IOC Report
https://t.dripemail3.com/c/eyJhbGciOiJIUzI1NiJ9.eyJhdWQiOiJkZXRvdXIiLCJpc3MiOiJtb25vbGl0aCIsInN1YiI6ImRldG91cl9saW5rIiwiaWF0IjoxNzI4MzEwODA2LCJuYmYiOjE3MjgzMTA4MDYsImFjY291bnRfaWQiOiIyNzYyNjA5IiwiZGVsaXZlcnlfaWQiOiJwODJtNGNzMzB4cXl2Zmh0NzQxaSIsInRva2VuIjoicDgybTRjczMweHF5dmZodDc0MWkiLCJzZW5kX2F0Ijox

loading gif

Files

File Path
Type
Category
Malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 7 14:56:24 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 7 14:56:24 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 7 14:56:24 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 7 14:56:24 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 7 14:56:24 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
Chrome Cache Entry: 100
MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
downloaded
Chrome Cache Entry: 72
ASCII text, with very long lines (32065)
downloaded
Chrome Cache Entry: 73
ASCII text, with very long lines (6791), with no line terminators
dropped
Chrome Cache Entry: 74
ASCII text, with very long lines (32065)
dropped
Chrome Cache Entry: 75
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 76
PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
dropped
Chrome Cache Entry: 77
PNG image data, 13 x 28, 8-bit/color RGB, non-interlaced
downloaded
Chrome Cache Entry: 78
ASCII text, with very long lines (65447)
dropped
Chrome Cache Entry: 79
SVG Scalable Vector Graphics image
dropped
Chrome Cache Entry: 80
ASCII text, with very long lines (47261)
dropped
Chrome Cache Entry: 81
SVG Scalable Vector Graphics image
dropped
Chrome Cache Entry: 82
SVG Scalable Vector Graphics image
dropped
Chrome Cache Entry: 83
HTML document, ASCII text
downloaded
Chrome Cache Entry: 84
ASCII text, with very long lines (6791), with no line terminators
downloaded
Chrome Cache Entry: 85
PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
downloaded
Chrome Cache Entry: 86
ASCII text, with no line terminators
downloaded
Chrome Cache Entry: 87
ASCII text, with very long lines (65447)
downloaded
Chrome Cache Entry: 88
ASCII text, with very long lines (47261)
downloaded
Chrome Cache Entry: 89
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 90
ASCII text, with very long lines (65536), with no line terminators
downloaded
Chrome Cache Entry: 91
HTML document, ASCII text, with very long lines (4928)
downloaded
Chrome Cache Entry: 92
SVG Scalable Vector Graphics image
dropped
Chrome Cache Entry: 93
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 94
ASCII text, with very long lines (3379)
downloaded
Chrome Cache Entry: 95
MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
dropped
Chrome Cache Entry: 96
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 97
ASCII text, with very long lines (50758)
downloaded
Chrome Cache Entry: 98
ASCII text, with very long lines (50758)
dropped
Chrome Cache Entry: 99
PNG image data, 13 x 28, 8-bit/color RGB, non-interlaced
dropped
There are 26 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1840,i,10789607078351078241,3572493302472614712,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://t.dripemail3.com/c/eyJhbGciOiJIUzI1NiJ9.eyJhdWQiOiJkZXRvdXIiLCJpc3MiOiJtb25vbGl0aCIsInN1YiI6ImRldG91cl9saW5rIiwiaWF0IjoxNzI4MzEwODA2LCJuYmYiOjE3MjgzMTA4MDYsImFjY291bnRfaWQiOiIyNzYyNjA5IiwiZGVsaXZlcnlfaWQiOiJwODJtNGNzMzB4cXl2Zmh0NzQxaSIsInRva2VuIjoicDgybTRjczMweHF5dmZodDc0MWkiLCJzZW5kX2F0IjoxNzI4MzA5NzMyLCJlbWFpbF9pZCI6OTk2NDE4NiwiZW1haWxhYmxlX3R5cGUiOiJCcm9hZGNhc3QiLCJlbWFpbGFibGVfaWQiOjM5NTQwMTYsInVybCI6Imh0dHBzOi8vZGFpbHlhbGFza2EuY29tL25ld3M_X19zPWw5bzljOTZzbG8xZjF3aGFiODZrJnV0bV9zb3VyY2U9ZHJpcCZ1dG1fbWVkaXVtPWVtYWlsJnV0bV9jYW1wYWlnbj0lRjAlOUYlOTElOEMrV2UrTWFkZStJdCtFYXN5K0ZvcitZb3UrJUYwJTlGJTkxJThDIn0.MNRoosOspCCWwx3VuYY41W-crcEzfjjfIELlO_QMAdM"

