Analysis Report https://www.ddfgptoolkits.com/ipWeb/appmanager/ct/desktop?_nfpb=true&_pageLabel=ct_home_page

Overview

General Information

Sample URL:	https://www.ddfgptoolkits.com/ipWeb/appmanager/ct/desktop?_nfpb=true&_pageLabel=ct_home_page
Analysis ID:	427255
Infos:
Most interesting Screenshot:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

No high impact signatures.

Classification

Signatures

There are no high impact signatures.

Source: https://www.ddfgptoolkits.com/ipWeb/appmanager/ct/desktop?_nfpb=true&_pageLabel=ct_home_page	HTTP Parser: No <meta name="author".. found
Source: https://www.ddfgptoolkits.com/ipWeb/appmanager/ct/desktop?_nfpb=true&_pageLabel=ct_home_page	HTTP Parser: No <meta name="author".. found
Source: https://www.ddfgptoolkits.com/ipWeb/appmanager/ct/desktop?_nfpb=true&_pageLabel=ct_home_page	HTTP Parser: No <meta name="author".. found
Source: https://www.ddfgptoolkits.com/ipWeb/appmanager/ct/desktop?_nfpb=true&_pageLabel=ct_home_page	HTTP Parser: No <meta name="author".. found

Source: https://www.ddfgptoolkits.com/ipWeb/appmanager/ct/desktop?_nfpb=true&_pageLabel=ct_home_page	HTTP Parser: No <meta name="copyright".. found
Source: https://www.ddfgptoolkits.com/ipWeb/appmanager/ct/desktop?_nfpb=true&_pageLabel=ct_home_page	HTTP Parser: No <meta name="copyright".. found
Source: https://www.ddfgptoolkits.com/ipWeb/appmanager/ct/desktop?_nfpb=true&_pageLabel=ct_home_page	HTTP Parser: No <meta name="copyright".. found
Source: https://www.ddfgptoolkits.com/ipWeb/appmanager/ct/desktop?_nfpb=true&_pageLabel=ct_home_page	HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 208.95.191.242:443 -> 192.168.2.3:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 208.95.191.242:443 -> 192.168.2.3:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 208.95.191.242:443 -> 192.168.2.3:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 208.95.191.242:443 -> 192.168.2.3:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 208.95.191.242:443 -> 192.168.2.3:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 208.95.191.242:443 -> 192.168.2.3:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 208.95.191.242:443 -> 192.168.2.3:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 208.95.191.242:443 -> 192.168.2.3:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 208.95.191.242:443 -> 192.168.2.3:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 208.95.191.242:443 -> 192.168.2.3:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 208.95.191.242:443 -> 192.168.2.3:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 208.95.191.242:443 -> 192.168.2.3:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 208.95.191.242:443 -> 192.168.2.3:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 208.95.191.242:443 -> 192.168.2.3:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 208.95.191.242:443 -> 192.168.2.3:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 208.95.191.242:443 -> 192.168.2.3:49752 version: TLS 1.2

