IOC Report
http://forum-thailande.com/

loading gif

Files

File Path
Type
Category
Malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 25 21:46:11 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 25 21:46:11 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 25 21:46:11 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 25 21:46:11 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 25 21:46:11 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
Chrome Cache Entry: 100
SVG Scalable Vector Graphics image
dropped
Chrome Cache Entry: 101
PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced
downloaded
Chrome Cache Entry: 102
PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced
dropped
Chrome Cache Entry: 103
PNG image data, 400 x 114, 8-bit colormap, non-interlaced
dropped
Chrome Cache Entry: 104
JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 1618x1011, components 3
downloaded
Chrome Cache Entry: 105
PNG image data, 80 x 42, 8-bit colormap, non-interlaced
dropped
Chrome Cache Entry: 106
JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 1618x1011, components 3
dropped
Chrome Cache Entry: 107
ASCII text, with no line terminators
downloaded
Chrome Cache Entry: 108
PNG image data, 400 x 114, 8-bit colormap, non-interlaced
downloaded
Chrome Cache Entry: 109
Web Open Font Format (Version 2), TrueType, length 30908, version 1.0
downloaded
Chrome Cache Entry: 77
JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, progressive, precision 8, 1618x1011, components 3
dropped
Chrome Cache Entry: 78
Unicode text, UTF-8 text
dropped
Chrome Cache Entry: 79
Unicode text, UTF-8 text
downloaded
Chrome Cache Entry: 80
PNG image data, 80 x 42, 8-bit colormap, non-interlaced
downloaded
Chrome Cache Entry: 81
PNG image data, 16 x 16, 8-bit colormap, non-interlaced
dropped
Chrome Cache Entry: 82
ASCII text, with very long lines (32038)
dropped
Chrome Cache Entry: 83
Web Open Font Format (Version 2), TrueType, length 14940, version 1.0
downloaded
Chrome Cache Entry: 84
ASCII text, with very long lines (32038)
downloaded
Chrome Cache Entry: 85
JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, progressive, precision 8, 1618x1011, components 3
dropped
Chrome Cache Entry: 86
Unicode text, UTF-8 text, with very long lines (20952)
dropped
Chrome Cache Entry: 87
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 88
HTML document, Unicode text, UTF-8 text, with very long lines (4099), with CRLF line terminators
downloaded
Chrome Cache Entry: 89
ASCII text, with very long lines (2343)
downloaded
Chrome Cache Entry: 90
Web Open Font Format, TrueType, length 7852, version 1.0
downloaded
Chrome Cache Entry: 91
ASCII text, with CRLF line terminators
downloaded
Chrome Cache Entry: 92
JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, progressive, precision 8, 1618x1011, components 3
downloaded
Chrome Cache Entry: 93
JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, progressive, precision 8, 1618x1011, components 3
downloaded
Chrome Cache Entry: 94
ASCII text, with very long lines (2343)
dropped
Chrome Cache Entry: 95
HTML document, ASCII text, with very long lines (7279)
downloaded
Chrome Cache Entry: 96
PNG image data, 16 x 16, 8-bit colormap, non-interlaced
downloaded
Chrome Cache Entry: 97
Unicode text, UTF-8 text, with very long lines (20952)
downloaded
Chrome Cache Entry: 98
ASCII text
downloaded
Chrome Cache Entry: 99
HTML document, ASCII text, with very long lines (7279)
dropped
There are 30 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2008 --field-trial-handle=2000,i,9062518207071933810,1206304948050960862,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://forum-thailande.com/"