URLs

Name
IP
Malicious
https://t.dripemail3.com/c/eyJhbGciOiJIUzI1NiJ9.eyJhdWQiOiJkZXRvdXIiLCJpc3MiOiJtb25vbGl0aCIsInN1YiI6ImRldG91cl9saW5rIiwiaWF0IjoxNzI4MzEwODA2LCJuYmYiOjE3MjgzMTA4MDYsImFjY291bnRfaWQiOiIyNzYyNjA5IiwiZGVsaXZlcnlfaWQiOiJwODJtNGNzMzB4cXl2Zmh0NzQxaSIsInRva2VuIjoicDgybTRjczMweHF5dmZodDc0MWkiLCJzZW5kX2F0IjoxNzI4MzA5NzMyLCJlbWFpbF9pZCI6OTk2NDE4NiwiZW1haWxhYmxlX3R5cGUiOiJCcm9hZGNhc3QiLCJlbWFpbGFibGVfaWQiOjM5NTQwMTYsInVybCI6Imh0dHBzOi8vZGFpbHlhbGFza2EuY29tL25ld3M_X19zPWw5bzljOTZzbG8xZjF3aGFiODZrJnV0bV9zb3VyY2U9ZHJpcCZ1dG1fbWVkaXVtPWVtYWlsJnV0bV9jYW1wYWlnbj0lRjAlOUYlOTElOEMrV2UrTWFkZStJdCtFYXN5K0ZvcitZb3UrJUYwJTlGJTkxJThDIn0.MNRoosOspCCWwx3VuYY41W-crcEzfjjfIELlO_QMAdM
malicious
https://harmesmg.com/js_/670404c158f8e-62ba4cbda984ea2df3057eb8390e0d8c
104.21.23.186
 malicious
https://harmesmg.com/css_/Bk0skH0VKnC5GQh
104.21.23.186
 malicious
https://harmesmg.com/home6dca65610bad709b07a9e6041699d6ce
104.21.23.186
 malicious
https://harmesmg.com/%3C?php%20echo%20SVGBKG;%20?%3E
104.21.23.186
 malicious
https://harmesmg.com/&redirect=467dbb71ea415b9eb4af299f337a08a557ae6ee7main&uid=f253efe302d32ab264a76e0ce65be769670404c116662
malicious
https://harmesmg.com/js___/670404c158f86-62ba4cbda984ea2df3057eb8390e0d8c
104.21.23.186
 malicious
https://t.dripemail3.com/c/eyJhbGciOiJIUzI1NiJ9.eyJhdWQiOiJkZXRvdXIiLCJpc3MiOiJtb25vbGl0aCIsInN1YiI6ImRldG91cl9saW5rIiwiaWF0IjoxNzI4MzEwODA2LCJuYmYiOjE3MjgzMTA4MDYsImFjY291bnRfaWQiOiIyNzYyNjA5IiwiZGVsaXZlcnlfaWQiOiJwODJtNGNzMzB4cXl2Zmh0NzQxaSIsInRva2VuIjoicDgybTRjczMweHF5dmZodDc0MWkiLCJzZW5kX2F0IjoxNzI4MzA5NzMyLCJlbWFpbF9pZCI6OTk2NDE4NiwiZW1haWxhYmxlX3R5cGUiOiJCcm9hZGNhc3QiLCJlbWFpbGFibGVfaWQiOjM5NTQwMTYsInVybCI6Imh0dHBzOi8vZGFpbHlhbGFza2EuY29tL25ld3M_X19zPWw5bzljOTZzbG8xZjF3aGFiODZrJnV0bV9zb3VyY2U9ZHJpcCZ1dG1fbWVkaXVtPWVtYWlsJnV0bV9jYW1wYWlnbj0lRjAlOUYlOTElOEMrV2UrTWFkZStJdCtFYXN5K0ZvcitZb3UrJUYwJTlGJTkxJThDIn0.MNRoosOspCCWwx3VuYY41W-crcEzfjjfIELlO_QMAdM
23.22.106.69
 malicious
https://harmesmg.com/captcha/style.css
104.21.23.186
 malicious
https://harmesmg.com/captcha/logo.svg
104.21.23.186
 malicious
https://harmesmg.com/cdn-cgi/challenge-platform/h/g/rc/8cef14ec2b888c29
104.21.23.186
 malicious
https://harmesmg.com/logo_/68ae214891024d21f46f0db6cb776026670404c42b8ef
104.21.23.186
 malicious
https://harmesmg.com/favicon.ico
104.21.23.186
 malicious
https://harmesmg.com/sig/68ae214891024d21f46f0db6cb776026670404c42b933
104.21.23.186
 malicious
https://harmesmg.com/endpoint2c12176623711ee3913b50a64a6de7cesec?data=mail&email=hgjhghjgjh%40aol.com&_=1728316610376
104.21.23.186
 malicious
https://harmesmg.com/logo_/Cb8v7L0xnbUZCJD
104.21.23.186
 malicious
https://harmesmg.com/b_/670404c158f8d-62ba4cbda984ea2df3057eb8390e0d8c
104.21.23.186
 malicious
https://harmesmg.com/
malicious
https://harmesmg.com/fav/s9G0tr0IOlyQ1oA
104.21.23.186
 malicious
https://harmesmg.com/VkZ6ZVFsa1A0REpranpmrobotVkZ6ZVFsa1A0REpranpm
104.21.23.186
 malicious
https://dailyalaska.com/news/?__s=l9o9c96slo1f1whab86k&utm_source=drip&utm_medium=email&utm_campaign=%F0%9F%91%8C+We+Made+It+Easy+For+You+%F0%9F%91%8C
162.241.114.35
https://challenges.cloudflare.com/turnstile/v0/g/ec4b873d446c/api.js
104.18.95.41
https://code.jquery.com/jquery-3.6.0.min.js
151.101.194.137
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/593885740:1728315463:QEvZ1HiOoBQogM0yRR2m-igmMF_DCUtjMQMpy3zrY7g/8cef14ec2b888c29/ac3f70574c87d9b
104.18.94.41
https://a.nel.cloudflare.com/report/v4?s=j89aznBYGZX%2FKVwQ8TaxuNNXG5lFd7Mw%2F6l93XhoiY2P8Vjg6n%2B7cFuEOlx04%2F4xsiP8ofaA1%2BlNE3CG8BailTGska1y5ZEq1h7X7npWp3iLKAIkXLLk%2Bbr%2BlGW4vDU%3D
35.190.80.1
https://harmesmg.com
unknown
https://getbootstrap.com/)
unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=8cef14ec2b888c29&lang=auto
104.18.94.41
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/pat/8cef14ec2b888c29/1728316593724/565d402329806b0e0b1bb81f496f43867780d73d369807fad6a60f01d771e0cb/F-bN9h4xjeTkyvK
104.18.94.41
https://a.nel.cloudflare.com/report/v4?s=nIcguF3VCMyMrhdkg8LIxJaJYb9Udub%2FU4jCXc48pGARZQ70IjFLyCW89F5PuGYPyJkufHCvEecKjtXBce3BKubnRYskwwhkeXtX%2FbmK00k9OehMLd1Yvi3vqigxxR0%3D
35.190.80.1
https://github.com/twbs/bootstrap/graphs/contributors)
unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/i/8cef14ec2b888c29/1728316593729/L9YnqAj51e-zh63
104.18.94.41
https://dailyalaska.com/news?__s=l9o9c96slo1f1whab86k&utm_source=drip&utm_medium=email&utm_campaign=%F0%9F%91%8C+We+Made+It+Easy+For+You+%F0%9F%91%8C
162.241.114.35
https://github.com/twbs/bootstrap/blob/master/LICENSE)
unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/cmg/1/wh0E0SXYnx6pTBdJW%2Fl926I%2BPRUplRdtQz3K9lHXs%2Fs%3D
104.18.94.41
https://google.com
unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/c4rds/0x4AAAAAAAwkfvalCr0Ft9wJ/auto/fbE/normal/auto/
104.18.94.41
There are 26 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
harmesmg.com
104.21.23.186
 malicious
t.dripemail3.com
23.22.106.69
google.com
142.250.74.206
a.nel.cloudflare.com
35.190.80.1
dailyalaska.com
162.241.114.35
code.jquery.com
151.101.194.137
challenges.cloudflare.com
104.18.95.41
www.google.com
172.217.18.4

