IOC Report
http://fllwytnd.com/

loading gif

Files

File Path
Type
Category
Malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 23 21:49:10 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 23 21:49:10 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 5 09:52:18 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 23 21:49:10 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 23 21:49:10 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 23 21:49:10 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
dropped
Chrome Cache Entry: 154
Web Open Font Format (Version 2), TrueType, length 10860, version 331.-31196
downloaded
Chrome Cache Entry: 155
Web Open Font Format (Version 2), TrueType, length 159376, version 1.0
downloaded
Chrome Cache Entry: 156
JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1920x642, components 3
downloaded
Chrome Cache Entry: 157
ASCII text, with very long lines (65397)
downloaded
Chrome Cache Entry: 158
JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 838x500, components 3
downloaded
Chrome Cache Entry: 159
ASCII text, with very long lines (27832)
downloaded
Chrome Cache Entry: 160
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
dropped
Chrome Cache Entry: 161
ASCII text, with very long lines (65536), with no line terminators
downloaded
Chrome Cache Entry: 162
Web Open Font Format (Version 2), TrueType, length 1296, version 331.-31196
downloaded
Chrome Cache Entry: 163
PNG image data, 293 x 100, 8-bit/color RGBA, non-interlaced
dropped
Chrome Cache Entry: 164
JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1920x642, components 3
downloaded
Chrome Cache Entry: 165
ASCII text, with very long lines (65324)
downloaded
Chrome Cache Entry: 166
HTML document, ASCII text, with very long lines (1238)
dropped
Chrome Cache Entry: 167
Unicode text, UTF-8 text
dropped
Chrome Cache Entry: 168
ASCII text, with very long lines (12736)
downloaded
Chrome Cache Entry: 169
ASCII text, with very long lines (27832)
dropped
Chrome Cache Entry: 170
JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1920x642, components 3
dropped
Chrome Cache Entry: 171
Web Open Font Format (Version 2), TrueType, length 23576, version 1.0
downloaded
Chrome Cache Entry: 172
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
downloaded
Chrome Cache Entry: 173
ASCII text, with very long lines (32065)
dropped
Chrome Cache Entry: 174
Unicode text, UTF-8 text
downloaded
Chrome Cache Entry: 175
HTML document, ASCII text, with very long lines (370)
downloaded
Chrome Cache Entry: 176
Unicode text, UTF-8 text
downloaded
Chrome Cache Entry: 177
JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 500x500, components 3
downloaded
Chrome Cache Entry: 178
JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1920x642, components 3
downloaded
Chrome Cache Entry: 179
ASCII text, with very long lines (65397)
dropped
Chrome Cache Entry: 180
JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1920x642, components 3
dropped
Chrome Cache Entry: 181
ASCII text, with very long lines (55494)
downloaded
Chrome Cache Entry: 182
ASCII text, with very long lines (55494)
dropped
Chrome Cache Entry: 183
ASCII text, with very long lines (391)
downloaded
Chrome Cache Entry: 184
Web Open Font Format (Version 2), TrueType, length 10992, version 331.-31196
downloaded
Chrome Cache Entry: 185
ASCII text, with very long lines (32065)
downloaded
Chrome Cache Entry: 186
ASCII text, with very long lines (26366)
downloaded
Chrome Cache Entry: 187
Web Open Font Format (Version 2), TrueType, length 17168, version 331.-31196
downloaded
Chrome Cache Entry: 188
ASCII text
downloaded
Chrome Cache Entry: 189
JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 500x500, components 3
dropped
Chrome Cache Entry: 190
JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1920x642, components 3
dropped
Chrome Cache Entry: 191
ASCII text, with very long lines (12736)
dropped
Chrome Cache Entry: 192
ASCII text, with very long lines (26366)
dropped
Chrome Cache Entry: 193
JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 500x500, components 3
dropped
Chrome Cache Entry: 194
Web Open Font Format (Version 2), TrueType, length 24800, version 331.-31196
downloaded
Chrome Cache Entry: 195
Web Open Font Format (Version 2), TrueType, length 11932, version 331.-31196
downloaded
Chrome Cache Entry: 196
ASCII text, with very long lines (391)
dropped
Chrome Cache Entry: 197
JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 500x500, components 3
downloaded
Chrome Cache Entry: 198
JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 838x500, components 3
dropped
Chrome Cache Entry: 199
PNG image data, 293 x 100, 8-bit/color RGBA, non-interlaced
downloaded
Chrome Cache Entry: 200
HTML document, ASCII text, with very long lines (1238)
downloaded
There are 44 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2412 --field-trial-handle=2360,i,9879100315137081832,17542337059139668284,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://fllwytnd.com/"

