IOC Report
https://signin.techinsights.com/passwordless/verify_redirect?scope=openid%20profile%20email&response_type=code&redirect_uri=https%3A%2F%2Fauth.svc.techinsights.com%2Fsaml%2FSSO&state=hKFo2SA0RndpWWpJODc5R3hsYzd1d3dObHJGQlB6dkpzWHBhb6FupWxvZ2luo3RpZNkgZ0ZvSUhKZURheUU3U0xPTXRDRjd5MXZ2YnA4V21URDWjY2lk2

loading gif

Files

File Path
Type
Category
Malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 20 15:27:09 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 20 15:27:09 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 20 15:27:09 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 20 15:27:09 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 20 15:27:09 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
Chrome Cache Entry: 64
ASCII text, with no line terminators
downloaded
Chrome Cache Entry: 65
Web Open Font Format (Version 2), TrueType, length 33116, version 1.0
downloaded
Chrome Cache Entry: 66
ASCII text
downloaded
Chrome Cache Entry: 67
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 68
Web Open Font Format (Version 2), TrueType, length 32236, version 1.0
downloaded
Chrome Cache Entry: 69
ASCII text
dropped
Chrome Cache Entry: 70
SVG Scalable Vector Graphics image
dropped
Chrome Cache Entry: 71
Web Open Font Format (Version 2), TrueType, length 31944, version 1.0
downloaded
Chrome Cache Entry: 72
ASCII text
downloaded
Chrome Cache Entry: 73
Unicode text, UTF-8 text, with very long lines (63861)
downloaded
There are 7 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1968,i,15999626710381135891,11917695017271450622,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://signin.techinsights.com/passwordless/verify_redirect?scope=openid%20profile%20email&response_type=code&redirect_uri=https%3A%2F%2Fauth.svc.techinsights.com%2Fsaml%2FSSO&state=hKFo2SA0RndpWWpJODc5R3hsYzd1d3dObHJGQlB6dkpzWHBhb6FupWxvZ2luo3RpZNkgZ0ZvSUhKZURheUU3U0xPTXRDRjd5MXZ2YnA4V21URDWjY2lk2SA1S2JiRkRzcWlHMVM1RjdBdG1UUnVMWk10Z2JRMUNjdQ&protocol=samlp&samlrequest=nZLNctowFEZfRaO9fxOC0WBSF4aWKWkIdrrIpiMLGau1JUe6Iu3bV4CdoTMdFl1K%2Bq7O1bma3v9qG3Tg2gglUxz5IUZcMrUTcp%2Fi52LpJfh%2BNjW0beKOZBZqueWvlhtArlAacj5JsdWSKGqEIZK23BBgJM8e1iT2Q9JpBYqpBqPMGK7BoeZKGttynXN9EIw%2Fb9cprgE6Q4KAOopvDswHzmohjdjXYHym2uAIC%2FL8EaOF60BICqeuh0KXlEL%2Bu6wLRl%2FKcrkwr%2BJTlI%2BW4wzaYmvXLw%2BwL5%2BiObMYrRYp%2Fl5WZXXDJnc8KUsasrCKRneVWyQJncSUOj8rYyxfSQNUQorjML71osiLwyK6JTdjEkd%2BMhm%2FYLTpn%2F1RyLPOa47Kc8iQz0Wx8TaPeYHRt2EsLoD7IZATXV%2Fav34xHZTjmXNBLuWQo%2BmQgLBWHIe0mwaXjIGY2%2FIHZ%2FBfyP6Kry6zWsx2mv7kfi2a5gOA2GtlO0mPIxrAfW5Y9uT3%2F3c%2B3qhGsN8oaxr1NtecAk8xaMsxWirdUrje3HFH7LzqFCWgqZPBJeBgoP79zWd%2FAA%3D%3D&app=app-launcher&login_hint=drake.hill%40ttigroupna.com&_csrf=9DVgb45q-1Eg18tLKUDsTIBrl3t6y9HYuro4&_intstate=deprecated&verification_code=054019&connection=email&client_id=5KbbFDsqiG1S5F7AtmTRuLZMtgbQ1Ccu&email=drake.hill%40ttigroupna.com"