Source: unknown

DNS traffic detected: queries for: www.ddfgptoolkits.com

Source: bootstrap.min[1].css.3.dr	String found in binary or memory: http://getbootstrap.com)
Source: jquery-ui.theme.min[1].css.3.dr	String found in binary or memory: http://jqueryui.com
Source: ga[1].js.3.dr	String found in binary or memory: http://www.google-analytics.com
Source: Why_cant_I_sign_on[1].htm.3.dr, Registering_for_Consumer_Toolkit[1].htm.3.dr, Signing_on_to_Consumer_Toolkit[1].htm.3.dr, What_if_I_forgot_my_user_name[1].htm.3.dr, Resetting_your_password[1].htm.3.dr	String found in binary or memory: http://www.madcapsoftware.com/Schemas/MadCap.xsd
Source: bootstrap.min[1].css.3.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: ga[1].js.3.dr	String found in binary or memory: https://ssl.google-analytics.com
Source: ga[1].js.3.dr	String found in binary or memory: https://ssl.google-analytics.com/j/__utm.gif
Source: ga[1].js.3.dr	String found in binary or memory: https://stats.g.doubleclick.net/j/collect?
Source: imagestore.dat.3.dr	String found in binary or memory: https://www.ddfgptoolkits.com/favicon.ico~
Source: {42691347-C28A-11EB-90E4-ECF4BB862DED}.dat.2.dr	String found in binary or memory: https://www.ddfgptoolkits.com/html/IS_User_Agreement.htm
Source: ~DFA26F8728FE7BE225.TMP.2.dr	String found in binary or memory: https://www.ddfgptoolkits.com/html/IS_User_Agreement.htm/Resetting_your_password.htmkit.htm
Source: {42691347-C28A-11EB-90E4-ECF4BB862DED}.dat.2.dr	String found in binary or memory: https://www.ddfgptoolkits.com/html/IS_User_Agreement.htmphttps://www.ddfgptoolkits.com/html/IS_User_
Source: {42691347-C28A-11EB-90E4-ECF4BB862DED}.dat.2.dr	String found in binary or memory: https://www.ddfgptoolkits.com/ipWeb/appmanager/ct
Source: {42691347-C28A-11EB-90E4-ECF4BB862DED}.dat.2.dr	String found in binary or memory: https://www.ddfgptoolkits.com/ipWeb/appmanager/ct/desktop?_nfpb=true&_pageLabel=ct_help_page
Source: {42691347-C28A-11EB-90E4-ECF4BB862DED}.dat.2.dr	String found in binary or memory: https://www.ddfgptoolkits.com/ipWeb/appmanager/ct/desktop?_nfpb=true&_pageLabel=ct_help_page.Consume
Source: ~DFA26F8728FE7BE225.TMP.2.dr	String found in binary or memory: https://www.ddfgptoolkits.com/ipWeb/appmanager/ct/desktop?_nfpb=true&_pageLabel=ct_help_pagegptoolki
Source: {42691347-C28A-11EB-90E4-ECF4BB862DED}.dat.2.dr, ~DFA26F8728FE7BE225.TMP.2.dr	String found in binary or memory: https://www.ddfgptoolkits.com/ipWeb/appmanager/ct/desktop?_nfpb=true&_pageLabel=ct_home_page
Source: {42691347-C28A-11EB-90E4-ECF4BB862DED}.dat.2.dr	String found in binary or memory: https://www.ddfgptoolkits.com/ipWeb/appmanager/ct/desktop?_nfpb=true&_pageLabel=ct_home_page.Consume
Source: {42691347-C28A-11EB-90E4-ECF4BB862DED}.dat.2.dr	String found in binary or memory: https://www.ddfgptoolkits.com/ipWeb/appmanager/ct/desktop?_nfpb=true&_pageLabel=ct_home_pageRoot
Source: ~DFA26F8728FE7BE225.TMP.2.dr	String found in binary or memory: https://www.ddfgptoolkits.com/ipWeb/appmanager/ct/desktop?_nfpb=true&_pageLabel=ct_home_pagegptoolki
Source: {42691347-C28A-11EB-90E4-ECF4BB862DED}.dat.2.dr	String found in binary or memory: https://www.ddfgptoolkits.com/ipWeb/appmanager/ct/desktop?_nfpb=true&_pageLabel=ct_home_pageits.com/
Source: ~DFA26F8728FE7BE225.TMP.2.dr	String found in binary or memory: https://www.ddfgptoolkits.com/ipWeb/appmanager/ct/desktop?_nfpb=true&_win