URLs

Name
IP
Malicious
http://fllwytnd.com/
https://raw.github.com/gdsmith/jquery-easing/master/LICENSE
unknown
https://fllwytnd.com/img/slider2.jpg
104.21.20.42
https://fllwytnd.com/img/logo.png
104.21.20.42
https://fllwytnd.com/img/slider.jpg
104.21.20.42
https://cdnjs.cloudflare.com/ajax/libs/jquery-easing/1.4.1/jquery.easing.js
104.17.24.14
https://fllwytnd.com/img/img1.jpg
104.21.20.42
https://stackpath.bootstrapcdn.com/bootstrap/4.2.1/js/bootstrap.min.js
104.18.11.207
https://fllwytnd.com/img/slider3.jpg
104.21.20.42
https://getbootstrap.com/)
unknown
https://fllwytnd.com/js/fixed.js
104.21.20.42
https://oss.maxcdn.com/libs/html5shiv/3.7.0/html5shiv.js
unknown
https://fllwytnd.com/css/main.css
104.21.20.42
http://gsgd.co.uk/sandbox/jquery/easing/
unknown
https://fontawesome.com
unknown
https://ka-p.fontawesome.com
unknown
https://fllwytnd.com/
https://kit.fontawesome.com
unknown
https://fllwytnd.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
104.21.20.42
https://github.com/twbs/bootstrap/graphs/contributors)
unknown
https://pro.fontawesome.com/releases/v5.6.3/css/all.css
unknown
https://fllwytnd.com/img/img3.jpg
104.21.20.42
https://fontawesome.com/license
unknown
https://kit.fontawesome.com/d5a48d4786.js
unknown
https://fllwytnd.com/img/favicon.png
104.21.20.42
https://github.com/twbs/bootstrap/blob/master/LICENSE)
unknown
https://oss.maxcdn.com/libs/respond.js/1.4.2/respond.min.js
unknown
https://stackpath.bootstrapcdn.com/bootstrap/4.2.1/css/bootstrap.min.css
104.18.11.207
https://fllwytnd.com/img/img2.jpg
104.21.20.42
https://kit-uploads.fontawesome.com
unknown
There are 19 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
stackpath.bootstrapcdn.com
104.18.11.207
bg.microsoft.map.fastly.net
199.232.210.172
cdnjs.cloudflare.com
104.17.24.14
fllwytnd.com
104.21.20.42
www.google.com
172.217.18.4
fp2e7a.wpc.phicdn.net
192.229.221.95
kit.fontawesome.com
unknown
pro.fontawesome.com
unknown
ka-p.fontawesome.com
unknown

IPs

IP
Domain
Country
Malicious
104.17.24.14
cdnjs.cloudflare.com
United States
104.21.20.42
fllwytnd.com
United States
172.217.18.4
www.google.com
United States
104.18.11.207
stackpath.bootstrapcdn.com
United States
192.168.2.11
unknown
unknown
239.255.255.250
unknown
Reserved

DOM / HTML

URL
Malicious
https://fllwytnd.com/
https://fllwytnd.com/
https://fllwytnd.com/