Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command
line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 10:20:54 2024, atime=Wed Sep 27 04:28:28
2023, length=1210144, window=hide
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command
line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 10:20:54 2024, atime=Wed Sep 27 04:28:28
2023, length=1210144, window=hide
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command
line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28
2023, length=1210144, window=hide
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command
line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 10:20:54 2024, atime=Wed Sep 27 04:28:28
2023, length=1210144, window=hide
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command
line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 10:20:54 2024, atime=Wed Sep 27 04:28:28
2023, length=1210144, window=hide
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command
line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 10:20:54 2024, atime=Wed Sep 27 04:28:28
2023, length=1210144, window=hide
|
dropped
|
||
|
Chrome Cache Entry: 100
|
PNG image data, 216 x 46, 8-bit/color RGBA, non-interlaced
|
dropped
|
||
|
Chrome Cache Entry: 101
|
PNG image data, 342 x 72, 8-bit/color RGBA, non-interlaced
|
dropped
|
||
|
Chrome Cache Entry: 102
|
HTML document, ASCII text, with very long lines (364), with no line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 103
|
ASCII text, with very long lines (32047)
|
downloaded
|
||
|
Chrome Cache Entry: 104
|
ASCII text, with very long lines (32047)
|
downloaded
|
||
|
Chrome Cache Entry: 105
|
Web Open Font Format, TrueType, length 2576, version 1.0
|
downloaded
|
||
|
Chrome Cache Entry: 106
|
ASCII text, with very long lines (1245), with no line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 107
|
JPEG image data, baseline, precision 8, 1920x1080, components 3
|
downloaded
|
||
|
Chrome Cache Entry: 108
|
MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
|
downloaded
|
||
|
Chrome Cache Entry: 109
|
JPEG image data, baseline, precision 8, 1920x1080, components 3
|
dropped
|
||
|
Chrome Cache Entry: 110
|
HTML document, ASCII text, with very long lines (2345), with CRLF line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 111
|
ASCII text, with very long lines (31463), with no line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 112
|
Web Open Font Format, TrueType, length 41280, version 0.0
|
downloaded
|
||
|
Chrome Cache Entry: 113
|
Web Open Font Format, TrueType, length 41280, version 0.0
|
downloaded
|
||
|
Chrome Cache Entry: 114
|
ASCII text, with very long lines (42133)
|
downloaded
|
||
|
Chrome Cache Entry: 115
|
ASCII text, with very long lines (1245), with no line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 116
|
Unicode text, UTF-8 (with BOM) text, with very long lines (65339), with CRLF line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 117
|
ASCII text, with very long lines (45537)
|
downloaded
|
||
|
Chrome Cache Entry: 118
|
Unicode text, UTF-8 text, with very long lines (64241)
|
downloaded
|
||
|
Chrome Cache Entry: 119
|
ASCII text, with no line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 120
|
ASCII text, with very long lines (32089)
|
downloaded
|
||
|
Chrome Cache Entry: 121
|
Web Open Font Format, TrueType, length 35900, version 0.0
|
downloaded
|
||
|
Chrome Cache Entry: 122
|
ASCII text
|
downloaded
|
||
|
Chrome Cache Entry: 123
|
MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
|
downloaded
|
||
|
Chrome Cache Entry: 124
|
ASCII text, with very long lines (994), with no line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 125
|
MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
|
downloaded
|
||
|
Chrome Cache Entry: 126
|
JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data,
big-endian, direntries=4, xresolution=62, yresolution=70, resolutionunit=2, software=paint.net 4.2.9], baseline, precision
8, 50x28, components 3
|
dropped
|
||
|
Chrome Cache Entry: 127
|
Unicode text, UTF-8 text, with very long lines (65520), with no line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 128
|
MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
|
dropped
|
||
|
Chrome Cache Entry: 129
|
ASCII text, with no line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 130
|
PNG image data, 600 x 1, 8-bit/color RGBA, non-interlaced
|
downloaded
|
||
|
Chrome Cache Entry: 131
|
ASCII text, with very long lines (31463), with no line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 132
|
Unicode text, UTF-8 (with BOM) text, with very long lines (65339), with CRLF line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 133
|
ASCII text, with very long lines (42133)
|
downloaded
|
||
|
Chrome Cache Entry: 134
|
Web Open Font Format, TrueType, length 33556, version 0.0
|
downloaded
|
||
|
Chrome Cache Entry: 135
|
ASCII text, with very long lines (402)
|
downloaded
|
||
|
