IOC Report
https://email.sg.on24event.com/ls/click?upn=u001.qPsCj0VSKBRlbXwk4CZaT1VjLeyp2VLEfjNu-2B0nZu-2Fxqd7J7azeavYtfWIpH5s06k53abKHqs4llH3Jhu5RjpTmrfFj-2FYXYono-2BrdhZiop6mM9HLMD7Duln3TjElhNYhPT-2FX6xyyoUu6Dx8yj9wcLwdMj4Otv5QhXZVxy2VRDQU6uLo4yOXejICyjLkqrLae30350b-2BkeFCHrJC86r8xk7gcTS2t-2BuxqZ9pGH5RtGLY2z

loading gif

Files

File Path
Type
Category
Malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 23 21:02:17 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 23 21:02:17 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:54:41 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 23 21:02:17 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 23 21:02:17 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 23 21:02:17 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
dropped
Chrome Cache Entry: 160
ASCII text, with very long lines (5162), with no line terminators
downloaded
Chrome Cache Entry: 161
MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
downloaded
Chrome Cache Entry: 162
GIF image data, version 89a, 14 x 14
dropped
Chrome Cache Entry: 163
MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
dropped
Chrome Cache Entry: 164
ASCII text, with very long lines (3157)
downloaded
Chrome Cache Entry: 165
ASCII text, with very long lines (32072)
dropped
Chrome Cache Entry: 166
ASCII text, with very long lines (1294)
downloaded
Chrome Cache Entry: 167
ASCII text
downloaded
Chrome Cache Entry: 168
ASCII text
downloaded
Chrome Cache Entry: 169
ASCII text, with very long lines (32072)
downloaded
Chrome Cache Entry: 170
HTML document, ASCII text, with CRLF line terminators
downloaded
Chrome Cache Entry: 171
HTML document, ASCII text, with very long lines (333), with CRLF line terminators
downloaded
Chrome Cache Entry: 172
Unicode text, UTF-8 text, with very long lines (416), with CRLF line terminators
downloaded
Chrome Cache Entry: 173
ASCII text, with very long lines (599)
downloaded
Chrome Cache Entry: 174
PNG image data, 64 x 64, 8-bit colormap, non-interlaced
downloaded
Chrome Cache Entry: 175
ASCII text, with very long lines (65531)
downloaded
Chrome Cache Entry: 176
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 64x64, components 3
downloaded
Chrome Cache Entry: 177
ASCII text, with very long lines (1302)
downloaded
Chrome Cache Entry: 178
GIF image data, version 89a, 14 x 14
downloaded
Chrome Cache Entry: 179
ASCII text, with very long lines (2287)
downloaded
Chrome Cache Entry: 180
Unicode text, UTF-8 text, with very long lines (623)
downloaded
Chrome Cache Entry: 181
ASCII text
downloaded
Chrome Cache Entry: 182
ASCII text, with very long lines (568)
dropped
Chrome Cache Entry: 183
HTML document, ASCII text, with CRLF line terminators
downloaded
Chrome Cache Entry: 184
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 185
HTML document, ASCII text
downloaded
Chrome Cache Entry: 186
ASCII text, with very long lines (4628)
downloaded
Chrome Cache Entry: 187
ASCII text, with very long lines (568)
downloaded
Chrome Cache Entry: 188
ASCII text, with very long lines (4628)
dropped
Chrome Cache Entry: 189
ASCII text
downloaded
Chrome Cache Entry: 190
Unicode text, UTF-8 text, with very long lines (416), with CRLF line terminators
dropped
Chrome Cache Entry: 191
ASCII text
downloaded
There are 29 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1948,i,4768738079385964301,3117420876505375979,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://email.sg.on24event.com/ls/click?upn=u001.qPsCj0VSKBRlbXwk4CZaT1VjLeyp2VLEfjNu-2B0nZu-2Fxqd7J7azeavYtfWIpH5s06k53abKHqs4llH3Jhu5RjpTmrfFj-2FYXYono-2BrdhZiop6mM9HLMD7Duln3TjElhNYhPT-2FX6xyyoUu6Dx8yj9wcLwdMj4Otv5QhXZVxy2VRDQU6uLo4yOXejICyjLkqrLae30350b-2BkeFCHrJC86r8xk7gcTS2t-2BuxqZ9pGH5RtGLY2zkEMeoaKmOXm3tDGn-2FRa-2BwRIXgw7hNarhNKSmU88fLl1YClGUQ1QCba1x2Z5CsVhA5r6cyKJlOqrmDk6rqIuiEop_9OLHkqx2rVAGyVftmWycnbCyZPGTO5u8UqYRaByMekSZQq7ByPoc3mourPjXvpTUmNi9jjrBuZbD8HHtA6oXuE-2FGsxKZRgEcCQwRUVwYz2UePYjvTEnwgQe0qgdgTvIyhYIcwTNrfJSG-2FM6xpZEkjXrRuz1qjpsmOQUx-2FCch59hPfgdCYY6WZEKSd4Fia5A1cpAR0bHHwgia4QSd8N6YT-2B1AnDrdbFtzqzP4YWNDfpaoL-2BhciczzMKaHaXELBylztOzEJRsLzvPylsSGlNHS7cw1PP0diZRTc-2FLkKQr3hY3ooRk2TKREINDOSjsj-2Fl3oxjLdy-2FMSFXq6EAR3TcUcIZNhT0UXbiZ2XFvhr2b3a7w-3D"

