IOC Report
https://gelw.nalverd.com/AvGEoxV/

loading gif

Files

File Path
Type
Category
Malicious
Chrome Cache Entry: 100
Web Open Font Format (Version 2), TrueType, length 43596, version 1.0
downloaded
Chrome Cache Entry: 101
SVG Scalable Vector Graphics image
dropped
Chrome Cache Entry: 102
PNG image data, 108 x 24, 8-bit/color RGBA, non-interlaced
downloaded
Chrome Cache Entry: 103
PNG image data, 2160 x 443, 8-bit/color RGBA, non-interlaced
dropped
Chrome Cache Entry: 104
PNG image data, 506 x 303, 8-bit/color RGBA, non-interlaced
dropped
Chrome Cache Entry: 105
Web Open Font Format, TrueType, length 36696, version 1.0
downloaded
Chrome Cache Entry: 106
Unicode text, UTF-8 text, with very long lines (65534), with no line terminators
downloaded
Chrome Cache Entry: 107
ASCII text, with very long lines (1222), with no line terminators
downloaded
Chrome Cache Entry: 108
PNG image data, 28 x 59, 8-bit/color RGB, non-interlaced
dropped
Chrome Cache Entry: 109
HTML document, ASCII text, with very long lines (1445), with CRLF line terminators
downloaded
Chrome Cache Entry: 110
PNG image data, 506 x 303, 8-bit/color RGBA, non-interlaced
downloaded
Chrome Cache Entry: 111
ASCII text, with very long lines (42414)
downloaded
Chrome Cache Entry: 112
Web Open Font Format (Version 2), TrueType, length 28584, version 1.66
downloaded
Chrome Cache Entry: 69
ASCII text, with very long lines (45667)
downloaded
Chrome Cache Entry: 70
ASCII text, with very long lines (631)
downloaded
Chrome Cache Entry: 71
PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
dropped
Chrome Cache Entry: 72
SVG Scalable Vector Graphics image
dropped
Chrome Cache Entry: 73
PNG image data, 2160 x 443, 8-bit/color RGBA, non-interlaced
downloaded
Chrome Cache Entry: 74
PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
dropped
Chrome Cache Entry: 75
Web Open Font Format, TrueType, length 35970, version 1.0
downloaded
Chrome Cache Entry: 76
PNG image data, 28 x 59, 8-bit/color RGB, non-interlaced
downloaded
Chrome Cache Entry: 77
ASCII text, with very long lines (796)
downloaded
Chrome Cache Entry: 78
ASCII text, with very long lines (1437), with CRLF line terminators
downloaded
Chrome Cache Entry: 79
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 80
PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
downloaded
Chrome Cache Entry: 81
Web Open Font Format (Version 2), TrueType, length 93276, version 1.0
downloaded
Chrome Cache Entry: 82
PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
downloaded
Chrome Cache Entry: 83
ASCII text, with no line terminators
downloaded
Chrome Cache Entry: 84
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 85
Web Open Font Format (Version 2), TrueType, length 28000, version 1.66
downloaded
Chrome Cache Entry: 86
PNG image data, 108 x 24, 8-bit/color RGBA, non-interlaced
dropped
Chrome Cache Entry: 87
HTML document, ASCII text, with very long lines (59237), with CRLF line terminators
downloaded
Chrome Cache Entry: 88
SVG Scalable Vector Graphics image
dropped
Chrome Cache Entry: 89
PNG image data, 2446 x 899, 8-bit/color RGBA, non-interlaced
downloaded
Chrome Cache Entry: 90
PNG image data, 2446 x 899, 8-bit/color RGBA, non-interlaced
dropped
Chrome Cache Entry: 91
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 92
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 93
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 94
ASCII text, with very long lines (23398), with no line terminators
downloaded
Chrome Cache Entry: 95
ASCII text, with very long lines (65447)
downloaded
Chrome Cache Entry: 96
PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
dropped
Chrome Cache Entry: 97
PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
downloaded
Chrome Cache Entry: 98
SVG Scalable Vector Graphics image
dropped
Chrome Cache Entry: 99
SVG Scalable Vector Graphics image
dropped
There are 35 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http:///
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2028 --field-trial-handle=1988,i,14014969750969590740,8094112872708556366,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http:///
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=1992,i,16513210451006904575,5440778139736474350,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2032 --field-trial-handle=1976,i,12066371401791932286,9202225342553752342,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://gelw.nalverd.com/AvGEoxV/"

