IOC Report
https://encrypt-na.mailanyone.net/activate?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJlbWFpbCI6ImtpbWJlcmx5Lm1vcnJpc0BtaGEub2hpby5nb3YiLCJpZCI6OTE5MjEsImFjdGl2YXRpb24iOnRydWUsImF1dGhlbnRpY2F0aW9uIjpmYWxzZSwicmVzZXQiOmZhbHNlLCJwaWQiOiIiLCJsb2dpbm1ldGhvZCI6IiIsInBpZF9jdXN0b21lcl9pZCI6MCwiZXhwIjoxNz

loading gif

Files

File Path
Type
Category
Malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 16:23:11 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 16:23:11 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 16:23:11 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 16:23:11 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 16:23:11 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
Chrome Cache Entry: 70
ASCII text, with very long lines (1572)
downloaded
Chrome Cache Entry: 71
HTML document, ASCII text
dropped
Chrome Cache Entry: 72
ASCII text
downloaded
Chrome Cache Entry: 73
ASCII text
dropped
Chrome Cache Entry: 74
ASCII text
dropped
Chrome Cache Entry: 75
ASCII text, with no line terminators
downloaded
Chrome Cache Entry: 76
ASCII text
downloaded
Chrome Cache Entry: 77
ASCII text, with very long lines (30837)
downloaded
Chrome Cache Entry: 78
HTML document, ASCII text
downloaded
Chrome Cache Entry: 79
PNG image data, 344 x 87, 8-bit/color RGBA, non-interlaced
dropped
Chrome Cache Entry: 80
HTML document, ASCII text
downloaded
Chrome Cache Entry: 81
PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced
downloaded
Chrome Cache Entry: 82
exported SGML document, ASCII text
dropped
Chrome Cache Entry: 83
ASCII text, with very long lines (65371)
downloaded
Chrome Cache Entry: 84
HTML document, ASCII text
downloaded
Chrome Cache Entry: 85
HTML document, ASCII text
downloaded
Chrome Cache Entry: 86
HTML document, ASCII text
dropped
Chrome Cache Entry: 87
HTML document, ASCII text
downloaded
Chrome Cache Entry: 88
Web Open Font Format (Version 2), TrueType, length 48236, version 1.0
downloaded
Chrome Cache Entry: 89
ASCII text, with very long lines (32052)
downloaded
Chrome Cache Entry: 90
ASCII text, with no line terminators
downloaded
Chrome Cache Entry: 91
ASCII text
downloaded
Chrome Cache Entry: 92
ASCII text
dropped
Chrome Cache Entry: 93
ASCII text, with very long lines (65447)
downloaded
Chrome Cache Entry: 94
exported SGML document, ASCII text
downloaded
Chrome Cache Entry: 95
HTML document, ASCII text
downloaded
Chrome Cache Entry: 96
ASCII text, with no line terminators
downloaded
Chrome Cache Entry: 97
PNG image data, 344 x 87, 8-bit/color RGBA, non-interlaced
downloaded
Chrome Cache Entry: 98
ASCII text, with no line terminators
downloaded
Chrome Cache Entry: 99
PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced
dropped
There are 27 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2436 --field-trial-handle=2016,i,13675016939151334243,8792632575374213456,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://encrypt-na.mailanyone.net/activate?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJlbWFpbCI6ImtpbWJlcmx5Lm1vcnJpc0BtaGEub2hpby5nb3YiLCJpZCI6OTE5MjEsImFjdGl2YXRpb24iOnRydWUsImF1dGhlbnRpY2F0aW9uIjpmYWxzZSwicmVzZXQiOmZhbHNlLCJwaWQiOiIiLCJsb2dpbm1ldGhvZCI6IiIsInBpZF9jdXN0b21lcl9pZCI6MCwiZXhwIjoxNzE0MDk2MDUzLCJpYXQiOjE3MTQwNTI4NTN9.iJ_xv1cTs-3TNXS5RpqLtZ2PQidggAArhRdVa8qws9k"

