Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command
line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 12:57:18 2024, atime=Mon Oct 2 20:46:57
2023, length=1210144, window=hide
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command
line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 12:57:18 2024, atime=Mon Oct 2 20:46:57
2023, length=1210144, window=hide
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command
line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 09:23:19 2023, atime=Mon Oct 2 20:46:57
2023, length=1210144, window=hide
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command
line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 12:57:18 2024, atime=Mon Oct 2 20:46:57
2023, length=1210144, window=hide
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command
line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 12:57:18 2024, atime=Mon Oct 2 20:46:57
2023, length=1210144, window=hide
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command
line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 12:57:18 2024, atime=Mon Oct 2 20:46:57
2023, length=1210144, window=hide
|
dropped
|
||
|
Chrome Cache Entry: 100
|
JSON data
|
dropped
|
||
|
Chrome Cache Entry: 101
|
MS Windows icon resource - 8 icons, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel,
256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel
|
downloaded
|
||
|
Chrome Cache Entry: 102
|
ASCII text, with very long lines (412)
|
downloaded
|
||
|
Chrome Cache Entry: 103
|
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 444227
|
downloaded
|
||
|
Chrome Cache Entry: 104
|
SVG Scalable Vector Graphics image
|
dropped
|
||
|
Chrome Cache Entry: 105
|
ASCII text, with very long lines (65449)
|
downloaded
|
||
|
Chrome Cache Entry: 106
|
MS Windows icon resource - 8 icons, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel,
256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel
|
dropped
|
||
|
Chrome Cache Entry: 107
|
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592
|
dropped
|
||
|
Chrome Cache Entry: 108
|
GIF image data, version 89a, 352 x 3
|
dropped
|
||
|
Chrome Cache Entry: 109
|
MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
|
downloaded
|
||
|
Chrome Cache Entry: 110
|
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 223759
|
downloaded
|
||
|
Chrome Cache Entry: 111
|
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1864
|
downloaded
|
||
|
Chrome Cache Entry: 112
|
GIF image data, version 89a, 352 x 3
|
dropped
|
||
|
Chrome Cache Entry: 113
|
HTML document, Unicode text, UTF-8 text, with very long lines (16913), with no line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 114
|
JSON data
|
dropped
|
||
|
Chrome Cache Entry: 115
|
JSON data
|
downloaded
|
||
|
Chrome Cache Entry: 116
|
GIF image data, version 89a, 352 x 3
|
downloaded
|
||
|
Chrome Cache Entry: 117
|
MS Windows icon resource - 8 icons, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel,
256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel
|
dropped
|
||
|
Chrome Cache Entry: 118
|
JSON data
|
dropped
|
||
|
Chrome Cache Entry: 119
|
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 55071
|
downloaded
|
||
|
Chrome Cache Entry: 120
|
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1864
|
dropped
|
||
|
Chrome Cache Entry: 121
|
GIF image data, version 89a, 352 x 3
|
downloaded
|
||
|
Chrome Cache Entry: 122
|
MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
|
dropped
|
||
|
Chrome Cache Entry: 123
|
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113084
|
downloaded
|
||
|
Chrome Cache Entry: 124
|
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113657
|
downloaded
|
||
|
Chrome Cache Entry: 83
|
Unicode text, UTF-8 text, with very long lines (32062)
|
downloaded
|
||
|
Chrome Cache Entry: 84
|
HTML document, ASCII text, with very long lines (2345), with CRLF line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 85
|
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
|
downloaded
|
||
|
Chrome Cache Entry: 86
|
SVG Scalable Vector Graphics image
|
dropped
|
||
|
Chrome Cache Entry: 87
|
JSON data
|
downloaded
|
||
|
Chrome Cache Entry: 88
|
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
|
dropped
|
||
|
Chrome Cache Entry: 89
|
MS Windows icon resource - 8 icons, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel,
256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel
|
downloaded
|
||
|
Chrome Cache Entry: 90
|
JSON data
|
dropped
|
||
|
Chrome Cache Entry: 91
|
HTML document, ASCII text, with very long lines (2345), with CRLF line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 92
|
ASCII text, with very long lines (45563)
|
downloaded
|
||
|
Chrome Cache Entry: 93
|
SVG Scalable Vector Graphics image
|
downloaded
|
||
|
Chrome Cache Entry: 94
|
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 15708
|
downloaded
|
||
|
Chrome Cache Entry: 95
|
JSON data
|
dropped
|
||
|
Chrome Cache Entry: 96
|
ASCII text, with very long lines (4212)
|
downloaded
|
||
|
Chrome Cache Entry: 97
|
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592
|
downloaded
|
||
|
Chrome Cache Entry: 98
|
SVG Scalable Vector Graphics image
|
downloaded
|
||
|
Chrome Cache Entry: 99
|
ASCII text, with no line terminators
|
downloaded
|
There are 39 hidden files, click here to show them.
