IOC Report
https://yielding-cliff-weather.glitch.me/JHindex.html

loading gif

Files

File Path
Type
Category
Malicious
C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic
data
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\2263ab63-f000-43a7-9e16-d2ba61b83264.tmp
ASCII text, with very long lines, with no line terminators
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\2568bd48-6432-41d2-bb85-7ee0f4069e87.tmp
ASCII text, with very long lines, with no line terminators
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\3970a607-8735-4b1b-80ee-a1e9697a6b73.tmp
ASCII text, with very long lines, with no line terminators
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\9686881b-6147-40be-a5a0-f5b2b5099682.tmp
ASCII text, with very long lines, with no line terminators
modified
C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
data
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\0aaa0181-d3e8-46d2-9b6c-68ea6abea8c0.tmp
UTF-8 Unicode text, with very long lines, with no line terminators
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\39e4bfd7-7caa-4984-9188-0cc21da36e1c.tmp
UTF-8 Unicode text, with very long lines, with no line terminators
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\3f013ca6-ac17-47f7-8012-9414330a0c59.tmp
ASCII text, with very long lines, with no line terminators
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\3f5bb10c-9b5f-42ed-bcc9-e4cad67ce5df.tmp
very short file (no magic)
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\4fb9161e-a3ad-492b-9183-194fb5d990ef.tmp
ASCII text, with very long lines, with no line terminators
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\58e5d558-46c3-4e9e-b6b9-6020c1fa5dd5.tmp
ASCII text, with very long lines, with no line terminators
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata\computed_hashes.json
ASCII text, with very long lines, with no line terminators
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\000003.log
data
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG
ASCII text
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG.old (copy)
ASCII text
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Provider Cache
data
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network Persistent State (copy)
ASCII text, with very long lines, with no line terminators
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences (copy)
ASCII text, with very long lines, with no line terminators
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences (copy)
UTF-8 Unicode text, with very long lines, with no line terminators
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\47b5ea01-3c4c-4762-80ba-4f5a0667c027.tmp
ASCII text, with very long lines, with no line terminators
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\GPUCache\data_1
data
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Network Persistent State (copy)
ASCII text, with very long lines, with no line terminators
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\7c533b11-7143-4259-b341-e1d3a5a58dae.tmp
ASCII text, with very long lines, with no line terminators
modified
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
data
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network Persistent State (copy)
ASCII text, with very long lines, with no line terminators
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\c56be455-e3c3-44ab-a75e-4469d5b6ab40.tmp
ASCII text, with very long lines, with no line terminators
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\c8f694f6-82e4-4221-bf9a-1a76bf6daf7c.tmp
UTF-8 Unicode text, with very long lines, with no line terminators
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\d3be6731-b662-4f2f-a6b4-f93c8af249da.tmp
UTF-8 Unicode text, with very long lines, with no line terminators
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000004.dbtmp
ASCII text
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\CURRENT (copy)
ASCII text
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\f4648257-450e-4f70-b24c-975702c9be0e.tmp
ASCII text, with very long lines, with no line terminators
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Last Browser
data
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Last Version
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State (copy)
ASCII text, with very long lines, with no line terminators
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Module Info Cache (copy)
data
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\ac568a46-f326-4e65-90e0-d738926a9bc7.tmp
ASCII text, with very long lines, with no line terminators
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\b7a0e570-0b1a-4eff-8268-525a6f15a860.tmp
SysEx File -
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\daa058be-d576-430d-8bf7-6ab3e3aa3f92.tmp
ASCII text, with very long lines, with no line terminators
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\dd17ec3a-2afd-4532-8474-3bb5a151f77f.tmp
data
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\edbf6efd-34e0-4844-93eb-8b95c77f0e39.tmp
ASCII text, with very long lines, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\6128_1258314342\_platform_specific\x86_64\pnacl_public_x86_64_crtbegin_for_eh_o
ELF 64-bit LSB relocatable, x86-64, version 1 (SYSV), not stripped
dropped
C:\Users\user\AppData\Local\Temp\6128_1258314342\_platform_specific\x86_64\pnacl_public_x86_64_crtbegin_o
ELF 64-bit LSB relocatable, x86-64, version 1 (SYSV), not stripped
dropped
C:\Users\user\AppData\Local\Temp\6128_1258314342\_platform_specific\x86_64\pnacl_public_x86_64_libpnacl_irt_shim_a
current ar archive
dropped
C:\Users\user\AppData\Local\Temp\6128_1258314342\_platform_specific\x86_64\pnacl_public_x86_64_libpnacl_irt_shim_dummy_a
current ar archive
dropped
C:\Users\user\AppData\Local\Temp\6128_1258314342\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_sz_nexe
ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, BuildID[sha1]=4b15de4ab227d5e46213978b8518d53c53ce1db9, stripped
dropped
C:\Users\user\AppData\Local\Temp\6128_1656070662\Recovery.crx3
Google Chrome extension, version 3
dropped
C:\Users\user\AppData\Local\Temp\6128_1656070662\_metadata\verified_contents.json
ASCII text, with very long lines, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\6128_1656070662\manifest.fingerprint
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\6128_1656070662\manifest.json
ASCII text
dropped
C:\Users\user\AppData\Local\Temp\70b2751f-7440-4b0d-ba86-8242ea14ddf0.tmp
Google Chrome extension, version 3
dropped
C:\Users\user\AppData\Local\Temp\cf5ddde2-aafb-449e-bec0-59740de41e98.tmp
very short file (no magic)
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir6128_596063834\70b2751f-7440-4b0d-ba86-8242ea14ddf0.tmp
Google Chrome extension, version 3
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir6128_596063834\CRX_INSTALL\_locales\bg\messages.json
UTF-8 Unicode text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir6128_596063834\CRX_INSTALL\_locales\ca\messages.json
UTF-8 Unicode text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir6128_596063834\CRX_INSTALL\_locales\cs\messages.json
UTF-8 Unicode text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir6128_596063834\CRX_INSTALL\_locales\da\messages.json
UTF-8 Unicode text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir6128_596063834\CRX_INSTALL\_locales\de\messages.json
UTF-8 Unicode text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir6128_596063834\CRX_INSTALL\_locales\el\messages.json
UTF-8 Unicode text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir6128_596063834\CRX_INSTALL\_locales\en\messages.json
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir6128_596063834\CRX_INSTALL\_locales\en_GB\messages.json
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir6128_596063834\CRX_INSTALL\_locales\es\messages.json
UTF-8 Unicode text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir6128_596063834\CRX_INSTALL\_locales\es_419\messages.json
UTF-8 Unicode text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir6128_596063834\CRX_INSTALL\_locales\et\messages.json
UTF-8 Unicode text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir6128_596063834\CRX_INSTALL\_locales\fi\messages.json
UTF-8 Unicode text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir6128_596063834\CRX_INSTALL\_locales\fil\messages.json
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir6128_596063834\CRX_INSTALL\_locales\fr\messages.json
UTF-8 Unicode text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir6128_596063834\CRX_INSTALL\_locales\hi\messages.json
UTF-8 Unicode text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir6128_596063834\CRX_INSTALL\_locales\hr\messages.json
UTF-8 Unicode text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir6128_596063834\CRX_INSTALL\_locales\hu\messages.json
UTF-8 Unicode text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir6128_596063834\CRX_INSTALL\_locales\id\messages.json
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir6128_596063834\CRX_INSTALL\_locales\it\messages.json
UTF-8 Unicode text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir6128_596063834\CRX_INSTALL\_locales\ja\messages.json
UTF-8 Unicode text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir6128_596063834\CRX_INSTALL\_locales\ko\messages.json
UTF-8 Unicode text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir6128_596063834\CRX_INSTALL\_locales\lt\messages.json
UTF-8 Unicode text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir6128_596063834\CRX_INSTALL\_locales\lv\messages.json
UTF-8 Unicode text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir6128_596063834\CRX_INSTALL\_locales\nb\messages.json
UTF-8 Unicode text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir6128_596063834\CRX_INSTALL\_locales\nl\messages.json
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir6128_596063834\CRX_INSTALL\_locales\pl\messages.json
UTF-8 Unicode text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir6128_596063834\CRX_INSTALL\_locales\pt_BR\messages.json
UTF-8 Unicode text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir6128_596063834\CRX_INSTALL\_locales\pt_PT\messages.json
UTF-8 Unicode text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir6128_596063834\CRX_INSTALL\_locales\ro\messages.json
UTF-8 Unicode text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir6128_596063834\CRX_INSTALL\_locales\ru\messages.json
UTF-8 Unicode text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir6128_596063834\CRX_INSTALL\_locales\sk\messages.json
UTF-8 Unicode text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir6128_596063834\CRX_INSTALL\_locales\sl\messages.json
UTF-8 Unicode text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir6128_596063834\CRX_INSTALL\_locales\sr\messages.json
UTF-8 Unicode text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir6128_596063834\CRX_INSTALL\_locales\sv\messages.json
UTF-8 Unicode text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir6128_596063834\CRX_INSTALL\_locales\th\messages.json
UTF-8 Unicode text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir6128_596063834\CRX_INSTALL\_locales\tr\messages.json
UTF-8 Unicode text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir6128_596063834\CRX_INSTALL\_locales\uk\messages.json
UTF-8 Unicode text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir6128_596063834\CRX_INSTALL\_locales\vi\messages.json
UTF-8 Unicode text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir6128_596063834\CRX_INSTALL\_locales\zh_CN\messages.json
UTF-8 Unicode text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir6128_596063834\CRX_INSTALL\_locales\zh_TW\messages.json
UTF-8 Unicode text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir6128_596063834\CRX_INSTALL\_metadata\verified_contents.json
ASCII text, with very long lines, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir6128_596063834\CRX_INSTALL\craw_background.js
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir6128_596063834\CRX_INSTALL\craw_window.js
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir6128_596063834\CRX_INSTALL\css\craw_window.css
ASCII text
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir6128_596063834\CRX_INSTALL\html\craw_window.html
HTML document, ASCII text
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir6128_596063834\CRX_INSTALL\images\flapper.gif
GIF image data, version 89a, 30 x 30
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir6128_596063834\CRX_INSTALL\images\icon_128.png
PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir6128_596063834\CRX_INSTALL\images\icon_16.png
PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir6128_596063834\CRX_INSTALL\images\topbar_floating_button.png
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir6128_596063834\CRX_INSTALL\images\topbar_floating_button_close.png
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir6128_596063834\CRX_INSTALL\images\topbar_floating_button_hover.png
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir6128_596063834\CRX_INSTALL\images\topbar_floating_button_maximize.png
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir6128_596063834\CRX_INSTALL\images\topbar_floating_button_pressed.png
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir6128_596063834\CRX_INSTALL\manifest.json
ASCII text, with CRLF line terminators
dropped
There are 98 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "https://yielding-cliff-weather.glitch.me/JHindex.html
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1540,8091005073310854459,9884762722939245423,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1964 /prefetch:8

URLs

Name
IP
Malicious
https://yielding-cliff-weather.glitch.me/JHindex.html
malicious
https://yielding-cliff-weather.glitch.me/JHindex.html
https://acctcdn.msftauth.net/converged_ux_v2_u77h9aLlpCTRkWpDDpAa0Q2.css?v=1
152.199.21.175
https://acctcdn.msftauth.net/images/dropdown_caret_KXSZjGsyILZaoTf0sI9X-A2.svg
152.199.21.175
https://dns.google
unknown
https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
unknown
https://www.google.com/intl/en-US/chrome/blank.html
unknown
https://ogs.google.com
unknown
https://yielding-cliff-weather.glitch.me/css/hover.css
52.22.91.148
https://acctcdn.msftauth.net/images/favicon.ico?v=2
152.199.21.175
https://www.google.com/images/cleardot.gif
unknown
https://acctcdn.msftauth.net/jqueryshim_hlu0tTfjWJFWYNt1WZrVqg2.js?v=1
152.199.21.175
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1
142.250.185.142
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard
172.217.16.205
https://payments.google.com/payments/v4/js/integrator.js
unknown
https://acctcdn.msftauth.net/datarequestpackage_h-_7C7UzwdefXJT9njDBTQ2.js
152.199.21.175
https://acctcdn.msftauth.net/images/2_vD0yppaJX3jBnfbHF1hqXQ2.svg
152.199.21.175
https://chromium.googlesource.com/a/native_client/pnacl-llvm.git
unknown
https://acctcdn.msftauth.net/oneds_CBxZrnSxLbjHuOGn7pHqpg2.js?v=1
152.199.21.175
https://yielding-cliff-weather.glitch.me/JHindex.html
52.22.91.148
https://sandbox.google.com/payments/v4/js/integrator.js
unknown
https://www.google.com/images/x2.gif
unknown
https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css
104.18.11.207
https://accounts.google.com/MergeSession
unknown
http://llvm.org/):
unknown
https://acctcdn.msftauth.net/knockout_3.3.0_X1BYS2jZMbi7hfUj8VuqFA2.js?v=1
152.199.21.175
https://www.google.com
unknown
https://acctcdn.msftauth.net/lightweightsignuppackage_A9e-qcQ2Wv90dJpcB7GHhQ2.js?v=1
152.199.21.175
https://www.google.com/images/dot2.gif
unknown
https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js
104.17.24.14
https://acctcdn.msftauth.net/images/microsoft_logo_7lyNn7YkjJOP0NwZNw6QvQ2.svg
152.199.21.175
https://yielding-cliff-weather.glitch.me/JHindex.html2
unknown
https://accounts.google.com
unknown
https://acctcdn.msftauth.net/lwsignupstringscountrybirthdate_en-us_Hu9XQvsxbdtI5Cn8ywiXCA2.js?v=1
152.199.21.175
https://clients2.googleusercontent.com
unknown
https://apis.google.com
unknown
https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js
104.18.11.207
https://www.google.com/accounts/OAuthLogin?issueuberauth=1
unknown
https://www.google.com/
unknown
https://www-googleapis-staging.sandbox.google.com
unknown
https://chromium.googlesource.com/a/native_client/pnacl-clang.git
unknown
https://clients2.google.com
unknown
https://clients2.google.com/service/update2/crx
unknown
There are 32 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
gstaticadssl.l.google.com
172.217.16.131
accounts.google.com
172.217.16.205
cdnjs.cloudflare.com
104.17.24.14
sni1gl.wpc.alphacdn.net
152.199.21.175
part-0017.t-0009.fbs1-t-msedge.net
13.107.219.45
maxcdn.bootstrapcdn.com
104.18.11.207
clients.l.google.com
142.250.185.142
yielding-cliff-weather.glitch.me
52.22.91.148
signup.live.com
unknown
ka-f.fontawesome.com
unknown
cdn.jsdelivr.net
unknown
kit.fontawesome.com
unknown
clients2.google.com
unknown
secure.aadcdn.microsoftonline-p.com
unknown
code.jquery.com
unknown
fpt.live.com
unknown
acctcdn.msftauth.net
unknown
There are 7 hidden domains, click here to show them.

IPs

IP
Domain
Country
Malicious
192.168.2.1
unknown
unknown
142.250.185.142
clients.l.google.com
United States
52.22.91.148
yielding-cliff-weather.glitch.me
United States
104.17.24.14
cdnjs.cloudflare.com
United States
172.217.16.205
accounts.google.com
United States
104.18.11.207
maxcdn.bootstrapcdn.com
United States
239.255.255.250
unknown
Reserved
152.199.21.175
sni1gl.wpc.alphacdn.net
United States
127.0.0.1
unknown
unknown
172.217.16.131
gstaticadssl.l.google.com
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}\LastWasDefault
S-1-5-21-3853321935-2125563209-4053062332-1002
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
ahfgeienlihckogmohjhadlkjgocpleb
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
gdaefkejpgkiemlaofpalmlakkmbjdnl
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
gfdkimpbcpahaombhbimeihdjnejgicl
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
kmendfapggjehodndflmmgagdbamhnfd
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
mfehgcgbbipciphmccgaenjidiccnmng
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
mhjfbmdgcfjbbpaeojofohoefgiehjai
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
neajdppkdcdipfabeoofebfddakdcjhd
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
nkeimhogjdpnpccoofpliimaahmaaome
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
pkedcjkdefgpdelpbcmbmeomcjbeemfm
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
prefs.preference_reset_time
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
gfdkimpbcpahaombhbimeihdjnejgicl
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
nmmhkkegccagdldgiimedpiccmgmieda
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
nmmhkkegccagdldgiimedpiccmgmieda
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
nmmhkkegccagdldgiimedpiccmgmieda
HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
state
HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
StatusCodes
HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
StatusCodes
HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
state
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
software_reporter.reporting
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
module_blacklist_cache_md5_digest
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
media.storage_id_salt
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
google.services.last_account_id
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
google.services.account_id
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
software_reporter.prompt_seed
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
settings_reset_prompt.last_triggered_for_homepage
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
default_search_provider_data.template_url_data
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
safebrowsing.incidents_sent
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
pinned_tabs
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
search_provider_overrides
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
settings_reset_prompt.last_triggered_for_default_search
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
prefs.preference_reset_time
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
google.services.last_username
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
session.startup_urls
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
session.restore_on_startup
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
software_reporter.prompt_version
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
settings_reset_prompt.last_triggered_for_startup_urls
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
settings_reset_prompt.prompt_wave
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
homepage
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
homepage_is_newtabpage
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
browser.show_home_button
HKEY_CURRENT_USER\Software\Google\Chrome\StabilityMetrics
user_experience_metrics.stability.exited_cleanly
HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
lastrun
There are 33 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
280DB696000
heap
page read and write
280E0EAD000
heap
page read and write
20D69087000
heap
page read and write
280E0F02000
heap
page read and write
280E0F1B000
heap
page read and write
280E2000000
heap
page read and write
35E03F7000
stack
page read and write
21318702000
heap
page read and write
280E1090000
trusted library allocation
page read and write
561C28C000
stack
page read and write
280E0E44000
heap
page read and write
280E10E0000
remote allocation
page read and write
280E0EDC000
heap
page read and write
1D286147000
heap
page read and write
280DB629000
heap
page read and write
20D69108000
heap
page read and write
1D2863D0000
trusted library allocation
page read and write
280E0DA4000
trusted library allocation
page read and write
280E0EE2000
heap
page read and write
213184C0000
heap
page read and write
35E017B000
stack
page read and write
280E0D86000
trusted library allocation
page read and write
4A40479000
stack
page read and write
280E0F02000
heap
page read and write
B5CC57A000
stack
page read and write
DB2897B000
stack
page read and write
280DB600000
heap
page read and write
27C4C286000
heap
page read and write
35DFD7C000
stack
page read and write
27C4C23C000
heap
page read and write
280DC19B000
heap
page read and write
B5CC07F000
stack
page read and write
280DC015000
heap
page read and write
B5CBEFF000
stack
page read and write
35DFDFE000
stack
page read and write
280E1402000
heap
page read and write
DB28D7F000
stack
page read and write
35E02FB000
stack
page read and write
280E0F22000
heap
page read and write
27C4C180000
trusted library allocation
page read and write
DB2867F000
stack
page read and write
280E10E0000
remote allocation
page read and write
280E0D85000
trusted library allocation
page read and write
280E0D80000
trusted library allocation
page read and write
27C4C270000
heap
page read and write
1D286126000
heap
page read and write
280DBFF0000
trusted library allocation
page read and write
20D6903C000
heap
page read and write
280E1400000
heap
page read and write
21319002000
trusted library allocation
page read and write
21318613000
heap
page read and write
280DC118000
heap
page read and write
280E0F1B000
heap
page read and write
21318713000
heap
page read and write
280E0F1B000
heap
page read and write
280E0E57000
heap
page read and write
280E0E2F000
heap
page read and write
280DB674000
heap
page read and write
280DC680000
trusted library allocation
page read and write
280E0F1B000
heap
page read and write
35E007D000
stack
page read and write
20D69053000
heap
page read and write
280DBFF3000
trusted library allocation
page read and write
20D68F70000
trusted library allocation
page read and write
20D6904E000
heap
page read and write
1D28634E000
trusted library allocation
page read and write
280E0F00000
heap
page read and write
280E0E00000
heap
page read and write
280DB570000
heap
page read and write
27C4C26D000
heap
page read and write
280E0EAA000
heap
page read and write
21318678000
heap
page read and write
280E0F2E000
heap
page read and write
1D286459000
heap
page read and write
20D69049000
heap
page read and write
20D68E10000
heap
page read and write
280DB713000
heap
page read and write
1D286390000
trusted library allocation
page read and write
280E0D80000
trusted library allocation
page read and write
280E0C70000
trusted library allocation
page read and write
27C4C0F0000
heap
page read and write
280E0EF3000
heap
page read and write
280DC690000
trusted library allocation
page read and write
280DC890000
trusted library section
page readonly
DB283BB000
stack
page read and write
280E0F19000
heap
page read and write
27C4C213000
heap
page read and write
20D6907D000
heap
page read and write
280E1230000
trusted library allocation
page read and write
2131863C000
heap
page read and write
1D286330000
trusted library allocation
page read and write
280DB68C000
heap
page read and write
280E0F2E000
heap
page read and write
1D2863E0000
heap
page readonly
280E0D81000
trusted library allocation
page read and write
27C4C302000
heap
page read and write
280DC19B000
heap
page read and write
280DB6A1000
heap
page read and write
DB2887F000
stack
page read and write
B5CC37F000
stack
page read and write
4A405F9000
stack
page read and write
21318700000
heap
page read and write
280DC100000
heap
page read and write
21318695000
heap
page read and write
280E0D8B000
trusted library allocation
page read and write
280E0F2E000
heap
page read and write
DB28A77000
stack
page read and write
280DC118000
heap
page read and write
1D2862B0000
heap
page read and write
20D69070000
heap
page read and write
1D286050000
heap
page read and write
280DBF90000
trusted library section
page read and write
20D68E00000
heap
page read and write
280E0DC4000
trusted library allocation
page read and write
B5CBB7A000
stack
page read and write
280E0C20000
trusted library allocation
page read and write
20D69802000
trusted library allocation
page read and write
280DC000000
heap
page read and write
21318628000
heap
page read and write
20D6902A000
heap
page read and write
280E0D87000
trusted library allocation
page read and write
280E0E1D000
heap
page read and write
280E0F2C000
heap
page read and write
27C4C200000
heap
page read and write
DB28C7D000
stack
page read and write
280E0C60000
trusted library allocation
page read and write
27C4C313000
heap
page read and write
280DC158000
heap
page read and write
280E0EE0000
trusted library allocation
page read and write
280DC860000
trusted library section
page readonly
B5CB56B000
stack
page read and write
280DC500000
trusted library allocation
page read and write
280DB613000
heap
page read and write
DB287FC000
stack
page read and write
27C4C229000
heap
page read and write
280E0DB0000
trusted library allocation
page read and write
280E0DA1000
trusted library allocation
page read and write
280DBE80000
trusted library allocation
page read and write
280E0D8A000
trusted library allocation
page read and write
280E0D8E000
trusted library allocation
page read and write
280E10E0000
remote allocation
page read and write
280E0F31000
heap
page read and write
561C7FB000
stack
page read and write
B5CBE7B000
stack
page read and write
280E0ED0000
trusted library allocation
page read and write
DB286FD000
stack
page read and write
B5CB977000
stack
page read and write
280E0DB0000
trusted library allocation
page read and write
280DB63F000
heap
page read and write
280E2010000
heap
page read and write
280E0F1B000
heap
page read and write
280DC118000
heap
page read and write
27C4CC02000
trusted library allocation
page read and write
B5CBA7A000
stack
page read and write
280DB5E0000
heap
page read and write
280E0F15000
heap
page read and write
35E04FF000
stack
page read and write
280DC159000
heap
page read and write
B5CB5EF000
stack
page read and write
280DC281000
trusted library allocation
page read and write
20D69000000
heap
page read and write
1D286460000
trusted library allocation
page read and write
27C4C150000
heap
page read and write
1D286455000
heap
page read and write
280DC19A000
heap
page read and write
B5CC17E000
stack
page read and write
B5CBFFE000
stack
page read and write
280DC1DC000
heap
page read and write
280E0EFF000
heap
page read and write
280DC780000
trusted library allocation
page read and write
21318560000
trusted library allocation
page read and write
21318600000
heap
page read and write
280E0DA0000
trusted library allocation
page read and write
1D28612D000
heap
page read and write
280DC880000
trusted library section
page readonly
1D2860C0000
heap
page read and write
280E0F1D000
heap
page read and write
280DB67C000
heap
page read and write
1D286126000
heap
page read and write
35E05FF000
stack
page read and write
B5CBD7A000
stack
page read and write
20D68E70000
heap
page read and write
280E0E22000
heap
page read and write
280DB658000
heap
page read and write
B5CC27C000
stack
page read and write
27C4C0E0000
heap
page read and write
35E01FE000
stack
page read and write
B5CBF7E000
stack
page read and write
280E0E64000
heap
page read and write
280E10B0000
trusted library allocation
page read and write
280E10A0000
trusted library allocation
page read and write
280DC118000
heap
page read and write
280DCC00000
trusted library allocation
page read and write
DB28B7F000
stack
page read and write
280DB679000
heap
page read and write
B5CC0FF000
stack
page read and write
280DC113000
heap
page read and write
280DB702000
heap
page read and write
280DB6FE000
heap
page read and write
213184D0000
heap
page read and write
280DB580000
heap
page read and write
21318657000
heap
page read and write
21318530000
heap
page read and write
27C4C28C000
heap
page read and write
1D286400000
trusted library allocation
page read and write
20D69113000
heap
page read and write
280DC118000
heap
page read and write
280DB68F000
heap
page read and write
1D286F50000
trusted library allocation
page read and write
280DC8A0000
trusted library section
page readonly
280E0D88000
trusted library allocation
page read and write
20D69047000
heap
page read and write
20D69100000
heap
page read and write
280E0F02000
heap
page read and write
280E0F2E000
heap
page read and write
1D286126000
heap
page read and write
1D2863F0000
trusted library allocation
page read and write
4A404F9000
stack
page read and write
2131868B000
heap
page read and write
280E0EFD000
heap
page read and write
280E10D0000
trusted library allocation
page read and write
280E0F02000
heap
page read and write
280DC870000
trusted library section
page readonly
1D286F56000
trusted library allocation
page read and write
1D2860E8000
heap
page read and write
1D286320000
trusted library allocation
page read and write
280E0DC0000
trusted library allocation
page read and write
4A4009C000
stack
page read and write
561C9FE000
stack
page read and write
561CAFE000
stack
page read and write
280E0F2E000
heap
page read and write
280DC661000
trusted library allocation
page read and write
280E10C0000
trusted library allocation
page read and write
280E10F0000
trusted library allocation
page read and write
280DC8B0000
trusted library section
page readonly
20D6904B000
heap
page read and write
20D69102000
heap
page read and write
1D286060000
trusted library allocation
page read and write
280E0F2E000
heap
page read and write
280E0EFF000
heap
page read and write
280E1220000
trusted library allocation
page read and write
1D28612D000
heap
page read and write
280E0DF0000
trusted library allocation
page read and write
1D2860E0000
heap
page read and write
1D286450000
heap
page read and write
27C4C202000
heap
page read and write
280E0F1D000
heap
page read and write
280DC002000
heap
page read and write
B5CBC7E000
stack
page read and write
1D28612E000
heap
page read and write
561C8FB000
stack
page read and write
1D287160000
trusted library allocation
page read and write
280E0C00000
trusted library allocation
page read and write
4A4057F000
stack
page read and write
20D69013000
heap
page read and write
280E0E51000
heap
page read and write
There are 246 hidden memdumps, click here to show them.

DOM / HTML

URL
Malicious
https://yielding-cliff-weather.glitch.me/JHindex.html
 malicious
https://signup.live.com/signup?ru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26response_type%3dcode%26client_id%3d51483342-085c-4d86-bf88-cf50c7252078%26scope%3dopenid%2bprofile%2bemail%2boffline_access%26response_mode%3dform_post%26redirect_uri%3dhttps%253a%252f%252flogin.microsoftonline.com%252fcommon%252ffederation%252foauth2%26state%3drQIIAeNisNLJKCkpKLbS1y_ILypJzNHLzUwuyi_OTyvJz8vJzEvVS87P1csvSs9MAbGKhLgEXtk_X7dhr6zr3uYXtw5zqiyexcgZn5NZBla5ilGZsHH6FxgZXzAy3mIS9C9K90wJL3ZLTUktSizJzM-7wCLwioXHgNmKg4NLgEGCQYHhBwvjIlagrZymylOOHFzvusZeeda6cxYMp1j1o6q8LfJ9zTO9Ukz9wyrdfC1NS3MtLDxy87y00wyKwoOKQjIDSsrKjAJCA20trAwnsAlNYGM6xcbwgY2xg53hACfjLS4RIwNDS10DI10DEwUDcytTCysjsygA0%26estsfed%3d1%26lw%3d1%26fl%3deasi2%26fci%3dhttps%253a%252f%252fportal.microsoftonline.com.orgid.com%26mkt%3dEN-US%26uaid%3daee73feabdb0451dbd83e8dac30924a3&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=51483342-085c-4d86-bf88-cf50c7252078&uaid=aee73feabdb0451dbd83e8dac30924a3&suc=https%3a%2f%2fportal.microsoftonline.com.orgid.com&lic=1