IOC Report
https://click.smb-hub-amer.com/CL0/https:%2F%2Faws-experience.com%2Famer%2Fsmb%2Fverify-me-request%3Ftoken=eyJlbWFpbCI6ImJwaW5lZGFAaW1heC5jb20iLCJ2ZXJpZnktdG9rZW4iOiIxZDgyNTBlYjVlMzM4MjNkNDM1ZGIyNDQ2NTRmNGQ1MmM3MTFiNDM4N2QwZDkzNTYwZjlmYzRiYTNmNTJhZjZmNzEyMDkyODdhMzZkYzZiOWQ5ZWNiNTZjYzFjMjRkMjg2ZmYzY

loading gif

Files

File Path
Type
Category
Malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 13:49:08 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 13:49:08 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 13:49:08 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 13:49:08 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 13:49:08 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
Chrome Cache Entry: 100
PNG image data, 1 x 1, 8-bit grayscale, non-interlaced
dropped
Chrome Cache Entry: 101
MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
downloaded
Chrome Cache Entry: 102
TrueType Font data, digitally signed, 19 tables, 1st "DSIG", 41 names, Macintosh, Copyright 2016 Dalton Maag Ltd. Modification of this file requires prior written permission from
downloaded
Chrome Cache Entry: 103
ASCII text
dropped
Chrome Cache Entry: 75
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 76
ASCII text, with very long lines (65463)
downloaded
Chrome Cache Entry: 77
PNG image data, 1 x 1, 8-bit grayscale, non-interlaced
dropped
Chrome Cache Entry: 78
TrueType Font data, digitally signed, 18 tables, 1st "DSIG", 30 names, Macintosh, Copyright 2014-2020, Amazon.com, Inc. or its affiliates. Modification or redistribution of this
downloaded
Chrome Cache Entry: 79
SVG Scalable Vector Graphics image
dropped
Chrome Cache Entry: 80
JSON data
dropped
Chrome Cache Entry: 81
ASCII text, with no line terminators
downloaded
Chrome Cache Entry: 82
PNG image data, 1 x 1, 8-bit grayscale, non-interlaced
dropped
Chrome Cache Entry: 83
ASCII text
dropped
Chrome Cache Entry: 84
TrueType Font data, digitally signed, 21 tables, 1st "DSIG", 29 names, Macintosh
downloaded
Chrome Cache Entry: 85
Unicode text, UTF-8 text, with very long lines (60092), with no line terminators
dropped
Chrome Cache Entry: 86
TrueType Font data, digitally signed, 18 tables, 1st "DSIG", 32 names, Macintosh
downloaded
Chrome Cache Entry: 87
PNG image data, 1 x 1, 8-bit grayscale, non-interlaced
downloaded
Chrome Cache Entry: 88
Unicode text, UTF-8 text, with very long lines (59051)
dropped
Chrome Cache Entry: 89
JSON data
downloaded
Chrome Cache Entry: 90
Unicode text, UTF-8 text, with very long lines (60092), with no line terminators
downloaded
Chrome Cache Entry: 91
ASCII text, with very long lines (65463)
dropped
Chrome Cache Entry: 92
ASCII text
downloaded
Chrome Cache Entry: 93
TrueType Font data, digitally signed, 18 tables, 1st "DSIG", 30 names, Macintosh, Copyright 2014-2020, Amazon.com, Inc. or its affiliates. Modification or redistribution of this
downloaded
Chrome Cache Entry: 94
JSON data
dropped
Chrome Cache Entry: 95
MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
dropped
Chrome Cache Entry: 96
JSON data
downloaded
Chrome Cache Entry: 97
ASCII text, with no line terminators
downloaded
Chrome Cache Entry: 98
HTML document, ASCII text, with very long lines (2353), with no line terminators
downloaded
Chrome Cache Entry: 99
Unicode text, UTF-8 text, with very long lines (59051)
downloaded
There are 26 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1936 --field-trial-handle=2032,i,3864348162281826665,9948028116960494871,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://click.smb-hub-amer.com/CL0/https:%2F%2Faws-experience.com%2Famer%2Fsmb%2Fverify-me-request%3Ftoken=eyJlbWFpbCI6ImJwaW5lZGFAaW1heC5jb20iLCJ2ZXJpZnktdG9rZW4iOiIxZDgyNTBlYjVlMzM4MjNkNDM1ZGIyNDQ2NTRmNGQ1MmM3MTFiNDM4N2QwZDkzNTYwZjlmYzRiYTNmNTJhZjZmNzEyMDkyODdhMzZkYzZiOWQ5ZWNiNTZjYzFjMjRkMjg2ZmYzYzRhYTgxYTQ0MTI4N2I0ODQxZjY5Njg4ZmZmZTcwZDdmZDZkNjZlYzlkMmRjMTAyNTUzZDA2YzNjNjY0ZjM1MjE5NjRhMzFmMzIwYWVhN2FlN2ZlNzU4NDdkN2E2OGQ5YWY1ZTNkYjk2MDI4ZWVlZWVmNjZiNDA4MWI3MzI0MDE0YzIzZDhkNjZmYjQ2YjRkNGQ5OGIzOWM4ZDU1In0%26type=event%26id=6585db7d-9771-4f75-83ae-d72331d5b483%26tier=basic%26path=%252Fe%252F6585d%252Ftech201-generative-ai-activation---prompt-engineering-with-amazon-bedrock/1/010f0192929ffdd9-52e8ab98-0c2d-4477-9745-d305c3580957-000000/bpy3MIKRHDhKHa3naGXB0nUpNkE0SIRP76qCITL47wA=180"