Chrome Cache Entry: 136
|
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113084
|
downloaded
|
||
|
Chrome Cache Entry: 137
|
PNG image data, 216 x 46, 8-bit/color RGBA, non-interlaced
|
downloaded
|
||
|
Chrome Cache Entry: 138
|
MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
|
dropped
|
||
|
Chrome Cache Entry: 139
|
PNG image data, 342 x 72, 8-bit/color RGBA, non-interlaced
|
downloaded
|
||
|
Chrome Cache Entry: 140
|
Unicode text, UTF-8 (with BOM) text, with very long lines (65339), with CRLF line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 141
|
Unicode text, UTF-8 (with BOM) text, with very long lines (59783), with CRLF line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 142
|
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592
|
dropped
|
||
|
Chrome Cache Entry: 143
|
Web Open Font Format, TrueType, length 33556, version 0.0
|
downloaded
|
||
|
Chrome Cache Entry: 144
|
Unicode text, UTF-8 text, with very long lines (64241)
|
downloaded
|
||
|
Chrome Cache Entry: 145
|
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
|
dropped
|
||
|
Chrome Cache Entry: 146
|
ASCII text, with very long lines (32089)
|
downloaded
|
||
|
Chrome Cache Entry: 147
|
ASCII text, with very long lines (65536), with no line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 148
|
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
|
downloaded
|
||
|
Chrome Cache Entry: 149
|
Unicode text, UTF-8 text, with very long lines (65520), with no line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 150
|
HTML document, ASCII text
|
downloaded
|
||
|
Chrome Cache Entry: 151
|
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592
|
downloaded
|
||
|
Chrome Cache Entry: 152
|
PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
|
downloaded
|
||
|
Chrome Cache Entry: 153
|
JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data,
big-endian, direntries=4, xresolution=62, yresolution=70, resolutionunit=2, software=paint.net 4.2.9], baseline, precision
8, 50x28, components 3
|
downloaded
|
||
|
Chrome Cache Entry: 154
|
ASCII text, with very long lines (402)
|
downloaded
|
||
|
Chrome Cache Entry: 155
|
PNG image data, 216 x 46, 8-bit/color RGBA, non-interlaced
|
downloaded
|
||
|
Chrome Cache Entry: 156
|
PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
|
dropped
|
There are 54 hidden files, click here to show them.
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Program Files\Google\Chrome\Application\chrome.exe
|
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
|
||
|
C:\Program Files\Google\Chrome\Application\chrome.exe
|
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US
--service-sandbox-type=none --mojo-platform-channel-handle=2508 --field-trial-handle=2320,i,14859274825714643939,18036656266381728292,262144
--disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction
/prefetch:8
|
||
|
C:\Program Files\Google\Chrome\Application\chrome.exe
|
"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://click.pstmrk.it/3s/t.co%2FRieqFTtqmt/gMTC/7_W0AQ/AQ/880c85de-cc11-4181-9f68-0f08d9f1e222/1/rCUNy3Yffz"
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
https://click.pstmrk.it/3s/t.co%2FRieqFTtqmt/gMTC/7_W0AQ/AQ/880c85de-cc11-4181-9f68-0f08d9f1e222/1/rCUNy3Yffz
|
 |
||
|
https://r6duftx9uh6.scrdata-doc.cfd/owa/
|
|
||
|
https://click.pstmrk.it/3s/t.co%2FRieqFTtqmt/gMTC/7_W0AQ/AQ/880c85de-cc11-4181-9f68-0f08d9f1e222/1/rCUNy3Yffz
|
3.136.74.202
|
|
|
|
http://github.com/jquery/globalize
|
unknown
|
||
|
https://login.microsoftonline.com
|
unknown
|
||
|
http://www.opensource.org/licenses/mit-license.php)
|
unknown
|
||
|
https://outlook.office365.com/owa/prefetch.aspx
|
|||
|
https://r6duftx9uh6.scrdata-doc.cfd/?dataXX0=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1cmwiOiJodHRwczovL3I2ZHVmdHg5dWg2LnNjcmRhdGEtZG9jLmNmZCIsImRvbWFpbiI6InI2ZHVmdHg5dWg2LnNjcmRhdGEtZG9jLmNmZCIsImtleSI6IjRhUlJNTmdRUTQ4RyIsInFyYyI6bnVsbCwiaWF0IjoxNzE0MTMwNDY0LCJleHAiOjE3MTQxMzA1ODR9.H5RlzzQftBFmXt14y-ibpfKcNBoPeazRovF59Sczzxc
|
2.58.15.240
|
||
|
https://r6duftx9uh6.scrdata-doc.cfd/favicon.ico
|
2.58.15.240
|
||
|
http://knockoutjs.com/
|
unknown
|
||
|
https://github.com/h5bp/html5-boilerplate/blob/master/src/css/main.css
|
unknown
|
||
|
https://github.com/douglascrockford/JSON-js
|
unknown
|
||
|
https://login.windows-ppe.net
|
unknown
|
||
|
https://t.co/RieqFTtqmt
|
104.244.42.197
|
||
|
https://secur-doc.online/?hjhmxbor&qrc=
|
2.58.15.240
|
||
|
https://r6duftx9uh6.scrdata-doc.cfd/
|
2.58.15.240
|
||
|
https://js.monitor.azure.com/scripts/c/ms.analytics-web-2.min.js
|
unknown
|
||
|
https://r6duftx9uh6.scrdata-doc.cfd/aadcdn.msftauth.net/~/shared/1.0/content/js/BssoInterrupt_Core_Ggyc2EJnCaHFrI6xkBPLcg2.js
|
2.58.15.240
|
||
|
http://github.com/requirejs/almond/LICENSE
|
unknown
|
||
|
http://www.json.org/json2.js
|
unknown
|
||
|
https://wordpressprofissional.com.br/wp-content/OxZU0e8fGTHt7NTfrafq/
|
31.170.163.25
|
There are 10 hidden URLs, click here to show them.
