Windows Analysis Report
https://u29271426.ct.sendgrid.net/ls/click?upn=3T7exZ7CPnDMYe213NRbLhq-2B5D4-2BnY-2FiPTzicmL02kUpZ11gmTXTCFRLsy6wjXggLkIYzrB9C24t-2B2-2FWkC5hKNIvF4j-2FvNG-2BV2FxSOqjizVopB7MgrWMoAW0OqtifeU8nsXx_0DZIarqO7rTJkdLOMFYhDD7dyDsIC7p5IrHjuIWYLvkfflMFAz0w3bHha13nk84f2Gg6NRBg3p5GJzNi0w7MkgseIvFKosT9eOBtLlNvwx

Overview

General Information

Sample URL: https://u29271426.ct.sendgrid.net/ls/click?upn=3T7exZ7CPnDMYe213NRbLhq-2B5D4-2BnY-2FiPTzicmL02kUpZ11gmTXTCFRLsy6wjXggLkIYzrB9C24t-2B2-2FWkC5hKNIvF4j-2FvNG-2BV2FxSOqjizVopB7MgrWMoAW0OqtifeU8nsXx_0DZIar
Analysis ID: 715062

Detection

HTMLPhisher
Score: 60
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Phishing site detected (based on favicon image match)
Yara detected HtmlPhish10
Phishing site detected (based on image similarity)
HTML body contains low number of good links
Found iframes
Suspicious form URL found
No HTML title found
Submit button contains javascript call

Classification

Phishing
barindex
Phishing site detected (based on favicon image match)
Source: https://davedinkel.com/teamsmp3/appsuite/ Matcher: Template: microsoft matched with high similarity
Yara detected HtmlPhish10
Source: Yara match File source: 05992.4.pages.csv, type: HTML
Source: Yara match File source: 09329.6.pages.csv, type: HTML
Phishing site detected (based on image similarity)
Source: https://davedinkel.com/teamsmp3/appsuite/ Matcher: Found strong image similarity, brand: Microsoft image: 05992.4.img.1.gfk.csv EE5C8D9FB6248C938FD0DC19370E90BD
Source: https://davedinkel.com/teamsmp3/appsuite/ Matcher: Found strong image similarity, brand: Microsoft image: 05992.4.img.5.gfk.csv A5DBD4393FF6A725C7E62B61DF7E72F0
Source: https://davedinkel.com/teamsmp3/appsuite/ Matcher: Found strong image similarity, brand: Microsoft image: 05992.4.img.1.gfk.csv EE5C8D9FB6248C938FD0DC19370E90BD
Source: https://davedinkel.com/teamsmp3/appsuite/ Matcher: Found strong image similarity, brand: Microsoft image: 05992.4.img.5.gfk.csv A5DBD4393FF6A725C7E62B61DF7E72F0
Source: https://davedinkel.com/teamsmp3/appsuite/ Matcher: Found strong image similarity, brand: Microsoft image: 05992.4.img.1.gfk.csv EE5C8D9FB6248C938FD0DC19370E90BD
Source: https://davedinkel.com/teamsmp3/appsuite/ Matcher: Found strong image similarity, brand: Microsoft image: 05992.4.img.5.gfk.csv A5DBD4393FF6A725C7E62B61DF7E72F0
Source: https://davedinkel.com/teamsmp3/appsuite/ Matcher: Found strong image similarity, brand: Microsoft image: 05992.4.img.1.gfk.csv EE5C8D9FB6248C938FD0DC19370E90BD
Source: https://davedinkel.com/teamsmp3/appsuite/ Matcher: Found strong image similarity, brand: Microsoft image: 05992.4.img.5.gfk.csv A5DBD4393FF6A725C7E62B61DF7E72F0
Source: https://davedinkel.com/teamsmp3/appsuite/index.php?error&id=sucker@sucker.com&.rand=13InboxLight.aspx?n=1774256418&fid=4#n=1252899642&fid=1&fav=1 Matcher: Found strong image similarity, brand: Microsoft image: 09329.6.img.1.gfk.csv EE5C8D9FB6248C938FD0DC19370E90BD
Source: https://davedinkel.com/teamsmp3/appsuite/index.php?error&id=sucker@sucker.com&.rand=13InboxLight.aspx?n=1774256418&fid=4#n=1252899642&fid=1&fav=1 Matcher: Found strong image similarity, brand: Microsoft image: 09329.6.img.5.gfk.csv A5DBD4393FF6A725C7E62B61DF7E72F0
Source: https://davedinkel.com/teamsmp3/appsuite/ Matcher: Found strong image similarity, brand: Microsoft image: 05992.4.img.1.gfk.csv EE5C8D9FB6248C938FD0DC19370E90BD
Source: https://davedinkel.com/teamsmp3/appsuite/ Matcher: Found strong image similarity, brand: Microsoft image: 05992.4.img.5.gfk.csv A5DBD4393FF6A725C7E62B61DF7E72F0
Source: https://davedinkel.com/teamsmp3/appsuite/index.php?error&id=sucker@sucker.com&.rand=13InboxLight.aspx?n=1774256418&fid=4#n=1252899642&fid=1&fav=1 Matcher: Found strong image similarity, brand: Microsoft image: 09329.6.img.1.gfk.csv EE5C8D9FB6248C938FD0DC19370E90BD
Source: https://davedinkel.com/teamsmp3/appsuite/index.php?error&id=sucker@sucker.com&.rand=13InboxLight.aspx?n=1774256418&fid=4#n=1252899642&fid=1&fav=1 Matcher: Found strong image similarity, brand: Microsoft image: 09329.6.img.5.gfk.csv A5DBD4393FF6A725C7E62B61DF7E72F0
Source: https://davedinkel.com/teamsmp3/appsuite/ Matcher: Found strong image similarity, brand: Microsoft image: 05992.4.img.1.gfk.csv EE5C8D9FB6248C938FD0DC19370E90BD
Source: https://davedinkel.com/teamsmp3/appsuite/ Matcher: Found strong image similarity, brand: Microsoft image: 05992.4.img.5.gfk.csv A5DBD4393FF6A725C7E62B61DF7E72F0
Source: https://davedinkel.com/teamsmp3/appsuite/index.php?error&id=sucker@sucker.com&.rand=13InboxLight.aspx?n=1774256418&fid=4#n=1252899642&fid=1&fav=1 Matcher: Found strong image similarity, brand: Microsoft image: 09329.6.img.1.gfk.csv EE5C8D9FB6248C938FD0DC19370E90BD
