IOC Report
https://www.blueteamhandbook.com/

loading gif

Files

File Path
Type
Category
Malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 23 13:51:55 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 23 13:51:55 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 23 13:51:55 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 23 13:51:55 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 23 13:51:55 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
Chrome Cache Entry: 100
GIF image data, version 89a, 1 x 1
downloaded
Chrome Cache Entry: 101
ASCII text, with very long lines (11346)
downloaded
Chrome Cache Entry: 102
JPEG image data, JFIF standard 1.01, resolution (DPI), density 600x600, segment length 16, baseline, precision 8, 600x150, components 3
dropped
Chrome Cache Entry: 103
Web Open Font Format (Version 2), TrueType, length 68544, version 1.0
downloaded
Chrome Cache Entry: 104
Web Open Font Format (Version 2), TrueType, length 203144, version 1.0
downloaded
Chrome Cache Entry: 105
JPEG image data, JFIF standard 1.01, resolution (DPI), density 600x600, segment length 16, baseline, precision 8, 600x150, components 3
downloaded
Chrome Cache Entry: 106
PNG image data, 171 x 123, 8-bit/color RGBA, non-interlaced
downloaded
Chrome Cache Entry: 107
ASCII text
dropped
Chrome Cache Entry: 108
GIF image data, version 89a, 1 x 1
downloaded
Chrome Cache Entry: 109
Web Open Font Format (Version 2), TrueType, length 30908, version 1.0
downloaded
Chrome Cache Entry: 110
Web Open Font Format (Version 2), TrueType, length 23708, version 1.0
downloaded
Chrome Cache Entry: 111
JPEG image data, JFIF standard 1.01, resolution (DPI), density 600x600, segment length 16, baseline, precision 8, 600x150, components 3
dropped
Chrome Cache Entry: 112
ASCII text
dropped
Chrome Cache Entry: 113
GIF image data, version 89a, 1 x 1
dropped
Chrome Cache Entry: 114
JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 236x105, components 3
dropped
Chrome Cache Entry: 115
Web Open Font Format (Version 2), TrueType, length 28268, version 1.0
downloaded
Chrome Cache Entry: 116
Web Open Font Format (Version 2), TrueType, length 78908, version 1.0
downloaded
Chrome Cache Entry: 117
Web Open Font Format (Version 2), TrueType, length 17604, version 1.0
downloaded
Chrome Cache Entry: 118
HTML document, ASCII text
downloaded
Chrome Cache Entry: 119
JPEG image data, JFIF standard 1.01, resolution (DPI), density 600x600, segment length 16, baseline, precision 8, 600x150, components 3
dropped
Chrome Cache Entry: 120
JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 236x105, components 3
downloaded
Chrome Cache Entry: 121
JPEG image data, JFIF standard 1.01, resolution (DPI), density 600x600, segment length 16, baseline, precision 8, 600x150, components 3
downloaded
Chrome Cache Entry: 122
HTML document, Unicode text, UTF-8 text, with very long lines (32803)
downloaded
Chrome Cache Entry: 123
GIF image data, version 89a, 1 x 1
dropped
Chrome Cache Entry: 124
ASCII text, with very long lines (3181)
downloaded
Chrome Cache Entry: 125
Web Open Font Format (Version 2), TrueType, length 34728, version 1.0
downloaded
Chrome Cache Entry: 126
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=8, PhotometricIntepretation=RGB, orientation=upper-left, xresolution=110, yresolution=118, resolutionunit=2, software=Adobe Photoshop CS3 Windows, datetime=2008:12:19 17:47:53], baseline, precision 8, 250x123, components 3
dropped
Chrome Cache Entry: 127
ASCII text, with very long lines (32004)
downloaded
Chrome Cache Entry: 128
ASCII text, with very long lines (3181)
dropped
Chrome Cache Entry: 129
Web Open Font Format (Version 2), TrueType, length 53296, version 1.0
downloaded
Chrome Cache Entry: 130
ASCII text, with very long lines (11346)
dropped
Chrome Cache Entry: 131
JPEG image data, JFIF standard 1.01, resolution (DPI), density 600x600, segment length 16, baseline, precision 8, 600x150, components 3
dropped
Chrome Cache Entry: 132
Web Open Font Format (Version 2), TrueType, length 36608, version 1.0
downloaded
Chrome Cache Entry: 133
ASCII text, with very long lines (360)
dropped
Chrome Cache Entry: 134
ASCII text, with very long lines (531)
dropped
Chrome Cache Entry: 135
ASCII text
downloaded
Chrome Cache Entry: 136
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=8, PhotometricIntepretation=RGB, orientation=upper-left, xresolution=110, yresolution=118, resolutionunit=2, software=Adobe Photoshop CS3 Windows, datetime=2008:12:19 17:47:53], baseline, precision 8, 250x123, components 3
