Windows Analysis Report https://docsend.com/view/vs4xxnasd8xu75by

Overview

General Information

Sample URL: https://docsend.com/view/vs4xxnasd8xu75by
Analysis ID: 530873
Infos:

Most interesting Screenshot:

Detection

HTMLPhisher
Score: 52
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Yara detected HtmlPhish10
Phishing site detected (based on logo template match)
None HTTPS page querying sensitive user data (password, username or email)
No HTML title found

Classification

Phishing:

barindex
Yara detected HtmlPhish10
Source: Yara match File source: 30509.0.pages.csv, type: HTML
Phishing site detected (based on logo template match)
Source: file:///C:/Users/user/Downloads/Payment-Receipt.html Matcher: Template: microsoft matched
None HTTPS page querying sensitive user data (password, username or email)
Source: file:///C:/Users/user/Downloads/Payment-Receipt.html HTTP Parser: Has password / email / username input fields
Source: file:///C:/Users/user/Downloads/Payment-Receipt.html HTTP Parser: Has password / email / username input fields
No HTML title found
Source: file:///C:/Users/user/Downloads/Payment-Receipt.html HTTP Parser: HTML title missing
Source: file:///C:/Users/user/Downloads/Payment-Receipt.html HTTP Parser: HTML title missing
Source: file:///C:/Users/user/Downloads/Payment-Receipt.html HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/user/Downloads/Payment-Receipt.html HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/user/Downloads/Payment-Receipt.html HTTP Parser: No <meta name="copyright".. found
Source: file:///C:/Users/user/Downloads/Payment-Receipt.html HTTP Parser: No <meta name="copyright".. found
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic Jump to behavior
Source: unknown HTTPS traffic detected: 104.19.142.111:443 -> 192.168.2.3:49781 version: TLS 1.2
Source: unknown DNS traffic detected: queries for: clients2.google.com
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown Network traffic detected: HTTP traffic on port 49771 -> 443
Source: global traffic HTTP traffic detected: GET /view/vs4xxnasd8xu75by HTTP/1.1Host: docsend.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-85.0.4183.121Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /bootstrap/4.0.0/css/bootstrap.min.css HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-aliveOrigin: nullUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,*/*;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /bootstrap/4.0.0/js/bootstrap.min.js HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-aliveOrigin: nullUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /ajax/libs/popper.js/1.12.9/umd/popper.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveOrigin: nullUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /960ba84347db823b8e7fc9cd4369a4cc.png HTTP/1.1Host: i.gyazo.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /d1b2270a564efe0c37d2e01ed1c647a8.png HTTP/1.1Host: i.gyazo.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: Gyazo_cfwoker=i
Source: global traffic HTTP traffic detected: GET /960ba84347db823b8e7fc9cd4369a4cc.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: i.gyazo.com
Source: global traffic HTTP traffic detected: GET /crx/blobs/Acy1k0bLIjHsvnKaKN_oRpVaYYvFs25d7GKYF1WXrT6yizCMksBO0c_ggE0B6tx6HPRHe6q1GOEe3_NcIbSiGG8kXeLMUY0sAKVvC6R89zvKM13s5VqoAMZSmuUgjQL5vlygJuArQghXXE_qTL7NlQ/extension_8520_615_0_5.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: data_3.2.dr String found in binary or memory: Content-Security-Policy: default-src 'self'; base-uri 'self'; child-src 'self' blob:; connect-src 'self' blob: https://d2qvtfnm75xrxf.cloudfront.net https://api.intercom.io https://api-iam.intercom.io https://api-ping.intercom.io https://nexus-websocket-a.intercom.io https://nexus-websocket-b.intercom.io https://nexus-long-poller-a.intercom.io https://nexus-long-poller-b.intercom.io wss://nexus-websocket-a.intercom.io wss://nexus-websocket-b.intercom.io https://*.intercomcdn.com https://uploads.intercomusercontent.com https://sessions.bugsnag.com https://notify.bugsnag.com https://*.kissmetrics.com https://*.kissmetrics.io https://api.segment.io https://cdn.segment.com https://*.id.opendns.com https://www.google-analytics.com https://*.g.doubleclick.net https://www.facebook.com https://api.autopilothq.com https://*.filestackapi.com https://cdn.filestackcontent.com https://s3.amazonaws.com https://*.nr-data.net https://browser.pipe.aria.microsoft.com https://checkout.stripe.com https://risk.clearbit.com https://forms.hubspot.com https://*.pubnub.com; font-src 'self' https: data: chrome-extension:; form-action 'self' https://docsend.com https://*.docsend.com https://intercom.help https://api-iam.intercom.io https://accounts.google.com https://www.linkedin.com https://*.salesforce.com https://www.dropbox.com https://accounts.logme.in https://secure.join.me https://*.okta.com https://*.oktapreview.com https://*.jumpcloud.com https://*.onelogin.com https://zapier.com https://ifttt.com https://www.facebook.com; frame-src 'self' https://d2qvtfnm75xrxf.cloudfront.net https://js.stripe.com https://checkout.stripe.com https://www.youtube.com https://player.vimeo.com https://*.g.doubleclick.net https://tpc.googlesyndication.com https://www.facebook.com https://telemetryservice.firstpartyapps.oaspapps.com