Joe Sandbox Cloud Basic Analysis Report

Loading ...

Play interactive tourEdit tour

Windows Analysis Report https://docs.google.com/document/d/1hHFEB09XYOGm1F87Todc5etNXb38nGMo/edit?usp=sharing_eip_m&rtpof=true&sd=true&invite=CKvaqcMD&ts=6178419e

Overview

General Information

Sample URL:https://docs.google.com/document/d/1hHFEB09XYOGm1F87Todc5etNXb38nGMo/edit?usp=sharing_eip_m&rtpof=true&sd=true&invite=CKvaqcMD&ts=6178419e
Analysis ID:509788
Infos:

Most interesting Screenshot:

Detection

HTMLPhisher
Score:68
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Phishing site detected (based on favicon image match)
Yara detected HtmlPhish10
Antivirus detection for URL or domain
Phishing site detected (based on logo template match)
No HTML title found
HTML body contains low number of good links
Invalid T&C link found
Suspicious form URL found

Classification

Process Tree

  • System is w10x64
  • chrome.exe (PID: 6564 cmdline: 'C:\Program Files\Google\Chrome\Application\chrome.exe' --start-maximized --enable-automation 'https://docs.google.com/document/d/1hHFEB09XYOGm1F87Todc5etNXb38nGMo/edit?usp=sharing_eip_m&rtpof=true&sd=true&invite=CKvaqcMD&ts=6178419e' MD5: C139654B5C1438A95B321BB01AD63EF6)
    • chrome.exe (PID: 6752 cmdline: 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1560,8177781781073637063,12308943224005517833,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1912 /prefetch:8 MD5: C139654B5C1438A95B321BB01AD63EF6)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

barindex
Antivirus detection for URL or domainShow sources
Source: https://marketingandsoftwaretools.com/wp-content/plugins/autoptimize/ANGEL/MicrosoftAccount.htmlSlashNext: Label: Fake Login Page type: Phishing & Social Engineering

Phishing:

barindex
Phishing site detected (based on favicon image match)Show sources
Source: https://marketingandsoftwaretools.com/wp-content/plugins/autoptimize/ANGEL/MicrosoftAccount.htmlMatcher: Template: microsoft matched with high similarity
Yara detected HtmlPhish10Show sources
Source: Yara matchFile source: 36599.2.pages.csv, type: HTML
Phishing site detected (based on logo template match)Show sources
Source: https://marketingandsoftwaretools.com/wp-content/plugins/autoptimize/ANGEL/MicrosoftAccount.htmlMatcher: Template: office matched
Source: https://marketingandsoftwaretools.com/wp-content/plugins/autoptimize/ANGEL/MicrosoftAccount.htmlHTTP Parser: HTML title missing
Source: https://marketingandsoftwaretools.com/wp-content/plugins/autoptimize/ANGEL/MicrosoftAccount.htmlHTTP Parser: HTML title missing
Source: https://marketingandsoftwaretools.com/wp-content/plugins/autoptimize/ANGEL/MicrosoftAccount.htmlHTTP Parser: Number of links: 0
Source: https://marketingandsoftwaretools.com/wp-content/plugins/autoptimize/ANGEL/MicrosoftAccount.htmlHTTP Parser: Number of links: 0
Source: https://marketingandsoftwaretools.com/wp-content/plugins/autoptimize/ANGEL/MicrosoftAccount.htmlHTTP Parser: Invalid link: Help
Source: https://marketingandsoftwaretools.com/wp-content/plugins/autoptimize/ANGEL/MicrosoftAccount.htmlHTTP Parser: Invalid link: Terms of use
Source: https://marketingandsoftwaretools.com/wp-content/plugins/autoptimize/ANGEL/MicrosoftAccount.htmlHTTP Parser: Invalid link: Privacy & Cookies
Source: https://marketingandsoftwaretools.com/wp-content/plugins/autoptimize/ANGEL/MicrosoftAccount.htmlHTTP Parser: Invalid link: Help
Source: https://marketingandsoftwaretools.com/wp-content/plugins/autoptimize/ANGEL/MicrosoftAccount.htmlHTTP Parser: Invalid link: Terms of use
Source: https://marketingandsoftwaretools.com/wp-content/plugins/autoptimize/ANGEL/MicrosoftAccount.htmlHTTP Parser: Invalid link: Privacy & Cookies
Source: https://marketingandsoftwaretools.com/wp-content/plugins/autoptimize/ANGEL/MicrosoftAccount.htmlHTTP Parser: Form action: 365.php
Source: https://marketingandsoftwaretools.com/wp-content/plugins/autoptimize/ANGEL/MicrosoftAccount.htmlHTTP Parser: Form action: next.php
Source: https://marketingandsoftwaretools.com/wp-content/plugins/autoptimize/ANGEL/MicrosoftAccount.htmlHTTP Parser: Form action: 365.php
Source: https://marketingandsoftwaretools.com/wp-content/plugins/autoptimize/ANGEL/MicrosoftAccount.htmlHTTP Parser: Form action: next.php
Source: https://marketingandsoftwaretools.com/wp-content/plugins/autoptimize/ANGEL/MicrosoftAccount.htmlHTTP Parser: No <meta name="author".. found
Source: https://marketingandsoftwaretools.com/wp-content/plugins/autoptimize/ANGEL/MicrosoftAccount.htmlHTTP Parser: No <meta name="author".. found
Source: https://marketingandsoftwaretools.com/wp-content/plugins/autoptimize/ANGEL/MicrosoftAccount.htmlHTTP Parser: No <meta name="copyright".. found
Source: https://marketingandsoftwaretools.com/wp-content/plugins/autoptimize/ANGEL/MicrosoftAccount.htmlHTTP Parser: No <meta name="copyright".. found
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Local\Temp\6564_244370255\LICENSE.txtJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\Google\Chrome\Application\DictionariesJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdicJump to behavior
Source: unknownHTTPS traffic detected: 142.250.203.97:443 -> 192.168.2.3:49778 version: TLS 1.2
Source: unknownHTTPS traffic detected: 142.250.203.97:443 -> 192.168.2.3:49779 version: TLS 1.2
Source: unknownHTTPS traffic detected: 142.250.203.97:443 -> 192.168.2.3:49806 version: TLS 1.2
Source: unknownNetwork traffic detected: HTTP traffic on port 49779 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49770 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49793 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49751 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49759
Source: unknownNetwork traffic detected: HTTP traffic on port 49778 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49791 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49759 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49757
Source: unknownNetwork traffic detected: HTTP traffic on port 49774 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49779
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49756
Source: unknownNetwork traffic detected: HTTP traffic on port 49755 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49778
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49755
Source: unknownNetwork traffic detected: HTTP traffic on port 49757 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49754
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49798
