IOC Report
Markelcorp Pay Application November 29, 2022_11725512247820161423.html

loading gif

Processes

Path
Cmdline
Malicious
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\Desktop\Markelcorp Pay Application November 29, 2022_11725512247820161423.html
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=1800,i,1373531813002401801,16495176252513405895,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8

URLs

Name
IP
Malicious
file:///C:/Users/user/Desktop/Markelcorp%20Pay%20Application%20November%2029,%202022_11725512247820161423.html
https://dreams15.co/csc/host9/0f70e1a.php
192.185.196.50
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.css
104.17.25.14
file:///C:/Users/user/Desktop/Markelcorp%20Pay%20Application%20November%2029,%202022_11725512247820161423.html#
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.102&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1
142.250.185.206
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard
142.250.186.109
https://aadcdn.msauthimages.net/dbd5a2dd-ttl-x9zsondwno6uogaxggczkbj5okcite29gtm-6do/logintenantbranding/0/bannerlogo?ts=636450702596912772
152.199.23.72

Domains

Name
IP
Malicious
part-0017.t-0009.t-msedge.net
13.107.213.45
accounts.google.com
142.250.186.109
cdnjs.cloudflare.com
104.17.25.14
www.google.com
172.217.16.132
clients.l.google.com
142.250.185.206
cs1025.wpc.upsiloncdn.net
152.199.23.72
dreams15.co
192.185.196.50
aadcdn.msauthimages.net
unknown
c.s-microsoft.com
unknown
clients2.google.com
unknown
code.jquery.com
unknown
assets.onestore.ms
unknown
ajax.aspnetcdn.com
unknown
There are 3 hidden domains, click here to show them.

IPs

IP
Domain
Country
Malicious
142.250.186.68
unknown
United States
142.250.185.206
clients.l.google.com
United States
192.168.2.1
unknown
unknown
142.250.186.36
unknown
United States
152.199.23.72
cs1025.wpc.upsiloncdn.net
United States
13.107.213.45
part-0017.t-0009.t-msedge.net
United States
142.250.186.109
accounts.google.com
United States
239.255.255.250
unknown
Reserved
192.185.196.50
dreams15.co
United States
127.0.0.1
unknown
unknown
104.17.25.14
cdnjs.cloudflare.com
United States
There are 1 hidden IPs, click here to show them.