https://ifttt.com; img-src 'self' https: data: blob: chrome-extension:; media-src 'self' data: https://d2qvtfnm75xrxf.cloudfront.net https://js.intercomcdn.com; object-src 'none'; script-src 'self' 'unsafe-eval' 'unsafe-inline' 'strict-dynamic' https://d2qvtfnm75xrxf.cloudfront.net https://app.intercom.io https://widget.intercom.io https://js.intercomcdn.com https://*.google-analytics.com https://cdn.segment.com https://scripts.kissmetrics.com https://*.id.opendns.com https://js-agent.newrelic.com https://*.nr-data.net https://www.youtube.com https://*.ytimg.com https://vimeo.com https://www.vimeo.com https://www.googletagmanager.com https://www.googleadservices.com https://tagmanager.google.com https://connect.facebook.net https://*.quora.com https://*.bing.com https://api.autopilothq.com https://*.capterra.com https://*.g.doubleclick.net https://js.hs-analytics.net https://js.hs-scripts.com https://js.hscollectedforms.net https://js.hsleadflows.net https://js.stripe.com https://checkout.stripe.com https://ajax.aspnetcdn.com https://appsforoffice.microsoft.com https://maps.googleapis.com https://static.filestackapi.com https://risk.clearbit.com https:/
Source: data_3.2.dr String found in binary or memory: Content-Security-Policy: default-src 'self'; base-uri 'self'; child-src 'self' blob:; connect-src 'self' blob: https://d2qvtfnm75xrxf.cloudfront.net https://api.intercom.io https://api-iam.intercom.io https://api-ping.intercom.io https://nexus-websocket-a.intercom.io https://nexus-websocket-b.intercom.io https://nexus-long-poller-a.intercom.io https://nexus-long-poller-b.intercom.io wss://nexus-websocket-a.intercom.io wss://nexus-websocket-b.intercom.io https://*.intercomcdn.com https://uploads.intercomusercontent.com https://sessions.bugsnag.com https://notify.bugsnag.com https://*.kissmetrics.com https://*.kissmetrics.io https://api.segment.io https://cdn.segment.com https://*.id.opendns.com https://www.google-analytics.com https://*.g.doubleclick.net https://www.facebook.com https://api.autopilothq.com https://*.filestackapi.com https://cdn.filestackcontent.com https://s3.amazonaws.com https://*.nr-data.net https://browser.pipe.aria.microsoft.com https://checkout.stripe.com https://risk.clearbit.com https://forms.hubspot.com https://*.pubnub.com; font-src 'self' https: data: chrome-extension:; form-action 'self' https://docsend.com https://*.docsend.com https://intercom.help https://api-iam.intercom.io https://accounts.google.com https://www.linkedin.com https://*.salesforce.com https://www.dropbox.com https://accounts.logme.in https://secure.join.me https://*.okta.com https://*.oktapreview.com https://*.jumpcloud.com https://*.onelogin.com https://zapier.com https://ifttt.com https://www.facebook.com; frame-src 'self' https://d2qvtfnm75xrxf.cloudfront.net https://js.stripe.com https://checkout.stripe.com https://www.youtube.com https://player.vimeo.com https://*.g.doubleclick.net https://tpc.googlesyndication.com https://www.facebook.com https://telemetryservice.firstpartyapps.oaspapps.com https://ifttt.com; img-src 'self' https: data: blob: chrome-extension:; media-src 'self' data: https://d2qvtfnm75xrxf.cloudfront.net https://js.intercomcdn.com; object-src 'none'; script-src 'self' 'unsafe-eval' 'unsafe-inline' 'strict-dynamic' https://d2qvtfnm75xrxf.cloudfront.net https://app.intercom.io https://widget.intercom.io https://js.intercomcdn.com https://*.google-analytics.com https://cdn.segment.com https://scripts.kissmetrics.com https://*.id.opendns.com https://js-agent.newrelic.com https://*.nr-data.net https://www.youtube.com https://*.ytimg.com https://vimeo.com https://www.vimeo.com https://www.googletagmanager.com https://www.googleadservices.com https://tagmanager.google.com https://connect.facebook.net https://*.quora.com https://*.bing.com https://api.autopilothq.com https://*.capterra.com https://*.g.doubleclick.net https://js.hs-analytics.net https://js.hs-scripts.com https://js.hscollectedforms.net https://js.hsleadflows.net https://js.stripe.com https://checkout.stripe.com https://ajax.aspnetcdn.com https://appsforoffice.microsoft.com https://maps.googleapis.com https://static.filestackapi.com https://risk.clearbit.com https:/
Source: data_3.2.dr String found in binary or memory: Content-Security-Policy: default-src 'self'; base-uri 'self'; child-src 'self' blob:; connect-src 'self' blob: https://d2qvtfnm75xrxf.cloudfront.net https://api.intercom.io https://api-iam.intercom.io https://api-ping.intercom.io https://nexus-websocket-a.intercom.io https://nexus-websocket-b.intercom.io https://nexus-long-poller-a.intercom.io https://nexus-long-poller-b.intercom.io wss://nexus-websocket-a.intercom.io wss://nexus-websocket-b.intercom.io https://*.intercomcdn.com https://uploads.intercomusercontent.com https://sessions.bugsnag.com https://notify.bugsnag.com https://*.kissmetrics.com https://*.kissmetrics.io https://api.segment.io https://cdn.segment.com https://*.id.opendns.com https://www.google-analytics.com https://*.g.doubleclick.net https://www.facebook.com https://api.autopilothq.com https://*.filestackapi.com https://cdn.filestackcontent.com https://s3.amazonaws.com https://*.nr-data.net https://browser.pipe.aria.microsoft.com https://checkout.stripe.com https://risk.clearbit.com