Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

Quote.docx

Microsoft OOXML

initial sample

C:\Users\user\AppData\Local\Google\Chrome\User Data\0c55f142-0e65-40d4-857b-164eafaca13a.tmp

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\42708ec6-443f-42aa-8f62-c801c4397428.tmp

ASCII text, with very long lines, with no line terminators

modified

C:\Users\user\AppData\Local\Google\Chrome\User Data\780f50d1-5da0-4c85-9301-5af79b03050f.tmp

ASCII text, with very long lines, with no line terminators

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\983734c8-442f-4035-b2d5-643a90e66f70.tmp

ASCII text, with very long lines, with no line terminators

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\2e5e65cf-3141-444f-991b-ee596ecf32c0.tmp

UTF-8 Unicode text, with very long lines, with no line terminators

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\2f4d64c3-0d99-4e7c-9fc3-7616834c1505.tmp

very short file (no magic)

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\324c5fd2-9b59-4efc-bd72-db915a3ed90c.tmp

ASCII text, with very long lines, with no line terminators

modified

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\336a90d0-6d00-4614-b81d-dbe8df6c44ba.tmp

ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\461bedee-acac-4bd4-9261-fa41b4943a1e.tmp

ASCII text, with very long lines, with no line terminators

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\47c00316-08f7-465e-9c35-2829b6b74d79.tmp

UTF-8 Unicode text, with very long lines, with no line terminators

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\988c98ae-eafe-4f67-9087-2b0fff461e2b.tmp

ASCII text, with very long lines, with no line terminators

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata\computed_hashes.json

ASCII text, with very long lines, with no line terminators

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\8520.615.0.5_0\_metadata\computed_hashes.json

ASCII text, with very long lines, with no line terminators

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\000003.log

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG.old (copy)

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Provider Cache

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network Persistent State (copy)

ASCII text, with very long lines, with no line terminators

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences (copy)

ASCII text, with very long lines, with no line terminators

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences (copy)

UTF-8 Unicode text, with very long lines, with no line terminators

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\29f2e5b7-b503-4a52-ba78-410e234ece76.tmp

ASCII text, with no line terminators

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Code Cache\js\index

ISO-8859 text, with no line terminators, with escape sequences

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Code Cache\js\index-dir\temp-index

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Code Cache\js\index-dir\the-real-index (copy)

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Code Cache\wasm\index

ISO-8859 text, with no line terminators, with escape sequences

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Code Cache\wasm\index-dir\temp-index

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Code Cache\wasm\index-dir\the-real-index (copy)

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\GPUCache\data_0

FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\GPUCache\data_1

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\GPUCache\data_2

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\GPUCache\data_3

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\GPUCache\index

FoxPro FPT, blocks size 512, next free block index 3284796353, field type 0

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Local Storage\leveldb\000001.dbtmp

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Local Storage\leveldb\CURRENT (copy)

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Local Storage\leveldb\MANIFEST-000001

PGP\011Secret Key -

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Network Persistent State (copy)

ASCII text, with no line terminators

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Platform Notifications\000001.dbtmp

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Platform Notifications\CURRENT (copy)

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Platform Notifications\MANIFEST-000001

PGP\011Secret Key -

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Session Storage\000001.dbtmp

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Session Storage\CURRENT (copy)

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Session Storage\MANIFEST-000001

PGP\011Secret Key -

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\fd35767f-84ae-4fa8-9c32-30dd2a65fbb1.tmp

ASCII text, with no line terminators

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\TransportSecurity (copy)

ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\a22706c9-1ed7-420a-aa97-38d4166dc01a.tmp

ASCII text, with very long lines, with no line terminators

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\addccecd-8da7-4b0e-90e0-13d5c87a6b5a.tmp

ASCII text, with very long lines, with no line terminators

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\b1985f12-51b9-4f7b-b5c8-5563a7aaef6c.tmp

UTF-8 Unicode text, with very long lines, with no line terminators

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\c0b78608-02bd-47a6-a8c0-e660a08f896a.tmp

ASCII text, with very long lines, with no line terminators

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\ca2caf34-cc1f-44ce-9f58-912c4f49e60a.tmp

ASCII text, with very long lines, with no line terminators

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\d632a682-52ea-454c-a5b5-b31f2a026a71.tmp

UTF-8 Unicode text, with very long lines, with no line terminators

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000008.dbtmp

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\CURRENT (copy)

