IOC Report
http://www.bethelwoods.org

loading gif

Files

File Path
Type
Category
Malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jan 15 16:31:02 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jan 15 16:31:02 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 5 07:00:51 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jan 15 16:31:02 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jan 15 16:31:02 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jan 15 16:31:02 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
Chrome Cache Entry: 101
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 800x532, components 3
dropped
Chrome Cache Entry: 102
PNG image data, 1800 x 750, 8-bit/color RGB, non-interlaced
dropped
Chrome Cache Entry: 103
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 2000x1333, components 3
dropped
Chrome Cache Entry: 104
PNG image data, 1800 x 750, 8-bit/color RGB, non-interlaced
downloaded
Chrome Cache Entry: 105
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 800x533, components 3
downloaded
Chrome Cache Entry: 106
PNG image data, 1000 x 250, 8-bit/color RGBA, non-interlaced
dropped
Chrome Cache Entry: 107
exported SGML document, ASCII text, with very long lines (1630)
dropped
Chrome Cache Entry: 108
PNG image data, 1800 x 750, 8-bit/color RGB, non-interlaced
downloaded
Chrome Cache Entry: 109
Web Open Font Format (Version 2), TrueType, length 15168, version 1.0
downloaded
Chrome Cache Entry: 110
ASCII text, with very long lines (3910)
downloaded
Chrome Cache Entry: 111
ASCII text, with very long lines (1305)
downloaded
Chrome Cache Entry: 112
PNG image data, 1800 x 750, 8-bit/color RGB, non-interlaced
dropped
Chrome Cache Entry: 113
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 800x532, components 3
dropped
Chrome Cache Entry: 114
ASCII text, with very long lines (32029)
dropped
Chrome Cache Entry: 115
ASCII text
downloaded
Chrome Cache Entry: 116
ASCII text
dropped
Chrome Cache Entry: 117
ASCII text, with very long lines (65536), with no line terminators
downloaded
Chrome Cache Entry: 118
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 800x532, components 3
downloaded
Chrome Cache Entry: 119
Web Open Font Format (Version 2), TrueType, length 15476, version 1.0
downloaded
Chrome Cache Entry: 120
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 800x533, components 3
dropped
Chrome Cache Entry: 121
ASCII text, with very long lines (65483)
dropped
Chrome Cache Entry: 122
ASCII text
downloaded
Chrome Cache Entry: 123
HTML document, ASCII text, with very long lines (654)
downloaded
Chrome Cache Entry: 124
PNG image data, 160 x 40, 8-bit/color RGBA, non-interlaced
dropped
Chrome Cache Entry: 125
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 800x532, components 3
downloaded
Chrome Cache Entry: 126
Web Open Font Format, TrueType, length 2636, version 1.0
downloaded
Chrome Cache Entry: 127
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 800x532, components 3
downloaded
Chrome Cache Entry: 128
PNG image data, 1800 x 750, 8-bit/color RGB, non-interlaced
downloaded
Chrome Cache Entry: 129
JSON data
dropped
Chrome Cache Entry: 130
HTML document, ASCII text, with very long lines (1238)
downloaded
Chrome Cache Entry: 131
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 800x532, components 3
dropped
Chrome Cache Entry: 132
ASCII text, with very long lines (32147)
downloaded
Chrome Cache Entry: 133
TrueType Font data, 16 tables, 1st "GPOS", 26 names, Macintosh, Copyright \251 2004 - 2007 Linotype GmbH, www.linotype.com. All rights reserved. This font softw
downloaded
Chrome Cache Entry: 134
MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
downloaded
Chrome Cache Entry: 135
ASCII text
downloaded
Chrome Cache Entry: 136
ASCII text, with no line terminators
downloaded
Chrome Cache Entry: 137
Web Open Font Format (Version 2), TrueType, length 12708, version 1.0
downloaded
Chrome Cache Entry: 138
ASCII text, with very long lines (65024)
downloaded
Chrome Cache Entry: 139
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 800x532, components 3
downloaded
Chrome Cache Entry: 140
ASCII text, with very long lines (1061)
downloaded
Chrome Cache Entry: 141
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 800x532, components 3
downloaded