https://forms.hubspot.com https://*.pubnub.com; font-src 'self' https: data: chrome-extension:; form-action 'self' https://docsend.com https://*.docsend.com https://intercom.help https://api-iam.intercom.io https://accounts.google.com https://www.linkedin.com https://*.salesforce.com https://www.dropbox.com https://accounts.logme.in https://secure.join.me https://*.okta.com https://*.oktapreview.com https://*.jumpcloud.com https://*.onelogin.com https://zapier.com https://ifttt.com https://www.facebook.com; frame-src 'self' https://d2qvtfnm75xrxf.cloudfront.net https://js.stripe.com https://checkout.stripe.com https://www.youtube.com https://player.vimeo.com https://*.g.doubleclick.net https://tpc.googlesyndication.com https://www.facebook.com https://telemetryservice.firstpartyapps.oaspapps.com https://ifttt.com; img-src 'self' https: data: blob: chrome-extension:; media-src 'self' data: https://d2qvtfnm75xrxf.cloudfront.net https://js.intercomcdn.com; object-src 'none'; script-src 'self' 'unsafe-eval' 'unsafe-inline' 'strict-dynamic' https://d2qvtfnm75xrxf.cloudfront.net https://app.intercom.io https://widget.intercom.io https://js.intercomcdn.com https://*.google-analytics.com https://cdn.segment.com https://scripts.kissmetrics.com https://*.id.opendns.com https://js-agent.newrelic.com https://*.nr-data.net https://www.youtube.com https://*.ytimg.com https://vimeo.com https://www.vimeo.com https://www.googletagmanager.com https://www.googleadservices.com https://tagmanager.google.com https://connect.facebook.net https://*.quora.com https://*.bing.com https://api.autopilothq.com https://*.capterra.com https://*.g.doubleclick.net https://js.hs-analytics.net https://js.hs-scripts.com https://js.hscollectedforms.net https://js.hsleadflows.net https://js.stripe.com https://checkout.stripe.com https://ajax.aspnetcdn.com https://appsforoffice.microsoft.com https://maps.googleapis.com https://static.filestackapi.com https://risk.clearbit.com https:/
Source: data_3.2.dr String found in binary or memory: HTTP/1.1 302 FoundServer: nginxDate: Tue, 30 Nov 2021 04:18:04 GMTContent-Type: text/html; charset=utf-8X-Frame-Options: DENYLocation: https://onedrive.live.com/download?cid=59C6A303099CB9A4&resid=59C6A303099CB9A4%21594&authkey=AExLMfzct9fFsFECache-Control: no-cacheContent-Security-Policy: default-src 'self'; base-uri 'self'; child-src 'self' blob:; connect-src 'self' blob: https://d2qvtfnm75xrxf.cloudfront.net https://api.intercom.io https://api-iam.intercom.io https://api-ping.intercom.io https://nexus-websocket-a.intercom.io https://nexus-websocket-b.intercom.io https://nexus-long-poller-a.intercom.io https://nexus-long-poller-b.intercom.io wss://nexus-websocket-a.intercom.io wss://nexus-websocket-b.intercom.io https://*.intercomcdn.com https://uploads.intercomusercontent.com https://sessions.bugsnag.com https://notify.bugsnag.com https://*.kissmetrics.com https://*.kissmetrics.io https://api.segment.io https://cdn.segment.com https://*.id.opendns.com https://www.google-analytics.com https://*.g.doubleclick.net https://www.facebook.com https://api.autopilothq.com https://*.filestackapi.com https://cdn.filestackcontent.com https://s3.amazonaws.com https://*.nr-data.net https://browser.pipe.aria.microsoft.com https://checkout.stripe.com https://risk.clearbit.com https://forms.hubspot.com https://*.pubnub.com; font-src 'self' https: data: chrome-extension:; form-action 'self' https://docsend.com https://*.docsend.com https://intercom.help https://api-iam.intercom.io https://accounts.google.com https://www.linkedin.com https://*.salesforce.com https://www.dropbox.com https://accounts.logme.in https://secure.join.me https://*.okta.com https://*.oktapreview.com https://*.jumpcloud.com https://*.onelogin.com https://zapier.com https://ifttt.com https://www.facebook.com; frame-src 'self' https://d2qvtfnm75xrxf.cloudfront.net https://js.stripe.com https://checkout.stripe.com https://www.youtube.com https://player.vimeo.com https://*.g.doubleclick.net https://tpc.googlesyndication.com https://www.facebook.com https://telemetryservice.firstpartyapps.oaspapps.com https://ifttt.com; img-src 'self' https: data: blob: chrome-extension:; media-src 'self' data: https://d2qvtfnm75xrxf.cloudfront.net https://js.intercomcdn.com; object-src 'none'; script-src 'self' 'unsafe-eval' 'unsafe-inline' 'strict-dynamic' https://d2qvtfnm75xrxf.cloudfront.net https://app.intercom.io https://widget.intercom.io https://js.intercomcdn.com https://*.google-analytics.com https://cdn.segment.com https://scripts.kissmetrics.com https://*.id.opendns.com https://js-agent.newrelic.com https://*.nr-data.net https://www.youtube.com https://*.ytimg.com https://vimeo.com https://www.vimeo.com https://www.googletagmanager.com https://www.googleadservices.com https://tagmanager.google.com https://connect.facebook.net https://*.quora.com https://*.bing.com https://api.autopilothq.com https://*.capterra.com https://*.g.doubleclick.net https://js.hs-analytics.net https://js.hs-scripts.com