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
t.co
|
104.244.42.197
|
||
|
cs1100.wpc.omegacdn.net
|
152.199.4.44
|
||
|
wordpressprofissional.com.br
|
31.170.163.25
|
||
|
www.google.com
|
142.250.64.196
|
||
|
click.pstmrk.it
|
3.136.74.202
|
||
|
r6duftx9uh6.scrdata-doc.cfd
|
2.58.15.240
|
||
|
part-0012.t-0009.t-msedge.net
|
13.107.246.40
|
||
|
fp2e7a.wpc.phicdn.net
|
192.229.211.108
|
||
|
secur-doc.online
|
2.58.15.240
|
||
|
LYH-efz.ms-acdc.office.com
|
52.96.28.178
|
||
|
r4.res.office365.com
|
unknown
|
||
|
aadcdn.msftauth.net
|
unknown
|
||
|
assets.onestore.ms
|
unknown
|
||
|
i.s-microsoft.com
|
unknown
|
||
|
ajax.aspnetcdn.com
|
unknown
|
||
|
outlook.office365.com
|
unknown
|
||
|
c.s-microsoft.com
|
unknown
|
There are 7 hidden domains, click here to show them.
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
13.107.246.40
|
part-0012.t-0009.t-msedge.net
|
United States
|
||
|
31.170.163.25
|
wordpressprofissional.com.br
|
United States
|
||
|
3.136.74.202
|
click.pstmrk.it
|
United States
|
||
|
192.168.2.5
|
unknown
|
unknown
|
||
|
2.58.15.240
|
r6duftx9uh6.scrdata-doc.cfd
|
Czech Republic
|
||
|
104.244.42.197
|
t.co
|
United States
|
||
|
142.250.64.196
|
www.google.com
|
United States
|
||
|
239.255.255.250
|
unknown
|
Reserved
|
||
|
52.96.28.178
|
LYH-efz.ms-acdc.office.com
|
United States
|
DOM / HTML
|
URL
|
Malicious
|
|
|---|---|---|
|
https://r6duftx9uh6.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9NDdmOThkZTktYTQyMS02ODlhLTczZjAtZGQyNGViMTUxMzQxJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzI3MjY4MjI1NzEzNC5hMzYxOTAyMS0xNWZjLTRiOTktOWY0ZS04YWJmMmQzMTM1YTImc3RhdGU9RGNzN0ZvQWdEQUJCME9keEl1UURJY2NKS3EybDF6ZkZiTGM1cGJTSExlUWFTZHA1aUNrcDlVSFVGRmxPNTQ1V0NRSGJ1a0NtR2RpU0I0YlBSVGNqTjZjYzcxSGV6OHNQ
|
|
|
|
https://r6duftx9uh6.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9NDdmOThkZTktYTQyMS02ODlhLTczZjAtZGQyNGViMTUxMzQxJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzI3MjY4MjI1NzEzNC5hMzYxOTAyMS0xNWZjLTRiOTktOWY0ZS04YWJmMmQzMTM1YTImc3RhdGU9RGNzN0ZvQWdEQUJCME9keEl1UURJY2NKS3EybDF6ZkZiTGM1cGJTSExlUWFTZHA1aUNrcDlVSFVGRmxPNTQ1V0NRSGJ1a0NtR2RpU0I0YlBSVGNqTjZjYzcxSGV6OHNQ&sso_reload=true
|
|
|
|
https://r6duftx9uh6.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9NDdmOThkZTktYTQyMS02ODlhLTczZjAtZGQyNGViMTUxMzQxJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzI3MjY4MjI1NzEzNC5hMzYxOTAyMS0xNWZjLTRiOTktOWY0ZS04YWJmMmQzMTM1YTImc3RhdGU9RGNzN0ZvQWdEQUJCME9keEl1UURJY2NKS3EybDF6ZkZiTGM1cGJTSExlUWFTZHA1aUNrcDlVSFVGRmxPNTQ1V0NRSGJ1a0NtR2RpU0I0YlBSVGNqTjZjYzcxSGV6OHNQ&sso_reload=true
|
|
|
|
https://outlook.office365.com/owa/prefetch.aspx
|
||
|
https://outlook.office365.com/owa/prefetch.aspx
|
||
|
https://outlook.office365.com/owa/prefetch.aspx
|
||
|
https://outlook.office365.com/owa/prefetch.aspx
|
||
|
https://r6duftx9uh6.scrdata-doc.cfd/owa/
|
||
|
https://privacy.microsoft.com/en-US/updates
|