Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command
line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 11:24:44 2024, atime=Wed Sep 27 04:28:28
2023, length=1210144, window=hide
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command
line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 11:24:44 2024, atime=Wed Sep 27 04:28:28
2023, length=1210144, window=hide
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command
line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28
2023, length=1210144, window=hide
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command
line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 11:24:44 2024, atime=Wed Sep 27 04:28:28
2023, length=1210144, window=hide
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command
line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 11:24:44 2024, atime=Wed Sep 27 04:28:28
2023, length=1210144, window=hide
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command
line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 11:24:44 2024, atime=Wed Sep 27 04:28:28
2023, length=1210144, window=hide
|
dropped
|
||
|
Chrome Cache Entry: 100
|
gzip compressed data, max compression, from Unix, truncated
|
downloaded
|
||
|
Chrome Cache Entry: 101
|
gzip compressed data, max compression, from Unix, truncated
|
dropped
|
||
|
Chrome Cache Entry: 102
|
gzip compressed data, max compression, from Unix, truncated
|
dropped
|
||
|
Chrome Cache Entry: 103
|
gzip compressed data, max compression, from Unix, truncated
|
downloaded
|
||
|
Chrome Cache Entry: 104
|
gzip compressed data, max compression, from Unix, original size modulo 2^32 2511
|
dropped
|
||
|
Chrome Cache Entry: 105
|
gzip compressed data, max compression, from Unix, truncated
|
dropped
|
||
|
Chrome Cache Entry: 106
|
gzip compressed data, max compression, from Unix, truncated
|
downloaded
|
||
|
Chrome Cache Entry: 107
|
gzip compressed data, max compression, from Unix, original size modulo 2^32 3184
|
downloaded
|
||
|
Chrome Cache Entry: 108
|
gzip compressed data, max compression, from Unix, truncated
|
dropped
|
||
|
Chrome Cache Entry: 109
|
gzip compressed data, max compression, from Unix, truncated
|
downloaded
|
||
|
Chrome Cache Entry: 110
|
gzip compressed data, max compression, from Unix, truncated
|
downloaded
|
||
|
Chrome Cache Entry: 111
|
gzip compressed data, max compression, from Unix, truncated
|
downloaded
|
||
|
Chrome Cache Entry: 112
|
gzip compressed data, max compression, from Unix, truncated
|
dropped
|
||
|
Chrome Cache Entry: 113
|
gzip compressed data, max compression, from Unix, truncated
|
downloaded
|
||
|
Chrome Cache Entry: 114
|
gzip compressed data, max compression, from Unix, truncated
|
dropped
|
||
|
Chrome Cache Entry: 115
|
gzip compressed data, max compression, from Unix, truncated
|
dropped
|
||
|
Chrome Cache Entry: 116
|
gzip compressed data, max compression, from Unix, truncated
|
downloaded
|
||
|
Chrome Cache Entry: 117
|
gzip compressed data, max compression, from Unix, truncated
|
dropped
|
||
|
Chrome Cache Entry: 118
|
gzip compressed data, max compression, from Unix, truncated
|
dropped
|
||
|
Chrome Cache Entry: 119
|
gzip compressed data, max compression, from Unix, truncated
|
dropped
|
||
|
Chrome Cache Entry: 120
|
gzip compressed data, max compression, from Unix, truncated
|
dropped
|
||
|
Chrome Cache Entry: 63
|
ASCII text, with very long lines (306)
|
downloaded
|
||
|
Chrome Cache Entry: 64
|
gzip compressed data, max compression, from Unix, truncated
|
downloaded
|
||
|
Chrome Cache Entry: 65
|
gzip compressed data, max compression, from Unix, truncated
|
downloaded
|
||
|
Chrome Cache Entry: 66
|
gzip compressed data, max compression, from Unix, truncated
|
dropped
|
||
|
Chrome Cache Entry: 67
|
gzip compressed data, max compression, from Unix, truncated
|
dropped
|
||
|
Chrome Cache Entry: 68
|
gzip compressed data, max compression, from Unix, truncated
|
downloaded
|
||
|
Chrome Cache Entry: 69
|
gzip compressed data, max compression, from Unix, truncated
|
dropped
|
||
|
Chrome Cache Entry: 70
|
gzip compressed data, max compression, from Unix, truncated
|
downloaded
|
||
|
Chrome Cache Entry: 71
|
gzip compressed data, max compression, from Unix, original size modulo 2^32 141
|
downloaded
|
||
|
Chrome Cache Entry: 72
|
gzip compressed data, max compression, from Unix, truncated
|
downloaded
|
||
|
Chrome Cache Entry: 73
|
gzip compressed data, max compression, from Unix, truncated
|
downloaded
|
||
|
Chrome Cache Entry: 74
|
gzip compressed data, max compression, from Unix, truncated
|
downloaded
|
||
|
Chrome Cache Entry: 75
|
gzip compressed data, max compression, from Unix, truncated
|
downloaded
|
||
|
Chrome Cache Entry: 76
|
