IOC Report
https://insacentre-my.sharepoint.com/:o:/g/personal/christel_chevereau_insa-cvl_fr/EiRzYlzmtGdJoxpcLidnoqABdW_125MBX4mxznGrm93yrA?e=ErmP6W

loading gif

Processes

Path
Cmdline
Malicious
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1968 --field-trial-handle=1788,i,15895415173541107671,4193211191602431059,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe" "https://insacentre-my.sharepoint.com/:o:/g/personal/christel_chevereau_insa-cvl_fr/EiRzYlzmtGdJoxpcLidnoqABdW_125MBX4mxznGrm93yrA?e=ErmP6W

URLs

Name
IP
Malicious
https://insacentre-my.sharepoint.com/:o:/g/personal/christel_chevereau_insa-cvl_fr/EiRzYlzmtGdJoxpcLidnoqABdW_125MBX4mxznGrm93yrA?e=ErmP6W
malicious
https://byzo.pages.dev/
188.114.97.3
 malicious
https://byzo.pages.dev/
malicious
https://byzo.pages.dev/favicon.ico
188.114.97.3
 malicious
https://insacentre-my.sharepoint.com/personal/christel_chevereau_insa-cvl_fr/_layouts/15/Doc.aspx?sourcedoc={5c627324-b4e6-4967-a31a-5c2e2767a2a0}&action=view&wd=target%28SPRECHER%20AG.one%7C4af76c2d-7b46-4be7-8c10-3c777d3ccd90%2FSPRECHER%20AG%7Ce1b01870-4c86-4aa6-abd5-d2ff398d2087%2F%29&wdorigin=NavigationUrl
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.81&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1
142.250.203.110
https://amcdn.msftauth.net/me?partner=OneNoteOnline&version=10.22108.2&market=FR-FR&wrapperId=suiteshell
13.107.246.60
https://insacentre-my.sharepoint.com/personal/christel_chevereau_insa-cvl_fr/_layouts/15/Doc.aspx?sourcedoc=%7B5c627324-b4e6-4967-a31a-5c2e2767a2a0%7D&action=default&slrid=e6036ba0-60ed-5000-3b56-ec6f32cafafb&originalPath=aHR0cHM6Ly9pbnNhY2VudHJlLW15LnNoYXJlcG9pbnQuY29tLzpvOi9nL3BlcnNvbmFsL2NocmlzdGVsX2NoZXZlcmVhdV9pbnNhLWN2bF9mci9FaVJ6WWx6bXRHZEpveHBjTGlkbm9xQUJkV18xMjVNQlg0bXh6bkdybTkzeXJBP3J0aW1lPTNTSGZoa1NsMmtn&cid=b4d974bd-1cf6-430c-b9ae-4dde6b87b7da
13.107.136.9
https://kccarpetsandfloorings.com/huest/test.php
68.65.120.250
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard
142.250.203.109

Domains

Name
IP
Malicious
b-0016.b-msedge.net
13.107.6.171
kccarpetsandfloorings.com
68.65.120.250
i-dub01p-cor003.api.p001.1drv.com
40.90.128.21
accounts.google.com
142.250.203.109
part-0032.t-0009.t-msedge.net
13.107.246.60
www.google.com
142.250.203.100
clients.l.google.com
142.250.203.110
byzo.pages.dev
188.114.97.3
dual-spo-0004.spo-msedge.net
13.107.136.9
onenoteonlinesync.onenote.com
unknown
augloop.office.com
unknown
storage.live.com
unknown
ajax.aspnetcdn.com
unknown
clients2.google.com
unknown
insacentre-my.sharepoint.com
unknown
amcdn.msftauth.net
unknown
spoprod-a.akamaihd.net
unknown
www.onenote.com
unknown
messaging.engagement.office.com
unknown
There are 9 hidden domains, click here to show them.

IPs

IP
Domain
Country
Malicious
192.168.2.1
unknown
unknown
142.250.203.110
clients.l.google.com
United States
13.107.136.9
dual-spo-0004.spo-msedge.net
United States
13.107.6.171
b-0016.b-msedge.net
United States
192.168.2.7
unknown
unknown
13.107.246.60
part-0032.t-0009.t-msedge.net
United States
142.250.203.109
accounts.google.com
United States
68.65.120.250
kccarpetsandfloorings.com
United States
142.250.203.100
www.google.com
United States
40.90.128.21
i-dub01p-cor003.api.p001.1drv.com
United States
239.255.255.250
unknown
Reserved
188.114.97.3
byzo.pages.dev
European Union
127.0.0.1
unknown
unknown
There are 3 hidden IPs, click here to show them.

