IOC Report
https://www.google.co.uk/url?q=38pQvvq6xRyj7Y00xDjnlx9kIHOSozurMOiaAkImPuQJnOIWtJjqJLi6stjtDz3yh&rct=tTPSrMOiaAkImPuQJnOIWtJjqJLi6stjtFX08pQvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&url=amp/taxigiarebienhoa.vn/nini/ybmex/captcha/Z3VsYW1yYXN1bC5jaGVwdXdhbGFAY2V2YWxvZ2lzdGljcy5jb20

loading gif

Files

File Path
Type
Category
Malicious
Chrome Cache Entry: 53
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 7390
dropped
Chrome Cache Entry: 54
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 513
dropped
Chrome Cache Entry: 55
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
dropped
Chrome Cache Entry: 56
ASCII text, with very long lines (49854)
dropped
Chrome Cache Entry: 57
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 250
dropped
Chrome Cache Entry: 58
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 59
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1864
downloaded
Chrome Cache Entry: 60
SVG Scalable Vector Graphics image
dropped
Chrome Cache Entry: 61
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 513
downloaded
Chrome Cache Entry: 62
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 7390
downloaded
Chrome Cache Entry: 63
Unicode text, UTF-8 (with BOM) text
downloaded
Chrome Cache Entry: 64
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
downloaded
Chrome Cache Entry: 65
PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
dropped
Chrome Cache Entry: 66
gzip compressed data, from Unix, truncated
downloaded
Chrome Cache Entry: 67
Unicode text, UTF-8 text, with very long lines (64593)
downloaded
Chrome Cache Entry: 68
ASCII text, with no line terminators
downloaded
Chrome Cache Entry: 69
ASCII text, with very long lines (49854)
downloaded
Chrome Cache Entry: 70
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 250
downloaded
Chrome Cache Entry: 71
PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
downloaded
Chrome Cache Entry: 72
JSON data
dropped
Chrome Cache Entry: 73
Unicode text, UTF-8 text, with very long lines (64593)
dropped
Chrome Cache Entry: 74
HTML document, ASCII text
downloaded
Chrome Cache Entry: 75
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1864
dropped
Chrome Cache Entry: 76
HTML document, Unicode text, UTF-8 text, with CRLF line terminators
downloaded
There are 15 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=2004,i,6732713318818398282,15989953615233870441,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.google.co.uk/url?q=38pQvvq6xRyj7Y00xDjnlx9kIHOSozurMOiaAkImPuQJnOIWtJjqJLi6stjtDz3yh&rct=tTPSrMOiaAkImPuQJnOIWtJjqJLi6stjtFX08pQvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&url=amp/taxigiarebienhoa.vn/nini/ybmex/captcha/Z3VsYW1yYXN1bC5jaGVwdXdhbGFAY2V2YWxvZ2lzdGljcy5jb20"

