IOC Report
http://www.beckmesser.de/

loading gif

Files

File Path
Type
Category
Malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 21:19:57 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 21:19:57 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 21:19:57 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 21:19:57 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 21:19:57 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
Chrome Cache Entry: 65
HTML document, ASCII text
downloaded
Chrome Cache Entry: 66
ASCII text, with very long lines (329), with CR line terminators
dropped
Chrome Cache Entry: 67
HTML document, ASCII text
downloaded
Chrome Cache Entry: 68
ASCII text
downloaded
Chrome Cache Entry: 69
GIF image data, version 89a, 58 x 47
downloaded
Chrome Cache Entry: 70
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 120x148, components 3
downloaded
Chrome Cache Entry: 71
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 120x148, components 3
dropped
Chrome Cache Entry: 72
GIF image data, version 89a, 41 x 24
downloaded
Chrome Cache Entry: 73
GIF image data, version 89a, 121 x 63
dropped
Chrome Cache Entry: 74
HTML document, ASCII text, with very long lines (387), with CR line terminators
downloaded
Chrome Cache Entry: 75
ASCII text, with very long lines (329), with CR line terminators
downloaded
Chrome Cache Entry: 76
GIF image data, version 89a, 129 x 35
dropped
Chrome Cache Entry: 77
GIF image data, version 89a, 121 x 63
downloaded
Chrome Cache Entry: 78
GIF image data, version 89a, 58 x 47
dropped
Chrome Cache Entry: 79
GIF image data, version 89a, 129 x 35
downloaded
Chrome Cache Entry: 80
HTML document, ASCII text, with CR line terminators
downloaded
Chrome Cache Entry: 81
GIF image data, version 89a, 41 x 24
dropped
Chrome Cache Entry: 82
HTML document, ASCII text
downloaded
There are 15 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 --field-trial-handle=2400,i,17571577324128591308,13681846696899668250,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://www.beckmesser.de/"

URLs

Name
IP
Malicious
http://www.beckmesser.de/
https://www.beckmesser.de/favicon.ico
185.101.156.75
https://www.beckmesser.de/images/nmz1.gif
185.101.156.75
http://groups.google.com/groups?q=
unknown
http://shopper.cnet.com/shopping/search/results/1
unknown
https://www.beckmesser.de/system-cgi/count/count.php?id=5&x=30&y=14&size=10&bg=474656&fg=fffaf0&lenght=5&transbg=false
185.101.156.75
https://www.beckmesser.de/images/neu.gif
185.101.156.75
http://search.msn.com/results.asp?RS=CHECKED&FORM=MSNH&v=1&q=
unknown
https://www.beckmesser.de/titel.html
185.101.156.75
https://www.beckmesser.de/GeneratedItems/CSScriptLib.js
185.101.156.75
http://www.lycos.com/cgi-bin/pursuit?query=
unknown
https://www.beckmesser.de/stylesheets/neue_musik.css
185.101.156.75
http://search.excite.com/search.gw?c=web&lk=webcrawler&onload=&s=
unknown
http://www.beckmesser.de/
185.101.156.75
https://www.beckmesser.de/navi.html
185.101.156.75
http://www.excite.com/search.gw?trace=a&search=
unknown
https://www.beckmesser.de/images/beck_engl.gif
185.101.156.75
http://search.yahoo.com/bin/search?p=
unknown
http://www.google.com/search?q=
unknown
https://www.beckmesser.de/
https://www.beckmesser.de/images/gzw.jpg
185.101.156.75
http://www.search.hotbot.com/hResult.html?SM=MC&MT=
unknown
https://www.beckmesser.de/images/home-n.gif
185.101.156.75
http://www.altavista.digital.com/cgi-bin/query?pg=q&what=web&fmt=.&q=
unknown
http://www.beckmesser.info
unknown
There are 14 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
s-part-0017.t-0009.t-msedge.net
13.107.246.45
www.google.com
142.250.185.228
www.beckmesser.de
185.101.156.75
fp2e7a.wpc.phicdn.net
192.229.221.95

IPs

IP
Domain
Country
Malicious
142.250.185.228
www.google.com
United States
239.255.255.250
unknown
Reserved
192.168.2.4
unknown
unknown
185.101.156.75
www.beckmesser.de
Switzerland
192.168.2.5
unknown
unknown

DOM / HTML

URL
Malicious
https://www.beckmesser.de/
https://www.beckmesser.de/