IOC Report
https://atpscan.global.hornetsecurity.com/?d=NnVkJrcOtS6jUcSOl6gFYT9DOTvhRx9_0n2vBuK3wGL4RfM1M4gwz-cei5V3Dmlh&f=VRGvOaKnOixCQPnN5E8Zd55sAVwpSzujOffY4RbLuwaxI18GkkIlhnlDIOqXjYsl&i=&k=IMq7&m=Eg31PQDiRU2Qx94y2dnGUum54tAMBzZzPaQN8QexaGJVzCG-OVPo4Om5V2lRlns7wwMWrL4CnmlsokgWfWk2TbD2kmpRAVDDTYG9PjUhZhfW-Bw

loading gif

Files

File Path
Type
Category
Malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 25 14:09:02 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 25 14:09:02 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 5 07:00:51 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 25 14:09:02 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 25 14:09:02 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 25 14:09:02 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
Chrome Cache Entry: 100
ASCII text, with very long lines (18184), with no line terminators
dropped
Chrome Cache Entry: 101
HTML document, ASCII text, with very long lines (33584)
downloaded
Chrome Cache Entry: 102
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 103
PNG image data, 49 x 41, 8-bit colormap, non-interlaced
dropped
Chrome Cache Entry: 104
PNG image data, 40 x 41, 8-bit colormap, non-interlaced
downloaded
Chrome Cache Entry: 75
ASCII text, with very long lines (65536), with no line terminators
dropped
Chrome Cache Entry: 76
ASCII text, with very long lines (2713), with no line terminators
downloaded
Chrome Cache Entry: 77
JSON data
dropped
Chrome Cache Entry: 78
ASCII text
dropped
Chrome Cache Entry: 79
ASCII text, with very long lines (34317), with no line terminators
dropped
Chrome Cache Entry: 80
ASCII text, with no line terminators
downloaded
Chrome Cache Entry: 81
JSON data
downloaded
Chrome Cache Entry: 82
SVG Scalable Vector Graphics image
dropped
Chrome Cache Entry: 83
HTML document, ASCII text, with very long lines (2225), with CRLF line terminators
downloaded
Chrome Cache Entry: 84
HTML document, ASCII text, with very long lines (2225), with CRLF line terminators
downloaded
Chrome Cache Entry: 85
RIFF (little-endian) data, Web/P image, VP8 encoding, 1027x578, Scaling: [none]x[none], YUV color, decoders should clamp
downloaded
Chrome Cache Entry: 86
PNG image data, 49 x 41, 8-bit colormap, non-interlaced
downloaded
Chrome Cache Entry: 87
JSON data
dropped
Chrome Cache Entry: 88
JSON data
downloaded
Chrome Cache Entry: 89
ASCII text, with very long lines (2713), with no line terminators
dropped
Chrome Cache Entry: 90
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1027x578, components 3
dropped
Chrome Cache Entry: 91
ASCII text, with very long lines (18184), with no line terminators
downloaded
Chrome Cache Entry: 92
PNG image data, 495 x 309, 8-bit colormap, non-interlaced
dropped
Chrome Cache Entry: 93
PNG image data, 495 x 309, 8-bit colormap, non-interlaced
downloaded
Chrome Cache Entry: 94
Web Open Font Format (Version 2), TrueType, length 49920, version 1.0
downloaded
Chrome Cache Entry: 95
ASCII text, with very long lines (34317), with no line terminators
downloaded
Chrome Cache Entry: 96
ASCII text, with very long lines (8206)
downloaded
Chrome Cache Entry: 97
ASCII text, with very long lines (65536), with no line terminators
downloaded
Chrome Cache Entry: 98
PNG image data, 40 x 41, 8-bit colormap, non-interlaced
dropped
Chrome Cache Entry: 99
Web Open Font Format (Version 2), TrueType, length 48108, version 1.0
downloaded
There are 27 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1888,i,3762134228026261569,15155687349111113855,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://atpscan.global.hornetsecurity.com/?d=NnVkJrcOtS6jUcSOl6gFYT9DOTvhRx9_0n2vBuK3wGL4RfM1M4gwz-cei5V3Dmlh&f=VRGvOaKnOixCQPnN5E8Zd55sAVwpSzujOffY4RbLuwaxI18GkkIlhnlDIOqXjYsl&i=&k=IMq7&m=Eg31PQDiRU2Qx94y2dnGUum54tAMBzZzPaQN8QexaGJVzCG-OVPo4Om5V2lRlns7wwMWrL4CnmlsokgWfWk2TbD2kmpRAVDDTYG9PjUhZhfW-BwkapmD9W6_zQVWXFVN&n=KNtSaiODbNsJQEbSEZDwh34xn1itEQQfP1UznpoGI5WaWwC1dWtBevnqXGm5H-f7&r=2Ow9cKZ98a-5wptqW8Y-zAwN-MJuNt25fcQbqzqwDypDZl3_sT7dioYpzt-h-3hX&s=1f78a40d69089fa0743a8630bc133d18afc652a160161afdf52202844b072b54&u=https%3A%2F%2Ft.ly%2Fe_R6v"

