IOC Report
ELECTRONIC RECEIPT_Augustahealth.html

loading gif

Files

File Path
Type
Category
Malicious
ELECTRONIC RECEIPT_Augustahealth.html
HTML document, ASCII text, with very long lines (65068), with CRLF line terminators
initial sample
malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed May 22 22:38:23 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed May 22 22:38:23 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed May 22 22:38:23 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed May 22 22:38:23 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed May 22 22:38:23 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
Chrome Cache Entry: 172
HTML document, Unicode text, UTF-8 text, with very long lines (941), with CRLF line terminators
dropped
Chrome Cache Entry: 173
PNG image data, 167 x 60, 8-bit/color RGBA, non-interlaced
downloaded
Chrome Cache Entry: 174
gzip compressed data, from Unix, original size modulo 2^32 15731
downloaded
Chrome Cache Entry: 175
gzip compressed data, original size modulo 2^32 3651
downloaded
Chrome Cache Entry: 176
PNG image data, 338 x 72, 8-bit/color RGBA, non-interlaced
dropped
Chrome Cache Entry: 177
PNG image data, 17 x 25, 8-bit/color RGBA, non-interlaced
dropped
Chrome Cache Entry: 178
gzip compressed data, from Unix, original size modulo 2^32 26954
downloaded
Chrome Cache Entry: 179
PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced
downloaded
Chrome Cache Entry: 180
GIF image data, version 89a, 352 x 3
downloaded
Chrome Cache Entry: 181
MS Windows icon resource - 5 icons, 16x16 with PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, 24x24 with PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced, 32 bits/pixel
downloaded
Chrome Cache Entry: 182
HTML document, Unicode text, UTF-8 text, with very long lines (941), with CRLF line terminators
downloaded
Chrome Cache Entry: 183
Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
downloaded
Chrome Cache Entry: 184
PNG image data, 16 x 25, 8-bit/color RGBA, non-interlaced
dropped
Chrome Cache Entry: 185
ASCII text, with CRLF line terminators
downloaded
Chrome Cache Entry: 186
PNG image data, 89 x 18, 8-bit/color RGBA, non-interlaced
dropped
Chrome Cache Entry: 187
gzip compressed data, original size modulo 2^32 1864
dropped
Chrome Cache Entry: 188
ASCII text, with CRLF line terminators
downloaded
Chrome Cache Entry: 189
ASCII text, with no line terminators
downloaded
Chrome Cache Entry: 190
GIF image data, version 89a, 22 x 22
downloaded
Chrome Cache Entry: 191
gzip compressed data, from Unix, original size modulo 2^32 55363
downloaded
Chrome Cache Entry: 192
PNG image data, 16 x 25, 8-bit/color RGBA, non-interlaced
downloaded
Chrome Cache Entry: 193
gzip compressed data, from Unix, original size modulo 2^32 141568
downloaded
Chrome Cache Entry: 194
gzip compressed data, from Unix, original size modulo 2^32 444961
downloaded
Chrome Cache Entry: 195
PNG image data, 338 x 72, 8-bit/color RGBA, non-interlaced
downloaded
Chrome Cache Entry: 196
PNG image data, 17 x 25, 8-bit/color RGBA, non-interlaced
downloaded
Chrome Cache Entry: 197
ASCII text, with CRLF line terminators
downloaded
Chrome Cache Entry: 198
ASCII text, with CRLF line terminators
downloaded
Chrome Cache Entry: 199
PNG image data, 89 x 18, 8-bit/color RGBA, non-interlaced
dropped
Chrome Cache Entry: 200
gzip compressed data, original size modulo 2^32 3651
dropped
Chrome Cache Entry: 201
GIF image data, version 89a, 22 x 22
dropped
Chrome Cache Entry: 202
gzip compressed data, from Unix, original size modulo 2^32 2628
downloaded
Chrome Cache Entry: 203
gzip compressed data, original size modulo 2^32 513
downloaded
Chrome Cache Entry: 204
gzip compressed data, from Unix, original size modulo 2^32 40329
downloaded
Chrome Cache Entry: 205
GIF image data, version 89a, 24 x 24
downloaded
Chrome Cache Entry: 206
PNG image data, 167 x 60, 8-bit/color RGBA, non-interlaced
dropped
Chrome Cache Entry: 207
gzip compressed data, from Unix, original size modulo 2^32 26690
downloaded
Chrome Cache Entry: 208
gzip compressed data, from Unix, original size modulo 2^32 113124
downloaded
Chrome Cache Entry: 209
Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
downloaded
Chrome Cache Entry: 210
GIF image data, version 89a, 24 x 24
dropped
Chrome Cache Entry: 211
gzip compressed data, original size modulo 2^32 1864
downloaded
Chrome Cache Entry: 212
gzip compressed data, from Unix, original size modulo 2^32 102833
downloaded
Chrome Cache Entry: 213
ASCII text, with CRLF line terminators
downloaded
Chrome Cache Entry: 214
gzip compressed data, original size modulo 2^32 513
dropped
Chrome Cache Entry: 215
PNG image data, 89 x 18, 8-bit/color RGBA, non-interlaced
downloaded
Chrome Cache Entry: 216
GIF image data, version 89a, 352 x 3
dropped
Chrome Cache Entry: 217
GIF image data, version 89a, 352 x 3
dropped
Chrome Cache Entry: 218
PNG image data, 89 x 18, 8-bit/color RGBA, non-interlaced
downloaded
Chrome Cache Entry: 219
gzip compressed data, from Unix, original size modulo 2^32 89501
downloaded
Chrome Cache Entry: 220
PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced
dropped
Chrome Cache Entry: 221
GIF image data, version 89a, 352 x 3
downloaded
Chrome Cache Entry: 222
MS Windows icon resource - 5 icons, 16x16 with PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, 24x24 with PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced, 32 bits/pixel
dropped
Chrome Cache Entry: 223
gzip compressed data, from Unix, original size modulo 2^32 223896
downloaded
There are 49 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\ELECTRONIC RECEIPT_Augustahealth.html"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 --field-trial-handle=2188,i,11909889322955057231,7924698504520723390,262144 /prefetch:8

