Windows Analysis Report
https://t.co/DnQEiw4qor

Overview

General Information

Sample URL:	https://t.co/DnQEiw4qor
Analysis ID:	1526007

Detection

Score:	20
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Performs DNS queries to domains with low reputation

Stores files to the Windows start menu directory

Classification

Signatures

Source: https://ofttimesscrapie.pro/?encoded_value=223GDT1&sub1=c972573f12b442909030f3cfd46aae04&sub2=&sub3=&sub4=&sub5=15608&source_id=20121&ip=8.46.123.33&domain=www.clicknloader.com

HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.17:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.17:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.68:443 -> 192.168.2.17:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.209.182:443 -> 192.168.2.17:49779 version: TLS 1.2

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 27MB

Networking

Performs DNS queries to domains with low reputation

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: push-visit.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: push-visit.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: push-visit.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: push-visit.xyz

Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /file.html?pmnohklhivng=jjiybomjnazj10000010000of002ygu020940l17w80yq0001 HTTP/1.1Host: abcfiretech.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Referer: https://t.co/DnQEiw4qorAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /326NL2/893G9HD/?sub1=2_1_137982&sub2=328_879_158.51.98.226_21&sub3=1_29q1i9&sub5=29q1i9 HTTP/1.1Host: www.tl2giutrk.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Referer: https://t.co/DnQEiw4qorAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: t.co
Source: global traffic	DNS traffic detected: DNS query: abcfiretech.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: www.tl2giutrk.com
Source: global traffic	DNS traffic detected: DNS query: www.redirectf4st.com
Source: global traffic	DNS traffic detected: DNS query: www.clicknloader.com
Source: global traffic	DNS traffic detected: DNS query: ofttimesscrapie.pro
Source: global traffic	DNS traffic detected: DNS query: virtualpushplatform.com
Source: global traffic	DNS traffic detected: DNS query: use.fontawesome.com
Source: global traffic	DNS traffic detected: DNS query: push-visit.xyz
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.17:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.17:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.68:443 -> 192.168.2.17:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.209.182:443 -> 192.168.2.17:49779 version: TLS 1.2

Source: classification engine

Classification label: sus20.troj.win@19/21@34/201

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 --field-trial-handle=1928,i,15819190803342787242,11737813605082890678,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://t.co/DnQEiw4qor"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 --field-trial-handle=1928,i,15819190803342787242,11737813605082890678,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.184.195	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
108.177.15.84	unknown	United States	15169	GOOGLEUS	false
172.67.142.245	unknown	United States	13335	CLOUDFLARENETUS	false
34.98.114.148	www.tl2giutrk.com	United States	15169	GOOGLEUS	false
130.185.239.18	abcfiretech.com	Bulgaria	32181	ASN-GIGENETUS	false
142.250.185.110	unknown	United States	15169	GOOGLEUS	false
172.67.130.219	www.redirectf4st.com	United States	13335	CLOUDFLARENETUS	false
20.50.64.3	push-visit.xyz	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	true
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.185.142	unknown	United States	15169	GOOGLEUS	false
104.21.27.152	unknown	United States	13335	CLOUDFLARENETUS	false
188.114.96.3	www.clicknloader.com	European Union	13335	CLOUDFLARENETUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
172.66.0.227	t.co	United States	13335	CLOUDFLARENETUS	false
172.217.16.195	unknown	United States	15169	GOOGLEUS	false
104.21.67.146	virtualpushplatform.com	United States	13335	CLOUDFLARENETUS	false
172.217.18.100	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.17

Contacted Domains

Name	IP	Active
push-visit.xyz	20.50.64.3	true
a.nel.cloudflare.com	35.190.80.1	true
t.co	172.66.0.227	true
www.tl2giutrk.com	34.98.114.148	true
www.clicknloader.com	188.114.96.3	true
www.google.com	172.217.18.100	true
ofttimesscrapie.pro	188.114.96.3	true
virtualpushplatform.com	104.21.67.146	true
abcfiretech.com	130.185.239.18	true
www.redirectf4st.com	172.67.130.219	true
use.fontawesome.com	unknown	unknown