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
ahfgeienlihckogmohjhadlkjgocpleb
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
gdaefkejpgkiemlaofpalmlakkmbjdnl
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
kmendfapggjehodndflmmgagdbamhnfd
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
mhjfbmdgcfjbbpaeojofohoefgiehjai
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
neajdppkdcdipfabeoofebfddakdcjhd
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
nkeimhogjdpnpccoofpliimaahmaaome
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
prefs.preference_reset_time
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}\LastWasDefault
S-1-5-21-3853321935-2125563209-4053062332-1002
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
gdaefkejpgkiemlaofpalmlakkmbjdnl
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
kmendfapggjehodndflmmgagdbamhnfd
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
neajdppkdcdipfabeoofebfddakdcjhd
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
nkeimhogjdpnpccoofpliimaahmaaome
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
nmmhkkegccagdldgiimedpiccmgmieda
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
nmmhkkegccagdldgiimedpiccmgmieda
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
nmmhkkegccagdldgiimedpiccmgmieda
HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
state
HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
StatusCodes
HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
StatusCodes
HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
state
HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
dr
HKEY_CURRENT_USER\Software\Google\Chrome\StabilityMetrics
user_experience_metrics.stability.exited_cleanly
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
media.cdm.origin_data
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
software_reporter.reporting
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
media.storage_id_salt
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
google.services.last_account_id
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
google.services.account_id
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
settings_reset_prompt.last_triggered_for_startup_urls
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
settings_reset_prompt.last_triggered_for_homepage
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
module_blocklist_cache_md5_digest
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
software_reporter.prompt_seed
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
default_search_provider_data.template_url_data
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
safebrowsing.incidents_sent
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
pinned_tabs
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
browser.show_home_button
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
search_provider_overrides
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
settings_reset_prompt.last_triggered_for_default_search
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
prefs.preference_reset_time
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
software_reporter.prompt_version
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
google.services.last_username
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
session.startup_urls
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
session.restore_on_startup
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
settings_reset_prompt.prompt_wave
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
homepage
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
homepage_is_newtabpage
HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
lastrun
HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
lastrun
HKEY_USERSS-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry
TraceTimeLast
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}\LastWasDefault
S-1-5-21-3853321935-2125563209-4053062332-1002
HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
state
HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
StatusCodes
HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
StatusCodes
HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
state
There are 42 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
26691875000
heap
page read and write
215AEA00000
heap
page read and write
A6CC1FC000
stack
page read and write
23A87213000
heap
page read and write
20E30B13000
heap
page read and write
26691829000
heap
page read and write
2669184F000
heap
page read and write
2669182D000
heap
page read and write
2911A613000
heap
page read and write
B283EFC000
stack
page read and write
215AF427000
heap
page read and write
23A87150000
heap
page read and write
1BC86100000
heap
page read and write
26691800000
heap
page read and write
266916D0000
heap
page read and write
A6CC5FE000
stack
page read and write
20E30A59000
heap
page read and write
28536C00000
heap
page read and write
A6CC3FE000
stack
page read and write
23A87200000
heap
page read and write
2669185E000
heap
page read and write
F73197E000
stack
page read and write
28536C7D000
heap
page read and write
B28387B000
stack
page read and write
215AEA5C000
heap
page read and write
215AF354000
heap
page read and write
B283FFC000
stack
page read and write
215AEA77000
heap
page read and write
1BC858C3000
heap
page read and write
26691862000
heap
page read and write
2669184B000
heap
page read and write
26692002000
trusted library allocation
page read and write
24431E2A000
heap
page read and write
52264FF000
stack
page read and write
2911A600000
heap
page read and write
20E30A4A000
heap
page read and write
2669187E000
heap
page read and write
215AF371000
heap
page read and write
F73137A000
stack
page read and write
A6CC17C000
stack
page read and write
23A87302000
heap
page read and write
23A87264000
heap
page read and write
215AF400000
heap
page read and write
20E30A4A000
heap
page read and write
28536D13000
heap
page read and write
28536C13000
heap
page read and write
F731A7F000
stack
page read and write
B283B7F000
stack
page read and write
522607F000
stack
page read and write
2911AE02000
trusted library allocation
page read and write
26691760000
trusted library allocation
page read and write
A6CBFFF000
stack
page read and write
5225E7F000
stack
page read and write
20E30A5A000
heap
page read and write
A34827B000
stack
page read and write
F73167E000
stack
page read and write
23A87A02000
trusted library allocation
page read and write
1BC858E1000
heap
page read and write
24431C40000
heap
page read and write
215AEA43000
heap
page read and write
E520C7E000
stack
page read and write
2911A5F0000
remote allocation
page read and write
26691861000
heap
page read and write
E520F7E000
stack
page read and write
20E30840000
heap
page read and write
215AEA79000
heap
page read and write
D640E7D000
stack
page read and write
215AEB8E000
heap
page read and write
52263FA000
stack
page read and write
28536C3D000
heap
page read and write
1BC85780000
heap
page read and write
20E30A49000
heap
page read and write
28536C78000
heap
page read and write
26691896000
heap
page read and write
20E30A74000
heap
page read and write
215AE840000
heap
page read and write
20E30850000
heap
page read and write
2669185F000
heap
page read and write
A34817B000
stack
page read and write
23A87279000
heap
page read and write
D640AFE000
