Analysis Report https://faxfax.zizera.com/remittanceadvice

Overview

General Information

Sample URL: https://faxfax.zizera.com/remittanceadvice
Analysis ID: 321356

Most interesting Screenshot:

Detection

HTMLPhisher
Score: 56
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Yara detected HtmlPhish_10
HTML body contains low number of good links
HTML title does not match URL
Suspicious form URL found

Classification

AV Detection:

barindex
Antivirus detection for URL or domain
Source: https://yelphaiku.com/office/mfile/ SlashNext: Label: Fake Login Page type: Phishing & Social Engineering

Phishing:

barindex
Yara detected HtmlPhish_10
Source: Yara match File source: 358075.pages.csv, type: HTML
HTML body contains low number of good links
Source: https://yelphaiku.com/office/mfile/ HTTP Parser: Number of links: 0
Source: https://yelphaiku.com/office/mfile/ HTTP Parser: Number of links: 0
HTML title does not match URL
Source: https://yelphaiku.com/office/mfile/ HTTP Parser: Title: Sharing Link Validation does not match URL
Source: https://yelphaiku.com/office/mfile/ HTTP Parser: Title: Sharing Link Validation does not match URL
Suspicious form URL found
Source: https://yelphaiku.com/office/mfile/ HTTP Parser: Form action: mai.php
Source: https://yelphaiku.com/office/mfile/ HTTP Parser: Form action: mai.php
Source: https://www.godaddy.com/contact-us HTTP Parser: No <meta name="author".. found
Source: https://www.godaddy.com/contact-us HTTP Parser: No <meta name="author".. found
Source: https://www.godaddy.com/ HTTP Parser: No <meta name="author".. found
Source: https://www.godaddy.com/ HTTP Parser: No <meta name="author".. found
Source: https://yelphaiku.com/office/mfile/ HTTP Parser: No <meta name="author".. found
Source: https://yelphaiku.com/office/mfile/ HTTP Parser: No <meta name="author".. found
Source: https://www.godaddy.com/legal/agreements/privacy-policy?target=_blank HTTP Parser: No <meta name="author".. found
Source: https://www.godaddy.com/legal/agreements/privacy-policy?target=_blank HTTP Parser: No <meta name="author".. found
Source: https://www.godaddy.com/contact-us HTTP Parser: No <meta name="copyright".. found
Source: https://www.godaddy.com/contact-us HTTP Parser: No <meta name="copyright".. found
Source: https://www.godaddy.com/ HTTP Parser: No <meta name="copyright".. found
Source: https://www.godaddy.com/ HTTP Parser: No <meta name="copyright".. found
Source: https://yelphaiku.com/office/mfile/ HTTP Parser: No <meta name="copyright".. found
Source: https://yelphaiku.com/office/mfile/ HTTP Parser: No <meta name="copyright".. found
Source: https://www.godaddy.com/legal/agreements/privacy-policy?target=_blank HTTP Parser: No <meta name="copyright".. found
Source: https://www.godaddy.com/legal/agreements/privacy-policy?target=_blank HTTP Parser: No <meta name="copyright".. found
Source: global traffic HTTP traffic detected: GET /8923bsuydn HTTP/1.1Host: x.coConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: 4f0802021d44bc50_0.0.dr String found in binary or memory: /_keyhttps://www.youtube.com/s/player/8b85eac2/www-widgetapi.vflset/www-widgetapi.js equals www.youtube.com (Youtube)
Source: 6dc6a15fa209a9ca_0.0.dr String found in binary or memory: Ohttps://www.youtube.com/s/player/8b85eac2/www-widgetapi.vflset/www-widgetapi.jsaD` equals www.youtube.com (Youtube)
Source: 4f0802021d44bc50_0.0.dr String found in binary or memory: _keyhttps://www.youtube.com/s/player/8b85eac2/www-widgetapi.vflset/www-widgetapi.js equals www.youtube.com (Youtube)
Source: 6dc6a15fa209a9ca_0.0.dr String found in binary or memory: https://www.youtube.com/s/player/8b85eac2/www-widgetapi.vflset/www-widgetapi.js equals www.youtube.com (Youtube)
Source: unknown DNS traffic detected: queries for: faxfax.zizera.com
Source: ED02812CD7D061716B0BBE6F31979D00_FAC544846B8B5FE851FF6BF0CF2990220.1.dr String found in binary or memory: http://certs.godaddy.com/repository/1301
Source: 223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B17710.1.dr String found in binary or memory: http://crl.godaddy.com/repository/0
Source: 223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B17710.1.dr String found in binary or memory: http://crl.godaddy.com/repository/gdroot-g2.crl0J
Source: ED02812CD7D061716B0BBE6F31979D00_FAC544846B8B5FE851FF6BF0CF2990220.1.dr String found in binary or memory: http://crl.godaddy.com/repository/mastergodaddy2issuing.crl0J
Source: 77EC63BDA74BD0D0E0426DC8F8008506.1.dr String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771.1.dr String found in binary or memory: http://ocsp.godaddy.com//MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLb
Source: ED02812CD7D061716B0BBE6F31979D00_FAC544846B8B5FE851FF6BF0CF299022.1.dr String found in binary or memory: http://ocsp.godaddy.com//MEowSDBGMEQwQjAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojP
Source: Current Session.0.dr String found in binary or memory: http://x.co/8923bsuydn
Source: Current Session.0.dr String found in binary or memory: http://x.co/8923bsuydn%DM
Source: 000003.log6.0.dr String found in binary or memory: https://:websiteId.onlinestore.godaddy.com/admin/products/new
Source: 000003.log6.0.dr String found in binary or memory: https://:websiteId.onlinestore.godaddy.com/admin/shipping_methods
Source: Reporting and NEL.1.dr String found in binary or memory: https://a.nel.cloudflare.com/report?s=6Z505SKohIi4WWmgmXZqMa0Djo%2BXeFR8%2Fks5wSla7rqTs2uUB10IWqnBWY
Source: 069eeec3b24f9036_0.0.dr String found in binary or memory: https://accdn.lpsnmedia.net/api/account/30187337/configuration/engagement-window/window-confs/249837
Source: 6745a26ff250e255_0.0.dr String found in binary or memory: https://accdn.lpsnmedia.net/api/account/30187337/configuration/le-campaigns/campaigns/1741658530/eng
Source: 80e4f13fb63695ca_0.0.dr String found in binary or memory: https://accdn.lpsnmedia.net/api/account/30187337/configuration/le-campaigns/zones?fields=id&fields=z
Source: bb2286b571c6fc01_0.0.dr String found in binary or memory: https://accdn.lpsnmedia.net/api/account/30187337/configuration/setting/accountproperties/?cb=lpCb212
Source: f562afac76b4b973_0.0.dr String found in binary or memory: https://accdn.lpsnmedia.net/api/account/30187337/configuration/setting/accountproperties/?cb=lpCb274
Source: ef34c246df0e42bc_0.0.dr String found in binary or memory: https://accdn.lpsnmedia.net/api/account/30187337/configuration/setting/accountproperties/?cb=lpCb415
Source: 702495c6e2e78b0c_0.0.dr String found in binary or memory: https://accdn.lpsnmedia.net/api/account/30187337/configuration/setting/accountproperties/?cb=lpCb446
Source: 4d6125cbda70b6f0_0.0.dr String found in binary or memory: https://accdn.lpsnmedia.net/api/account/30187337/configuration/setting/accountproperties/?cb=lpCb490
Source: 1cb141e79f5601dc_0.0.dr String found in binary or memory: https://accdn.lpsnmedia.net/api/account/30187337/configuration/setting/accountproperties/?cb=lpCb507
Source: ca9e60488bdc5258_0.0.dr String found in binary or memory: https://account.godaddy.com
Source: ca9e60488bdc5258_0.0.dr String found in binary or memory: https://account.godaddy.com/billing?filter=expires&subFilter=90
Source: 000003.log6.0.dr String found in binary or memory: https://account.godaddy.com/products
Source: manifest.json0.0.dr, 7dca2324-0762-42fa-aa87-27e7dc26b4c8.tmp.1.dr String found in binary or memory: https://accounts.google.com
Source: Network Action Predictor-journal.0.dr String found in binary or memory: https://ajax.aspnetcdn.com/
Source: 0ad5e255cfc99a9c_0.0.dr, 094e2d6bf2abec98_0.0.dr String found in binary or memory: https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.11.2.min.js
Source: 0ad5e255cfc99a9c_0.0.dr String found in binary or memory: https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.11.2.min.jsaD
Source: manifest.json0.0.dr, 7dca2324-0762-42fa-aa87-27e7dc26b4c8.tmp.1.dr String found in binary or memory: https://apis.google.com
Source: Network Action Predictor-journal.0.dr String found in binary or memory: https://assets.onestore.ms/
Source: ffae120ac1988083_0.0.dr String found in binary or memory: https://auth.split.io/api
Source: 001b7dfda48b5f6d_0.0.dr String found in binary or memory: https://babeljs.io/
Source: Network Action Predictor.0.dr String found in binary or memory: https://cdn.trackjs.com/
Source: 08b95bf8e6dd7b84_0.0.dr String found in binary or memory: https://cdn.trackjs.com/agent/v3/latest/t.js
Source: Network Action Predictor-journal.0.dr String found in binary or memory: https://cdnjs.cloudflare.com/
Source: 001b7dfda48b5f6d_0.0.dr, 41c17cabcb7066a9_0.0.dr String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/babel-core/5.8.23/browser.min.js
Source: 001b7dfda48b5f6d_0.0.dr String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/babel-core/5.8.23/browser.min.jsaD
Source: 762ca5cdd3b40fce_0.0.dr, 041e202bfc772cc8_0.0.dr String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/jquery.min.js
Source: 041e202bfc772cc8_0.0.dr String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/jquery.min.jsaD
Source: 7dca2324-0762-42fa-aa87-27e7dc26b4c8.tmp.1.dr String found in binary or memory: https://clients2.google.com
Source: manifest.json0.0.dr String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 7dca2324-0762-42fa-aa87-27e7dc26b4c8.tmp.1.dr String found in binary or memory: https://clients2.googleusercontent.com
Source: 1056dc81b557cff9_0.0.dr String found in binary or memory: https://confluence.godaddy.com/display/CKPT/Event
Source: 000003.log6.0.dr String found in binary or memory: https://contacts.godaddy.com/contacts?website_id=:websiteId
Source: manifest.json0.0.dr String found in binary or memory: https://content.googleapis.com
Source: ca9e60488bdc5258_0.0.dr String found in binary or memory: https://dcc.godaddy.com
Source: 3f8de413-94c9-4d2d-82ef-fb648f36cc41.tmp.1.dr, 7dca2324-0762-42fa-aa87-27e7dc26b4c8.tmp.1.dr, fa580813-37d6-4ab1-be71-3a66ef7a7790.tmp.1.dr String found in binary or memory: https://dns.google
Source: ca9e60488bdc5258_0.0.dr String found in binary or memory: https://email.godaddy.com
Source: ffae120ac1988083_0.0.dr String found in binary or memory: https://events.split.io/api
Source: 2e3d5cdfef0b6238_0.0.dr String found in binary or memory: https://faxfax.zizera.com/lite/assets/js/app.e1f1e969.js
Source: a1898ca8587555c5_0.0.dr String found in binary or memory: https://faxfax.zizera.com/lite/assets/js/chunk-vendors.753f9ae2.js
Source: History-journal.0.dr String found in binary or memory: https://faxfax.zizera.com/remittanceadvice
Source: History-journal.0.dr String found in binary or memory: https://faxfax.zizera.com/remittanceadvice$
Source: History Provider Cache.0.dr String found in binary or memory: https://faxfax.zizera.com/remittanceadvice2
Source: History-journal.0.dr String found in binary or memory: https://faxfax.zizera.com/remittanceadviceremittanceadvice
Source: manifest.json0.0.dr String found in binary or memory: https://feedback.googleusercontent.com
Source: 7dca2324-0762-42fa-aa87-27e7dc26b4c8.tmp.1.dr String found in binary or memory: https://fonts.googleapis.com
Source: manifest.json0.0.dr String found in binary or memory: https://fonts.googleapis.com;
Source: 7dca2324-0762-42fa-aa87-27e7dc26b4c8.tmp.1.dr String found in binary or memory: https://fonts.gstatic.com
Source: manifest.json0.0.dr String found in binary or memory: https://fonts.gstatic.com;
Source: ca9e60488bdc5258_0.0.dr String found in binary or memory: https://gateway.godaddy.com
Source: 001b7dfda48b5f6d_0.0.dr String found in binary or memory: https://github.com/babel/babel/issues
Source: 02454aa6d8da3fb1_0.0.dr, 1dcc732920861c78_0.0.dr, 406a0f0498fb7a87_0.0.dr, 5100317373070f9f_0.0.dr String found in binary or memory: https://godaddy.com/
Source: c3de3858c26638d5_0.0.dr String found in binary or memory: https://godaddy.com/)
Source: 7f58cad8484a3ffb_0.0.dr String found in binary or memory: https://godaddy.com/1
Source: 9064f3a5056d6bb1_0.0.dr String found in binary or memory: https://godaddy.com/4
Source: 02454aa6d8da3fb1_0.0.dr String found in binary or memory: https://godaddy.com/8
Source: f562afac76b4b973_0.0.dr String found in binary or memory: https://godaddy.com/A
Source: 183955bae54e77e3_0.0.dr String found in binary or memory: https://godaddy.com/E
Source: 4e7ced3c9971ec86_0.0.dr String found in binary or memory: https://godaddy.com/JIR
Source: 08b95bf8e6dd7b84_0.0.dr, d6862ab8bd2f679c_0.0.dr String found in binary or memory: https://godaddy.com/N
Source: 4d6125cbda70b6f0_0.0.dr String found in binary or memory: https://godaddy.com/V
Source: 3332cf6ef51dd1a9_0.0.dr String found in binary or memory: https://godaddy.com/c
Source: 406a0f0498fb7a87_0.0.dr String found in binary or memory: https://godaddy.com/d
Source: 000003.log6.0.dr String found in binary or memory: https://godaddy.com/help/contact-us
Source: aa261b7c4be61a46_0.0.dr String found in binary or memory: https://godaddy.com/i
Source: 702495c6e2e78b0c_0.0.dr String found in binary or memory: https://godaddy.com/kJ
Source: d3eaba701bf0be20_0.0.dr String found in binary or memory: https://godaddy.com/m
Source: c487f9ceefa38302_0.0.dr String found in binary or memory: https://godaddy.com/m(
Source: 0995e489bf59c488_0.0.dr String found in binary or memory: https://godaddy.com/s
Source: 47ccc19b4da77a8d_0.0.dr String found in binary or memory: https://godaddy.com/u
Source: 80e4f13fb63695ca_0.0.dr String found in binary or memory: https://godaddy.com/y8
Source: c3de3858c26638d5_0.0.dr String found in binary or memory: https://godaddy.com/z
Source: manifest.json0.0.dr String found in binary or memory: https://hangouts.google.com/
Source: Network Action Predictor-journal.0.dr String found in binary or memory: https://img1.wsimg.com/
Source: Favicons.0.dr String found in binary or memory: https://img1.wsimg.com/assets/godaddy.ico
Source: 000003.log6.0.dr String found in binary or memory: https://img1.wsimg.com/cdn/Image/Mobile/InApp/1/en-US/03dc69f6-c9ae-40f4-8fbd-dff9b1f9c3b1/CardBg4.p
Source: 000003.log6.0.dr String found in binary or memory: https://img1.wsimg.com/cdn/Image/Mobile/InApp/1/en-US/0b124caa-f0d8-4d86-8e7b-1050053b71f9/CardBg3.p
Source: 000003.log6.0.dr String found in binary or memory: https://img1.wsimg.com/cdn/Image/Mobile/InApp/1/en-US/41664504-2241-4b23-a411-495d4a4d9db0/CardBg5.p
Source: 000003.log6.0.dr String found in binary or memory: https://img1.wsimg.com/cdn/Image/Mobile/InApp/1/en-US/446f7777-b3cc-4f18-98fa-6386e45597fa/GiftCard.
Source: 000003.log6.0.dr String found in binary or memory: https://img1.wsimg.com/cdn/Image/Mobile/InApp/1/en-US/5718e628-c8d1-478d-8122-f55c075e6418/OpenWeSta
Source: 000003.log6.0.dr String found in binary or memory: https://img1.wsimg.com/cdn/Image/Mobile/InApp/1/en-US/61119dc6-2b69-47e5-b9fc-8ca7652c4466/Product.p
Source: 000003.log6.0.dr String found in binary or memory: https://img1.wsimg.com/cdn/Image/Mobile/InApp/1/en-US/688b7ee2-8381-4523-b5cf-418bcc91fd43/Campaign.
Source: 000003.log6.0.dr String found in binary or memory: https://img1.wsimg.com/cdn/Image/Mobile/InApp/1/en-US/70d6d604-9554-4082-98b8-39e2628706cf/Delivery.
Source: 000003.log6.0.dr String found in binary or memory: https://img1.wsimg.com/cdn/Image/Mobile/InApp/1/en-US/945eef1c-6161-4bf4-be0d-5d0b2e1b3053/Availabil
Source: 000003.log6.0.dr String found in binary or memory: https://img1.wsimg.com/cdn/Image/Mobile/InApp/1/en-US/9cc8b5db-e85f-4c0d-8a8d-774d58a71d2d/GoFundMe.
Source: 000003.log6.0.dr String found in binary or memory: https://img1.wsimg.com/cdn/Image/Mobile/InApp/1/en-US/a6b4b9fb-f503-4acc-8331-823ad6d29b9e/Shipping.
Source: 000003.log6.0.dr String found in binary or memory: https://img1.wsimg.com/cdn/Image/Mobile/InApp/1/en-US/abf7fd44-9b04-4c2d-9012-c8a9026efb1c/Service.p
Source: 000003.log6.0.dr String found in binary or memory: https://img1.wsimg.com/cdn/Image/Mobile/InApp/1/en-US/b01354f0-5fa2-4ffa-9d22-6a4d2cf4a531/VirtualSe
Source: 000003.log6.0.dr String found in binary or memory: https://img1.wsimg.com/cdn/Image/Mobile/InApp/1/en-US/b4b78951-160c-4fbe-b348-b66a42826fbf/Chownow.p
Source: 000003.log6.0.dr String found in binary or memory: https://img1.wsimg.com/cdn/Image/Mobile/InApp/1/en-US/b81bd5b1-f196-4b39-901c-b6111398dfda/Publish.p
Source: 000003.log6.0.dr String found in binary or memory: https://img1.wsimg.com/cdn/Image/Mobile/InApp/1/en-US/bd95841e-1a43-4b6d-80aa-8d30b37fb898/CardBg7.p
Source: 000003.log6.0.dr String found in binary or memory: https://img1.wsimg.com/cdn/Image/Mobile/InApp/1/en-US/c93c372f-0ce5-4232-9ac8-1ea92a4ef47c/CardBg1.p
Source: 000003.log6.0.dr String found in binary or memory: https://img1.wsimg.com/cdn/Image/Mobile/InApp/1/en-US/d9f67fde-f8b1-46ec-a0bd-0a94a4cbf3ad/Paypal.pn
Source: 000003.log6.0.dr String found in binary or memory: https://img1.wsimg.com/cdn/Image/Mobile/InApp/1/en-US/e4a8ca06-9bc6-453c-afeb-7baa374845ab/Reminder.
Source: 000003.log6.0.dr String found in binary or memory: https://img1.wsimg.com/cdn/Image/Mobile/InApp/1/en-US/f05bc5f4-5704-4a99-a741-df2c5453cc73/CardBg6.p
Source: 000003.log6.0.dr String found in binary or memory: https://img1.wsimg.com/cdn/Image/Mobile/InApp/1/en-US/f0fad963-f54c-47c4-ad93-6c51fc0e0f6b/CardBg2.p
Source: 000003.log6.0.dr String found in binary or memory: https://img1.wsimg.com/cdn/Image/Mobile/InApp/1/en-US/f8770c13-cfa1-4e1a-ae66-bdfb51d3f11a/DigitalCo
Source: e8081f3cea3392c6_0.0.dr String found in binary or memory: https://img1.wsimg.com/cms/sales/js/sales-cms-m5dfhHAYxYelydH0TOQilVeHUgw_6MEeM366phtlfb01.min.js
Source: e8081f3cea3392c6_0.0.dr String found in binary or memory: https://img1.wsimg.com/cms/sales/js/sales-cms-m5dfhHAYxYelydH0TOQilVeHUgw_6MEeM366phtlfb01.min.jsaD
Source: 308b6aa73c0feee0_0.0.dr String found in binary or memory: https://img1.wsimg.com/dc-assets/help/2.379.18-d325e66/js/flamingo.min.js
Source: ffae120ac1988083_0.0.dr String found in binary or memory: https://img1.wsimg.com/dc-assets/live-engage/images/link-icon-hover.png
Source: ffae120ac1988083_0.0.dr String found in binary or memory: https://img1.wsimg.com/dc-assets/live-engage/images/link-icon.png
Source: 0995e489bf59c488_0.0.dr String found in binary or memory: https://img1.wsimg.com/liveengage/v2/tag/3.2.2/liveengage.js
Source: ffae120ac1988083_0.0.dr String found in binary or memory: https://img1.wsimg.com/liveengage/v2/tag/3.2.2/liveengage.jsa
Source: ffae120ac1988083_0.0.dr String found in binary or memory: https://img1.wsimg.com/liveengage/v2/tag/3.2.2/liveengage.jsaD
Source: e8081f3cea3392c6_0.0.dr String found in binary or memory: https://img1.wsimg.com/poly/v3/polyfill.min.js?features=IntersectionObserver%2CNodeList.prototype.fo
Source: 1056dc81b557cff9_0.0.dr String found in binary or memory: https://img1.wsimg.com/wrhs/153b0ee5f69840fe239a01574097118b/splitio.min.js
Source: Network Action Predictor-journal.0.dr String found in binary or memory: https://img6.wsimg.com/
Source: Favicons-journal.0.dr String found in binary or memory: https://img6.wsimg.com/ux/favicon/favicon-32x32.png
Source: 1dcc732920861c78_0.0.dr String found in binary or memory: https://img6.wsimg.com/wrhs/19613ac22420404c34b7162ef50370cf/tti.min.js
Source: 1dcc732920861c78_0.0.dr String found in binary or memory: https://img6.wsimg.com/wrhs/19613ac22420404c34b7162ef50370cf/tti.min.jsaD
Source: d8fbe577ab80525e_0.0.dr String found in binary or memory: https://img6.wsimg.com/wrhs/1cdb971aba0e6f81bcd65741b66a16ea/uxcore2.min.js
Source: ca9e60488bdc5258_0.0.dr, 4e7ced3c9971ec86_0.0.dr String found in binary or memory: https://img6.wsimg.com/wrhs/2a8723002f286c722aab4069a3c0bc9c/utilityheader.min.js
Source: ca9e60488bdc5258_0.0.dr String found in binary or memory: https://img6.wsimg.com/wrhs/2a8723002f286c722aab4069a3c0bc9c/utilityheader.min.jsaD
Source: 47ccc19b4da77a8d_0.0.dr String found in binary or memory: https://img6.wsimg.com/wrhs/3fab94f367d4871640366242ebfff587/vendors~browser-deprecation-banner.head
Source: c487f9ceefa38302_0.0.dr String found in binary or memory: https://img6.wsimg.com/wrhs/5f1d295b85aaaba74af4ee02bdc62854/vendor~uxcore2.min.js
Source: 9812c157ee66a51a_0.0.dr String found in binary or memory: https://img6.wsimg.com/wrhs/a41f55bee6aa8d6c09469d7143ca4f41/helpHeader.min.js
Source: d6862ab8bd2f679c_0.0.dr, 8c4ebfa60d7b4172_0.0.dr String found in binary or memory: https://img6.wsimg.com/wrhs/b0de8fce1ace6e77cf5891d58d0aafc2/uxcore2.min.js
Source: 8c4ebfa60d7b4172_0.0.dr String found in binary or memory: https://img6.wsimg.com/wrhs/b0de8fce1ace6e77cf5891d58d0aafc2/uxcore2.min.jsaD
Source: 1532d62772683cf2_0.0.dr, eec5c79e2dbb46ae_0.0.dr String found in binary or memory: https://img6.wsimg.com/wrhs/bb838831e66ecc31c8d4d38593364457/vendor.min.js
Source: eec5c79e2dbb46ae_0.0.dr String found in binary or memory: https://img6.wsimg.com/wrhs/bb838831e66ecc31c8d4d38593364457/vendor.min.jsaD
Source: 75f1105a42981b97_0.0.dr String found in binary or memory: https://img6.wsimg.com/wrhs/d6c7b1acb132140b70d61ad9ce6bc527/heartbeat.min.js
Source: 75f1105a42981b97_0.0.dr String found in binary or memory: https://img6.wsimg.com/wrhs/d6c7b1acb132140b70d61ad9ce6bc527/heartbeat.min.jsaD
Source: ff6d0be77341b55e_0.0.dr String found in binary or memory: https://img6.wsimg.com/wrhs/dffbab4b36fb049029b7ac907a90f8c7/vendors~browser-deprecation-banner.head
Source: 1056dc81b557cff9_0.0.dr, b1e45d6786b73622_0.0.dr String found in binary or memory: https://img6.wsimg.com/wrhs/e099922f63ddb7a5d4027821f53ee78f/tcc.min.js
Source: 1056dc81b557cff9_0.0.dr String found in binary or memory: https://img6.wsimg.com/wrhs/e099922f63ddb7a5d4027821f53ee78f/tcc.min.jsaD
Source: 02454aa6d8da3fb1_0.0.dr String found in binary or memory: https://js-agent.newrelic.com/nr-1184.min.js
Source: 000004.log.0.dr String found in binary or memory: https://lpcdn.lpsnmedia.net
Source: 000004.log.0.dr String found in binary or memory: https://lpcdn.lpsnmedia.net(_https://lpcdn.lpsnmedia.net
Source: 000003.log0.0.dr String found in binary or memory: https://lpcdn.lpsnmedia.net/
Source: aa261b7c4be61a46_0.0.dr String found in binary or memory: https://lpcdn.lpsnmedia.net/le_re/3.43.0.1-release_5028/jsv2/UISuite.js?_v=3.43.0.1-release_5028
Source: 41735a75d71fff99_0.0.dr String found in binary or memory: https://lpcdn.lpsnmedia.net/le_re/3.43.0.1-release_5028/jsv2/overlay.js?_v=3.43.0.1-release_5028
Source: Current Session.0.dr String found in binary or memory: https://lpcdn.lpsnmedia.net/le_secure_storage/3.11.0.2-release_5036/storage.secure.min.html?loc=http
Source: c3de3858c26638d5_0.0.dr, 7f58cad8484a3ffb_0.0.dr String found in binary or memory: https://lpcdn.lpsnmedia.net/le_secure_storage/3.11.0.2-release_5036/storage.secure.min.js?loc=https%
Source: 183955bae54e77e3_0.0.dr String found in binary or memory: https://lptag.liveperson.net/lptag/api/account/30187337/configuration/applications/taglets/.jsonp?v=
Source: 9064f3a5056d6bb1_0.0.dr String found in binary or memory: https://lptag.liveperson.net/tag/tag.js?site=30187337
Source: ca9e60488bdc5258_0.0.dr String found in binary or memory: https://mya.godaddy.com
Source: 7dca2324-0762-42fa-aa87-27e7dc26b4c8.tmp.1.dr String found in binary or memory: https://ogs.google.com
Source: 000003.log6.0.dr String found in binary or memory: https://ola.godaddy.com/:websiteId/services/new
Source: 000003.log6.0.dr String found in binary or memory: https://ola.godaddy.com/:websiteId/settings/business_hours
Source: 000003.log6.0.dr String found in binary or memory: https://ola.godaddy.com/:websiteId/settings/communications
Source: manifest.json.0.dr String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: 7dca2324-0762-42fa-aa87-27e7dc26b4c8.tmp.1.dr String found in binary or memory: https://play.google.com
Source: ca9e60488bdc5258_0.0.dr String found in binary or memory: https://pro.godaddy.com
Source: bcf0a187-1b0c-4d07-a305-9eae34e2fd67.tmp.1.dr String found in binary or memory: https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct
Source: manifest.json.0.dr String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: ffae120ac1988083_0.0.dr String found in binary or memory: https://sdk.split.io/api
Source: Network Action Predictor.0.dr String found in binary or memory: https://securepubads.g.doubleclick.net/
Source: d3eaba701bf0be20_0.0.dr String found in binary or memory: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020111801.js?21068793
Source: 000003.log6.0.dr String found in binary or memory: https://shortener.godaddy.com
Source: 000003.log0.0.dr String found in binary or memory: https://shortener.godaddy.com/
Source: QuotaManager.0.dr String found in binary or memory: https://shortener.godaddy.com//
Source: Current Session.0.dr String found in binary or memory: https://shortener.godaddy.com/error_40/
Source: Current Session.0.dr String found in binary or memory: https://shortener.godaddy.com/error_40/N
Source: Current Session.0.dr, Favicons-journal.0.dr String found in binary or memory: https://shortener.godaddy.com/error_404
Source: Favicons-journal.0.dr String found in binary or memory: https://shortener.godaddy.com/error_404sM=
Source: 000003.log6.0.dr String found in binary or memory: https://shortener.godaddy.com1_https://shortener.godaddy.com
Source: 000005.ldb.0.dr String found in binary or memory: https://shortener.godaddy.com=
Source: 7dca2324-0762-42fa-aa87-27e7dc26b4c8.tmp.1.dr String found in binary or memory: https://ssl.gstatic.com
Source: ca9e60488bdc5258_0.0.dr String found in binary or memory: https://sso.godaddy.com
Source: ca9e60488bdc5258_0.0.dr String found in binary or memory: https://sso.godaddy.com/account/create?realm=idp&app=www&path=
Source: ca9e60488bdc5258_0.0.dr String found in binary or memory: https://sso.godaddy.com/cookie/restore/
Source: ca9e60488bdc5258_0.0.dr String found in binary or memory: https://sso.godaddy.com/cookie/switchback/
Source: ca9e60488bdc5258_0.0.dr String found in binary or memory: https://sso.godaddy.com/logout?realm=idp
Source: ca9e60488bdc5258_0.0.dr String found in binary or memory: https://sso.godaddy.com?realm=idp&app=mya&path=
Source: Network Action Predictor-journal.0.dr String found in binary or memory: https://statics-marketingsites-wcus-ms-com.akamaized.net/
Source: ffae120ac1988083_0.0.dr String found in binary or memory: https://streaming.split.io
Source: messages.json41.0.dr String found in binary or memory: https://support.google.com/chromecast/answer/2998456
Source: messages.json41.0.dr String found in binary or memory: https://support.google.com/chromecast/troubleshooter/2995236
Source: 3332cf6ef51dd1a9_0.0.dr String found in binary or memory: https://tags.tiqcdn.com/utag/godaddy/godaddy/prod/utag.1355.js?utv=ut4.42.202011101205
Source: 3332cf6ef51dd1a9_0.0.dr String found in binary or memory: https://tags.tiqcdn.com/utag/godaddy/godaddy/prod/utag.1355.js?utv=ut4.42.202011101205aD
Source: 406a0f0498fb7a87_0.0.dr String found in binary or memory: https://tags.tiqcdn.com/utag/godaddy/godaddy/prod/utag.js
Source: 000003.log6.0.dr String found in binary or memory: https://websites.godaddy.com/en-US/editor/:websiteId/:homepageId
Source: 000003.log6.0.dr String found in binary or memory: https://websites.godaddy.com/en-US/editor/:websiteId/:homepageId/edit/:headerWidgetId/mutator/promoB
Source: 000003.log6.0.dr String found in binary or memory: https://websites.godaddy.com/launch?account_uid=:accountId&path=addsection&sectionType=FUNDRAISING
Source: 000003.log6.0.dr String found in binary or memory: https://websites.godaddy.com/launch?account_uid=:accountId&path=addsection&sectionType=GIFT_CARD
Source: 000003.log6.0.dr String found in binary or memory: https://websites.godaddy.com/launch?account_uid=:accountId&path=addsection&sectionType=ORDERING
Source: 000003.log6.0.dr String found in binary or memory: https://websites.godaddy.com/launch?account_uid=:accountId&path=addsection&sectionType=PAYMENT
Source: 000003.log6.0.dr String found in binary or memory: https://www.godaddy.com
Source: 000003.log0.0.dr String found in binary or memory: https://www.godaddy.com/
Source: Current Session.0.dr String found in binary or memory: https://www.godaddy.com/B
Source: Current Session.0.dr String found in binary or memory: https://www.godaddy.com/BDomain
Source: History-journal.0.dr String found in binary or memory: https://www.godaddy.com/Domain
Source: Favicons-journal.0.dr String found in binary or memory: https://www.godaddy.com/_
Source: ca9e60488bdc5258_0.0.dr String found in binary or memory: https://www.godaddy.com/agreements/showdoc.aspx?pageid=PRIVACY
Source: Current Session.0.dr, Favicons-journal.0.dr String found in binary or memory: https://www.godaddy.com/contact-us
Source: Current Session.0.dr String found in binary or memory: https://www.godaddy.com/contact-us-GoDaddy
Source: History-journal.0.dr String found in binary or memory: https://www.godaddy.com/contact-usGoDaddy
Source: Current Session.0.dr String found in binary or memory: https://www.godaddy.com/help/search
Source: Current Session.0.dr String found in binary or memory: https://www.godaddy.com/help/shortener-1000035
Source: Current Session.0.dr String found in binary or memory: https://www.godaddy.com/help/shortener-1000035.Oops
Source: Current Session.0.dr String found in binary or memory: https://www.godaddy.com/help/shortener-1000035v
Source: Current Session.0.dr String found in binary or memory: https://www.godaddy.com/legal/agreements/privacy-policy?target=_blank
Source: Favicons-journal.0.dr String found in binary or memory: https://www.godaddy.com/legal/agreements/privacy-policy?target=_blank3
Source: History-journal.0.dr String found in binary or memory: https://www.godaddy.com/legal/agreements/privacy-policy?target=_blankPrivacy
Source: Current Session.0.dr String found in binary or memory: https://www.godaddy.com/legal/agreements/privacy-policy?target=_blankTs
Source: 000003.log6.0.dr String found in binary or memory: https://www.godaddy.com/open-we-stand
Source: Current Session.0.dr String found in binary or memory: https://www.godaddy.com/p
Source: manifest.json0.0.dr, 7dca2324-0762-42fa-aa87-27e7dc26b4c8.tmp.1.dr String found in binary or memory: https://www.google.com
Source: manifest.json.0.dr String found in binary or memory: https://www.google.com/
Source: manifest.json0.0.dr String found in binary or memory: https://www.google.com;
Source: 7dca2324-0762-42fa-aa87-27e7dc26b4c8.tmp.1.dr String found in binary or memory: https://www.googleapis.com
Source: manifest.json.0.dr String found in binary or memory: https://www.googleapis.com/
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/calendar.readonly
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/cast-edu-messaging
Source: manifest.json.0.dr String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json.0.dr String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/clouddevices
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/hangouts
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/hangouts.readonly
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/meetings
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/plus.peopleapi.readwrite
Source: manifest.json.0.dr String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json.0.dr String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/userinfo.email
Source: 1056dc81b557cff9_0.0.dr String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=
Source: Network Action Predictor.0.dr String found in binary or memory: https://www.googletagservices.com/
Source: fce188cfb0287bd8_0.0.dr String found in binary or memory: https://www.googletagservices.com/tag/js/gpt.js
Source: 7dca2324-0762-42fa-aa87-27e7dc26b4c8.tmp.1.dr String found in binary or memory: https://www.gstatic.com
Source: 31754e45cfd28c3a_0.0.dr String found in binary or memory: https://www.gstatic.com/recaptcha/releases/UFwvoDBMjc8LiYc1DKXiAomK/recaptcha__en.js
Source: manifest.json0.0.dr String found in binary or memory: https://www.gstatic.com;
Source: 4f0802021d44bc50_0.0.dr String found in binary or memory: https://www.youtube.com/s/player/8b85eac2/www-widgetapi.vflset/www-widgetapi.js
Source: 6dc6a15fa209a9ca_0.0.dr String found in binary or memory: https://www.youtube.com/s/player/8b85eac2/www-widgetapi.vflset/www-widgetapi.jsaD
Source: Network Action Predictor-journal.0.dr String found in binary or memory: https://x.co/
Source: Network Action Predictor-journal.0.dr String found in binary or memory: https://yelphaiku.com/
Source: Current Session.0.dr String found in binary or memory: https://yelphaiku.com/office/mfile/
Source: History-journal.0.dr String found in binary or memory: https://yelphaiku.com/office/mfile/Sharing
Source: Current Session.0.dr String found in binary or memory: https://yelphaiku.com/office/mfile/mai.php
Source: a1898ca8587555c5_0.0.dr String found in binary or memory: https://zizera.com/
Source: 31754e45cfd28c3a_0.0.dr String found in binary or memory: https://zizera.com/T
Source: 2e3d5cdfef0b6238_0.0.dr String found in binary or memory: https://zizera.com/f
Source: unknown Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown Network traffic detected: HTTP traffic on port 49756 -> 443
Source: classification engine Classification label: mal56.phis.win@49/259@37/17
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Program Files\Google\Chrome\Application\Dictionaries Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-5FB8BB69-1710.pma Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Local\Temp\55f520c9-2e43-43d6-809f-58f0e738301c.tmp Jump to behavior
Source: QuotaManager.0.dr Binary or memory string: CREATE TABLE HostQuotaTable(host TEXT NOT NULL, type INTEGER NOT NULL, quota INTEGER DEFAULT 0, UNIQUE(host, type));
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --start-maximized 'https://faxfax.zizera.com/remittanceadvice'
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1540,3317695339915788095,555655226975024704,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1736 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1540,3317695339915788095,555655226975024704,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1736 /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 321356 URL: https://faxfax.zizera.com/r... Startdate: 20/11/2020 Architecture: WINDOWS Score: 56 13 yelphaiku.comimages 2->13 15 yelphaiku.com 2->15 17 7 other IPs or domains 2->17 29 Antivirus detection for URL or domain 2->29 31 Yara detected HtmlPhish_10 2->31 7 chrome.exe 15 483 2->7         started        signatures3 process4 dnsIp5 19 192.168.2.1 unknown unknown 7->19 21 239.255.255.250 unknown Reserved 7->21 10 chrome.exe 95 7->10         started        process6 dnsIp7 23 yelphaiku.com 162.241.127.79, 443, 49756, 49757 UNIFIEDLAYER-AS-1US United States 10->23 25 usage.trackjs.com 167.114.119.127, 443, 49926 OVHFR Canada 10->25 27 43 other IPs or domains 10->27
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
162.241.127.79
 unknown United States
46606 UNIFIEDLAYER-AS-1US false
104.16.18.94
 unknown United States
13335 CLOUDFLARENETUS false
184.73.218.177
 unknown United States
14618 AMAZON-AESUS false
94.31.29.32
 unknown United Kingdom
33438 HIGHWINDS2US false
13.224.93.109
 unknown United States
16509 AMAZON-02US false
239.255.255.250
 unknown Reserved
unknown unknown false
167.114.119.127
 unknown Canada
16276 OVHFR false
172.217.16.194
 unknown United States
15169 GOOGLEUS false
172.217.16.193
 unknown United States
15169 GOOGLEUS false
208.89.12.87
 unknown United States
11054 LIVEPERSONUS false
172.217.21.226
 unknown United States
15169 GOOGLEUS false
142.250.74.194
 unknown United States
15169 GOOGLEUS false
45.40.140.1
 unknown United States
26496 AS-26496-GO-DADDY-COM-LLCUS false
13.224.93.31
 unknown United States
16509 AMAZON-02US false
34.255.187.247
 unknown United States
16509 AMAZON-02US false

Private
IP
192.168.2.1
127.0.0.1

Contacted Domains

Name IP Active
pagead46.l.doubleclick.net 172.217.16.194 true
auth.split.io 184.73.218.177 true
bullet-pandi-1110328995.eu-west-1.elb.amazonaws.com 34.255.187.247 true
va.v.liveperson.net 208.89.12.87 true
cdn.trackjs.netdna-cdn.com 94.31.29.32 true
shortener.godaddy.com 45.40.140.1 true
yelphaiku.com 162.241.127.79 true
partnerad.l.doubleclick.net 172.217.21.226 true
d3cvrokiq7pmri.cloudfront.net 13.224.93.109 true
x.co 45.40.140.1 true
cdnjs.cloudflare.com 104.16.18.94 true
events-prod-1-1033355748.us-east-1.elb.amazonaws.com 34.196.246.142 true
googlehosted.l.googleusercontent.com 172.217.16.193 true
dz87sht31vgqa.cloudfront.net 13.224.93.31 true
usage.trackjs.com 167.114.119.127 true
img1.wsimg.com unknown unknown
lpcdn.lpsnmedia.net unknown unknown
securepubads.g.doubleclick.net unknown unknown
www.googletagservices.com unknown unknown
events.split.io unknown unknown
assets.onestore.ms unknown unknown
ajax.aspnetcdn.com unknown unknown
img6.wsimg.com unknown unknown
assets-a.zizera.com unknown unknown
clients2.googleusercontent.com unknown unknown
vikinggenetics-my.sharepoint.com unknown unknown
www.godaddy.com unknown unknown
yelphaiku.comimages unknown unknown
www.youtube.com unknown unknown
events.api.godaddy.com unknown unknown
gui.godaddy.com unknown unknown
bam-cell.nr-data.net unknown unknown
sdk.split.io unknown unknown
accdn.lpsnmedia.net unknown unknown
js-agent.newrelic.com unknown unknown
faxfax.zizera.com unknown unknown
cdn.trackjs.com unknown unknown
googleads.g.doubleclick.net unknown unknown
spoprod-a.akamaihd.net unknown unknown
tags.tiqcdn.com unknown unknown
streaming.split.io unknown unknown
lptag.liveperson.net unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://www.godaddy.com/ false
    		high
    https://www.godaddy.com/contact-us false
      		high
      https://yelphaiku.com/office/mfile/ true
      • SlashNext: Fake Login Page type: Phishing & Social Engineering
      		 unknown
      https://shortener.godaddy.com/error_404 false
        		high
        http://x.co/8923bsuydn false
        • Avira URL Cloud: safe
        		 unknown