IOC Report
https://in.xero.com/Kw5EivBbP7cI8mUewaIbiEH2de2DrArU8XaI2H1t

loading gif

Files

File Path
Type
Category
Malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 14:34:39 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 14:34:39 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 09:23:19 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 14:34:39 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 14:34:39 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 14:34:38 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
dropped
C:\Users\user\Downloads\75ff2734-d7c5-43d9-b1cd-c1b3dadcf477.tmp
PDF document, version 1.7, 0 pages (zip deflate encoded)
dropped
C:\Users\user\Downloads\Invoice INV-0003.pdf (copy)
PDF document, version 1.7, 0 pages (zip deflate encoded)
dropped
C:\Users\user\Downloads\Invoice INV-0003.pdf.crdownload
PDF document, version 1.7, 0 pages (zip deflate encoded)
dropped
Chrome Cache Entry: 102
gzip compressed data, from Unix, original size modulo 2^32 6952
downloaded
Chrome Cache Entry: 103
RIFF (little-endian) data, Web/P image
downloaded
Chrome Cache Entry: 104
GIF image data, version 89a, 1 x 1
dropped
Chrome Cache Entry: 105
gzip compressed data, from Unix, original size modulo 2^32 209926
downloaded
Chrome Cache Entry: 106
MS Windows icon resource - 4 icons, 64x64, 32 bits/pixel, 32x32, 32 bits/pixel
downloaded
Chrome Cache Entry: 107
ASCII text, with no line terminators
downloaded
Chrome Cache Entry: 109
gzip compressed data, from Unix, original size modulo 2^32 493458
downloaded
Chrome Cache Entry: 110
ASCII text, with very long lines (65536), with no line terminators
downloaded
Chrome Cache Entry: 111
JSON data
dropped
Chrome Cache Entry: 112
ASCII text, with very long lines (36028), with no line terminators
downloaded
Chrome Cache Entry: 113
Unicode text, UTF-8 text, with very long lines (65535), with no line terminators
downloaded
Chrome Cache Entry: 114
gzip compressed data, from Unix, original size modulo 2^32 35428
downloaded
Chrome Cache Entry: 115
ASCII text, with very long lines (407), with no line terminators
downloaded
Chrome Cache Entry: 116
ASCII text, with very long lines (65453)
downloaded
Chrome Cache Entry: 117
HTML document, ASCII text, with very long lines (30711)
downloaded
Chrome Cache Entry: 118
ASCII text, with very long lines (20730), with no line terminators
downloaded
Chrome Cache Entry: 119
ASCII text, with no line terminators
downloaded
Chrome Cache Entry: 120
PNG image data, 16 x 16, 8-bit colormap, non-interlaced
dropped
Chrome Cache Entry: 124
ASCII text, with very long lines (65536), with no line terminators
downloaded
Chrome Cache Entry: 125
PNG image data, 729 x 733, 8-bit colormap, non-interlaced
dropped
Chrome Cache Entry: 127
ASCII text, with very long lines (583), with no line terminators
downloaded
Chrome Cache Entry: 128
ASCII text, with very long lines (34055), with no line terminators
downloaded
Chrome Cache Entry: 129
gzip compressed data, from Unix, original size modulo 2^32 13268
downloaded
Chrome Cache Entry: 131
ASCII text, with very long lines (26008), with no line terminators
downloaded
Chrome Cache Entry: 133
ASCII text, with very long lines (65441)
downloaded
Chrome Cache Entry: 134
ASCII text, with very long lines (27878), with no line terminators
downloaded
Chrome Cache Entry: 135
gzip compressed data, from Unix, original size modulo 2^32 528370
downloaded
Chrome Cache Entry: 136
ASCII text, with very long lines (32010)
downloaded
Chrome Cache Entry: 137
gzip compressed data, from Unix, original size modulo 2^32 705897
downloaded
Chrome Cache Entry: 94
ASCII text, with very long lines (945)
downloaded
Chrome Cache Entry: 95
JSON data
dropped
Chrome Cache Entry: 96
ASCII text, with very long lines (4706)
downloaded
Chrome Cache Entry: 98
ASCII text, with very long lines (630)
downloaded
Chrome Cache Entry: 99
ASCII text, with very long lines (4310), with no line terminators
downloaded
There are 34 hidden files, click here to show them.

URLs

Name
IP
Malicious
https://in.xero.com/Kw5EivBbP7cI8mUewaIbiEH2de2DrArU8XaI2H1t
https://in.xero.com/m/Kw5EivBbP7cI8mUewaIbiEH2de2DrArU8XaI2H1t
about:blank
file:///C:/Users/user/Downloads/Invoice%20INV-0003.pdf

Domains

Name
IP
Malicious
fastly-tls12-bam.nr-data.net
162.247.243.29
widget.intercom.io
13.32.87.112
js-agent.newrelic.com
162.247.243.39
www.google.com
142.250.64.196
api-iam.intercom.io
44.214.72.116
nexus-websocket-a.intercom.io
35.174.127.31
js.intercomcdn.com
13.226.52.91
in.xero.com
unknown
edge.xero.com
unknown
www.xero.com
unknown
bam.nr-data.net
unknown
product-analytics-bff.xero.com
unknown
There are 2 hidden domains, click here to show them.

IPs

IP
Domain
Country
Malicious
142.250.189.142
unknown
United States
172.253.123.84
unknown
United States
44.214.72.116
api-iam.intercom.io
United States
1.1.1.1
unknown
Australia
192.178.50.46
unknown
United States
34.199.118.93
unknown
United States
184.84.137.134
unknown
United States
13.226.52.91
js.intercomcdn.com
United States
192.168.2.18
unknown
unknown
13.32.87.112
widget.intercom.io
United States
35.174.127.31
nexus-websocket-a.intercom.io
United States
142.250.64.195
unknown
United States
172.217.15.202
unknown
United States
34.237.73.95
unknown
United States
142.250.64.196
www.google.com
United States
239.255.255.250
unknown
Reserved
184.84.136.204
unknown
United States
162.247.243.29
fastly-tls12-bam.nr-data.net
United States
162.247.243.39
js-agent.newrelic.com
United States
142.250.217.195
unknown
United States
23.34.204.146
unknown
United States
There are 11 hidden IPs, click here to show them.