Files
File Path
|
Type
|
Category
|
Malicious
|
|
---|---|---|---|---|
ELECTRONIC RECEIPT_Augustahealth.html
|
HTML document, ASCII text, with very long lines (65068), with CRLF line terminators
|
initial sample
|
||
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command
line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed May 22 22:38:23 2024, atime=Wed Sep 27 04:28:28
2023, length=1210144, window=hide
|
dropped
|
||
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command
line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed May 22 22:38:23 2024, atime=Wed Sep 27 04:28:28
2023, length=1210144, window=hide
|
dropped
|
||
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command
line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28
2023, length=1210144, window=hide
|
dropped
|
||
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command
line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed May 22 22:38:23 2024, atime=Wed Sep 27 04:28:28
2023, length=1210144, window=hide
|
dropped
|
||
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command
line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed May 22 22:38:23 2024, atime=Wed Sep 27 04:28:28
2023, length=1210144, window=hide
|
dropped
|
||
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command
line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed May 22 22:38:23 2024, atime=Wed Sep 27 04:28:28
2023, length=1210144, window=hide
|
dropped
|
||
Chrome Cache Entry: 172
|
HTML document, Unicode text, UTF-8 text, with very long lines (941), with CRLF line terminators
|
dropped
|
||
Chrome Cache Entry: 173
|
PNG image data, 167 x 60, 8-bit/color RGBA, non-interlaced
|
downloaded
|
||
Chrome Cache Entry: 174
|
gzip compressed data, from Unix, original size modulo 2^32 15731
|
downloaded
|
||
Chrome Cache Entry: 175
|
gzip compressed data, original size modulo 2^32 3651
|
downloaded
|
||
Chrome Cache Entry: 176
|
PNG image data, 338 x 72, 8-bit/color RGBA, non-interlaced
|
dropped
|
||
Chrome Cache Entry: 177
|
PNG image data, 17 x 25, 8-bit/color RGBA, non-interlaced
|
dropped
|
||
Chrome Cache Entry: 178
|
gzip compressed data, from Unix, original size modulo 2^32 26954
|
downloaded
|
||
Chrome Cache Entry: 179
|
PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced
|
downloaded
|
||
Chrome Cache Entry: 180
|
GIF image data, version 89a, 352 x 3
|
downloaded
|
||
Chrome Cache Entry: 181
|
MS Windows icon resource - 5 icons, 16x16 with PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, 24x24
with PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced, 32 bits/pixel
|
downloaded
|
||
Chrome Cache Entry: 182
|
HTML document, Unicode text, UTF-8 text, with very long lines (941), with CRLF line terminators
|
downloaded
|
||
Chrome Cache Entry: 183
|
Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
|
downloaded
|
||
Chrome Cache Entry: 184
|
PNG image data, 16 x 25, 8-bit/color RGBA, non-interlaced
|
dropped
|
||
Chrome Cache Entry: 185
|
ASCII text, with CRLF line terminators
|
downloaded
|
||
Chrome Cache Entry: 186
|
PNG image data, 89 x 18, 8-bit/color RGBA, non-interlaced
|
dropped
|
||
Chrome Cache Entry: 187
|
gzip compressed data, original size modulo 2^32 1864
|
dropped
|
||
Chrome Cache Entry: 188
|
ASCII text, with CRLF line terminators
|
downloaded
|
||
Chrome Cache Entry: 189
|
ASCII text, with no line terminators
|
downloaded
|
||
Chrome Cache Entry: 190