URLs

Name
IP
Malicious
https://gelw.nalverd.com/AvGEoxV/
malicious
https://gelw.nalverd.com/FWGyepeeTcNLGevvghfBiFFrzBGCYUBPWXEMKIPPIVBICGFWIRWQZIQCXMQI?NUXHCCSXGMHREERTFBIRZOTJnUNpiQBJQVUNRJGENPXLFHUCZQRYGBXSLLNBBLAQSWMBHQ#
malicious
https://gelw.nalverd.com/AvGEoxV/
malicious
https://gelw.nalverd.com/FWGyepeeTcNLGevvghfBiFFrzBGCYUBPWXEMKIPPIVBICGFWIRWQZIQCXMQI?NUXHCCSXGMHREERTFBIRZOTJnUNpiQBJQVUNRJGENPXLFHUCZQRYGBXSLLNBBLAQSWMBHQ
malicious
https://gelw.nalverd.com/klj1eG3tSaytCwjrXzICsMuEqyQpW4g8SFRzUj6tIKqr7txlTIREt7dVq58AuzO33Lfaab230
104.21.69.145
https://a.nel.cloudflare.com/report/v4?s=GNhGHBlTK40Qxl8yrzTBH100RSsBCKkzE6mn%2FT1cLWSiQRsNQ%2FRtiz0u8%2BfeYvoIT64L1%2FBrAaEmhuQJwZrIf%2F0Wp7f%2FSaz48XXOoES3a1mlfFYAXrQShML029%2FZ1A%3D%3D
35.190.80.1
https://gelw.nalverd.com/AvGEoxV/?I
104.21.69.145
https://gelw.nalverd.com/45yVO44dmTA90syzESKrvw70
104.21.69.145
https://code.jquery.com/jquery-3.6.0.min.js
151.101.2.137
https://developers.google.com/recaptcha/docs/faq#localhost_support
unknown
https://gelw.nalverd.com/vsM6mmvurLL43CsA8dxFAJ3rUHNM6UX3tRalxywoFHROMEZ4H0ywk9u8BpBzIWiEzk
104.21.69.145
https://support.google.com/recaptcha#6262736
unknown
https://gelw.nalverd.com/56K0nbKYrgITt23boQaw63NUst60
104.21.69.145
https://gelw.nalverd.com/mnOWaQBrcIdpa34BRhnzOaJ24edeMnemijmE4g5lxOGkEJX6fiGguaVvC2XLwx217
104.21.69.145
https://gelw.nalverd.com/opS0liWtiXMPTKhtyAqukrR2E4BkVhGkIyPEij9IxRXmD8amGJE1HQR7T51iDwV8Eef198
104.21.69.145
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/2068823770:1714138173:Yd-dD0IZEEpfFfpf9Qa63h2pIQIK_QVifXRcV5tB7BU/87a710338ea567d5/a7fbae31b181157
104.17.2.184
https://support.google.com/recaptcha/?hl=en#6223828
unknown
https://cloud.google.com/contact
unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/pat/87a710338ea567d5/1714139654153/81999ed28a33744e83b5c38619d9069ef1e685be62df9d2992cd495c0e962af3/v0ZxRUGQqAmyGXK
104.17.2.184
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/j7byh/0x4AAAAAAAXFpOFgzO5Hc4Qb/auto/normal
https://gelw.nalverd.com/efHT9fEl2bIjBxAkf788HZGPIeoMmn93
104.21.69.145
https://www.google.com/recaptcha/api.js
192.178.50.36
https://support.google.com/recaptcha/#6175971
unknown
https://gelw.nalverd.com/pq5Loe61P66934Jy6H9zKuv40
104.21.69.145
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/cmg/1/wh0E0SXYnx6pTBdJW%2Fl926I%2BPRUplRdtQz3K9lHXs%2Fs%3D
104.17.2.184
https://www.gstatic.c..?/recaptcha/releases/V6_85qpc2Xf2sbe3xTnRte7m/recaptcha__.
unknown
https://a.nel.cloudflare.com/report/v4?s=MCigmAka401pAFs%2B4HJoqm%2FJn5ACm1PS1Dw%2B1EAgvXFguHYHl8VBYYldwwjRaDS0%2Fs%2BjKFyTYPyHISGizl%2FOoJaRV6UvZKDNnBEHpTtN1Q05%2F412Ab4G8cGAP1PLVw%3D%3D
35.190.80.1
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
172.217.2.196
https://www.google.com/recaptcha/api2/
unknown
https://gelw.nalverd.com/89FC3LlzFMbfkAIa12MVy6APab80
104.21.69.145
https://gelw.nalverd.com/opXzx0V3EAxkN1NVtcp1FcM5voH8d1uvMINzY0npJbyzB59Q9k6zaOH8NN1UAEcJPowpabef231
104.21.69.145
https://gelw.nalverd.com/xyjOiDrdG3K2xYrsFtzef30
104.21.69.145
https://support.google.com/recaptcha
unknown
https://gelw.nalverd.com/wxzeIZFcFkuD2JEnuWY0FKopaBCDYwWLVVv9vW4bCd34124
104.21.69.145
https://gelw.nalverd.com/12mFBHzsl1P5UHY78Rh8VKqQwop46
104.21.69.145
https://gelw.nalverd.com/web8socket/socket.io/?type=User&appnum=1&EIO=4&transport=websocket
104.21.69.145
https://cloud.google.com/recaptcha-enterprise/billing-information
unknown
https://recaptcha.net
unknown
https://www.apache.org/licenses/
unknown
https://gelw.nalverd.com/yzRPf0ukSa92U6vgYnj4wVzAUifxwAyrsUB99awLhumZZ1wwaE3ab180
104.21.69.145
https://www.google.com/async/newtab_promos
172.217.2.196
https://gelw.nalverd.com/stfgaECSNBRcwGTjvw4Y2UjQh2isH45Yxy60MMkI4AG5WKuuMRQB3u7ef252
104.21.69.145
https://gelw.nalverd.com/56t0gL5gK2cmpN4LsnFcyfwlpkl11tSccwbSup0iu89110
104.21.69.145
https://gelw.nalverd.com/qrqxZQ7i49HVQDFkT2K9mniyQTFXOnXx5i81oj42ckX345139
104.21.69.145
https://gelw.nalverd.com/ghul1Tu50F2Y5jjiuNP6JD7kUYmWfHYKkVUyz4FdmnjUBVW0XkEsPF4LxYKUjdA3pZWDJffxref210
104.21.69.145
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/i/87a710338ea567d5/1714139654150/r0ZfVbOmH73SGQe
104.17.2.184
https://gelw.nalverd.com/klYxDrIn4c5ahRCJcTlqyzxGkfyG4Q3O2Emd78169
104.21.69.145
https://developers.google.com/recaptcha/docs/faq#my-computer-or-network-may-be-sending-automated-que
unknown
https://play.google.com/log?format=json&hasfast=true
unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
172.217.2.196
https://developers.google.com/recaptcha/docs/faq#are-there-any-qps-or-daily-limits-on-my-use-of-reca
unknown
https://cdn.socket.io/4.6.0/socket.io.min.js
18.64.174.31
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=87a710338ea567d5
104.17.2.184
https://gelw.nalverd.com/favicon.ico
104.21.69.145
https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_promos&q=EgRmgZjcGOXjrrEGIjC4jVxfp-h1T95D__e1hifsmLHtMbQtVurfMLjuVV-qYNApfmE9CIFqdY7D1CKGhlsyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM
172.217.2.196
https://gelw.nalverd.com/ciu6ZlGujadtbi2YBUZC11pmfydNyxiG9k7l
104.21.69.145
https://gelw.nalverd.com/12xTPozz5QNdx7URFcdWeF8920
104.21.69.145
https://gelw.nalverd.com/mn5trU4TDuv3RovRLaSklrwxCRX3PZ1DLDk90150
104.21.69.145
There are 47 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
a.nel.cloudflare.com
35.190.80.1
code.jquery.com
151.101.2.137
d2vgu95hoyrpkh.cloudfront.net
18.64.174.31
gelw.nalverd.com
104.21.69.145
challenges.cloudflare.com
104.17.3.184
www.google.com
172.217.2.196
fp2e7a.wpc.phicdn.net
192.229.211.108
cdn.socket.io
unknown

IPs

IP
Domain
Country
Malicious
192.178.50.36
unknown
United States
104.21.69.145
gelw.nalverd.com
United States
172.217.2.196
www.google.com
United States
18.64.174.31
d2vgu95hoyrpkh.cloudfront.net
United States
192.168.2.4
unknown
unknown
104.17.3.184
challenges.cloudflare.com
United States
151.101.2.137
code.jquery.com
United States
239.255.255.250
unknown
Reserved
35.190.80.1
a.nel.cloudflare.com
United States
104.17.2.184
unknown
United States

DOM / HTML

URL
Malicious
https://gelw.nalverd.com/FWGyepeeTcNLGevvghfBiFFrzBGCYUBPWXEMKIPPIVBICGFWIRWQZIQCXMQI?NUXHCCSXGMHREERTFBIRZOTJnUNpiQBJQVUNRJGENPXLFHUCZQRYGBXSLLNBBLAQSWMBHQ
 malicious
https://gelw.nalverd.com/FWGyepeeTcNLGevvghfBiFFrzBGCYUBPWXEMKIPPIVBICGFWIRWQZIQCXMQI?NUXHCCSXGMHREERTFBIRZOTJnUNpiQBJQVUNRJGENPXLFHUCZQRYGBXSLLNBBLAQSWMBHQ#
 malicious
https://gelw.nalverd.com/AvGEoxV/
https://gelw.nalverd.com/AvGEoxV/
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/j7byh/0x4AAAAAAAXFpOFgzO5Hc4Qb/auto/normal
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/j7byh/0x4AAAAAAAXFpOFgzO5Hc4Qb/auto/normal
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/j7byh/0x4AAAAAAAXFpOFgzO5Hc4Qb/auto/normal