Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
RemittanceDetails(Rjackson)CQDM.html
|
HTML document, Unicode text, UTF-8 text, with very long lines (835), with CRLF line terminators
|
initial sample
|
 |
|
|
Chrome Cache Entry: 152
|
PNG image data, 93 x 96, 8-bit/color RGB, non-interlaced
|
downloaded
|
||
|
Chrome Cache Entry: 153
|
PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
|
dropped
|
||
|
Chrome Cache Entry: 154
|
ASCII text, with very long lines (62597), with CRLF line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 155
|
ASCII text, with very long lines (65447)
|
dropped
|
||
|
Chrome Cache Entry: 156
|
HTML document, ASCII text, with CRLF, LF line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 157
|
ASCII text, with very long lines (47992), with no line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 158
|
ASCII text, with very long lines (47261)
|
dropped
|
||
|
Chrome Cache Entry: 159
|
HTML document, ASCII text
|
downloaded
|
||
|
Chrome Cache Entry: 160
|
HTML document, ASCII text, with no line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 161
|
HTML document, ASCII text, with very long lines (529), with CRLF line terminators
|
dropped
|
||
|
Chrome Cache Entry: 162
|
PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
|
downloaded
|
||
|
Chrome Cache Entry: 163
|
ASCII text, with very long lines (47992), with no line terminators
|
dropped
|
||
|
Chrome Cache Entry: 164
|
ASCII text, with very long lines (47992), with no line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 165
|
HTML document, ASCII text, with very long lines (1350), with CRLF line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 166
|
ASCII text, with very long lines (47261)
|
downloaded
|
||
|
Chrome Cache Entry: 167
|
ASCII text, with very long lines (62661), with CRLF line terminators
|
dropped
|
||
|
Chrome Cache Entry: 168
|
PNG image data, 93 x 96, 8-bit/color RGB, non-interlaced
|
dropped
|
||
|
Chrome Cache Entry: 169
|
ASCII text, with very long lines (65447)
|
downloaded
|
There are 9 hidden files, click here to show them.
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Program Files\Google\Chrome\Application\chrome.exe
|
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\RemittanceDetails(Rjackson)CQDM.html"
|
||
|
C:\Program Files\Google\Chrome\Application\chrome.exe
|
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US
--service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=2008,i,2422264411858432843,10904277492832570940,262144
/prefetch:8
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
https://romrich.ru/NZKGY/
|
172.67.156.90
|
|
|
|
https://hartamas.webworks.com.my/arull.php
|
|
||
|
https://romrich.ru/NZKGY/#QUmphY2tzb25AY2FwaXRhbGFkdmlzb3JzLnR2
|
|
||
|
https://hartamas.webworks.com.my/arull.php?2072797967704b5369323074637679733874796b7a4f304373713166654c386e615031416341canister
|
185.93.164.24
|
|
|
|
file:///C:/Users/user/Desktop/RemittanceDetails(Rjackson)CQDM.html
|
|
||
|
https://perjalanankuh.exnet.su/#learn-more
|
unknown
|
||
|
https://challenges.cloudflare.com/turnstile/v0/g/ec4b873d446c/api.js
|
104.18.95.41
|
||
|
https://perjalanankuh.exnet.su/#contact
|
unknown
|
||
|
https://cdn.jsdelivr.net/npm/bootstrap
|
unknown
|
||
|
https://code.jquery.com/jquery-3.6.0.min.js
|
151.101.130.137
|
||
|
https://perjalanankuh.exnet.su/#electric-vehicles
|
unknown
|
||
|
https://perjalanankuh.exnet.su/#faq
|
unknown
|
||
|
https://challenges.cloudflare.com/turnstile/v0/api.js
|
104.18.95.41
|
||
|
https://romrich.ru/favicon.ico
|
172.67.156.90
|
||
|
https://perjalanankuh.exnet.su/#services
|
unknown
|
||
|
https://perjalanankuh.exnet.su/#about
|
unknown
|
||
|
https://perjalanankuh.exnet.su/#classic-cars
|
unknown
|
||
|
https://perjalanankuh.exnet.su///8015.php
|
104.21.46.23
|
||
|
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/i/8cf100713b37c352/1728336726787/j_u1_VsfrkQWNHt
|
104.18.94.41
|
||
|
https://perjalanankuh.exnet.su/#terms
|
unknown
|
||
|
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=8cf100713b37c352&lang=auto
|
104.18.94.41
|
||
|
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/3pvwb/0x4AAAAAAAfThjpwEmNj8CIs/auto/fbE/normal/auto/
|
104.18.94.41
|
||
|
https://romrich.ru/NZKGY/,
|
172.67.156.90
|
||
|
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/pat/8cf100713b37c352/1728336726781/8776b3d02b2a831f5526a6d93f7969657a5bd8220652e45067e4bd920fba18ca/K_5A23foHFcojxh
|
104.18.94.41
|
||
|
https://perjalanankuh.exnet.su/#privacy
|
unknown
|
||
|
https://hartamas.webworks.com.my/favicon.ico
|
185.93.164.24
|
||
|
https://perjalanankuh.exnet.su/#
|
unknown
|
||
|
https://perjalanankuh.exnet.su/#modern-supercars
|
unknown
|
||
|
https://a.nel.cloudflare.com/report/v4?s=Y2it3rVEpELVA4HjWF46LF91hok%2F5rpgfe83jetvxhDlGvhFk6RORmmr%2FqctDQ9RFc5039kj%2FqzFwIW06InX9yCeDI7fEmJOT3ypD0P3%2FI75PzhXEvk1S91m2FNe
|
35.190.80.1
|
||
|
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/98378069:1728332824:wBT5eU-cduWBzbkDqx8xO88Z7-fIzFevZqD5OrPszCs/8cf100713b37c352/e4d153bbc4aefb1
|
104.18.94.41
|
||
|
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/cmg/1/wh0E0SXYnx6pTBdJW%2Fl926I%2BPRUplRdtQz3K9lHXs%2Fs%3D
|
104.18.94.41
|
||
|
https://perjalanankuh.exnet.su//
|
104.21.46.23
|
||
|
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.0/css/all.min.css
|
unknown
|
||
|
https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js
|
104.17.24.14
|
There are 24 hidden URLs, click here to show them.
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
romrich.ru
|
172.67.156.90
|
|
|
|
a.nel.cloudflare.com
|
35.190.80.1
|
||
|
code.jquery.com
|
151.101.130.137
|
||
|
cdnjs.cloudflare.com
|
104.17.24.14
|
||
|
challenges.cloudflare.com
|
104.18.95.41
|
||
|
perjalanankuh.exnet.su
|
104.21.46.23
|
||
|
www.google.com
|
142.250.185.164
|
||
|
hartamas.webworks.com.my
|
185.93.164.24
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
172.67.156.90
|
romrich.ru
|
United States
|
|
|
|
104.17.24.14
|
cdnjs.cloudflare.com
|
United States
|
||
|
104.18.94.41
|
unknown
|
United States
|
||
|
104.18.95.41
|
challenges.cloudflare.com
|
United States
|
||
|
104.21.46.23
|
perjalanankuh.exnet.su
|
United States
|
||
|
192.168.2.6
|
unknown
|
unknown
|
||
|
151.101.130.137
|
code.jquery.com
|
United States
|
||
|
239.255.255.250
|
unknown
|
Reserved
|
||
|
185.93.164.24
|
hartamas.webworks.com.my
|
Malaysia
|
||
|
142.250.185.164
|
www.google.com
|
United States
|
||
|
35.190.80.1
|
a.nel.cloudflare.com
|
United States
|
||
|
104.17.25.14
|
unknown
|
United States
|
There are 2 hidden IPs, click here to show them.
DOM / HTML
|
URL
|
Malicious
|
|
|---|---|---|
|
https://romrich.ru/NZKGY/#QUmphY2tzb25AY2FwaXRhbGFkdmlzb3JzLnR2
|
|
|
|
https://romrich.ru/NZKGY/#QUmphY2tzb25AY2FwaXRhbGFkdmlzb3JzLnR2
|
|
|
|
file:///C:/Users/user/Desktop/RemittanceDetails(Rjackson)CQDM.html
|
||
|
https://hartamas.webworks.com.my/arull.php
|
||
|
https://romrich.ru/NZKGY/#QUmphY2tzb25AY2FwaXRhbGFkdmlzb3JzLnR2
|
||
|
https://romrich.ru/NZKGY/#QUmphY2tzb25AY2FwaXRhbGFkdmlzb3JzLnR2
|
||
|
https://romrich.ru/NZKGY/#QUmphY2tzb25AY2FwaXRhbGFkdmlzb3JzLnR2
|