Edit tour

Windows Analysis Report
https://nftstorage.link/ipfs/bafkreihmtitp2zhfxzglulfp5g4krdsybgqwu3k3p3dmtf72lviomgrqsu?login=ap@ddcaz.com

Overview

General Information

Sample URL:	https://nftstorage.link/ipfs/bafkreihmtitp2zhfxzglulfp5g4krdsybgqwu3k3p3dmtf72lviomgrqsu?login=ap@ddcaz.com
Analysis ID:	1428444

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

HTML page contains hidden URLs or javascript code

Stores files to the Windows start menu directory

URL contains potential PII (phishing indication)

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6960 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://nftstorage.link/ipfs/bafkreihmtitp2zhfxzglulfp5g4krdsybgqwu3k3p3dmtf72lviomgrqsu?login=ap@ddcaz.com MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7144 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=2032,i,14778199674943808372,13306175376740835996,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

HTTP traffic detected: GET /control_dotcom/?login=ap@ddcaz.com&page=null&request_type=null&page_bg=null&no_redrct=null&pcnt=null&no_psplash=null&pmax=null&vcnt=null&use_cdtimr=null HTTP/1.1Host: vosmuta.clickConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: unknown

DNS traffic detected: queries for: nftstorage.link

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747

Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.16:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.16:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.16:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.16:49763 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@18/17@26/201

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://nftstorage.link/ipfs/bafkreihmtitp2zhfxzglulfp5g4krdsybgqwu3k3p3dmtf72lviomgrqsu?login=ap@ddcaz.com
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=2032,i,14778199674943808372,13306175376740835996,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=2032,i,14778199674943808372,13306175376740835996,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Name	IP	Active	Malicious	Reputation
wakandos.top	104.21.17.82	true	false	unknown
defendguard.top	172.67.134.71	true	false	unknown
a.nel.cloudflare.com	35.190.80.1	true	false	high
bafkreihmtitp2zhfxzglulfp5g4krdsybgqwu3k3p3dmtf72lviomgrqsu.ipfs.nftstorage.link	104.18.41.40	true	false	unknown
vosmuta.click	3.105.85.247	true	false	unknown
nftstorage.link	104.18.41.40	true	false	unknown
challenges.cloudflare.com	104.17.2.184	true	false	high
www.google.com	108.177.122.104	true	false	high

Contacted URLs

Name	Malicious	Reputation
https://defendguard.top/_mysterio_omni/?login=ap@ddcaz.com&page=null&request_type=null&page_bg=null&no_redrct=null&pcnt=null&no_psplash=null&pmax=null&vcnt=null&use_cdtimr=null	false	unknown
https://defendguard.top/_mysterio_omni/?login=ap@ddcaz.com	false	unknown
about:blank	false	low
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/8vg65/0x4AAAAAAAUZDvNEXYqNiWys/auto/normal	false	high
http://vosmuta.click/control_dotcom/?login=ap@ddcaz.com&page=null&request_type=null&page_bg=null&no_redrct=null&pcnt=null&no_psplash=null&pmax=null&vcnt=null&use_cdtimr=null	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
142.250.105.94	unknown	United States	15169	GOOGLEUS	false
142.250.105.138	unknown	United States	15169	GOOGLEUS	false
172.253.124.138	unknown	United States	15169	GOOGLEUS	false
172.67.134.71	defendguard.top	United States	13335	CLOUDFLARENETUS	false
172.253.124.94	unknown	United States	15169	GOOGLEUS	false
172.253.124.95	unknown	United States	15169	GOOGLEUS	false
104.21.25.137	unknown	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
64.233.185.84	unknown	United States	15169	GOOGLEUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
142.250.9.147	unknown	United States	15169	GOOGLEUS	false
3.105.85.247	vosmuta.click	United States	16509	AMAZON-02US	false
104.17.2.184	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
104.21.17.82	wakandos.top	United States	13335	CLOUDFLARENETUS	false
104.18.41.40	bafkreihmtitp2zhfxzglulfp5g4krdsybgqwu3k3p3dmtf72lviomgrqsu.ipfs.nftstorage.link	United States	13335	CLOUDFLARENETUS	false
108.177.122.104	www.google.com	United States	15169	GOOGLEUS	false
64.233.176.106	unknown	United States	15169	GOOGLEUS	false
142.251.15.105	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16
192.168.2.4