Source: data_3.2.dr String found in binary or memory: HTTP/1.1 302 FoundServer: nginxDate: Tue, 30 Nov 2021 04:18:04 GMTContent-Type: text/html; charset=utf-8X-Frame-Options: DENYLocation: https://onedrive.live.com/download?cid=59C6A303099CB9A4&resid=59C6A303099CB9A4%21594&authkey=AExLMfzct9fFsFECache-Control: no-cacheContent-Security-Policy: default-src 'self'; base-uri 'self'; child-src 'self' blob:; connect-src 'self' blob: https://d2qvtfnm75xrxf.cloudfront.net https://api.intercom.io https://api-iam.intercom.io https://api-ping.intercom.io https://nexus-websocket-a.intercom.io https://nexus-websocket-b.intercom.io https://nexus-long-poller-a.intercom.io https://nexus-long-poller-b.intercom.io wss://nexus-websocket-a.intercom.io wss://nexus-websocket-b.intercom.io https://*.intercomcdn.com https://uploads.intercomusercontent.com https://sessions.bugsnag.com https://notify.bugsnag.com https://*.kissmetrics.com https://*.kissmetrics.io https://api.segment.io https://cdn.segment.com https://*.id.opendns.com https://www.google-analytics.com https://*.g.doubleclick.net https://www.facebook.com https://api.autopilothq.com https://*.filestackapi.com https://cdn.filestackcontent.com https://s3.amazonaws.com https://*.nr-data.net https://browser.pipe.aria.microsoft.com https://checkout.stripe.com https://risk.clearbit.com https://forms.hubspot.com https://*.pubnub.com; font-src 'self' https: data: chrome-extension:; form-action 'self' https://docsend.com https://*.docsend.com https://intercom.help https://api-iam.intercom.io https://accounts.google.com https://www.linkedin.com https://*.salesforce.com https://www.dropbox.com https://accounts.logme.in https://secure.join.me https://*.okta.com https://*.oktapreview.com https://*.jumpcloud.com https://*.onelogin.com https://zapier.com https://ifttt.com https://www.facebook.com; frame-src 'self' https://d2qvtfnm75xrxf.cloudfront.net https://js.stripe.com https://checkout.stripe.com https://www.youtube.com https://player.vimeo.com https://*.g.doubleclick.net https://tpc.googlesyndication.com https://www.facebook.com https://telemetryservice.firstpartyapps.oaspapps.com https://ifttt.com; img-src 'self' https: data: blob: chrome-extension:; media-src 'self' data: https://d2qvtfnm75xrxf.cloudfront.net https://js.intercomcdn.com; object-src 'none'; script-src 'self' 'unsafe-eval' 'unsafe-inline' 'strict-dynamic' https://d2qvtfnm75xrxf.cloudfront.net https://app.intercom.io https://widget.intercom.io https://js.intercomcdn.com https://*.google-analytics.com https://cdn.segment.com https://scripts.kissmetrics.com https://*.id.opendns.com https://js-agent.newrelic.com https://*.nr-data.net https://www.youtube.com https://*.ytimg.com https://vimeo.com https://www.vimeo.com https://www.googletagmanager.com https://www.googleadservices.com https://tagmanager.google.com https://connect.facebook.net https://*.quora.com https://*.bing.com https://api.autopilothq.com https://*.capterra.com https://*.g.doubleclick.net https://js.hs-analytics.net https://js.hs-scripts.com
Source: data_3.2.dr String found in binary or memory: HTTP/1.1 302 FoundServer: nginxDate: Tue, 30 Nov 2021 04:18:04 GMTContent-Type: text/html; charset=utf-8X-Frame-Options: DENYLocation: https://onedrive.live.com/download?cid=59C6A303099CB9A4&resid=59C6A303099CB9A4%21594&authkey=AExLMfzct9fFsFECache-Control: no-cacheContent-Security-Policy: default-src 'self'; base-uri 'self'; child-src 'self' blob:; connect-src 'self' blob: https://d2qvtfnm75xrxf.cloudfront.net https://api.intercom.io https://api-iam.intercom.io https://api-ping.intercom.io https://nexus-websocket-a.intercom.io https://nexus-websocket-b.intercom.io https://nexus-long-poller-a.intercom.io https://nexus-long-poller-b.intercom.io wss://nexus-websocket-a.intercom.io wss://nexus-websocket-b.intercom.io https://*.intercomcdn.com https://uploads.intercomusercontent.com https://sessions.bugsnag.com https://notify.bugsnag.com https://*.kissmetrics.com https://*.kissmetrics.io https://api.segment.io https://cdn.segment.com https://*.id.opendns.com https://www.google-analytics.com https://*.g.doubleclick.net https://www.facebook.com https://api.autopilothq.com https://*.filestackapi.com https://cdn.filestackcontent.com https://s3.amazonaws.com https://*.nr-data.net https://browser.pipe.aria.microsoft.com https://checkout.stripe.com https://risk.clearbit.com https://forms.hubspot.com https://*.pubnub.com; font-src 'self' https: data: chrome-extension:; form-action 'self' https://docsend.com https://*.docsend.com https://intercom.help https://api-iam.intercom.io https://accounts.google.com https://www.linkedin.com https://*.salesforce.com https://www.dropbox.com https://accounts.logme.in https://secure.join.me https://*.okta.com https://*.oktapreview.com https://*.jumpcloud.com https://*.onelogin.com https://zapier.com https://ifttt.com https://www.facebook.com; frame-src 'self' https://d2qvtfnm75xrxf.cloudfront.net https://js.stripe.com https://checkout.stripe.com https://www.youtube.com https://player.vimeo.com https://*.g.doubleclick.net https://tpc.googlesyndication.com https://www.facebook.com https://telemetryservice.firstpartyapps.oaspapps.com https://ifttt.com; img-src 'self' https: data: blob: chrome-extension:; media-src 'self' data: https://d2qvtfnm75xrxf.cloudfront.net https://js.intercomcdn.com; object-src 'none'; script-src 'self' 'unsafe-eval' 'unsafe-inline' 'strict-dynamic' https://d2qvtfnm75xrxf.cloudfront.net https://app.intercom.io https://widget.intercom.io https://js.intercomcdn.com https://*.google-analytics.com https://cdn.segment.com https://scripts.kissmetrics.com https://*.id.opendns.com https://js-agent.newrelic.com https://*.nr-data.net https://www.youtube.com https://*.ytimg.com https://vimeo.com https://www.vimeo.com https://www.googletagmanager.com https://www.googleadservices.com https://tagmanager.google.com https://connect.facebook.net https://*.quora.com https://*.bing.com https://api.autopilothq.com https://*.capterra.com https://*.g.doubleclick.net https://js.hs-analytics.net https://js.hs-scripts.com
Source: Filtering Rules.1.dr String found in binary or memory: www.facebook.com/ajax/ads/ equals www.facebook.com (Facebook)
Source: Filtering Rules.1.dr String found in binary or memory: www.facebook.com0 equals www.facebook.com (Facebook)
Source: angular.js.1.dr String found in binary or memory: http://angularjs.org
Source: angular.js.1.dr String found in binary or memory: http://errors.angularjs.org/1.6.4-local
Source: pnacl_public_x86_64_pnacl_sz_nexe.1.dr, pnacl_public_x86_64_pnacl_llc_nexe.1.dr String found in binary or memory: http://llvm.org/):
Source: mirroring_hangouts.js.1.dr String found in binary or memory: http://tools.ietf.org/html/rfc1950
Source: mirroring_hangouts.js.1.dr String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: mirroring_hangouts.js.1.dr String found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions
Source: mirroring_hangouts.js.1.dr String found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01
Source: Reporting and NEL.2.dr String found in binary or memory: https://a.nel.cloudflare.com/report/v3?s=aJe%2B3%2F4hNG3Whh0qPCoSicWI%2BVtjYBqSfq0o%2B%2F24mI7J3PldT
Source: Reporting and NEL.2.dr String found in binary or memory: https://a.nel.cloudflare.com/report/v3?s=icKGpM7uYIiZswZvQEHjBMof4gelzMvES6xMZP4r6n7GxoYUR9JYUFkNLc9
Source: data_1.2.dr String found in binary or memory: https://aadcdn.msauth.net/ests/2.1/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
Source: ee3f4d79-0e9c-4821-b7ca-530943adfc7f.tmp.2.dr, 6f195062-691e-42dd-8e62-7d3c22a457a8.tmp.2.dr, manifest.json2.1.dr String found in binary or memory: https://accounts.google.com
Source: craw_window.js.1.dr String found in binary or memory: https://accounts.google.com/MergeSession
Source: ee3f4d79-0e9c-4821-b7ca-530943adfc7f.tmp.2.dr String found in binary or memory: https://ajax.googleapis.com
Source: data_1.2.dr String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
Source: data_3.2.dr String found in binary or memory: https://api-iam.intercom.io
Source: data_3.2.dr String found in binary or memory: https://api-ping.intercom.io
Source: data_3.2.dr String found in binary or memory: https://api.intercom.io
Source: data_3.2.dr String found in binary or memory: https://api.segment.io
Source: ee3f4d79-0e9c-4821-b7ca-530943adfc7f.tmp.2.dr, 6f195062-691e-42dd-8e62-7d3c22a457a8.tmp.2.dr, manifest.json2.1.dr String found in binary or memory: https://apis.google.com
Source: mirroring_common.js.1.dr String found in binary or memory: https://apis.google.com/js/client.js
Source: mirroring_common.js.1.dr String found in binary or memory: https://castedumessaging-pa.googleapis.com/v1
Source: data_3.2.dr String found in binary or memory: https://cdn.segment.com
Source: data_1.2.dr String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js
Source: data_1.2.dr String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.jskf
Source: pnacl_public_x86_64_libcrt_platform_a.1.dr, pnacl_public_x86_64_pnacl_llc_nexe.1.dr String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-clang.git
Source: pnacl_public_x86_64_libcrt_platform_a.1.dr, pnacl_public_x86_64_pnacl_llc_nexe.1.dr String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-llvm.git
Source: ee3f4d79-0e9c-4821-b7ca-530943adfc7f.tmp.2.dr, 6f195062-691e-42dd-8e62-7d3c22a457a8.tmp.2.dr String found in binary or memory: https://clients2.google.com
Source: mirroring_hangouts.js.1.dr String found in binary or memory: https://clients2.google.com/cr/report
Source: manifest.json0.1.dr, manifest.json.1.dr, manifest.json2.1.dr String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: ee3f4d79-0e9c-4821-b7ca-530943adfc7f.tmp.2.dr, 6f195062-691e-42dd-8e62-7d3c22a457a8.tmp.2.dr String found in binary or memory: https://clients2.googleusercontent.com
Source: mirroring_hangouts.js.1.dr String found in binary or memory: https://clients6.google.com
Source: pnacl_public_x86_64_ld_nexe.1.dr String found in binary or memory: https://code.google.com/p/nativeclient/issues/entry
Source: pnacl_public_x86_64_ld_nexe.1.dr String found in binary or memory: https://code.google.com/p/nativeclient/issues/entry%s:
Source: data_1.2.dr String found in binary or memory: https://code.jquery.com/jquery-3.1.1.min.js
Source: data_1.2.dr String found in binary or memory: https://code.jquery.com/jquery-3.2.1.slim.min.js
Source: data_1.2.dr String found in binary or memory: https://code.jquery.com/jquery-3.3.1.js
Source: data_1.2.dr String found in binary or memory: https://code.jquery.com/jquery-3.3.1.js&
Source: manifest.json2.1.dr String found in binary or memory: https://content.googleapis.com
Source: common.js.1.dr, mirroring_cast_streaming.js.1.dr String found in binary or memory: https://crash.corp.google.com/samples?reportid=&q=
Source: LICENSE.txt.1.dr String found in binary or memory: https://creativecommons.org/.