URLs

Name
IP
Malicious
https://email.sg.on24event.com/ls/click?upn=u001.qPsCj0VSKBRlbXwk4CZaT1VjLeyp2VLEfjNu-2B0nZu-2Fxqd7J7azeavYtfWIpH5s06k53abKHqs4llH3Jhu5RjpTmrfFj-2FYXYono-2BrdhZiop6mM9HLMD7Duln3TjElhNYhPT-2FX6xyyoUu6Dx8yj9wcLwdMj4Otv5QhXZVxy2VRDQU6uLo4yOXejICyjLkqrLae30350b-2BkeFCHrJC86r8xk7gcTS2t-2BuxqZ9pGH5RtGLY2zkEMeoaKmOXm3tDGn-2FRa-2BwRIXgw7hNarhNKSmU88fLl1YClGUQ1QCba1x2Z5CsVhA5r6cyKJlOqrmDk6rqIuiEop_9OLHkqx2rVAGyVftmWycnbCyZPGTO5u8UqYRaByMekSZQq7ByPoc3mourPjXvpTUmNi9jjrBuZbD8HHtA6oXuE-2FGsxKZRgEcCQwRUVwYz2UePYjvTEnwgQe0qgdgTvIyhYIcwTNrfJSG-2FM6xpZEkjXrRuz1qjpsmOQUx-2FCch59hPfgdCYY6WZEKSd4Fia5A1cpAR0bHHwgia4QSd8N6YT-2B1AnDrdbFtzqzP4YWNDfpaoL-2BhciczzMKaHaXELBylztOzEJRsLzvPylsSGlNHS7cw1PP0diZRTc-2FLkKQr3hY3ooRk2TKREINDOSjsj-2Fl3oxjLdy-2FMSFXq6EAR3TcUcIZNhT0UXbiZ2XFvhr2b3a7w-3D
http://stackoverflow.com/questions/6768474/how-can-i-detect-which-javascript-engine-v8-or-jsc-is-use
unknown
https://event.on24.com/view/help/index.html
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=7&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
172.217.18.4
http://www.broofa.com
unknown
https://event.on24.com/view/help/css/main.css
199.83.44.71
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=event.on24.com&oit=3&cp=14&pgcl=7&gs_rn=42&psi=5sooXk6zbJdYs6cy&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
172.217.18.4
https://event.on24.com/view/help/sysreq.html
199.83.44.71
https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
unknown
https://modernizr.com/download/?-audio-flash-video-setclasses
unknown
https://event.on24.com/view/help/html5-test/modernizr-custom.js
199.83.44.71
https://event.on24.com/view/help/images/q_mark.gif
199.83.44.71
http://www.opera.com/support/kb/view/843/
unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=event.&oit=1&cp=6&pgcl=7&gs_rn=42&psi=5sooXk6zbJdYs6cy&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
172.217.18.4
http://event.on24.com/wcc/r
unknown
https://mths.be/mit
unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=event.o&oit=1&cp=7&pgcl=7&gs_rn=42&psi=5sooXk6zbJdYs6cy&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
172.217.18.4
https://demoneaux.github.io/
unknown
https://mths.be/platform
unknown
https://event.on24.com/utils/test/testYourSystem.html?eventid=4743223&sessionid=1&key=16A43A36AD63313A13C8C243DAA1AD2C&checkBrowser=true&checkOS=true&checkBandwidth=true&checkCookie=true&ngwebcast=true&ngwebcast=true
http://h5bp.com/
unknown
https://event.on24.com/view/help/sysreq.html#media_player
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
172.217.18.4
https://apis.google.com
unknown
https://event.on24.com/view/help/html5-test/platform.js
199.83.44.71
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=event.on&oit=1&cp=8&pgcl=7&gs_rn=42&psi=5sooXk6zbJdYs6cy&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
172.217.18.4