IPs

IP
Domain
Country
Malicious
104.21.23.186
harmesmg.com
United States
malicious
172.217.18.4
www.google.com
United States
104.18.94.41
unknown
United States
192.168.2.16
unknown
unknown
104.18.95.41
challenges.cloudflare.com
United States
216.58.206.68
unknown
United States
239.255.255.250
unknown
Reserved
172.67.212.190
unknown
United States
151.101.194.137
code.jquery.com
United States
35.190.80.1
a.nel.cloudflare.com
United States
162.241.114.35
dailyalaska.com
United States
23.22.106.69
t.dripemail3.com
United States
There are 2 hidden IPs, click here to show them.

DOM / HTML

URL
Malicious
https://harmesmg.com/&redirect=467dbb71ea415b9eb4af299f337a08a557ae6ee7main&uid=f253efe302d32ab264a76e0ce65be769670404c116662
 malicious
https://harmesmg.com/&redirect=467dbb71ea415b9eb4af299f337a08a557ae6ee7main&uid=f253efe302d32ab264a76e0ce65be769670404c116662
 malicious
https://harmesmg.com/
https://harmesmg.com/
https://harmesmg.com/&redirect=467dbb71ea415b9eb4af299f337a08a557ae6ee7main&uid=f253efe302d32ab264a76e0ce65be769670404c116662