Windows Analysis Report
https://autode.sk/4bb5BeV

Overview

General Information

Sample URL:	https://autode.sk/4bb5BeV
Analysis ID:	1431872

Detection

HtmlDropper, HTMLPhisher

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected Html Dropper

Yara detected HtmlPhish10

Phishing site detected (based on image similarity)

Drops files with a non-matching file extension (content does not match file extension)

HTML body contains low number of good links

HTML page contains hidden URLs or javascript code

HTML title does not match URL

Invalid 'sign-in options' or 'sign-up' link found

Stores files to the Windows start menu directory

Classification

Signatures

Phishing

Yara detected HtmlPhish10

Source: Yara match

File source: 8.14.pages.csv, type: HTML

Phishing site detected (based on image similarity)

Source: https://langevinonline.net/7d719490e0f1a74c929a6fbc76695143662ab9bac6cd3LOG7d719490e0f1a74c929a6fbc76695143662ab9bac6cd4

Matcher: Found strong image similarity, brand: MICROSOFT

HTML body contains low number of good links

Source: https://langevinonline.net/7d719490e0f1a74c929a6fbc76695143662ab9bac6cd3LOG7d719490e0f1a74c929a6fbc76695143662ab9bac6cd4

HTTP Parser: Number of links: 0

HTML page contains hidden URLs or javascript code

Source: https://langevinonline.net/

HTTP Parser: Base64 decoded: https://langevinonline.net/

HTML title does not match URL

Source: https://langevinonline.net/7d719490e0f1a74c929a6fbc76695143662ab9bac6cd3LOG7d719490e0f1a74c929a6fbc76695143662ab9bac6cd4

HTTP Parser: Title: 887a22425293f6b75ffc3ada99869033662ab9bac6cba does not match URL

Invalid 'sign-in options' or 'sign-up' link found

Source: https://langevinonline.net/7d719490e0f1a74c929a6fbc76695143662ab9bac6cd3LOG7d719490e0f1a74c929a6fbc76695143662ab9bac6cd4

HTTP Parser: Invalid link: get a new Microsoft account

Source: https://damassets.autodesk.com/content/dam/autodesk/privacy/wads.html	HTTP Parser: No favicon
Source: https://cdn.us.oss.api.autodesk.com/com.autodesk.oss-persistent/us-east-1/6e/ee/fb/66628b8c6f7146fb43f30eccbfe34595c8/wip.dm.prod?response-content-type=application%2Fpdf&response-content-disposition=inline%3B+filename%3D%22Panneaux+3D+Inc.pdf%22%3B+filename*%3Dutf-8%27%27Panneaux+3D+Inc.pdf&Expires=1714076127&Signature=iPs3GpcnRS7Y8sqKZfSNbv0IruOvY4BrPB7OCWAPe-bg0uAbcJnezbFFUo9OtBhmm8WP30YYHD0Whn6duDtM1BpGAP7q8f8dTWebKiIAeulwuz1R2DQcwovAEDTFwzpjQMi-pXtL61L4PeVqSYohO9ijy0dIonpAKCDKTk4styphh6ZvwZ3ed-VwVzOB4lFnWrmoNvew6~WLYTTJzdY2Xb1DKfbno7gFN5ALCeKGYhpeVRnsA-aEPgZGHgMk~85Ak3SAhApjnF7dAfjY94K8XumD~-JmTy8PBMG0jsyhPTrqo6qjxwBa6dfrCTFnEm5C9rQWJQwjtx2LREo6MFJnKQ__&Key-Pair-Id=K5HRZD7MMO1U9	HTTP Parser: No favicon
Source: https://langevinonline.net/	HTTP Parser: No favicon
Source: https://langevinonline.net/	HTTP Parser: No favicon
Source: https://langevinonline.net/	HTTP Parser: No favicon
Source: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/0nuo4/0x4AAAAAAADnPIDROrmt1Wwj/light/normal	HTTP Parser: No favicon
Source: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/0nuo4/0x4AAAAAAADnPIDROrmt1Wwj/light/normal	HTTP Parser: No favicon
Source: https://langevinonline.net/7d719490e0f1a74c929a6fbc76695143662ab9bac6cd3LOG7d719490e0f1a74c929a6fbc76695143662ab9bac6cd4	HTTP Parser: No favicon

Source: https://langevinonline.net/7d719490e0f1a74c929a6fbc76695143662ab9bac6cd3LOG7d719490e0f1a74c929a6fbc76695143662ab9bac6cd4

HTTP Parser: No <meta name="author".. found

Source: https://langevinonline.net/7d719490e0f1a74c929a6fbc76695143662ab9bac6cd3LOG7d719490e0f1a74c929a6fbc76695143662ab9bac6cd4

HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 23.54.200.130:443 -> 192.168.2.16:49834 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.54.200.130:443 -> 192.168.2.16:49845 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49856 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49908 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.49.5.229
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: autode.sk
Source: global traffic	DNS traffic detected: DNS query: drive.autodesk.com
Source: global traffic	DNS traffic detected: DNS query: www.dropbox.com
Source: global traffic	DNS traffic detected: DNS query: tags.tiqcdn.com
Source: global traffic	DNS traffic detected: DNS query: damassets.autodesk.net
Source: global traffic	DNS traffic detected: DNS query: damassets.autodesk.com
Source: global traffic	DNS traffic detected: DNS query: akamai.tiqcdn.com
Source: global traffic	DNS traffic detected: DNS query: app.launchdarkly.com
Source: global traffic	DNS traffic detected: DNS query: developer.api.autodesk.com
Source: global traffic	DNS traffic detected: DNS query: epsilon.6sense.com
Source: global traffic	DNS traffic detected: DNS query: dpm.demdex.net
Source: global traffic	DNS traffic detected: DNS query: j.6sc.co
Source: global traffic	DNS traffic detected: DNS query: auth.autodesk.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: widget.uservoice.com
Source: global traffic	DNS traffic detected: DNS query: accounts.autodesk.com
Source: global traffic	DNS traffic detected: DNS query: smetrics.autodesk.com
Source: global traffic	DNS traffic detected: DNS query: a.wa.autodesk.com
Source: global traffic	DNS traffic detected: DNS query: secure.adnxs.com
Source: global traffic	DNS traffic detected: DNS query: c.6sc.co
Source: global traffic	DNS traffic detected: DNS query: ipv6.6sc.co
Source: global traffic	DNS traffic detected: DNS query: epsilon-cloudfront.6sense.com
Source: global traffic	DNS traffic detected: DNS query: b.6sc.co
Source: global traffic	DNS traffic detected: DNS query: c.wa.autodesk.com
Source: global traffic	DNS traffic detected: DNS query: stats.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: analytics.google.com
Source: global traffic	DNS traffic detected: DNS query: events.launchdarkly.com
Source: global traffic	DNS traffic detected: DNS query: znb2b6wn008pbgkwn-autodeskfeedback.siteintercept.qualtrics.com
Source: global traffic	DNS traffic detected: DNS query: by2.uservoice.com
Source: global traffic	DNS traffic detected: DNS query: siteintercept.qualtrics.com
Source: global traffic	DNS traffic detected: DNS query: cdn.us.oss.api.autodesk.com
Source: global traffic	DNS traffic detected: DNS query: langevinonline.net
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443

Source: unknown	HTTPS traffic detected: 23.54.200.130:443 -> 192.168.2.16:49834 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.54.200.130:443 -> 192.168.2.16:49845 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49856 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49908 version: TLS 1.2

Source: classification engine

Classification label: mal60.phis.troj.win@23/64@112/554

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://autode.sk/4bb5BeV
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1944,i,3757667931063255673,6650192291686099731,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1944,i,3757667931063255673,6650192291686099731,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Data Obfuscation

Yara detected Html Dropper

Source: Yara match

File source: 8.14.pages.csv, type: HTML

Drops files with a non-matching file extension (content does not match file extension)

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: Chrome Cache Entry: 120

Jump to dropped file

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
52.2.102.39	unknown	United States	14618	AMAZON-AESUS	false
172.217.215.147	www.google.com	United States	15169	GOOGLEUS	false
34.204.115.252	dsprod-snowplow-ava-ecs-elb-1521947359.us-east-1.elb.amazonaws.com	United States	14618	AMAZON-AESUS	false
54.161.33.86	engine-11-3.authz-p-ue1-pf.cloudos.autodesk.com	United States	14618	AMAZON-AESUS	false
18.238.49.79	d386d2qs7rw7pa.cloudfront.net	United States	16509	AMAZON-02US	false
13.248.142.121	epsilon.6sense.com	United States	16509	AMAZON-02US	false
34.198.16.133	unknown	United States	14618	AMAZON-AESUS	false
18.210.197.67	events.launchdarkly.com	United States	14618	AMAZON-AESUS	false
162.125.9.18	www-env.dropbox-dns.com	United States	19679	DROPBOXUS	false
68.67.179.155	unknown	United States	29990	ASN-APPNEXUS	false
173.222.249.17	unknown	United States	20940	AKAMAI-ASN1EU	false
63.140.39.72	unknown	United States	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
142.251.15.99	unknown	United States	15169	GOOGLEUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
108.177.122.138	unknown	United States	15169	GOOGLEUS	false
64.233.176.139	analytics.google.com	United States	15169	GOOGLEUS	false
54.230.31.28	cdn.us.oss.api.autodesk.com	United States	16509	AMAZON-02US	false
23.2.23.61	unknown	United States	16625	AKAMAI-ASUS	false
74.125.138.99	unknown	United States	15169	GOOGLEUS	false
74.125.138.147	unknown	United States	15169	GOOGLEUS	false
23.1.33.13	unknown	United States	20940	AKAMAI-ASN1EU	false
23.1.33.12	unknown	United States	20940	AKAMAI-ASN1EU	false
172.253.124.138	unknown	United States	15169	GOOGLEUS	false
18.160.18.7	unknown	United States	3	MIT-GATEWAYSUS	false
18.238.80.7	drive.autodesk.com	United States	16509	AMAZON-02US	false
104.17.29.92	widget.uservoice.com	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
18.160.78.89	epsilon-cloudfront.6sense.com	United States	3	MIT-GATEWAYSUS	false
108.177.122.94	unknown	United States	15169	GOOGLEUS	false
173.222.249.89	unknown	United States	20940	AKAMAI-ASN1EU	false
3.161.163.65	dzfq4ouujrxm8.cloudfront.net	United States	16509	AMAZON-02US	false
108.177.122.105	unknown	United States	15169	GOOGLEUS	false
104.17.2.184	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
104.17.208.240	unknown	United States	13335	CLOUDFLARENETUS	false
74.125.138.100	unknown	United States	15169	GOOGLEUS	false
74.125.138.138	unknown	United States	15169	GOOGLEUS	false
64.233.176.94	unknown	United States	15169	GOOGLEUS	false
104.17.209.240	unknown	United States	13335	CLOUDFLARENETUS	false
68.67.161.208	ib.anycast.adnxs.com	United States	29990	ASN-APPNEXUS	false
52.206.37.105	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com	United States	14618	AMAZON-AESUS	false
23.79.183.31	unknown	United States	16625	AKAMAI-ASUS	false
104.17.3.184	unknown	United States	13335	CLOUDFLARENETUS	false
18.154.227.62	d327j5wh71069m.cloudfront.net	United States	16509	AMAZON-02US	false
64.233.177.156	unknown	United States	15169	GOOGLEUS	false
172.67.166.154	langevinonline.net	United States	13335	CLOUDFLARENETUS	false
67.199.248.12	autode.sk	United States	396982	GOOGLE-PRIVATE-CLOUDUS	false
172.217.215.155	stats.g.doubleclick.net	United States	15169	GOOGLEUS	false
74.125.136.97	unknown	United States	15169	GOOGLEUS	false
142.250.105.95	unknown	United States	15169	GOOGLEUS	false
23.214.187.157	unknown	United States	16625	AKAMAI-ASUS	false
142.250.105.97	unknown	United States	15169	GOOGLEUS	false
54.209.244.119	unknown	United States	14618	AMAZON-AESUS	false
63.140.38.210	autodesk.com.ssl.sc.omtrdc.net	United States	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
104.17.27.92	by2.uservoice.com	United States	13335	CLOUDFLARENETUS	false
18.160.18.96	unknown	United States	3	MIT-GATEWAYSUS	false
151.101.2.217	unknown	United States	54113	FASTLYUS	false
34.160.78.217	developerx.api.autodesk.com	United States	2686	ATGS-MMD-ASUS	false
142.251.15.84	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16

