IOC Report
https://sites.google.com/view/scanned-files-jn1nn/google-pdf?file=Chasebank_Statement_Apr.pdf&fid=60231474

loading gif

Files

File Path
Type
Category
Malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Apr 24 21:54:32 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Apr 24 21:54:32 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Apr 24 21:54:32 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Apr 24 21:54:32 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Apr 24 21:54:32 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
Chrome Cache Entry: 100
JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 450x450, components 3
dropped
Chrome Cache Entry: 101
ASCII text, with very long lines (2054)
downloaded
Chrome Cache Entry: 102
ASCII text, with very long lines (1907)
downloaded
Chrome Cache Entry: 103
ASCII text, with very long lines (65536), with no line terminators
downloaded
Chrome Cache Entry: 104
ASCII text
downloaded
Chrome Cache Entry: 105
ASCII text, with very long lines (383)
downloaded
Chrome Cache Entry: 106
MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
dropped
Chrome Cache Entry: 107
ASCII text, with no line terminators
downloaded
Chrome Cache Entry: 108
PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced
dropped
Chrome Cache Entry: 109
HTML document, ASCII text, with very long lines (1726)
downloaded
Chrome Cache Entry: 110
PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced
downloaded
Chrome Cache Entry: 111
ASCII text, with very long lines (2124)
downloaded
Chrome Cache Entry: 112
ASCII text, with very long lines (631)
downloaded
Chrome Cache Entry: 113
ASCII text
downloaded
Chrome Cache Entry: 114
ASCII text, with very long lines (2054)
downloaded
Chrome Cache Entry: 115
ASCII text, with no line terminators
downloaded
Chrome Cache Entry: 116
PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced
dropped
Chrome Cache Entry: 117
ASCII text, with no line terminators
downloaded
Chrome Cache Entry: 118
MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
downloaded
Chrome Cache Entry: 119
PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
downloaded
Chrome Cache Entry: 120
ASCII text, with very long lines (1162)
downloaded
Chrome Cache Entry: 121
JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 450x450, components 3
downloaded
Chrome Cache Entry: 122
PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
dropped
Chrome Cache Entry: 123
ASCII text, with very long lines (546)
downloaded
Chrome Cache Entry: 124
HTML document, ASCII text, with very long lines (1759)
downloaded
Chrome Cache Entry: 125
PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced
downloaded
Chrome Cache Entry: 126
ASCII text, with very long lines (56412), with no line terminators
downloaded
Chrome Cache Entry: 127
ASCII text, with very long lines (3383)
downloaded
Chrome Cache Entry: 128
ASCII text, with very long lines (1281), with no line terminators
downloaded
Chrome Cache Entry: 129
HTML document, ASCII text
dropped
Chrome Cache Entry: 130
HTML document, ASCII text
downloaded
Chrome Cache Entry: 131
ASCII text, with very long lines (17673)
downloaded
Chrome Cache Entry: 132
Web Open Font Format (Version 2), TrueType, length 15340, version 1.0
downloaded
Chrome Cache Entry: 133
ASCII text, with very long lines (1066)
downloaded
Chrome Cache Entry: 134
ASCII text
downloaded
Chrome Cache Entry: 135
Web Open Font Format (Version 2), TrueType, length 34108, version 1.0
downloaded
Chrome Cache Entry: 136
HTML document, Unicode text, UTF-8 text, with very long lines (1136)
dropped
Chrome Cache Entry: 137
Web Open Font Format (Version 2), TrueType, length 15552, version 1.0
downloaded
Chrome Cache Entry: 138
Web Open Font Format (Version 2), TrueType, length 15344, version 1.0
downloaded
Chrome Cache Entry: 139
ASCII text, with very long lines (2054)
downloaded
Chrome Cache Entry: 140
Web Open Font Format (Version 2), TrueType, length 15744, version 1.0
downloaded
Chrome Cache Entry: 141
PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced
downloaded
Chrome Cache Entry: 142
PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced
dropped
Chrome Cache Entry: 95
ASCII text, with very long lines (2124)
downloaded
Chrome Cache Entry: 96
ASCII text, with very long lines (989)
downloaded
Chrome Cache Entry: 97
ASCII text, with very long lines (631)
downloaded
Chrome Cache Entry: 98
ASCII text, with no line terminators
downloaded
Chrome Cache Entry: 99
ASCII text, with very long lines (2124)
downloaded
There are 45 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 --field-trial-handle=2012,i,2004731542745830163,9567229137091194842,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://sites.google.com/view/scanned-files-jn1nn/google-pdf?file=Chasebank_Statement_Apr.pdf&fid=60231474"