Source: {42691347-C28A-11EB-90E4-ECF4BB862DED}.dat.2.dr, ~DFA26F8728FE7BE225.TMP.2.dr	String found in binary or memory: https://www.ddfgptoolkits.com/ipWeb/appmanager/ct/desktop?_nfpb=true&_windowLabel=ctLoginControllerP
Source: {42691347-C28A-11EB-90E4-ECF4BB862DED}.dat.2.dr	String found in binary or memory: https://www.ddfgptoolkits.com/ipWeb/appmanager/ctRoot
Source: imagestore.dat.3.dr	String found in binary or memory: https://www.ddfgptoolkits.com/ipWeb/framework/skins/ct_commercial/images/favicon.ico
Source: {42691347-C28A-11EB-90E4-ECF4BB862DED}.dat.2.dr, ~DFA26F8728FE7BE225.TMP.2.dr	String found in binary or memory: https://www.ddfgptoolkits.com/onlinehelp/ct/Content/Topics/Registering_for_Consumer_Toolkit.htm
Source: {42691347-C28A-11EB-90E4-ECF4BB862DED}.dat.2.dr	String found in binary or memory: https://www.ddfgptoolkits.com/onlinehelp/ct/Content/Topics/Registering_for_Consumps://www.ddfgptoolk
Source: {42691347-C28A-11EB-90E4-ECF4BB862DED}.dat.2.dr	String found in binary or memory: https://www.ddfgptoolkits.com/onlinehelp/ct/Content/Topics/Resetting_your_password.htm
Source: {42691347-C28A-11EB-90E4-ECF4BB862DED}.dat.2.dr	String found in binary or memory: https://www.ddfgptoolkits.com/onlinehelp/ct/Content/Topics/Resetting_your_password.htm.Resetting
Source: ~DFA26F8728FE7BE225.TMP.2.dr	String found in binary or memory: https://www.ddfgptoolkits.com/onlinehelp/ct/Content/Topics/Resetting_your_password.htmkit.htm
Source: {42691347-C28A-11EB-90E4-ECF4BB862DED}.dat.2.dr, ~DFA26F8728FE7BE225.TMP.2.dr	String found in binary or memory: https://www.ddfgptoolkits.com/onlinehelp/ct/Content/Topics/Signing_on_to_Consumer_Toolkit.htm
Source: ~DFA26F8728FE7BE225.TMP.2.dr	String found in binary or memory: https://www.ddfgptoolkits.com/onlinehelp/ct/Content/Topics/What_if_I_forgot_my_user_name.htm
Source: ~DFA26F8728FE7BE225.TMP.2.dr	String found in binary or memory: https://www.ddfgptoolkits.com/onlinehelp/ct/Content/Topics/What_if_I_forgot_my_user_name.htmollerPor
Source: {42691347-C28A-11EB-90E4-ECF4BB862DED}.dat.2.dr	String found in binary or memory: https://www.ddfgptoolkits.com/onlinehelp/ct/Content/Topics/Why_cant_I_sign_on.htm
Source: {42691347-C28A-11EB-90E4-ECF4BB862DED}.dat.2.dr	String found in binary or memory: https://www.ddfgptoolkits.com/onlinehelp/ct/Content/Topics/Why_cant_I_sign_on.htm&Why
Source: ~DFA26F8728FE7BE225.TMP.2.dr	String found in binary or memory: https://www.ddfgptoolkits.com/onlinehelp/ct/Content/Topics/Why_cant_I_sign_on.htmctLoginControllerPo
Source: desktop[2].htm.3.dr, desktop[1].htm.3.dr	String found in binary or memory: https://www.ddfgptoolkits.com:443/ipWeb/appmanager/ct/desktop?_nfpb=true&_pageLabel=ct_help_page
Source: desktop[2].htm.3.dr, desktop[1].htm.3.dr	String found in binary or memory: https://www.ddfgptoolkits.com:443/ipWeb/appmanager/ct/desktop?_nfpb=true&_pageLabel=ct_home_page
Source: desktop[2].htm.3.dr	String found in binary or memory: https://www.ddfgptoolkits.com:443/ipWeb/appmanager/ct/desktop?_nfpb=true&_windowLabel=CTHelpControll
Source: {42691347-C28A-11EB-90E4-ECF4BB862DED}.dat.2.dr	String found in binary or memory: https://www.ddfgptoolkits.comRoot
Source: ga[1].js.3.dr	String found in binary or memory: https://www.google.%/ads/ga-audiences?
Source: ga[1].js.3.dr	String found in binary or memory: https://www.google.com/analytics/web/inpage/pub/inpage.js?