gzip compressed data, max compression, from Unix, truncated
|
dropped
|
||
|
Chrome Cache Entry: 77
|
gzip compressed data, max compression, from Unix, original size modulo 2^32 92629
|
downloaded
|
||
|
Chrome Cache Entry: 78
|
gzip compressed data, max compression, from Unix, truncated
|
dropped
|
||
|
Chrome Cache Entry: 79
|
gzip compressed data, max compression, from Unix, truncated
|
dropped
|
||
|
Chrome Cache Entry: 80
|
gzip compressed data, max compression, from Unix, truncated
|
dropped
|
||
|
Chrome Cache Entry: 81
|
gzip compressed data, max compression, from Unix, truncated
|
downloaded
|
||
|
Chrome Cache Entry: 82
|
gzip compressed data, max compression, from Unix, truncated
|
downloaded
|
||
|
Chrome Cache Entry: 83
|
gzip compressed data, max compression, from Unix, truncated
|
dropped
|
||
|
Chrome Cache Entry: 84
|
gzip compressed data, max compression, from Unix, truncated
|
downloaded
|
||
|
Chrome Cache Entry: 85
|
gzip compressed data, max compression, from Unix, truncated
|
dropped
|
||
|
Chrome Cache Entry: 86
|
gzip compressed data, max compression, from Unix, truncated
|
dropped
|
||
|
Chrome Cache Entry: 87
|
gzip compressed data, max compression, from Unix, truncated
|
downloaded
|
||
|
Chrome Cache Entry: 88
|
gzip compressed data, max compression, from Unix, truncated
|
downloaded
|
||
|
Chrome Cache Entry: 89
|
gzip compressed data, max compression, from Unix, truncated
|
dropped
|
||
|
Chrome Cache Entry: 90
|
gzip compressed data, max compression, from Unix, truncated
|
dropped
|
||
|
Chrome Cache Entry: 91
|
gzip compressed data, max compression, from Unix, truncated
|
downloaded
|
||
|
Chrome Cache Entry: 92
|
gzip compressed data, max compression, from Unix, truncated
|
dropped
|
||
|
Chrome Cache Entry: 93
|
gzip compressed data, max compression, from Unix, truncated
|
downloaded
|
||
|
Chrome Cache Entry: 94
|
gzip compressed data, max compression, from Unix, truncated
|
downloaded
|
||
|
Chrome Cache Entry: 95
|
gzip compressed data, max compression, from Unix, truncated
|
dropped
|
||
|
Chrome Cache Entry: 96
|
gzip compressed data, max compression, from Unix, truncated
|
downloaded
|
||
|
Chrome Cache Entry: 97
|
gzip compressed data, last modified: Tue Mar 2 18:53:53 2021, max compression, from Unix, original size modulo 2^32 28406
|
downloaded
|
||
|
Chrome Cache Entry: 98
|
gzip compressed data, max compression, from Unix, truncated
|
dropped
|
||
|
Chrome Cache Entry: 99
|
gzip compressed data, max compression, from Unix, truncated
|
downloaded
|
There are 55 hidden files, click here to show them.
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Program Files\Google\Chrome\Application\chrome.exe
|
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
|
||
|
C:\Program Files\Google\Chrome\Application\chrome.exe
|
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US
--service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=2016,i,1715222104164893096,13145483760006011228,262144
--disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction
/prefetch:8
|
||
|
C:\Program Files\Google\Chrome\Application\chrome.exe
|
"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://www.corp-internal.co/ae90cbd9826866b7?l=8"
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://www.corp-internal.co/ae90cbd9826866b7?l=8
|
|||
|
http://www.corp-internal.co/trace?id=90cbd26866&msg=BrowserDetect%20-%20plugin%20Chromium%20PDF%20Viewer&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0
|
52.213.98.16
|
||
|
http://www.corp-internal.co/trace?id=90cbd26866&msg=BrowserDetect%20-%20os_version%20%3D%2010&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0
|
52.213.98.16
|
||
|
http://www.corp-internal.co/trace?id=90cbd26866&msg=browser_post_successful&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0
|
52.213.98.16
|
||
|
http://www.corp-internal.co/trace?id=90cbd26866&msg=BrowserDetect%20-%20plugin%20Chrome%20PDF%20Viewer&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0
|
52.213.98.16
|
||
|
http://www.corp-internal.co/trace?id=90cbd26866&msg=BrowserDetect%20-%20hasCookies%20%3D%20true&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0
|
52.213.98.16
|
||
|
http://www.corp-internal.co/trace?id=90cbd26866&msg=BrowserDetect%20-%20localStorage%20%3D%20true&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0
|
52.213.98.16
|
||
|
http://www.corp-internal.co/trace?id=90cbd26866&msg=Skipping%20WindowsMediaPlayer%20detection&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0
|
52.213.98.16
|
||
|
http://www.corp-internal.co/trace?id=90cbd26866&msg=BrowserDetect%20-%20browser%20%3D%20Chrome&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0
|
52.213.98.16
|
||
|