URLs

Name
IP
Malicious
https://click.smb-hub-amer.com/CL0/https:%2F%2Faws-experience.com%2Famer%2Fsmb%2Fverify-me-request%3Ftoken=eyJlbWFpbCI6ImJwaW5lZGFAaW1heC5jb20iLCJ2ZXJpZnktdG9rZW4iOiIxZDgyNTBlYjVlMzM4MjNkNDM1ZGIyNDQ2NTRmNGQ1MmM3MTFiNDM4N2QwZDkzNTYwZjlmYzRiYTNmNTJhZjZmNzEyMDkyODdhMzZkYzZiOWQ5ZWNiNTZjYzFjMjRkMjg2ZmYzYzRhYTgxYTQ0MTI4N2I0ODQxZjY5Njg4ZmZmZTcwZDdmZDZkNjZlYzlkMmRjMTAyNTUzZDA2YzNjNjY0ZjM1MjE5NjRhMzFmMzIwYWVhN2FlN2ZlNzU4NDdkN2E2OGQ5YWY1ZTNkYjk2MDI4ZWVlZWVmNjZiNDA4MWI3MzI0MDE0YzIzZDhkNjZmYjQ2YjRkNGQ5OGIzOWM4ZDU1In0%26type=event%26id=6585db7d-9771-4f75-83ae-d72331d5b483%26tier=basic%26path=%252Fe%252F6585d%252Ftech201-generative-ai-activation---prompt-engineering-with-amazon-bedrock/1/010f0192929ffdd9-52e8ab98-0c2d-4477-9745-d305c3580957-000000/bpy3MIKRHDhKHa3naGXB0nUpNkE0SIRP76qCITL47wA=180
malicious
https://aws.amazon.com/developer/language/java/?nc1=f_dr
unknown
https://aws.amazon.com/architecture/?nc1=f_cc
unknown
https://aws.amazon.com/de/what-is-cloud-computing/?nc1=f_cc
unknown
http://certs.starfieldtech.com/repository/1/0-
unknown
https://aws.amazon.com/es/developer/language/php/?nc1=f_cc
unknown
https://aws.amazon.com/ko/partners/work-with-partners/?nc1=f_dr
unknown
https://aws.amazon.com/it/faqs/?nc1=f_dr
unknown
http://ocsp.starfieldtech.com/09
unknown
https://aws.amazon.com/pt/partners/work-with-partners/?nc1=f_dr
unknown
https://aws.amazon.com/solutions/?nc1=f_cc
unknown
https://aws.demdex.net/dest5.html?d_nsid=0
34.254.132.151
https://aws.amazon.com/fr/developer/tools/?nc1=f_dr
unknown
https://aws.amazon.com/ru/diversity-inclusion/?nc1=f_cc
unknown
https://aws.amazon.com/pt/blogs/?nc1=f_cc
unknown
https://aws.amazon.com/it/what-is-aws/?nc1=f_cc
unknown
https://aws.amazon.com/ko/codeofconduct/
unknown
http://ocsp.starfieldtech.com/0D
unknown
https://aws.amazon.com/es/solutions/?nc1=f_cc
unknown
https://aws.amazon.com/es/containers/?nc1=f_cc
unknown
https://aws.amazon.com/fr/contact-us/?nc1=f_m
unknown
https://aws.amazon.com/cn/?nc1=h_ls
unknown
https://aws.amazon.com/ko/contact-us/?nc1=f_m
unknown
https://aws.amazon.com/pt/containers/?nc1=f_cc
unknown
https://aws.amazon.com/ru/containers/?nc1=f_cc
unknown
https://aws.amazon.com/es/developer/language/javascript/?nc1=f_dr
unknown
https://aws.amazon.com/ko/big-data/datalakes-and-analytics/what-is-a-data-lake/?nc1=f_cc
unknown
https://aws.amazon.com/de/premiumsupport/?nc1=f_dr
unknown
https://aws.amazon.com/it/training/?nc1=f_cc
unknown
https://aws.amazon.com/ru/architecture/?nc1=f_cc
