IOC Report
https://equifax.secure.virtru.com/start/?c=experiment&t=emailtemplate2019-09&s=WFADevOps%40equifax.com&p=ad830fe6-1ef5-467e-8767-71b894c7a923#v=3.0.0&d=https%3A%2F%2Fapi.virtru.com%2Fstorage%2Fapi%2Fpolicies%2Fad830fe6-1ef5-467e-8767-71b894c7a923%2Fdata%2Fmetadata&dk=zj5sd1RYE7oBWsww99m8Ub9Z49b3tl8d

loading gif

Files

File Path
Type
Category
Malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 18:49:27 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 18:49:27 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 18:49:27 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 18:49:27 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 18:49:27 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
Chrome Cache Entry: 70
ASCII text, with very long lines (29186)
downloaded
Chrome Cache Entry: 71
ASCII text, with no line terminators
dropped
Chrome Cache Entry: 72
ASCII text, with very long lines (54527), with no line terminators
downloaded
Chrome Cache Entry: 74
ASCII text, with very long lines (3671)
downloaded
Chrome Cache Entry: 75
PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced
dropped
Chrome Cache Entry: 76
Web Open Font Format (Version 2), TrueType, length 29496, version 3.0
downloaded
Chrome Cache Entry: 78
Web Open Font Format (Version 2), TrueType, length 18520, version 1.6619
downloaded
Chrome Cache Entry: 79
SVG Scalable Vector Graphics image
dropped
Chrome Cache Entry: 80
ASCII text, with very long lines (507)
downloaded
Chrome Cache Entry: 82
data
dropped
Chrome Cache Entry: 83
Web Open Font Format (Version 2), TrueType, length 17780, version 1.0
downloaded
Chrome Cache Entry: 84
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
downloaded
Chrome Cache Entry: 87
Web Open Font Format (Version 2), TrueType, length 29500, version 1.0
downloaded
Chrome Cache Entry: 88
ASCII text, with very long lines (2410), with no line terminators
downloaded
Chrome Cache Entry: 90
ASCII text, with very long lines (19783)
downloaded
Chrome Cache Entry: 92
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 93
Unicode text, UTF-8 text, with very long lines (65470)
downloaded
Chrome Cache Entry: 94
MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
downloaded
Chrome Cache Entry: 95
Unicode text, UTF-8 text, with very long lines (28162), with no line terminators
downloaded
There are 16 hidden files, click here to show them.

URLs

Name
IP
Malicious
https://equifax.secure.virtru.com/start/?c=experiment&t=emailtemplate2019-09&s=WFADevOps%40equifax.com&p=ad830fe6-1ef5-467e-8767-71b894c7a923#v=3.0.0&d=https%3A%2F%2Fapi.virtru.com%2Fstorage%2Fapi%2Fpolicies%2Fad830fe6-1ef5-467e-8767-71b894c7a923%2Fdata%2Fmetadata&dk=zj5sd1RYE7oBWsww99m8Ub9Z49b3tl8dYxvfG%2BC1tHs%3D
https://equifax.secure.virtru.com/secure-reader/initial-loader

Domains

Name
IP
Malicious
api-gcp.virtru.com
130.211.46.139
alb-logs-http-rum-pub-s0-1171131448.us-east-1.elb.amazonaws.com
3.233.153.122
static-gcp.virtru.com
34.160.98.162
api.amplitude.com
52.32.35.160
www.google.com
64.233.177.103
equifax.secure.virtru.com
unknown
rum.browser-intake-datadoghq.com
unknown
api.virtru.com
unknown

IPs

IP
Domain
Country
Malicious
34.160.98.162
static-gcp.virtru.com
United States
192.168.2.16
unknown
unknown
3.233.153.122
alb-logs-http-rum-pub-s0-1171131448.us-east-1.elb.amazonaws.com
United States
142.250.105.138
unknown
United States
130.211.46.139
api-gcp.virtru.com
United States
44.239.44.141
unknown
United States
239.255.255.250
unknown
Reserved
64.233.177.103
www.google.com
United States
142.251.15.84
unknown
United States
142.250.9.94
unknown
United States
52.32.35.160
api.amplitude.com
United States
74.125.138.94
unknown
United States
There are 2 hidden IPs, click here to show them.