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1428444
Start date and time:	2024-04-18 23:52:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://nftstorage.link/ipfs/bafkreihmtitp2zhfxzglulfp5g4krdsybgqwu3k3p3dmtf72lviomgrqsu?login=ap@ddcaz.com
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean1.win@18/17@26/201

Warnings

Exclude process from analysis (whitelisted): SgrmBroker.exe, MoUsoCoreWorker.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.253.124.94, 142.250.105.138, 142.250.105.113, 142.250.105.102, 142.250.105.101, 142.250.105.100, 142.250.105.139, 64.233.185.84, 34.104.35.123, 172.253.124.95, 142.251.15.105, 142.251.15.103, 142.251.15.106, 142.251.15.147, 142.251.15.99, 142.251.15.104, 64.233.176.106, 64.233.176.99, 64.233.176.147, 64.233.176.105, 64.233.176.104, 64.233.176.103
Excluded domains from analysis (whitelisted): fs.microsoft.com, clients2.google.com, accounts.google.com, edgedl.me.gvt1.com, ajax.googleapis.com, clientservices.googleapis.com, t1.gstatic.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: https://nftstorage.link/ipfs/bafkreihmtitp2zhfxzglulfp5g4krdsybgqwu3k3p3dmtf72lviomgrqsu?login=ap@ddcaz.com

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 18 20:52:36 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.993888386246513
Encrypted:	false
SSDEEP:
MD5:	B9E178B4BE3A58FA13FD5492991F1D38
SHA1:	3395E8D74A2153FA0C8FC142C6FC0793139B3526
SHA-256:	21AA7A00D9E7F74A611CD57A4D83ABB4EC861BFC3C42E5486CA6C44AC087753F
SHA-512:	A026C98F50B068936BCC226EF65189D949DDCFE22EE1BF55EEE7121B9D9A2CA6FD2100276B81A8AE1AB05D0DE77CCF83830CD799CA18B9A44C8D3B04B6A023E1
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....8.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............z.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 18 20:52:36 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.008653530922288
Encrypted:	false
SSDEEP:
MD5:	71F542E36EDC46E94827ADA7444A382E
SHA1:	5DA9611FA5A54A2C2A1D3B7FDC90342BFAEA7E0A
SHA-256:	FDD39E7DE0845F1EC6193F54EF66676D84DECED484E54E78C9BC1FB5FB4DD54F
SHA-512:	1B538ED39AC1CAC58BB211013551012EE0AACF2AC7FE2D9A393C2EE8D6A13A276558E0CEB2C0CE0AEBDB360A0C8DC6FE9FCAAA68DF6D571F6839E039157830F0
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.........N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............z.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.0169766420643995
Encrypted:	false
SSDEEP:
MD5:	3C036A3C06D1194F7361A828E2627E3F
SHA1:	EA3658258B07FFCB505ECEC096BC33616AC020EE
SHA-256:	0654C57FBDAD8190044273E11603DE5B45CAE458861AC5D2054BAC1788A4AB1C
SHA-512:	6E96812380466723B1F768004508BF96A740133AA09197AB460D4EF4ECDFDE94A27408355B455E0BA60082C2255D486E23550C0B080A541119DB3937655E1A9D
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............z.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 18 20:52:36 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	4.004638206325101
Encrypted:	false
SSDEEP:
MD5:	213E69EB9BA43019EC98A08C14B4AE67
SHA1:	0125E5D2464AAEC0341D06BCE406192416A809FE
SHA-256:	EA7467B2105A9B4601D0C2D61517972C32B9A2D4FB2CCE4C6EB33ABC52F2AF26
SHA-512:	08654C921BC2554060D8A982EE702B0D4E40605A59368F37592C37198581E40FA356EE9457F16FD3B9BDDCCB0F90137E3B921F46E9621AC509D8F895901AE929
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....Fo....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............z.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 18 20:52:36 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9959838390704596
Encrypted:	false
SSDEEP:
MD5:	3C4ED0C6C8D77B5BFCB7B2A8BC624439
SHA1:	F44C03F481E9E2D5E836C93244305A801D4A0DC7
SHA-256:	1E82416C12B7214E894050C614F3B28FBBF04B9241CE3B80B79BE4DAFCA8AE14
SHA-512:	7CB232F7D2A19CFE12DAADB8359E2FFB4A58AB412F42D3487A7E1C91D083E6205B4B873A355B06593455EF63C5A99DD4A4743E6609CB2E5D1F788AA5CE477398
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,..........N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............z.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 18 20:52:36 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.006357414762737
Encrypted:	false
SSDEEP:
MD5:	C7F80E84F6DA02C1922AA871C7E146E5
SHA1:	612F898CD88306AA6F0F261210222D1F31B11413
SHA-256:	421A6446C1F7CB24741DD7FE68C14BA8BCD838BA7187A86BF2F213FB1D7D6B06
SHA-512:	20F751114DF8EDE860C31947B4C7612B3E6956A4B10A1C71C9FD8EDADA7F3EDCFA92460A34642665F619CC766360BF387777A780ACDF81DC2F3F8099E51B859F
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....T.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............z.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 73