URLs

Name
IP
Malicious
file:///C:/Users/user/Desktop/ELECTRONIC%20RECEIPT_Augustahealth.html
malicious

Domains

Name
IP
Malicious
b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com
170.130.165.102
malicious
bcf693cc-04bafa98.consultingexpertiseinc.com
170.130.165.102
a135181d-04bafa98.consultingexpertiseinc.com
170.130.165.102
2a14037b-04bafa98.consultingexpertiseinc.com
170.130.165.102
www.google.com
142.250.184.228
fa3fa60b-04bafa98.consultingexpertiseinc.com
170.130.165.102
f4438677-04bafa98.consultingexpertiseinc.com
170.130.165.102
44069f49-04bafa98.consultingexpertiseinc.com
170.130.165.102
6b520068-04bafa98.consultingexpertiseinc.com
170.130.165.102
97d79e89-04bafa98.consultingexpertiseinc.com
170.130.165.102
l1ve.consultingexpertiseinc.com
170.130.165.102
There are 1 hidden domains, click here to show them.

IPs

IP
Domain
Country
Malicious
170.130.165.102
bcf693cc-04bafa98.consultingexpertiseinc.com
United States
malicious
192.168.2.5
unknown
unknown
239.255.255.250
unknown
Reserved
142.250.184.228
www.google.com
United States
172.217.16.132
unknown
United States

DOM / HTML

URL
Malicious
https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com/?v4hgHT=pUepMZ&username=dsmallwood%40augustahealth.com
malicious
https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com/?v4hgHT=pUepMZ&username=dsmallwood%40augustahealth.com
malicious
https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com/?v4hgHT=pUepMZ&username=dsmallwood%40augustahealth.com&sso_reload=true
malicious
https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com/?v4hgHT=pUepMZ&username=dsmallwood%40augustahealth.com&sso_reload=true
malicious
https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com/?v4hgHT=pUepMZ&username=dsmallwood%40augustahealth.com&sso_reload=true
malicious
https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com/?v4hgHT=pUepMZ&username=dsmallwood%40augustahealth.com&sso_reload=true
malicious
file:///C:/Users/user/Desktop/ELECTRONIC%20RECEIPT_Augustahealth.html
https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com/?v4hgHT=pUepMZ&username=dsmallwood%40augustahealth.com
https://f4438677-04bafa98.consultingexpertiseinc.com/Prefetch/Prefetch.aspx
https://97d79e89-04bafa98.consultingexpertiseinc.com/?ru=https%3a%2f%2fb7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com%2fcommon%2freprocess%3fctx%3drQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAT8_kYvmBV623XKv3lX5zSsS1jFqEzYCP0LjIwvGBknMcmkFOcm5uSU5-enOCSWppcWlyRmpCbmlGSAVN1iEvQvSvdMCS92S01JLUosyczPe8SMV8sFFoFXLDwGzFYcHFwCDBIMCgw_WBgXsQLdmbNik9nxHcd9WgUePPhiL8lwilU_ySzUy7kkO8XP1MNA28IsPMwkIs2gMjgiKtzJ3K0q2yfTMc9SPzQs3Mc51NbEynACm9AENqZTbAwf2Bg72BlmsTMc4GQ8wMvwg69ld1Nz6_V57zxe8etEGVflm1UkVVlWBXlGmFkaBacl-RWb-XiXFpj4JmZY5Lo7Fnn5R3m4GBgE2m4QYAAA0&mkt=en-US&hosted=0&device_platform=Windows+10
https://97d79e89-04bafa98.consultingexpertiseinc.com/?ru=https%3a%2f%2fb7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com%2fcommon%2freprocess%3fctx%3drQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAT8_kYvmBV623XKv3lX5zSsS1jFqEzYCP0LjIwvGBknMcmkFOcm5uSU5-enOCSWppcWlyRmpCbmlGSAVN1iEvQvSvdMCS92S01JLUosyczPe8SMV8sFFoFXLDwGzFYcHFwCDBIMCgw_WBgXsQLdmbNik9nxHcd9WgUePPhiL8lwilU_ySzUy7kkO8XP1MNA28IsPMwkIs2gMjgiKtzJ3K0q2yfTMc9SPzQs3Mc51NbEynACm9AENqZTbAwf2Bg72BlmsTMc4GQ8wMvwg69ld1Nz6_V57zxe8etEGVflm1UkVVlWBXlGmFkaBacl-RWb-XiXFpj4JmZY5Lo7Fnn5R3m4GBgE2m4QYAAA0&mkt=en-US&hosted=0&device_platform=Windows+10
https://97d79e89-04bafa98.consultingexpertiseinc.com/?ru=https%3a%2f%2fb7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com%2fcommon%2freprocess%3fctx%3drQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAT8_kYvmBV623XKv3lX5zSsS1jFqEzYCP0LjIwvGBknMcmkFOcm5uSU5-enOCSWppcWlyRmpCbmlGSAVN1iEvQvSvdMCS92S01JLUosyczPe8SMV8sFFoFXLDwGzFYcHFwCDBIMCgw_WBgXsQLdmbNik9nxHcd9WgUePPhiL8lwilU_ySzUy7kkO8XP1MNA28IsPMwkIs2gMjgiKtzJ3K0q2yfTMc9SPzQs3Mc51NbEynACm9AENqZTbAwf2Bg72BlmsTMc4GQ8wMvwg69ld1Nz6_V57zxe8etEGVflm1UkVVlWBXlGmFkaBacl-RWb-XiXFpj4JmZY5Lo7Fnn5R3m4GBgE2m4QYAAA0&mkt=en-US&hosted=0&device_platform=Windows+10
https://97d79e89-04bafa98.consultingexpertiseinc.com/?ru=https%3a%2f%2fb7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com%2fcommon%2freprocess%3fctx%3drQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAT8_kYvmBV623XKv3lX5zSsS1jFqEzYCP0LjIwvGBknMcmkFOcm5uSU5-enOCSWppcWlyRmpCbmlGSAVN1iEvQvSvdMCS92S01JLUosyczPe8SMV8sFFoFXLDwGzFYcHFwCDBIMCgw_WBgXsQLdmbNik9nxHcd9WgUePPhiL8lwilU_ySzUy7kkO8XP1MNA28IsPMwkIs2gMjgiKtzJ3K0q2yfTMc9SPzQs3Mc51NbEynACm9AENqZTbAwf2Bg72BlmsTMc4GQ8wMvwg69ld1Nz6_V57zxe8etEGVflm1UkVVlWBXlGmFkaBacl-RWb-XiXFpj4JmZY5Lo7Fnn5R3m4GBgE2m4QYAAA0&mkt=en-US&hosted=0&device_platform=Windows+10
There are 3 hidden doms, click here to show them.