IOC Report
https://prod.luxsinsights.com/resetPassword?token=1nx3r51qkulky7dn7nc97zkovb8wgy

loading gif

Files

File Path
Type
Category
Malicious
Chrome Cache Entry: 125
ASCII text, with very long lines (34054), with no line terminators
dropped
Chrome Cache Entry: 126
SVG Scalable Vector Graphics image
dropped
Chrome Cache Entry: 127
PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced
dropped
Chrome Cache Entry: 128
ASCII text, with very long lines (3393), with no line terminators
dropped
Chrome Cache Entry: 129
SVG Scalable Vector Graphics image
dropped
Chrome Cache Entry: 130
HTML document, ASCII text, with very long lines (1234)
downloaded
Chrome Cache Entry: 131
JSON data
downloaded
Chrome Cache Entry: 132
HTML document, ASCII text, with very long lines (1234)
dropped
Chrome Cache Entry: 133
PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced
downloaded
Chrome Cache Entry: 134
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 135
ASCII text, with very long lines (34054), with no line terminators
downloaded
Chrome Cache Entry: 136
JSON data
dropped
Chrome Cache Entry: 137
ASCII text, with very long lines (65536), with no line terminators
downloaded
Chrome Cache Entry: 138
JSON data
downloaded
Chrome Cache Entry: 139
ASCII text, with very long lines (43107)
downloaded
Chrome Cache Entry: 140
ASCII text
downloaded
Chrome Cache Entry: 141
ASCII text, with no line terminators
downloaded
Chrome Cache Entry: 142
PNG image data, 57 x 57, 8-bit/color RGB, non-interlaced
dropped
Chrome Cache Entry: 143
ASCII text, with very long lines (3393), with no line terminators
downloaded
Chrome Cache Entry: 144
ASCII text, with very long lines (65536), with no line terminators
downloaded
Chrome Cache Entry: 145
ASCII text, with very long lines (65310)
dropped
Chrome Cache Entry: 146
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 147
ASCII text, with very long lines (65310)
downloaded
Chrome Cache Entry: 148
PNG image data, 57 x 57, 8-bit/color RGB, non-interlaced
downloaded
Chrome Cache Entry: 149
ASCII text, with very long lines (65536), with no line terminators
dropped
Chrome Cache Entry: 150
HTML document, ASCII text, with very long lines (1234)
downloaded
Chrome Cache Entry: 151
ASCII text, with very long lines (65536), with no line terminators
dropped
There are 18 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=2016,i,6388946200651141411,18357895096746229618,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://prod.luxsinsights.com/resetPassword?token=1nx3r51qkulky7dn7nc97zkovb8wgy"

URLs

Name
IP
Malicious
https://prod.luxsinsights.com/resetPassword?token=1nx3r51qkulky7dn7nc97zkovb8wgy
https://prod.luxsinsights.com/assets/images/login.svg
3.124.173.203
https://prod.luxsinsights.com/assets/favicon.png
3.124.173.203
https://prod.luxsinsights.com/main.eace655848e13166.js
3.124.173.203
https://prod.luxsinsights.com/assets/i18n/en.json
3.124.173.203
http://fontawesome.io
unknown
https://cdn.eu.pendo.io/agent/static/f8cf41b0-9548-4c73-6c36-7825a8391626/pendo.js
34.36.140.245
https://prod.luxsinsights.com/styles.5499f8a476e4bedd.css
3.124.173.203
https://prod.luxsinsights.com/assets/images/logo_new.svg
3.124.173.203
https://getbootstrap.com)
unknown
https://prod.luxsinsights.com/api/auth/resetPassword/isValid?token=1nx3r51qkulky7dn7nc97zkovb8wgy
3.124.173.203
https://prod.luxsinsights.com/assets/Logo_withoutBackground.png
3.124.173.203
https://prod.luxsinsights.com/manifest.json
3.124.173.203
https://cdn.eu.pendo.io/agent/static/
unknown
https://github.com/google/model-viewer/pull/755#issuecomment-536597893
unknown
https://github.com/twbs/bootstrap/blob/master/LICENSE)
unknown
https://prod.luxsinsights.com/scripts.6c183ee58008d7c9.js
3.124.173.203
https://github.com/h5bp/html5-boilerplate/blob/ceb4620c78fc82e13534fc44202a3f168754873f/dist/css/mai
unknown
https://prod.luxsinsights.com/polyfills.ea375224e2490b8a.js
3.124.173.203
https://prod.luxsinsights.com/runtime.ef141cf91ef705cc.js
3.124.173.203
https://agent.pendo.io/licenses
unknown
https://prod.luxsinsights.com/resetPassword?token=1nx3r51qkulky7dn7nc97zkovb8wgy
https://prod.luxsinsights.com/assets/ol.css
3.124.173.203
https://prod.luxsinsights.com/assets/i18n/en-US.json
3.124.173.203
http://fontawesome.io/license
unknown
There are 14 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
bg.microsoft.map.fastly.net
199.232.210.172
cdn.eu.pendo.io
34.36.140.245
s-part-0036.t-0009.fb-t-msedge.net
13.107.253.64
s-part-0017.t-0009.fb-t-msedge.net
13.107.253.45
www.google.com
142.250.185.100
prod.luxsinsights.com
3.124.173.203
fp2e7a.wpc.phicdn.net
192.229.221.95

IPs

IP
Domain
Country
Malicious
142.250.186.68
unknown
United States
34.36.140.245
cdn.eu.pendo.io
United States
142.250.185.100
www.google.com
United States
192.168.2.4
unknown
unknown
3.124.173.203
prod.luxsinsights.com
United States
239.255.255.250
unknown
Reserved

DOM / HTML

URL
Malicious
https://prod.luxsinsights.com/resetPassword?token=1nx3r51qkulky7dn7nc97zkovb8wgy
https://prod.luxsinsights.com/resetPassword?token=1nx3r51qkulky7dn7nc97zkovb8wgy
https://prod.luxsinsights.com/resetPassword?token=1nx3r51qkulky7dn7nc97zkovb8wgy