Source: https://davedinkel.com/teamsmp3/appsuite/index.php?error&id=sucker@sucker.com&.rand=13InboxLight.aspx?n=1774256418&fid=4#n=1252899642&fid=1&fav=1 Matcher: Found strong image similarity, brand: Microsoft image: 09329.6.img.5.gfk.csv A5DBD4393FF6A725C7E62B61DF7E72F0
Source: https://davedinkel.com/teamsmp3/appsuite/ Matcher: Found strong image similarity, brand: Microsoft image: 05992.4.img.1.gfk.csv EE5C8D9FB6248C938FD0DC19370E90BD
Source: https://davedinkel.com/teamsmp3/appsuite/ Matcher: Found strong image similarity, brand: Microsoft image: 05992.4.img.5.gfk.csv A5DBD4393FF6A725C7E62B61DF7E72F0
Source: https://davedinkel.com/teamsmp3/appsuite/index.php?error&id=sucker@sucker.com&.rand=13InboxLight.aspx?n=1774256418&fid=4#n=1252899642&fid=1&fav=1 Matcher: Found strong image similarity, brand: Microsoft image: 09329.6.img.1.gfk.csv EE5C8D9FB6248C938FD0DC19370E90BD
Source: https://davedinkel.com/teamsmp3/appsuite/index.php?error&id=sucker@sucker.com&.rand=13InboxLight.aspx?n=1774256418&fid=4#n=1252899642&fid=1&fav=1 Matcher: Found strong image similarity, brand: Microsoft image: 09329.6.img.5.gfk.csv A5DBD4393FF6A725C7E62B61DF7E72F0
Source: https://davedinkel.com/teamsmp3/appsuite/ Matcher: Found strong image similarity, brand: Microsoft image: 05992.4.img.1.gfk.csv EE5C8D9FB6248C938FD0DC19370E90BD
Source: https://davedinkel.com/teamsmp3/appsuite/ Matcher: Found strong image similarity, brand: Microsoft image: 05992.4.img.5.gfk.csv A5DBD4393FF6A725C7E62B61DF7E72F0
Source: https://davedinkel.com/teamsmp3/appsuite/index.php?error&id=sucker@sucker.com&.rand=13InboxLight.aspx?n=1774256418&fid=4#n=1252899642&fid=1&fav=1 Matcher: Found strong image similarity, brand: Microsoft image: 09329.6.img.1.gfk.csv EE5C8D9FB6248C938FD0DC19370E90BD
Source: https://davedinkel.com/teamsmp3/appsuite/index.php?error&id=sucker@sucker.com&.rand=13InboxLight.aspx?n=1774256418&fid=4#n=1252899642&fid=1&fav=1 Matcher: Found strong image similarity, brand: Microsoft image: 09329.6.img.5.gfk.csv A5DBD4393FF6A725C7E62B61DF7E72F0
Source: https://davedinkel.com/teamsmp3/appsuite/ Matcher: Found strong image similarity, brand: Microsoft image: 05992.4.img.1.gfk.csv EE5C8D9FB6248C938FD0DC19370E90BD
Source: https://davedinkel.com/teamsmp3/appsuite/ Matcher: Found strong image similarity, brand: Microsoft image: 05992.4.img.5.gfk.csv A5DBD4393FF6A725C7E62B61DF7E72F0
Source: https://davedinkel.com/teamsmp3/appsuite/index.php?error&id=sucker@sucker.com&.rand=13InboxLight.aspx?n=1774256418&fid=4#n=1252899642&fid=1&fav=1 Matcher: Found strong image similarity, brand: Microsoft image: 09329.6.img.1.gfk.csv EE5C8D9FB6248C938FD0DC19370E90BD
Source: https://davedinkel.com/teamsmp3/appsuite/index.php?error&id=sucker@sucker.com&.rand=13InboxLight.aspx?n=1774256418&fid=4#n=1252899642&fid=1&fav=1 Matcher: Found strong image similarity, brand: Microsoft image: 09329.6.img.5.gfk.csv A5DBD4393FF6A725C7E62B61DF7E72F0
Source: https://davedinkel.com/teamsmp3/appsuite/ Matcher: Found strong image similarity, brand: Microsoft image: 05992.4.img.1.gfk.csv EE5C8D9FB6248C938FD0DC19370E90BD
Source: https://davedinkel.com/teamsmp3/appsuite/ Matcher: Found strong image similarity, brand: Microsoft image: 05992.4.img.5.gfk.csv A5DBD4393FF6A725C7E62B61DF7E72F0
Source: https://davedinkel.com/teamsmp3/appsuite/index.php?error&id=sucker@sucker.com&.rand=13InboxLight.aspx?n=1774256418&fid=4#n=1252899642&fid=1&fav=1 Matcher: Found strong image similarity, brand: Microsoft image: 09329.6.img.1.gfk.csv EE5C8D9FB6248C938FD0DC19370E90BD
Source: https://davedinkel.com/teamsmp3/appsuite/index.php?error&id=sucker@sucker.com&.rand=13InboxLight.aspx?n=1774256418&fid=4#n=1252899642&fid=1&fav=1 Matcher: Found strong image similarity, brand: Microsoft image: 09329.6.img.5.gfk.csv A5DBD4393FF6A725C7E62B61DF7E72F0
HTML body contains low number of good links