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49774
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49751
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49750
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49794
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49793
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49770
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49791
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49790
Source: unknownNetwork traffic detected: HTTP traffic on port 49767 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49749 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49747 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49794 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49806 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49806
Source: unknownNetwork traffic detected: HTTP traffic on port 49750 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49798 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49749
Source: unknownNetwork traffic detected: HTTP traffic on port 49754 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49747
Source: unknownNetwork traffic detected: HTTP traffic on port 49790 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49756 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49767
Source: Ruleset Data.1.drString found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: Filtering Rules.1.drString found in binary or memory: www.facebook.com/ajax/ads/ equals www.facebook.com (Facebook)
Source: Filtering Rules.1.drString found in binary or memory: www.facebook.com0 equals www.facebook.com (Facebook)
Source: angular.js.1.drString found in binary or memory: http://angularjs.org
Source: data_3.2.drString found in binary or memory: http://crl.pki.goog/gsr1/gsr1.crl0;
Source: data_3.2.drString found in binary or memory: http://crl.pki.goog/gtsr1/gtsr1.crl0W
Source: data_3.2.drString found in binary or memory: http://crls.pki.goog/gts1c3/QOvJ0N1sT2A.crl0
Source: data_3.2.drString found in binary or memory: http://crls.pki.goog/gts1c3/QqFxbi9M48c.crl0
Source: data_3.2.drString found in binary or memory: http://crls.pki.goog/gts1c3/fVJxbV-Ktmk.crl0
Source: data_3.2.drString found in binary or memory: http://crls.pki.goog/gts1c3/zdATt0Ex_Fk.crl0
Source: angular.js.1.drString found in binary or memory: http://errors.angularjs.org/1.6.4-local
Source: pnacl_public_x86_64_pnacl_sz_nexe.1.drString found in binary or memory: http://llvm.org/):
Source: data_3.2.drString found in binary or memory: http://ocsp.pki.goog/gsr10)
Source: data_3.2.drString found in binary or memory: http://ocsp.pki.goog/gts1c301
Source: data_3.2.drString found in binary or memory: http://ocsp.pki.goog/gtsr100
Source: data_3.2.drString found in binary or memory: http://pki.goog/gsr1/gsr1.crt02
Source: data_3.2.drString found in binary or memory: http://pki.goog/repo/certs/gts1c3.der0
Source: data_3.2.drString found in binary or memory: http://pki.goog/repo/certs/gts1c3.der0M
Source: data_3.2.drString found in binary or memory: http://pki.goog/repo/certs/gtsr1.der04
Source: mirroring_hangouts.js.1.drString found in binary or memory: http://tools.ietf.org/html/rfc1950
Source: mirroring_hangouts.js.1.drString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: mirroring_hangouts.js.1.drString found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions
Source: mirroring_hangouts.js.1.drString found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01
Source: 2b5d6b28-abc9-4340-9ff7-41e8f309b77f.tmp.2.dr, 2707e0e2-4311-4956-91b9-88ef1478870e.tmp.2.drString found in binary or memory: https://0.docs.google.com
Source: manifest.json.1.dr, 2c6a0c24-8c93-4014-9329-732aa4582676.tmp.2.dr, 2b5d6b28-abc9-4340-9ff7-41e8f309b77f.tmp.2.dr, 2707e0e2-4311-4956-91b9-88ef1478870e.tmp.2.drString found in binary or memory: https://accounts.google.com
Source: craw_window.js.1.drString found in binary or memory: https://accounts.google.com/MergeSession
Source: manifest.json.1.dr, 2c6a0c24-8c93-4014-9329-732aa4582676.tmp.2.dr, 2b5d6b28-abc9-4340-9ff7-41e8f309b77f.tmp.2.dr, 2707e0e2-4311-4956-91b9-88ef1478870e.tmp.2.drString found in binary or memory: https://apis.google.com
Source: data_1.2.drString found in binary or memory: https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.wk7zEZseXNs.O/m=card/exm=config/rt=j/
Source: data_1.2.drString found in binary or memory: https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.wk7zEZseXNs.O/m=config/rt=j/sv=1/d=1/
Source: data_1.2.drString found in binary or memory: https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.wk7zEZseXNs.O/m=gapi_iframes/rt=j/sv=
Source: data_1.2.drString found in binary or memory: https://apis.google.com/js/api.js
Source: data_1.2.drString found in binary or memory: https://apis.google.com/js/api.jsCgkKBw2RYZVOGgA=j
Source: mirroring_common.js.1.drString found in binary or memory: https://apis.google.com/js/client.js
Source: data_1.2.drString found in binary or memory: https://bit.ly/3me0XGn
Source: History.1.drString found in binary or memory: https://bit.ly/3me0XGnSign
Source: mirroring_common.js.1.drString found in binary or memory: https://castedumessaging-pa.googleapis.com/v1
Source: pnacl_public_x86_64_libcrt_platform_a.1.drString found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-clang.git
Source: pnacl_public_x86_64_libcrt_platform_a.1.drString found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-llvm.git
Source: 2c6a0c24-8c93-4014-9329-732aa4582676.tmp.2.dr, 2b5d6b28-abc9-4340-9ff7-41e8f309b77f.tmp.2.dr, 2707e0e2-4311-4956-91b9-88ef1478870e.tmp.2.drString found in binary or memory: https://clients2.google.com
Source: mirroring_hangouts.js.1.drString found in binary or memory: https://clients2.google.com/cr/report
Source: manifest.json0.1.dr, manifest.json.1.drString found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 2c6a0c24-8c93-4014-9329-732aa4582676.tmp.2.dr, 2b5d6b28-abc9-4340-9ff7-41e8f309b77f.tmp.2.dr, 2707e0e2-4311-4956-91b9-88ef1478870e.tmp.2.drString found in binary or memory: https://clients2.googleusercontent.com
Source: mirroring_hangouts.js.1.drString found in binary or memory: https://clients6.google.com
Source: pnacl_public_x86_64_ld_nexe.1.drString found in binary or memory: https://code.google.com/p/nativeclient/issues/entry
Source: pnacl_public_x86_64_ld_nexe.1.drString found in binary or memory: https://code.google.com/p/nativeclient/issues/entry%s:
Source: Current Session.1.dr, 2b5d6b28-abc9-4340-9ff7-41e8f309b77f.tmp.2.dr, 2707e0e2-4311-4956-91b9-88ef1478870e.tmp.2.drString found in binary or memory: https://contacts.google.com
Source: data_1.2.drString found in binary or memory: https://contacts.google.com/_/scs/social-static/_/js/k=boq.SocialPeopleHovercardUi.en_US.tOwJwNEluXc
Source: Current Session.1.drString found in binary or memory: https://contacts.google.com/widget/hovercard/v/2?authuser&origin=https%3A%2F%2Fdocs.google.com&usega
Source: 2b5d6b28-abc9-4340-9ff7-41e8f309b77f.tmp.2.dr, 2707e0e2-4311-4956-91b9-88ef1478870e.tmp.2.drString found in binary or memory: https://content-autofill.googleapis.com
Source: data_1.2.drString found in binary or memory: https://content-autofill.googleapis.com/v1/pages/Chc2LjEuMTcxNS4xNDQyL2VuIChHR0xMKRIUCWOw5nM0Lic7Egk
Source: data_1.2.drString found in binary or memory: https://content-autofill.googleapis.com/v1/pages/Chc2LjEuMTcxNS4xNDQyL2VuIChHR0xMKRIfCWpMGCmxf_rYEgk
Source: manifest.json.1.drString found in binary or memory: https://content.googleapis.com
Source: common.js.1.dr, mirroring_cast_streaming.js.1.drString found in binary or memory: https://crash.corp.google.com/samples?reportid=&q=
Source: LICENSE.txt.1.drString found in binary or memory: https://creativecommons.org/.
Source: LICENSE.txt.1.drString found in binary or memory: https://creativecommons.org/compatiblelicenses
Source: mirroring_hangouts.js.1.drString found in binary or memory: https://creativecommons.org/publicdomain/zero/1.0/.
Source: data_3.2.dr, data_2.2.drString found in binary or memory: https://csp.withgoogle.com/csp/apps-themes
Source: data_2.2.drString found in binary or memory: https://csp.withgoogle.com/csp/apps-themesCross-Origin-Resource-Policy:
Source: data_3.2.drString found in binary or memory: https://csp.withgoogle.com/csp/apps-themescross-origin-resource-policy:cross-origincross-origin-open
Source: data_3.2.dr, data_2.2.drString found in binary or memory: https://csp.withgoogle.com/csp/docs
Source: data_2.2.drString found in binary or memory: https://csp.withgoogle.com/csp/docsCross-Origin-Resource-Policy:
Source: data_3.2.drString found in binary or memory: https://csp.withgoogle.com/csp/docscross-origin-resource-policy:cross-origincross-origin-opener-poli
Source: data_2.2.drString found in binary or memory: https://csp.withgoogle.com/csp/product-feedback-gathering
Source: data_2.2.drString found in binary or memory: https://csp.withgoogle.com/csp/product-feedback-gatheringCross-Origin-Resource-Policy:
Source: Reporting and NEL.2.drString found in binary or memory: https://csp.withgoogle.com/csp/report-to/IdentityListAccountsHttp/external
Source: data_2.2.drString found in binary or memory: https://csp.withgoogle.com/csp/report-to/apps-themes
Source: Reporting and NEL.2.drString found in binary or memory: https://csp.withgoogle.com/csp/report-to/apps-themesO
Source: data_2.2.drString found in binary or memory: https://csp.withgoogle.com/csp/report-to/docs
Source: Reporting and NEL.2.drString found in binary or memory: https://csp.withgoogle.com/csp/report-to/docs_
Source: data_3.2.drString found in binary or memory: https://csp.withgoogle.com/csp/report-to/encsid_AZM8iraUaxGffpGvzdngqc4Fvn5RSrjjchThcp06-oHT7wAy4gvP
Source: data_3.2.drString found in binary or memory: https://csp.withgoogle.com/csp/report-to/encsid_AZM8iraZH88pL4jQdjcWpuaSZEaZk6SzMEy_nItKJ7e9QFtt
Source: data_2.2.drString found in binary or memory: https://csp.withgoogle.com/csp/report-to/product-feedback-gathering
Source: Reporting and NEL.2.drString found in binary or memory: https://csp.withgoogle.com/csp/report-to/product-feedback-gatheringO
Source: Reporting and NEL.2.drString found in binary or memory: https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access
Source: data_3.2.drString found in binary or memory: https://csp.withgoogle.com/csp/social-frontend-mpm-access
Source: data_3.2.drString found in binary or memory: https://csp.withgoogle.com/csp/social-frontend-mpm-accesscross-origin-resource-policy:cross-origincr
Source: 2c6a0c24-8c93-4014-9329-732aa4582676.tmp.2.dr, 2b5d6b28-abc9-4340-9ff7-41e8f309b77f.tmp.2.dr, 2e3c3ba8-5ab9-48ca-a3ea-849bb783bcfa.tmp.2.dr, 2707e0e2-4311-4956-91b9-88ef1478870e.tmp.2.dr, 1a9e076c-5189-4c0f-ad8f-53604d4503d9.tmp.2.drString found in binary or memory: https://dns.google
Source: 000003.log.1.drString found in binary or memory: https://docs.google.com
Source: QuotaManager.1.drString found in binary or memory: https://docs.google.com/
Source: Favicons.1.dr, History.1.dr, Current Session.1.drString found in binary or memory: https://docs.google.com/document/d/1hHFEB09XYOGm1F87Todc5etNXb38nGMo/edit?invite=CKvaqcMD
Source: Current Session.1.drString found in binary or memory: https://docs.google.com/document/d/1hHFEB09XYOGm1F87Todc5etNXb38nGMo/edit?invite=CKvaqcMD)Adjunct
Source: History Provider Cache.1.drString found in binary or memory: https://docs.google.com/document/d/1hHFEB09XYOGm1F87Todc5etNXb38nGMo/edit?invite=CKvaqcMD2)Adjunct
Source: History.1.drString found in binary or memory: https://docs.google.com/document/d/1hHFEB09XYOGm1F87Todc5etNXb38nGMo/edit?invite=CKvaqcMDAdjunct
Source: History.1.dr, History Provider Cache.1.drString found in binary or memory: https://docs.google.com/document/d/1hHFEB09XYOGm1F87Todc5etNXb38nGMo/edit?rtpof=true&sd=true&invite=
Source: History.1.dr, History Provider Cache.1.drString found in binary or memory: https://docs.google.com/document/d/1hHFEB09XYOGm1F87Todc5etNXb38nGMo/edit?usp=sharing_eip_m&rtpof=tr
Source: data_1.2.drString found in binary or memory: https://docs.google.com/static/document/client/css/390957633-KixCss_ltr.css
Source: data_1.2.drString found in binary or memory: https://docs.google.com/static/document/client/css/390957633-KixCss_ltr.csse
Source: data_1.2.drString found in binary or memory: https://docs.google.com/static/document/client/js/1222260494-client_js_prod_kix_tertiary__en_gb.js
Source: data_1.2.drString found in binary or memory: https://docs.google.com/static/document/client/js/1693417843-client_js_prod_datetimeresources__en_gb
Source: data_1.2.drString found in binary or memory: https://docs.google.com/static/document/client/js/1807487000-client_js_prod_peoplehovercard__en_gb.j
Source: data_1.2.drString found in binary or memory: https://docs.google.com/static/document/client/js/230979601-client_js_prod_kix_app__en_gb.js
Source: data_1.2.drString found in binary or memory: https://docs.google.com/static/document/client/js/2408424249-client_js_prod_kix_explore__en_gb.js
Source: data_1.2.drString found in binary or memory: https://docs.google.com/static/document/client/js/2467020024-client_js_prod_kix_approvals__en_gb.js
Source: data_1.2.drString found in binary or memory: https://docs.google.com/static/document/client/js/2467020024-client_js_prod_kix_approvals__en_gb.jsA
Source: data_1.2.drString found in binary or memory: https://docs.google.com/static/document/client/js/3097510115-client_js_prod_meet__en_gb.js
Source: data_1.2.drString found in binary or memory: https://docs.google.com/static/document/client/js/3714220469-client_js_prod_kix_core__en_gb.js
Source: data_1.2.drString found in binary or memory: https://docs.google.com/static/document/client/js/3714220469-client_js_prod_kix_core__en_gb.jsW
Source: data_1.2.drString found in binary or memory: https://docs.google.com/static/document/client/js/436474874-client_js_prod_voice__en_gb.js
Source: data_1.2.drString found in binary or memory: https://docs.google.com/static/document/client/js/436474874-client_js_prod_voice__en_gb.jsb
Source: Current Session.1.drString found in binary or memory: https://docs.google.comh
Source: LICENSE.txt.1.drString found in binary or memory: https://easylist.to/)
Source: Network Action Predictor.1.drSt