IOC Report
https://hnt.zkg.mybluehost.me/CA/LET

loading gif

Files

File Path
Type
Category
Malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 8 14:58:58 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 8 14:58:57 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 8 14:58:57 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 8 14:58:58 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 8 14:58:57 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
Chrome Cache Entry: 102
PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced
downloaded
Chrome Cache Entry: 103
ASCII text, with no line terminators
downloaded
Chrome Cache Entry: 104
ASCII text, with very long lines (1434), with no line terminators
downloaded
Chrome Cache Entry: 105
PNG image data, 20 x 18, 8-bit/color RGBA, non-interlaced
dropped
Chrome Cache Entry: 107
Web Open Font Format (Version 2), TrueType, length 15344, version 1.0
downloaded
Chrome Cache Entry: 108
PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced
downloaded
Chrome Cache Entry: 111
data
downloaded
Chrome Cache Entry: 112
PNG image data, 187 x 18, 8-bit/color RGBA, non-interlaced
dropped
Chrome Cache Entry: 113
JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 300x300, components 3
dropped
Chrome Cache Entry: 115
SVG Scalable Vector Graphics image
dropped
Chrome Cache Entry: 120
Unicode text, UTF-8 text, with very long lines (51786)
downloaded
Chrome Cache Entry: 121
ASCII text, with no line terminators
dropped
Chrome Cache Entry: 122
Web Open Font Format (Version 2), TrueType, length 125064, version 768.67
downloaded
Chrome Cache Entry: 123
ASCII text, with very long lines (65536), with no line terminators
downloaded
Chrome Cache Entry: 125
PNG image data, 39 x 28, 8-bit/color RGBA, non-interlaced
dropped
Chrome Cache Entry: 126
ASCII text, with very long lines (65536), with no line terminators
downloaded
Chrome Cache Entry: 128
ASCII text, with very long lines (724)
downloaded
Chrome Cache Entry: 129
PNG image data, 27 x 29, 8-bit/color RGBA, non-interlaced
downloaded
Chrome Cache Entry: 134
PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
dropped
Chrome Cache Entry: 140
MS Windows icon resource - 1 icon, 32x32, 8 bits/pixel
downloaded
Chrome Cache Entry: 141
Web Open Font Format (Version 2), TrueType, length 15340, version 1.0
downloaded
Chrome Cache Entry: 143
ASCII text, with no line terminators
downloaded
Chrome Cache Entry: 145
JPEG image data, JFIF standard 1.01, resolution (DPI), density 0x0, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=2], baseline, precision 8, 474x218, components 3
downloaded
Chrome Cache Entry: 146
ASCII text, with very long lines (65536), with no line terminators
downloaded
Chrome Cache Entry: 147
HTML document, ASCII text
downloaded
Chrome Cache Entry: 148
ASCII text, with no line terminators
downloaded
Chrome Cache Entry: 149
ASCII text, with very long lines (65311)
downloaded
Chrome Cache Entry: 151
ASCII text
downloaded
Chrome Cache Entry: 155
ASCII text, with no line terminators
downloaded
Chrome Cache Entry: 157
PNG image data, 32 x 27, 8-bit/color RGBA, non-interlaced
downloaded
Chrome Cache Entry: 158
PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced
dropped
Chrome Cache Entry: 160
GIF image data, version 89a, 200 x 103
downloaded
Chrome Cache Entry: 92
PNG image data, 214 x 20, 8-bit/color RGBA, non-interlaced
downloaded
Chrome Cache Entry: 93
Unicode text, UTF-8 text, with very long lines (9887)
dropped
Chrome Cache Entry: 94
Web Open Font Format (Version 2), TrueType, length 15552, version 1.0
downloaded
Chrome Cache Entry: 95
ASCII text, with very long lines (18053)
dropped
Chrome Cache Entry: 97
Unicode text, UTF-8 text, with very long lines (9887)
downloaded
There are 34 hidden files, click here to show them.

URLs

Name
IP
Malicious
https://hnt.zkg.mybluehost.me/CA/LET
malicious
https://hnt.zkg.mybluehost.me/CA/ALMA/TM86/home.php?enc=216cebe87e59f7d733a55cb34caac745&p=0&dispatch=2e859a3c5bf05618f3198065172f3e675b61b5f7
malicious
https://hnt.zkg.mybluehost.me/CA/ALMA/
malicious
https://hnt.zkg.mybluehost.me/CA/ALMA/TM86/load.php?code=action1
malicious
https://hnt.zkg.mybluehost.me/CA/ALMA/TM86/cc.php
malicious

Domains

Name
IP
Malicious
hnt.zkg.mybluehost.me
50.6.153.248
malicious
cdnjs.cloudflare.com
104.17.25.14
www.google.com
142.250.184.196
cdn.lr-in.com
104.21.234.145
dispatching-centre.lasamericascargo.com
135.181.58.223
api.livechatinc.com
unknown
cdn.livechatinc.com
unknown

IPs

IP
Domain
Country
Malicious
50.6.153.248
hnt.zkg.mybluehost.me
United States
malicious
23.38.98.94
unknown
United States
142.250.186.174
unknown
United States
192.168.2.16
unknown
unknown
104.21.234.145
cdn.lr-in.com
United States
192.168.2.4
unknown
unknown
95.101.111.159
unknown
European Union
23.38.98.79
unknown
United States
142.250.186.132
unknown
United States
142.250.184.206
unknown
United States
142.250.186.138
unknown
United States
142.250.184.195
unknown
United States
142.250.184.196
www.google.com
United States
1.1.1.1
unknown
Australia
108.177.15.84
unknown
United States
142.250.186.163
unknown
United States
172.217.18.4
unknown
United States
142.250.185.132
unknown
United States
135.181.58.223
dispatching-centre.lasamericascargo.com
Germany
142.250.186.106
unknown
United States
239.255.255.250
unknown
Reserved
142.250.185.131
unknown
United States
142.250.185.195
unknown
United States
172.217.16.195
unknown
United States
95.101.111.161
unknown
European Union
104.17.25.14
cdnjs.cloudflare.com
United States
There are 16 hidden IPs, click here to show them.