|
GIF image data, version 89a, 22 x 22
|
downloaded
|
||
Chrome Cache Entry: 191
|
gzip compressed data, from Unix, original size modulo 2^32 55363
|
downloaded
|
||
Chrome Cache Entry: 192
|
PNG image data, 16 x 25, 8-bit/color RGBA, non-interlaced
|
downloaded
|
||
Chrome Cache Entry: 193
|
gzip compressed data, from Unix, original size modulo 2^32 141568
|
downloaded
|
||
Chrome Cache Entry: 194
|
gzip compressed data, from Unix, original size modulo 2^32 444961
|
downloaded
|
||
Chrome Cache Entry: 195
|
PNG image data, 338 x 72, 8-bit/color RGBA, non-interlaced
|
downloaded
|
||
Chrome Cache Entry: 196
|
PNG image data, 17 x 25, 8-bit/color RGBA, non-interlaced
|
downloaded
|
||
Chrome Cache Entry: 197
|
ASCII text, with CRLF line terminators
|
downloaded
|
||
Chrome Cache Entry: 198
|
ASCII text, with CRLF line terminators
|
downloaded
|
||
Chrome Cache Entry: 199
|
PNG image data, 89 x 18, 8-bit/color RGBA, non-interlaced
|
dropped
|
||
Chrome Cache Entry: 200
|
gzip compressed data, original size modulo 2^32 3651
|
dropped
|
||
Chrome Cache Entry: 201
|
GIF image data, version 89a, 22 x 22
|
dropped
|
||
Chrome Cache Entry: 202
|
gzip compressed data, from Unix, original size modulo 2^32 2628
|
downloaded
|
||
Chrome Cache Entry: 203
|
gzip compressed data, original size modulo 2^32 513
|
downloaded
|
||
Chrome Cache Entry: 204
|
gzip compressed data, from Unix, original size modulo 2^32 40329
|
downloaded
|
||
Chrome Cache Entry: 205
|
GIF image data, version 89a, 24 x 24
|
downloaded
|
||
Chrome Cache Entry: 206
|
PNG image data, 167 x 60, 8-bit/color RGBA, non-interlaced
|
dropped
|
||
Chrome Cache Entry: 207
|
gzip compressed data, from Unix, original size modulo 2^32 26690
|
downloaded
|
||
Chrome Cache Entry: 208
|
gzip compressed data, from Unix, original size modulo 2^32 113124
|
downloaded
|
||
Chrome Cache Entry: 209
|
Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
|
downloaded
|
||
Chrome Cache Entry: 210
|
GIF image data, version 89a, 24 x 24
|
dropped
|
||
Chrome Cache Entry: 211
|
gzip compressed data, original size modulo 2^32 1864
|
downloaded
|
||
Chrome Cache Entry: 212
|
gzip compressed data, from Unix, original size modulo 2^32 102833
|
downloaded
|
||
Chrome Cache Entry: 213
|
ASCII text, with CRLF line terminators
|
downloaded
|
||
Chrome Cache Entry: 214
|
gzip compressed data, original size modulo 2^32 513
|
dropped
|
||
Chrome Cache Entry: 215
|
PNG image data, 89 x 18, 8-bit/color RGBA, non-interlaced
|
downloaded
|
||
Chrome Cache Entry: 216
|
GIF image data, version 89a, 352 x 3
|
dropped
|
||
Chrome Cache Entry: 217
|
GIF image data, version 89a, 352 x 3
|
dropped
|
||
Chrome Cache Entry: 218
|
PNG image data, 89 x 18, 8-bit/color RGBA, non-interlaced
|
downloaded
|
||
Chrome Cache Entry: 219
|
gzip compressed data, from Unix, original size modulo 2^32 89501
|
downloaded
|
||
Chrome Cache Entry: 220
|
PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced
|
dropped
|
||
Chrome Cache Entry: 221
|
GIF image data, version 89a, 352 x 3
|
downloaded
|
||
Chrome Cache Entry: 222
|
MS Windows icon resource - 5 icons, 16x16 with PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, 24x24
with PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced, 32 bits/pixel
|
dropped
|
||
Chrome Cache Entry: 223
|
gzip compressed data, from Unix, original size modulo 2^32 223896
|
downloaded
|
There are 49 hidden files, click here to show them.