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 208.95.191.242:443 -> 192.168.2.3:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 208.95.191.242:443 -> 192.168.2.3:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 208.95.191.242:443 -> 192.168.2.3:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 208.95.191.242:443 -> 192.168.2.3:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 208.95.191.242:443 -> 192.168.2.3:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 208.95.191.242:443 -> 192.168.2.3:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 208.95.191.242:443 -> 192.168.2.3:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 208.95.191.242:443 -> 192.168.2.3:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 208.95.191.242:443 -> 192.168.2.3:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 208.95.191.242:443 -> 192.168.2.3:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 208.95.191.242:443 -> 192.168.2.3:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 208.95.191.242:443 -> 192.168.2.3:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 208.95.191.242:443 -> 192.168.2.3:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 208.95.191.242:443 -> 192.168.2.3:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 208.95.191.242:443 -> 192.168.2.3:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 208.95.191.242:443 -> 192.168.2.3:49752 version: TLS 1.2

Source: classification engine

Classification label: clean0.win@3/61@2/1

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DFF1672E34DEBBC179.TMP

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:3488 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:3488 CREDAT:17410 /prefetch:2	Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe	Automated click: Next
Source: C:\Program Files\internet explorer\iexplore.exe	Automated click: Next

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
208.95.191.242	www.ddfgptoolkits.com	United States		15342	DDPMI-1US	false

Contacted Domains

Name	IP	Active
www.ddfgptoolkits.com	208.95.191.242	true

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.ddfgptoolkits.com/ipWeb/appmanager/ct/desktop?_nfpb=true&_windowLabel=ctLoginControllerPortlet_1&ctLoginControllerPortlet_1_actionOverride=%2Fdesktops%2Fct%2Fportlets%2Fsecurity%2Flogin%2Fregistration	false		unknown
https://www.ddfgptoolkits.com/onlinehelp/ct/Content/Topics/Registering_for_Consumer_Toolkit.htm	false	0%, Virustotal, Browse	unknown
https://www.ddfgptoolkits.com/onlinehelp/ct/Content/Topics/What_if_I_forgot_my_user_name.htm	false		unknown
https://www.ddfgptoolkits.com/html/IS_User_Agreement.htm	false		unknown
https://www.ddfgptoolkits.com/onlinehelp/ct/Content/Topics/Why_cant_I_sign_on.htm	false		unknown
https://www.ddfgptoolkits.com/onlinehelp/ct/Content/Topics/Resetting_your_password.htm	false		unknown
https://www.ddfgptoolkits.com/ipWeb/appmanager/ct/desktop?_nfpb=true&_pageLabel=ct_help_page	false		unknown
https://www.ddfgptoolkits.com/onlinehelp/ct/Content/Topics/Signing_on_to_Consumer_Toolkit.htm	false		unknown
https://www.ddfgptoolkits.com/ipWeb/appmanager/ct/desktop?_nfpb=true&_windowLabel=ctLoginControllerPortlet_1&ctLoginControllerPortlet_1_actionOverride=%2Fdesktops%2Fct%2Fportlets%2Fsecurity%2Flogin%2FforgotPassword	false		unknown
https://www.ddfgptoolkits.com/ipWeb/appmanager/ct/desktop?_nfpb=true&_windowLabel=ctLoginControllerPortlet_1&ctLoginControllerPortlet_1_actionOverride=%2Fdesktops%2Fct%2Fportlets%2Fsecurity%2Flogin%2FforgotUserName	false		unknown
https://www.ddfgptoolkits.com/ipWeb/appmanager/ct/desktop?_nfpb=true&_pageLabel=ct_home_page	false		unknown

ID:	427255
Product:	CloudBasic
Start time:	20:33:35
Start date:	31.05.2021
Cookbook:	browseurl.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{42691345-C28A-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	6DD593D2AC2581168A641B3476D74F23	2CA73662545B22803C1610640F18BE53C3337DA2	686551FFBF3ED1A4DD97D6656DDB7976EF3BD34B844503542ECEA4D178783273
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{42691347-C28A-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	CFC264A8D8470B58AD209C92C21CD10E	D5A11E1E548550E5876102064AC0D8D1690CB9D8	2780F0D0D4EE38EAC8F45A73C796B72191AC04B4BA6699C4C71920C21BEF9D33
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{48E18953-C28A-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	B707545E075975223F0EBE5348A7FF87	EE93CFB7BF15695A27738E06C0799F356AB315F5	D78C9D6E8E6187F46362A2EC1FBE555B2B04D25BFC0409435AD4FFE395247B1D
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\ynfz0jx\imagestore.dat	data	8E411498103032BB0F46475D0357827D	902DCFB966117250AE8FABAC538A73114097A227	E4A5AF32FC2155FAFD0EFBAEF5EC0A0FFF264E5B6633AA68CAC168391CAE3CCC
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\IS_User_Agreement[1].htm	HTML document, ASCII text, with very long lines, with CRLF line terminators	EA826CF23602E26CB06C339AF31A7840	AA69B2D9543398EC3419D0E7DA5B141C5AB81A8C	55C36554119E4D59BE3345CDFCFE293DA470E5A559D5924DB2AA382F18D620C2
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\What_if_I_forgot_my_user_name[1].htm	XML 1.0 document, UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators	EA33CCA86CBA991950771343E263BC0F	6A10CC33B55C9CD0C2D9A79CA83CB3BCD50F6D7F	82E3191B1839DBCEBEA418A69B4287C73AA0C8EE0C64C0757F7FBCE815D42506
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\bootstrap.min[1].css	ASCII text, with very long lines	EC3BB52A00E176A7181D454DFFAEA219	6527D8BF3E1E9368BAB8C7B60F56BC01FA3AFD68	F75E846CC83BD11432F4B1E21A45F31BC85283D11D372F7B19ACCD1BF6A2635C
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\bootstrapOverride[1].css	ASCII text	28EF49DC9ADBFF3E0E8C55C3AD99641D	403878EC311DF51E6177302CD553A5E4C97ABCB2	E438546EF6A865E90EF5EB5C8DAA5C425F13EDA219C558BFE0DB3DA1664974FD
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\components[1].css	ASCII text	A1E5D416CBC262104A912FEC6653BE0A	453D506D80A51EE11694E1163AC133D50365203B	BB47B2746C75FBD928E3157211592A535D9215764F03640AA4E582E36179C49F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\desktop[1].htm	HTML document, ASCII text, with very long lines	A0771E389A40604EA0E92B3590DF02EF	1B1218B8EC1A72333E3BF354E48AD1D423314BBD	18C94728598B7F31ADAA7674514D2ACB16A37107B307599950EBE558C9C44EC5
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\favicon[1].ico	MS Windows icon resource - 1 icon, 27x27, 32 bits/pixel	B9AE638F726F5CEF870D3460F89DF7D5	4F764EA5813AF114D5DC887AC75A08264DFF4DA2	ABCD1DF6F3BDB228377A0236E1A8CC30B059584C8CCE2D576EBC7CF3BF2E6388
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\favicon[2].ico	MS Windows icon resource - 1 icon, 16x16	A8B9DD2C84DBF031C05A651F4AD5205C	B8ACCA7795226C8CB32763E937C5CC0CF7939D1F	BB7373C120A1E9DD94281ABB54AFFD1D6B7FD386DC29F743B75C8655C09089F3
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\form[1].css	ASCII text	12D23742FCB717AD141463A75B88EEFD	226791F08A5B8344BF813D6D5BBF0442F430778C	67BB43D5E15422161918378D0EE5D5043214032F27D3F1585410B0DDDED67E2F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\jquery-ui.min[1].js	ASCII text, with very long lines	C15B1008DEC3C8967EA657A7BB4BAAEC	78489E580ADAEF931E6E5B131DAB556C397E4A1A	28CE75D953678C4942DF47A11707A15E3C756021CF89090E3E6AA7AD6B6971C3
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\jquery-ui.theme.min[1].css	ASCII text, with very long lines	C12CAC44216CF877FD0C6903F3794407	A3640158B618410B280A5F37E54661A8337D6BD0	023CA8C9A46D9C6553CB0287FC8B31C6EE4F5C8D2CE02704D01CCF017F373E97