https://domains.google.com/suggest/flow
unknown
http://dev.opera.com/articles/view/opera-mini-web-content-authoring-guidelines/#operamini
unknown
https://event.on24.com/favicon.ico
199.83.44.71
http://requirejs.org/docs/errors.html#mismatch
unknown
https://event.on24.com/view/help/js/common.js
199.83.44.71
http://people.mozilla.org/~jorendorff/es6-draft.html#sec-tolength)
unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=event.on2&oit=1&cp=9&pgcl=7&gs_rn=42&psi=5sooXk6zbJdYs6cy&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
172.217.18.4
https://event.on24.com/view/help/css/normalize.css
199.83.44.71
https://event.on24.com/
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=event&oit=1&cp=5&pgcl=7&gs_rn=42&psi=5sooXk6zbJdYs6cy&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
172.217.18.4
https://www.google.com/async/newtab_promos
172.217.18.4
http://docs.blackberry.com/en/developers/deliverables/18169/HTTP_headers_sent_by_BB_Browser_1234911_
unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
172.217.18.4
https://plus.google.com
unknown
https://www.google.com/async/ddljson?async=ntp:2
172.217.18.4
https://play.google.com/log?format=json&hasfast=true
172.217.18.110
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
172.217.18.4
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0
142.250.185.238
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=e&oit=1&cp=1&pgcl=7&gs_rn=42&psi=5sooXk6zbJdYs6cy&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
172.217.18.4
http://www.howtocreate.co.uk/operaStuff/operaObject.html
unknown
http://event.on24.com
unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=even&oit=1&cp=4&pgcl=7&gs_rn=42&psi=5sooXk6zbJdYs6cy&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
172.217.18.4
http://allyoucanleet.com/
unknown
https://clients6.google.com
unknown
There are 39 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
plus.l.google.com
142.250.185.238
play.google.com
172.217.18.110
www.google.com
172.217.18.4
r-email.sg.on24event.com
199.83.44.68
r-event.on24.com
199.83.44.71
event.on24.com
unknown
apis.google.com
unknown
email.sg.on24event.com
unknown

IPs

IP
Domain
Country
Malicious
192.168.2.17
unknown
unknown
172.217.18.4
www.google.com
United States
142.250.185.238
plus.l.google.com
United States
239.255.255.250
unknown
Reserved
199.83.44.71
r-event.on24.com
United States
199.83.44.68
r-email.sg.on24event.com
United States
172.217.18.110
play.google.com
United States

DOM / HTML

URL
Malicious
https://event.on24.com/utils/test/testYourSystem.html?eventid=4743223&sessionid=1&key=16A43A36AD63313A13C8C243DAA1AD2C&checkBrowser=true&checkOS=true&checkBandwidth=true&checkCookie=true&ngwebcast=true&ngwebcast=true
https://event.on24.com/view/help/sysreq.html#media_player
https://event.on24.com/
https://event.on24.com/view/help/index.html