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
ahfgeienlihckogmohjhadlkjgocpleb
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
gdaefkejpgkiemlaofpalmlakkmbjdnl
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
kmendfapggjehodndflmmgagdbamhnfd
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
mhjfbmdgcfjbbpaeojofohoefgiehjai
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
neajdppkdcdipfabeoofebfddakdcjhd
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
nkeimhogjdpnpccoofpliimaahmaaome
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
prefs.preference_reset_time
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}\LastWasDefault
S-1-5-21-2660496737-530772487-1027249058-1001
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
gdaefkejpgkiemlaofpalmlakkmbjdnl
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
kmendfapggjehodndflmmgagdbamhnfd
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
neajdppkdcdipfabeoofebfddakdcjhd
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
nkeimhogjdpnpccoofpliimaahmaaome
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
nmmhkkegccagdldgiimedpiccmgmieda
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
nmmhkkegccagdldgiimedpiccmgmieda
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
nmmhkkegccagdldgiimedpiccmgmieda
HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
state
HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
StatusCodes
HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
StatusCodes
HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
state
HKEY_CURRENT_USER\Software\Google\Chrome\StabilityMetrics
user_experience_metrics.stability.exited_cleanly
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
media.cdm.origin_data
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
software_reporter.reporting
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
media.storage_id_salt
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
google.services.last_account_id
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
google.services.account_id
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
settings_reset_prompt.last_triggered_for_startup_urls
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
settings_reset_prompt.last_triggered_for_homepage
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
module_blocklist_cache_md5_digest
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
software_reporter.prompt_seed
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
default_search_provider_data.template_url_data
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
safebrowsing.incidents_sent
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
pinned_tabs
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
browser.show_home_button
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
search_provider_overrides
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
settings_reset_prompt.last_triggered_for_default_search
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
prefs.preference_reset_time
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
software_reporter.prompt_version
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
google.services.last_username
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
session.startup_urls
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
session.restore_on_startup
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
settings_reset_prompt.prompt_wave
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
homepage
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
homepage_is_newtabpage
HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
lastrun
HKEY_USERSS-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry
TraceTimeLast
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}\LastWasDefault
S-1-5-21-2660496737-530772487-1027249058-1001
There are 36 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
2A89C93E000
heap
page read and write
F185FFF000
stack
page read and write
2A89BF95000
heap
page read and write
2A89BFEB000
heap
page read and write
2A89CBB5000
heap
page read and write
2A89C93E000
heap
page read and write
2A89BFE0000
heap
page read and write
2A89BF55000
heap
page read and write
2A89BFF3000
heap
page read and write
2A89BFAA000
heap
page read and write
2A89BFC9000
heap
page read and write
2A89CBB2000
heap
page read and write
2A89BFD5000
heap
page read and write
2A89BFB9000
heap
page read and write
2A89BFC9000
heap
page read and write
2A89BFE0000
heap
page read and write
2A89BF7E000
heap
page read and write
2A89BF90000
heap
page read and write
2A89BF83000
heap
page read and write
2A89BFAB000
heap
page read and write
F185EFF000
stack
page read and write
2A89C938000
heap
page read and write
2A89BF88000
heap
page read and write
2A89BFB9000
heap
page read and write
2A89C943000
heap
page read and write
2A89BF90000
heap
page read and write
2A89BFAB000
heap
page read and write
2A89BFB3000
heap
page read and write
2A89BFA3000
heap
page read and write
2A89BF88000
heap
page read and write
2A89BFB9000
heap
page read and write
2A89BFA8000
heap
page read and write
2A89BF48000
heap
page read and write
2A89BF9F000
heap
page read and write
2A89BF7F000
heap
page read and write
2A89BFE5000
heap
page read and write
2A89BF35000
heap
page read and write
2A89BF08000
heap
page read and write
2A89BF97000
heap
page read and write
2A89BF9B000
heap
page read and write
2A89BF9B000
heap
page read and write