unknown
https://aws.amazon.com/de/developer/tools/?nc1=f_dr
unknown
https://iq.aws.amazon.com/?utm=mkt.foot/?nc1=f_m
unknown
https://aws.amazon.com/ru/?nc1=h_ls
unknown
https://aws.amazon.com/ko/resources/analyst-reports/?nc1=f_cc
unknown
https://aws.amazon.com/fr/developer/language/php/?nc1=f_cc
unknown
https://aws.amazon.com/fr/what-is-cloud-computing/?nc1=f_cc
unknown
https://aws.amazon.com/pt/resources/analyst-reports/?nc1=f_cc
unknown
https://aws.amazon.com/es/premiumsupport/knowledge-center/?nc1=f_dr
unknown
https://aws.amazon.com/ru/developer/language/php/?nc1=f_cc
unknown
https://aws.amazon.com/ar/?nc1=h_ls
unknown
https://aws.amazon.com/ko/containers/?nc1=f_cc
unknown
https://www.amazon.jobs/content/en/teams/amazon-web-services
unknown
https://aws.amazon.com/fr/partners/work-with-partners/?nc1=f_dr
unknown
http://www.daltonmaag.com/eula
unknown
https://aws.amazon.com/de/training/?nc1=f_cc
unknown
https://aws.amazon.com/ru/contact-us/?nc1=f_m
unknown
https://aws.amazon.com/it/partners/work-with-partners/?nc1=f_dr
unknown
https://aws.amazon.com/ko/diversity-inclusion/?nc1=f_cc
unknown
https://aws.amazon.com/es/architecture/?nc1=f_cc
unknown
http://certs.godaddy.com/repository/1301
unknown
https://console.aws.amazon.com/support/home/?nc1=f_dr
unknown
https://aws.amazon.com/ru/partners/work-with-partners/?nc1=f_dr
unknown
https://certs.godaddy.com/repository/0
unknown
http://certificates.godaddy.com/repository/gd_intermediate.crt0
unknown
https://aws.amazon.com/pt/developer/tools/?nc1=f_dr
unknown
http://crl.starfieldtech.com/sfsroot.crl0S
unknown
https://aws.amazon.com/de/contact-us/?nc1=f_m
unknown
https://aws.amazon.com/ko/privacy/
unknown
http://crl.godaddy.com/gdroot-g2.crl0F
unknown
https://aws.amazon.com/fr/training/?nc1=f_cc
unknown
https://aws.amazon.com/ko/developer/language/python/?nc1=f_dr
unknown
https://aws.amazon.com/it/diversity-inclusion/?nc1=f_cc
unknown
https://aws.amazon.com/ko/developer/language/net/?nc1=f_dr
unknown
https://aws.amazon.com/de/legal/?nc1=f_cc
unknown
https://aws.amazon.com/tr/?nc1=h_ls
unknown
https://aws.amazon.com/fr/?nc1=h_ls
unknown
https://aws.amazon.com/pt/architecture/?nc1=f_cc
unknown
https://aws.amazon.com/pt/solutions/?nc1=f_cc
unknown
https://aws.amazon.com/fr/legal/?nc1=f_cc
unknown
https://aws.amazon.com/ru/faqs/?nc1=f_dr
unknown
https://aws.amazon.com/ru/security/?nc1=f_cc
unknown
https://aws.amazon.com/es/developer/language/java/?nc1=f_dr
unknown
https://aws.amazon.com/es/developer/language/python/?nc1=f_dr
unknown
https://aws.amazon.com/pt/what-is-aws/?nc1=f_cc
unknown
https://aws.amazon.com/es/legal/?nc1=f_cc
unknown
http://crl.godaddy.com/gdig2s5-1.crl0S
unknown
https://aws.amazon.com/pt/training/?nc1=f_cc
unknown
https://www.westpac.com.au/business-banking/bank-accounts/business-one-plus/
unknown
https://aws.amazon.com/es/getting-started/?nc1=f_cc
unknown
https://certs.starfieldtech.com/repository/0
unknown
https://aws.amazon.com/pt/premiumsupport/knowledge-center/?nc1=f_dr
unknown
http://certificates.godaddy.com/repository/0
unknown
https://aws.amazon.com/es/new/?nc1=f_cc
unknown
https://aws.amazon.com/es/diversity-inclusion/?nc1=f_cc
unknown
https://aws.amazon.com/fr/premiumsupport/?nc1=f_dr
unknown
https://aws.amazon.com/ko/blogs/?nc1=f_cc
unknown
https://aws.amazon.com/it/containers/?nc1=f_cc
unknown
https://aws.amazon.com/developer/language/javascript/?nc1=f_dr
unknown
https://aws.amazon.com/de/premiumsupport/knowledge-center/?nc1=f_dr
unknown
https://aws.amazon.com/pt/big-data/datalakes-and-analytics/what-is-a-data-lake/?nc1=f_cc
unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0
unknown
https://aws.amazon.com/fr/getting-started/?nc1=f_cc
unknown
https://aws.amazon.com/es/developer/?nc1=f_dr
unknown
https://aws.amazon.com/es/resources/analyst-reports/?nc1=f_cc
unknown
https://aws.amazon.com/fr/faqs/?nc1=f_dr
unknown
https://aws.amazon.com/fr/security/?nc1=f_cc
unknown
https://aws.amazon.com/pt/developer/language/net/?nc1=f_dr
unknown
https://aws.amazon.com/ko/new/?nc1=f_cc
unknown
https://aws.amazon.com/ru/getting-started/?nc1=f_cc
unknown
https://aws.amazon.com/fr/developer/language/python/?nc1=f_dr
unknown
https://aws.amazon.com/ru/premiumsupport/?nc1=f_dr
unknown
There are 90 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
aws-experience.com
13.225.78.106
 malicious
amazonwebservices.d2.sc.omtrdc.net
63.140.62.27
prod.log.shortbread.aws.dev
18.66.147.41
click.smb-hub-amer.com
143.204.98.27
d2wgy05m4ds5i.cloudfront.net
108.138.26.101
s-part-0017.t-0009.fb-t-msedge.net
13.107.253.45
www.google.com
172.217.18.4
a0.awsstatic.com
18.172.109.49
prod.tools.shortbread.aws.dev
52.222.214.29
dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com
54.217.253.102
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com
217.20.57.18
fp2e7a.wpc.phicdn.net
192.229.221.95
aws.demdex.net
unknown
dpm.demdex.net
unknown
cm.everesttech.net
unknown
vs.aws.amazon.com
unknown
There are 6 hidden domains, click here to show them.