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Program Files\Google\Chrome\Application\chrome.exe
|
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://urlshortener.teams.cloud.microsoft/8DC6524B7BA4BE6-3-2
|
||
|
C:\Program Files\Google\Chrome\Application\chrome.exe
|
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US
--service-sandbox-type=none --mojo-platform-channel-handle=2196 --field-trial-handle=1972,i,12641275858175302215,10052665692327869527,262144
--disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction
/prefetch:8
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
https://urlshortener.teams.cloud.microsoft/8DC6524B7BA4BE6-3-2
|
|||
|
http://www.apache.org/licenses/LICENSE-2.0
|
unknown
|
||
|
https://login.microsoftonline.com/
|
unknown
|
||
|
https://github.com/zloirock/core-js
|
unknown
|
||
|
https://login.microsoftonline.com/common/oauth2/v2.0/authorize?response_type=id_token&scope=openid%20profile&client_id=4b3e8f46-56d3-427f-b1e2-d239b2ea6bca&redirect_uri=https%3A%2F%2Fteams.live.com%2Fgo&state=eyJpZCI6ImEyMDY2NDE4LTcyNjQtNGNmNC1iYTRjLTc4ZThiY2VlMjZiMyIsInRzIjoxNzE0MDUzNDUxLCJtZXRob2QiOiJyZWRpcmVjdEludGVyYWN0aW9uIn0%3D&nonce=539c480e-d8b2-40c4-9d3c-3d892a76377c&client_info=1&x-client-SKU=MSAL.JS&x-client-Ver=1.3.4&nopa=2&client-request-id=786f855e-c771-495a-ac7f-188dfe5e225c&response_mode=fragment&sso_reload=true
|
|||
|
http://knockoutjs.com/
|
unknown
|
||
|
https://github.com/douglascrockford/JSON-js
|
unknown
|
||
|
https://login.windows-ppe.net
|
unknown
|
||
|
https://statics.teams.cdn.live.net/hashedjs-launcher/launcher.3c5b23498b3a051ad013.js
|
unknown
|
||
|
https://teams.live.com/api/mt
|
unknown
|
||
|
https://login.microsoftonline.com/common/oauth2/v2.0/authorize?response_type=id_token&scope=openid%20profile&client_id=4b3e8f46-56d3-427f-b1e2-d239b2ea6bca&redirect_uri=https%3A%2F%2Fteams.live.com%2Fgo&state=eyJpZCI6ImEyMDY2NDE4LTcyNjQtNGNmNC1iYTRjLTc4ZThiY2VlMjZiMyIsInRzIjoxNzE0MDUzNDUxLCJtZXRob2QiOiJyZWRpcmVjdEludGVyYWN0aW9uIn0%3D&nonce=539c480e-d8b2-40c4-9d3c-3d892a76377c&client_info=1&x-client-SKU=MSAL.JS&x-client-Ver=1.3.4&nopa=2&client-request-id=786f855e-c771-495a-ac7f-188dfe5e225c&response_mode=fragment
|
|||
|
https://api.spaces.skype.com/.default
|
unknown
|
||
|
https://statics.teams.cdn.live.net/hashedcss-launcher/launcher.d6cd10b8b26b2130799c.css
|
unknown
|
||
|
https://login.microsoftonline.com
|
unknown
|
||
|
http://www.opensource.org/licenses/mit-license.php)
|
unknown
|
||
|
https://statics.teams.cdn.live.net/hashedjs-launcher/polyfills.1f5a03d113c6ac7b91f5.js
|
unknown
|
||
|
