IOC Report
https://url.avanan.click/v2/r01/___https://www.tiktok.com/qnspdA7?fni=6cbb&qfsl=js&xhjsj=gnt_zwq&yfwljy=myyux:ddBBB.lttlqj.htr.gtdzwq?v=frudxdxrtxfilfrjx.htrd.iwtlt___.YXAzOnNvdXRoZXJua2l0Y2hlbmFuZGdyaWxsOmE6bzpjOGJiNWZiM2U4NjZhMDk1M2Y0MGVjY2U1MDhmYjQ4YTo3OmM4Y2I6MDdlZDdhNDI4N2UyMzc1NGJjZGQ1YjkyOWYy

loading gif

Files

File Path
Type
Category
Malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 7 14:04:02 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 7 14:04:02 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 7 14:04:02 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 7 14:04:02 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 7 14:04:02 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
Chrome Cache Entry: 61
MS Windows icon resource - 3 icons, 32x32, 32 bits/pixel, 24x24, 32 bits/pixel
dropped
Chrome Cache Entry: 62
ASCII text, with very long lines (47261)
downloaded
Chrome Cache Entry: 63
HTML document, ASCII text, with CRLF line terminators
downloaded
Chrome Cache Entry: 64
HTML document, ASCII text, with very long lines (8542)
downloaded
Chrome Cache Entry: 65
PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
dropped
Chrome Cache Entry: 66
PNG image data, 90 x 49, 8-bit/color RGB, non-interlaced
downloaded
Chrome Cache Entry: 67
ASCII text, with very long lines (47261)
dropped
Chrome Cache Entry: 68
MS Windows icon resource - 3 icons, 32x32, 32 bits/pixel, 24x24, 32 bits/pixel
downloaded
Chrome Cache Entry: 69
PNG image data, 90 x 49, 8-bit/color RGB, non-interlaced
dropped
Chrome Cache Entry: 70
HTML document, ASCII text
downloaded
Chrome Cache Entry: 71
PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
downloaded
There are 8 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 --field-trial-handle=2332,i,14535773166594397801,11605537149060957620,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://url.avanan.click/v2/r01/___https://www.tiktok.com/qnspdA7?fni=6cbb&qfsl=js&xhjsj=gnt_zwq&yfwljy=myyux:ddBBB.lttlqj.htr.gtdzwq?v=frudxdxrtxfilfrjx.htrd.iwtlt___.YXAzOnNvdXRoZXJua2l0Y2hlbmFuZGdyaWxsOmE6bzpjOGJiNWZiM2U4NjZhMDk1M2Y0MGVjY2U1MDhmYjQ4YTo3OmM4Y2I6MDdlZDdhNDI4N2UyMzc1NGJjZGQ1YjkyOWYyODg2OTI5ZDkyNzU0YTQ2NWI4MzhkYWZlMmM3NjA5ZGMyZGNmMzpoOlQ6VA#YnJhbmRvbi53YW5nQGludGVncmFjb25uZWN0LmNvbQ=="

