IOC Report
https://dl3.xmind.app/Xmind-for-Windows-x64bit-24.10.01101-202410202317.exe

loading gif

Files

File Path
Type
Category
Malicious
C:\Users\user\Downloads\Unconfirmed 858745.crdownload
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
dropped

Processes

Path
Cmdline
Malicious
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1940 --field-trial-handle=2476,i,8415214140440152596,1170151013612774235,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://dl3.xmind.app/Xmind-for-Windows-x64bit-24.10.01101-202410202317.exe"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3996 --field-trial-handle=2476,i,8415214140440152596,1170151013612774235,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

URLs

Name
IP
Malicious
https://dl3.xmind.app/Xmind-for-Windows-x64bit-24.10.01101-202410202317.exe
http://nsis.sf.net/NSIS_ErrorError
unknown
https://dl3.xmind.app/Xmind-for-Windows-x64bit-24.10.01101-202410202317.exe
216.137.52.41

Domains

Name
IP
Malicious
www.google.com
142.250.181.68
dl3.xmind.app
216.137.52.41

IPs

IP
Domain
Country
Malicious
239.255.255.250
unknown
Reserved
142.250.181.68
www.google.com
United States
216.137.52.41
dl3.xmind.app
United States
192.168.2.4
unknown
unknown