http://rock.mit-license.org
|
unknown
|
||
|
https://teams.live.com/dl/launcher/launcher.html?url=%2F_%23%2Fl%2Fchat%2F19%3Auni01_2hqxtwyf57dbz2miswffeciw5d4epfpr7i4h5u5gvnh7pqd4slpq%40thread.v2%2Fconversations%3FtenantId%3D9188040d-6c67-4c5b-b112-36a304b66dad%26launchAgent%3DES%26laEntry%3DMAE%26v%3DMAE5%26lm%3Ddeeplink%26lmsrc%3Demail%26emltid%3D10459c8b-4325-4997-8dae-4b4abe8055d7%26linkpos%3D1%26emltype%3DNew_Activities_TFL%26linktype%3DNew_ChatActivity_TFL&type=chat&deeplinkId=bda27838-9a4c-4bf2-b95e-469b509bf49f&directDl=true&msLaunch=true&enableMobilePage=true&suppressPrompt=true
|
|||
|
https://urlshortener.teams.cloud.microsoft/8DC6524B7BA4BE6-3-2
|
52.123.129.14
|
||
|
https://teams.live.com/?tenantId=9188040d-6c67-4c5b-b112-36a304b66dad#/l/chat/19:uni01_2hqxtwyf57dbz2miswffeciw5d4epfpr7i4h5u5gvnh7pqd4slpq@thread.v2/conversations?tenantId=9188040d-6c67-4c5b-b112-36a304b66dad&launchAgent=ES&laEntry=MAE&v=MAE5&lm=deeplink&lmsrc=email&emltid=10459c8b-4325-4997-8dae-4b4abe8055d7&linkpos=1&emltype=New_Activities_TFL&linktype=New_ChatActivity_TFL&deeplinkId=46105036-5060-4449-b6d3-8dc1b42e2e8b
|
|||
|
https://statics.teams.cdn.live.net
|
unknown
|
||
|
https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration
|
unknown
|
||
|
https://login.microsoftonline.com/common/discovery/v2.0/keys
|
unknown
|
||
|
https://aadcdn.msftauth.net/shared/1.0/content/js/BssoInterrupt_Core_ChpboAn7HyXj89A22M8mzg2.js
|
152.199.4.44
|
||
|
https://local.teams.office.com/#/calendar?meetingId=AA
|
unknown
|
||
|
https://login.microsoftonline.com/common/oauth2/v2.0/token
|
unknown
|
There are 15 hidden URLs, click here to show them.
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
part-0013.t-0009.t-msedge.net
|
13.107.246.41
|
||
|
cs1100.wpc.omegacdn.net
|
152.199.4.44
|
||
|
www.google.com
|
64.233.177.147
|
||
|
s-0005.dual-s-msedge.net
|
52.123.129.14
|
||
|
urlshortener.teams.cloud.microsoft
|
unknown
|
||
|
identity.nel.measure.office.net
|
unknown
|
||
|
aadcdn.msftauth.net
|
unknown
|
||
|
statics.teams.cdn.live.net
|
unknown
|
||
|
login.microsoftonline.com
|
unknown
|
||
|
teams.live.com
|
unknown
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
13.107.246.41
|
part-0013.t-0009.t-msedge.net
|
United States
|
||
|
152.199.4.44
|
cs1100.wpc.omegacdn.net
|
United States
|
||
|
192.168.2.18
|
unknown
|
unknown
|
||
|
52.123.129.14
|
s-0005.dual-s-msedge.net
|
United States
|
||
|
239.255.255.250
|
unknown
|
Reserved
|
||
|
64.233.177.147
|
www.google.com
|
United States
|
||
|
13.107.213.41
|
unknown
|
United States
|
DOM / HTML
|
URL
|
Malicious
|
|
