F44C03F481E9E2D5E836C93244305A801D4A0DC7	1E82416C12B7214E894050C614F3B28FBBF04B9241CE3B80B79BE4DAFCA8AE14
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 18 20:52:36 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	C7F80E84F6DA02C1922AA871C7E146E5	612F898CD88306AA6F0F261210222D1F31B11413	421A6446C1F7CB24741DD7FE68C14BA8BCD838BA7187A86BF2F213FB1D7D6B06
Chrome Cache Entry: 73	ASCII text	2849239B95F5A9A2AEA3F6ED9420BB88	AF32F706407AB08F800C5E697CCE92466E735847	1FE2BB5390A75E5D61E72C107CAB528FC3C29A837D69AAB7D200E1DBB5DCD239
Chrome Cache Entry: 74	PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced	9246CCA8FC3C00F50035F28E9F6B7F7D	3AA538440F70873B574F40CD793060F53EC17A5D	C07D7D29E3C20FA6CA4C5D20663688D52BAD13E129AD82CE06B80EB187D9DC84
Chrome Cache Entry: 75	HTML document, ASCII text, with CRLF line terminators	50C446E4404BDDA682D64622E8BE54C6	2D35EEBA647614BE667A8B684CA37D49C5863B6D	EC9A26FD64E5BE4CBA2CAFE9B8A88E5809A16A6D5B7EC6C997FA5D50E61A3095
Chrome Cache Entry: 76	ASCII text, with very long lines (65447)	CF2FBBF84281D9ECBFFB4993203D543B	832A6A4E86DAF38B1975D705C5DE5D9E5F5844BC	A6F3F0FAEA4B3D48E03176341BEF0ED3151FFBF226D4C6635F1C6039C0500575
Chrome Cache Entry: 77	PNG image data, 32 x 43, 8-bit/color RGB, non-interlaced	E0F6B83816B94198EBB5FFE91A5CE7C7	F3D44AE91E1CC6EE5D954C41745C885DC81BBF78	CCFEC2C1CF67DD7FAF9F909F0B7E643051E8E448024A78DDAE08FF15EBD05D73
Chrome Cache Entry: 78	ASCII text, with very long lines (7858), with no line terminators	1EC4217D030AF4C2F3701D2027B3D31C	23B28AA94A2B631A44BE21A3CCEFA6534B893C8D	834D2B15C50F93C2D3A0B14DBF28A582670BCFF097EDE1C3626C087244F77221
Chrome Cache Entry: 80	GIF image data, version 89a, 48 x 48	BAB0AD7CE20E911217791C00BCD4E35B	0822AC44951DEF4349090998B9ECB153128F03D5	BD750F550A5DB2901C0BD52EC564DA6ADFBAD55562B862B1F125D96D9D62B026
Chrome Cache Entry: 82	HTML document, ASCII text, with CRLF line terminators	9AC824F8699D3FAD4A706E118C7987BB	EF1B664A479CA91ED336017068E09BF0093CBCBE	86E63B58CA882B6496815D3B363ADDD4F0F90C994704EEB0835A353599FBCA86
Chrome Cache Entry: 84	PNG image data, 16 x 16, 8-bit colormap, non-interlaced	CDC3F7291A5A930CE84D2F825AB38CAF	84CE417BACFEA0AB571E1E116BFE155218E3335D	B8F2FE6CD0317E9052DAB065EF92F4CB62DFA210752CD5DB1A283F55EF7EA7CC
Chrome Cache Entry: 86	HTML document, ASCII text	80A0117131329166F55E7DC4022B63F9	5838A1B9111A88EBB24A1CA6D8A8D5469FDC97BD	B35585CF421AFCCCD16BCA81C01A0F63D01F877A17DE377A1160D40A40BEB6C0
Chrome Cache Entry: 87	ASCII text, with very long lines (42414)	374FEC8B5E50CD6AB980F3FEF21A5AA0	7F474607991A19B6F1B78CC32E0F75B501B60774	8AF2DA74872F03E058AB79A584176D2086AFC01BBD42DD2ED14259179341BE6A

Windows Analysis Report
https://nftstorage.link/ipfs/bafkreihmtitp2zhfxzglulfp5g4krdsybgqwu3k3p3dmtf72lviomgrqsu?login=ap@ddcaz.com

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report https://nftstorage.link/ipfs/bafkreihmtitp2zhfxzglulfp5g4krdsybgqwu3k3p3dmtf72lviomgrqsu?login=ap@ddcaz.com

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
https://nftstorage.link/ipfs/bafkreihmtitp2zhfxzglulfp5g4krdsybgqwu3k3p3dmtf72lviomgrqsu?login=ap@ddcaz.com