Contacted Domains

Name	IP	Active
developerx.api.autodesk.com	34.160.78.217	true
a.nel.cloudflare.com	35.190.80.1	true
widget.uservoice.com	104.17.29.92	true
d386d2qs7rw7pa.cloudfront.net	18.238.49.79	true
events.launchdarkly.com	18.210.197.67	true
langevinonline.net	172.67.166.154	true
cdn.us.oss.api.autodesk.com	54.230.31.28	true
stats.g.doubleclick.net	172.217.215.155	true
drive.autodesk.com	18.238.80.7	true
dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com	52.206.37.105	true
engine-11-3.authz-p-ue1-pf.cloudos.autodesk.com	54.161.33.86	true
autode.sk	67.199.248.12	true
challenges.cloudflare.com	104.17.2.184	true
www-env.dropbox-dns.com	162.125.9.18	true
autodesk.com.ssl.sc.omtrdc.net	63.140.38.210	true
www.google.com	172.217.215.147	true
analytics.google.com	64.233.176.139	true
epsilon.6sense.com	13.248.142.121	true
by2.uservoice.com	104.17.27.92	true
ib.anycast.adnxs.com	68.67.161.208	true
epsilon-cloudfront.6sense.com	18.160.78.89	true
dsprod-snowplow-ava-ecs-elb-1521947359.us-east-1.elb.amazonaws.com	34.204.115.252	true
dzfq4ouujrxm8.cloudfront.net	3.161.163.65	true
d327j5wh71069m.cloudfront.net	18.154.227.62	true
accounts.autodesk.com	unknown	unknown
auth.autodesk.com	unknown	unknown
damassets.autodesk.net	unknown	unknown
a.wa.autodesk.com	unknown	unknown
akamai.tiqcdn.com	unknown	unknown
siteintercept.qualtrics.com	unknown	unknown
secure.adnxs.com	unknown	unknown
znb2b6wn008pbgkwn-autodeskfeedback.siteintercept.qualtrics.com	unknown	unknown
b.6sc.co	unknown	unknown
www.dropbox.com	unknown	unknown
j.6sc.co	unknown	unknown
dpm.demdex.net	unknown	unknown
developer.api.autodesk.com	unknown	unknown
app.launchdarkly.com	unknown	unknown
smetrics.autodesk.com	unknown	unknown
c.6sc.co	unknown	unknown
damassets.autodesk.com	unknown	unknown
c.wa.autodesk.com	unknown	unknown
tags.tiqcdn.com	unknown	unknown
ipv6.6sc.co	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://damassets.autodesk.com/content/dam/autodesk/privacy/wads.html	false		high
https://drive.autodesk.com/oauth.html?error_description=The+client+specified+not+to+prompt%2C+but+the+user+is+not+logged+in.&state=UFpKdTgtMjNuTkdQSWRQZWI3V0F3LldLZlg2bDZtUGNETGJyWWtfYmhXRA%3D%3D&error=access_denied#.	false		high
https://drive.autodesk.com/de28a5d6a/shares/SH512d4QTec90decfa6ec8e4ac0e0a569c38	false		high
https://langevinonline.net/	false		unknown
https://langevinonline.net/7d719490e0f1a74c929a6fbc76695143662ab9bac6cd3LOG7d719490e0f1a74c929a6fbc76695143662ab9bac6cd4	true		unknown
about:blank	false	Avira URL Cloud: safe	low
https://www.google.com/url?q=https%3A%2F%2Flangevinonline.net&sa=D&sntz=1&usg=AOvVaw2j6LtxkQmCInx3-r3q909k	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/0nuo4/0x4AAAAAAADnPIDROrmt1Wwj/light/normal	false		high