stack
page read and write
D640BFE000
stack
page read and write
26691846000
heap
page read and write
24431E00000
heap
page read and write
20E323E0000
remote allocation
page read and write
1BC8586E000
heap
page read and write
24431E4B000
heap
page read and write
215AF394000
heap
page read and write
28537350000
trusted library allocation
page read and write
26691854000
heap
page read and write
24431E20000
heap
page read and write
1BC858BB000
heap
page read and write
26691813000
heap
page read and write
522617C000
stack
page read and write
23A8723E000
heap
page read and write
D640CFD000
stack
page read and write
2911A657000
heap
page read and write
E52079B000
stack
page read and write
215AEA71000
heap
page read and write
215AF413000
heap
page read and write
215AF302000
heap
page read and write
215AEA94000
heap
page read and write
2911A702000
heap
page read and write
26691877000
heap
page read and write
20E30A2A000
heap
page read and write
D640A7E000
stack
page read and write
23A87140000
heap
page read and write
28536BF0000
heap
page read and write
215AF430000
heap
page read and write
24432602000
trusted library allocation
page read and write
215AE830000
heap
page read and write
A6CC2FF000
stack
page read and write
D640D7E000
stack
page read and write
26691848000
heap
page read and write
24431E45000
heap
page read and write
215AEA6C000
heap
page read and write
215AF3C0000
heap
page read and write
215AEA58000
heap
page read and write
26691864000
heap
page read and write
215AEA85000
heap
page read and write
5225AAC000
stack
page read and write
2911A450000
heap
page read and write
266916C0000
heap
page read and write
24431E3C000
heap
page read and write
24431C30000
heap
page read and write
2911A602000
heap
page read and write
23A871E0000
trusted library allocation
page read and write
1BC85823000
heap
page read and write
A6CC4FD000
stack
page read and write
28536C5B000
heap
page read and write
215AEBE5000
heap
page read and write
28536C02000
heap
page read and write
24431E02000
heap
page read and write
26691869000
heap
page read and write
26691841000
heap
page read and write
20E30A00000
heap
page read and write
A34847E000
stack
page read and write
20E30A6A000
heap
page read and write
20E323A0000
trusted library allocation
page read and write
23A87300000
heap
page read and write
2911A5F0000
remote allocation
page read and write
1BC85813000
heap
page read and write
F731C7E000
stack
page read and write
20E309D0000
trusted library allocation
page read and write
215AF300000
heap
page read and write
26691845000
heap
page read and write
28537402000
trusted library allocation
page read and write
28536C35000
heap
page read and write
26691902000
heap
page read and write
26691830000
heap
page read and write
D640FFE000
stack
page read and write
20E309B0000
trusted library allocation
page read and write
215AEA64000
heap
page read and write
2911A5F0000
remote allocation
page read and write
9E67B7C000
stack
page read and write
F73187F000
stack
page read and write
215AEA3C000
heap
page read and write
20E30B00000
heap
page read and write
1BC858CC000
heap
page read and write
A6CB92B000
stack
page read and write
23A87313000
heap
page read and write
2911A634000
heap
page read and write
215AF423000
heap
page read and write
2669187A000
heap
page read and write
A6CBEFE000
stack
page read and write
1BC85800000
heap
page read and write
215AEBB9000
heap
page read and write
2669183D000
heap
page read and write
F73147E000
stack
page read and write
20E308B0000
heap
page read and write
26691860000
heap
page read and write
2911A629000
heap
page read and write
2669187B000
heap
page read and write
26691883000
heap
page read and write
2911A4C0000
heap
page read and write
20E30A13000
heap
page read and write
215AE8A0000
heap
page read and write
F73177D000
stack
page read and write
B283D7E000
stack
page read and write
215AF3C9000
heap
page read and write
A347E7B000
stack
page read and write
F730F3C000
stack
page read and write
20E30B18000
heap
page read and write
215AEA89000
heap
page read and write
28536C29000
heap
page read and write
B283C7E000
stack
page read and write
26691874000
heap
page read and write
A6CBD7C000
stack
page read and write
D640F7D000
stack
page read and write
9E67D79000
stack
page read and write
24431E52000
heap
page read and write
26691867000
heap
page read and write
20E30A3D000
heap
page read and write
23A87268000
heap
page read and write
52265FB000
stack
page read and write
24431E2F000
heap
page read and write
20E323E0000
remote allocation
page read and write
28536C58000
heap
page read and write
23A87228000
heap
page read and write
28536B90000
heap
page read and write
24431D90000
trusted library allocation
page read and write
E520A7E000
stack
page read and write
2911A63C000
heap
page read and write
215AE9C0000
trusted library allocation
page read and write
1BC857B0000
trusted library allocation
page read and write
23A871B0000
heap
page read and write
24431F02000
heap
page read and write
215AEA2A000
heap
page read and write
9E6774B000
stack
page read and write
215AF322000
heap
page read and write
26691863000
heap
page read and write
1BC86002000
heap
page read and write
215AEA13000
heap
page read and write
26691842000
heap
page read and write
1BC85843000
heap
page read and write
A34837B000
stack
page read and write
20E32600000
trusted library allocation
page read and write
1BC86132000
heap
page read and write
1BC85902000
heap
page read and write
52262FE000
stack
page read and write
20E30B02000
heap
page read and write
215AEB13000
heap
page read and write
20E32402000
trusted library allocation
page read and write
23A87255000
heap
page read and write
1BC85710000
heap
page read and write
2911A460000
heap
page read and write
5225EFF000
stack
page read and write
24431E37000
heap
page read and write
1BC85720000
heap
page read and write
26691849000
heap
page read and write
20E30A5A000
heap
page read and write
26691866000
heap
page read and write
215AEA66000
heap
page read and write
215AF402000
heap
page read and write
215AF3B2000
heap
page read and write
28536D02000
heap
page read and write
26691847000
heap
page read and write
1BC85887000
heap
page read and write
F731B7F000
stack
page read and write
26691840000
heap
page read and write
20E323E0000
remote allocation
page read and write
A6CC07C000
stack
page read and write
B2840FE000
stack
page read and write
215AF343000
heap
page read and write
52261F9000
stack
page read and write
215AE9A0000
trusted library allocation
page read and write
E520D7E000
stack
page read and write
26691730000
heap
page read and write
2911A5C0000
trusted library allocation
page read and write
215AEA91000
heap
page read and write
2669182E000
heap
page read and write
24431C90000
heap
page read and write
B2841FE000
stack
page read and write
1BC85913000
heap
page read and write
E520E7F000
stack
page read and write
20E30A02000
heap
page read and write
E520AFE000
stack
page read and write
F73157C000
stack
page read and write
26691839000
heap
page read and write
23A87202000
heap
page read and write
24431E13000
heap
page read and write
215AF322000
heap
page read and write
1BC85829000
heap
page read and write
215AF202000
heap
page read and write
9E67E7F000
stack
page read and write
26691844000
heap
page read and write
28536B80000
heap
page read and write
D64058B000
stack
page read and write
9E67C7F000
stack
page read and write
There are 259 hidden memdumps, click here to show them.