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	288580
Entropy (8bit):	5.066983843372853
Encrypted:	false
SSDEEP:
MD5:	2849239B95F5A9A2AEA3F6ED9420BB88
SHA1:	AF32F706407AB08F800C5E697CCE92466E735847
SHA-256:	1FE2BB5390A75E5D61E72C107CAB528FC3C29A837D69AAB7D200E1DBB5DCD239
SHA-512:	9FFE201D6DDAB4CDD0A9171B0A7E9EC26A7170B00719A0E3A4406EE3165DE3B3745B6A10FBAABBA1CDCF5ECB6B2585DC6CD535387750D53EE900FFA08B962EF2
Malicious:	false
Reputation:	unknown
URL:	https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.js
Preview:	/!. jQuery JavaScript Library v3.6.0. * https://jquery.com/. . Includes Sizzle.js. * https://sizzlejs.com/. . Copyright OpenJS Foundation and other contributors. * Released under the MIT license. * https://jquery.org/license. . Date: 2021-03-02T17:08Z. */.( function( global, factory ) {..."use strict";...if ( typeof module === "object" && typeof module.exports === "object" ) {....// For CommonJS and CommonJS-like environments where a proper `window`...// is present, execute the factory and get jQuery....// For environments that do not have a `window` with a `document`...// (such as Node.js), expose a factory as module.exports....// This accentuates the need for the creation of a real `window`....// e.g. var jQuery = require("jquery")(window);...// See ticket #14549 for more info....module.exports = global.document ?....factory( global, true ) :....function( w ) {.....if ( !w.document ) {......throw new Error( "jQuery requires a window with a document" );.....}.....return fa

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.990210155325004
Encrypted:	false
SSDEEP:
MD5:	9246CCA8FC3C00F50035F28E9F6B7F7D
SHA1:	3AA538440F70873B574F40CD793060F53EC17A5D
SHA-256:	C07D7D29E3C20FA6CA4C5D20663688D52BAD13E129AD82CE06B80EB187D9DC84
SHA-512:	A2098304D541DF4C71CDE98E4C4A8FB1746D7EB9677CEBA4B19FF522EFDD981E484224479FD882809196B854DBC5B129962DBA76198D34AAECF7318BD3736C6B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...............s....IDAT.....$.....IEND.B`.

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	3405
Entropy (8bit):	5.2482265760791655
Encrypted:	false
SSDEEP:
MD5:	50C446E4404BDDA682D64622E8BE54C6
SHA1:	2D35EEBA647614BE667A8B684CA37D49C5863B6D
SHA-256:	EC9A26FD64E5BE4CBA2CAFE9B8A88E5809A16A6D5B7EC6C997FA5D50E61A3095
SHA-512:	FCA1414D58CAD2226010BAA01C1ADDA453BEEAB83CE8AA7DB29E39A58B4D14C02B694A5C1D4FA491D5C855FEE72C77E84A8D3E00605AE1F11376729CCB481FB3
Malicious:	false
Reputation:	unknown
URL:	https://bafkreihmtitp2zhfxzglulfp5g4krdsybgqwu3k3p3dmtf72lviomgrqsu.ipfs.nftstorage.link/?login=ap@ddcaz.com
Preview:	<!DOCTYPE html>..<html>..<head>.. <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">.. <meta name="Generator" content="Microsoft Word 97">.. <meta name="GENERATOR" content="Mozilla/4.73 [en] (Win95; U) [Netscape]">.. <meta http-equiv="REFRESH" content="0;url=">...<meta name="robots" content="noindex">...<meta name="googlebot" content="noindex">...<meta name="googlebot-news" content="noindex">...<meta name="otherbot" content="noindex">...<meta name="noarchive" content="noindex">...<meta name="nosnippet" content="noindex">...<meta name="noimageindex" content="noindex"> ...<meta name="robots" content="nofollow">...<meta name="googlebot" content="nofollow">...<meta name="googlebot-news" content="nofollow">...<meta name="otherbot" content="nofollow">...<meta name="noarchive" content="nofollow">...<meta name="nosnippet" content="nofollow">...<meta name="noimageindex" content="nofollow">...<meta name="robots" content="max-snippet:0">..<style>..#spintarget { ..

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	downloaded
Size (bytes):	89947
Entropy (8bit):	5.290839266829335
Encrypted:	false
SSDEEP:
MD5:	CF2FBBF84281D9ECBFFB4993203D543B
SHA1:	832A6A4E86DAF38B1975D705C5DE5D9E5F5844BC
SHA-256:	A6F3F0FAEA4B3D48E03176341BEF0ED3151FFBF226D4C6635F1C6039C0500575
SHA-512:	493A1FE319B5C2091F9BB85E5AA149567E7C1E6DC4B52DF55C569A81A6BC54C45E097024427259FA3132F0F082FE24F5F1D172F7959C131347153A8BCA9EF679
Malicious:	false
Reputation:	unknown
URL:	https://ajax.googleapis.com/ajax/libs/jquery/3.6.3/jquery.min.js
Preview:	/! jQuery v3.6.3 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,y=n.hasOwnProperty,a=y.toString,l=a.call(Object),v={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},S=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|S).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}funct

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 43, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	61
Entropy (8bit):	4.035372245524405
Encrypted:	false
SSDEEP:
MD5:	E0F6B83816B94198EBB5FFE91A5CE7C7
SHA1:	F3D44AE91E1CC6EE5D954C41745C885DC81BBF78
SHA-256:	CCFEC2C1CF67DD7FAF9F909F0B7E643051E8E448024A78DDAE08FF15EBD05D73
SHA-512:	0DB5188128541B128890767B6A856384DA6A83292C661CBFC7BEDED43D5A1AB0A1B047D6A04D2785134B05635EC3A20ABF52E1DA09A69D7F6F6A15D55629F83E
Malicious:	false
Reputation:	unknown
URL:	https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/i/8767e218e80269f3/1713477161301/1Z0rjq1R4Rqp_ix
Preview:	.PNG........IHDR... ...+........`....IDAT.....$.....IEND.B`.

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (7858), with no line terminators
Category:	downloaded
Size (bytes):	7858
Entropy (8bit):	5.768986303727004
Encrypted:	false
SSDEEP:
MD5:	1EC4217D030AF4C2F3701D2027B3D31C
SHA1:	23B28AA94A2B631A44BE21A3CCEFA6534B893C8D
SHA-256:	834D2B15C50F93C2D3A0B14DBF28A582670BCFF097EDE1C3626C087244F77221
SHA-512:	2DF411E2E88EEBD7532BB74C698E55D66C6B2AD81F2AAF01A66F5552531C10660B3E16BD58B894331AB06E619258879611DFE4C26F7B365BA40DCED07EFDEDFD
Malicious:	false
Reputation:	unknown
URL:	https://defendguard.top/cdn-cgi/challenge-platform/h/g/scripts/jsd/54ea73d52131/main.js
Preview:	window._cf_chl_opt={cFPWv:'g'};~function(V,g,h,m,n,o,y,z){V=b,function(c,e,U,f,C){for(U=b,f=c();!![];)try{if(C=-parseInt(U(316))/1(parseInt(U(312))/2)+parseInt(U(297))/3+-parseInt(U(267))/4(parseInt(U(304))/5)+parseInt(U(301))/6(-parseInt(U(341))/7)+-parseInt(U(247))/8+parseInt(U(327))/9(-parseInt(U(324))/10)+parseInt(U(285))/11,C===e)break;else f.push(f.shift())}catch(D){f.push(f.shift())}}(a,820946),g=this\|\|self,h=g[V(305)],m=function(a0,e,f,C){return a0=V,e=String[a0(336)],f={'h':function(D){return null==D?'':f.g(D,6,function(E,a1){return a1=b,a1(298)[a1(315)](E)})},'g':function(D,E,F,a2,G,H,I,J,K,L,M,N,O,P,Q,R,S,T){if(a2=a0,D==null)return'';for(H={},I={},J='',K=2,L=3,M=2,N=[],O=0,P=0,Q=0;Q<D[a2(337)];Q+=1)if(R=D[a2(315)](Q),Object[a2(335)][a2(311)][a2(293)](H,R)\|\|(H[R]=L++,I[R]=!0),S=J+R,Object[a2(335)][a2(311)][a2(293)](H,S))J=S;else{if(Object[a2(335)][a2(311)][a2(293)](I,J)){if(256>J[a2(264)](0)){for(G=0;G<M;O<<=1,E-1==P?(P=0,N[a2(288)](F(O)),O=0):P++,G++);for(T=J[a2(264)](0)