IPs

IP
Domain
Country
Malicious
13.225.78.106
aws-experience.com
United States
malicious
18.66.147.127
unknown
United States
18.172.109.49
a0.awsstatic.com
United States
18.66.147.41
prod.log.shortbread.aws.dev
United States
34.254.132.151
unknown
United States
172.217.18.4
www.google.com
United States
63.140.62.27
amazonwebservices.d2.sc.omtrdc.net
United States
192.168.2.5
unknown
unknown
108.138.26.2
unknown
United States
239.255.255.250
unknown
Reserved
54.217.253.102
dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com
United States
63.140.62.222
unknown
United States
52.222.214.29
prod.tools.shortbread.aws.dev
United States
143.204.98.27
click.smb-hub-amer.com
United States
108.138.26.101
d2wgy05m4ds5i.cloudfront.net
United States
There are 5 hidden IPs, click here to show them.

DOM / HTML

URL
Malicious
https://aws-experience.com/amer/smb/log-in
 malicious
https://aws-experience.com/amer/smb/verify-me-request?token=eyJlbWFpbCI6ImJwaW5lZGFAaW1heC5jb20iLCJ2ZXJpZnktdG9rZW4iOiIxZDgyNTBlYjVlMzM4MjNkNDM1ZGIyNDQ2NTRmNGQ1MmM3MTFiNDM4N2QwZDkzNTYwZjlmYzRiYTNmNTJhZjZmNzEyMDkyODdhMzZkYzZiOWQ5ZWNiNTZjYzFjMjRkMjg2ZmYzYzRhYTgxYTQ0MTI4N2I0ODQxZjY5Njg4ZmZmZTcwZDdmZDZkNjZlYzlkMmRjMTAyNTUzZDA2YzNjNjY0ZjM1MjE5NjRhMzFmMzIwYWVhN2FlN2ZlNzU4NDdkN2E2OGQ5YWY1ZTNkYjk2MDI4ZWVlZWVmNjZiNDA4MWI3MzI0MDE0YzIzZDhkNjZmYjQ2YjRkNGQ5OGIzOWM4ZDU1In0&type=event&id=6585db7d-9771-4f75-83ae-d72331d5b483&tier=basic&path=%2Fe%2F6585d%2Ftech201-generative-ai-activation---prompt-engineering-with-amazon-bedrock
https://aws-experience.com/amer/smb/verify-me-request?token=eyJlbWFpbCI6ImJwaW5lZGFAaW1heC5jb20iLCJ2ZXJpZnktdG9rZW4iOiIxZDgyNTBlYjVlMzM4MjNkNDM1ZGIyNDQ2NTRmNGQ1MmM3MTFiNDM4N2QwZDkzNTYwZjlmYzRiYTNmNTJhZjZmNzEyMDkyODdhMzZkYzZiOWQ5ZWNiNTZjYzFjMjRkMjg2ZmYzYzRhYTgxYTQ0MTI4N2I0ODQxZjY5Njg4ZmZmZTcwZDdmZDZkNjZlYzlkMmRjMTAyNTUzZDA2YzNjNjY0ZjM1MjE5NjRhMzFmMzIwYWVhN2FlN2ZlNzU4NDdkN2E2OGQ5YWY1ZTNkYjk2MDI4ZWVlZWVmNjZiNDA4MWI3MzI0MDE0YzIzZDhkNjZmYjQ2YjRkNGQ5OGIzOWM4ZDU1In0&type=event&id=6585db7d-9771-4f75-83ae-d72331d5b483&tier=basic&path=%2Fe%2F6585d%2Ftech201-generative-ai-activation---prompt-engineering-with-amazon-bedrock
https://aws-experience.com/amer/smb/log-in
https://aws-experience.com/amer/smb/log-in
https://aws-experience.com/amer/smb/log-in