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\layout[1].css	ASCII text	EC3F46331CDF4C00BAE6BF87A133E95D	C8BF79B498711A14224EB26431B4933923FC3550	2630B274C51EC23355C03612291EC7AC878E23D7EFEA3A7169A76AF2740D7C10
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\window[1].css	ASCII text	A924EA3BECD4FF51135853C85E5DE637	0E9CF5700C53EFC97C1300B5CB8C22C9B46DF557	81FD99C6D6C4CC8C5A48211D0F2F025FBD15FA6E0899D7E0EA55958EAA8D33CF
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\window[2].css	ASCII text	9269BBD96A776F7C8A4EC65768F57C77	0074295403DD1C91BCF6FFBE5C05D84983DD1BFD	707FED6B2BE24C3D808F817CF186A394D5A1181D3AAB29CD098BA1F6940FF99C
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\Gotham-Book[1].woff	Web Open Font Format, TrueType, length 16384, version 0.0	80AC6F1DE11FE94333AFF0A86CA90A11	6C0C97CEBCC0619F11D696E0A2AF2DA3387BA5FB	C6DC95F430548A5874324477B0A5A64743930109A48125469565F66CC00026C7
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\MadCapAll[1].js	UTF-8 Unicode text, with very long lines, with CRLF line terminators	09DFD490632AD5A100D692F19C761E28	FC1F67D3F2EA151023498F703560B2EFEBAAF917	1BDB08CBE06A99168CC417EA5B84B092A5FC85F068D29B2E1216572095392A2A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\MadCapBodyEnd[1].js	UTF-8 Unicode (with BOM) text, with CRLF line terminators	CA9B0FAD85477AE1B8007484AFAE1074	00CD94858CEE04658AB951630C21273C12FF8EF3	EEA11D76E574F725846505B34AB65FA10D82E11228524E2D05CD52E76AA3AC9C
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\Resetting_your_password[1].htm	XML 1.0 document, UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators	35F83953A07CFC4CA1EE62749056BF78	28712736238C61EF450FC4FE7161D20B2315DFFF	2FDF0DCE00FF0248CF77ACE1E79221513CC2FBBB28D4377ACAAED1B89D04D587
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\book[1].css	ASCII text	C40945E4B3742E53AED7608BF889D818	33E13AC4BD54C4DD39B4919DD30D60B3B7C7B352	D523CFFDBFBF86CF04C713AABD1D558B343DDAA961D07FFECB738BB28EDDCC35
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\button[1].css	ASCII text	9A556EAEAF566AD2B228B9E383E99553	2A21F1931631B6C4262FBAD2CC9245CE09A55FF8	6DF465563555FDEB2EA0695FD6C682DC2DD9F49713D488C68363C8BCF710C94E
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\cps[1].css	ASCII text, with CRLF line terminators	A7A3D5E519E535CA7E3FA993FF48A30B	61562EFFC2E33FB408A0284A60216B0B5487ED43	481E00670325B1DBCDC736BB0B19CF1D6055EC1E2F5CF28D5BCD4E802C519059
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\custom-portlets[1].css	ASCII text, with CRLF line terminators	F11C965BD89232B66047175D42844FA0	023E5C5137356FB3FF1B8E34D5BBAC0602C389EA	BC5AE6958CD61211607985526C635020B392FEA7A3A249EBAF2EB23D85BE867F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\ga[1].js	ASCII text, with very long lines	E9372F0EBBCF71F851E3D321EF2A8E5A	2C7D19D1AF7D97085C977D1B69DCB8B84483D87C	1259EA99BD76596239BFD3102C679EB0A5052578DC526B0452F4D42F8BCDD45F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\iconHelp[1].gif	GIF image data, version 89a, 16 x 16	50A6646A5B4C10A110B737C978751253	84CA21994707C145A6355781B6CF3A4D56B9C77E	1579890343A70767130967B5CC22B41D9AFC2190DBCC0183616B7883920B5D6A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\netui_namemap_init[1].js	ASCII text	8209921EA14D8B160D8270D1F0B0F2BF	8B9B232922AF293EEFA040B8D4128BFC217B7AD7	9F0710E78FAB8005D12D447C193822B3DDD30DD3C293C04DF61901EB96AA0C39
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\portlet[1].css	ASCII text	A3A84FADAF66B6AD0474E22E1B2461CA	E434881F969DFC9E9A84DA0B1BA253566BBC677C	8A7F2DD4A4766FBB9C371672E14A5E01CF8CD2EC10E92BA2D9169B94F37A84DF