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 48 x 48
Category:	downloaded
Size (bytes):	46341
Entropy (8bit):	7.770392720954173
Encrypted:	false
SSDEEP:
MD5:	BAB0AD7CE20E911217791C00BCD4E35B
SHA1:	0822AC44951DEF4349090998B9ECB153128F03D5
SHA-256:	BD750F550A5DB2901C0BD52EC564DA6ADFBAD55562B862B1F125D96D9D62B026
SHA-512:	B856A53A80A9DEE9705500C23201760B556495B369F7C7914EAB0B3AE77233A448DF7243F7C47A7088BEDFF9F04AF8B16F8FC2B35CD5D3D4040D06022B9DBACA
Malicious:	false
Reputation:	unknown
URL:	https://defendguard.top/_mysterio_omni/functions/spinner.gif
Preview:	GIF89a0.0......&........${b....v[.mQ...l..K.\|..q............^?......B.u.....[....E......[..)}eT..=.s.........:.tY.qV.......z..f-.i....fH.......Y...u......................h....................x]....dEP.~.................iL.......`..x..0.j...}..\|..I.y...E.x......hJy..X...kN......8.n5.m........U..e..!x^.z`.......jMy..:.p.`A...u......................................pT.................0.l.bD..0.......nR..Pi............~..b...R1F.{4.j~..e....._...hJg..x..........\|.................O..............lO..p...5.o......._@t..\|..6.k_..t...................7.q........q..0.f........._.....G.vx..d..............2.k.........@.q....rW...+.g...n.....4.l...z.....w............eG.kN.kO...]........0.h...............m...o..?.wN.{........X...cC.cD....jM......!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RDF xmlns:rdf="ht

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	3410
Entropy (8bit):	5.247787652410367
Encrypted:	false
SSDEEP:
MD5:	9AC824F8699D3FAD4A706E118C7987BB
SHA1:	EF1B664A479CA91ED336017068E09BF0093CBCBE
SHA-256:	86E63B58CA882B6496815D3B363ADDD4F0F90C994704EEB0835A353599FBCA86
SHA-512:	2BDDEDAF77BDD0EA2029059484951882B140A35EAAC86762C38BA2AD6CD99F5AD48082814559BB5416FD945E7716F77DC639F7EF53F109765932594162D505CE
Malicious:	false
Reputation:	unknown
URL:	http://vosmuta.click/control_dotcom/?login=ap@ddcaz.com&page=null&request_type=null&page_bg=null&no_redrct=null&pcnt=null&no_psplash=null&pmax=null&vcnt=null&use_cdtimr=null
Preview:	<!DOCTYPE html>..<html>..<head>.. <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">.. <meta name="Generator" content="Microsoft Word 97">.. <meta name="GENERATOR" content="Mozilla/4.73 [en] (Win95; U) [Netscape]">.. <meta http-equiv="REFRESH" content="0;url=">...<meta name="robots" content="noindex">...<meta name="googlebot" content="noindex">...<meta name="googlebot-news" content="noindex">...<meta name="otherbot" content="noindex">...<meta name="noarchive" content="noindex">...<meta name="nosnippet" content="noindex">...<meta name="noimageindex" content="noindex"> ...<meta name="robots" content="nofollow">...<meta name="googlebot" content="nofollow">...<meta name="googlebot-news" content="nofollow">...<meta name="otherbot" content="nofollow">...<meta name="noarchive" content="nofollow">...<meta name="nosnippet" content="nofollow">...<meta name="noimageindex" content="nofollow">...<meta name="robots" content="max-snippet:0">..<style>..#spintarget { ..

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	228
Entropy (8bit):	6.299138014283589
Encrypted:	false
SSDEEP:
MD5:	CDC3F7291A5A930CE84D2F825AB38CAF
SHA1:	84CE417BACFEA0AB571E1E116BFE155218E3335D
SHA-256:	B8F2FE6CD0317E9052DAB065EF92F4CB62DFA210752CD5DB1A283F55EF7EA7CC
SHA-512:	378630939E95A83859A3E0D79CB46645DBA18438B21F1F7472C7300C37BFCD52D96733052469AC4A6AF2FE71715E7099803FDDFC45D941CF8B0AB5251F5B2F1F
Malicious:	false
Reputation:	unknown
URL:	"https://t1.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url=http://ddcaz.com&size=16"
Preview:	.PNG........IHDR.............(-.S...*PLTE+..GpL+..+..+..+..+..+..-..+..+..,..-../....W.....tRNS...{/....;.S........[IDAT..u.Q.. .C.1....u.q"...^...-.+.a..).9.aBB..(....PE..][Kh.N..H....a.\.CX[2M....................IEND.B`.

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	302
Entropy (8bit):	5.284589343501797
Encrypted:	false
SSDEEP:
MD5:	80A0117131329166F55E7DC4022B63F9
SHA1:	5838A1B9111A88EBB24A1CA6D8A8D5469FDC97BD
SHA-256:	B35585CF421AFCCCD16BCA81C01A0F63D01F877A17DE377A1160D40A40BEB6C0
SHA-512:	482E101BB1463125BC6804F7BCE18B39C9A0677A1E2742F2451BC9560714EF898505AD091EE08CF444984353A46F0ED2932C58C766ACA3F88D2C5E744CF2FB22
Malicious:	false
Reputation:	unknown
URL:	https://defendguard.top/favicon.ico
Preview:	<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>404 Not Found</title>.</head><body>.<h1>Not Found</h1>.<p>The requested URL was not found on this server.</p>.<hr>.<address>Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/7.4.30 Server at defendguard.top Port 80</address>.</body></html>.

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (42414)
Category:	downloaded
Size (bytes):	42415
Entropy (8bit):	5.374316408837108
Encrypted:	false
SSDEEP:
MD5:	374FEC8B5E50CD6AB980F3FEF21A5AA0
SHA1:	7F474607991A19B6F1B78CC32E0F75B501B60774
SHA-256:	8AF2DA74872F03E058AB79A584176D2086AFC01BBD42DD2ED14259179341BE6A
SHA-512:	3420E0DEF4FA49BD8B67DA80F1C3F56A08B4892BC0373D7BB824F8126713B209116147D4B1E1D5E7B07C6DBC58B1AD411AEB2F5A0DAE99FFC220246311E3808E
Malicious:	false
Reputation:	unknown
URL:	https://challenges.cloudflare.com/turnstile/v0/g/54ea73d52131/api.js
Preview:	"use strict";(function(){function bt(e,r,t,o,u,s,m){try{var b=e[s](m),h=b.value}catch(d){t(d);return}b.done?r(h):Promise.resolve(h).then(o,u)}function Et(e){return function(){var r=this,t=arguments;return new Promise(function(o,u){var s=e.apply(r,t);function m(h){bt(s,o,u,m,b,"next",h)}function b(h){bt(s,o,u,m,b,"throw",h)}m(void 0)})}}function M(e,r){return r!=null&&typeof Symbol!="undefined"&&r[Symbol.hasInstance]?!!r[Symbol.hasInstance](e):M(e,r)}function Ie(e,r,t){return r in e?Object.defineProperty(e,r,{value:t,enumerable:!0,configurable:!0,writable:!0}):e[r]=t,e}function Ve(e){for(var r=1;r<arguments.length;r++){var t=arguments[r]!=null?arguments[r]:{},o=Object.keys(t);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(t).filter(function(u){return Object.getOwnPropertyDescriptor(t,u).enumerable}))),o.forEach(function(u){Ie(e,u,t[u])})}return e}function fr(e,r){var t=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertyS

Static File Info

⊘No static file info

Source: https://nftstorage.link/ipfs/bafkreihmtitp2zhfxzglulfp5g4krdsybgqwu3k3p3dmtf72lviomgrqsu?login=ap@ddcaz.com	Sample URL: PII: ap@ddcaz.com
Source: https://nftstorage.link/ipfs/bafkreihmtitp2zhfxzglulfp5g4krdsybgqwu3k3p3dmtf72lviomgrqsu?login=ap@ddcaz.com	Sample URL: PII: ap@ddcaz.com
Source: https://nftstorage.link/ipfs/bafkreihmtitp2zhfxzglulfp5g4krdsybgqwu3k3p3dmtf72lviomgrqsu?login=ap@ddcaz.com	Sample URL: PII: ap@ddcaz.com
Source: https://nftstorage.link/ipfs/bafkreihmtitp2zhfxzglulfp5g4krdsybgqwu3k3p3dmtf72lviomgrqsu?login=ap@ddcaz.com	Sample URL: PII: ap@ddcaz.com
Source: https://nftstorage.link/ipfs/bafkreihmtitp2zhfxzglulfp5g4krdsybgqwu3k3p3dmtf72lviomgrqsu?login=ap@ddcaz.com	Sample URL: PII: ap@ddcaz.com
Source: https://nftstorage.link/ipfs/bafkreihmtitp2zhfxzglulfp5g4krdsybgqwu3k3p3dmtf72lviomgrqsu?login=ap@ddcaz.com	Sample URL: PII: ap@ddcaz.com
Source: https://nftstorage.link/ipfs/bafkreihmtitp2zhfxzglulfp5g4krdsybgqwu3k3p3dmtf72lviomgrqsu?login=ap@ddcaz.com	Sample URL: PII: ap@ddcaz.com
Source: https://nftstorage.link/ipfs/bafkreihmtitp2zhfxzglulfp5g4krdsybgqwu3k3p3dmtf72lviomgrqsu?login=ap@ddcaz.com	Sample URL: PII: ap@ddcaz.com
Source: https://nftstorage.link/ipfs/bafkreihmtitp2zhfxzglulfp5g4krdsybgqwu3k3p3dmtf72lviomgrqsu?login=ap@ddcaz.com	Sample URL: PII: ap@ddcaz.com
Source: https://nftstorage.link/ipfs/bafkreihmtitp2zhfxzglulfp5g4krdsybgqwu3k3p3dmtf72lviomgrqsu?login=ap@ddcaz.com	Sample URL: PII: ap@ddcaz.com
Source: https://nftstorage.link/ipfs/bafkreihmtitp2zhfxzglulfp5g4krdsybgqwu3k3p3dmtf72lviomgrqsu?login=ap@ddcaz.com	Sample URL: PII: ap@ddcaz.com
Source: https://nftstorage.link/ipfs/bafkreihmtitp2zhfxzglulfp5g4krdsybgqwu3k3p3dmtf72lviomgrqsu?login=ap@ddcaz.com	Sample URL: PII: ap@ddcaz.com

Source: https://defendguard.top/_mysterio_omni/?login=ap@ddcaz.com&page=null&request_type=null&page_bg=null&no_redrct=null&pcnt=null&no_psplash=null&pmax=null&vcnt=null&use_cdtimr=null	HTTP Parser: No favicon
Source: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/8vg65/0x4AAAAAAAUZDvNEXYqNiWys/auto/normal	HTTP Parser: No favicon

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://nftstorage.link/ipfs/bafkreihmtitp2zhfxzglulfp5g4krdsybgqwu3k3p3dmtf72lviomgrqsu?login=ap@ddcaz.com

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Chrome Cache Entry: 80

Chrome Cache Entry: 82

Chrome Cache Entry: 84

Chrome Cache Entry: 86

Chrome Cache Entry: 87

Static File Info

Windows Analysis Report
https://nftstorage.link/ipfs/bafkreihmtitp2zhfxzglulfp5g4krdsybgqwu3k3p3dmtf72lviomgrqsu?login=ap@ddcaz.com