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 19:14:18 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	9835E5740DE77AE41FB9917F109F0C07	3CCB5E1BCCD4CEFF7690CFE1BC942A083997CB51	9AB380DE3E5BDCE026DF770B5EB8C89DC940DE1E486B28B3C281F8F6F6144409
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 19:14:18 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	F305D763750B899EE8533977DF782732	F70CC535164B473F92D0B628A9C28DECFFB1E05F	582BED902E9580F3145AEE5CA3DE85488EC30CD9425A8C80796072B839D7ED14
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	92951CF6DFA189686AA7482337CEEE4C	393B34EEA0F4BA6FBE3CAFA59ED4DB5EFF1E598C	C52D6A88DFE831D0398617DAAE22FC60F429F7B94D4F71239E7B18A3CB1DF293
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 19:14:18 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	91ECCD24F83310E485AF823339636566	84ABB64C40B0E766DE4174EC5F5C94277ADDBD00	AC1C4CB34D02A1FA8F8C964032D56EB50ED182187DD52C5960D1DE48137F5919
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 19:14:18 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	DC8529C4A847F59718AE27D878A27BA6	D3CFC7531790F7F3044DF3D5631B0140E4B3E102	B5D38E33ADF4A5E4A0656C8EA669147A6CE78DC500B15390F88E8AD72E31B8D6
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 19:14:18 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	C3CB174044E6DBFA5CE2083DEF9746F7	BA3DD1224F86F5B27836162607D0ADB7D1394AC6	83442EE0EF37D7F20063712F3F01243D15CEEAAEF7CAE216FA9BC1A675FC2693
Chrome Cache Entry: 109	SVG Scalable Vector Graphics image	67DCE78ABE097ED7D258158D65060A46	F1D1A9A66885237DB5976AD3805EE76D4FB80576	70ECCE52E7B828578364F13B40A0C68616CBD35916AE24233E4CE8130BFA6050
Chrome Cache Entry: 111	HTML document, ASCII text	561D9D238ED9433A0C3FADDB5A9EF0F6	5C6EC07E490A2905EA64D329AFC22202616027D6	E097F74693DC6C7B6520962CF14039D6EBFF2CABE076C2CE6BCD314AB2E00F1A
Chrome Cache Entry: 112	ASCII text, with very long lines (523)	7B430C6350A59A7CF22B9ADECCBA327B	B48D3C289BCB6809BB52FFFD8F013055ED6BCD65	058ED961BFE422AF7BFC65865F4C08531EC8ACE995F8A1EC560A46581CB7712C
Chrome Cache Entry: 113	SVG Scalable Vector Graphics image	4E48046CE74F4B89D45037C90576BFAC	4A41B3B51ED787F7B33294202DA72220C7CD2C32	8E6DB1634F1812D42516778FC890010AA57F3E39914FB4803DF2C38ABBF56D93
Chrome Cache Entry: 114	JSON data	8983A90EE315C7115E2BBB23E62B6A76	6E35D80CEEECC643D14225E372DCC754AE94267B	2476D463F75A607E3806F86FA58B4C89FC146A525A9F317FFB69C6FE6675E865
Chrome Cache Entry: 115	ASCII text, with no line terminators	7A61D749398E44EF35B14D378AECE471	59D87CFF7987A23CBEEF2426A3D17A17F2EB60F3	29363BE218C0843331714139CAD0A0C962612A6EB5626C0D6EB333F66A4B9A25
Chrome Cache Entry: 117	ASCII text, with very long lines (19969)	F37BDE7217536A48FA0C316E39EF3E7B	0F8FAB30B57C603D158CCC0879AFEAC0E115A953	E7AA440997796D164EC6AABB65D358586A793D037893980B76CE664E23422290
Chrome Cache Entry: 119	ASCII text, with very long lines (4199)	3DB40D15C12F9665549A8AD5381EAE41	36436111AD1498ACC038D9C6997EC4F0CF44F764	5A4E632D4D0830E2C15D44CB72EE6ADF84FDBF776A27D12426804AFF81BC583D
Chrome Cache Entry: 120	PDF document, version 1.7, 1 pages	782ECB82F458BF6FA2C03248A263CDBA	6EEEFB66628B8C6F7146FB43F30ECCBFE34595C8	69245D83E8B2319446F6CA5AABA09D6ACDE3E4239D42274ABE73577E329EDAAA
Chrome Cache Entry: 121	ASCII text, with very long lines (7043), with no line terminators	B6C202188699B897BB727A68EDD24665	FF3B891E06C983DCA277C1D7D874C8EB8084EB96	184A034CB9202937BF012AFF8C81E0747B7CA8F8F9E6115556FDB09D5BAEC419
Chrome Cache Entry: 122	ASCII text, with very long lines (5357)	F466991EB59D5FAE1A13F6BA7DCF817D	EA820FB95965D109C68E5A6A84AFE23E01D5109D	A30688266C80586B43C666C88CB63750388B8D65FBDAC7C3ADD9A805DB9ADA03
Chrome Cache Entry: 123	ASCII text, with very long lines (65536), with no line terminators	8E6B0F88563F9C33F78BCE65CF287DF7	EF7765CD2A7D64ED27DD7344702597AFF6F8C397	A7057BEBFFF43E7281CA31DA00D40BD88C8D02D1576B9C45891DD56A3853269A
Chrome Cache Entry: 125	ASCII text, with no line terminators	011B17B116126E6E0C4A9B0DE9145805	DF63A6EB731FFCE96F79802EFF6D53D00CDA42BC	3418E6E704387A99F1611EB7BB883328A438BA600971E6D692E8BEA60F10B179
Chrome Cache Entry: 126	Unicode text, UTF-8 text, with very long lines (64466)	762DECF25949E9D8B11196301AB6AC35	5ACB23B935EE77752A1F2287AEFD7E67B41B4E68	46797CB705307B4DADF561DD088A9AFDCB81E35E11959B54E66CE70EF6E0C392