Chrome Cache Entry: 142
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 800x532, components 3
downloaded
Chrome Cache Entry: 143
ASCII text, with very long lines (65483)
downloaded
Chrome Cache Entry: 144
Web Open Font Format (Version 2), TrueType, length 23216, version 1.0
downloaded
Chrome Cache Entry: 145
HTML document, ASCII text, with very long lines (1238)
dropped
Chrome Cache Entry: 146
Web Open Font Format (Version 2), TrueType, length 16020, version 1.0
downloaded
Chrome Cache Entry: 147
Web Open Font Format (Version 2), TrueType, length 18760, version 2.6553
downloaded
Chrome Cache Entry: 148
Web Open Font Format (Version 2), TrueType, length 16560, version 2.6553
downloaded
Chrome Cache Entry: 149
ASCII text, with very long lines (32029)
downloaded
Chrome Cache Entry: 150
PNG image data, 1800 x 750, 8-bit/color RGB, non-interlaced
downloaded
Chrome Cache Entry: 151
ASCII text, with very long lines (1434), with no line terminators
downloaded
Chrome Cache Entry: 152
ASCII text, with very long lines (1434), with no line terminators
dropped
Chrome Cache Entry: 153
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 800x532, components 3
dropped
Chrome Cache Entry: 154
ASCII text
downloaded
Chrome Cache Entry: 155
ASCII text
downloaded
Chrome Cache Entry: 156
HTML document, ASCII text, with very long lines (654)
dropped
Chrome Cache Entry: 157
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 800x532, components 3
downloaded
Chrome Cache Entry: 158
Web Open Font Format, TrueType, length 24865, version 1.0
downloaded
Chrome Cache Entry: 159
PNG image data, 1800 x 750, 8-bit/color RGB, non-interlaced
dropped
Chrome Cache Entry: 160
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 800x532, components 3
dropped
Chrome Cache Entry: 161
ASCII text, with very long lines (1305)
dropped
Chrome Cache Entry: 162
ASCII text
downloaded
Chrome Cache Entry: 163
PNG image data, 1800 x 750, 8-bit/color RGB, non-interlaced
dropped
Chrome Cache Entry: 164
ASCII text, with very long lines (32147)
dropped
Chrome Cache Entry: 165
ASCII text, with very long lines (2512)
dropped
Chrome Cache Entry: 166
HTML document, ASCII text, with very long lines (5562), with CRLF, LF line terminators
downloaded
Chrome Cache Entry: 167
PNG image data, 160 x 40, 8-bit/color RGBA, non-interlaced
dropped
Chrome Cache Entry: 168
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 800x532, components 3
downloaded
Chrome Cache Entry: 169
PNG image data, 160 x 40, 8-bit/color RGBA, non-interlaced
downloaded
Chrome Cache Entry: 170
Web Open Font Format (Version 2), TrueType, length 15856, version 1.0
downloaded
Chrome Cache Entry: 171
PNG image data, 160 x 40, 8-bit/color RGBA, non-interlaced
downloaded
Chrome Cache Entry: 172
ASCII text, with very long lines (13080)
downloaded
Chrome Cache Entry: 173
ASCII text, with very long lines (65024)
dropped
Chrome Cache Entry: 174
ASCII text
dropped
Chrome Cache Entry: 175
Web Open Font Format, TrueType, length 20709, version 1.0
downloaded
Chrome Cache Entry: 176
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 800x532, components 3
dropped
Chrome Cache Entry: 177
ASCII text, with very long lines (2512)
downloaded
Chrome Cache Entry: 178
TrueType Font data, 16 tables, 1st "GPOS", 30 names, Macintosh, Copyright \251 2004 - 2007 Linotype GmbH, www.linotype.com. All rights reserved. This font softw
downloaded
Chrome Cache Entry: 179
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 800x532, components 3
dropped
Chrome Cache Entry: 180
TrueType Font data, 17 tables, 1st "LTSH", 22 names, Macintosh, \251 1999-2001, WolfBainX & Apostrophic Labs. All rights reserved. Visit www.apsotrophiclab.com
downloaded
Chrome Cache Entry: 181
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 2000x1333, components 3
downloaded
Chrome Cache Entry: 182
MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
dropped
Chrome Cache Entry: 183
PNG image data, 1000 x 250, 8-bit/color RGBA, non-interlaced
downloaded
Chrome Cache Entry: 184
exported SGML document, ASCII text, with very long lines (1630)
downloaded
There are 81 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2032 --field-trial-handle=1928,i,4644759013041422048,12174751424962130956,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://www.bethelwoods.org"