Source: LICENSE.txt.1.dr String found in binary or memory: https://creativecommons.org/compatiblelicenses
Source: mirroring_hangouts.js.1.dr String found in binary or memory: https://creativecommons.org/publicdomain/zero/1.0/.
Source: data_3.2.dr String found in binary or memory: https://csp.withgoogle.com/csp/hosted-libraries-pushers
Source: data_3.2.dr String found in binary or memory: https://csp.withgoogle.com/csp/hosted-libraries-pushersCross-Origin-Resource-Policy:
Source: data_3.2.dr, Reporting and NEL.2.dr String found in binary or memory: https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers
Source: data_3.2.dr String found in binary or memory: https://d2qvtfnm75xrxf.cloudfront.net
Source: e80faca5-6ec5-4af4-a40f-2e8d9e934331.tmp.2.dr, ee3f4d79-0e9c-4821-b7ca-530943adfc7f.tmp.2.dr, c9e14d76-2af0-41c1-a321-2b3c2691b15a.tmp.2.dr, 6f195062-691e-42dd-8e62-7d3c22a457a8.tmp.2.dr String found in binary or memory: https://dns.google
Source: mirroring_common.js.1.dr String found in binary or memory: https://docs.google.com
Source: 000003.log2.1.dr, History.1.dr, data_1.2.dr String found in binary or memory: https://docsend.com/view/vs4xxnasd8xu75by
Source: History.1.dr String found in binary or memory: https://docsend.com/view/vs4xxnasd8xu75by59C6A303099CB9A4
Source: data_1.2.dr String found in binary or memory: https://docsend.com/view/vs4xxnasd8xu75byy?
Source: data_3.2.dr String found in binary or memory: https://e9qmzg.bl.files.1drv.com/y4mfQlinL1bjZWvQxbSaPtnetahEIoHLnMnJI6oj1ylel9auWkfO4GQpcYn9KT1aRVB
Source: Payment-Receipt.html_Zone.Identifier.8.dr, 000003.log2.1.dr, History.1.dr, data_1.2.dr String found in binary or memory: https://e9qmzg.bl.files.1drv.com/y4mvfSX9hpfakLP8V9z8cW21J9iSBCjJj4ACQAXrcELbHawz5ogUMQZuad3-IOW66Oy
Source: LICENSE.txt.1.dr String found in binary or memory: https://easylist.to/)
Source: manifest.json2.1.dr String found in binary or memory: https://feedback.googleusercontent.com
Source: ee3f4d79-0e9c-4821-b7ca-530943adfc7f.tmp.2.dr, 6f195062-691e-42dd-8e62-7d3c22a457a8.tmp.2.dr String found in binary or memory: https://fonts.googleapis.com
Source: data_1.2.dr String found in binary or memory: https://fonts.googleapis.com/css?family=Archivo
Source: manifest.json2.1.dr String found in binary or memory: https://fonts.googleapis.com;
Source: data_3.2.dr, ee3f4d79-0e9c-4821-b7ca-530943adfc7f.tmp.2.dr, 6f195062-691e-42dd-8e62-7d3c22a457a8.tmp.2.dr String found in binary or memory: https://fonts.gstatic.com
Source: data_2.2.dr String found in binary or memory: https://fonts.gstatic.com/s/archivonarrow/v18/tss5ApVBdCYD5Q7hcxTE1ArZ0Zz8oY2KRmwvKhhvLFG6o3ms.woff2
Source: data_2.2.dr String found in binary or memory: https://fonts.gstatic.com/s/archivonarrow/v18/tss5ApVBdCYD5Q7hcxTE1ArZ0Zz8oY2KRmwvKhhvLFG6rHmsJCQ.wo
Source: data_2.2.dr String found in binary or memory: https://fonts.gstatic.com/s/archivonarrow/v18/tss5ApVBdCYD5Q7hcxTE1ArZ0Zz8oY2KRmwvKhhvLFG6rXmsJCQ.wo
Source: manifest.json2.1.dr String found in binary or memory: https://fonts.gstatic.com;
Source: angular.js.1.dr, material_css_min.css.1.dr String found in binary or memory: https://github.com/angular/material
Source: LICENSE.txt.1.dr String found in binary or memory: https://github.com/easylist)
Source: craw_background.js.1.dr, craw_window.js.1.dr String found in binary or memory: https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
Source: mirroring_hangouts.js.1.dr String found in binary or memory: https://github.com/madler/zlib/blob/master/zlib.h
Source: data_2.2.dr String found in binary or memory: https://gyazo.com
Source: data_2.2.dr String found in binary or memory: https://gyazo.comAge:
Source: mirroring_hangouts.js.1.dr String found in binary or memory: https://hangouts.clients6.google.com
Source: manifest.json2.1.dr String found in binary or memory: https://hangouts.google.com/
Source: mirroring_hangouts.js.1.dr String found in binary or memory: https://hangouts.google.com/hangouts/_/logpref
Source: data_1.2.dr String found in binary or memory: https://i.gyazo.com/960ba84347db823b8e7fc9cd4369a4cc.png
Source: data_1.2.dr String found in binary or memory: https://i.gyazo.com/d1b2270a564efe0c37d2e01ed1c647a8.png
Source: data_1.2.dr String found in binary or memory: https://i.gyazo.com/d1b2270a564efe0c37d2e01ed1c647a8.pngD
Source: data_3.2.dr String found in binary or memory: https://ka-f.fontawesome.com
Source: data_1.2.dr String found in binary or memory: https://ka-f.fontawesome.com/releases/v5.15.4/css/free-v4-shims.min.css?token=585b051251
Source: data_1.2.dr String found in binary or memory: https://ka-f.fontawesome.com/releases/v5.15.4/css/free.min.css?token=585b051251
Source: data_3.2.dr String found in binary or memory: https://kit.fontawesome.com
Source: data_1.2.dr String found in binary or memory: https://kit.fontawesome.com/585b051251.js
Source: data_1.2.dr String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css
Source: data_1.2.dr String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js
Source: data_1.2.dr String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.jsy
Source: mirroring_common.js.1.dr String found in binary or memory: https://meet.google.com
Source: mirroring_hangouts.js.1.dr String found in binary or memory: https://meetings.clients6.google.com
Source: mirroring_common.js.1.dr String found in binary or memory: https://networktraversal.googleapis.com/v1alpha
Source: data_3.2.dr String found in binary or memory: https://nexus-long-poller-a.intercom.io
Source: data_3.2.dr String found in binary or memory: https://nexus-long-poller-b.intercom.io
Source: data_3.2.dr String found in binary or memory: https://nexus-websocket-a.intercom.io
Source: data_3.2.dr String found in binary or memory: https://nexus-websocket-b.intercom.io
Source: data_3.2.dr String found in binary or memory: https://notify.bugsnag.com
Source: ee3f4d79-0e9c-4821-b7ca-530943adfc7f.tmp.2.dr, 6f195062-691e-42dd-8e62-7d3c22a457a8.tmp.2.dr String found in binary or memory: https://ogs.google.com
Source: data_3.2.dr, 000003.log2.1.dr, History.1.dr String found in binary or memory: https://onedrive.live.com/download?cid=59C6A303099CB9A4&resid=59C6A303099CB9A4%21594&authkey=AExLMfz
Source: manifest.json0.1.dr, craw_window.js.1.dr String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: ee3f4d79-0e9c-4821-b7ca-530943adfc7f.tmp.2.dr, 6f195062-691e-42dd-8e62-7d3c22a457a8.tmp.2.dr String found in binary or memory: https://play.google.com
Source: mirroring_hangouts.js.1.dr String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: mirroring_hangouts.js.1.dr String found in binary or memory: https://preprod-hangouts-googleapis.sandbox.google.com
Source: ee3f4d79-0e9c-4821-b7ca-530943adfc7f.tmp.2.dr String found in binary or memory: https://r4---sn-4g5edns6.gvt1.com
Source: data_1.2.dr String found in binary or memory: https://r4---sn-4g5edns6.gvt1.com/edgedl/chrome/dict/en-us-9-0.bdic?cms_redirect=yes&mh=I2&mip=84.17
Source: ee3f4d79-0e9c-4821-b7ca-530943adfc7f.tmp.2.dr String found in binary or memory: https://redirector.gvt1.com
Source: data_1.2.dr String found in binary or memory: https://redirector.gvt1.com/edgedl/chrome/dict/en-us-9-0.bdic
Source: manifest.json0.1.dr, craw_window.js.1.dr String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: data_3.2.dr String found in binary or memory: https://sessions.bugsnag.com
Source: ee3f4d79-0e9c-4821-b7ca-530943adfc7f.tmp.2.dr, 6f195062-691e-42dd-8e62-7d3c22a457a8.tmp.2.dr String found in binary or memory: https://ssl.gstatic.com
Source: messages.json27.1.dr, messages.json52.1.dr, feedback.html.1.dr, messages.json80.1.dr, messages.json28.1.dr, messages.json72.1.dr, messages.json73.1.dr, messages.json54.1.dr, messages.json10.1.dr, messages.json17.1.dr, messages.json29.1.dr, messages.json61.1.dr, messages.json3.1.dr, messages.json74.1.dr, messages.json60.1.dr, messages.json9.1.dr, messages.json62.1.dr, messages.json41.1.dr, messages.json24.1.dr, messages.json4.1.dr, messages.json8.1.dr, messages.json1.1.dr, messages.json15.1.dr, messages.json56.1.dr, messages.json7.1.dr, messages.json30.1.dr, messages.json70.1.dr, messages.json23.1.dr, messages.json50.1.dr, messages.json25.1.dr, messages.json63.1.dr, messages.json6.1.dr, messages.json53.1.dr, messages.json65.1.dr, messages.json12.1.dr, messages.json2.1.dr, messages.json55.1.dr, messages.json71.1.dr, messages.json82.1.dr, messages.json81.1.dr, messages.json5.1.dr, messages.json42.1.dr, messages.json64.1.dr, messages.json0.1.dr, messages.json11.1.dr, messages.json16.1.dr, messages.json.1.dr, messages.json13.1.dr, messages.json14.1.dr String found in binary or memory: https://support.google.com/chromecast/answer/2998456
Source: messages.json27.1.dr, messages.json52.1.dr, feedback.html.1.dr, messages.json80.1.dr, messages.json28.1.dr, messages.json72.1.dr, messages.json73.1.dr, messages.json54.1.dr, messages.json10.1.dr, messages.json17.1.dr, messages.json29.1.dr, messages.json61.1.dr, messages.json3.1.dr, messages.json74.1.dr, messages.json60.1.dr, messages.json9.1.dr, messages.json62.1.dr, messages.json41.1.dr, messages.json24.1.dr, messages.json4.1.dr, messages.json8.1.dr, messages.json1.1.dr, messages.json15.1.dr, messages.json56.1.dr, messages.json7.1.dr, messages.json30.1.dr, messages.json70.1.dr, messages.json23.1.dr, messages.json50.1.dr, messages.json25.1.dr, messages.json63.1.dr, messages.json6.1.dr, messages.json53.1.dr, messages.json65.1.dr, messages.json12.1.dr, messages.json2.1.dr, messages.json55.1.dr, messages.json71.1.dr, messages.json82.1.dr, messages.json81.1.dr, messages.json5.1.dr, messages.json42.1.dr, messages.json64.1.dr, messages.json0.1.dr, messages.json11.1.dr, messages.json16.1.dr, messages.json.1.dr, messages.json13.1.dr, messages.json14.1.dr String found in binary or memory: https://support.google.com/chromecast/troubleshooter/2995236
Source: data_3.2.dr String found in binary or memory: https://uploads.intercomusercontent.com
Source: craw_background.js.1.dr, craw_window.js.1.dr String found in binary or memory: https://www-googleapis-staging.sandbox.google.com
Source: data_3.2.dr String found in binary or memory: https://www.google-analytics.com
Source: ee3f4d79-0e9c-4821-b7ca-530943adfc7f.tmp.2.dr, 6f195062-691e-42dd-8e62-7d3c22a457a8.tmp.2.dr, manifest.json2.1.dr String found in binary or memory: https://www.google.com
Source: manifest.json0.1.dr String found in binary or memory: https://www.google.com/
Source: craw_window.js.1.dr String found in binary or memory: https://www.google.com/accounts/OAuthLogin?issueuberauth=1
Source: craw_window.js.1.dr String found in binary or memory: https://www.google.com/images/cleardot.gif
Source: craw_window.js.1.dr String found in binary or memory: https://www.google.com/images/dot2.gif
Source: craw_window.js.1.dr String found in binary or memory: https://www.google.com/images/x2.gif
Source: craw_background.js.1.dr String found in binary or memory: https://www.google.com/intl/en-US/chrome/blank.html
Source: mirroring_hangouts.js.1.dr String found in binary or memory: https://www.google.com/log?format=json&hasfast=true
Source: feedback_script.js.1.dr String found in binary or memory: https://www.google.com/tools/feedback
Source: manifest.json2.1.dr String found in binary or memory: https://www.google.com;
Source: ee3f4d79-0e9c-4821-b7ca-530943adfc7f.tmp.2.dr, 6f195062-691e-42dd-8e62-7d3c22a457a8.tmp.2.dr, craw_background.js.1.dr, craw_window.js.1.dr String found in binary or memory: https://www.googleapis.com
Source: manifest.json0.1.dr String found in binary or memory: https://www.googleapis.com/
Source: manifest.json2.1.dr String found in binary or memory: https://www.googleapis.com/auth/calendar.readonly
Source: manifest.json2.1.dr String found in binary or memory: https://www.googleapis.com/auth/cast-edu-messaging
Source: manifest.json0.1.dr String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json0.1.dr String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json2.1.dr String found in binary or memory: https://www.googleapis.com/auth/clouddevices
Source: manifest.json2.1.dr String found in binary or memory: https://www.googleapis.com/auth/hangouts
Source: manifest.json2.1.dr String found in binary or memory: https://www.googleapis.com/auth/hangouts.readonly
Source: manifest.json2.1.dr String found in binary or memory: https://www.googleapis.com/auth/meetings
Source: manifest.json2.1.dr String found in binary or memory: https://www.googleapis.com/auth/plus.peopleapi.readwrite
Source: manifest.json0.1.dr String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json0.1.dr String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: manifest.json2.1.dr String found in binary or memory: https://www.googleapis.com/auth/userinfo.email
Source: mirroring_common.js.1.dr String found in binary or memory: https://www.googleapis.com/calendar/v3
Source: mirroring_common.js.1.dr String found in binary or memory: https://www.googleapis.com/hangouts/v1
Source: ee3f4d79-0e9c-4821-b7ca-530943adfc7f.tmp.2.dr, 6f195062-691e-42dd-8e62-7d3c22a457a8.tmp.2.dr String found in binary or memory: https://www.gstatic.com
Source: common.js.1.dr String found in binary or memory: https://www.gstatic.com/hangouts_echo_detector/release/%
Source: manifest.json2.1.dr String found in binary or memory: https://www.gstatic.com;
Source: unknown HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: unknown HTTPS traffic detected: 104.19.142.111:443 -> 192.168.2.3:49781 version: TLS 1.2
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Local\Temp\23c0a88f-ff38-43ab-b16e-d164fbe986c2.tmp Jump to behavior
Source: classification engine Classification label: mal52.phis.win@35/268@15/11
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "https://docsend.com/view/vs4xxnasd8xu75by
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1564,2201414432115109513,9060046497952583545,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1920 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1564,2201414432115109513,9060046497952583545,131072 --lang=en-US --service-sandbox-type=none --enable-audio-service-sandbox --mojo-platform-channel-handle=4784 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1564,2201414432115109513,9060046497952583545,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1920 /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1564,2201414432115109513,9060046497952583545,131072 --lang=en-US --service-sandbox-type=none --enable-audio-service-sandbox --mojo-platform-channel-handle=4784 /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Program Files\Google\Chrome\Application\Dictionaries Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-61A62488-13C4.pma Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic Jump to behavior
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs