IOC Report
http://gmail.com

loading gif

Files

File Path
Type
Category
Malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Apr 16 19:51:59 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Apr 16 19:51:59 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Apr 16 19:51:59 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Apr 16 19:51:59 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Apr 16 19:51:59 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
Chrome Cache Entry: 171
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 172
HTML document, ASCII text, with very long lines (682)
downloaded
Chrome Cache Entry: 173
ASCII text, with very long lines (467)
downloaded
Chrome Cache Entry: 174
ASCII text, with very long lines (2362)
downloaded
Chrome Cache Entry: 175
MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
downloaded
Chrome Cache Entry: 176
ASCII text, with very long lines (4199)
downloaded
Chrome Cache Entry: 177
SVG Scalable Vector Graphics image
dropped
Chrome Cache Entry: 178
Web Open Font Format (Version 2), TrueType, length 52280, version 1.0
downloaded
Chrome Cache Entry: 179
MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
dropped
Chrome Cache Entry: 180
ASCII text, with very long lines (693)
downloaded
Chrome Cache Entry: 181
ASCII text, with very long lines (405)
downloaded
Chrome Cache Entry: 182
ASCII text, with very long lines (834)
downloaded
Chrome Cache Entry: 183
ASCII text, with very long lines (574)
downloaded
Chrome Cache Entry: 184
ASCII text, with very long lines (1299)
downloaded
Chrome Cache Entry: 185
ASCII text, with very long lines (504)
downloaded
Chrome Cache Entry: 186
ASCII text, with no line terminators
downloaded
Chrome Cache Entry: 187
ASCII text, with very long lines (775)
downloaded
Chrome Cache Entry: 188
ASCII text, with very long lines (17337)
downloaded
Chrome Cache Entry: 189
ASCII text, with very long lines (1631)
downloaded
There are 16 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://gmail.com/
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=1948,i,11222838486592232605,4256594581684048127,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5888 --field-trial-handle=1948,i,11222838486592232605,4256594581684048127,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5552 --field-trial-handle=1948,i,11222838486592232605,4256594581684048127,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

URLs

Name
IP
Malicious
http://gmail.com
https://play.google/intl/
unknown
https://families.google.com/intl/
unknown
https://youtube.com/t/terms?gl=
unknown
https://policies.google.com/technologies/location-data
unknown
https://www.google.com/intl/
unknown
https://apis.google.com/js/api.js
unknown
https://policies.google.com/privacy/google-partners
unknown
https://musicart.xboxlive.com/7/f5855100-0000-0000-0000-000000000002/504/image.jpg?w=140&h=190
23.54.200.10
https://play.google.com/work/enroll?identifier=
unknown
https://policies.google.com/terms/service-specific
unknown
https://musicart.xboxlive.com/7/b7654500-0000-0000-0000-000000000002/504/image.jpg?w=140&h=190
23.54.200.10
https://g.co/recover
unknown
https://policies.google.com/privacy/additional
unknown
https://support.google.com/websearch/answer/4358949?hl=ko&ref_topic=3285072
unknown
https://mail.google.com/mail/u/0/
74.125.136.83
https://policies.google.com/technologies/cookies
unknown
https://www.google.com/favicon.ico
142.250.105.103
https://policies.google.com/terms
unknown
https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=
unknown
https://musicart.xboxlive.com/7/27ea1000-0000-0000-0000-000000000002/504/image.jpg?w=140&h=190
23.54.200.10
https://www.google.com
unknown
https://play.google.com/log?format=json&hasfast=true
unknown
https://policies.google.com/privacy/additional/embedded?gl=kr
unknown
https://policies.google.com/terms/location/embedded
unknown
https://www.youtube.com/t/terms?chromeless=1&hl=
unknown
https://support.google.com/accounts?hl=
unknown
https://policies.google.com/privacy
unknown
https://musicart.xboxlive.com/7/fd965100-0000-0000-0000-000000000002/504/image.jpg?w=140&h=190
23.54.200.10
https://musicart.xboxlive.com/7/713f2900-0000-0000-0000-000000000002/504/image.jpg?w=140&h=190
23.54.200.10
http://gmail.com/
142.250.9.17
https://musicart.xboxlive.com/7/45172400-0000-0000-0000-000000000002/504/image.jpg?w=140&h=190
23.54.200.10
https://support.google.com/accounts?p=new-si-ui
unknown
https://apis.google.com/js/rpc:shindig_random.js?onload=credentialservice.postMessage
unknown
There are 23 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
www3.l.google.com
74.125.138.101
play.google.com
74.125.138.139
mail.google.com
74.125.136.83
www.google.com
142.250.105.103
gmail.com
142.250.9.17
accounts.youtube.com
unknown

IPs

IP
Domain
Country
Malicious
74.125.136.83
mail.google.com
United States
192.168.2.16
unknown
unknown
142.250.105.103
www.google.com
United States
142.250.105.147
unknown
United States
142.250.9.17
gmail.com
United States
239.255.255.250
unknown
Reserved
74.125.138.101
www3.l.google.com
United States

DOM / HTML

URL
Malicious
https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fmail.google.com%2Fmail%2Fu%2F0%2F&emr=1&followup=https%3A%2F%2Fmail.google.com%2Fmail%2Fu%2F0%2F&ifkv=ARZ0qKIHrR-OP7wuyBHgl5kCupPQoNCArmS8_o9stByQ3swkcy54UbGwOeFbS3ltHD7t_ObTxPJ2Ug&osid=1&passive=1209600&service=mail&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1929935711%3A1713300719426040&theme=mn&ddm=0
https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fmail.google.com%2Fmail%2Fu%2F0%2F&emr=1&followup=https%3A%2F%2Fmail.google.com%2Fmail%2Fu%2F0%2F&ifkv=ARZ0qKIHrR-OP7wuyBHgl5kCupPQoNCArmS8_o9stByQ3swkcy54UbGwOeFbS3ltHD7t_ObTxPJ2Ug&osid=1&passive=1209600&service=mail&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1929935711%3A1713300719426040&theme=mn&ddm=0
https://accounts.youtube.com/accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=-1321404373&timestamp=1713300722730
https://accounts.google.com/_/bscframe