URLs

Name
IP
Malicious
http://www.bethelwoods.org
http://www.linotype.comhttp://www.linotype.com/fontdesignershttp://www.linotype.com/license
unknown
https://twitter.com/jacobrossi/status/480596438489890816
unknown
https://www.bethelwoods.org/files/main_style.css?1736780472
199.34.228.77
https://www.bethelwoods.org/uploads/5/8/7/2/58726453/dsc-0817.jpg
199.34.228.77
https://developers.google.com/recaptcha/docs/faq#localhost_support
unknown
https://www.bethelwoods.org/uploads/5/8/7/2/58726453/background-images/1096751491.jpg
199.34.228.77
https://cdn2.editmysite.com/fonts/wSocial/wsocial.woff?ts=1736455000640
151.101.1.46
https://support.google.com/recaptcha#6262736
unknown
https://www.bethelwoods.org/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
199.34.228.77
https://cdn2.editmysite.com/fonts/Cabin/bolditalic.woff2
151.101.1.46
https://cdn2.editmysite.com/fonts/Cabin/regular.woff2
151.101.1.46
https://www.bethelwoods.org/uploads/5/8/7/2/58726453/logo-2024-1_orig.png
199.34.228.77
https://www.bethelwoods.org/uploads/5/8/7/2/58726453/pancake-brunch-fundraiser-logo-15_orig.png
199.34.228.77
https://www.bethelwoods.org/files/theme/fonts/f26faddb-86cc-4477-a253-1e1287684336.woff?1736780472
199.34.228.77
https://www.bethelwoods.org/ajax/api/JsonRPC/CustomerAccounts/?CustomerAccounts[CustomerAccounts::getAccountDetails]
199.34.228.77
https://www.ultracamp.com/clientlogin.aspx?idCamp=465&campCode=bcc
unknown
https://support.google.com/recaptcha/?hl=en#6223828
unknown
https://www.bethelwoods.org/files/theme/fonts/63a74598-733c-4d0c-bd91-b01bffcd6e69.ttf?1736780472
199.34.228.77
https://www.bethelwoods.org/files/theme/fonts/46cf1067-688d-4aab-b0f7-bd942af6efd8.ttf?1736780472
199.34.228.77
https://cloud.google.com/contact
unknown
https://www.google.%/ads/ga-audiences?
unknown
https://www.gstatic.c..?/recaptcha/releases/zIriijn3uj5Vpknvt_LnfNbF/recaptcha__.
unknown
http://www.linotype.comhttp://www.linotype.com/fontdesignersNOTIFICATION
unknown
https://cdn2.editmysite.com/fonts/Cabin/italic.woff2
151.101.1.46
https://www.bethelwoods.org/uploads/5/8/7/2/58726453/dsc-0697.jpg
199.34.228.77
https://cdn2.editmysite.com/js/lang/en/stl.js?buildTime=1736455907&
151.101.1.46
https://support.google.com/recaptcha/#6175971
unknown
https://www.google.com/recaptcha/api.js
unknown
http://www.linotype.com/license
unknown
https://www.google.com/analytics/web/inpage/pub/inpage.js?
unknown
https://www.bethelwoods.org/files/theme/fonts/627fbb5a-3bae-4cd9-b617-2f923e29d55e.woff2?1736780472
199.34.228.77
https://www.bethelwoods.org/favicon.ico
199.34.228.77
https://www.google.com/recaptcha/api2/
unknown
http://www.linotype.comhttp://www.linotype.com/fontdesignershttp://www.linotype.com/licenseCopyright
unknown
https://cdn2.editmysite.com/fonts/Cabin/bold.woff2
151.101.1.46
https://cdn2.editmysite.com/fonts/Cabin/font.css?2
151.101.1.46
https://support.google.com/recaptcha
unknown
https://www.ultracamp.com/clientlogin.aspx?idCamp=465&campCode=bcc
unknown
https://www.bethelwoods.org/uploads/5/8/7/2/58726453/dsc-0067.jpg
199.34.228.77
https://www.bethelwoods.org/files/templateArtifacts.js?1736780472
199.34.228.77
https://cdn2.editmysite.com/fonts/Komika_Axis/font.css?2
151.101.1.46
https://www.bethelwoods.org/files/theme/fonts/1e9892c0-6927-4412-9874-1b82801ba47a.woff?1736780472
199.34.228.77
https://cdn2.editmysite.com/js/site/main.js?buildTime=1736455907
151.101.1.46
http://hammerjs.github.io/
unknown
https://cloud.google.com/recaptcha-enterprise/billing-information
unknown
https://www.bethelwoods.org/uploads/5/8/7/2/58726453/published/untitled-design.png?1727274392
199.34.228.77
https://www.bethelwoods.org/
https://www.google.com/recaptcha/api.js?_=1736962272523
142.250.184.228
https://cdn2.editmysite.com/js/jquery-1.8.3.min.js
151.101.1.46
https://www.bethelwoods.org/uploads/5/8/7/2/58726453/dsc-0114.jpg
199.34.228.77
https://www.bethelwoods.org/uploads/5/8/7/2/58726453/dsc-0334.jpg
199.34.228.77
https://developers.google.com/recaptcha/docs/faq#my-computer-or-network-may-be-sending-automated-que
unknown
https://cdn2.editmysite.com/fonts/Amaranth/bold.woff2
151.101.1.46
https://www.bethelwoods.org/uploads/5/8/7/2/58726453/published/untitled-design.png?1728568775
199.34.228.77
https://cdn2.editmysite.com/fonts/Montserrat/regular.woff2
151.101.1.46
https://play.google.com/log?format=json&hasfast=true
unknown
https://cdn2.editmysite.com/css/social-icons.css?buildtime=1736455907
151.101.1.46
https://www.bethelwoods.org/uploads/5/8/7/2/58726453/dsc-0026.jpg
199.34.228.77
https://www.bethelwoods.org/uploads/5/8/7/2/58726453/pancake-brunch-fundraiser-logo-14_orig.png
199.34.228.77
https://cdn2.editmysite.com/fonts/Komika_Axis/regular.ttf
151.101.1.46
https://www.bethelwoods.org/uploads/5/8/7/2/58726453/dsc-0196.jpg
199.34.228.77
https://developers.google.com/recaptcha/docs/faq#are-there-any-qps-or-daily-limits-on-my-use-of-reca
unknown
https://stats.g.doubleclick.net/j/collect?
unknown
https://www.bethelwoods.org/files/theme/custom.js?1565969634
199.34.228.77
https://ec.editmysite.com/com.snowplowanalytics.snowplow/tp2
44.240.99.243
https://www.bethelwoods.org/files/theme/fonts/2cd55546-ec00-4af9-aeca-4a3cd186da53.woff2?1736780472
199.34.228.77
https://cdn2.editmysite.com/js/site/main-customer-accounts-site.js?buildTime=1736455907
151.101.1.46
https://www.bethelwoods.org/uploads/5/8/7/2/58726453/pancake-brunch-fundraiser-logo-4_orig.png
199.34.228.77
https://www.bethelwoods.org/files/theme/plugins.js?1565969634
199.34.228.77
https://www.bethelwoods.org/uploads/5/8/7/2/58726453/dsc-0044.jpg
199.34.228.77
https://www.bethelwoods.org/uploads/5/8/7/2/58726453/pancake-brunch-fundraiser-logo-5_orig.png
199.34.228.77
https://cdn2.editmysite.com/css/sites.css?buildTime=1736455907
151.101.1.46
https://www.bethelwoods.org/uploads/5/8/7/2/58726453/00000193.jpg
199.34.228.77
https://cdn2.editmysite.com/js/wsnbn/snowday262.js
151.101.1.46
https://www.weebly.com/?utm_source=internal&utm_medium=footer&utm_campaign=2
unknown
https://cdn2.editmysite.com/css/old/fancybox.css?1736455907
151.101.1.46
https://cdn2.editmysite.com/fonts/Amaranth/font.css?2
151.101.1.46
https://cdn2.editmysite.com/fonts/Montserrat/font.css?2
151.101.1.46
There are 68 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
www.bethelwoods.org
199.34.228.77
 malicious
sp-2020021412301152490000000a-1069308460.us-west-2.elb.amazonaws.com
44.240.99.243
weebly.map.fastly.net
151.101.1.46
www.google.com
142.250.185.228
ec.editmysite.com
unknown
cdn2.editmysite.com
unknown
198.187.3.20.in-addr.arpa
unknown

IPs

IP
Domain
Country
Malicious
199.34.228.77
www.bethelwoods.org
United States
malicious
142.250.185.228
www.google.com
United States
192.168.2.8
unknown
unknown
151.101.1.46
weebly.map.fastly.net
United States
142.250.185.100
unknown
United States
44.240.99.243
sp-2020021412301152490000000a-1069308460.us-west-2.elb.amazonaws.com
United States
216.58.206.36
unknown
United States
239.255.255.250
unknown
Reserved
142.250.184.228
unknown
United States

DOM / HTML

URL
Malicious
https://www.bethelwoods.org/
https://www.bethelwoods.org/