URLs

Name
IP
Malicious
http://forum-thailande.com/
http://www.entypo.com/
unknown
http://www.siam-webagency.com
unknown
http://justgoodthemes.com/
unknown
http://danielbruce.se/
unknown
https://forum-thailande.com/images/siam-webagency-mini.png
172.67.182.85
https://forum-thailande.com/js/plugins.js
172.67.182.85
https://x.com/Forumthailande?mx=2
104.244.42.65
http://keith-wood.name/countdown.html
unknown
https://x.com/x/migrate
104.244.42.65
https://forum-thailande.com/
https://forum-thailande.com/images/logo-forum-thailande.png
172.67.182.85
https://forum-thailande.com/images/bg3.jpg
172.67.182.85
https://tagassistant.google.com/
unknown
https://x.com/Forumthailande
104.244.42.65
https://forum-thailande.com/js/modernizr-custom.js
172.67.182.85
https://ampcid.google.com/v1/publisher:getClientId
unknown
https://twitter.com/x/migrate?tok=7b2265223a222f466f72756d746861696c616e6465222c2274223a313732393839363434377dc3308bbd1887fd198a25b06b16b886e7
104.244.42.65
https://abs-0.twimg.com/emoji/v2/svg/26a0.svg
104.244.43.131
https://twitter.com/Forumthailande
104.244.42.65
http://jqueryvalidation.org/
unknown
https://abs.twimg.com/responsive-web/client-web/vendor.42364e5a.js
146.75.120.159
http://creativecommons.org/licenses/by-sa/3.0/us/
unknown
https://forum-thailande.com/css/style.css
172.67.182.85
https://forum-thailande.com/js/jquery-1.11.3.min.js
172.67.182.85
https://forum-thailande.com/images/favicon.png
172.67.182.85
https://www.google.com/ads/ga-audiences
unknown
https://www.google.%/ads/ga-audiences
unknown
https://forum-thailande.com/css/fonts/entypo.woff?mspppq
172.67.182.85
https://forum-thailande.com/js/scripts.js
172.67.182.85
https://abs.twimg.com/responsive-web/client-web/i18n/en.660e4f6a.js
146.75.120.159
https://abs.twimg.com/responsive-web/client-web/main.29798dca.js
146.75.120.159
https://forum-thailande.com/images/bg1.jpg
172.67.182.85
http://srobbin.com/jquery-plugins/backstretch/
unknown
https://stats.g.doubleclick.net/j/collect
unknown
https://forum-thailande.com/css/images/overlay.png
172.67.182.85
http://keith-wood.name/licence.html)
unknown
https://forum-thailande.com/images/bg2.jpg
172.67.182.85
http://modernizr.com/download/?-domprefixes-prefixed-prefixes-shiv-testallprops-testprop-teststyles
unknown
There are 28 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
twitter.com
104.244.42.65
dualstack.video.twitter.map.fastly.net
199.232.188.158
tpop-api.x.com
104.244.42.130
s-part-0017.t-0009.t-msedge.net
13.107.246.45
fp2e7a.wpc.phicdn.net
192.229.221.95
forum-thailande.com
172.67.182.85
tpop-api.twitter.com
104.244.42.130
bg.microsoft.map.fastly.net
199.232.214.172
t.co
162.159.140.229
twimg.twitter.map.fastly.net
146.75.120.159
abs-zero.twimg.com
104.244.43.131
www.google.com
142.250.185.132
x.com
104.244.42.65
abs.twimg.com
unknown
pbs.twimg.com
unknown
api.x.com
unknown
abs-0.twimg.com
unknown
video.twimg.com
unknown
api.twitter.com
unknown
There are 9 hidden domains, click here to show them.

IPs

IP
Domain
Country
Malicious
104.244.42.65
twitter.com
United States
162.159.140.229
t.co
United States
146.75.120.159
twimg.twitter.map.fastly.net
Sweden
142.250.185.132
www.google.com
United States
104.244.42.130
tpop-api.x.com
United States
192.168.2.5
unknown
unknown
192.168.2.10
unknown
unknown
239.255.255.250
unknown
Reserved
104.21.32.25
unknown
United States
199.232.188.158
dualstack.video.twitter.map.fastly.net
United States
104.244.43.131
abs-zero.twimg.com
United States
172.67.182.85
forum-thailande.com
United States
There are 2 hidden IPs, click here to show them.

DOM / HTML

URL
Malicious
https://forum-thailande.com/
https://forum-thailande.com/
https://forum-thailande.com/
https://forum-thailande.com/
https://forum-thailande.com/