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\util[1].js	ASCII text	3FA73E91251E3B9C93340FE86052E718	549B6D2AD6298B5E16F7D6204D619BA499F09E19	5B969E99662770C7E96CBD5EE4A407B94DF7103D5DD532FACCC3C9BFC8796097
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\FormProcessing[1].js	ASCII text	4D38320C9F2C719713827D938DB8EDE7	70E1C6F602F0D635A96ADCCAC3039BE3B4BD29FA	777795677FB8F6038FC36336A67EB3B0CE30D9953F609D7D82F36176687AED7F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\Registering_for_Consumer_Toolkit[1].htm	XML 1.0 document, UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators	4006047197ED6620AA79143BD55143DF	D9A689058C1071C9C2E97ABA369D28D6BB9A71F0	D1DBE4E07C8B1B78CF20003B3A3CC4C8FA9D88AEC704794DFADB4E6B3EC963D7
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\Why_cant_I_sign_on[1].htm	XML 1.0 document, UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators	153CC0C2FD9E8B79B10539ABCBD0B34D	32107CB6705C77DB423B2DE343CB17DFD802F65F	661117E4F7840E0DA574946A1B3335A8B43D33A851BDC10D30FF01256F93943F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\bootstrap.min[1].js	ASCII text, with very long lines	5869C96CC8F19086AEE625D670D741F9	430A443D74830FE9BE26EFCA431F448C1B3740F9	53964478A7C634E8DAD34ECC303DD8048D00DCE4993906DE1BACF67F663486EF
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\custom-portlets[1].css	assembler source, ASCII text	C187F33A917D3C7CA4C51A8EA1813F31	14D9678FBD1463E3BE800B1B7DC0BAE4D50E5C34	9250864CB708B4A6C883224BAB5F5EA1B49A26A7A6DC21FB01522103E908EC16
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\custom[1].css	ASCII text	7454F249215AC61F11FF36567CD1ED8E	DE87CAABC7D4BD04E7EADAD68F0A626A9F2FC6FD	ABED8EBEA3529FD09564D10BBA777A2212CF1783C47324CC2236B3DF98F4EE96
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\delete[1].js	ASCII text	1F3B8653623CAB70A2AB128B9F243693	4B3DE25392015EE9F7786303BA7F1FD7E30B4FED	4B71545F27E3D7C594882735E4E5A10A4F24CF363E95C86760E9D5B8B95F23FD
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\desktop[1].htm	HTML document, ASCII text, with very long lines	28F070A5EF753D257278BA68FF535FAE	4D836293667B1EBC1AE5604EB2607666D86F7382	5802DEE2EA1C30AF069980BEFF452D7356AE4BF79A33868D9A6D3B84F303A863
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\desktop[2].htm	HTML document, ASCII text, with very long lines	A0771E389A40604EA0E92B3590DF02EF	1B1218B8EC1A72333E3BF354E48AD1D423314BBD	18C94728598B7F31ADAA7674514D2ACB16A37107B307599950EBE558C9C44EC5
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\form[1].css	ASCII text, with CRLF line terminators	AEDC72FB33A13C9E7FFFDBA27087F962	C68E2D097CD547482AE713A4D2515D59234FD5FE	B677E1FD4BF929355BE4A5927F3F0A38B1A17EB62C26C6BCC980423E15A071AE
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\icon-bullet-whitebg[1].gif	GIF image data, version 89a, 5 x 5	8EF45262EA4131FD8F0F2DBD698492B4	2CE8408D47AFA5CF9014E867442A4430BF49AFCC	E86314E3B0B978AB422A16E31E3F23A141CE1895B8A06587A18D06D7BE3F4720
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\jquery-3.3.1.min[1].js	ASCII text, with very long lines	A09E13EE94D51C524B7E2A728C7D4039	0DC32DB4AA9C5F03F3B38C47D883DBD4FED13AAE	160A426FF2894252CD7CEBBDD6D6B7DA8FCD319C65B70468F10B6690C45D02EF
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\jquery-ui.min[1].js	ASCII text, with very long lines	C15B1008DEC3C8967EA657A7BB4BAAEC	78489E580ADAEF931E6E5B131DAB556C397E4A1A	28CE75D953678C4942DF47A11707A15E3C756021CF89090E3E6AA7AD6B6971C3
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\Gotham-Bold[1].woff	Web Open Font Format, TrueType, length 27360, version 0.0	E74FF77A19C633796DC1A0402240B8BF	13782CBF384D2ABDD4B48419EEAD7BEF324E65EA	66CABAAB424EDB1B8509AE0013FC6A38FE1ABCE1930E45BC18BE03279F0496AE