2A89CBBE000
heap
page read and write
2A89CBB0000
heap
page read and write
2A89BF72000
heap
page read and write
2A89BF7F000
heap
page read and write
F18607E000
stack
page read and write
2A89BF4C000
heap
page read and write
2A89BF6A000
heap
page read and write
2A89CBCC000
heap
page read and write
2A89BF62000
heap
page read and write
2A89C930000
heap
page read and write
2A89BFED000
heap
page read and write
2A89BFEB000
heap
page read and write
2A89BFD0000
heap
page read and write
2A89BFEB000
heap
page read and write
2A89CBB4000
heap
page read and write
2A89BFC4000
heap
page read and write
2A89BFED000
heap
page read and write
2A89C1E0000
heap
page read and write
2A89CBBB000
heap
page read and write
2A89BFDA000
heap
page read and write
2A89CBC9000
heap
page read and write
2A89BF33000
heap
page read and write
2A89BFF6000
heap
page read and write
2A89CBD1000
heap
page read and write
2A89BFE0000
heap
page read and write
2A89BF6B000
heap
page read and write
2A89BF8A000
heap
page read and write
2A89CBD6000
heap
page read and write
2A89BFCD000
heap
page read and write
2A89BFB6000
heap
page read and write
2A89BFD7000
heap
page read and write
2A89CBBA000
heap
page read and write
2A89BF79000
heap
page read and write
2A89BFB6000
heap
page read and write
2A89C94B000
heap
page read and write
2A89BF42000
heap
page read and write
2A89BF79000
heap
page read and write
2A89BF90000
heap
page read and write
2A89BF9F000
heap
page read and write
2A89BFA9000
heap
page read and write
2A89BFB4000
heap
page read and write
2A89BF2B000
heap
page read and write
2A89BF5A000
heap
page read and write
2A89BFED000
heap
page read and write
2A89BFBC000
heap
page read and write
2A89BF79000
heap
page read and write
F185E7B000
stack
page read and write
2A89BFED000
heap
page read and write
2A89BFE0000
heap
page read and write
2A89BFC9000
heap
page read and write
2A89BFE5000
heap
page read and write
2A89CBCE000
heap
page read and write
2A89BF7D000
heap
page read and write
2A89BF77000
heap
page read and write
2A89BFC4000
heap
page read and write
2A89BFA9000
heap
page read and write
2A89BF1F000
heap
page read and write
2A89BE80000
heap
page read and write
2A89BF2E000
heap
page read and write
2A89BFF3000
heap
page read and write
2A89BFBC000
heap
page read and write
2A89C93E000
heap
page read and write
2A89C951000
heap
page read and write
2A89BFD5000
heap
page read and write
2A89CBBA000
heap
page read and write
2A89BF81000
heap
page read and write
2A89BF81000
heap
page read and write
2A89BFB4000
heap
page read and write
2A89BFD7000
heap
page read and write
F185B2F000
stack
page read and write
2A89C93E000
heap
page read and write
2A89BFF2000
heap
page read and write
2A89BF84000
heap
page read and write
2A89BFFE000
heap
page read and write
2A89CBBA000
heap
page read and write
2A89BFCD000
heap
page read and write
2A89BF6E000
heap
page read and write
2A89BF85000
heap
page read and write
2A89BF4E000
heap
page read and write
2A89BFE5000
heap
page read and write
2A89BF92000
heap
page read and write
2A89BFA3000
heap
page read and write
2A89C0D0000
heap
page read and write
2A89BFED000
heap
page read and write
2A89BFC4000
heap
page read and write
2A89C94E000
heap
page read and write
2A89BFC1000
heap
page read and write
2A89BFF0000
heap
page read and write
2A89BFFE000
heap
page read and write
2A89BF1A000
heap
page read and write
2A89BF7F000
heap
page read and write
2A89BFC9000
heap
page read and write
2A89BFC4000
heap
page read and write
2A89CB90000
heap
page read and write
2A89BF5E000
heap
page read and write
2A89C945000
heap
page read and write
2A89CBB3000
heap
page read and write
2A89BED0000
heap
page read and write
2A89BF9B000
heap
page read and write
2A89BFD5000
heap
page read and write
2A89BF9B000
heap
page read and write
2A89BFBC000
heap
page read and write
2A89BF99000
heap
page read and write
2A89C1E5000
heap
page read and write
2A89BFA3000
heap
page read and write
2A89C938000
heap
page read and write
2A89BFF2000
heap
page read and write
2A89BFB4000
heap
page read and write
2A89CBB7000
heap
page read and write
2A89BF9B000
heap
page read and write
2A89BF4E000
heap
page read and write
2A89BF9E000
heap
page read and write
2A89C941000
heap
page read and write
2A89BFD5000
heap
page read and write
2A89BFA8000
heap
page read and write
2A89BFDD000
heap
page read and write
2A89BF42000
heap
page read and write
2A89BFE5000
heap
page read and write
2A89C953000
heap
page read and write
2A89CBD4000
heap
page read and write
F185F7C000
stack
page read and write
2A89BFF2000
heap
page read and write
2A89CBB7000
heap
page read and write
2A89BFB6000
heap
page read and write
2A89CBC7000
heap
page read and write
2A89BF90000
heap
page read and write
2A89CBC0000
heap
page read and write
2A89BF90000
heap
page read and write
2A89BF63000
heap
page read and write
2A89BFB4000
heap
page read and write
2A89BFA9000
heap
page read and write
F185BAF000
stack
page read and write
2A89BFDD000
heap
page read and write
2A89BF00000
heap
page read and write
2A89BFF9000
heap
page read and write
F185AA7000
stack
page read and write
2A89CBCB000
heap
page read and write
2A89BFAB000
heap
page read and write
2A89BFC9000
heap
page read and write
There are 170 hidden memdumps, click here to show them.

DOM / HTML

URL
Malicious
file:///C:/Users/user/Desktop/Markelcorp%20Pay%20Application%20November%2029,%202022_11725512247820161423.html
 malicious
file:///C:/Users/user/Desktop/Markelcorp%20Pay%20Application%20November%2029,%202022_11725512247820161423.html#
 malicious