Windows Analysis Report
https://click.sleadtrack.com/link?messageId=%3C8227ea57-e0dc-sl97-4826-98af-00679a8c68a7@ogreai.net%3E&url=%20https://ogre.ai/en

Overview

General Information

Sample URL: https://click.sleadtrack.com/link?messageId=%3C8227ea57-e0dc-sl97-4826-98af-00679a8c68a7@ogreai.net%3E&url=%20https://ogre.ai/en
Analysis ID: 1543675

Detection

Score: 1
Range: 0 - 100
Whitelisted: false
Confidence: 80%

Signatures

Detected non-DNS traffic on DNS port
Stores files to the Windows start menu directory
URL contains potential PII (phishing indication)

Classification

Source: https://click.sleadtrack.com/link?messageId=%3C8227ea57-e0dc-sl97-4826-98af-00679a8c68a7@ogreai.net%3E&url=%20https://ogre.ai/en Sample URL: PII: %3C8227ea57-e0dc-sl97-4826-98af-00679a8c68a7@ogreai.net%3E&url
Source: https://click.sleadtrack.com/link?messageId=%3C8227ea57-e0dc-sl97-4826-98af-00679a8c68a7@ogreai.net%3E&url=%20https://ogre.ai/en Sample URL: PII: %3C8227ea57-e0dc-sl97-4826-98af-00679a8c68a7@ogreai.net%3E&url
Source: https://click.sleadtrack.com/link?messageId=%3C8227ea57-e0dc-sl97-4826-98af-00679a8c68a7@ogreai.net%3E&url=%20https://ogre.ai/en Sample URL: PII: %3C8227ea57-e0dc-sl97-4826-98af-00679a8c68a7@ogreai.net%3E&url
Source: https://click.sleadtrack.com/link?messageId=%3C8227ea57-e0dc-sl97-4826-98af-00679a8c68a7@ogreai.net%3E&url=%20https://ogre.ai/en Sample URL: PII: %3C8227ea57-e0dc-sl97-4826-98af-00679a8c68a7@ogreai.net%3E&url
Source: https://click.sleadtrack.com/link?messageId=%3C8227ea57-e0dc-sl97-4826-98af-00679a8c68a7@ogreai.net%3E&url=%20https://ogre.ai/en Sample URL: PII: %3C8227ea57-e0dc-sl97-4826-98af-00679a8c68a7@ogreai.net%3E&url
Source: https://click.sleadtrack.com/link?messageId=%3C8227ea57-e0dc-sl97-4826-98af-00679a8c68a7@ogreai.net%3E&url=%20https://ogre.ai/en Sample URL: PII: %3C8227ea57-e0dc-sl97-4826-98af-00679a8c68a7@ogreai.net%3E&url
Source: https://click.sleadtrack.com/link?messageId=%3C8227ea57-e0dc-sl97-4826-98af-00679a8c68a7@ogreai.net%3E&url=%20https://ogre.ai/en Sample URL: PII: %3C8227ea57-e0dc-sl97-4826-98af-00679a8c68a7@ogreai.net%3E&url
Source: https://click.sleadtrack.com/link?messageId=%3C8227ea57-e0dc-sl97-4826-98af-00679a8c68a7@ogreai.net%3E&url=%20https://ogre.ai/en Sample URL: PII: %3C8227ea57-e0dc-sl97-4826-98af-00679a8c68a7@ogreai.net%3E&url
Source: https://click.sleadtrack.com/link?messageId=%3C8227ea57-e0dc-sl97-4826-98af-00679a8c68a7@ogreai.net%3E&url=%20https://ogre.ai/en Sample URL: PII: %3C8227ea57-e0dc-sl97-4826-98af-00679a8c68a7@ogreai.net%3E&url
Source: https://click.sleadtrack.com/link?messageId=%3C8227ea57-e0dc-sl97-4826-98af-00679a8c68a7@ogreai.net%3E&url=%20https://ogre.ai/en Sample URL: PII: %3C8227ea57-e0dc-sl97-4826-98af-00679a8c68a7@ogreai.net%3E&url
Source: https://click.sleadtrack.com/link?messageId=%3C8227ea57-e0dc-sl97-4826-98af-00679a8c68a7@ogreai.net%3E&url=%20https://ogre.ai/en Sample URL: PII: %3C8227ea57-e0dc-sl97-4826-98af-00679a8c68a7@ogreai.net%3E&url
Source: https://click.sleadtrack.com/link?messageId=%3C8227ea57-e0dc-sl97-4826-98af-00679a8c68a7@ogreai.net%3E&url=%20https://ogre.ai/en Sample URL: PII: %3C8227ea57-e0dc-sl97-4826-98af-00679a8c68a7@ogreai.net%3E&url
Source: https://click.sleadtrack.com/link?messageId=%3C8227ea57-e0dc-sl97-4826-98af-00679a8c68a7@ogreai.net%3E&url=%20https://ogre.ai/en Sample URL: PII: %3C8227ea57-e0dc-sl97-4826-98af-00679a8c68a7@ogreai.net%3E&url
Source: https://click.sleadtrack.com/link?messageId=%3C8227ea57-e0dc-sl97-4826-98af-00679a8c68a7@ogreai.net%3E&url=%20https://ogre.ai/en Sample URL: PII: %3C8227ea57-e0dc-sl97-4826-98af-00679a8c68a7@ogreai.net%3E&url
Source: https://click.sleadtrack.com/%20https://ogre.ai/en HTTP Parser: No favicon
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49709 version: TLS 1.2
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49711 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.16:49713 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:58978 version: TLS 1.2
Source: global traffic TCP traffic: 192.168.2.16:58975 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:58975 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:58975 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:58975 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:58975 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:58975 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:58975 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:58975 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:58975 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:58975 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:58975 -> 1.1.1.1:53
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: global traffic DNS traffic detected: DNS query: click.sleadtrack.com
Source: global traffic DNS traffic detected: DNS query: www.google.com
Source: unknown Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58978
Source: unknown Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58977
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58976
Source: unknown Network traffic detected: HTTP traffic on port 58981 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58981
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58980
Source: unknown Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58978 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58976 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58980 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown Network traffic detected: HTTP traffic on port 58977 -> 443
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49709 version: TLS 1.2
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49711 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.16:49713 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:58978 version: TLS 1.2
Source: classification engine Classification label: clean1.win@17/8@4/102
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1816,i,18160453113757978522,14806343787247285058,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://click.sleadtrack.com/link?messageId=%3C8227ea57-e0dc-sl97-4826-98af-00679a8c68a7@ogreai.net%3E&url=%20https://ogre.ai/en"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1816,i,18160453113757978522,14806343787247285058,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs