IOC Report
https://docs.google.com/forms/d/e/1FAIpQLScaqr8AS5UHJLhHgsk75Su6KzT5rrqw0atzmeeQYQGFlm3rfA/viewform?usp=sf_link

loading gif

Files

File Path
Type
Category
Malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Apr 16 17:01:15 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Apr 16 17:01:15 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Apr 16 17:01:15 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Apr 16 17:01:15 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Apr 16 17:01:15 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
Chrome Cache Entry: 107
Web Open Font Format (Version 2), TrueType, length 58012, version 1.0
downloaded
Chrome Cache Entry: 108
Web Open Font Format (Version 2), TrueType, length 1360, version 1.0
downloaded
Chrome Cache Entry: 109
Web Open Font Format (Version 2), TrueType, length 129672, version 1.0
downloaded
Chrome Cache Entry: 110
Web Open Font Format (Version 2), TrueType, length 31456, version 1.0
downloaded
Chrome Cache Entry: 111
Web Open Font Format (Version 2), TrueType, length 72784, version 1.0
downloaded
Chrome Cache Entry: 112
Web Open Font Format (Version 2), TrueType, length 42132, version 1.0
downloaded
Chrome Cache Entry: 113
Web Open Font Format (Version 2), TrueType, length 4196, version 1.0
downloaded
Chrome Cache Entry: 114
Web Open Font Format (Version 2), TrueType, length 64068, version 1.0
downloaded
Chrome Cache Entry: 115
Web Open Font Format (Version 2), TrueType, length 1756, version 1.0
downloaded
Chrome Cache Entry: 116
GIF image data, version 89a, 1 x 1
downloaded
Chrome Cache Entry: 117
Web Open Font Format (Version 2), TrueType, length 1664, version 1.0
downloaded
Chrome Cache Entry: 118
Web Open Font Format (Version 2), TrueType, length 45536, version 1.0
downloaded
Chrome Cache Entry: 119
Web Open Font Format (Version 2), TrueType, length 39708, version 1.0
downloaded
Chrome Cache Entry: 120
Web Open Font Format (Version 2), TrueType, length 58892, version 1.0
downloaded
Chrome Cache Entry: 121
Web Open Font Format (Version 2), TrueType, length 37488, version 1.0
downloaded
Chrome Cache Entry: 122
Web Open Font Format (Version 2), TrueType, length 64164, version 1.0
downloaded
Chrome Cache Entry: 123
Web Open Font Format (Version 2), TrueType, length 44316, version 1.0
downloaded
Chrome Cache Entry: 124
Web Open Font Format (Version 2), TrueType, length 2568, version 1.0
downloaded
Chrome Cache Entry: 125
Web Open Font Format (Version 2), TrueType, length 60648, version 1.0
downloaded
Chrome Cache Entry: 126
Web Open Font Format (Version 2), TrueType, length 36840, version 1.0
downloaded
Chrome Cache Entry: 127
Web Open Font Format (Version 2), TrueType, length 41676, version 1.0
downloaded
Chrome Cache Entry: 128
Web Open Font Format (Version 2), TrueType, length 2484, version 1.0
downloaded
Chrome Cache Entry: 129
Web Open Font Format (Version 2), TrueType, length 65812, version 1.0
downloaded
Chrome Cache Entry: 130
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 131
Web Open Font Format (Version 2), TrueType, length 40412, version 1.0
downloaded
Chrome Cache Entry: 132
Web Open Font Format (Version 2), TrueType, length 50476, version 1.0
downloaded
Chrome Cache Entry: 133
Web Open Font Format (Version 2), TrueType, length 41284, version 1.0
downloaded
Chrome Cache Entry: 134
Web Open Font Format (Version 2), TrueType, length 1416, version 1.0
downloaded
Chrome Cache Entry: 135
Web Open Font Format (Version 2), TrueType, length 25980, version 1.0
downloaded
Chrome Cache Entry: 136
PNG image data, 580 x 145, 8-bit/color RGB, non-interlaced
downloaded
Chrome Cache Entry: 137
Web Open Font Format (Version 2), TrueType, length 1516, version 1.0
downloaded
Chrome Cache Entry: 138
Web Open Font Format (Version 2), TrueType, length 143084, version 1.0
downloaded
Chrome Cache Entry: 139
Web Open Font Format (Version 2), TrueType, length 46840, version 1.0
downloaded
Chrome Cache Entry: 140
Web Open Font Format (Version 2), TrueType, length 3576, version 1.0
downloaded
Chrome Cache Entry: 141
Web Open Font Format (Version 2), TrueType, length 55204, version 1.0
downloaded
Chrome Cache Entry: 142
Web Open Font Format (Version 2), TrueType, length 50664, version 1.0
downloaded
Chrome Cache Entry: 143
Web Open Font Format (Version 2), TrueType, length 26936, version 1.0
downloaded
Chrome Cache Entry: 144
Web Open Font Format (Version 2), TrueType, length 40184, version 1.0
downloaded
Chrome Cache Entry: 145
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 146
Web Open Font Format (Version 2), TrueType, length 2708, version 1.0
downloaded
Chrome Cache Entry: 147
ASCII text, with very long lines (987)
downloaded
Chrome Cache Entry: 148
Web Open Font Format (Version 2), TrueType, length 57612, version 1.0
downloaded
Chrome Cache Entry: 149
Web Open Font Format (Version 2), TrueType, length 32644, version 1.0
downloaded
Chrome Cache Entry: 150
Web Open Font Format (Version 2), TrueType, length 58200, version 1.0
downloaded
Chrome Cache Entry: 151
GIF image data, version 89a, 1 x 1
downloaded
Chrome Cache Entry: 152
Web Open Font Format (Version 2), TrueType, length 41288, version 1.0
downloaded
Chrome Cache Entry: 153
SVG Scalable Vector Graphics image
dropped
Chrome Cache Entry: 154
ASCII text, with very long lines (1719)
dropped
Chrome Cache Entry: 155
PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
downloaded
Chrome Cache Entry: 156
Web Open Font Format (Version 2), TrueType, length 3640, version 1.0
downloaded
Chrome Cache Entry: 157
ASCII text, with no line terminators
downloaded
Chrome Cache Entry: 158
Web Open Font Format (Version 2), TrueType, length 4344, version 1.0
downloaded
Chrome Cache Entry: 159
ASCII text, with very long lines (1719)
downloaded
Chrome Cache Entry: 160
Web Open Font Format (Version 2), TrueType, length 99952, version 1.0
downloaded
Chrome Cache Entry: 161
Web Open Font Format (Version 2), TrueType, length 50264, version 1.0
downloaded
Chrome Cache Entry: 162
GIF image data, version 89a, 1 x 1
dropped
Chrome Cache Entry: 163
ASCII text, with very long lines (609)
downloaded
Chrome Cache Entry: 164
Web Open Font Format (Version 2), TrueType, length 17368, version 1.0
downloaded
Chrome Cache Entry: 165
Web Open Font Format (Version 2), TrueType, length 64656, version 1.0
downloaded
Chrome Cache Entry: 166
ASCII text, with very long lines (609)
dropped
Chrome Cache Entry: 167
SVG Scalable Vector Graphics image
dropped
Chrome Cache Entry: 168
Web Open Font Format (Version 2), TrueType, length 1528, version 1.0
downloaded
Chrome Cache Entry: 169
ASCII text, with very long lines (3383)
downloaded
Chrome Cache Entry: 170
Web Open Font Format (Version 2), TrueType, length 41584, version 1.0
downloaded
Chrome Cache Entry: 171
Web Open Font Format (Version 2), TrueType, length 41220, version 1.0