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\e17feb97-827b-4868-bf99-3eec46429783.tmp

ASCII text, with very long lines, with no line terminators

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Last Browser

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Last Version

ASCII text, with no line terminators

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State (copy)

ASCII text, with very long lines, with no line terminators

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Module Info Cache (copy)

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_1

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\ae129922-354b-479c-82af-b8152a1fc67d.tmp

ASCII text, with very long lines, with no line terminators

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\aef8f571-0071-4a84-8989-4768cc933b8f.tmp

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\d09f5bcd-5a17-4d7d-b576-77321f90dd4c.tmp

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\f0158de1-dd75-4774-8985-4d084ab0f370.tmp

ASCII text, with very long lines, with no line terminators

dropped

C:\Users\user\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-CNRY.FSD

data

dropped

C:\Users\user\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-{3F60BB7A-400C-4585-8C05-39E1CA9BF9D8}.FSD

data

dropped

C:\Users\user\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSF-CTBL.FSF

data

dropped

C:\Users\user\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSD

data

dropped

C:\Users\user\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-{7F0DD477-4BC5-4595-AB07-1BAC0E7BC339}.FSD

data

dropped

C:\Users\user\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSF-{0E1EEE64-E8C6-4E2A-9759-63CF07FD8988}.FSF

data

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\3A1A009F.jpeg

JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 337x150, frames 3

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\5004FCFD.wmf

Targa image data - Map - RLE 142 x 65536 x 0 +8 "\004"

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{651978B4-4A43-457C-A7AD-2D669B25A072}.tmp

Composite Document File V2 Document, Cannot read section info

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{1020FCC3-ABBD-4B9A-9F3F-9D2AD4D8E8F1}.tmp

data

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{A99EA44A-DACF-46CE-8CD4-E40B0EE13B56}.tmp

data

dropped

C:\Users\user\AppData\Local\Temp\29a6a4f2-fc37-4ab9-a5e8-4ccdeb19f64f.tmp

very short file (no magic)

dropped

C:\Users\user\AppData\Local\Temp\6b3a6152-3efe-4be4-990f-78ea35319cc7.tmp

Google Chrome extension, version 3

dropped

C:\Users\user\AppData\Local\Temp\b522298f-573b-457a-90dd-3c8d51dfbc87.tmp

very short file (no magic)

dropped

C:\Users\user\AppData\Local\Temp\dccc7939-f97e-49ad-96c6-ac7c7a560f9a.tmp

Google Chrome extension, version 3

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_1294151567\6b3a6152-3efe-4be4-990f-78ea35319cc7.tmp

Google Chrome extension, version 3

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_1294151567\CRX_INSTALL\_locales\bg\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_1294151567\CRX_INSTALL\_locales\ca\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_1294151567\CRX_INSTALL\_locales\cs\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_1294151567\CRX_INSTALL\_locales\da\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_1294151567\CRX_INSTALL\_locales\de\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_1294151567\CRX_INSTALL\_locales\el\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_1294151567\CRX_INSTALL\_locales\en\messages.json

ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_1294151567\CRX_INSTALL\_locales\en_GB\messages.json

ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_1294151567\CRX_INSTALL\_locales\es\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_1294151567\CRX_INSTALL\_locales\es_419\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_1294151567\CRX_INSTALL\_locales\et\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_1294151567\CRX_INSTALL\_locales\fi\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_1294151567\CRX_INSTALL\_locales\fil\messages.json

ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_1294151567\CRX_INSTALL\_locales\fr\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_1294151567\CRX_INSTALL\_locales\hi\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_1294151567\CRX_INSTALL\_locales\hr\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_1294151567\CRX_INSTALL\_locales\hu\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_1294151567\CRX_INSTALL\_locales\id\messages.json

ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_1294151567\CRX_INSTALL\_locales\it\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_1294151567\CRX_INSTALL\_locales\ja\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_1294151567\CRX_INSTALL\_locales\ko\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_1294151567\CRX_INSTALL\_locales\lt\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_1294151567\CRX_INSTALL\_locales\lv\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_1294151567\CRX_INSTALL\_locales\nb\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_1294151567\CRX_INSTALL\_locales\nl\messages.json

ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_1294151567\CRX_INSTALL\_locales\pl\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_1294151567\CRX_INSTALL\_locales\pt_BR\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_1294151567\CRX_INSTALL\_locales\pt_PT\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_1294151567\CRX_INSTALL\_locales\ro\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_1294151567\CRX_INSTALL\_locales\ru\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_1294151567\CRX_INSTALL\_locales\sk\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_1294151567\CRX_INSTALL\_locales\sl\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_1294151567\CRX_INSTALL\_locales\sr\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_1294151567\CRX_INSTALL\_locales\sv\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_1294151567\CRX_INSTALL\_locales\th\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_1294151567\CRX_INSTALL\_locales\tr\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_1294151567\CRX_INSTALL\_locales\uk\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_1294151567\CRX_INSTALL\_locales\vi\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_1294151567\CRX_INSTALL\_locales\zh_CN\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_1294151567\CRX_INSTALL\_locales\zh_TW\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_1294151567\CRX_INSTALL\_metadata\verified_contents.json

ASCII text, with very long lines, with no line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_1294151567\CRX_INSTALL\craw_background.js

ASCII text, with very long lines

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_1294151567\CRX_INSTALL\craw_window.js

ASCII text, with very long lines

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_1294151567\CRX_INSTALL\css\craw_window.css

ASCII text

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_1294151567\CRX_INSTALL\html\craw_window.html

HTML document, ASCII text

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_1294151567\CRX_INSTALL\images\flapper.gif

GIF image data, version 89a, 30 x 30

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_1294151567\CRX_INSTALL\images\icon_128.png

PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_1294151567\CRX_INSTALL\images\icon_16.png

PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_1294151567\CRX_INSTALL\images\topbar_floating_button.png

PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_1294151567\CRX_INSTALL\images\topbar_floating_button_close.png

PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_1294151567\CRX_INSTALL\images\topbar_floating_button_hover.png

PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_1294151567\CRX_INSTALL\images\topbar_floating_button_maximize.png

PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_1294151567\CRX_INSTALL\images\topbar_floating_button_pressed.png

PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_1294151567\CRX_INSTALL\manifest.json

ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_275637972\CRX_INSTALL\_locales\am\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_275637972\CRX_INSTALL\_locales\ar\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_275637972\CRX_INSTALL\_locales\bg\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_275637972\CRX_INSTALL\_locales\bn\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_275637972\CRX_INSTALL\_locales\ca\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_275637972\CRX_INSTALL\_locales\cs\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_275637972\CRX_INSTALL\_locales\da\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_275637972\CRX_INSTALL\_locales\de\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_275637972\CRX_INSTALL\_locales\el\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_275637972\CRX_INSTALL\_locales\en\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_275637972\CRX_INSTALL\_locales\es\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_275637972\CRX_INSTALL\_locales\et\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_275637972\CRX_INSTALL\_locales\fa\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_275637972\CRX_INSTALL\_locales\fi\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_275637972\CRX_INSTALL\_locales\fil\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_275637972\CRX_INSTALL\_locales\fr\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_275637972\CRX_INSTALL\_locales\gu\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_275637972\CRX_INSTALL\_locales\hi\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_275637972\CRX_INSTALL\_locales\hr\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_275637972\CRX_INSTALL\_locales\hu\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_275637972\CRX_INSTALL\_locales\id\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_275637972\CRX_INSTALL\_locales\it\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_275637972\CRX_INSTALL\_locales\iw\messages.json

HTML document, ASCII text, with very long lines, with no line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_275637972\CRX_INSTALL\_locales\ja\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_275637972\CRX_INSTALL\_locales\kn\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_275637972\CRX_INSTALL\_locales\ko\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_275637972\CRX_INSTALL\_locales\lt\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_275637972\CRX_INSTALL\_locales\lv\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_275637972\CRX_INSTALL\_locales\ml\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_275637972\CRX_INSTALL\_locales\mr\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_275637972\CRX_INSTALL\_locales\ms\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_275637972\CRX_INSTALL\_locales\nb\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_275637972\CRX_INSTALL\_locales\nl\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_275637972\CRX_INSTALL\_locales\pl\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_275637972\CRX_INSTALL\_locales\pt\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_275637972\CRX_INSTALL\_locales\ro\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_275637972\CRX_INSTALL\_locales\ru\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_275637972\CRX_INSTALL\_locales\sk\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_275637972\CRX_INSTALL\_locales\sl\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_275637972\CRX_INSTALL\_locales\sr\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_275637972\CRX_INSTALL\_locales\sv\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_275637972\CRX_INSTALL\_locales\sw\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_275637972\CRX_INSTALL\_locales\ta\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_275637972\CRX_INSTALL\_locales\te\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_275637972\CRX_INSTALL\_locales\th\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_275637972\CRX_INSTALL\_locales\tr\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_275637972\CRX_INSTALL\_locales\uk\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_275637972\CRX_INSTALL\_locales\vi\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_275637972\CRX_INSTALL\_locales\zh\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_275637972\CRX_INSTALL\_locales\zh_TW\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_275637972\CRX_INSTALL\_metadata\verified_contents.json

ASCII text, with very long lines, with no line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_275637972\CRX_INSTALL\angular.js

ASCII text, with very long lines

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_275637972\CRX_INSTALL\background_script.js

ASCII text, with very long lines

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_275637972\CRX_INSTALL\cast_sender.js

ASCII text, with very long lines

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_275637972\CRX_INSTALL\common.js

ASCII text, with very long lines

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_275637972\CRX_INSTALL\feedback.css

ASCII text

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_275637972\CRX_INSTALL\feedback.html

HTML document, ASCII text

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_275637972\CRX_INSTALL\feedback_script.js

ASCII text, with very long lines

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_275637972\CRX_INSTALL\manifest.json

ASCII text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_275637972\CRX_INSTALL\material_css_min.css

ASCII text, with very long lines

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_275637972\CRX_INSTALL\mirroring_cast_streaming.js

ASCII text, with very long lines

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_275637972\CRX_INSTALL\mirroring_common.js

ASCII text, with very long lines

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_275637972\CRX_INSTALL\mirroring_hangouts.js

ASCII text, with very long lines

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_275637972\CRX_INSTALL\mirroring_webrtc.js

ASCII text, with very long lines

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir2940_275637972\dccc7939-f97e-49ad-96c6-ac7c7a560f9a.tmp

Google Chrome extension, version 3

dropped

C:\Users\user\AppData\Local\Temp\{438EF921-628C-4FCC-AE0A-192E952184A6}

data

dropped

C:\Users\user\AppData\Local\Temp\{566C2623-E5BA-44EA-8F9C-38F55FE094D7}

data

dropped

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Quote.LNK

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Tue Mar 8 15:45:54 2022, mtime=Tue Mar 8 15:45:54 2022, atime=Wed Apr 20 21:05:17 2022, length=32648, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

data

dropped

C:\Users\user\Desktop\~$Quote.docx

data

dropped

There are 196 hidden files, click here to show them.

Processes

Path

Cmdline

Malicious

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding

Details

Is windows:	true
Is dropped:	false
PID:	2604
Target ID:	0
Parent PID:	576
Name:	WINWORD.EXE
Class:	word
Path:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Commandline:	"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Size:	1423704
MD5:	9EE74859D22DAE61F1750B3A1BACB6F5
Time:	15:05:17
Date:	20/04/2022
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x13fd80000
Modulesize:	1437696
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "https://oldmacdonald.had-a.phish.farm/XVDBaVFRVNVdjRmd5Wm5WWWNWUlhTVkJuYlc0d09HMW9hMU5PTDJob05rNVZPRzFpWkdFdlJpOTRTMjlFT1ZsSVJYbEVXRnBKTkd4T1ZIcHhhRXhOYVVnME0wZFdNbkpFTmtaellXMU5NMHBLY1RaTlVpczFRWGhPTWpkTlJUbHhVbkJqY2tSU00zSjVibkZyYzJOMVQwNVNPVkJZZUhOV1psWlJSbFJxTUhZMlJ6Vk9ZbkpHYTNCT01XdFRVR3hUVUdoUVRrMXZMMEZMU2xCWlUyOHJlbXhMUldwd1VFVldZVGRCUFMwdFRHdFllbU5WZEdsMEszQnBObGxDT0RSTlF6TkxVVDA5LS0xYjU0YTc1MGRkYmVmMzUxYjM1MzM3Nzc1ZTcyYjc5ODE2OTU3Mjlk?cid=1156173281

Details

Is windows:	true
Is dropped:	false
PID:	2940
Target ID:	3
Parent PID:	2064
Name:	chrome.exe
Path:	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
Commandline:	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "https://oldmacdonald.had-a.phish.farm/XVDBaVFRVNVdjRmd5Wm5WWWNWUlhTVkJuYlc0d09HMW9hMU5PTDJob05rNVZPRzFpWkdFdlJpOTRTMjlFT1ZsSVJYbEVXRnBKTkd4T1ZIcHhhRXhOYVVnME0wZFdNbkpFTmtaellXMU5NMHBLY1RaTlVpczFRWGhPTWpkTlJUbHhVbkJqY2tSU00zSjVibkZyYzJOMVQwNVNPVkJZZUhOV1psWlJSbFJxTUhZMlJ6Vk9ZbkpHYTNCT01XdFRVR3hUVUdoUVRrMXZMMEZMU2xCWlUyOHJlbXhMUldwd1VFVldZVGRCUFMwdFRHdFllbU5WZEdsMEszQnBObGxDT0RSTlF6TkxVVDA5LS0xYjU0YTc1MGRkYmVmMzUxYjM1MzM3Nzc1ZTcyYjc5ODE2OTU3Mjlk?cid=1156173281
Size:	1820656
MD5:	6ACAE527E744C80997B25EF2A0485D5E
Time:	15:05:51
Date:	20/04/2022
Reason:	newprocess
Reputation:	moderate
Is admin:	true
Is elevated:	true
Modulebase:	0x13f490000
Modulesize:	1867776
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1028,11011485947330513052,11238533169344121473,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1416 /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	2540
Target ID:	4
Parent PID:	2940
Name:	chrome.exe
Path:	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1028,11011485947330513052,11238533169344121473,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1416 /prefetch:8
Size:	1820656
MD5:	6ACAE527E744C80997B25EF2A0485D5E
Time:	15:05:54
Date:	20/04/2022
Reason:	newprocess
Reputation:	moderate
Is admin:	true
Is elevated:	true
Modulebase:	0x13f490000
Modulesize:	1867776
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

https://secured-login.net/pages/9c8d1a532ce0b/XVDBaVFRVNVdjRmd5Wm5WWWNWUlhTVkJuYlc0d09HMW9hMU5PTDJob05rNVZPRzFpWkdFdlJpOTRTMjlFT1ZsSVJYbEVXRnBKTkd4T1ZIcHhhRXhOYVVnME0wZFdNbkpFTmtaellXMU5NMHBLY1RaTlVpczFRWGhPTWpkTlJUbHhVbkJqY2tSU00zSjVibkZyYzJOMVQwNVNPVkJZZUhOV1psWlJSbFJxTUhZMlJ6Vk9ZbkpHYTNCT01XdFRVR3hUVUdoUVRrMXZMMEZMU2xCWlUyOHJlbXhMUldwd1VFVldZVGRCUFMwdFRHdFllbU5WZEdsMEszQnBObGxDT0RSTlF6TkxVVDA5LS0xYjU0YTc1MGRkYmVmMzUxYjM1MzM3Nzc1ZTcyYjc5ODE2OTU3Mjlk

https://oldmacdonald.had-a.phish.farm/XZVhBdlpDOVhVWHByUldGcE0zRnljVnBMTVhaaFJ6UmpjMDFDTWxGUk0wMXZhM

unknown

https://apis.google.com/js/client.js

unknown

https://secured-login.net/assets/sei-flag-90af55d793544fe1893f26677661a4252761afbe811fab0eced85c67bc82f984.png

54.146.183.223

https://oldmacdonald.had-a.phish.farm/XU0RWNVJFcHNUV2x4WTIweFFXTTVUbFZqU1ZOdldVaExaMkYxT1dOalRWWm9ka

unknown

https://www.google.com/images/cleardot.gif

unknown

https://secured-login.net/assets/sei-tooltip-1ae0d1e9729436272a0cdfaf2325f9aacea7d6f89787d08056eda54a1910752d.css

54.146.183.223

https://oldmacdonald.had-a.phish.farm/XVDBaVFRVNVdjRmd5Wm5WWWNWUlhTVkJuYlc0d09HMW9hMU5PTDJob05rNVZPR

unknown

https://crash.corp.google.com/samples?reportid=&q=

unknown

https://www.google.com/log?format=json&hasfast=true

unknown

https://s3.amazonaws.com/helpimg/landing_pages/css/flags.css

3.5.3.10

https://secured-login.net/favicon.ico

54.146.183.223

https://oldmacdonald.had-a.phish.farm/XUjFWa2JraHZTRk5aTDJaRGFGaE9iRmQzVmtwa2JTdERNM1pKUTFoclV6TkJWM