URLs

Name
IP
Malicious
https://encrypt-na.mailanyone.net/activate?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJlbWFpbCI6ImtpbWJlcmx5Lm1vcnJpc0BtaGEub2hpby5nb3YiLCJpZCI6OTE5MjEsImFjdGl2YXRpb24iOnRydWUsImF1dGhlbnRpY2F0aW9uIjpmYWxzZSwicmVzZXQiOmZhbHNlLCJwaWQiOiIiLCJsb2dpbm1ldGhvZCI6IiIsInBpZF9jdXN0b21lcl9pZCI6MCwiZXhwIjoxNzE0MDk2MDUzLCJpYXQiOjE3MTQwNTI4NTN9.iJ_xv1cTs-3TNXS5RpqLtZ2PQidggAArhRdVa8qws9k
http://fontawesome.io
unknown
https://encrypt-na.mailanyone.net/signup
http://momentjs.com/guides/#/warnings/zone/
unknown
http://angular-ui.github.io/bootstrap/
unknown
https://github.com/danielhusar
unknown
https://github.com/moment/moment/issues/1423
unknown
http://docs.closure-library.googlecode.com/git/closure_goog_date_date.js.source.html
unknown
https://github.com/woolfg
unknown
http://html2canvas.hertzen.com
unknown
https://github.com/andreasgal/pdf.js
unknown
http://errors.angularjs.org/1.8.2/
unknown
https://github.com/fraywing/textAngular/wiki
unknown
https://encrypt-na.mailanyone.net/login
https://github.com/BiggA94
unknown
https://raw.github.com/danro/jquery-easing/master/LICENSE
unknown
http://momentjs.com/guides/#/warnings/add-inverted-param/
unknown
https://github.com/moment/moment/issues/2978
unknown
http://momentjs.com/guides/#/warnings/dst-shifted/
unknown
https://tools.ietf.org/html/rfc2822#section-3.3
unknown
https://stackoverflow.com/q/181348
unknown
https://ui-router.github.io/blog/uirouter-for-angularjs-umd-bundles
unknown
http://fontawesome.io/license
unknown
http://gsgd.co.uk/sandbox/jquery/easing/
unknown
https://github.com/flamenco
unknown
https://github.com/moment/moment/pull/1871
unknown
https://github.com/lsdriscoll
unknown
https://github.com/moment/moment/issues/2166
unknown
http://opensource.org/licenses/mit-license
unknown
https://encrypt-na.mailanyone.net/forgot
http://momentjs.com/guides/#/warnings/js-date/
unknown
https://github.com/niklasvh/base64-arraybuffer
unknown
http://momentjs.com/guides/#/warnings/define-locale/
unknown
http://www.opensource.org/licenses/MIT
unknown
https://github.com/dordille/moment-isoduration/blob/master/moment.isoduration.js
unknown
http://getbootstrap.com)
unknown
https://github.com/jamesbrobb
unknown
https://github.com/twbs/bootstrap/blob/master/LICENSE)
unknown
http://angularjs.org
unknown
https://github.com/ocombe/ocLazyLoad
unknown
http://www.ietf.org/rfc/rfc2109.txt
unknown
https://github.com/diegocr
unknown
https://ui-router.github.io
unknown
https://encrypt-na.mailanyone.net/activate?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJlbWFpbCI6ImtpbWJlcmx5Lm1vcnJpc0BtaGEub2hpby5nb3YiLCJpZCI6OTE5MjEsImFjdGl2YXRpb24iOnRydWUsImF1dGhlbnRpY2F0aW9uIjpmYWxzZSwicmVzZXQiOmZhbHNlLCJwaWQiOiIiLCJsb2dpbm1ldGhvZCI6IiIsInBpZF9jdXN0b21lcl9pZCI6MCwiZXhwIjoxNzE0MDk2MDUzLCJpYXQiOjE3MTQwNTI4NTN9.iJ_xv1cTs-3TNXS5RpqLtZ2PQidggAArhRdVa8qws9k
https://github.com/juanpgaviria
unknown
https://nodejs.org/dist/latest/docs/api/util.html#util_custom_inspect_function_on_objects
unknown
http://momentjs.com/guides/#/warnings/min-max/
unknown
https://github.com/gildas-lormeau/zip.js
unknown
There are 37 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
bg.microsoft.map.fastly.net
199.232.214.172
www.google.com
172.217.215.104
fp2e7a.wpc.phicdn.net
192.229.211.108
encrypt-na.mailanyone.net
unknown

IPs

IP
Domain
Country
Malicious
172.217.215.104
www.google.com
United States
192.168.2.4
unknown
unknown
192.168.2.5
unknown
unknown
239.255.255.250
unknown
Reserved

DOM / HTML

URL
Malicious
https://encrypt-na.mailanyone.net/activate?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJlbWFpbCI6ImtpbWJlcmx5Lm1vcnJpc0BtaGEub2hpby5nb3YiLCJpZCI6OTE5MjEsImFjdGl2YXRpb24iOnRydWUsImF1dGhlbnRpY2F0aW9uIjpmYWxzZSwicmVzZXQiOmZhbHNlLCJwaWQiOiIiLCJsb2dpbm1ldGhvZCI6IiIsInBpZF9jdXN0b21lcl9pZCI6MCwiZXhwIjoxNzE0MDk2MDUzLCJpYXQiOjE3MTQwNTI4NTN9.iJ_xv1cTs-3TNXS5RpqLtZ2PQidggAArhRdVa8qws9k
https://encrypt-na.mailanyone.net/activate?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJlbWFpbCI6ImtpbWJlcmx5Lm1vcnJpc0BtaGEub2hpby5nb3YiLCJpZCI6OTE5MjEsImFjdGl2YXRpb24iOnRydWUsImF1dGhlbnRpY2F0aW9uIjpmYWxzZSwicmVzZXQiOmZhbHNlLCJwaWQiOiIiLCJsb2dpbm1ldGhvZCI6IiIsInBpZF9jdXN0b21lcl9pZCI6MCwiZXhwIjoxNzE0MDk2MDUzLCJpYXQiOjE3MTQwNTI4NTN9.iJ_xv1cTs-3TNXS5RpqLtZ2PQidggAArhRdVa8qws9k
https://encrypt-na.mailanyone.net/login
https://encrypt-na.mailanyone.net/login
https://encrypt-na.mailanyone.net/login
https://encrypt-na.mailanyone.net/login
https://encrypt-na.mailanyone.net/login
https://encrypt-na.mailanyone.net/signup
https://encrypt-na.mailanyone.net/signup
https://encrypt-na.mailanyone.net/forgot
https://encrypt-na.mailanyone.net/forgot
There are 1 hidden doms, click here to show them.