Source: https://davedinkel.com/teamsmp3/appsuite/ HTTP Parser: Number of links: 0
Source: https://davedinkel.com/teamsmp3/appsuite/ HTTP Parser: Number of links: 0
Source: https://davedinkel.com/teamsmp3/appsuite/index.php?error&id=sucker@sucker.com&.rand=13InboxLight.aspx?n=1774256418&fid=4#n=1252899642&fid=1&fav=1 HTTP Parser: Number of links: 0
Source: https://davedinkel.com/teamsmp3/appsuite/index.php?error&id=sucker@sucker.com&.rand=13InboxLight.aspx?n=1774256418&fid=4#n=1252899642&fid=1&fav=1 HTTP Parser: Number of links: 0
Found iframes
Source: https://davedinkel.com/teamsmp3/appsuite/ HTTP Parser: Iframe src: ./Sign in to your account_files/prefetch(1).html
Source: https://davedinkel.com/teamsmp3/appsuite/ HTTP Parser: Iframe src: ./Sign in to your account_files/prefetch(1).html
Source: https://davedinkel.com/teamsmp3/appsuite/index.php?error&id=sucker@sucker.com&.rand=13InboxLight.aspx?n=1774256418&fid=4#n=1252899642&fid=1&fav=1 HTTP Parser: Iframe src: ./Sign in to your account_files/prefetch(1).html
Source: https://davedinkel.com/teamsmp3/appsuite/index.php?error&id=sucker@sucker.com&.rand=13InboxLight.aspx?n=1774256418&fid=4#n=1252899642&fid=1&fav=1 HTTP Parser: Iframe src: ./Sign in to your account_files/prefetch(1).html
Suspicious form URL found
Source: https://davedinkel.com/teamsmp3/appsuite/ HTTP Parser: Form action: login.php
Source: https://davedinkel.com/teamsmp3/appsuite/ HTTP Parser: Form action: login.php
Source: https://davedinkel.com/teamsmp3/appsuite/index.php?error&id=sucker@sucker.com&.rand=13InboxLight.aspx?n=1774256418&fid=4#n=1252899642&fid=1&fav=1 HTTP Parser: Form action: login.php
Source: https://davedinkel.com/teamsmp3/appsuite/index.php?error&id=sucker@sucker.com&.rand=13InboxLight.aspx?n=1774256418&fid=4#n=1252899642&fid=1&fav=1 HTTP Parser: Form action: login.php
No HTML title found
Source: https://davedinkel.com/teamsmp3/appsuite/ HTTP Parser: HTML title missing
Source: https://davedinkel.com/teamsmp3/appsuite/ HTTP Parser: HTML title missing
Source: https://davedinkel.com/teamsmp3/appsuite/index.php?error&id=sucker@sucker.com&.rand=13InboxLight.aspx?n=1774256418&fid=4#n=1252899642&fid=1&fav=1 HTTP Parser: HTML title missing
Source: https://davedinkel.com/teamsmp3/appsuite/index.php?error&id=sucker@sucker.com&.rand=13InboxLight.aspx?n=1774256418&fid=4#n=1252899642&fid=1&fav=1 HTTP Parser: HTML title missing
Submit button contains javascript call
Source: https://davedinkel.com/teamsmp3/appsuite/ HTTP Parser: On click: goNext()
Source: https://davedinkel.com/teamsmp3/appsuite/ HTTP Parser: On click: goNext()
Source: https://davedinkel.com/teamsmp3/appsuite/ HTTP Parser: No <meta name="author".. found
Source: https://davedinkel.com/teamsmp3/appsuite/ HTTP Parser: No <meta name="author".. found
Source: https://davedinkel.com/teamsmp3/appsuite/index.php?error&id=sucker@sucker.com&.rand=13InboxLight.aspx?n=1774256418&fid=4#n=1252899642&fid=1&fav=1 HTTP Parser: No <meta name="author".. found
Source: https://davedinkel.com/teamsmp3/appsuite/index.php?error&id=sucker@sucker.com&.rand=13InboxLight.aspx?n=1774256418&fid=4#n=1252899642&fid=1&fav=1 HTTP Parser: No <meta name="author".. found
Source: https://davedinkel.com/teamsmp3/appsuite/ HTTP Parser: No <meta name="copyright".. found
Source: https://davedinkel.com/teamsmp3/appsuite/ HTTP Parser: No <meta name="copyright".. found
Source: https://davedinkel.com/teamsmp3/appsuite/index.php?error&id=sucker@sucker.com&.rand=13InboxLight.aspx?n=1774256418&fid=4#n=1252899642&fid=1&fav=1 HTTP Parser: No <meta name="copyright".. found
Source: https://davedinkel.com/teamsmp3/appsuite/index.php?error&id=sucker@sucker.com&.rand=13InboxLight.aspx?n=1774256418&fid=4#n=1252899642&fid=1&fav=1 HTTP Parser: No <meta name="copyright".. found
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Directory created: C:\Program Files\Google\GoogleUpdater
Source: unknown HTTPS traffic detected: 170.39.79.34:443 -> 192.168.2.2:49797 version: TLS 1.2
Source: unknown DNS traffic detected: queries for: u29271426.ct.sendgrid.net
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown HTTPS traffic detected: 170.39.79.34:443 -> 192.168.2.2:49797 version: TLS 1.2
Source: classification engine Classification label: mal60.phis.win@31/3@21/260
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://u29271426.ct.sendgrid.net/ls/click?upn=3T7exZ7CPnDMYe213NRbLhq-2B5D4-2BnY-2FiPTzicmL02kUpZ11gmTXTCFRLsy6wjXggLkIYzrB9C24t-2B2-2FWkC5hKNIvF4j-2FvNG-2BV2FxSOqjizVopB7MgrWMoAW0OqtifeU8nsXx_0DZIarqO7rTJkdLOMFYhDD7dyDsIC7p5IrHjuIWYLvkfflMFAz0w3bHha13nk84f2Gg6NRBg3p5GJzNi0w7MkgseIvFKosT9eOBtLlNvwx-2F1e1F3NDnggParWpZFm-2FPSjS1gGUKWYhzU7cFFHD9idZltk1H1NxOa9gNQ5T2Br-2BYl-2BPY4EnDFELBtiHpsENUApjNICGs5jD0cpDtmC-2F5FS9JD8vHdEgDODYsC1TYiABOUpcXaSdgGsL2brbpEnlUGganYnIkydhSLAC7C0gaOWLcpEMrSafFR3ySNWE9FHgqAFx8hnDAwr6Wr2woAk4vGpa8FpMNYu7DPx3rOrMSxQHqV9w7zvcCtIeSVz9yN7VLcIFzjRy5jM4hPDZnSF2gMilUZzuBtx9s8uP-2Fg-2FH-2B3fU1vEBUxtz-2F15OMpp3yc6w5VTJvTiwZodHVKzjAnX1Xe709VhpVo2Lo75G52JsjbSKS-2B-2FkHKf7teOLBNtrScoFbE-2FCoanOGNYnRWJ7mNnwZrYTcwBNA6uvkjVjGPbCjNhDldw643ruGdKMffBTDGB3HragrPRGrrsSdad-2ByG0Gnke298NCaqpC4VkbRSqg-2FEPePxnvrSqgqRLpMcAu0FxIG0vvHLOpBsRKXip-2B1FPI5RG628kNXFkx4uAwwnbg9UJazGaQ3q-2FpSJaSX1514PGquYFWQeIZkiJuklBxoD5ka3LlKUukRTVjBr-2FgVC4Crjm2GBl9-2BXYRN8zX8RR5G4xC-2Fb2qMdgwPEwiR-2Bj9iHttcE-2BbdGkL7O3AjCkoNf4NBinJf4oFKton71fRnwsp0xP-2BR0RGlurfhN1wJrKmK4HnhngB5Dio-2FjoaLb20SMFmnvZrJWuGSYcD8HWbjee65Bcbg-3D
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1768,i,1560021492578366336,2145283588874095376,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1768,i,1560021492578366336,2145283588874095376,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Program Files\Google\GoogleUpdater
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\eyup\Downloads\9bf54cf1-c50f-4d95-bdf1-4c42a1419cdc.tmp
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Directory created: C:\Program Files\Google\GoogleUpdater
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
172.217.18.14
 clients.l.google.com United States
15169 GOOGLEUS false
18.214.126.200
 webflow.com United States
14618 AMAZON-AESUS false
216.239.32.36
 unknown United States
15169 GOOGLEUS false
104.82.137.172
 unknown United States
16625 AKAMAI-ASUS false
3.135.11.48
 matomo-wpmudev-1288779782.us-east-2.elb.amazonaws.com United States
16509 AMAZON-02US false
142.250.184.227
 unknown United States
15169 GOOGLEUS false
142.250.184.228
 unknown United States
15169 GOOGLEUS false
142.250.186.136
 unknown United States
15169 GOOGLEUS false
142.250.186.77
 accounts.google.com United States
15169 GOOGLEUS false
52.222.232.144
 d3e54v103j8qbb.cloudfront.net United States
16509 AMAZON-02US false
142.250.186.35
 unknown United States
15169 GOOGLEUS false
13.225.78.54
 uploads-ssl.webflow.com United States
16509 AMAZON-02US false
172.217.16.202
 unknown United States
15169 GOOGLEUS false
34.104.35.123
 unknown United States
15169 GOOGLEUS false
151.139.242.7
 stats-juc1ugur1qwqqqo4.stackpathdns.com United States
33438 HIGHWINDS2US false
142.250.184.193
 googlehosted.l.googleusercontent.com United States
15169 GOOGLEUS false
142.250.186.163
 unknown United States
15169 GOOGLEUS false
167.89.118.28
 u29271426.ct.sendgrid.net United States
11377 SENDGRIDUS false
172.217.18.3
 unknown United States
15169 GOOGLEUS false
142.250.185.110
 drive.google.com United States
15169 GOOGLEUS false
69.16.175.42
 unknown United States
20446 HIGHWINDS3US false
239.255.255.250
 unknown Reserved
unknown unknown false
170.39.79.34
 davedinkel.com Reserved
139776 PETRONAS-BHD-AS-APPetroliamNasionalBerhadMY false
151.101.2.132
 unknown United States
54113 FASTLYUS false
172.217.16.132
 unknown United States
15169 GOOGLEUS false

