Report Overview

  1. Visited public
    2025-04-16 23:14:49
    Tags
    Submit Tags
  2. URL

    cdn.nomad-group.net/nomadapps/mplus/build_depot/prod/zip/Win64ShippingPublic_r96.zip?__cf_chl_tk=Bp23hh5eBQJesUHIz12Vqlnpxql74Tue8AeKjoDSz.w-1740244906-1.0.1.1-YdIyP0SdG4M3bet8GltzcAEx3m5efKCj8h3khmfLBGs

  3. Finishing URL

    cdn.nomad-group.net/nomadapps/mplus/build_depot/prod/zip/Win64ShippingPublic_r96.zip?__cf_chl_tk=RQ1Cl6bqpb2VlFOFMk4pzVc4zFucEb0FR1S5gk_7loI-1744845249-1.0.1.1-ZkNnVmnmnAmcw1ArxO7Wzo6xxpEU8fuy_v6RBFW17gI

  4. IP / ASN
    172.67.179.186

    #13335 CLOUDFLARENET

    Title
    Just a moment...
Detections
urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
5

Domain Summary

Domain / FQDNRankRegisteredFirst SeenLast Seen
challenges.cloudflare.comunknown2009-02-172021-10-202025-04-16
cdn.nomad-group.netunknown2017-12-102020-08-212025-04-12

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected


OpenPhish

No alerts detected


PhishTank

No alerts detected


Quad9 DNS

No alerts detected


ThreatFox

No alerts detected


Files detected

  1. URL

    cdn.nomad-group.net/nomadapps/mplus/build_depot/prod/zip/Win64ShippingPublic_r96.zip

  2. IP

    188.114.97.1

  3. ASN

    #13335 CLOUDFLARENET

  1. File type

    Zip archive data, at least v2.0 to extract, compression method=deflate

    Size

    3.6 MB (3572396 bytes)

  2. Hash

    de4ade3d60f2ef70d04bbee7f71e82a0

    92b7afa13131e33a83329b2f1b770c1a35b41622

  1. Archive (50)

  2. FilenameMd5File type
    dinput8.dll
    c5c37d75684bdec6d89c8e5a96178036
    PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections
    ScriptHook\core.dll
    16f0b376cafe00495398c5b4d5e31030
    PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 7 sections
    ScriptHook\crashpad_handler.exe
    2558cf13ca8426b066936ea1a7aee9ca
    PE32+ executable (GUI) x86-64, for MS Windows, 7 sections
    ScriptHook\data\discord_game_sdk.dll
    d8cc567718550ae35c1566c3315b90df
    PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 5 sections
    ScriptHook\data\LICENSE
    6b0c0c9c0db49844b2a83e2f91e9a733
    ASCII text, with CRLF line terminators
    ScriptHook\data\ref_epic_1.0.0.nmd
    e0267d5a229f59d8d761cbc156fc6aaa
    data
    ScriptHook\data\ref_epic_1.1.0.nmd
    ba16e96465d1c1d335e6978664fd123c
    data
    ScriptHook\data\ref_epic_1.2.0.nmd
    fd82e4b2e83835029a75eede7470d266
    data
    ScriptHook\data\ref_epic_1.3.0.nmd
    c78ba2e6e072f9f5343392d122adaed8
    data
    ScriptHook\data\ref_steam_1.0.0.nmd
    7a5853af6a669578c4a74b3d2c6fed42
    data
    ScriptHook\data\ref_steam_1.1.0.nmd
    327d427fdcedf2e08f954a253fafce02
    data
    ScriptHook\data\ref_steam_1.2.0.nmd
    0d3499653993dc339c1a437d2bd0d272
    data
    ScriptHook\data\ref_steam_1.3.0.nmd
    710cf2fcffff9c5c4e9d8017d500df51
    data
    ScriptHook\data\steam_api64.dll
    8afde2d19c89d0bf1a9f6ec475aa0ebb
    PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections
    ScriptHook\data\steam_appid.txt
    ea0d8bd52045a95f6de3f627fc005fb6
    ASCII text, with no line terminators
    ScriptHook\data\versions.json
    8d11b6272c396eaa29fe007e8c054289
    JSON text data
    ScriptHook\data\lua\main.lua
    835c7c764aafee7ff820019d382f1b50
    ASCII text, with CRLF line terminators
    ScriptHook\data\lua\extensions\commandArgumentType.lua
    26e1ea2a9bf051c0897d63d67b9a2453
    ASCII text, with CRLF line terminators
    ScriptHook\data\lua\extensions\d3d.lua
    4c47d11d91c2391a8389563fa5c7940a
    ASCII text, with CRLF line terminators
    ScriptHook\data\lua\extensions\string.lua
    15953d188218eb5a738c7bc4f4f53fd6
    ASCII text, with CRLF line terminators
    ScriptHook\data\lua\extensions\table.lua
    9fe5deab23d0677f8daaf6f5feb655d0
    ASCII text, with CRLF line terminators
    ScriptHook\data\lua\extensions\threads.lua
    d8cf1fd7d056705f72b1cdebab9737e1
    JavaScript source, ASCII text, with CRLF line terminators
    ScriptHook\data\lua\game\PlayerModelIDs.lua
    f261291121cdba856a7fdda2c04d19cd
    ASCII text, with CRLF line terminators
    ScriptHook\data\lua\game\TeleportSpots.lua
    25cee014217c2613baa92b3166ef9de7
    ASCII text, with CRLF line terminators
    ScriptHook\data\lua\game\VehicleModelIDs.lua
    71587cae8abfce32fab386eb54f0ca03
    ASCII text, with CRLF line terminators
    ScriptHook\data\lua\game\WeaponIDs.lua
    7ccc73dd1e5a0a58e6abb4b348d81a1e
    ASCII text, with CRLF line terminators
    ScriptHook\data\lua\game\WeatherIDs.lua
    21359ddaa36a766e1d9d536dd97234c4
    ASCII text, with CRLF line terminators
    ScriptHook\data\lua\modules\util.lua
    c294ba9f976ecb4eeffeb4829aa27872
    ASCII text, with CRLF line terminators
    ScriptHook\data\scripts\trainer\LICENSE
    5156c0dc8cef6c929ec37d820d134f4c
    ASCII text, with CRLF line terminators
    ScriptHook\data\scripts\trainer\main.lua
    1f590ae9130385ba1b7081fe30bf1d85
    ASCII text, with CRLF line terminators
    ScriptHook\data\scripts\trainer\manifest.json
    9c8cc3cee0492a9e259b67bd7ddafe1a
    JSON text data
    ScriptHook\data\scripts\trainer\README.md
    79cd9b9ed1c733602fd7a157e752c95e
    ASCII text, with CRLF line terminators
    ScriptHook\data\scripts\trainer\webui.lua
    f05689d7f3111fcd25809afcc4987c2e
    ASCII text, with CRLF line terminators
    ScriptHook\data\scripts\trainer\menu\Environment.lua
    30418af0902dbaa11a531c26dd8604a4
    ASCII text, with CRLF line terminators
    ScriptHook\data\scripts\trainer\menu\HUD.lua
    414cbcdf143c0bac6a00eaa3870ad117
    JavaScript source, ASCII text, with CRLF line terminators
    ScriptHook\data\scripts\trainer\menu\menu.lua
    18126bc8bd79c37696b293df405d687d
    ASCII text, with CRLF line terminators
    ScriptHook\data\scripts\trainer\menu\Player.lua
    c4984cbd98ac88652803740479608185
    JavaScript source, ASCII text, with CRLF line terminators
    ScriptHook\data\scripts\trainer\menu\Police.lua
    7242a5e3583baebedf243cd3fcb7bef9
    ASCII text, with CRLF line terminators
    ScriptHook\data\scripts\trainer\menu\Teleport.lua
    5ae022875ad8a36450010d05362a5b71
    ASCII text, with CRLF line terminators
    ScriptHook\data\scripts\trainer\menu\Vehicle.lua
    662e443492822528e150dab5d1a9aa1a
    JavaScript source, ASCII text, with CRLF line terminators
    ScriptHook\data\scripts\trainer\menu\Weapons.lua
    becd0af48cb9030e2c66f8d9b754b2a5
    ASCII text, with CRLF line terminators
    ScriptHook\data\scripts\trainer\settings\noclip.lua
    d483098953c49b6b76932ce58cdddbce
    ASCII text, with CRLF line terminators
    ScriptHook\data\ui\ui-json.core.schema.jsonc
    3747e9398951d356b20a259010b0ad89
    ASCII text, with CRLF line terminators
    ScriptHook\data\ui\styles\default\application.json
    c590d31ba20d575bab8b863c24f93033
    JSON text data
    ScriptHook\data\ui\styles\default\default.json
    8ef0472ace9d20b31031151782542087
    JSON text data
    ScriptHook\data\ui\styles\default\docking.json
    5d03add21088e78d97673317762df87f
    JSON text data
    ScriptHook\data\ui\styles\default\game-controls.json
    3b825c53e2e8e5f5395f801f7c44fbaa
    JSON text data
    ScriptHook\data\ui\styles\default\icons.png
    41cc25a86bf3b5648a8e5647d70b6bcc
    PNG image data, 192 x 192, 8-bit/color RGBA, non-interlaced
    ScriptHook\data\ui\styles\default\simple-menu.json
    380516530ebd7011058b003457dcad8d
    JSON text data
    ScriptHook\data\ui\styles\default\startup-menu.json
    1cd8d1adbbf8d618f65d6bf92df69010
    JSON text data

    Detections

    AnalyzerVerdictAlert
    YARAhub by abuse.chmalware
    files - file ~tmp01925d3f.exe
    YARAhub by abuse.chmalware
    files - file ~tmp01925d3f.exe
    YARAhub by abuse.chmalware
    files - file ~tmp01925d3f.exe
    VirusTotalsuspicious

JavaScript (91)

HTTP Transactions (17)

URLIPResponseSize
POST challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/148295563:1744841779:4RYHg-kv46t5xuPwn60S97U37r0oBIrC1XrEs2IQXwU/9317609e1f205694/DFpmeeD2Z19dJ9MXVz0Bdo4pL4Zqqv.Wj_oJtbsKxp0-1744845250-1.1.1.1-gACDyPz30MqmjcivNUFHtsEZe7Y7VXVVDOiL61z3BThiyIZR7EMCKYUn.zPtBL8y
104.18.95.41200 OK238 kB
POST challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/148295563:1744841779:4RYHg-kv46t5xuPwn60S97U37r0oBIrC1XrEs2IQXwU/9317609e1f205694/DFpmeeD2Z19dJ9MXVz0Bdo4pL4Zqqv.Wj_oJtbsKxp0-1744845250-1.1.1.1-gACDyPz30MqmjcivNUFHtsEZe7Y7VXVVDOiL61z3BThiyIZR7EMCKYUn.zPtBL8y
104.18.95.41200 OK28 kB
GET cdn.nomad-group.net/nomadapps/mplus/build_depot/prod/zip/Win64ShippingPublic_r96.zip?__cf_chl_tk=Bp23hh5eBQJesUHIz12Vqlnpxql74Tue8AeKjoDSz.w-1740244906-1.0.1.1-YdIyP0SdG4M3bet8GltzcAEx3m5efKCj8h3khmfLBGs
188.114.97.1301 Moved Permanently7.6 kB
GET cdn.nomad-group.net/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=9317609a6b060b51
188.114.97.1200 OK95 kB
GET challenges.cloudflare.com/turnstile/v0/g/44e6f86df4dc/api.js?onload=boSsq5&render=explicit
104.18.95.41200 OK48 kB
GET challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/w978o/0x4AAAAAAAAjq6WYeRDKmebM/light/fbE/new/normal/auto/
104.18.95.41200 OK28 kB
GET challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/cmg/1
104.18.95.41200 OK61 B
GET challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=9317609e1f205694&lang=auto
104.18.95.41200 OK115 kB
GET cdn.nomad-group.net/nomadapps/mplus/build_depot/prod/zip/Win64ShippingPublic_r96.zip?__cf_chl_tk=Bp23hh5eBQJesUHIz12Vqlnpxql74Tue8AeKjoDSz.w-1740244906-1.0.1.1-YdIyP0SdG4M3bet8GltzcAEx3m5efKCj8h3khmfLBGs
188.114.97.1403 Forbidden8.2 kB
GET cdn.nomad-group.net/favicon.ico
188.114.97.1404 Not Found127 B
POST cdn.nomad-group.net/cdn-cgi/challenge-platform/h/g/flow/ov1/10395246:1744841601:on58bI1op2W8lxWtLvvjTjFrIjkU4nFJj4lH1yaei8g/9317609a6b060b51/iMJG.KrirHCfx25Tvj5I0OmLYOVC_Xc2iOqsNeFyDr4-1744845249-1.2.1.1-7PS4CZrfzgL_NBc48LZ0GexQNtFOpw0NBjx_ba4_kW9uIfZlXBvV0sN.Ofj1Ylvb
188.114.97.1200 OK17 kB
GET challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/pat/9317609e1f205694/1744845250779/18c2f068fa41c753992c5270df7107fe11070e3b0cefd133f0682039ef825a3f/vZF-jEMAtfFC7NR
104.18.95.41401 Unauthorized1 B
GET challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/d/9317609e1f205694/1744845250783/2m0DdfeC_GCee5C
104.18.95.41200 OK61 B
POST cdn.nomad-group.net/cdn-cgi/challenge-platform/h/g/flow/ov1/10395246:1744841601:on58bI1op2W8lxWtLvvjTjFrIjkU4nFJj4lH1yaei8g/9317609a6b060b51/iMJG.KrirHCfx25Tvj5I0OmLYOVC_Xc2iOqsNeFyDr4-1744845249-1.2.1.1-7PS4CZrfzgL_NBc48LZ0GexQNtFOpw0NBjx_ba4_kW9uIfZlXBvV0sN.Ofj1Ylvb
188.114.97.1200 OK4.2 kB
POST cdn.nomad-group.net/nomadapps/mplus/build_depot/prod/zip/Win64ShippingPublic_r96.zip
188.114.97.1200 OK3.6 MB
GET cdn.nomad-group.net/nomadapps/mplus/build_depot/prod/zip/Win64ShippingPublic_r96.zip
188.114.97.1403 Forbidden7.6 kB
GET cdn.nomad-group.net/favicon.ico
188.114.97.1404 Not Found127 B