downloaded
Chrome Cache Entry: 172
Web Open Font Format (Version 2), TrueType, length 100756, version 1.0
downloaded
Chrome Cache Entry: 173
Web Open Font Format (Version 2), TrueType, length 54324, version 1.0
downloaded
Chrome Cache Entry: 174
Web Open Font Format (Version 2), TrueType, length 84892, version 1.0
downloaded
Chrome Cache Entry: 175
Web Open Font Format (Version 2), TrueType, length 126552, version 1.0
downloaded
Chrome Cache Entry: 176
Web Open Font Format (Version 2), TrueType, length 37800, version 1.0
downloaded
Chrome Cache Entry: 177
Web Open Font Format (Version 2), TrueType, length 116720, version 1.0
downloaded
Chrome Cache Entry: 178
Web Open Font Format (Version 2), TrueType, length 57236, version 1.0
downloaded
Chrome Cache Entry: 179
Web Open Font Format (Version 2), TrueType, length 54776, version 1.0
downloaded
Chrome Cache Entry: 180
Web Open Font Format (Version 2), TrueType, length 34108, version 1.0
downloaded
Chrome Cache Entry: 181
Web Open Font Format (Version 2), TrueType, length 1260, version 1.0
downloaded
Chrome Cache Entry: 182
Web Open Font Format (Version 2), TrueType, length 37632, version 1.0
downloaded
Chrome Cache Entry: 183
Web Open Font Format (Version 2), TrueType, length 43772, version 1.0
downloaded
Chrome Cache Entry: 184
Web Open Font Format (Version 2), TrueType, length 5044, version 1.0
downloaded
Chrome Cache Entry: 185
HTML document, Unicode text, UTF-8 text, with very long lines (1136)
dropped
Chrome Cache Entry: 186
ASCII text, with very long lines (65536), with no line terminators
downloaded
Chrome Cache Entry: 187
Web Open Font Format (Version 2), TrueType, length 15744, version 1.0
downloaded
Chrome Cache Entry: 188
GIF image data, version 89a, 1 x 1
dropped
Chrome Cache Entry: 189
ASCII text
downloaded
Chrome Cache Entry: 190
ASCII text
downloaded
Chrome Cache Entry: 191
Web Open Font Format (Version 2), TrueType, length 47364, version 1.0
downloaded
Chrome Cache Entry: 192
Web Open Font Format (Version 2), TrueType, length 72264, version 1.0
downloaded
Chrome Cache Entry: 193
PNG image data, 580 x 145, 8-bit/color RGB, non-interlaced
dropped
Chrome Cache Entry: 194
Web Open Font Format (Version 2), TrueType, length 64888, version 1.0
downloaded
Chrome Cache Entry: 195
Web Open Font Format (Version 2), TrueType, length 35060, version 1.0
downloaded
Chrome Cache Entry: 196
ASCII text
downloaded
Chrome Cache Entry: 197
Web Open Font Format (Version 2), TrueType, length 50340, version 1.0
downloaded
Chrome Cache Entry: 198
Web Open Font Format (Version 2), TrueType, length 4280, version 1.0
downloaded
Chrome Cache Entry: 199
Web Open Font Format (Version 2), TrueType, length 105776, version 1.0
downloaded
Chrome Cache Entry: 200
Web Open Font Format (Version 2), TrueType, length 42296, version 1.0
downloaded
Chrome Cache Entry: 201
Web Open Font Format (Version 2), TrueType, length 1420, version 1.0
downloaded
Chrome Cache Entry: 202
PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
dropped
Chrome Cache Entry: 203
Web Open Font Format (Version 2), TrueType, length 44980, version 1.0
downloaded
There are 94 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 --field-trial-handle=2220,i,18086223595071496100,9062713011887786877,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://docs.google.com/forms/d/e/1FAIpQLScaqr8AS5UHJLhHgsk75Su6KzT5rrqw0atzmeeQYQGFlm3rfA/viewform?usp=sf_link"

URLs

Name
IP
Malicious
https://docs.google.com/forms/d/e/1FAIpQLScaqr8AS5UHJLhHgsk75Su6KzT5rrqw0atzmeeQYQGFlm3rfA/viewform?usp=sf_link
malicious
http://localhost.corp.google.com/inapp/
unknown
https://feedback.googleusercontent.com/resources/annotator.css
unknown
https://youtube.com/embed/?rel=0
unknown
https://apis.google.com/js/client.js
unknown
https://feedback2-test.corp.googleusercontent.com/tools/feedback/%
unknown
https://support.google.com
unknown
https://play.google.com
unknown
https://youtube.com/embed/
unknown
http://localhost.proxy.googlers.com/inapp/
unknown
https://stagingqual-feedback-pa-googleapis.sandbox.google.com
unknown
https://support.google.com/inapp/%
unknown
https://asx-help-frontend-autopush.corp.youtube.com/inapp/
unknown
https://help.youtube.com/tools/feedback/
unknown
https://docs.google.com/forms/d/e/1FAIpQLScaqr8AS5UHJLhHgsk75Su6KzT5rrqw0atzmeeQYQGFlm3rfA/naLogImpressions
142.250.9.100
https://asx-frontend-staging.corp.google.com/tools/feedback/
unknown
https://support.google.com/
unknown
https://www.google.com
unknown
https://scone-pa.clients6.google.com
unknown
https://support.google.com/inapp/
unknown
https://asx-frontend-autopush.corp.google.co.uk/inapp/
unknown
https://asx-frontend-autopush.corp.google.co.uk/tools/feedback/
unknown
https://asx-frontend-autopush.corp.google.com/tools/feedback/
unknown
https://asx-frontend-autopush.corp.youtube.com/tools/feedback/
unknown
https://feedback2-test.corp.google.com/inapp/%
unknown
https://www.google.com/tools/feedback
unknown
https://sandbox.google.com/inapp/%
unknown
https://docs.google.com/forms/d/e/1FAIpQLScaqr8AS5UHJLhHgsk75Su6KzT5rrqw0atzmeeQYQGFlm3rfA/viewform
https://lh5.googleusercontent.com/qT4DCK2LKzecwlfH_KeT8lBWadfqlPRvtivdMZMXcGG_CRS6ybKJf354o1nOBIOo9cGaLyG9Hl0fQk80G8iXQQ-KdATcPkutqm7QbF2qJLD5-IB7cID4YmTX8GmGDBYxkQ=w580
173.194.219.132
https://feedback2-test.corp.googleusercontent.com/inapp/%
unknown
https://localhost.proxy.googlers.com/inapp/
unknown
https://docs.google.com/forms/d/e/1FAIpQLScaqr8AS5UHJLhHgsk75Su6KzT5rrqw0atzmeeQYQGFlm3rfA/viewform?usp=sf_link
https://www.google.com/tools/feedback/
unknown
https://www.google.cn/tools/feedback/
unknown
https://play.google.com/log?format=json&hasfast=true&authuser=0
172.217.215.102
https://asx-frontend-autopush.corp.google.de/inapp/
unknown
https://www.google.cn/tools/feedback/%
unknown
https://feedback2-test.corp.google.com/tools/feedback/%
unknown
https://www.google.com/tools/feedback/help_panel_binary.js
unknown
https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=
unknown
https://asx-frontend-autopush.corp.google.de/tools/feedback/
unknown
https://sandbox.google.com/inapp/
unknown
https://test-scone-pa-googleapis.sandbox.google.com
unknown
https://asx-help-frontend-autopush.corp.youtube.com/tools/feedback/
unknown
https://play.google.com/log?format=json&hasfast=true
unknown
https://asx-frontend-autopush.corp.google.com/inapp/
unknown
https://feedback.googleusercontent.com/resources/render_frame2.html
unknown
https://sandbox.google.com/tools/feedback/%
unknown
https://sandbox.google.com/tools/feedback/
unknown
https://docs.google.com/forms/d/e/1FAIpQLScaqr8AS5UHJLhHgsk75Su6KzT5rrqw0atzmeeQYQGFlm3rfA/font/getmetadata
142.250.9.100
https://localhost.corp.google.com/inapp/
unknown
https://asx-frontend-autopush.corp.youtube.com/inapp/
unknown
https://feedback-pa.clients6.google.com
unknown
https://asx-frontend-staging.corp.google.com/inapp/
unknown
https://www.google.com/tools/feedback/%
unknown
https://fonts.google.com/license/googlerestricted
unknown
There are 45 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
docs.google.com
142.250.9.100
bg.microsoft.map.fastly.net
199.232.214.172
play.google.com
172.217.215.102
www.google.com
142.250.105.147
googlehosted.l.googleusercontent.com
173.194.219.132
fp2e7a.wpc.phicdn.net
192.229.211.108
lh5.googleusercontent.com
unknown

IPs

IP
Domain
Country
Malicious
172.253.124.101
unknown
United States
172.217.215.102
play.google.com
United States
142.250.105.132
unknown
United States
192.168.2.5
unknown
unknown
142.250.105.147
www.google.com
United States
173.194.219.132
googlehosted.l.googleusercontent.com
United States
64.233.177.138
unknown
United States
239.255.255.250
unknown
Reserved
142.250.9.101
unknown
United States
142.250.9.100
docs.google.com
United States

DOM / HTML

URL
Malicious
https://docs.google.com/forms/d/e/1FAIpQLScaqr8AS5UHJLhHgsk75Su6KzT5rrqw0atzmeeQYQGFlm3rfA/viewform?usp=sf_link
 malicious
https://docs.google.com/forms/d/e/1FAIpQLScaqr8AS5UHJLhHgsk75Su6KzT5rrqw0atzmeeQYQGFlm3rfA/viewform
 malicious
https://docs.google.com/forms/d/e/1FAIpQLScaqr8AS5UHJLhHgsk75Su6KzT5rrqw0atzmeeQYQGFlm3rfA/viewform
 malicious