Private

IP
127.0.0.1

Contacted Domains

Name IP Active
d3e54v103j8qbb.cloudfront.net 52.222.232.144 true
stats-juc1ugur1qwqqqo4.stackpathdns.com 151.139.242.7 true
accounts.google.com 142.250.186.77 true
u29271426.ct.sendgrid.net 167.89.118.28 true
webflow.com 18.214.126.200 true
matomo-wpmudev-1288779782.us-east-2.elb.amazonaws.com 3.135.11.48 true
drive.google.com 142.250.185.110 true
www.google.com 142.250.185.68 true
clients.l.google.com 172.217.18.14 true
uploads-ssl.webflow.com 13.225.78.54 true
davedinkel.com 170.39.79.34 true
googlehosted.l.googleusercontent.com 142.250.184.193 true
doc-00-8k-docs.googleusercontent.com unknown unknown
stats1.wpmudev.com unknown unknown
i-am-not-a-robot-40ce05.webflow.io unknown unknown
stats.wpmucdn.com unknown unknown
clients2.google.com unknown unknown
secure.aadcdn.microsoftonline-p.com unknown unknown
code.jquery.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Le_nU0iAAAAAPmsJQ8BPTLdUr8LuicL6Wf0uvP_&co=aHR0cHM6Ly9pLWFtLW5vdC1hLXJvYm90LTQwY2UwNS53ZWJmbG93LmlvOjQ0Mw..&hl=en&v=a9s0j4pCVT6gaTEkLiFbtZPH&size=normal&cb=dji1q0iloo8x false
    		high
    https://davedinkel.com/teamsmp3/appsuite/index.php?error&id=sucker@sucker.com&.rand=13InboxLight.aspx?n=1774256418&fid=4#n=1252899642&fid=1&fav=1 true
      		unknown
      https://www.google.com/recaptcha/api2/bframe?hl=en&v=a9s0j4pCVT6gaTEkLiFbtZPH&k=6Le_nU0iAAAAAPmsJQ8BPTLdUr8LuicL6Wf0uvP_ false
        		high
        file:///C:/Users/eyup/Downloads/audiomp310032022.html false
          		low
          https://davedinkel.com/ false unknown
          https://davedinkel.com/teamsmp3/appsuite/ true
            		unknown