DOM / HTML

URL
Malicious
https://byzo.pages.dev/
 malicious
https://insacentre-my.sharepoint.com/:o:/g/personal/christel_chevereau_insa-cvl_fr/EiRzYlzmtGdJoxpcLidnoqABdW_125MBX4mxznGrm93yrA?rtime=3SHfhkSl2kg
https://euc-onenote.officeapps.live.com/o/onenoteframe.aspx?ui=fr%2DFR&rs=fr%2DFR&wopisrc=https%3A%2F%2Finsacentre-my.sharepoint.com%2Fpersonal%2Fchristel_chevereau_insa-cvl_fr%2F_vti_bin%2Fwopi.ashx%2Ffolders%2F5c627324b4e64967a31a5c2e2767a2a0&wdenableroaming=1&mscc=0&wdodb=1&hid=E7036BA0-4004-5000-4704-8C7977F963C9&wdorigin=Sharing&wdhostclicktime=1664836694371&jsapi=1&jsapiver=v1&newsession=1&corrid=f4fb35ab-872b-4831-80cd-60f1741f9c31&usid=f4fb35ab-872b-4831-80cd-60f1741f9c31&sftc=1&cac=1&mtf=1&sfp=1&readonly=1&wdredirectionreason=Force_SingleStepBoot&rct=Medium&ctp=LeastProtected
https://insacentre-my.sharepoint.com/personal/christel_chevereau_insa-cvl_fr/_layouts/15/Doc.aspx?sourcedoc={5c627324-b4e6-4967-a31a-5c2e2767a2a0}&action=view&wd=target%28SPRECHER%20AG.one%7C4af76c2d-7b46-4be7-8c10-3c777d3ccd90%2FSPRECHER%20AG%7Ce1b01870-4c86-4aa6-abd5-d2ff398d2087%2F%29&wdorigin=NavigationUrl