URLs

Name
IP
Malicious
https://atpscan.global.hornetsecurity.com/?d=NnVkJrcOtS6jUcSOl6gFYT9DOTvhRx9_0n2vBuK3wGL4RfM1M4gwz-cei5V3Dmlh&f=VRGvOaKnOixCQPnN5E8Zd55sAVwpSzujOffY4RbLuwaxI18GkkIlhnlDIOqXjYsl&i=&k=IMq7&m=Eg31PQDiRU2Qx94y2dnGUum54tAMBzZzPaQN8QexaGJVzCG-OVPo4Om5V2lRlns7wwMWrL4CnmlsokgWfWk2TbD2kmpRAVDDTYG9PjUhZhfW-BwkapmD9W6_zQVWXFVN&n=KNtSaiODbNsJQEbSEZDwh34xn1itEQQfP1UznpoGI5WaWwC1dWtBevnqXGm5H-f7&r=2Ow9cKZ98a-5wptqW8Y-zAwN-MJuNt25fcQbqzqwDypDZl3_sT7dioYpzt-h-3hX&s=1f78a40d69089fa0743a8630bc133d18afc652a160161afdf52202844b072b54&u=https%3A%2F%2Ft.ly%2Fe_R6v
malicious
https://atpscan.global.hornetsecurity.com/?d=NnVkJrcOtS6jUcSOl6gFYT9DOTvhRx9_0n2vBuK3wGL4RfM1M4gwz-cei5V3Dmlh&f=VRGvOaKnOixCQPnN5E8Zd55sAVwpSzujOffY4RbLuwaxI18GkkIlhnlDIOqXjYsl&i=&k=IMq7&m=Eg31PQDiRU2Qx94y2dnGUum54tAMBzZzPaQN8QexaGJVzCG-OVPo4Om5V2lRlns7wwMWrL4CnmlsokgWfWk2TbD2kmpRAVDDTYG9PjUhZhfW-BwkapmD9W6_zQVWXFVN&n=KNtSaiODbNsJQEbSEZDwh34xn1itEQQfP1UznpoGI5WaWwC1dWtBevnqXGm5H-f7&r=2Ow9cKZ98a-5wptqW8Y-zAwN-MJuNt25fcQbqzqwDypDZl3_sT7dioYpzt-h-3hX&s=1f78a40d69089fa0743a8630bc133d18afc652a160161afdf52202844b072b54&u=https%3A%2F%2Ft.ly%2Fe_R6v
94.100.136.44
 malicious
https://407842.seu2.cleverreach.com/c/100263302/0a256ff41-slvagr
54.72.231.100
https://securelinks.cloud-security.net/Hornet-Regular.021743c5464be55c.woff2
94.100.133.74
https://securelinks.cloud-security.net/polyfills.607595976de3afd5.js
94.100.133.74
https://securelinks.cloud-security.net/main.2a45a72e85716257.js
94.100.133.74
https://securelinks.cloud-security.net/
unknown
https://securelinks.cloud-security.net/translations/en.json
94.100.133.74
https://i.pcmag.com/imagery/reviews/07LERcQBRVgcVKystB3aGUU-11.fit_scale.size_1028x578.v1569471957.j
unknown
https://securelinks.cloud-security.net/analyse
94.100.133.74
https://securelinks.cloud-security.net/images/load.svg
94.100.133.74
https://securelinks.cloud-security.net/images/shield-loop-solid.png
94.100.133.74
https://i.pcmag.com/imagery/reviews/07LERcQBRVgcVKystB3aGUU-11.fit_scale.size_1028x578.v1569471957.jpg
104.16.20.118
https://securelinks.cloud-security.net/app/config/config.json
94.100.133.74
https://t.ly/e_R6v
104.20.7.133
https://securelinks.cloud-security.net/images/completed.png
94.100.133.74
https://securelinks.cloud-security.net/v4?d=NnVkJrcOtS6jUcSOl6gFYT9DOTvhRx9_0n2vBuK3wGL4RfM1M4gwz-cei5V3Dmlh&f=VRGvOaKnOixCQPnN5E8Zd55sAVwpSzujOffY4RbLuwaxI18GkkIlhnlDIOqXjYsl&i=&k=IMq7&m=Eg31PQDiRU2Qx94y2dnGUum54tAMBzZzPaQN8QexaGJVzCG-OVPo4Om5V2lRlns7wwMWrL4CnmlsokgWfWk2TbD2kmpRAVDDTYG9PjUhZhfW-BwkapmD9W6_zQVWXFVN&n=KNtSaiODbNsJQEbSEZDwh34xn1itEQQfP1UznpoGI5WaWwC1dWtBevnqXGm5H-f7&r=2Ow9cKZ98a-5wptqW8Y-zAwN-MJuNt25fcQbqzqwDypDZl3_sT7dioYpzt-h-3hX&s=1f78a40d69089fa0743a8630bc133d18afc652a160161afdf52202844b072b54&u=https:%2F%2Ft.ly%2Fe_R6v
https://securelinks.cloud-security.net/runtime.931bdb8976401128.js
94.100.133.74
https://securelinks.cloud-security.net/v4?d=NnVkJrcOtS6jUcSOl6gFYT9DOTvhRx9_0n2vBuK3wGL4RfM1M4gwz-cei5V3Dmlh&f=VRGvOaKnOixCQPnN5E8Zd55sAVwpSzujOffY4RbLuwaxI18GkkIlhnlDIOqXjYsl&i=&k=IMq7&m=Eg31PQDiRU2Qx94y2dnGUum54tAMBzZzPaQN8QexaGJVzCG-OVPo4Om5V2lRlns7wwMWrL4CnmlsokgWfWk2TbD2kmpRAVDDTYG9PjUhZhfW-BwkapmD9W6_zQVWXFVN&n=KNtSaiODbNsJQEbSEZDwh34xn1itEQQfP1UznpoGI5WaWwC1dWtBevnqXGm5H-f7&r=2Ow9cKZ98a-5wptqW8Y-zAwN-MJuNt25fcQbqzqwDypDZl3_sT7dioYpzt-h-3hX&s=1f78a40d69089fa0743a8630bc133d18afc652a160161afdf52202844b072b54&u=https%3A%2F%2Ft.ly%2Fe_R6v
94.100.133.74
https://securelinks.cloud-security.net/redirect
94.100.133.74
https://securelinks.cloud-security.net/images/shield-check-solid.png
94.100.133.74
https://securelinks.cloud-security.net/styles.291c02806014e652.css
94.100.133.74
https://securelinks.cloud-security.net/895.cb1f795f6b72d74a.js
94.100.133.74
https://securelinks.cloud-security.net/Hornet-SemiBold.bf9154546071add8.woff2
94.100.133.74
There are 13 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
407842.seu2.cleverreach.com
54.72.231.100
t.ly
104.20.7.133
securelinks.cloud-security.net
94.100.133.74
atpscan.global.hornetsecurity.com
94.100.136.44
www.google.com
142.250.185.228
i.pcmag.com
104.16.20.118
fp2e7a.wpc.phicdn.net
192.229.221.95

IPs

IP
Domain
Country
Malicious
54.72.231.100
407842.seu2.cleverreach.com
United States
142.250.185.228
www.google.com
United States
104.16.21.118
unknown
United States
192.168.2.8
unknown
unknown
94.100.136.44
atpscan.global.hornetsecurity.com
Germany
94.100.133.74
securelinks.cloud-security.net
Germany
239.255.255.250
unknown
Reserved
104.16.20.118
i.pcmag.com
United States
104.20.7.133
t.ly
United States

DOM / HTML

URL
Malicious
https://securelinks.cloud-security.net/v4?d=NnVkJrcOtS6jUcSOl6gFYT9DOTvhRx9_0n2vBuK3wGL4RfM1M4gwz-cei5V3Dmlh&f=VRGvOaKnOixCQPnN5E8Zd55sAVwpSzujOffY4RbLuwaxI18GkkIlhnlDIOqXjYsl&i=&k=IMq7&m=Eg31PQDiRU2Qx94y2dnGUum54tAMBzZzPaQN8QexaGJVzCG-OVPo4Om5V2lRlns7wwMWrL4CnmlsokgWfWk2TbD2kmpRAVDDTYG9PjUhZhfW-BwkapmD9W6_zQVWXFVN&n=KNtSaiODbNsJQEbSEZDwh34xn1itEQQfP1UznpoGI5WaWwC1dWtBevnqXGm5H-f7&r=2Ow9cKZ98a-5wptqW8Y-zAwN-MJuNt25fcQbqzqwDypDZl3_sT7dioYpzt-h-3hX&s=1f78a40d69089fa0743a8630bc133d18afc652a160161afdf52202844b072b54&u=https:%2F%2Ft.ly%2Fe_R6v
https://potopoto.z13.web.core.windows.net/