Contacted URLs

Name	Malicious	Reputation
http://www.tl2giutrk.com/326NL2/893G9HD/?sub1=2_1_137982&sub2=328_879_158.51.98.226_21&sub3=1_29q1i9&sub5=29q1i9	false	unknown
https://ofttimesscrapie.pro/?encoded_value=223GDT1&sub1=c972573f12b442909030f3cfd46aae04&sub2=&sub3=&sub4=&sub5=15608&source_id=20121&ip=8.46.123.33&domain=www.clicknloader.com	false	unknown
http://abcfiretech.com/file.html?pmnohklhivng=jjiybomjnazj10000010000of002ygu020940l17w80yq0001	false	unknown

ID:	1526007
Product:	CloudBasic
Start time:	16:37:51
Start date:	04.10.2024
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 4 13:38:42 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	F2E450E5B4C51719FCD828A5EEFDAF39	4DA07449942108D1C0D1E7B2E2FB8783653D37F9	898F1CDFE9E89D6C36144D601B0BBA7D174D17EA1F0F8DDEB7F81687A8D57C91
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 4 13:38:42 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	F557ADED66377E3898065DFBBBB1EB29	6A00363B3DE5D4F1091510EA21A2EF6FD22C0EF9	C51B10810E430972007BF5256D6CAB6C240D09DB32B88FD73E48854F02B89E51
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:54:41 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	75711B944E12B9CB782FAED76C3390A7	FFD3FBBCF69613EEE9F2C6740A346795DC543E71	7B08D5AAFDA701BA394ADF4D952344AACF4380C9CD9BDE42ED8599D808769846
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 4 13:38:42 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	485F24035FFFA5DB60658DE4E00CC0D9	D721C6F0F11D96489E3B72938FC45DB417D4DABD	376277D7987206047207A3B4101F053617CDFF8ECA1FFBB53D113F5C37D152F7
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 4 13:38:42 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	06876B418223C070405069FED5DC414F	1102D63BDEAC94F0F50827B358C3E6AFECDB459B	81546D00678565C966EC9567F1F78C9FA14E8B12727E30300632C608FEBD8F30
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 4 13:38:42 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	D48762F74D2C6D629425FD4DDAD5A7AC	64B3F1C4FDA039ACA42B5035E51CFD7BBE839F6A	0934AC28FB18A6755B8CEA40AED507A7E6220E719192548CF4265B3C27A819DB
Chrome Cache Entry: 104	ASCII text, with very long lines (2087)	E1BBDDE3DA7E752B53670EDFBC2AC0B6	3596BA7A911A76EBCFCB3DB9A17D32363C75788D	3C84B28386C5C3620305387766021AB72864D3A9216B716CE0C70B9EFA11A1DA
Chrome Cache Entry: 106	PNG image data, 1684 x 551, 8-bit/color RGBA, non-interlaced	82C104DE86667C2B15A9586EEB4A3145	3C96B92F06699772590E8A83739AA37BE19BFE3A	668C19383725720F06B04EA4AD62D93C56D0C9B68AE91CDCEF0828318B9705AE
Chrome Cache Entry: 84	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced	11C6A53B4E028D2CA36BDBB0F46F12D7	170B3977139D27791F2C281B6A235793B455F678	158DF9E156E7522DB3CCA6577A212582E0764C9F749BBC39EDADBB75782DE21C