http://www.corp-internal.co/trace?id=90cbd26866&msg=BrowserDetect%20-%20browser_version%20%3D%20117&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0
|
52.213.98.16
|
||
|
http://www.corp-internal.co/secure/browser_post
|
52.213.98.16
|
||
|
http://www.corp-internal.co/trace?id=90cbd26866&msg=BrowserDetect%20-%20sessionStorage%20%3D%20true&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0
|
52.213.98.16
|
||
|
http://www.corp-internal.co/trace?id=90cbd26866&msg=BrowserDetect%20-%20plugin%20WebKit%20built-in%20PDF&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0
|
52.213.98.16
|
||
|
http://www.corp-internal.co/trace?id=90cbd26866&msg=BrowserDetect%20-%20plugin%20Microsoft%20Edge%20PDF%20Viewer&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0
|
52.213.98.16
|
||
|
http://www.corp-internal.co/trace?id=90cbd26866&msg=BrowserDetect%20-%20os%20%3D%20Windows&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0
|
52.213.98.16
|
||
|
http://www.corp-internal.co/trace?id=90cbd26866&msg=Skipping%20flash%20detection&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0
|
52.213.98.16
|
||
|
http://www.corp-internal.co/trace?id=90cbd26866&msg=redirecting%20to%20%2Fload_training%3Fguid%3De390cbdd12686627%26correlation_id%3D3fac3af0-74a1-4072-a0f1-391c2d2ad2d0&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0
|
52.213.98.16
|
||
|
http://www.corp-internal.co/trace?id=90cbd26866&msg=Skipping%20pdf%20detection&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0
|
52.213.98.16
|
||
|
http://www.corp-internal.co/trace?id=90cbd26866&msg=Skipping%20java%20detection&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0
|
52.213.98.16
|
||
|
http://www.corp-internal.co/trace?id=90cbd26866&msg=Skipping%20quicktime%20detection&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0
|
52.213.98.16
|
||
|
http://www.corp-internal.co/load_training?guid=e390cbdd12686627&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0
|
|||
|
http://www.corp-internal.co/trace?id=90cbd26866&msg=Chrome%20browser%2C%20using%20more%20detailed%20version&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0
|
52.213.98.16
|
||
|
http://www.corp-internal.co/trace?id=90cbd26866&msg=BrowserDetect%20-%20width%20%3D%201280&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0
|
52.213.98.16
|
||
|
http://www.corp-internal.co/trace?id=90cbd26866&msg=BrowserDetect%20-%20colorDepth%20%3D%2024&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0
|
52.213.98.16
|
||
|
http://www.corp-internal.co/favicon.ico
|
52.213.98.16
|
||
|
http://www.corp-internal.co/ae90cbd9826866b7?l=8
|
52.213.98.16
|
||
|
http://www.corp-internal.co/trace?id=90cbd26866&msg=Skipping%20Silverlight%20detection&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0
|
52.213.98.16
|
||
|
https://tslp.s3.amazonaws.com/detect/plugin_detect.js?guid=90cbd26866&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0
|
52.216.26.156
|
||
|
http://www.corp-internal.co/trace?id=90cbd26866&msg=BrowserDetect%20-%20plugin%20PDF%20Viewer&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0
|
52.213.98.16
|
||
|
http://www.corp-internal.co/trace?id=90cbd26866&msg=BrowserDetect%20-%20height%20%3D%201024&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0
|
52.213.98.16
|
||
|
http://www.corp-internal.co/assets/all.js?g=90cbd26866
|
52.213.98.16
|
||
|
http://www.corp-internal.co/trace?id=90cbd26866&msg=Skipping%20RealPlayer%20detection&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0
|
52.213.98.16
|
||
|
http://www.corp-internal.co/assets/ajax/libs/jquery/1.9.1/jquery.min.js
|
52.213.98.16
|
||
|
http://www.corp-internal.co/trace?id=90cbd26866&msg=BrowserDetect%20-%20language%20%3D%20en-US&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0
|
52.213.98.16
|
There are 23 hidden URLs, click here to show them.
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
s3-w.us-east-1.amazonaws.com
|
52.216.26.156
|
||
|
bg.microsoft.map.fastly.net
|
199.232.210.172
|
||
|
prod-lp-alb-323408969.eu-west-1.elb.amazonaws.com
|
52.213.98.16
|
||
|
www.google.com
|
142.250.9.104
|
||
|
fp2e7a.wpc.phicdn.net
|
192.229.211.108
|
||
|
tslp.s3.amazonaws.com
|
unknown
|
||
|
_49153._https.www.corp-internal.co
|
unknown
|
||
|
www.corp-internal.co
|
unknown
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
239.255.255.250
|
unknown
|
Reserved
|
||
|
142.250.9.104
|
www.google.com
|
United States
|
||
|
34.248.78.201
|
unknown
|
United States
|
||
|
52.216.26.156
|
s3-w.us-east-1.amazonaws.com
|
United States
|
||
|
52.213.98.16
|
prod-lp-alb-323408969.eu-west-1.elb.amazonaws.com
|
United States
|
||
|
192.168.2.5
|
unknown
|
unknown
|
DOM / HTML
|
URL
|
Malicious
|
|
|---|---|---|
|
http://www.corp-internal.co/load_training?guid=e390cbdd12686627&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0
|