downloaded
Chrome Cache Entry: 137
HTML document, Unicode text, UTF-8 text, with very long lines (32803)
dropped
Chrome Cache Entry: 138
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 864x576, components 3
downloaded
Chrome Cache Entry: 139
Web Open Font Format (Version 2), TrueType, length 18668, version 1.0
downloaded
Chrome Cache Entry: 140
ASCII text, with very long lines (360)
downloaded
Chrome Cache Entry: 141
GIF image data, version 89a, 1 x 1
downloaded
Chrome Cache Entry: 142
ASCII text
downloaded
Chrome Cache Entry: 143
ASCII text, with very long lines (510)
dropped
Chrome Cache Entry: 144
JPEG image data, JFIF standard 1.01, resolution (DPI), density 144x144, segment length 16, baseline, precision 8, 235x100, components 3
dropped
Chrome Cache Entry: 145
PNG image data, 171 x 123, 8-bit/color RGBA, non-interlaced
dropped
Chrome Cache Entry: 146
GIF image data, version 89a, 1 x 1
dropped
Chrome Cache Entry: 147
Web Open Font Format (Version 2), TrueType, length 18912, version 1.0
downloaded
Chrome Cache Entry: 148
JPEG image data, JFIF standard 1.01, resolution (DPI), density 600x600, segment length 16, baseline, precision 8, 600x150, components 3
downloaded
Chrome Cache Entry: 149
HTML document, Unicode text, UTF-8 text, with very long lines (16115), with CRLF, LF line terminators
downloaded
Chrome Cache Entry: 150
Web Open Font Format (Version 2), TrueType, length 17144, version 1.0
downloaded
Chrome Cache Entry: 151
JPEG image data, JFIF standard 1.01, resolution (DPI), density 144x144, segment length 16, baseline, precision 8, 235x100, components 3
downloaded
Chrome Cache Entry: 152
Web Open Font Format (Version 2), TrueType, length 12276, version 1.0
downloaded
Chrome Cache Entry: 153
Unicode text, UTF-8 text, with very long lines (32968), with no line terminators
downloaded
Chrome Cache Entry: 154
JPEG image data, JFIF standard 1.01, resolution (DPI), density 600x600, segment length 16, baseline, precision 8, 600x150, components 3
dropped
Chrome Cache Entry: 155
JPEG image data, JFIF standard 1.01, resolution (DPI), density 600x600, segment length 16, baseline, precision 8, 600x150, components 3
downloaded
Chrome Cache Entry: 156
Web Open Font Format (Version 2), TrueType, length 41160, version 1.0
downloaded
Chrome Cache Entry: 157
ASCII text, with very long lines (531)
downloaded
Chrome Cache Entry: 158
HTML document, Unicode text, UTF-8 text, with very long lines (12686)
downloaded
Chrome Cache Entry: 159
Web Open Font Format (Version 2), TrueType, length 10324, version 1.0
downloaded
Chrome Cache Entry: 160
Web Open Font Format (Version 2), TrueType, length 26576, version 1.0
downloaded
Chrome Cache Entry: 161
Web Open Font Format (Version 2), TrueType, length 33024, version 1.0
downloaded
Chrome Cache Entry: 162
GIF image data, version 89a, 1 x 1
downloaded
Chrome Cache Entry: 163
ASCII text, with very long lines (65536), with no line terminators
dropped
Chrome Cache Entry: 164
Web Open Font Format (Version 2), TrueType, length 43616, version 1.0
downloaded
Chrome Cache Entry: 165
ASCII text, with very long lines (1149)
downloaded
Chrome Cache Entry: 166
ASCII text, with very long lines (65536), with no line terminators
downloaded
Chrome Cache Entry: 167
GIF image data, version 89a, 1 x 1
dropped
Chrome Cache Entry: 91
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 864x576, components 3
dropped
Chrome Cache Entry: 92
JPEG image data, JFIF standard 1.01, resolution (DPI), density 600x600, segment length 16, baseline, precision 8, 600x150, components 3
downloaded
Chrome Cache Entry: 93
ASCII text, with very long lines (1149)
dropped
Chrome Cache Entry: 94
ASCII text, with very long lines (510)
downloaded
Chrome Cache Entry: 95
Web Open Font Format (Version 2), TrueType, length 20028, version 1.0
downloaded
Chrome Cache Entry: 96
JPEG image data, JFIF standard 1.01, resolution (DPI), density 600x600, segment length 16, baseline, precision 8, 600x150, components 3
dropped
Chrome Cache Entry: 97
JPEG image data, JFIF standard 1.01, resolution (DPI), density 600x600, segment length 16, baseline, precision 8, 600x150, components 3
downloaded
Chrome Cache Entry: 98
ASCII text, with very long lines (32004)
dropped
Chrome Cache Entry: 99
Web Open Font Format (Version 2), TrueType, length 18120, version 1.0
downloaded
There are 74 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1868,i,14284371467717423403,7965405504482947707,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.blueteamhandbook.com/"

URLs

Name
IP
Malicious
https://www.blueteamhandbook.com/
https://img1.wsimg.com/gfonts/s/arizonia/v21/neIIzCemt4A5qa7mv5WOFqwKUQ.woff2)
unknown
https://img1.wsimg.com/gfonts/s/specialelite/v18/XLYgIZbkc4JPUL5CVArUVL0ntnAOSA.woff2)
unknown
https://img1.wsimg.com/gfonts/s/arizonia/v21/neIIzCemt4A5qa7mv5WBFqw.woff2)
unknown
https://img1.wsimg.com/gfonts/s/amaticsc/v26/TUZyzwprpvBS1izr_vOEBeSfQZQ.woff2)
unknown
https://img1.wsimg.com/gfonts/s/averiasanslibre/v19/ga6XaxZG_G5OvCf_rt7FH3B6BHLMEdVOEoI.woff2)
unknown
https://www.blueteamhandbook.com/site.css?v=
76.223.105.230
http://www.blueteamhandbook.com/soc_cover_design.html
unknown
https://img1.wsimg.com/gfonts/s/pacifico/v22/FwZY7-Qmy14u9lezJ-6K6MmTpA.woff2)
unknown
https://img1.wsimg.com/gfonts/s/allura/v21/9oRPNYsQpS4zjuA_hAgWDto.woff2)
unknown
https://img1.wsimg.com/gfonts/s/allura/v21/9oRPNYsQpS4zjuA_hQgWDto.woff2)
unknown
https://img1.wsimg.com/gfonts/s/pacifico/v22/FwZY7-Qmy14u9lezJ-6I6MmTpA.woff2)
unknown
https://img1.wsimg.com/gfonts/s/loveyalikeasister/v22/R70EjzUBlOqPeouhFDfR80-0FhOqJubN-BeL9Xxd.woff2
unknown
https://img1.wsimg.com/gfonts/s/oswald/v53/TK3_WkUHHAIjg75cFRf3bXL8LICs1_FvsUZiZQ.woff2)
unknown
https://img1.wsimg.com/gfonts/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B5
unknown
https://img1.wsimg.com/gfonts/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4
unknown
https://img1.wsimg.com/gfonts/s/oswald/v53/TK3_WkUHHAIjg75cFRf3bXL8LICs1_FvsUJiZTaR.woff2)
unknown
https://img1.wsimg.com/wst/v7/WSB7_J_20220713_1340_DEP-19535_3880/v2
unknown
https://img1.wsimg.com/gfonts/s/amaticsc/v26/TUZyzwprpvBS1izr_vOEBOSfQZQ.woff2)
unknown
https://img1.wsimg.com/gfonts/s/merriweather/v30/u-440qyriQwlOrhSvowK_l5-ciZMZ-Y.woff2)
unknown
https://img1.wsimg.com/gfonts/s/offside/v24/HI_KiYMWKa9QrAykc5joR6-d.woff2)
unknown
https://img1.wsimg.com/gfonts/s/sacramento/v15/buEzpo6gcdjy0EiZMBUG4CMf_exL.woff2)
unknown
https://img1.wsimg.com/gfonts/s/amaticsc/v26/TUZyzwprpvBS1izr_vOECOSfQZQ.woff2)
unknown
https://img1.wsimg.com/gfonts/s/francoisone/v21/_Xmr-H4zszafZw3A-KPSZut9zgiRi_Y.woff2)
unknown
https://img1.wsimg.com/gfonts/s/frederickathegreat/v21/9Bt33CxNwt7aOctW2xjbCstzwVKsIBVV--StxbcVcg.wo
unknown
https://img1.wsimg.com/gfonts/s/kaushanscript/v18/vm8vdRfvXFLG3OLnsO15WYS5DG72wNJHMw.woff2)
unknown
https://img1.wsimg.com/gfonts/s/sacramento/v15/buEzpo6gcdjy0EiZMBUG4C0f_Q.woff2)
unknown
https://img1.wsimg.com/gfonts/s/loveyalikeasister/v22/R70EjzUBlOqPeouhFDfR80-0FhOqJubN-BeL-3xdgGE.wo
unknown
https://img1.wsimg.com/gfonts/s/romanesco/v21/w8gYH2ozQOY7_r_J7mSX1XYKmOo.woff2)
unknown
https://img1.wsimg.com/gfonts/s/pacifico/v22/FwZY7-Qmy14u9lezJ-6D6MmTpA.woff2)
unknown
https://img1.wsimg.com/gfonts/s/romanesco/v21/w8gYH2ozQOY7_r_J7mSX23YK.woff2)
unknown
https://img1.wsimg.com/gfonts/s/amaticsc/v26/TUZyzwprpvBS1izr_vOECuSf.woff2)
unknown
http://www.blueteamhandbook.com/home.html
unknown
https://img1.wsimg.com/gfonts/s/seaweedscript/v15/bx6cNx6Tne2pxOATYE8C_Rsoe3WO8qY.woff2)
unknown
https://img1.wsimg.com/gfonts/s/arizonia/v21/neIIzCemt4A5qa7mv5WPFqwKUQ.woff2)
unknown
https://img1.wsimg.com/gfonts/s/oswald/v53/TK3_WkUHHAIjg75cFRf3bXL8LICs1_FvsUhiZTaR.woff2)
unknown
https://www.amazon.com/Blue-Team-Handbook-Condensed-Operations/dp/1091493898
unknown
https://img1.wsimg.com/gfonts/s/merriweather/v30/u-440qyriQwlOrhSvowK_l5-fCZM.woff2)
unknown
https://www.amazon.com/Blue-Team-Handbook-condensed-Responder/dp/1500734756
unknown
https://img1.wsimg.com/gfonts/s/merriweather/v30/u-440qyriQwlOrhSvowK_l5-eCZMZ-Y.woff2)
unknown
https://img1.wsimg.com/gfonts/s/merriweather/v30/u-440qyriQwlOrhSvowK_l5-cyZMZ-Y.woff2)
unknown
https://img1.wsimg.com/gfonts/s/pacifico/v22/FwZY7-Qmy14u9lezJ-6H6Mk.woff2)
unknown
http://www.counterhack.net/Counter_Hack/Welcome.html
unknown
https://img1.wsimg.com/gfonts/s/francoisone/v21/_Xmr-H4zszafZw3A-KPSZut9zwiRi_Y.woff2)
unknown
https://img1.wsimg.com/gfonts/s/jacquesfrancoisshadow/v25/KR1FBtOz8PKTMk-kqdkLVrvR0ECFrB6Pin-2_p8Sun
unknown
https://img1.wsimg.com/gfonts/s/seaweedscript/v15/bx6cNx6Tne2pxOATYE8C_Rsoe3WA8qY2VQ.woff2)
unknown
https://www.blueteamhandbook.com/soc_cover_design.html
https://img1.wsimg.com/gfonts/s/oswald/v53/TK3_WkUHHAIjg75cFRf3bXL8LICs1_FvsUliZTaR.woff2)
unknown
https://img1.wsimg.com/gfonts/s/pacifico/v22/FwZY7-Qmy14u9lezJ-6J6MmTpA.woff2)
unknown
https://img1.wsimg.com/gfonts/s/frederickathegreat/v21/9Bt33CxNwt7aOctW2xjbCstzwVKsIBVV--Sjxbc.woff2
unknown
https://www.blueteamhandbook.com/
https://img1.wsimg.com/gfonts/s/offside/v24/HI_KiYMWKa9QrAykc5boRw.woff2)
unknown
https://img1.wsimg.com/gfonts/s/amaticsc/v26/TUZyzwprpvBS1izr_vOEDuSfQZQ.woff2)
unknown
https://img1.wsimg.com/gfonts/s/allura/v21/9oRPNYsQpS4zjuA_iwgW.woff2)
unknown
https://img1.wsimg.com/wst/v7/WSB7_J_20220713_1340_DEP-19535_3880/v2/libs/jquery/jq.js
unknown
https://www.blueteamhandbook.com/favicon.ico
76.223.105.230
https://img1.wsimg.com/gfonts/s/overtherainbow/v20/11haGoXG1k_HKhMLUWz7Mc7vvW5ulvSs9Q.woff2)
unknown
https://img1.wsimg.com/gfonts/s/oswald/v53/TK3_WkUHHAIjg75cFRf3bXL8LICs1_FvsUtiZTaR.woff2)
unknown
https://img1.wsimg.com/gfonts/s/kaushanscript/v18/vm8vdRfvXFLG3OLnsO15WYS5DG74wNI.woff2)
unknown
https://img1.wsimg.com/gfonts/s/josefinslab/v26/lW-swjwOK3Ps5GSJlNNkMalNpiZe_ldbOR4W71msR349Kg.woff2
unknown
https://img1.wsimg.com/gfonts/s/cabinsketch/v21/QGYpz_kZZAGCONcK2A4bGOj8mNhN.woff2)
unknown
https://img1.wsimg.com/gfonts/s/francoisone/v21/_Xmr-H4zszafZw3A-KPSZut9wQiR.woff2)
unknown
http://nebula.wsimg.com
unknown
http://securityweekly.com/2014/10/episode-389-interview-with-don-murdoch.html
unknown
http://schema.org/Organization
unknown
https://img1.wsimg.com/gfonts/s/merriweather/v30/u-440qyriQwlOrhSvowK_l5-cSZMZ-Y.woff2)
unknown
There are 55 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
blueteamhandbook.com
76.223.105.230
www.google.com
142.250.186.68
img1.wsimg.com
unknown
www.blueteamhandbook.com
unknown
nebula.wsimg.com
unknown
csp.secureserver.net
unknown
events.api.secureserver.net
unknown
img2.wsimg.com
unknown
img4.wsimg.com
unknown
s7.addthis.com
unknown

IPs

IP
Domain
Country
Malicious
142.250.186.68
www.google.com
United States
76.223.105.230
blueteamhandbook.com
United States
192.168.2.16
unknown
unknown
216.58.206.36
unknown
United States
239.255.255.250
unknown
Reserved

DOM / HTML

URL
Malicious
https://www.blueteamhandbook.com/
https://www.blueteamhandbook.com/
https://www.blueteamhandbook.com/
https://www.blueteamhandbook.com/
https://www.blueteamhandbook.com/
https://www.blueteamhandbook.com/soc_cover_design.html
https://www.blueteamhandbook.com/soc_cover_design.html
https://www.blueteamhandbook.com/soc_cover_design.html