IOC Report
https://turbocards.com//wp-content/ledt/

loading gif

Files

File Path
Type
Category
Malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Oct 12 22:18:29 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Oct 12 22:18:29 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Oct 12 22:18:29 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Oct 12 22:18:29 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Oct 12 22:18:29 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
Chrome Cache Entry: 74
JSON data
dropped
Chrome Cache Entry: 79
JSON data
downloaded
Chrome Cache Entry: 80
ASCII text, with very long lines (32239)
downloaded
Chrome Cache Entry: 82
ASCII text, with very long lines (33104)
dropped
Chrome Cache Entry: 83
ASCII text, with very long lines (17340)
dropped
Chrome Cache Entry: 84
ASCII text
downloaded
Chrome Cache Entry: 87
RIFF (little-endian) data, Web/P image
dropped
Chrome Cache Entry: 88
ASCII text, with very long lines (65299)
dropped
Chrome Cache Entry: 89
Unicode text, UTF-8 text, with very long lines (65342)
downloaded
Chrome Cache Entry: 91
JSON data
downloaded
Chrome Cache Entry: 92
HTML document, Unicode text, UTF-8 text, with very long lines (16428)
dropped
Chrome Cache Entry: 93
RIFF (little-endian) data, Web/P image
downloaded
Chrome Cache Entry: 94
HTML document, Unicode text, UTF-8 text, with very long lines (312)
downloaded
Chrome Cache Entry: 95
ASCII text
downloaded
Chrome Cache Entry: 97
Web Open Font Format (Version 2), TrueType, length 18536, version 1.0
downloaded
There are 12 hidden files, click here to show them.

URLs

Name
IP
Malicious
https://turbocards.com//wp-content/ledt/
https://wordpress-44086035828.devrimsdemo.com/contact/?redirection=details

Domains

Name
IP
Malicious
1857279285.rsc.cdn77.org
195.181.170.19
1087630013.rsc.cdn77.org
195.181.170.18
turbocards.com
199.16.173.48
websocket-visitors.smartsupp.com
18.194.185.123
www.google.com
142.250.184.228
bootstrap.smartsuppchat.com
52.29.129.13
1161431244.rsc.cdn77.org
212.102.56.179
wordpress-44086035828.devrimsdemo.com
128.199.2.230
www.smartsuppchat.com
unknown
translations.smartsuppcdn.com
unknown
widget-v3.smartsuppcdn.com
unknown
There are 1 hidden domains, click here to show them.

IPs

IP
Domain
Country
Malicious
142.250.185.78
unknown
United States
199.16.173.48
turbocards.com
United States
1.1.1.1
unknown
Australia
142.250.186.163
unknown
United States
195.181.170.19
1857279285.rsc.cdn77.org
United Kingdom
192.168.2.16
unknown
unknown
195.181.170.18
1087630013.rsc.cdn77.org
United Kingdom
128.199.2.230
wordpress-44086035828.devrimsdemo.com
United Kingdom
142.250.185.227
unknown
United States
18.194.185.123
websocket-visitors.smartsupp.com
United States
212.102.56.179
1161431244.rsc.cdn77.org
Italy
142.250.186.106
unknown
United States
52.29.129.13
bootstrap.smartsuppchat.com
United States
239.255.255.250
unknown
Reserved
142.250.185.131
unknown
United States
64.233.184.84
unknown
United States
142.250.184.238
unknown
United States
142.250.184.228
www.google.com
United States
195.181.175.40
unknown
United Kingdom
169.150.255.184
unknown
United States
There are 10 hidden IPs, click here to show them.