URLs

Name
IP
Malicious
https://www.google.co.uk/url?q=38pQvvq6xRyj7Y00xDjnlx9kIHOSozurMOiaAkImPuQJnOIWtJjqJLi6stjtDz3yh&rct=tTPSrMOiaAkImPuQJnOIWtJjqJLi6stjtFX08pQvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&url=amp/taxigiarebienhoa.vn/nini/ybmex/captcha/Z3VsYW1yYXN1bC5jaGVwdXdhbGFAY2V2YWxvZ2lzdGljcy5jb20
malicious
https://rieg.riegriegrieg.com/favicon.ico
192.185.209.0
 malicious
https://rieg.riegriegrieg.com/n/?c3Y9bzM2NV8xX25vbSZyYW5kPVZFMW5halE9JnVpZD1VU0VSMDkxMDIwMjRVNDQxMDA5MjE=N0123N
192.185.209.0
 malicious
https://rieg.riegriegrieg.com/n/jsnom.js
192.185.209.0
 malicious
https://rieg.riegriegrieg.com/n/?c3Y9bzM2NV8xX25vbSZyYW5kPVZFMW5halE9JnVpZD1VU0VSMDkxMDIwMjRVNDQxMDA5MjE=N0123N#Z3VsYW1yYXN1bC5jaGVwdXdhbGFAY2V2YWxvZ2lzdGljcy5jb20
malicious
https://www.google.co.uk/url?q=38pQvvq6xRyj7Y00xDjnlx9kIHOSozurMOiaAkImPuQJnOIWtJjqJLi6stjtDz3yh&rct=tTPSrMOiaAkImPuQJnOIWtJjqJLi6stjtFX08pQvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&url=amp/taxigiarebienhoa.vn/nini/ybmex/captcha/Z3VsYW1yYXN1bC5jaGVwdXdhbGFAY2V2YWxvZ2lzdGljcy5jb20
172.217.16.195
https://sandoom2notnt.com/socket.io/?EIO=4&transport=polling&t=PB7beRv&sid=JMhweoIWN1gqZtHIAAXf
188.114.97.3
https://sandoom2notnt.com/socket.io/?EIO=4&transport=polling&t=PB7bfLd&sid=JMhweoIWN1gqZtHIAAXf
188.114.97.3
https://cdn.socket.io/4.6.0/socket.io.min.js
unknown
https://www.hostgator.com.br
unknown
https://www.google.co.uk/amp/taxigiarebienhoa.vn/nini/ybmex/captcha/Z3VsYW1yYXN1bC5jaGVwdXdhbGFAY2V2YWxvZ2lzdGljcy5jb20
172.217.16.195
https://aadcdn.msftauth.net/shared/1.0/content/images/picker_verify_code_b41922ebdaebec16b19999fc6054a15a.svg
152.199.21.175
https://aadcdn.msftauth.net/shared/1.0/content/images/appbackgrounds/49_6ffe0a92d779c878835b40171ffc
unknown
https://www.w3schools.com/w3css/4/w3.css
192.229.133.221
https://sandoom2notnt.com/socket.io/?EIO=4&transport=polling&t=PB7bdZX
188.114.97.3
https://sandoom2notnt.com/socket.io/?EIO=4&transport=websocket&sid=JMhweoIWN1gqZtHIAAXf
188.114.97.3
https://google.com
unknown
https://cdn.socket.io/4.7.5/socket.io.min.js
18.245.31.89
https://sandoom2notnt.com/socket.io/?EIO=4&transport=polling&t=PB7beRs&sid=JMhweoIWN1gqZtHIAAXf
188.114.97.3
http://taxigiarebienhoa.vn/favicon.ico
103.255.237.40
http://taxigiarebienhoa.vn/nini/ybmex/captcha/Z3VsYW1yYXN1bC5jaGVwdXdhbGFAY2V2YWxvZ2lzdGljcy5jb20
https://sandoom2notnt.com/socket.io/?EIO=4&transport=polling&t=PB7bfLc&sid=JMhweoIWN1gqZtHIAAXf
188.114.97.3
There are 11 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
rieg.riegriegrieg.com
192.185.209.0
 malicious
d2vgu95hoyrpkh.cloudfront.net
18.245.31.89
cs837.wac.edgecastcdn.net
192.229.133.221
www.google.co.uk
172.217.16.195
s-part-0017.t-0009.t-msedge.net
13.107.246.45
sni1gl.wpc.omegacdn.net
152.199.21.175
www.google.com
142.250.184.196
sandoom2notnt.com
188.114.97.3
taxigiarebienhoa.vn
103.255.237.40
s-part-0032.t-0009.t-msedge.net
13.107.246.60
fp2e7a.wpc.phicdn.net
192.229.221.95
windowsupdatebg.s.llnwi.net
87.248.204.0
aadcdn.msftauth.net
unknown
www.w3schools.com
unknown
cdn.socket.io
unknown
There are 5 hidden domains, click here to show them.

IPs

IP
Domain
Country
Malicious
192.185.209.0
rieg.riegriegrieg.com
United States
malicious
192.168.2.4
unknown
unknown
malicious
142.250.184.196
www.google.com
United States
13.107.246.45
s-part-0017.t-0009.t-msedge.net
United States
18.245.31.89
d2vgu95hoyrpkh.cloudfront.net
United States
18.245.31.78
unknown
United States
192.229.133.221
cs837.wac.edgecastcdn.net
United States
13.107.246.60
s-part-0032.t-0009.t-msedge.net
United States
103.255.237.40
taxigiarebienhoa.vn
Viet Nam
239.255.255.250
unknown
Reserved
188.114.97.3
sandoom2notnt.com
European Union
152.199.21.175
sni1gl.wpc.omegacdn.net
United States
172.217.16.195
www.google.co.uk
United States
There are 3 hidden IPs, click here to show them.

DOM / HTML

URL
Malicious
https://rieg.riegriegrieg.com/n/?c3Y9bzM2NV8xX25vbSZyYW5kPVZFMW5halE9JnVpZD1VU0VSMDkxMDIwMjRVNDQxMDA5MjE=N0123N#Z3VsYW1yYXN1bC5jaGVwdXdhbGFAY2V2YWxvZ2lzdGljcy5jb20
 malicious
https://rieg.riegriegrieg.com/n/?c3Y9bzM2NV8xX25vbSZyYW5kPVZFMW5halE9JnVpZD1VU0VSMDkxMDIwMjRVNDQxMDA5MjE=N0123N#Z3VsYW1yYXN1bC5jaGVwdXdhbGFAY2V2YWxvZ2lzdGljcy5jb20
 malicious
http://taxigiarebienhoa.vn/nini/ybmex/captcha/Z3VsYW1yYXN1bC5jaGVwdXdhbGFAY2V2YWxvZ2lzdGljcy5jb20