Processes
Path
|
Cmdline
|
Malicious
|
|
---|---|---|---|
C:\Program Files\Google\Chrome\Application\chrome.exe
|
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\ELECTRONIC RECEIPT_Augustahealth.html"
|
||
C:\Program Files\Google\Chrome\Application\chrome.exe
|
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US
--service-sandbox-type=none --mojo-platform-channel-handle=2340 --field-trial-handle=2188,i,11909889322955057231,7924698504520723390,262144
/prefetch:8
|
URLs
Name
|
IP
|
Malicious
|
|
---|---|---|---|
file:///C:/Users/user/Desktop/ELECTRONIC%20RECEIPT_Augustahealth.html
|
Domains
Name
|
IP
|
Malicious
|
|
---|---|---|---|
b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com
|
170.130.165.102
|
||
bcf693cc-04bafa98.consultingexpertiseinc.com
|
170.130.165.102
|
||
a135181d-04bafa98.consultingexpertiseinc.com
|
170.130.165.102
|
||
2a14037b-04bafa98.consultingexpertiseinc.com
|
170.130.165.102
|
||
www.google.com
|
142.250.184.228
|
||
fa3fa60b-04bafa98.consultingexpertiseinc.com
|
170.130.165.102
|
||
f4438677-04bafa98.consultingexpertiseinc.com
|
170.130.165.102
|
||
44069f49-04bafa98.consultingexpertiseinc.com
|
170.130.165.102
|
||
6b520068-04bafa98.consultingexpertiseinc.com
|
170.130.165.102
|
||
97d79e89-04bafa98.consultingexpertiseinc.com
|
170.130.165.102
|
||
l1ve.consultingexpertiseinc.com
|
170.130.165.102
|
There are 1 hidden domains, click here to show them.
IPs
IP
|
Domain
|
Country
|
Malicious
|
|
---|---|---|---|---|
170.130.165.102
|
bcf693cc-04bafa98.consultingexpertiseinc.com
|
United States
|
||
192.168.2.5
|
unknown
|
unknown
|
||
239.255.255.250
|
unknown
|
Reserved
|
||
142.250.184.228
|
www.google.com
|
United States
|
||
172.217.16.132
|
unknown
|
United States
|
DOM / HTML
URL
|
Malicious
|
|
---|---|---|
https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com/?v4hgHT=pUepMZ&username=dsmallwood%40augustahealth.com
|
||
https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com/?v4hgHT=pUepMZ&username=dsmallwood%40augustahealth.com
|
||
https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com/?v4hgHT=pUepMZ&username=dsmallwood%40augustahealth.com&sso_reload=true
|
||
https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com/?v4hgHT=pUepMZ&username=dsmallwood%40augustahealth.com&sso_reload=true
|
||
https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com/?v4hgHT=pUepMZ&username=dsmallwood%40augustahealth.com&sso_reload=true
|
||
https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com/?v4hgHT=pUepMZ&username=dsmallwood%40augustahealth.com&sso_reload=true
|
||
file:///C:/Users/user/Desktop/ELECTRONIC%20RECEIPT_Augustahealth.html
|
||