URLs

Name
IP
Malicious
https://sites.google.com/view/scanned-files-jn1nn/google-pdf?file=Chasebank_Statement_Apr.pdf&fid=60231474
https://signaler-staging.sandbox.google.com
unknown
https://feedback.googleusercontent.com/resources/annotator.css
unknown
https://developers.google.com/recaptcha/docs/faq#localhost_support
unknown
https://apis.google.com/js/client.js
unknown
https://www.google.com/recaptcha/api2/reload?k=6LfVIcYpAAAAAJxs1OJypixVLiu-KHsYa1fuwsHL
74.125.136.103
https://feedback2-test.corp.googleusercontent.com/tools/feedback/%
unknown
http://lh3.ggpht.com
unknown
https://support.google.com
unknown
http://localhost.proxy.googlers.com/inapp/
unknown
https://support.google.com/recaptcha#6262736
unknown
https://stagingqual-feedback-pa-googleapis.sandbox.google.com
unknown
https://dataconnector.corp.google.com/:session_prefix:ui/widgetview?usegapi=1
unknown
https://support.google.com/drive/answer/2423485?hl=%s
unknown
https://help.youtube.com/tools/feedback/
unknown
https://support.google.com/a/answer/33864?hl=en-US
unknown
about:blank
https://onepick-autopush.sandbox.google.com/picker/minpick/main
unknown
https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
unknown
https://sites.google.com/view/scanned-files-jn1nn/google-pdf?file=Chasebank_Statement_Apr.pdf&fid=60231474
https://support.google.com/recaptcha/?hl=en#6223828
unknown
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.JisoxTPHVRs.O/m=gapi_rpc/rt=j/sv=1/d=1/ed=1/am=AAAC/rs=AHpOoo9VOmUKkb8FAwL65OiDUU4etqWcRg/cb=gapi.loaded_0?le=scs
64.233.176.113
https://www.youtube.com
unknown
https://asx-frontend-staging.corp.google.com/tools/feedback/
unknown
https://apis.google.com/js/api.js?checkCookie=1
64.233.176.113
https://www.google.com
unknown
https://support.google.com/drive/answer/2407404?hl=en
unknown
https://pay.google.com/gp/v/widget/save
unknown
https://workspace.google.com
unknown
https://onepick-staging.sandbox.google.com/picker/minpick/main
unknown
https://support.google.com/recaptcha/#6175971
unknown
https://support.google.com/docs/answer/49114
unknown
https://support.google.com/drive/answer/2423694
unknown
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfVIcYpAAAAAJxs1OJypixVLiu-KHsYa1fuwsHL&co=aHR0cHM6Ly9taXJvc2xhd2JhY2EucGw6NDQz&hl=en&v=V6_85qpc2Xf2sbe3xTnRte7m&size=normal&cb=ohmt2ae69ssp
https://support.google.com/google-workspace-individual/?p=esignature_signer_terms
unknown
https://www.gstatic.c..?/recaptcha/releases/V6_85qpc2Xf2sbe3xTnRte7m/recaptcha__.
unknown
https://drive-thirdparty.googleusercontent.com/
unknown
https://www.google.com/shopping/customerreviews/optin?usegapi=1
unknown
https://asx-frontend-autopush.corp.google.co.uk/tools/feedback/
unknown
https://onepick-preprod.sandbox.google.com/picker/minpick/main
unknown
https://developers.google.com/
unknown
https://onepick-staging-drivequal.sandbox.google.com/picker/minpick/main
unknown
https://support.google.com/cloudsearch/answer/6172299
unknown
https://support.google.com/recaptcha
unknown
https://developers.google.com/identity/gsi/web/guides/gis-migration)
unknown
https://www.google.com/tools/feedback
unknown
https://sandbox.google.com/inapp/%
unknown
https://www.google.com/recaptcha/api.js?trustedtypes=true
unknown
https://apis.google.com/js/api.js
unknown
https://workspace.google.com/products/sites/
unknown
https://www.apache.org/licenses/
unknown
