IOC Report
https://u14209785.ct.sendgrid.net/ls/click?upn=u001.7INBLi-2BpMtquNhvHXoCTQDs4I8fdKE9GOHSvdTryAC4YNl8SgVmFqvpumkhlW1dclTJXsA-2F-2Ff7YgccTrLpBOaqe5F4BFCpk26UqRyhBoWKMiBIlA9IyESRgA9QJQmRqgb6HSe3vdUDFbWqU7fvHjWkz5WXnc8fDT6OC7qZ9utOxT-2FNCb37p3l01J5uCoo1HVdPyUtoL-2B-2B0SRCFvnKnnkl2cgDoMMkH8qipQH3xK8ozGp

loading gif

Files

File Path
Type
Category
Malicious
Chrome Cache Entry: 59
ASCII text, with very long lines (58316), with no line terminators
dropped
Chrome Cache Entry: 60
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 61
ASCII text, with very long lines (372), with no line terminators
downloaded
Chrome Cache Entry: 62
Web Open Font Format (Version 2), TrueType, length 48236, version 1.0
downloaded
Chrome Cache Entry: 63
ASCII text, with very long lines (371), with no line terminators
downloaded
Chrome Cache Entry: 64
ASCII text
downloaded
Chrome Cache Entry: 65
ASCII text, with very long lines (371), with no line terminators
dropped
Chrome Cache Entry: 66
ASCII text
downloaded
Chrome Cache Entry: 67
Web Open Font Format (Version 2), TrueType, length 35020, version 1.0
downloaded
Chrome Cache Entry: 68
Unicode text, UTF-8 text, with very long lines (32000)
downloaded
Chrome Cache Entry: 69
MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
dropped
Chrome Cache Entry: 70
SVG Scalable Vector Graphics image
dropped
Chrome Cache Entry: 71
TrueType Font data, digitally signed, 19 tables, 1st "DSIG"
downloaded
Chrome Cache Entry: 72
ASCII text, with very long lines (65536), with no line terminators
downloaded
Chrome Cache Entry: 73
Unicode text, UTF-8 text, with very long lines (32000)
dropped
Chrome Cache Entry: 74
HTML document, ASCII text, with very long lines (1528)
downloaded
Chrome Cache Entry: 75
ASCII text, with very long lines (372), with no line terminators
dropped
Chrome Cache Entry: 76
ASCII text, with very long lines (2051)
dropped
Chrome Cache Entry: 77
ASCII text, with very long lines (3015), with no line terminators
dropped
Chrome Cache Entry: 78
ASCII text, with very long lines (2051)
downloaded
Chrome Cache Entry: 79
ASCII text, with very long lines (1572)
downloaded
Chrome Cache Entry: 80
ASCII text, with very long lines (65536), with no line terminators
downloaded
Chrome Cache Entry: 81
ASCII text, with very long lines (65536), with no line terminators
dropped
Chrome Cache Entry: 82
Web Open Font Format (Version 2), TrueType, length 77160, version 4.459
downloaded
Chrome Cache Entry: 83
MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
downloaded
Chrome Cache Entry: 84
ASCII text, with very long lines (3015), with no line terminators
downloaded
Chrome Cache Entry: 85
ASCII text, with very long lines (582), with CRLF, LF line terminators
downloaded
Chrome Cache Entry: 86
ASCII text, with very long lines (58316), with no line terminators
downloaded
There are 19 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=1988,i,16457401036646260543,1716617626027759870,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://u14209785.ct.sendgrid.net/ls/click?upn=u001.7INBLi-2BpMtquNhvHXoCTQDs4I8fdKE9GOHSvdTryAC4YNl8SgVmFqvpumkhlW1dclTJXsA-2F-2Ff7YgccTrLpBOaqe5F4BFCpk26UqRyhBoWKMiBIlA9IyESRgA9QJQmRqgb6HSe3vdUDFbWqU7fvHjWkz5WXnc8fDT6OC7qZ9utOxT-2FNCb37p3l01J5uCoo1HVdPyUtoL-2B-2B0SRCFvnKnnkl2cgDoMMkH8qipQH3xK8ozGpjDHL3flhrDXeVFBaHdl4LGJSUVrJc6M9o8i4SglGpFFn9dfE-2FtsTsuo-2B0mBHeOBcych8ZiKvWhJHmO05ohuREBDztuIr0vCJ6wXPVKNBfY5nqFOvk301XXCcEdvSWqyKbqa4r-2Bl0xucu-2BJzNFNlEvPKUJOu-2FvCjaQwYmYUZnM4wPF1XHaZjT2Db0meexDY-2FrQSpSHdisr5xxV37BPWlKvG78_7C4orIQZnafKjRVbYSRH-2BiiFCrE5Suj9DoCT3YmaBp6xHEmvfjIu7sBs4SH0sA27JDQ7qwm8ew7IdBy9KU-2BhwjcjUNabpKHazU46qeBwOPS2rGdblkSAs4tI4mIJBoJaiovHThgFHT-2BzOz3B13IChJXGPRwu2d1LCnzIQZ9DC-2FICZGiTyFvOxCkRk8teH-2BhRaM1ZbaA36D95IIm5AIM7CQ6DJUiWcnjTC-2FBfU4u86HmnC0pZ5g4whjWxIg0Z8XFXA1GNfVQb55rNpxhqeRQRStA5VIpdV5gQtTpDKZVSu4Yb2b3EaLjjBqgpZ5ZFWTUK"

