IOC Report
https://unilever.sharepoint.com/sites/VelocityVendorRequestTool/Shared%20Documents/Forms/AllItems.aspx?id=%2Fsites%2FVelocityVendorRequestTool%2FShared%20Documents%2FSupport%2Epdf&parent=%2Fsites%2FVelocityVendorRequestTool%2FShared%20Documents&p=true

loading gif

Files

File Path
Type
Category
Malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 16:28:21 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 16:28:21 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 16:28:21 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 16:28:21 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 16:28:21 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
Chrome Cache Entry: 155
ASCII text, with very long lines (2054)
downloaded
Chrome Cache Entry: 160
ASCII text, with very long lines (65450), with CRLF line terminators
dropped
Chrome Cache Entry: 165
ASCII text, with no line terminators
downloaded
Chrome Cache Entry: 166
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592
dropped
Chrome Cache Entry: 167
MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
downloaded
Chrome Cache Entry: 168
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113378
downloaded
Chrome Cache Entry: 170
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=5, orientation=upper-left], baseline, precision 8, 182x60, components 3
dropped
There are 4 hidden files, click here to show them.

URLs

Name
IP
Malicious
https://unilever.sharepoint.com/sites/VelocityVendorRequestTool/Shared%20Documents/Forms/AllItems.aspx?id=%2Fsites%2FVelocityVendorRequestTool%2FShared%20Documents%2FSupport%2Epdf&parent=%2Fsites%2FVelocityVendorRequestTool%2FShared%20Documents&p=true
https://login.microsoftonline.com/f66fae02-5d36-495b-bfe0-78a6ff9f8e6e/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=3DB2E172216CD123CDCD7E4EB9DE5F55CBCBE200471AD9A8%2D48308F682EEEAA594D94331111324E6CEF9453C897971B61AC6999A2E7AA06D6&redirect%5Furi=https%3A%2F%2Funilever%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&domain%5Fhint=unilever%2Ecom&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=f51b5da1%2Dc0b9%2Da000%2D4b37%2D4e5e5029c9af&sso_reload=true
https://login.microsoftonline.com/f66fae02-5d36-495b-bfe0-78a6ff9f8e6e/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=3DB2E172216CD123CDCD7E4EB9DE5F55CBCBE200471AD9A8%2D48308F682EEEAA594D94331111324E6CEF9453C897971B61AC6999A2E7AA06D6&redirect%5Furi=https%3A%2F%2Funilever%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&domain%5Fhint=unilever%2Ecom&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=f51b5da1%2Dc0b9%2Da000%2D4b37%2D4e5e5029c9af

Domains

Name
IP
Malicious
dual-spo-0005.spo-msedge.net
13.107.136.10
sni1gl.wpc.upsiloncdn.net
152.199.21.175
sni1gl.wpc.omegacdn.net
152.199.21.175
s-part-0017.t-0009.fb-t-msedge.net
13.107.253.45
s-part-0017.t-0009.t-msedge.net
13.107.246.45
www.google.com
142.250.186.132
aadcdn.msauthimages.net
unknown
unilever.sharepoint.com
unknown
identity.nel.measure.office.net
unknown
aadcdn.msftauth.net
unknown
login.microsoftonline.com
unknown
There are 1 hidden domains, click here to show them.

IPs

IP
Domain
Country
Malicious
34.104.35.123
unknown
United States
13.107.136.10
dual-spo-0005.spo-msedge.net
United States
216.58.212.138
unknown
United States
40.126.32.140
unknown
United States
13.107.246.45
s-part-0017.t-0009.t-msedge.net
United States
192.168.2.16
unknown
unknown
13.107.253.45
s-part-0017.t-0009.fb-t-msedge.net
United States
142.250.185.110
unknown
United States
142.250.185.238
unknown
United States
239.255.255.250
unknown
Reserved
142.250.185.163
unknown
United States
2.16.164.19
unknown
European Union
152.199.21.175
sni1gl.wpc.upsiloncdn.net
United States
142.250.186.132
www.google.com
United States
40.126.32.136
unknown
United States
172.217.16.195
unknown
United States
66.102.1.84
unknown
United States
There are 7 hidden IPs, click here to show them.