|---|---|---|
|
https://teams.live.com/dl/launcher/launcher.html?url=%2F_%23%2Fl%2Fchat%2F19%3Auni01_2hqxtwyf57dbz2miswffeciw5d4epfpr7i4h5u5gvnh7pqd4slpq%40thread.v2%2Fconversations%3FtenantId%3D9188040d-6c67-4c5b-b112-36a304b66dad%26launchAgent%3DES%26laEntry%3DMAE%26v%3DMAE5%26lm%3Ddeeplink%26lmsrc%3Demail%26emltid%3D10459c8b-4325-4997-8dae-4b4abe8055d7%26linkpos%3D1%26emltype%3DNew_Activities_TFL%26linktype%3DNew_ChatActivity_TFL&type=chat&deeplinkId=bda27838-9a4c-4bf2-b95e-469b509bf49f&directDl=true&msLaunch=true&enableMobilePage=true&suppressPrompt=true
|
||
|
https://teams.live.com/?tenantId=9188040d-6c67-4c5b-b112-36a304b66dad#/l/chat/19:uni01_2hqxtwyf57dbz2miswffeciw5d4epfpr7i4h5u5gvnh7pqd4slpq@thread.v2/conversations?tenantId=9188040d-6c67-4c5b-b112-36a304b66dad&launchAgent=ES&laEntry=MAE&v=MAE5&lm=deeplink&lmsrc=email&emltid=10459c8b-4325-4997-8dae-4b4abe8055d7&linkpos=1&emltype=New_Activities_TFL&linktype=New_ChatActivity_TFL&deeplinkId=46105036-5060-4449-b6d3-8dc1b42e2e8b
|
||
|
https://login.microsoftonline.com/common/oauth2/v2.0/authorize?response_type=id_token&scope=openid%20profile&client_id=4b3e8f46-56d3-427f-b1e2-d239b2ea6bca&redirect_uri=https%3A%2F%2Fteams.live.com%2Fgo&state=eyJpZCI6ImEyMDY2NDE4LTcyNjQtNGNmNC1iYTRjLTc4ZThiY2VlMjZiMyIsInRzIjoxNzE0MDUzNDUxLCJtZXRob2QiOiJyZWRpcmVjdEludGVyYWN0aW9uIn0%3D&nonce=539c480e-d8b2-40c4-9d3c-3d892a76377c&client_info=1&x-client-SKU=MSAL.JS&x-client-Ver=1.3.4&nopa=2&client-request-id=786f855e-c771-495a-ac7f-188dfe5e225c&response_mode=fragment
|
||
|
https://login.microsoftonline.com/common/oauth2/v2.0/authorize?response_type=id_token&scope=openid%20profile&client_id=4b3e8f46-56d3-427f-b1e2-d239b2ea6bca&redirect_uri=https%3A%2F%2Fteams.live.com%2Fgo&state=eyJpZCI6ImEyMDY2NDE4LTcyNjQtNGNmNC1iYTRjLTc4ZThiY2VlMjZiMyIsInRzIjoxNzE0MDUzNDUxLCJtZXRob2QiOiJyZWRpcmVjdEludGVyYWN0aW9uIn0%3D&nonce=539c480e-d8b2-40c4-9d3c-3d892a76377c&client_info=1&x-client-SKU=MSAL.JS&x-client-Ver=1.3.4&nopa=2&client-request-id=786f855e-c771-495a-ac7f-188dfe5e225c&response_mode=fragment&sso_reload=true
|
||
|
https://login.microsoftonline.com/common/oauth2/v2.0/authorize?response_type=id_token&scope=openid%20profile&client_id=4b3e8f46-56d3-427f-b1e2-d239b2ea6bca&redirect_uri=https%3A%2F%2Fteams.live.com%2Fgo&state=eyJpZCI6ImEyMDY2NDE4LTcyNjQtNGNmNC1iYTRjLTc4ZThiY2VlMjZiMyIsInRzIjoxNzE0MDUzNDUxLCJtZXRob2QiOiJyZWRpcmVjdEludGVyYWN0aW9uIn0%3D&nonce=539c480e-d8b2-40c4-9d3c-3d892a76377c&client_info=1&x-client-SKU=MSAL.JS&x-client-Ver=1.3.4&nopa=2&client-request-id=786f855e-c771-495a-ac7f-188dfe5e225c&response_mode=fragment&sso_reload=true
|