Chrome Cache Entry: 127	SVG Scalable Vector Graphics image	EE5C8D9FB6248C938FD0DC19370E90BD	D01A22720918B781338B5BBF9202B241A5F99EE4	04D29248EE3A13A074518C93A18D6EFC491BF1F298F9B87FC989A6AE4B9FAD7A
Chrome Cache Entry: 128	JSON data	F2431417B5868D91BCB265C230244683	3BCE8D2DF68F90015A8E8E4E594D7B7959A6E6E4	B508AF0D848F4BE3DCAD91308053B164739CAEB316EB209AC5F74C088E57B3D8
Chrome Cache Entry: 129	SVG Scalable Vector Graphics image	07F9F7A2BE89225368D7CE86D043AA84	0CDBD3C155843F5BAC7485DB4D4622232ECC4BE9	D7C6A0BC9B3FC3E517E0F8E52B460715E652F10AF67B87606C84FF8DC7E76247
Chrome Cache Entry: 131	ASCII text, with very long lines (8035)	178E782AD3DEB083AC9D377875D56DF6	A1128E53703F9143E820380854C913006282564B	174A6D10843449D5A20BAAC59CCFF321D3643F4C8D5732081A951C2723A98D66
Chrome Cache Entry: 132	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced	8B1C526D8CF3E4BD18718034B85C349A	07FF0B0918E29FFC787B6EF06B5F4A5C08B36E7B	F068012BBF577A9968C7CA65882A6D61C240D9A5CCF1AD75864CAA4F044F0654
Chrome Cache Entry: 133	ASCII text, with very long lines (5945)	B8DFC92D5E9CADBB8F30714F0B9639D6	A1A9F227DF94B25D07EA0CC565EF8E9D296A9B55	585D34D46D11F24BA9FCDC69D47B9803B3853C49EB85168F2013C27183D3F0F2
Chrome Cache Entry: 137	ASCII text, with very long lines (32065)	2F6B11A7E914718E0290410E85366FE9	69BB69E25CA7D5EF0935317584E6153F3FD9A88C	05B85D96F41FFF14D8F608DAD03AB71E2C1017C2DA0914D7C59291BAD7A54F8E
Chrome Cache Entry: 138	ASCII text, with very long lines (50758)	67176C242E1BDC20603C878DEE836DF3	27A71B00383D61EF3C489326B3564D698FC1227C	56C12A125B021D21A69E61D7190CEFA168D6C28CE715265CEA1B3B0112D169C4
Chrome Cache Entry: 139	ASCII text, with very long lines (1048)	D9BDC31B05E6DBAA2BA3410096648907	431A2C29ECC04FBA333AB9FFE75D733F7E792894	52CE47C2E5560ECEAC2D5FFE5475CB4DC1A185F0B019910ACC9A16C9981AA2C2
Chrome Cache Entry: 140	JSON data	EE4DBB866FB012385D52D43921AE9E49	F4C06701C969BBFB1FD79EAF7235DB4A681A397C	40473EEB9460B9A66B9CF2F2CC4E44686A446CD47A26DCD8434C500CDCE5BDA5
Chrome Cache Entry: 143	ASCII text, with very long lines (65377)	F1988667A3555CEB0324D00901A5B796	FA32483A565FD4A3BB501EA4F7FDDC0B42773232	6C73B7915EB8AC798BDB0E39778FE88EA51905CB3E06C9F98B5C9598BC10CEF6
Chrome Cache Entry: 145	HTML document, ASCII text	391EBB4C8DADA0793C3D9A1EF3BB1A58	EC2DAF6A782747AD7D983AEFAFD954CC7E661CF7	B0693DC92F76E08BF1485B3DD9B514A2E31DFD6F39422A6B60EDB722671DC98F
Chrome Cache Entry: 146	HTML document, ASCII text, with CRLF, LF line terminators	6590A488314301E46D9F170530BE237E	F2C04ADE3E926464B1913C349EDC46984F522E84	69EA75105BC3DFA8B0399A6A13D083C57EA7655CD4AAF2E14118FFCBD671D701
Chrome Cache Entry: 147	Unicode text, UTF-8 text, with very long lines (12156)	CF577D5ABE8DFEB6977002B0D78E7299	175182A0CA0F2900C23C8EC8E6969F1D9B12D1DE	72445E9D3B9A5157FD5447E6CCEB4B301E879967542EC499A759858B8A550B70
Chrome Cache Entry: 149	ASCII text, with very long lines (49440)	015181DB273345F66904066331D67FF3	E7382ABC895C8C4422292B825D88884567504726	96FB7DC7D54155DA609AFDE7DD42EE536AE559615768992345A6293DD664400D
Chrome Cache Entry: 150	ASCII text, with very long lines (31983)	E3D6E971DBA0516A806492757AF293E5	4CC33A99ACADBED3FADF14D35E5393C2D6FFCAF3	FE47CA742A4E46F1AAD72D5A233ABF780C76273CB43096C2A966008D160A34DC
Chrome Cache Entry: 151	PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced	9246CCA8FC3C00F50035F28E9F6B7F7D	3AA538440F70873B574F40CD793060F53EC17A5D	C07D7D29E3C20FA6CA4C5D20663688D52BAD13E129AD82CE06B80EB187D9DC84
Chrome Cache Entry: 152	ASCII text, with very long lines (5945)	E15D4E5EA096F178355CE9D24B3C0243	B5BA429CD1C306452D360693B7F4E007B47664F7	EAF6B97E05198D4D98BC17FBC315ABEB1875C334FD858E4841034B5EA6D01630
Chrome Cache Entry: 154	ASCII text, with very long lines (1634)	606915B4AC07A93E5FAF0DC076450728	BA184DBC1B58F4F41E350ED068A052B495D71BF5	4954DC3E39232CD2B85CB562E84733ADB6D642774D278AAF580E1E02343EE7DB
Chrome Cache Entry: 155	ASCII text, with very long lines (65425)	4BE3A8D3603083086F4889671B424CDC	400A68D78BC63D96E9FE8CD08264D912AD39A757	BAA41AD2F6193361E771C3E399699315502EAA4FE61CEDC7E68E6FE8A868AD97
Chrome Cache Entry: 156	ASCII text, with very long lines (2343)	575B5480531DA4D14E7453E2016FE0BC	E5C5F3134FE29E60B591C87EA85951F0AEA36EE1	DE36E50194320A7D3EF1ACE9BD34A875A8BD458B253C061979DD628E9BF49AFD
Chrome Cache Entry: 157	ASCII text, with very long lines (35315)	EE37567FF69873B0D6F988827155DA3F	AA4442473F1C16CA77433D5BCA152C44E6D86328	9DB3C8607BAAA1F10C0B22858B06CEFF73FCD15B27FBAED4E00B5BCA81B06700
Chrome Cache Entry: 159	SVG Scalable Vector Graphics image	BC3D32A696895F78C19DF6C717586A5D	9191CB156A30A3ED79C44C0A16C95159E8FF689D	0E88B6FCBB8591EDFD28184FA70A04B6DD3AF8A14367C628EDD7CABA32E58C68
Chrome Cache Entry: 160	SVG Scalable Vector Graphics image	251B4372B84C5C79C13B0FC829AFAA50	42E059912F4CE526FD00AAAD7D7B3B2ABF3CB183	D951F4676DE105931B2763696636E6A841EB7FCC511FD72588A0AC227FF85B99
Chrome Cache Entry: 162	ASCII text, with very long lines (3331)	0E4A638B2C81C797B204FF51F7DF03CF	0B7EFD5C5BBB3EC771C6CC3923BADF97457C7BC9	FC0211B5115BED33F7C780AECD7B6D18BC2A6ABC85B075B2FC3DD7953A4543A1
Chrome Cache Entry: 163	ASCII text, with very long lines (42414)	F94A2211CE789A95A7C67E8C660D63E8	F1FC19B6BCB96D0A905BF3192AAFF0885FF9F36F	926DC3302F99EC05E4206E965DDEB7250F5910A8C38E82C7BEAFB724BBAAF37B
Chrome Cache Entry: 165	SVG Scalable Vector Graphics image	85463E2AF0705B2DBAB01ECEC4242637	D736380769121A67C6FA168EEB09B78883A40C48	0AE8920BE0A2E4163351B5D81C4416B5D6020EC566FB1B8F300DEC828C4FC86C
Chrome Cache Entry: 166	ASCII text, with very long lines (34872)	86CDF66000C32F77BFC7E47A4EBD58ED	A2EE5C97DC74E7E6281FE89603BAFD151AFC0CE9	5CC5813B6643ED3A6D65F29E1A9BE7638D0C9195FE18E17DD580C5ED8C17F5C8
Chrome Cache Entry: 168	JSON data	82DA3E7958C1C801BD397A5942A5046B	226D2ADE2CEAA5F6A038010E589D50995D1655A8	E88AA8711C9125D32A7D54E145D0CA8FEAAFA86156197A956430EC13401E8257
Chrome Cache Entry: 169	SVG Scalable Vector Graphics image	C545D3357FBD11804DAD0A4ED3E343D6	E76F728F1F7685AB1C0F31D8C435B16E6AC45452	4D31E7E156E7E5B576DF070904321313D94BD651223AB409342B04CCDB5B65DF
Chrome Cache Entry: 170	HTML document, ASCII text, with very long lines (4020)	9849B45C3EA510032D86644318671042	68A09C6F526B7AA1F6D534068E13A5FB2D759B27	4CEE85E478ADB6DBD1C9861E38A30A28652431F707D9F9665C692835709CE7C0
Chrome Cache Entry: 171	HTML document, ASCII text, with very long lines (494)	46619E6ACF74E6AB11C38EAD5DE0451C	40807A4C3621B6703EB0050F22730B082E4EA0AC	B42D8F020F55CE8394A0520848DA3F8D0F4CED1DEDCB59D9B6BFCACD61B7187A
Chrome Cache Entry: 172	Web Open Font Format (Version 2), TrueType, length 43968, version 2.13107	7FCA9BDB61FACAF360BDFD1376FEFFFA	CD42BF2AFD1C46A77A383CA1D74B5D642A106B06	A4A6C8CFD856949FF5B4C9DF9F2FC1C62D813CBED1ECBAA2B62D7BE08BA7D42F
Chrome Cache Entry: 174	ASCII text, with very long lines (4192)	68F4B349AA7BA0B576765C671799020C	E9F19E7E01C37AB59C3B6936C97FE24A817529A7	50F6BA356054AF0492E6D6C79520A221AF642ACDD81BF4A5B4A9783C4267D5C4
Chrome Cache Entry: 175	JSON data	32C6BBBFC915DB10032B479BDA07246C	EF89D362FD44B347EA7E7F14AF02840C87483643	72874CF2FDF17C0B18267A70130AC46DD3B3457FACC82161C7553C856D3AD87E
Chrome Cache Entry: 176	ASCII text, with no line terminators	7BC0EE636B3B83484FC3B9348863BD22	EBBFFB7D7EA5362A22BFA1BAB0BFDEB1617CD610	A2C2339691FC48FBD14FB307292DFF3E21222712D9240810742D7DF0C6D74DFB
Chrome Cache Entry: 177	ASCII text, with very long lines (64780)	25BFB70085441577363541B4DF4A77E7	0F9DEF166C5537480C274BCDF079ACADCBF0B196	4018D7F0A983131974ACBEA85F1BE1A84C2CCA541C584F98B5C5C83413913695
Chrome Cache Entry: 178	ASCII text, with very long lines (7711)	4904FC447E21CAE9E66183B19DBD52A2	C31820BFD350001F7EE4D8756F641813CE3FA884	FDB381EF5DF87329F3CC740D9B5E768DF9FEDFE34E9B65B20AAF29411851BB6D
Chrome Cache Entry: 179	JSON data	AD3093820F51C2A13646AA202B2D9237	7BDE152F18FFA8EC06A58759A32ED5BBFFF47215	FD85C41C81E9C15741CEC0D5421A000103BACAC3B25C12703252E3AC49AD07CB
Chrome Cache Entry: 180	ASCII text, with very long lines (995)	FBC539349A6E82E3916E241C66957DC7	ABD882D10E790A4EC5F200523B555813D6808C6F	63678083DAE431AFBFB10E368DEF920EF32F94418FDC494222CB4E44F9B44F83
Chrome Cache Entry: 181	ASCII text, with no line terminators	D97623D172F087D9640DA9ACD38830FF	515BD358BB7D990930F0E2B3DE399DB1787A2567	FE04A9DC88D3F3BE8D4F6BC63A9A80F45A4C6D8460E7551DAB849457C091920A
Chrome Cache Entry: 182	ASCII text	6C98BE5FDA77913799E8EF24B86A7ABD	2C9A2A706436C6C8D7C0B7EEAF9C02CE47EEAB4D	D753F8EE126736431A1CD8170DBFCF94F553EEB1D24F2BAA7C66474A80D0E559
Chrome Cache Entry: 183	ASCII text, with very long lines (794)	C7ED884A2F59ED7F116C4F5B800BB726	9460CB85B18B8010D95BA27059CBD37BB17F354C	F95F997531DCAC77E288505D7F8672BA9B46E075431F76EDA482B270ED56920A
Chrome Cache Entry: 184	PNG image data, 50 x 45, 8-bit/color RGB, non-interlaced	245342D5CAF462B6DDC9856F021718A4	013E9939253628C51E0AD143139FDD62105B96D3	292111D5D5A92D2CA2539DE199EBF59833DB4244D4BB9937D7807AD1FF72629B

Phishing

Yara detected HtmlPhish10

Source: Yara match

File source: 8.14.pages.csv, type: HTML

Phishing site detected (based on image similarity)

Source: https://langevinonline.net/7d719490e0f1a74c929a6fbc76695143662ab9bac6cd3LOG7d719490e0f1a74c929a6fbc76695143662ab9bac6cd4

Matcher: Found strong image similarity, brand: MICROSOFT

HTML body contains low number of good links

Source: https://langevinonline.net/7d719490e0f1a74c929a6fbc76695143662ab9bac6cd3LOG7d719490e0f1a74c929a6fbc76695143662ab9bac6cd4

HTTP Parser: Number of links: 0

HTML page contains hidden URLs or javascript code

Source: https://langevinonline.net/

HTTP Parser: Base64 decoded: https://langevinonline.net/

HTML title does not match URL

Source: https://langevinonline.net/7d719490e0f1a74c929a6fbc76695143662ab9bac6cd3LOG7d719490e0f1a74c929a6fbc76695143662ab9bac6cd4

HTTP Parser: Title: 887a22425293f6b75ffc3ada99869033662ab9bac6cba does not match URL

Invalid 'sign-in options' or 'sign-up' link found

Source: https://langevinonline.net/7d719490e0f1a74c929a6fbc76695143662ab9bac6cd3LOG7d719490e0f1a74c929a6fbc76695143662ab9bac6cd4