URLs

Name
IP
Malicious
https://u14209785.ct.sendgrid.net/ls/click?upn=u001.7INBLi-2BpMtquNhvHXoCTQDs4I8fdKE9GOHSvdTryAC4YNl8SgVmFqvpumkhlW1dclTJXsA-2F-2Ff7YgccTrLpBOaqe5F4BFCpk26UqRyhBoWKMiBIlA9IyESRgA9QJQmRqgb6HSe3vdUDFbWqU7fvHjWkz5WXnc8fDT6OC7qZ9utOxT-2FNCb37p3l01J5uCoo1HVdPyUtoL-2B-2B0SRCFvnKnnkl2cgDoMMkH8qipQH3xK8ozGpjDHL3flhrDXeVFBaHdl4LGJSUVrJc6M9o8i4SglGpFFn9dfE-2FtsTsuo-2B0mBHeOBcych8ZiKvWhJHmO05ohuREBDztuIr0vCJ6wXPVKNBfY5nqFOvk301XXCcEdvSWqyKbqa4r-2Bl0xucu-2BJzNFNlEvPKUJOu-2FvCjaQwYmYUZnM4wPF1XHaZjT2Db0meexDY-2FrQSpSHdisr5xxV37BPWlKvG78_7C4orIQZnafKjRVbYSRH-2BiiFCrE5Suj9DoCT3YmaBp6xHEmvfjIu7sBs4SH0sA27JDQ7qwm8ew7IdBy9KU-2BhwjcjUNabpKHazU46qeBwOPS2rGdblkSAs4tI4mIJBoJaiovHThgFHT-2BzOz3B13IChJXGPRwu2d1LCnzIQZ9DC-2FICZGiTyFvOxCkRk8teH-2BhRaM1ZbaA36D95IIm5AIM7CQ6DJUiWcnjTC-2FBfU4u86HmnC0pZ5g4whjWxIg0Z8XFXA1GNfVQb55rNpxhqeRQRStA5VIpdV5gQtTpDKZVSu4Yb2b3EaLjjBqgpZ5ZFWTUK
https://pp-wfe-100.advancedmd.com/api/configuration/settings?officeKey=154537
18.244.18.58
https://pp-wfe-100.advancedmd.com/api/configuration/Configuration?officeKey=154537
18.244.18.58
https://pp-wfe-100.advancedmd.com/api/configuration/OfficeKeySettings?officeKey=154537
18.244.18.58
https://pp-wfe-100.advancedmd.com/api/configuration/featureAccess?officeKey=154537
18.244.18.58
https://pp-wfe-100.advancedmd.com/api/configuration/PatientLocation?officekey=154537
18.244.18.58
https://classroom.google.com/sharewidget?usegapi=1
unknown
https://apis.google.com/js/api.js
142.250.185.174
https://amds-material-dev.advancedmd.com/8/stable/8.0/amds-theme-default/material-theme.css
18.239.69.2
https://www.youtube.com/subscribe_embed?usegapi=1
unknown
https://api2.heartlandportico.com/SecureSubmit.v1/token/2.1/securesubmit.min.js
35.211.11.79
https://pp-wfe-100.advancedmd.com/assets/images/logo.svg
18.244.18.58
https://pp-wfe-100.advancedmd.com/fontawesome-webfont.e9955780856cf8aa.woff2?v=4.7.0
18.244.18.58
https://dataconnector.corp.google.com/:session_prefix:ui/widgetview?usegapi=1
unknown
https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
unknown
https://amds-material-dev.advancedmd.com/8/stable/8.0/amds-icons/amds-icons.css
18.239.69.2
https://pp-wfe-100.advancedmd.com/512.9bc87b909a9ebbb9.js
18.244.18.58
https://amds-material-dev.advancedmd.com/8/stable/8.0/amds-icons/font/amds-icons.woff2
18.239.69.2
https://plus.google.com
unknown
https://clients3.google.com/cast/chromecast/home/widget/backdrop?usegapi=1
unknown
https://pp-wfe-100.advancedmd.com/styles.bc20a01cb439f66e.css
18.244.18.58
https://www.google.com/shopping/customerreviews/badge?usegapi=1
unknown
https://pay.google.com/gp/v/widget/save
unknown
https://drive.google.com/savetodrivebutton?usegapi=1
unknown
https://pp-wfe-100.advancedmd.com/312.5741a208cd925cb7.js
18.244.18.58
https://pp-wfe-100.advancedmd.com/api/configuration/SystemDefaults?officeKey=154537
18.244.18.58
https://talkgadget.google.com/:session_prefix:talkgadget/_/widget
unknown
https://play.google.com/work/embedded/search?usegapi=1&usegapi=1
unknown
https://www.google.com/shopping/customerreviews/optin?usegapi=1
unknown
https://pp-wfe-100.advancedmd.com/main.679ab1521d22507c.js
18.244.18.58
https://pp-wfe-100.advancedmd.com/runtime.828784c1b995f56f.js
18.244.18.58
https://apis.google.com
unknown
https://families.google.com/webcreation?usegapi=1&usegapi=1
unknown
https://pp-wfe-100.advancedmd.com/api/configuration/Branding?officeKey=154537
18.244.18.58
https://pp-wfe-100.advancedmd.com/polyfills.55f1c22607bcff8d.js
18.244.18.58
https://clients6.google.com
unknown
https://pp-wfe-100.advancedmd.com/OpenSans.4543090a37b427da.ttf
18.244.18.58
https://pp-wfe-100.advancedmd.com/favicon.ico?v=2
18.244.18.58
There are 27 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
api2.heartlandportico.com
35.211.11.79
plus.l.google.com
142.250.185.174
www.google.com
142.250.185.100
u14209785.ct.sendgrid.net
167.89.115.121
d1nn1qnqm7ih5y.cloudfront.net
18.244.18.58
d11ag707s7acdq.cloudfront.net
13.227.219.101
d1he4b11razhen.cloudfront.net
18.239.69.2
fp2e7a.wpc.phicdn.net
192.229.221.95
patientportal.advancedmd.com
unknown
amds-material-dev.advancedmd.com
unknown
apis.google.com
unknown
pp-wfe-100.advancedmd.com
unknown
There are 2 hidden domains, click here to show them.