https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com/?v4hgHT=pUepMZ&username=dsmallwood%40augustahealth.com
|
||
https://f4438677-04bafa98.consultingexpertiseinc.com/Prefetch/Prefetch.aspx
|
||
https://97d79e89-04bafa98.consultingexpertiseinc.com/?ru=https%3a%2f%2fb7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com%2fcommon%2freprocess%3fctx%3drQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAT8_kYvmBV623XKv3lX5zSsS1jFqEzYCP0LjIwvGBknMcmkFOcm5uSU5-enOCSWppcWlyRmpCbmlGSAVN1iEvQvSvdMCS92S01JLUosyczPe8SMV8sFFoFXLDwGzFYcHFwCDBIMCgw_WBgXsQLdmbNik9nxHcd9WgUePPhiL8lwilU_ySzUy7kkO8XP1MNA28IsPMwkIs2gMjgiKtzJ3K0q2yfTMc9SPzQs3Mc51NbEynACm9AENqZTbAwf2Bg72BlmsTMc4GQ8wMvwg69ld1Nz6_V57zxe8etEGVflm1UkVVlWBXlGmFkaBacl-RWb-XiXFpj4JmZY5Lo7Fnn5R3m4GBgE2m4QYAAA0&mkt=en-US&hosted=0&device_platform=Windows+10
|
||
https://97d79e89-04bafa98.consultingexpertiseinc.com/?ru=https%3a%2f%2fb7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com%2fcommon%2freprocess%3fctx%3drQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAT8_kYvmBV623XKv3lX5zSsS1jFqEzYCP0LjIwvGBknMcmkFOcm5uSU5-enOCSWppcWlyRmpCbmlGSAVN1iEvQvSvdMCS92S01JLUosyczPe8SMV8sFFoFXLDwGzFYcHFwCDBIMCgw_WBgXsQLdmbNik9nxHcd9WgUePPhiL8lwilU_ySzUy7kkO8XP1MNA28IsPMwkIs2gMjgiKtzJ3K0q2yfTMc9SPzQs3Mc51NbEynACm9AENqZTbAwf2Bg72BlmsTMc4GQ8wMvwg69ld1Nz6_V57zxe8etEGVflm1UkVVlWBXlGmFkaBacl-RWb-XiXFpj4JmZY5Lo7Fnn5R3m4GBgE2m4QYAAA0&mkt=en-US&hosted=0&device_platform=Windows+10
|
||
https://97d79e89-04bafa98.consultingexpertiseinc.com/?ru=https%3a%2f%2fb7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com%2fcommon%2freprocess%3fctx%3drQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAT8_kYvmBV623XKv3lX5zSsS1jFqEzYCP0LjIwvGBknMcmkFOcm5uSU5-enOCSWppcWlyRmpCbmlGSAVN1iEvQvSvdMCS92S01JLUosyczPe8SMV8sFFoFXLDwGzFYcHFwCDBIMCgw_WBgXsQLdmbNik9nxHcd9WgUePPhiL8lwilU_ySzUy7kkO8XP1MNA28IsPMwkIs2gMjgiKtzJ3K0q2yfTMc9SPzQs3Mc51NbEynACm9AENqZTbAwf2Bg72BlmsTMc4GQ8wMvwg69ld1Nz6_V57zxe8etEGVflm1UkVVlWBXlGmFkaBacl-RWb-XiXFpj4JmZY5Lo7Fnn5R3m4GBgE2m4QYAAA0&mkt=en-US&hosted=0&device_platform=Windows+10
|
||
https://97d79e89-04bafa98.consultingexpertiseinc.com/?ru=https%3a%2f%2fb7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com%2fcommon%2freprocess%3fctx%3drQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAT8_kYvmBV623XKv3lX5zSsS1jFqEzYCP0LjIwvGBknMcmkFOcm5uSU5-enOCSWppcWlyRmpCbmlGSAVN1iEvQvSvdMCS92S01JLUosyczPe8SMV8sFFoFXLDwGzFYcHFwCDBIMCgw_WBgXsQLdmbNik9nxHcd9WgUePPhiL8lwilU_ySzUy7kkO8XP1MNA28IsPMwkIs2gMjgiKtzJ3K0q2yfTMc9SPzQs3Mc51NbEynACm9AENqZTbAwf2Bg72BlmsTMc4GQ8wMvwg69ld1Nz6_V57zxe8etEGVflm1UkVVlWBXlGmFkaBacl-RWb-XiXFpj4JmZY5Lo7Fnn5R3m4GBgE2m4QYAAA0&mkt=en-US&hosted=0&device_platform=Windows+10
|
There are 3 hidden doms, click here to show them.