HTTP Parser: Invalid link: get a new Microsoft account

Source: https://damassets.autodesk.com/content/dam/autodesk/privacy/wads.html	HTTP Parser: No favicon
Source: https://cdn.us.oss.api.autodesk.com/com.autodesk.oss-persistent/us-east-1/6e/ee/fb/66628b8c6f7146fb43f30eccbfe34595c8/wip.dm.prod?response-content-type=application%2Fpdf&response-content-disposition=inline%3B+filename%3D%22Panneaux+3D+Inc.pdf%22%3B+filename*%3Dutf-8%27%27Panneaux+3D+Inc.pdf&Expires=1714076127&Signature=iPs3GpcnRS7Y8sqKZfSNbv0IruOvY4BrPB7OCWAPe-bg0uAbcJnezbFFUo9OtBhmm8WP30YYHD0Whn6duDtM1BpGAP7q8f8dTWebKiIAeulwuz1R2DQcwovAEDTFwzpjQMi-pXtL61L4PeVqSYohO9ijy0dIonpAKCDKTk4styphh6ZvwZ3ed-VwVzOB4lFnWrmoNvew6~WLYTTJzdY2Xb1DKfbno7gFN5ALCeKGYhpeVRnsA-aEPgZGHgMk~85Ak3SAhApjnF7dAfjY94K8XumD~-JmTy8PBMG0jsyhPTrqo6qjxwBa6dfrCTFnEm5C9rQWJQwjtx2LREo6MFJnKQ__&Key-Pair-Id=K5HRZD7MMO1U9	HTTP Parser: No favicon
Source: https://langevinonline.net/	HTTP Parser: No favicon
Source: https://langevinonline.net/	HTTP Parser: No favicon
Source: https://langevinonline.net/	HTTP Parser: No favicon
Source: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/0nuo4/0x4AAAAAAADnPIDROrmt1Wwj/light/normal	HTTP Parser: No favicon
Source: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/0nuo4/0x4AAAAAAADnPIDROrmt1Wwj/light/normal	HTTP Parser: No favicon
Source: https://langevinonline.net/7d719490e0f1a74c929a6fbc76695143662ab9bac6cd3LOG7d719490e0f1a74c929a6fbc76695143662ab9bac6cd4	HTTP Parser: No favicon

Source: https://langevinonline.net/7d719490e0f1a74c929a6fbc76695143662ab9bac6cd3LOG7d719490e0f1a74c929a6fbc76695143662ab9bac6cd4

HTTP Parser: No <meta name="author".. found

Source: https://langevinonline.net/7d719490e0f1a74c929a6fbc76695143662ab9bac6cd3LOG7d719490e0f1a74c929a6fbc76695143662ab9bac6cd4

HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 23.54.200.130:443 -> 192.168.2.16:49834 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.54.200.130:443 -> 192.168.2.16:49845 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49856 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49908 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.49.5.229
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: autode.sk
Source: global traffic	DNS traffic detected: DNS query: drive.autodesk.com
Source: global traffic	DNS traffic detected: DNS query: www.dropbox.com
Source: global traffic	DNS traffic detected: DNS query: tags.tiqcdn.com
Source: global traffic	DNS traffic detected: DNS query: damassets.autodesk.net
Source: global traffic	DNS traffic detected: DNS query: damassets.autodesk.com
Source: global traffic	DNS traffic detected: DNS query: akamai.tiqcdn.com
Source: global traffic	DNS traffic detected: DNS query: app.launchdarkly.com
Source: global traffic	DNS traffic detected: DNS query: developer.api.autodesk.com
Source: global traffic	DNS traffic detected: DNS query: epsilon.6sense.com
Source: global traffic	DNS traffic detected: DNS query: dpm.demdex.net
Source: global traffic	DNS traffic detected: DNS query: j.6sc.co
Source: global traffic	DNS traffic detected: DNS query: auth.autodesk.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: widget.uservoice.com
Source: global traffic	DNS traffic detected: DNS query: accounts.autodesk.com
Source: global traffic	DNS traffic detected: DNS query: smetrics.autodesk.com
Source: global traffic	DNS traffic detected: DNS query: a.wa.autodesk.com
Source: global traffic	DNS traffic detected: DNS query: secure.adnxs.com
Source: global traffic	DNS traffic detected: DNS query: c.6sc.co
Source: global traffic	DNS traffic detected: DNS query: ipv6.6sc.co
Source: global traffic	DNS traffic detected: DNS query: epsilon-cloudfront.6sense.com
Source: global traffic	DNS traffic detected: DNS query: b.6sc.co
Source: global traffic	DNS traffic detected: DNS query: c.wa.autodesk.com
Source: global traffic	DNS traffic detected: DNS query: stats.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: analytics.google.com
Source: global traffic	DNS traffic detected: DNS query: events.launchdarkly.com
Source: global traffic	DNS traffic detected: DNS query: znb2b6wn008pbgkwn-autodeskfeedback.siteintercept.qualtrics.com
Source: global traffic	DNS traffic detected: DNS query: by2.uservoice.com
Source: global traffic	DNS traffic detected: DNS query: siteintercept.qualtrics.com
Source: global traffic	DNS traffic detected: DNS query: cdn.us.oss.api.autodesk.com
Source: global traffic	DNS traffic detected: DNS query: langevinonline.net
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443

Source: unknown	HTTPS traffic detected: 23.54.200.130:443 -> 192.168.2.16:49834 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.54.200.130:443 -> 192.168.2.16:49845 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49856 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49908 version: TLS 1.2

Source: classification engine

Classification label: mal60.phis.troj.win@23/64@112/554

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://autode.sk/4bb5BeV
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1944,i,3757667931063255673,6650192291686099731,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1944,i,3757667931063255673,6650192291686099731,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Data Obfuscation

Yara detected Html Dropper

Source: Yara match

File source: 8.14.pages.csv, type: HTML

Drops files with a non-matching file extension (content does not match file extension)

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: Chrome Cache Entry: 120

Jump to dropped file

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

ID:	1431872
Product:	CloudBasic
Start time:	22:13:49
Start date:	25.04.2024
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Windows Analysis Report
https://autode.sk/4bb5BeV

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report https://autode.sk/4bb5BeV

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
https://autode.sk/4bb5BeV