unknown

https://sandbox.google.com/payments/v4/js/integrator.js

unknown

http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01

unknown

https://s3.amazonaws.com/helpimg/landing_pages/css/dd.css

3.5.3.10

https://accounts.google.com/MergeSession

unknown

https://preprod-hangouts-googleapis.sandbox.google.com

unknown

https://clients2.googleusercontent.com/crx/blobs/Acy1k0bLIjHsvnKaKN_oRpVaYYvFs25d7GKYF1WXrT6yizCMksBO0c_ggE0B6tx6HPRHe6q1GOEe3_NcIbSiGG8kXeLMUY0sAKVvC6R89zvKM13s5VqoAMZSmuUgjQL5vlygJuArQghXXE_qTL7NlQ/extension_8520_615_0_5.crx

142.250.185.65

https://secured-login.net/assets/sei-flag-68d13d784ca9a21935d3004d873a9d547a5992deb153f1069c517f83cb514c7a.css

54.146.183.223

https://www.google.com

unknown

https://oldmacdonald.had-a.phish.farm/XZEhoUlZFUjJkRlJsYTFCSE1VeFRiR0pUYnpScVN6QnZSMFZoZG10aFJWRk1Wa

unknown

https://hangouts.clients6.google.com

unknown

https://meet.google.com

unknown

https://hangouts.google.com/hangouts/_/logpref

unknown

https://accounts.google.com

unknown

https://clients2.google.com/cr/report

unknown

https://secured-login.net/packs/js/vendor-2207a81ec738c3300f3e.js

54.146.183.223

http://angularjs.org

unknown

https://creativecommons.org/publicdomain/zero/1.0/.

unknown

https://github.com/angular/material

unknown

https://apis.google.com

unknown

https://www.google.com/accounts/OAuthLogin?issueuberauth=1

unknown

https://github.com/madler/zlib/blob/master/zlib.h

unknown

https://www-googleapis-staging.sandbox.google.com

unknown

https://clients2.google.com

unknown

https://consent.google.com

unknown

https://www.google.com/tools/feedback

unknown

http://www.apache.org/licenses/LICENSE-2.0

unknown

https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p

unknown

https://www.google.com/intl/en-US/chrome/blank.html

unknown

https://ogs.google.com

unknown

https://oldmacdonald.had-a.phish.farm/XYW05NU1UZFVNVEpXVWxGNFNsTjNPVXh5TWpsUE9WQnZRa3hDY1RSc2EybERPW

unknown

https://support.google.com/chromecast/troubleshooter/2995236

unknown

https://secured-login.net/assets/landing-watermark-8487e36eef1bec74f06631f19fea0aa171c208e2976373cda5bd0a4b9e230903.css

54.146.183.223

http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions

unknown

https://upload.wikimedia.org/wikipedia/commons/thumb/2/22/Milliman_logo.svg/301px-Milliman_logo.svg.png

91.198.174.208

https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard

142.250.185.205

https://payments.google.com/payments/v4/js/integrator.js

unknown

https://adservice.google.com

unknown

https://www.google.com;

unknown

https://hangouts.google.com/

unknown

https://oldmacdonald.had-a.phish.farm/XYkZob05YQlhlRzl1Tld0dFYyUlRjVWg2ZERaUk1uUkRjRlI1VmxoM2VEYzVjR

unknown

https://www.google.com/images/x2.gif

unknown

https://i.imgur.com/QRF01zv.png

151.101.112.193

https://www.google.com/images/dot2.gif

unknown

https://meetings.clients6.google.com

unknown

https://play.google.com/log?format=json&hasfast=true

unknown

https://secured-login.net/pages/9c8d1a532ce0b/XVDBaVFRVNVdjRmd5Wm5WWWNWUlhTVkJuYlc0d09HMW9hMU5PTDJob

unknown

https://oldmacdonald.had-a.phish.farm/XUzJzMFltNVhNa3RVZEZOWlZrSkhORkp0WlVoNGVVbFBTRkJNUld0UWJIUnhPQ

unknown

http://tools.ietf.org/html/rfc1950

unknown

54.146.183.223

https://support.google.com/chromecast/answer/2998456

unknown

https://clients2.googleusercontent.com

unknown

https://oldmacdonald.had-a.phish.farm/XYkZob05YQlhlRzl1Tld0dFYyUlRjVWg2ZERaUk1uUkRjRlI1VmxoM2VEYzVjRXQyWTJSbVFTOTRaamxRVmpkdk1qQktVR2szVWxOV1ltRXZSelZTUldwcVprcG5ValpPWTJGSk5FaExkbk5FWm5CSU56VnlVWFJZWXk5M1NXMU9ja0pqV1UxamNucEdWMVU5TFMxR1IwWmlabE4wTkZNd1RHbEpWa3MyWjI5eVppdG5QVDA9LS00ZTQwMmQzNjJhYzNmNGVmZWI3NDZiOGQzNTE2MjBmYjBhMDYxODFj?cid=1156173281

3.221.148.222

https://secured-login.net/assets/application-04a96146efb6193a4fb9ccb60b99fa33c679e346e15d7cea0a2e9e8e54397acb.js

54.146.183.223

https://oldmacdonald.had-a.phish.farm/XVDBaVFRVNVdjRmd5Wm5WWWNWUlhTVkJuYlc0d09HMW9hMU5PTDJob05rNVZPRzFpWkdFdlJpOTRTMjlFT1ZsSVJYbEVXRnBKTkd4T1ZIcHhhRXhOYVVnME0wZFdNbkpFTmtaellXMU5NMHBLY1RaTlVpczFRWGhPTWpkTlJUbHhVbkJqY2tSU00zSjVibkZyYzJOMVQwNVNPVkJZZUhOV1psWlJSbFJxTUhZMlJ6Vk9ZbkpHYTNCT01XdFRVR3hUVUdoUVRrMXZMMEZMU2xCWlUyOHJlbXhMUldwd1VFVldZVGRCUFMwdFRHdFllbU5WZEdsMEszQnBObGxDT0RSTlF6TkxVVDA5LS0xYjU0YTc1MGRkYmVmMzUxYjM1MzM3Nzc1ZTcyYjc5ODE2OTU3Mjlk?cid=1156173281

54.146.183.223

https://secured-login.net/assets/sei-modal-298c1edd0166bef9cbaf6b85083b95d5819753f027d6a841658c738f21e84e49.css

54.146.183.223

https://docs.google.com

unknown

https://www.google.com/

unknown

https://feedback.googleusercontent.com

unknown

https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=84.0.4147.135&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1

142.250.184.238

https://secured-login.net/assets/modernizr-79e0181ec91aff04bb01d87cba546535ede843f75d19f5c60f66b8dd6546971f.js

54.146.183.223

https://clients2.google.com/service/update2/crx

unknown

https://clients6.google.com

unknown

There are 65 hidden URLs, click here to show them.

Domains

Name

Malicious

oldmacdonald.had-a.phish.farm

unknown

s3.amazonaws.com

3.5.3.10

accounts.google.com

142.250.185.205

upload.wikimedia.org

91.198.174.208

clients.l.google.com

142.250.184.238

secured-login.net

54.146.183.223

googlehosted.l.googleusercontent.com

142.250.185.65

landing.training.knowbe4.com

3.221.148.222

ipv4.imgur.map.fastly.net

151.101.112.193

clients2.googleusercontent.com

unknown

clients2.google.com

unknown

i.imgur.com

unknown

There are 2 hidden domains, click here to show them.

IPs

Domain

Country

Malicious

3.5.3.10

s3.amazonaws.com

United States

54.146.183.223

secured-login.net

United States

91.198.174.208

upload.wikimedia.org

Netherlands

192.168.2.7

unknown

142.250.185.205

accounts.google.com

United States

192.168.2.3

unknown

192.168.2.5

unknown

3.221.148.222

landing.training.knowbe4.com

United States

192.168.2.22

unknown

239.255.255.250

unknown

Reserved

142.250.184.238

clients.l.google.com

United States

151.101.112.193

ipv4.imgur.map.fastly.net

United States

192.168.2.255

unknown

127.0.0.1

unknown

142.250.185.65

googlehosted.l.googleusercontent.com

United States

There are 5 hidden IPs, click here to show them.

Registry

Path

Value

Malicious

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems

cu0

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word

MTTT

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems

az0

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems

v~0

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\ReviewCycle

ReviewToken

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached

{E7E4BC40-E76A-11CE-A9BB-00AA004AE837} {000214E6-0000-0000-C000-000000000046} 0xFFFF

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\DocumentRecovery\67A2F

67A2F

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage

VBAFiles