Chrome Cache Entry: 85	ASCII text, with CRLF line terminators	58C942A1D03F93C3EE99A709E03DDF54	52E21A8F0D44189BE30758629ABE1BA1B07429F5	11F105A08E89103402777A983B6D8F88CC66C7706F95A348719D70FFE3ADADA3
Chrome Cache Entry: 86	HTML document, ASCII text, with very long lines (479), with no line terminators	A03E833C50B9B5338C8FEAD76A8BCBC3	E5A4AA30637B2C3BA66313747F8EEB3914F9417D	7B8153BB141B7FEACD16B40641288A017AFC844A2FAFF63AC28472217AC329B0
Chrome Cache Entry: 87	ASCII text, with very long lines (65350)	5E29440867FDB02A48DFFDED02338C31	C8BFBBFCA7EB327E2E98CAF637D6DE05E5EE737A	812AB0E46F86B2CE98AB2425AB2224B90D0845952A1AC0D5ABD734B6217E98BF
Chrome Cache Entry: 88	ASCII text	214349946705960CFE67BEDAF33557FD	9913FDF6E3A598AB77C67A9FEA25350C5240E796	F01E80D938B5EF8A342CB62ED6E4C7DFA34B5E64E4EA511CB5231A9B0B266B1D
Chrome Cache Entry: 89	GIF image data, version 89a, 452 x 302	F39EC33F8E63AA394EF898EFFF0D3969	DF50325585B0582FE435CFB0206B851D4B1C0105	A09A57DB981B13C71AC6A6F4C966656994CEF24C3CEBFBD816FE1FA5AF8C1065
Chrome Cache Entry: 92	PNG image data, 1684 x 387, 8-bit/color RGBA, non-interlaced	3A72DCBECCB52F82840FF280A6AFDB05	1F0AA7E26C87515CE83CA44F794A7E25D350C675	97F53F1905052FCCE8B5496AFEEA1CC3E1BA1407E052F04682BE81D09B690562
Chrome Cache Entry: 93	ASCII text, with CRLF line terminators	3AB05E26F5BDCD56D77D2B195BE0C644	A9A42E1DA8A5DF1561C06B5EE26C8C6BA314A6B3	2D52B22D335024AA0EFBA1DD0A13EBDAC87329BF27B3F0B6D7BBA7A2522EED33
Chrome Cache Entry: 94	PNG image data, 449 x 361, 8-bit/color RGB, non-interlaced	D33BD0635F2A373C686B1F4FF1636E28	6A273355A9D22D8564D7F4BBFAEC1A9636AB87E7	0B1E3F520732D85B3EF94866C75FED54B83A92A43738E7B4DF6ADDB9EE2E4789
Chrome Cache Entry: 96	ASCII text, with very long lines (57919), with CRLF line terminators	43D6B8FDF324505F0CEB7EA698D0B7A5	5FAB2FF7884F74BEB235AE1382A647CBD4491F3A	4C055E6D0D9BA2B8F1BE4719110E92C1B9499ED0759F0D1C48FCCD16A7B31DCF
Chrome Cache Entry: 97	ASCII text, with very long lines (1301)	A039CF921197E7D7FC55F91381931C9C	6B0F2BDF4383B05C4BAB383D4BB0031865B0042E	A26CD1F11C52B3D369A64DB3026165F5109C51875F971F8459878F4E070637FA
Chrome Cache Entry: 98	HTML document, ASCII text, with CRLF line terminators	1F2D48C4FF4E64B6CD52DCC195661137	4027FD733385BE485C946A2CFF56D950028B5D15	3365FD5BCCA6DB3766CF099D5BBB74DC8DB7FAE302C30FA6BDF43EEDDAF98742
Chrome Cache Entry: 99	HTML document, ASCII text, with very long lines (328), with CRLF line terminators	0BE53146CD7082EB72FFA6698B1539E1	61D6D81B21E73FD99C54987A28660C9C25EC6CCE	DA41938F706677C7EBCC766AEB3429A4853584F015EDF3C4EBDB2E9A902A250C

Windows Analysis Report
https://t.co/DnQEiw4qor

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report https://t.co/DnQEiw4qor

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
https://t.co/DnQEiw4qor