IPs

IP
Domain
Country
Malicious
18.244.18.58
d1nn1qnqm7ih5y.cloudfront.net
United States
18.239.69.2
d1he4b11razhen.cloudfront.net
United States
35.211.11.79
api2.heartlandportico.com
United States
167.89.115.121
u14209785.ct.sendgrid.net
United States
142.250.185.100
www.google.com
United States
18.65.39.10
unknown
United States
192.168.2.4
unknown
unknown
13.227.219.101
d11ag707s7acdq.cloudfront.net
United States
216.58.206.46
unknown
United States
192.168.2.5
unknown
unknown
239.255.255.250
unknown
Reserved
142.250.185.174
plus.l.google.com
United States
There are 2 hidden IPs, click here to show them.

DOM / HTML

URL
Malicious
https://pp-wfe-100.advancedmd.com/154537/billing?token=YS9iTHZadjJXcEhXTGhta3RteDA1M0xpZVM2L3VlbzJUbHRuajRIREdIbkZsMm96bjRheWVwV1pmbms3cVJwMlAvY1pIVVVoQnUvaXI3T2NxM09OVjFIb25qTWNHQjhKbFNSZ2s3NjJmdWJhb3gzdTkraitzVGtlK3B4UWtSTE1GOEJhZWNYOFArWkJmYjIrZ3NpTUZFcWk1bmc0eFR5dFh0eTE5bkZKMmgzWWRPNENRTlRBUlltRUtQbFFWSmJY
https://pp-wfe-100.advancedmd.com/154537/billing?token=YS9iTHZadjJXcEhXTGhta3RteDA1M0xpZVM2L3VlbzJUbHRuajRIREdIbkZsMm96bjRheWVwV1pmbms3cVJwMlAvY1pIVVVoQnUvaXI3T2NxM09OVjFIb25qTWNHQjhKbFNSZ2s3NjJmdWJhb3gzdTkraitzVGtlK3B4UWtSTE1GOEJhZWNYOFArWkJmYjIrZ3NpTUZFcWk1bmc0eFR5dFh0eTE5bkZKMmgzWWRPNENRTlRBUlltRUtQbFFWSmJY
https://pp-wfe-100.advancedmd.com/154537/billing?token=YS9iTHZadjJXcEhXTGhta3RteDA1M0xpZVM2L3VlbzJUbHRuajRIREdIbkZsMm96bjRheWVwV1pmbms3cVJwMlAvY1pIVVVoQnUvaXI3T2NxM09OVjFIb25qTWNHQjhKbFNSZ2s3NjJmdWJhb3gzdTkraitzVGtlK3B4UWtSTE1GOEJhZWNYOFArWkJmYjIrZ3NpTUZFcWk1bmc0eFR5dFh0eTE5bkZKMmgzWWRPNENRTlRBUlltRUtQbFFWSmJY