https://www.google.com/tools/feedback/
unknown
https://www.youtube.com/subscribe_embed?usegapi=1
unknown
https://feedback2-test.corp.google.com/tools/feedback/%
unknown
https://punctual-dev.corp.google.com
unknown
https://plus.google.com
unknown
https://support.google.com/google-workspace-individual/?p=esignature_signer_tos
unknown
https://developers.google.com/recaptcha/docs/faq#my-computer-or-network-may-be-sending-automated-que
unknown
https://asx-frontend-autopush.corp.google.de/tools/feedback/
unknown
https://www.youtubeeducation.com
unknown
https://asx-help-frontend-autopush.corp.youtube.com/tools/feedback/
unknown
https://clients5.google.com/webstore/wall/widget
unknown
https://play.google.com/log?format=json&hasfast=true
unknown
https://asx-frontend-autopush.corp.google.com/inapp/
unknown
https://preprod-dynamite-alpha-us-signaler-pa.clients6.google.com
unknown
https://feedback.googleusercontent.com/resources/render_frame2.html
unknown
https://sandbox.google.com/tools/feedback/%
unknown
https://localhost.corp.google.com/inapp/
unknown
https://support.google.com/drive/answer/7650301
unknown
https://drive.google.com
unknown
https://play.google.com/work/embedded/search?usegapi=1&usegapi=1
unknown
https://rapid.corp.google.com/
unknown
https://drive.google.com/requestreview?id=
unknown
http://lh4.ggpht.com
unknown
https://asx-frontend-staging.corp.google.com/inapp/
unknown
https://drive.google.com/drive/my-drive
unknown
https://fonts.google.com/license/googlerestricted
unknown
https://clients6.google.com
unknown
https://www.google.com/recaptcha/api2/payload?p=06AFcWeA6eAkkpFQi7IwwJwhIUV0lP0m6te_VdTKclmnezSRY1QyMLvayGRt1NmniaIU-meakxVJRAT3g5zk4f0Z0otG3SMs8rhFiB_aaj6I76i2dlFu8g1U3pzEVk5A8qLADunZJlPqkIWkB30xLtz6Qp2p8iyWVJ4zr7OVM2V-vMx0VodlFwfTRjrbILAUoIsPeJz2gMWGtqBkWsr7TxTx_hBtC7_rSygw&k=6LfVIcYpAAAAAJxs1OJypixVLiu-KHsYa1fuwsHL
74.125.136.103
http://localhost.corp.google.com/inapp/
unknown
https://scriptz.corp.google.com/
unknown
https://miroslawbaca.pl/wp-content/uploads/2020/boat.php?id=AwvqtMJyy0Vldu
https://play.google.com
unknown
https://clients5.google.com
unknown
https://console.developers.google.com/
unknown
https://signaler-pa.youtube.com
unknown
https://support.google.com/inapp/%
unknown
https://asx-help-frontend-autopush.corp.youtube.com/inapp/
unknown
https://drivemetadata.clients6.google.com
unknown
https://cloud.google.com/contact
unknown
https://support.google.com/docs/answer/148505
unknown
https://support.google.com/
unknown
https://support.google.com/docs/answer/37603
unknown
https://www.google.com/shopping/customerreviews/badge?usegapi=1
unknown
https://csp.withgoogle.com/csp/lcreport/
unknown
https://drive.google.com/savetodrivebutton?usegapi=1
unknown
https://scone-pa.clients6.google.com
unknown
https://support.google.com/inapp/
unknown
https://asx-frontend-autopush.corp.google.co.uk/inapp/
unknown
http://lh6.ggpht.com
unknown
https://developers.google.com/api-client-library/javascript/reference/referencedocs
unknown
There are 90 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
plus.l.google.com
142.250.105.139
play.google.com
64.233.185.139
sites.google.com
64.233.185.139
www.google.com
74.125.136.103
drive.google.com
172.217.215.100
miroslawbaca.pl
153.92.220.230
googlehosted.l.googleusercontent.com
142.251.15.132
1466681747-atari-embeds.googleusercontent.com
unknown
apis.google.com
unknown