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\Signing_on_to_Consumer_Toolkit[1].htm	XML 1.0 document, UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators	F6CADFBF9941DD064DD6AD5C1C289EC5	FD15850C009165F875A17750033EFB0C4DEF9969	EEEAF427C4BEC2ED8296DF38AF95B2DB21D4D110C53B1DF5E168F26945966F13
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\bgorange[1].gif	GIF image data, version 89a, 13 x 13	62935C79C0A6DA1A792D38F6DBAF0081	20924AD49561854AAF71F8713890E46F9035A9C7	6FB420253E2FF796493859461F6E3302B14AC9B77BDE621406F30167C1C29F9E
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\body[1].css	assembler source, ASCII text	5CBF1CF9C6624FD188EBA9868B93BE69	128EDF144A3772EC9E08A37F6D0354ECA93718AC	FB799B2F0FB42961D8C827D3B3A0E1BAE134E0FB15EC6BBB4ADAFC777A2196CE
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\custom-nav[1].css	ASCII text	8C8F3E8A0E868906E95914FCB6253976	635F85D625A78F950852783C1D80CA04139A0B35	BDA7EDD7F2999FD1A4FE09A0D98AE8B02386CE2EE1BD34744735AC30866207F2
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\custom-nav[2].css	ASCII text	C2144E20C777813DFE7A975299CB6306	18FF47324E97C3EAC49293DA7779EFB77644977F	1889AEB0545485BF6DEA3207BA9C1575728EB4831E4AC87416CF1C12ABF6E3A4
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\desktop[1].htm	HTML document, ASCII text, with very long lines	1F17F6569B259E1F892B3898AC921689	DA60E6FACF06D78F119581426B9688F2C2EBEBBD	C98025F75D3F76D071B772A0798CE045701204381AA17B07DC2786B28ADBD856
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\desktop[2].htm	HTML document, ASCII text, with very long lines	A0771E389A40604EA0E92B3590DF02EF	1B1218B8EC1A72333E3BF354E48AD1D423314BBD	18C94728598B7F31ADAA7674514D2ACB16A37107B307599950EBE558C9C44EC5
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\float[1].js	ASCII text	65CDACC325F3C4BB05AD67EF568C6753	F42805CA3D0AFE27E67F76E67356256F6D4D03FE	AD9AA3D3FFCE962D20AB2785AA28C1D04AA58577617F516B17C3102E08A2824F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\menu[1].js	ASCII text	2B639A281B2E0A5C49C6AA6B3B4FC1AD	0121493337FBDECF800D2DAB62421C86540EE4FB	1A5E86A8E4B03E45134EED45DFE2DAE0F20D0ACB3A581D9DB60B342CEEB343CA
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\menufx[1].js	ASCII text	32A3285AABD46C4B4CF33D02A4D46711	9E30C8FDDC197A3AA7AF896C7F98ECEA7563698E	879AECC8A76BEAEA86F0E22A5779F73BC20E131D08095E1F3B3DBCA15995432A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\skin[1].js	ASCII text	ABF5104A526E9C178424A177473C412C	0717BB5DE277C71477CEA49D96FE43A23E937287	9FE9B275E6461E444AD37866560CEC67F2D58ACB1317170BDE472CB5BA2A0519
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\smallorange[1].gif	GIF image data, version 89a, 10 x 10	E15791DDF06FD7022B50E96AEDE9D6A1	E881032407722002BE4E4F767A4718667084851B	817A3D1406CA2AFF75D112DF104455425737BF901F6E4F4BCC6279DC0833A8CC
C:\Users\user\AppData\Local\Temp\~DFA26F8728FE7BE225.TMP	data	93F89173962C915F2EB7409CE988B45A	8AB1AF6A8E881FF78217FF0DD9661FC0B67ADF81	C33D378C2943FA2CD13CBB43C1FE9457B0E0C2D553353F145CA2CEE15A97072F
C:\Users\user\AppData\Local\Temp\~DFF1672E34DEBBC179.TMP	data	C7B506DDD5F0FD6800969758C23677C5	001BC155B30EB93D72876C3288A7A842CB3877AE	B8D951D44371230AB0981536EE04CD0D129AF7062AC8B996860C38D27A71DE29
C:\Users\user\AppData\Local\Temp\~DFFF2781C92EF79BB8.TMP	data	625212169D297CE77AFD9447A2D0CACB	D48C5E474ED2F364647E87F1810FB7B7FDF04ADB	4ABE981CF92A913CF40BE4DC5408D04B0B929125590A4F1AE58CDCB0B74D9F31
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\3SEUU2BSKWZN2K86OMG2.temp	data	0D7032466534DF9FB5560F117DD041DE	AB010D5F9FBC6F36549E9E874B01DBF078D62087	08EE8A073F3E7B7B6AD9723DCC6B4B87AC1658784F571FBE414EA0925A8DCB9F

Analysis Report https://www.ddfgptoolkits.com/ipWeb/appmanager/ct/desktop?_nfpb=true&_pageLabel=ct_home_page

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing:

Compliance:

Networking:

System Summary:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs