IOC Report
https://docx-nok.online/

loading gif

Files

File Path
Type
Category
Malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 19 14:01:42 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 19 14:01:42 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 09:23:19 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 19 14:01:42 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 19 14:01:42 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 19 14:01:42 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
dropped
Chrome Cache Entry: 71
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 72
SVG Scalable Vector Graphics image
dropped
Chrome Cache Entry: 73
PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
downloaded
Chrome Cache Entry: 74
SVG Scalable Vector Graphics image
dropped
Chrome Cache Entry: 75
ASCII text, with very long lines (7043), with no line terminators
downloaded
Chrome Cache Entry: 76
SVG Scalable Vector Graphics image
dropped
Chrome Cache Entry: 77
HTML document, ASCII text, with very long lines (4020)
downloaded
Chrome Cache Entry: 78
ASCII text, with very long lines (42414)
downloaded
Chrome Cache Entry: 79
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 80
ASCII text, with very long lines (50758)
downloaded
Chrome Cache Entry: 81
SVG Scalable Vector Graphics image
dropped
Chrome Cache Entry: 82
PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
dropped
Chrome Cache Entry: 83
PNG image data, 25 x 36, 8-bit/color RGB, non-interlaced
downloaded
Chrome Cache Entry: 84
ASCII text, with very long lines (32065)
downloaded
Chrome Cache Entry: 85
ASCII text, with very long lines (65536), with no line terminators
downloaded
Chrome Cache Entry: 86
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 87
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 88
ASCII text, with no line terminators
downloaded
Chrome Cache Entry: 89
PNG image data, 25 x 36, 8-bit/color RGB, non-interlaced
dropped
There are 16 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://docx-nok.online/
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 --field-trial-handle=1960,i,2773275675352970223,11905223981876917908,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

URLs

Name
IP
Malicious
https://docx-nok.online/
malicious
https://docx-nok.online/
malicious
https://docx-nok.online/d740c10c7b9cf800d441f265844201e16622875f9f709LOGd740c10c7b9cf800d441f265844201e16622875f9f70a
malicious
https://docx-nok.online/ASSETS/img/m_.svg
172.67.179.148
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/vb618/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
https://docx-nok.online/boot/0a6095cf83124146bdbff28bf2470f15662287604d125
172.67.179.148
https://docx-nok.online/APP-0a6095cf83124146bdbff28bf2470f1566228761d30a1/0a6095cf83124146bdbff28bf2470f1566228761d30a2
172.67.179.148
https://docx-nok.online/API.php?data=mail&email=testing@outlook.com&_=1713538912791
172.67.179.148
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/i/876dc57e0ff87bcf/1713538904216/ZhnC9eUuQVZ5DM0
104.17.3.184
https://a.nel.cloudflare.com/report/v4?s=STBy%2BUyACwnYD3awDUeNnEj2LKnE68Y%2BVLhS1y75i%2F4haioJh%2F42CjIVyUVKma84h4FyNwG%2F6bntFklcOiAn7Pnz%2B4OBzeq4zdmX%2FYGkEAT6633iH3yFtiJRNk3xvv8MgC0%3D
35.190.80.1
https://docx-nok.online/o/0a6095cf83124146bdbff28bf2470f1566228761d30cc
172.67.179.148
https://docx-nok.online/favicon.ico
172.67.179.148
https://docx-nok.online/1
172.67.179.148
https://docx-nok.online/jq/0a6095cf83124146bdbff28bf2470f15662287604d11f
172.67.179.148
https://a.nel.cloudflare.com/report/v4?s=%2Fig0HEQ%2Blnw5kYrXqwSh28tVKyhsW%2FGo6%2FhwGbDcWOvIAlpMk1kgk1JhaBhJ5M1YrS0uojY23Xoi%2BN47DdM6vN%2F5rD%2BGj%2FcPHA4RxEP2%2FDwRK3vydqY5rbJrqAE02182yTE%3D
35.190.80.1
https://getbootstrap.com/)
unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=876dc57e0ff87bcf
104.17.3.184
https://docx-nok.online/cdn-cgi/challenge-platform/h/b/flow/ov1/1736105386:1713535998:CYTVeI83CkoB0ctzeZWb_Z14PECqxivQK0UVGDjsM1A/876dc5736c867b92/b9a92c2ac5a9fbe
172.67.179.148
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/pat/876dc57e0ff87bcf/1713538904224/8b21d532fd0fc07fa9c6884c1f3c7bea1f97e6034430a71051c4d69f0b0adb96/6vxr3lRydoc6S4F
104.17.3.184
https://github.com/twbs/bootstrap/graphs/contributors)
unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/2113343596:1713536042:z0Mz6ptvznMXor49lcX9vmU5GqwrNAa91JbxMzs_QqI/876dc57e0ff87bcf/86e27d6bbc5acfd
104.17.3.184
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/cmg/1/wh0E0SXYnx6pTBdJW%2Fl926I%2BPRUplRdtQz3K9lHXs%2Fs%3D
104.17.3.184
https://a.nel.cloudflare.com/report/v4?s=sE%2FViEXTjU3YoiTIVDU2HLPzJskHU7ESzd1dpLVo7zuFXga%2BjuMzBPHuoYzGoRvZv7R4VHv1NQuAHfd0R%2F5mdmWGW29MDiBDeqvviBNnuhovAfdGN1haa9Qjclu1Q90G9Xk%3D
35.190.80.1
https://github.com/twbs/bootstrap/blob/master/LICENSE)
unknown
https://docx-nok.online/API.php?data=mail&email=alen@outlook.com&_=1713538912792
172.67.179.148
https://docx-nok.online/API.php?data=mail&email=alen@outlook.com&_=1713538912793
172.67.179.148
https://docx-nok.online/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=876dc5736c867b92
172.67.179.148
https://docx-nok.online/x/0a6095cf83124146bdbff28bf2470f1566228761d30a7
172.67.179.148
https://docx-nok.online/js/0a6095cf83124146bdbff28bf2470f15662287604d126
172.67.179.148
https://docx-nok.online/ASSETS/img/sig-op.svg
172.67.179.148
There are 19 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
docx-nok.online
172.67.179.148
a.nel.cloudflare.com
35.190.80.1
challenges.cloudflare.com
104.17.3.184
www.google.com
142.250.9.99

IPs

IP
Domain
Country
Malicious
104.21.35.209
unknown
United States
192.168.2.18
unknown
unknown
104.17.3.184
challenges.cloudflare.com
United States
239.255.255.250
unknown
Reserved
35.190.80.1
a.nel.cloudflare.com
United States
104.17.2.184
unknown
United States
142.250.9.99
www.google.com
United States
172.67.179.148
docx-nok.online
United States

DOM / HTML

URL
Malicious
https://docx-nok.online/d740c10c7b9cf800d441f265844201e16622875f9f709LOGd740c10c7b9cf800d441f265844201e16622875f9f70a
 malicious
https://docx-nok.online/d740c10c7b9cf800d441f265844201e16622875f9f709LOGd740c10c7b9cf800d441f265844201e16622875f9f70a
 malicious
https://docx-nok.online/
https://docx-nok.online/
https://docx-nok.online/
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/vb618/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/vb618/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
https://docx-nok.online/d740c10c7b9cf800d441f265844201e16622875f9f709LOGd740c10c7b9cf800d441f265844201e16622875f9f70a