IPs

IP
Domain
Country
Malicious
172.217.215.100
drive.google.com
United States
74.125.136.105
unknown
United States
172.217.215.104
unknown
United States
192.168.2.5
unknown
unknown
64.233.176.113
unknown
United States
74.125.136.103
www.google.com
United States
64.233.185.139
play.google.com
United States
142.251.15.132
googlehosted.l.googleusercontent.com
United States
239.255.255.250
unknown
Reserved
108.177.122.101
unknown
United States
153.92.220.230
miroslawbaca.pl
United States
There are 1 hidden IPs, click here to show them.

DOM / HTML

URL
Malicious
about:blank
https://sites.google.com/view/scanned-files-jn1nn/google-pdf?file=Chasebank_Statement_Apr.pdf&fid=60231474
https://sites.google.com/view/scanned-files-jn1nn/google-pdf?file=Chasebank_Statement_Apr.pdf&fid=60231474
https://drive.google.com/auth_warmup
https://www.gstatic.com/atari/embeds/83a60601c213b72fb19c1855fb0c5f26/intermediate-frame-minified.html?jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.JisoxTPHVRs.O%2Fam%3DAAAC%2Fd%3D1%2Frs%3DAHpOoo9VOmUKkb8FAwL65OiDUU4etqWcRg%2Fm%3D__features__&r=440830379
https://www.gstatic.com/atari/embeds/83a60601c213b72fb19c1855fb0c5f26/intermediate-frame-minified.html?jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.JisoxTPHVRs.O%2Fam%3DAAAC%2Fd%3D1%2Frs%3DAHpOoo9VOmUKkb8FAwL65OiDUU4etqWcRg%2Fm%3D__features__&r=440830379
https://www.gstatic.com/atari/embeds/83a60601c213b72fb19c1855fb0c5f26/intermediate-frame-minified.html?jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.JisoxTPHVRs.O%2Fam%3DAAAC%2Fd%3D1%2Frs%3DAHpOoo9VOmUKkb8FAwL65OiDUU4etqWcRg%2Fm%3D__features__&r=440830379
https://1466681747-atari-embeds.googleusercontent.com/embeds/16cb204cf3a9d4d223a0a3fd8b0eec5d/inner-frame-minified.html?jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.JisoxTPHVRs.O%2Fam%3DAAAC%2Fd%3D1%2Frs%3DAHpOoo9VOmUKkb8FAwL65OiDUU4etqWcRg%2Fm%3D__features__
https://1466681747-atari-embeds.googleusercontent.com/embeds/16cb204cf3a9d4d223a0a3fd8b0eec5d/inner-frame-minified.html?jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.JisoxTPHVRs.O%2Fam%3DAAAC%2Fd%3D1%2Frs%3DAHpOoo9VOmUKkb8FAwL65OiDUU4etqWcRg%2Fm%3D__features__
https://1466681747-atari-embeds.googleusercontent.com/embeds/16cb204cf3a9d4d223a0a3fd8b0eec5d/inner-frame-minified.html?jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.JisoxTPHVRs.O%2Fam%3DAAAC%2Fd%3D1%2Frs%3DAHpOoo9VOmUKkb8FAwL65OiDUU4etqWcRg%2Fm%3D__features__
https://miroslawbaca.pl/wp-content/uploads/2020/boat.php?id=AwvqtMJyy0Vldu
https://miroslawbaca.pl/wp-content/uploads/2020/boat.php?id=AwvqtMJyy0Vldu
https://miroslawbaca.pl/wp-content/uploads/2020/boat.php?id=AwvqtMJyy0Vldu
https://miroslawbaca.pl/wp-content/uploads/2020/boat.php?id=AwvqtMJyy0Vldu
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfVIcYpAAAAAJxs1OJypixVLiu-KHsYa1fuwsHL&co=aHR0cHM6Ly9taXJvc2xhd2JhY2EucGw6NDQz&hl=en&v=V6_85qpc2Xf2sbe3xTnRte7m&size=normal&cb=ohmt2ae69ssp
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfVIcYpAAAAAJxs1OJypixVLiu-KHsYa1fuwsHL&co=aHR0cHM6Ly9taXJvc2xhd2JhY2EucGw6NDQz&hl=en&v=V6_85qpc2Xf2sbe3xTnRte7m&size=normal&cb=ohmt2ae69ssp
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfVIcYpAAAAAJxs1OJypixVLiu-KHsYa1fuwsHL&co=aHR0cHM6Ly9taXJvc2xhd2JhY2EucGw6NDQz&hl=en&v=V6_85qpc2Xf2sbe3xTnRte7m&size=normal&cb=ohmt2ae69ssp
https://www.google.com/recaptcha/api2/bframe?hl=en&v=V6_85qpc2Xf2sbe3xTnRte7m&k=6LfVIcYpAAAAAJxs1OJypixVLiu-KHsYa1fuwsHL
https://www.google.com/recaptcha/api2/bframe?hl=en&v=V6_85qpc2Xf2sbe3xTnRte7m&k=6LfVIcYpAAAAAJxs1OJypixVLiu-KHsYa1fuwsHL
There are 9 hidden doms, click here to show them.