URLs

Name
IP
Malicious
https://signin.techinsights.com/passwordless/verify_redirect?scope=openid%20profile%20email&response_type=code&redirect_uri=https%3A%2F%2Fauth.svc.techinsights.com%2Fsaml%2FSSO&state=hKFo2SA0RndpWWpJODc5R3hsYzd1d3dObHJGQlB6dkpzWHBhb6FupWxvZ2luo3RpZNkgZ0ZvSUhKZURheUU3U0xPTXRDRjd5MXZ2YnA4V21URDWjY2lk2SA1S2JiRkRzcWlHMVM1RjdBdG1UUnVMWk10Z2JRMUNjdQ&protocol=samlp&samlrequest=nZLNctowFEZfRaO9fxOC0WBSF4aWKWkIdrrIpiMLGau1JUe6Iu3bV4CdoTMdFl1K%2Bq7O1bma3v9qG3Tg2gglUxz5IUZcMrUTcp%2Fi52LpJfh%2BNjW0beKOZBZqueWvlhtArlAacj5JsdWSKGqEIZK23BBgJM8e1iT2Q9JpBYqpBqPMGK7BoeZKGttynXN9EIw%2Fb9cprgE6Q4KAOopvDswHzmohjdjXYHym2uAIC%2FL8EaOF60BICqeuh0KXlEL%2Bu6wLRl%2FKcrkwr%2BJTlI%2BW4wzaYmvXLw%2BwL5%2BiObMYrRYp%2Fl5WZXXDJnc8KUsasrCKRneVWyQJncSUOj8rYyxfSQNUQorjML71osiLwyK6JTdjEkd%2BMhm%2FYLTpn%2F1RyLPOa47Kc8iQz0Wx8TaPeYHRt2EsLoD7IZATXV%2Fav34xHZTjmXNBLuWQo%2BmQgLBWHIe0mwaXjIGY2%2FIHZ%2FBfyP6Kry6zWsx2mv7kfi2a5gOA2GtlO0mPIxrAfW5Y9uT3%2F3c%2B3qhGsN8oaxr1NtecAk8xaMsxWirdUrje3HFH7LzqFCWgqZPBJeBgoP79zWd%2FAA%3D%3D&app=app-launcher&login_hint=drake.hill%40ttigroupna.com&_csrf=9DVgb45q-1Eg18tLKUDsTIBrl3t6y9HYuro4&_intstate=deprecated&verification_code=054019&connection=email&client_id=5KbbFDsqiG1S5F7AtmTRuLZMtgbQ1Ccu&email=drake.hill%40ttigroupna.com
https://cdn.auth0.com/backend-templates/main.js?v=1
18.165.217.42
https://cdn.auth0.com/backend-templates/imgs/error-mouth.svg
18.165.217.42
https://cdn.auth0.com/backend-templates/main.css
18.165.217.42
http://opensource.org/licenses/MIT
unknown
https://cdn.auth0.com/styleguide/latest/lib/font/avenir-next/avenir-next-regular-italic.woff2
18.165.217.42
http://daneden.me/animate
unknown
https://signin.techinsights.com/favicon.ico
104.19.168.24
https://cdn.auth0.com/styleguide/latest/lib/font/avenir-next/avenir-next-medium.woff2
18.165.217.42
https://signin.techinsights.com/authorize/resume?state=r-fLZuTT-f4x2o1LPIUca9XnPcsL13eJ
https://cdn.auth0.com/styleguide/latest/lib/font/avenir-next/avenir-next-regular.woff2
18.165.217.42
http://www.bohemiancoding.com/sketch
unknown
https://cdn.auth0.com/styleguide/latest/index.min.css
18.165.217.42
There are 2 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
www.google.com
142.250.181.68
techinsights-auth2-cd-2mkmnn4elujq8xtb.edge.tenants.us.auth0.com
104.19.168.24
dp0wn1kjwhg75.cloudfront.net
18.165.217.42
signin.techinsights.com
unknown
cdn.auth0.com
unknown

IPs

IP
Domain
Country
Malicious
239.255.255.250
unknown
Reserved
142.250.181.68
www.google.com
United States
18.165.217.42
dp0wn1kjwhg75.cloudfront.net
United States
104.19.168.24
techinsights-auth2-cd-2mkmnn4elujq8xtb.edge.tenants.us.auth0.com
United States
192.168.2.5
unknown
unknown

DOM / HTML

URL
Malicious
https://signin.techinsights.com/authorize/resume?state=r-fLZuTT-f4x2o1LPIUca9XnPcsL13eJ
https://signin.techinsights.com/authorize/resume?state=r-fLZuTT-f4x2o1LPIUca9XnPcsL13eJ
https://signin.techinsights.com/authorize/resume?state=r-fLZuTT-f4x2o1LPIUca9XnPcsL13eJ