URLs

Name
IP
Malicious
https://url.avanan.click/v2/r01/___https://www.tiktok.com/qnspdA7?fni=6cbb&qfsl=js&xhjsj=gnt_zwq&yfwljy=myyux:ddBBB.lttlqj.htr.gtdzwq?v=frudxdxrtxfilfrjx.htrd.iwtlt___.YXAzOnNvdXRoZXJua2l0Y2hlbmFuZGdyaWxsOmE6bzpjOGJiNWZiM2U4NjZhMDk1M2Y0MGVjY2U1MDhmYjQ4YTo3OmM4Y2I6MDdlZDdhNDI4N2UyMzc1NGJjZGQ1YjkyOWYyODg2OTI5ZDkyNzU0YTQ2NWI4MzhkYWZlMmM3NjA5ZGMyZGNmMzpoOlQ6VA#YnJhbmRvbi53YW5nQGludGVncmFjb25uZWN0LmNvbQ==
malicious
https://smosadgames.com/.drogo/#YnJhbmRvbi53YW5nQGludGVncmFjb25uZWN0LmNvbQ==
malicious
https://riaj.reviosn.com/NWgUDvGO#YnJhbmRvbi53YW5nQGludGVncmFjb25uZWN0LmNvbQ==
malicious
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/pat/8ceec85d68cc80d0/1728313457926/5ee27b9ed352dcdb0ce3666e9482571736d86aa1eaf54984bfa11335d83d2e84/y9dve74qE9Zw1Wm
104.18.94.41
https://url.avanan.click/v2/r01/___https://www.tiktok.com/qnspdA7?fni=6cbb&qfsl=js&xhjsj=gnt_zwq&yfwljy=myyux:ddBBB.lttlqj.htr.gtdzwq?v=frudxdxrtxfilfrjx.htrd.iwtlt___.YXAzOnNvdXRoZXJua2l0Y2hlbmFuZGdyaWxsOmE6bzpjOGJiNWZiM2U4NjZhMDk1M2Y0MGVjY2U1MDhmYjQ4YTo3OmM4Y2I6MDdlZDdhNDI4N2UyMzc1NGJjZGQ1YjkyOWYyODg2OTI5ZDkyNzU0YTQ2NWI4MzhkYWZlMmM3NjA5ZGMyZGNmMzpoOlQ6VA
108.138.7.80
https://challenges.cloudflare.com/turnstile/v0/g/ec4b873d446c/api.js
104.18.95.41
https://www.google.com.bo/amp/s/smosadgames.com/.drogo
172.217.18.3
https://smosadgames.com/.drogo/
50.6.194.123
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/i/8ceec85d68cc80d0/1728313457925/jClsVbx-dlvePMq
104.18.94.41
https://smosadgames.com/.drogo
50.6.194.123
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/871031589:1728311232:3M_iq3ekaETo0UWYxBDjOXsNiLotJ__kI5TADsXAOts/8ceec85d68cc80d0/5c8ec0c2c6e3cae
104.18.94.41
https://riaj.reviosn.com/owa/favicon.ico
188.114.96.3
https://smosadgames.com/favicon.ico
50.6.194.123
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/ty9w6/0x4AAAAAAAiTk1TsQcIM06cA/auto/fbE/normal/auto/
104.18.94.41
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/cmg/1/wh0E0SXYnx6pTBdJW%2Fl926I%2BPRUplRdtQz3K9lHXs%2Fs%3D
104.18.94.41
https://www.google.com.bo/url?q=amp%2Fs%2Fsmosadgames.com%2F.drogo&safe=active
172.217.18.3
https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback
104.18.95.41
https://riaj.reviosn.com/favicon.ico
188.114.96.3
https://riaj.reviosn.com/NWgUDvGO
188.114.96.3
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=8ceec85d68cc80d0&lang=auto
104.18.94.41
There are 9 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
challenges.cloudflare.com
104.18.95.41
d3bl0rsvnw97mw.cloudfront.net
108.138.7.80
www.google.com
142.250.186.36
smosadgames.com
50.6.194.123
www.google.com.bo
172.217.18.3
fp2e7a.wpc.phicdn.net
192.229.221.95
riaj.reviosn.com
188.114.96.3
url.avanan.click
unknown
www.tiktok.com
unknown

IPs

IP
Domain
Country
Malicious
142.250.186.36
www.google.com
United States
104.18.94.41
unknown
United States
172.217.18.3
www.google.com.bo
United States
192.168.2.16
unknown
unknown
104.18.95.41
challenges.cloudflare.com
United States
192.168.2.18
unknown
unknown
50.6.194.123
smosadgames.com
United States
192.168.2.5
unknown
unknown
239.255.255.250
unknown
Reserved
188.114.97.3
unknown
European Union
188.114.96.3
riaj.reviosn.com
European Union
108.138.7.80
d3bl0rsvnw97mw.cloudfront.net
United States
There are 2 hidden IPs, click here to show them.

DOM / HTML

URL
Malicious
https://smosadgames.com/.drogo/#YnJhbmRvbi53YW5nQGludGVncmFjb25uZWN0LmNvbQ==
https://riaj.reviosn.com/NWgUDvGO#YnJhbmRvbi53YW5nQGludGVncmFjb25uZWN0LmNvbQ==
https://riaj.reviosn.com/NWgUDvGO#YnJhbmRvbi53YW5nQGludGVncmFjb25uZWN0LmNvbQ==