Engine | Download Report | Detection | Info |
---|---|---|---|
|
malicious
Score: 100
|
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
|
IP | Country | Detection |
---|---|---|
149.154.167.220 | United Kingdom | |
208.95.112.1 | United States | |
34.117.59.81 | United States |
Name | IP | Detection |
---|---|---|
ipinfo.io | 34.117.59.81 | |
ip-api.com | 208.95.112.1 | |
api.telegram.org | 149.154.167.220 |
Name | Detection |
---|---|
http://api.telegram.org/botTELEG | |
http://api.telegram.org/botTELEGRAM_APIKEY/sendMessage?chat_id=TELEGRAM_CHATID&text=%F0%9F%98%8E%20N | |
http://ip-api.com/line/?fields=hosting | |
Click to see the 21 hidden entries | |
http://crl.entrust.net/2048ca.crl0 | |
http://ipinfo.io/jsonHt | |
http://ip-api.com4bkX | |
https://api.telegram.org/botTELEGRAM_APIKEY/sendMessage?chat_id=TELEGRAM_CHATID&text=%F0%9F%98%8E%20 | |
http://www.entrust.net/rpa0 | |
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name | |
http://ipinfo.io/json4 | |
http://crl.entrust.net/ts1ca.crl0 | |
http://nsis.sf.net/NSIS_ErrorError | |
https://ipinfo.io/missingauth | |
http://ipinfo.io/json | |
http://aia.entrust.net/ts1-chain256.cer01 | |
http://ip-api.com | |
http://api.telegram.org/botTELEGRAM_APIKEY/sendMessage?chat_id=TELEGRAM_CHATID&text=%F0%9F%98%8E%20New%20worker%20connected!%0A%0A%E2%9D%97%EF%B8%8F%20Info:%20%0A%E2%80%94%20GPU:%20Microsoft%20Basic%20Display%20Adapter%0A%E2%80%94%20CPU:%20Intel(R)%20Core(TM)2%20CPU%206600%20@%202.40%20GHz%0A%E2%80%94%20RAM:%208191%20MB%0A%0A%E2%9D%95%20Other%20info:%0A%E2%80%94%20Username:%20user%0A%E2%80%94%20IP:%20102.129.143.40%0A%E2%80%94%20Country:%20CH%0A%E2%80%94%20Build%20tag:%20BOba%0A | |
https://api.telegram.org/botTELEGRAM_APIKEY/sendMessage?chat_id=TELEGRAM_CHATID&text=%F0%9F%98%8E%20New%20worker%20connected!%0A%0A%E2%9D%97%EF%B8%8F%20Info:%20%0A%E2%80%94%20GPU:%20Microsoft%20Basic%20Display%20Adapter%0A%E2%80%94%20CPU:%20Intel(R)%20Core(TM)2%20CPU%206600%20@%202.40%20GHz%0A%E2%80%94%20RAM:%208191%20MB%0A%0A%E2%9D%95%20Other%20info:%0A%E2%80%94%20Username:%20user%0A%E2%80%94%20IP:%20102.129.143.40%0A%E2%80%94%20Country:%20CH%0A%E2%80%94%20Build%20tag:%20BOba%0A | |
https://api.telegram.org/ | |
http://www.entrust.net/rpa03 | |
http://ocsp.entrust.net02 | |
http://ipinfo.io/jsonxt | |
http://ocsp.entrust.net03 | |
http://nsis.sf.net/NSIS_Error |
Name | File Type | Hashes | Detection |
---|---|---|---|
C:\Users\user\AppData\Local\Microsoft\OneDrive\OneDrive.exe |
PE32+ executable (GUI) x86-64, for MS Windows | # | |
C:\Users\user\AppData\Roaming\[New]1.exe |
PE32 executable (console) Intel 80386, for MS Windows | # | |
C:\Users\user\AppData\Roaming\[New]Salvity_crypted(2).exe |
PE32 executable (console) Intel 80386, for MS Windows | # | |
Click to see the 4 hidden entries | |||
C:\Users\user\AppData\Local\Microsoft\0ZkOYc2aecGHWT_s |
Non-ISO extended-ASCII text, with NEL line terminators | # | |
C:\Users\user\AppData\Local\Microsoft\OneDrive\Secur32.dll |
PE32+ executable (DLL) (GUI) x86-64, for MS Windows | # | |
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\sendMessage[1].htm |
HTML document, ASCII text, with CRLF line terminators | # | |
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\json[1].json |
UTF-8 Unicode text | # |