Windows Analysis Report https://elink.io/p/9360a05

Overview

General Information

Sample URL: https://elink.io/p/9360a05
Analysis ID: 528631
Infos:

Most interesting Screenshot:

Detection

HTMLPhisher
Score: 76
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Yara detected HtmlPhish10
Antivirus detection for URL or domain
Yara detected HtmlPhish29
Phishing site detected (based on logo template match)
Invalid 'forgot password' link found
No HTML title found
HTML body contains low number of good links

Classification

AV Detection:

barindex
Antivirus / Scanner detection for submitted sample
Source: https://elink.io/p/9360a05 SlashNext: detection malicious, Label: Fake Login Page type: Phishing & Social Engineering
Antivirus detection for URL or domain
Source: https://quickest-cream-ringer.glitch.me/frk73jk.html SlashNext: Label: Fake Login Page type: Phishing & Social Engineering

Phishing:

barindex
Yara detected HtmlPhish10
Source: Yara match File source: 16391.1.pages.csv, type: HTML
Yara detected HtmlPhish29
Source: Yara match File source: 64835.0.pages.csv, type: HTML
Source: Yara match File source: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache\data_3, type: DROPPED
Phishing site detected (based on logo template match)
Source: https://quickest-cream-ringer.glitch.me/frk73jk.html Matcher: Template: microsoft matched
Invalid 'forgot password' link found
Source: https://quickest-cream-ringer.glitch.me/frk73jk.html HTTP Parser: Invalid link: Forgot password?
Source: https://quickest-cream-ringer.glitch.me/frk73jk.html HTTP Parser: Invalid link: Forgot password?
No HTML title found
Source: https://quickest-cream-ringer.glitch.me/frk73jk.html HTTP Parser: HTML title missing
Source: https://quickest-cream-ringer.glitch.me/frk73jk.html HTTP Parser: HTML title missing
HTML body contains low number of good links
Source: https://quickest-cream-ringer.glitch.me/frk73jk.html HTTP Parser: Number of links: 0
Source: https://quickest-cream-ringer.glitch.me/frk73jk.html HTTP Parser: Number of links: 0
Source: https://quickest-cream-ringer.glitch.me/frk73jk.html HTTP Parser: No <meta name="author".. found
Source: https://quickest-cream-ringer.glitch.me/frk73jk.html HTTP Parser: No <meta name="author".. found
Source: https://quickest-cream-ringer.glitch.me/frk73jk.html HTTP Parser: No <meta name="copyright".. found
Source: https://quickest-cream-ringer.glitch.me/frk73jk.html HTTP Parser: No <meta name="copyright".. found
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic Jump to behavior
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49789
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 25 Nov 2021 14:24:04 GMTContent-Length: 3672Connection: closeCache-Control: max-age=0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 25 Nov 2021 14:24:05 GMTContent-Length: 3672Connection: closeCache-Control: max-age=0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 25 Nov 2021 14:24:06 GMTContent-Length: 3672Connection: closeCache-Control: max-age=0
Source: angular.js.0.dr String found in binary or memory: http://angularjs.org
Source: angular.js.0.dr String found in binary or memory: http://errors.angularjs.org/1.6.4-local
Source: data_2.1.dr String found in binary or memory: http://glitch.com/help
Source: mirroring_hangouts.js.0.dr String found in binary or memory: http://tools.ietf.org/html/rfc1950
Source: mirroring_hangouts.js.0.dr String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: mirroring_hangouts.js.0.dr String found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions
Source: mirroring_hangouts.js.0.dr String found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01
Source: data_2.1.dr String found in binary or memory: http://www.imagemagick.org
Source: Reporting and NEL.1.dr String found in binary or memory: https://a.nel.cloudflare.com/report/v3?s=KtFKmO7547i85sbHfB7i6BMlxKvH2PNlLOo2gjQFkN6zAQJYBq2IZWaagQk
Source: Reporting and NEL.1.dr String found in binary or memory: https://a.nel.cloudflare.com/report/v3?s=aTReSkPY3ONaURXbb0PW9GkLJN%2FzaXJCVJOLomdbzj1aTMlGblRJUYZ2g
Source: 0db7bdd1-dc2d-4704-94fc-80e5558ca212.tmp.1.dr, manifest.json2.0.dr, 818576fc-551d-4e0a-9077-b0c1f4f43fbf.tmp.1.dr String found in binary or memory: https://accounts.google.com
Source: craw_window.js.0.dr String found in binary or memory: https://accounts.google.com/MergeSession
Source: 0db7bdd1-dc2d-4704-94fc-80e5558ca212.tmp.1.dr String found in binary or memory: https://ajax.googleapis.com
Source: Network Action Predictor.0.dr String found in binary or memory: https://ajax.googleapis.com/
Source: data_1.1.dr String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
Source: 0db7bdd1-dc2d-4704-94fc-80e5558ca212.tmp.1.dr, manifest.json2.0.dr, 818576fc-551d-4e0a-9077-b0c1f4f43fbf.tmp.1.dr String found in binary or memory: https://apis.google.com
Source: mirroring_common.js.0.dr String found in binary or memory: https://apis.google.com/js/client.js
Source: mirroring_common.js.0.dr String found in binary or memory: https://castedumessaging-pa.googleapis.com/v1
Source: data_2.1.dr String found in binary or memory: https://cdn.glitch.com/d7f4f279-e13b-4330-8422-00b2d9211424%2FGlitch-Error-Rainbow-Mug-hires.png?v=1
Source: data_1.1.dr String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js
Source: data_1.1.dr String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.jskf
Source: 0db7bdd1-dc2d-4704-94fc-80e5558ca212.tmp.1.dr, 818576fc-551d-4e0a-9077-b0c1f4f43fbf.tmp.1.dr String found in binary or memory: https://clients2.google.com
Source: mirroring_hangouts.js.0.dr, mirroring_cast_streaming.js.0.dr String found in binary or memory: https://clients2.google.com/cr/report
Source: manifest.json.0.dr, manifest.json2.0.dr String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 0db7bdd1-dc2d-4704-94fc-80e5558ca212.tmp.1.dr, 818576fc-551d-4e0a-9077-b0c1f4f43fbf.tmp.1.dr String found in binary or memory: https://clients2.googleusercontent.com
Source: mirroring_hangouts.js.0.dr String found in binary or memory: https://clients6.google.com
Source: data_2.1.dr String found in binary or memory: https://cloud.webtype.com/css/3a8e55c6-b1f3-4659-99eb-125ae72bd084.css
Source: Network Action Predictor.0.dr String found in binary or memory: https://code.jquery.com/
Source: data_1.1.dr String found in binary or memory: https://code.jquery.com/jquery-3.1.1.min.js
Source: data_1.1.dr String found in binary or memory: https://code.jquery.com/jquery-3.1.1.min.js&
Source: data_1.1.dr String found in binary or memory: https://code.jquery.com/jquery-3.2.1.slim.min.js
Source: 0db7bdd1-dc2d-4704-94fc-80e5558ca212.tmp.1.dr String found in binary or memory: https://content-autofill.googleapis.com
Source: data_1.1.dr String found in binary or memory: https://content-autofill.googleapis.com/v1/pages/Chc2LjEuMTcxNS4xNDQyL2VuIChHR0xMKRIfCZkEslxFRfZyEgk
Source: manifest.json2.0.dr String found in binary or memory: https://content.googleapis.com
Source: mirroring_cast_streaming.js.0.dr, common.js.0.dr String found in binary or memory: https://crash.corp.google.com/samples?reportid=&q=
Source: mirroring_hangouts.js.0.dr String found in binary or memory: https://creativecommons.org/publicdomain/zero/1.0/.
Source: data_3.1.dr String found in binary or memory: https://csp.withgoogle.com/csp/hosted-libraries-pushers
Source: data_3.1.dr String found in binary or memory: https://csp.withgoogle.com/csp/hosted-libraries-pushersCross-Origin-Resource-Policy:
Source: Reporting and NEL.1.dr String found in binary or memory: https://csp.withgoogle.com/csp/report-to/IdentityListAccountsHttp/external
Source: data_3.1.dr String found in binary or memory: https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers
Source: data_3.1.dr String found in binary or memory: https://d1l0zj21glo9rz.cloudfront.net/assets/apple-icon-180x180-1d2a0b0231aeb05bd873ae01be11e1bb4b0d
Source: data_3.1.dr String found in binary or memory: https://d1l0zj21glo9rz.cloudfront.net/assets/elink-newsletter-creator-web-page-builder-bookmarker-06
Source: data_3.1.dr String found in binary or memory: https://d1l0zj21glo9rz.cloudfront.net/assets/favicon-16x16-1e6354606bf7a915bbe94b81e75f626102c26fe33
Source: data_1.1.dr, data_3.1.dr, Favicons.0.dr String found in binary or memory: https://d1l0zj21glo9rz.cloudfront.net/assets/favicon-32x32-a644812140740e0a773efd74decbd7ddb53818dc3
Source: data_1.1.dr, data_3.1.dr String found in binary or memory: https://d1l0zj21glo9rz.cloudfront.net/assets/favicon-5ae1a659dd03596c3c7ac832da397a3446bf0877e23e10e
Source: data_3.1.dr String found in binary or memory: https://d1l0zj21glo9rz.cloudfront.net/assets/safari-pinned-tab-f3bfedb231f63bea1b40dbac2cc9122b35426
Source: data_1.1.dr, data_3.1.dr String found in binary or memory: https://d1l0zj21glo9rz.cloudfront.net/packs/css/824-8b498fe7.css
Source: data_1.1.dr, data_3.1.dr String found in binary or memory: https://d1l0zj21glo9rz.cloudfront.net/packs/css/post-b5651ef6.css
Source: data_1.1.dr, data_3.1.dr String found in binary or memory: https://d1l0zj21glo9rz.cloudfront.net/packs/js/743-53f1d3a98111ada910b5.js
Source: data_1.1.dr, data_3.1.dr String found in binary or memory: https://d1l0zj21glo9rz.cloudfront.net/packs/js/765-f3e3d2aa0a8cc8fb551a.js
Source: data_1.1.dr, data_3.1.dr String found in binary or memory: https://d1l0zj21glo9rz.cloudfront.net/packs/js/824-a887e342065a310d7542.js
Source: data_1.1.dr, data_3.1.dr String found in binary or memory: https://d1l0zj21glo9rz.cloudfront.net/packs/js/post-39db28324387f530c73f.js
Source: data_1.1.dr, data_3.1.dr String found in binary or memory: https://d1l0zj21glo9rz.cloudfront.net/packs/js/runtime-b2d3ed74518f437053d6.js
Source: data_1.1.dr String found in binary or memory: https://d1l0zj21glo9rz.cloudfront.net/packs/js/runtime-b2d3ed74518f437053d6.jsM
Source: data_3.1.dr String found in binary or memory: https://diak46rl5chc7.cloudfront.net/post_editor_images/xr22g7aetsl1rs7l/xr22g7aetsl1rs7l.png
Source: data_1.1.dr String found in binary or memory: https://diak46rl5chc7.cloudfront.net/post_editor_images/xr22g7aetsl1rs7l/xr22g7aetsl1rs7l.pngg
Source: cf85c120-7b04-4206-be50-99e26c3ed2d4.tmp.1.dr, 0db7bdd1-dc2d-4704-94fc-80e5558ca212.tmp.1.dr, 37f8dfaa-96dc-4ae9-96b5-0c3096a2340d.tmp.1.dr, 818576fc-551d-4e0a-9077-b0c1f4f43fbf.tmp.1.dr String found in binary or memory: https://dns.google
Source: mirroring_common.js.0.dr String found in binary or memory: https://docs.google.com
Source: data_3.1.dr String found in binary or memory: https://elink.io/9360a05
Source: data_3.1.dr String found in binary or memory: https://elink.io/embed/9360a05
Source: Current Session.0.dr, data_1.1.dr, data_3.1.dr, Favicons.0.dr, History.0.dr String found in binary or memory: https://elink.io/p/9360a05
Source: History.0.dr String found in binary or memory: https://elink.io/p/9360a05(1)
Source: History Provider Cache.0.dr String found in binary or memory: https://elink.io/p/9360a052
Source: manifest.json2.0.dr String found in binary or memory: https://feedback.googleusercontent.com
Source: 0db7bdd1-dc2d-4704-94fc-80e5558ca212.tmp.1.dr, 818576fc-551d-4e0a-9077-b0c1f4f43fbf.tmp.1.dr String found in binary or memory: https://fonts.googleapis.com
Source: Network Action Predictor.0.dr String found in binary or memory: https://fonts.googleapis.com/
Source: data_1.1.dr String found in binary or memory: https://fonts.googleapis.com/css?family=Archivo
Source: manifest.json2.0.dr String found in binary or memory: https://fonts.googleapis.com;
Source: data_3.1.dr, 818576fc-551d-4e0a-9077-b0c1f4f43fbf.tmp.1.dr String found in binary or memory: https://fonts.gstatic.com
Source: data_2.1.dr String found in binary or memory: https://fonts.gstatic.com/s/archivonarrow/v18/tss5ApVBdCYD5Q7hcxTE1ArZ0Zz8oY2KRmwvKhhvLFG6o3ms.woff2
Source: data_2.1.dr String found in binary or memory: https://fonts.gstatic.com/s/archivonarrow/v18/tss5ApVBdCYD5Q7hcxTE1ArZ0Zz8oY2KRmwvKhhvLFG6rHmsJCQ.wo
Source: data_2.1.dr String found in binary or memory: https://fonts.gstatic.com/s/archivonarrow/v18/tss5ApVBdCYD5Q7hcxTE1ArZ0Zz8oY2KRmwvKhhvLFG6rXmsJCQ.wo
Source: manifest.json2.0.dr String found in binary or memory: https://fonts.gstatic.com;
Source: material_css_min.css.0.dr, angular.js.0.dr String found in binary or memory: https://github.com/angular/material
Source: craw_window.js.0.dr, craw_background.js.0.dr String found in binary or memory: https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
Source: mirroring_hangouts.js.0.dr String found in binary or memory: https://github.com/madler/zlib/blob/master/zlib.h
Source: data_2.1.dr String found in binary or memory: https://glitch.com
Source: mirroring_hangouts.js.0.dr String found in binary or memory: https://hangouts.clients6.google.com
Source: manifest.json2.0.dr String found in binary or memory: https://hangouts.google.com/
Source: mirroring_hangouts.js.0.dr String found in binary or memory: https://hangouts.google.com/hangouts/_/logpref
Source: data_3.1.dr String found in binary or memory: https://ka-f.fontawesome.com
Source: Network Action Predictor.0.dr String found in binary or memory: https://ka-f.fontawesome.com/
Source: data_1.1.dr String found in binary or memory: https://ka-f.fontawesome.com/releases/v5.15.4/css/free-v4-shims.min.css?token=585b051251
Source: data_1.1.dr String found in binary or memory: https://ka-f.fontawesome.com/releases/v5.15.4/css/free.min.css?token=585b051251
Source: data_3.1.dr String found in binary or memory: https://kit.fontawesome.com
Source: Network Action Predictor.0.dr String found in binary or memory: https://kit.fontawesome.com/
Source: data_1.1.dr String found in binary or memory: https://kit.fontawesome.com/585b051251.js
Source: data_1.1.dr String found in binary or memory: https://logincdn.msauth.net/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90b
Source: Network Action Predictor.0.dr String found in binary or memory: https://maxcdn.bootstrapcdn.com/
Source: data_1.1.dr String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css
Source: data_1.1.dr String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js
Source: data_1.1.dr String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js6
Source: mirroring_common.js.0.dr String found in binary or memory: https://meet.google.com
Source: mirroring_hangouts.js.0.dr String found in binary or memory: https://meetings.clients6.google.com
Source: mirroring_common.js.0.dr String found in binary or memory: https://networktraversal.googleapis.com/v1alpha
Source: 0db7bdd1-dc2d-4704-94fc-80e5558ca212.tmp.1.dr, 818576fc-551d-4e0a-9077-b0c1f4f43fbf.tmp.1.dr String found in binary or memory: https://ogs.google.com
Source: craw_window.js.0.dr, manifest.json.0.dr String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: 0db7bdd1-dc2d-4704-94fc-80e5558ca212.tmp.1.dr, 818576fc-551d-4e0a-9077-b0c1f4f43fbf.tmp.1.dr String found in binary or memory: https://play.google.com
Source: mirroring_hangouts.js.0.dr String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: mirroring_hangouts.js.0.dr String found in binary or memory: https://preprod-hangouts-googleapis.sandbox.google.com
Source: Network Action Predictor.0.dr String found in binary or memory: https://quickest-cream-ringer.glitch.me/
Source: data_1.1.dr String found in binary or memory: https://quickest-cream-ringer.glitch.me/css/hover.css
Source: data_1.1.dr String found in binary or memory: https://quickest-cream-ringer.glitch.me/css/hover.cssy
Source: data_1.1.dr String found in binary or memory: https://quickest-cream-ringer.glitch.me/favicon.ico
Source: data_1.1.dr String found in binary or memory: https://quickest-cream-ringer.glitch.me/favicon.icoChIKBw2DqFs9GgAKBw3OQUx6GgA=D
Source: data_3.1.dr, History.0.dr String found in binary or memory: https://quickest-cream-ringer.glitch.me/frk73jk.html
Source: data_1.1.dr String found in binary or memory: https://quickest-cream-ringer.glitch.me/frk73jk.htmlM
Source: History.0.dr String found in binary or memory: https://quickest-cream-ringer.glitch.me/frk73jk.htmlOffice
Source: 0db7bdd1-dc2d-4704-94fc-80e5558ca212.tmp.1.dr String found in binary or memory: https://r2---sn-4g5e6nz7.gvt1.com
Source: data_3.1.dr String found in binary or memory: https://r2---sn-4g5e6nz7.gvt1.com/edgedl/chrome/dict/en-us-9-0.bdic?cms_redirect=yes&mh=I2&mip=84.17
Source: 0db7bdd1-dc2d-4704-94fc-80e5558ca212.tmp.1.dr String found in binary or memory: https://redirector.gvt1.com
Source: data_1.1.dr String found in binary or memory: https://redirector.gvt1.com/edgedl/chrome/dict/en-us-9-0.bdic
Source: craw_window.js.0.dr, manifest.json.0.dr String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: 0db7bdd1-dc2d-4704-94fc-80e5558ca212.tmp.1.dr, 818576fc-551d-4e0a-9077-b0c1f4f43fbf.tmp.1.dr String found in binary or memory: https://ssl.gstatic.com
Source: messages.json15.0.dr, messages.json5.0.dr, messages.json7.0.dr, messages.json29.0.dr, messages.json49.0.dr, feedback.html.0.dr, messages.json61.0.dr, messages.json69.0.dr, messages.json62.0.dr, messages.json71.0.dr, messages.json59.0.dr, messages.json46.0.dr, messages.json70.0.dr, messages.json33.0.dr, messages.json35.0.dr, messages.json0.0.dr, messages.json48.0.dr, messages.json88.0.dr, messages.json14.0.dr, messages.json87.0.dr, messages.json57.0.dr, messages.json18.0.dr, messages.json.0.dr, messages.json51.0.dr, messages.json50.0.dr, messages.json28.0.dr, messages.json10.0.dr, messages.json8.0.dr, messages.json2.0.dr, messages.json60.0.dr, messages.json31.0.dr, messages.json32.0.dr, messages.json11.0.dr, messages.json64.0.dr, messages.json26.0.dr, messages.json6.0.dr, messages.json34.0.dr, messages.json1.0.dr, messages.json30.0.dr, messages.json58.0.dr, messages.json12.0.dr, messages.json4.0.dr, messages.json45.0.dr, messages.json16.0.dr, messages.json17.0.dr, messages.json3.0.dr, messages.json13.0.dr, messages.json56.0.dr, messages.json63.0.dr, messages.json47.0.dr String found in binary or memory: https://support.google.com/chromecast/answer/2998456
Source: messages.json15.0.dr, messages.json5.0.dr, messages.json7.0.dr, messages.json29.0.dr, messages.json49.0.dr, feedback.html.0.dr, messages.json61.0.dr, messages.json69.0.dr, messages.json62.0.dr, messages.json71.0.dr, messages.json59.0.dr, messages.json46.0.dr, messages.json70.0.dr, messages.json33.0.dr, messages.json35.0.dr, messages.json0.0.dr, messages.json48.0.dr, messages.json88.0.dr, messages.json14.0.dr, messages.json87.0.dr, messages.json57.0.dr, messages.json18.0.dr, messages.json.0.dr, messages.json51.0.dr, messages.json50.0.dr, messages.json28.0.dr, messages.json10.0.dr, messages.json8.0.dr, messages.json2.0.dr, messages.json60.0.dr, messages.json31.0.dr, messages.json32.0.dr, messages.json11.0.dr, messages.json64.0.dr, messages.json26.0.dr, messages.json6.0.dr, messages.json34.0.dr, messages.json1.0.dr, messages.json30.0.dr, messages.json58.0.dr, messages.json12.0.dr, messages.json4.0.dr, messages.json45.0.dr, messages.json16.0.dr, messages.json17.0.dr, messages.json3.0.dr, messages.json13.0.dr, messages.json56.0.dr, messages.json63.0.dr, messages.json47.0.dr String found in binary or memory: https://support.google.com/chromecast/troubleshooter/2995236
Source: craw_window.js.0.dr, craw_background.js.0.dr String found in binary or memory: https://www-googleapis-staging.sandbox.google.com
Source: 0db7bdd1-dc2d-4704-94fc-80e5558ca212.tmp.1.dr String found in binary or memory: https://www.google-analytics.com
Source: data_1.1.dr String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: 0db7bdd1-dc2d-4704-94fc-80e5558ca212.tmp.1.dr, manifest.json2.0.dr, 818576fc-551d-4e0a-9077-b0c1f4f43fbf.tmp.1.dr String found in binary or memory: https://www.google.com
Source: manifest.json.0.dr String found in binary or memory: https://www.google.com/
Source: craw_window.js.0.dr String found in binary or memory: https://www.google.com/accounts/OAuthLogin?issueuberauth=1
Source: craw_window.js.0.dr String found in binary or memory: https://www.google.com/images/cleardot.gif
Source: craw_window.js.0.dr String found in binary or memory: https://www.google.com/images/dot2.gif
Source: craw_window.js.0.dr String found in binary or memory: https://www.google.com/images/x2.gif
Source: craw_background.js.0.dr String found in binary or memory: https://www.google.com/intl/en-US/chrome/blank.html
Source: mirroring_hangouts.js.0.dr String found in binary or memory: https://www.google.com/log?format=json&hasfast=true
Source: feedback_script.js.0.dr String found in binary or memory: https://www.google.com/tools/feedback
Source: manifest.json2.0.dr String found in binary or memory: https://www.google.com;
Source: craw_window.js.0.dr, craw_background.js.0.dr, 0db7bdd1-dc2d-4704-94fc-80e5558ca212.tmp.1.dr, 818576fc-551d-4e0a-9077-b0c1f4f43fbf.tmp.1.dr String found in binary or memory: https://www.googleapis.com
Source: manifest.json.0.dr String found in binary or memory: https://www.googleapis.com/
Source: manifest.json2.0.dr String found in binary or memory: https://www.googleapis.com/auth/calendar.readonly
Source: manifest.json2.0.dr String found in binary or memory: https://www.googleapis.com/auth/cast-edu-messaging
Source: manifest.json.0.dr String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json.0.dr String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json2.0.dr String found in binary or memory: https://www.googleapis.com/auth/clouddevices
Source: manifest.json2.0.dr String found in binary or memory: https://www.googleapis.com/auth/hangouts
Source: manifest.json2.0.dr String found in binary or memory: https://www.googleapis.com/auth/hangouts.readonly
Source: manifest.json2.0.dr String found in binary or memory: https://www.googleapis.com/auth/meetings
Source: manifest.json2.0.dr String found in binary or memory: https://www.googleapis.com/auth/plus.peopleapi.readwrite
Source: manifest.json.0.dr String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json.0.dr String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: manifest.json2.0.dr String found in binary or memory: https://www.googleapis.com/auth/userinfo.email
Source: mirroring_common.js.0.dr String found in binary or memory: https://www.googleapis.com/calendar/v3
Source: mirroring_common.js.0.dr String found in binary or memory: https://www.googleapis.com/hangouts/v1
Source: 0db7bdd1-dc2d-4704-94fc-80e5558ca212.tmp.1.dr, 818576fc-551d-4e0a-9077-b0c1f4f43fbf.tmp.1.dr String found in binary or memory: https://www.gstatic.com
Source: common.js.0.dr String found in binary or memory: https://www.gstatic.com/hangouts_echo_detector/release/%
Source: manifest.json2.0.dr String found in binary or memory: https://www.gstatic.com;
Source: unknown HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: unknown DNS traffic detected: queries for: accounts.google.com
Source: global traffic HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-85.0.4183.121Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /p/9360a05 HTTP/1.1Host: elink.ioConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /packs/css/824-8b498fe7.css HTTP/1.1Host: d1l0zj21glo9rz.cloudfront.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,*/*;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://elink.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /packs/css/post-b5651ef6.css HTTP/1.1Host: d1l0zj21glo9rz.cloudfront.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,*/*;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://elink.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /packs/js/runtime-b2d3ed74518f437053d6.js HTTP/1.1Host: d1l0zj21glo9rz.cloudfront.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://elink.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /packs/js/824-a887e342065a310d7542.js HTTP/1.1Host: d1l0zj21glo9rz.cloudfront.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://elink.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /packs/js/743-53f1d3a98111ada910b5.js HTTP/1.1Host: d1l0zj21glo9rz.cloudfront.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://elink.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /packs/js/765-f3e3d2aa0a8cc8fb551a.js HTTP/1.1Host: d1l0zj21glo9rz.cloudfront.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://elink.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /packs/js/post-39db28324387f530c73f.js HTTP/1.1Host: d1l0zj21glo9rz.cloudfront.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://elink.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /analytics.js HTTP/1.1Host: www.google-analytics.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://elink.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /post_editor_images/xr22g7aetsl1rs7l/xr22g7aetsl1rs7l.png HTTP/1.1Host: diak46rl5chc7.cloudfront.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://elink.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /assets/favicon-5ae1a659dd03596c3c7ac832da397a3446bf0877e23e10e6d8805902ab94588f.ico HTTP/1.1Host: d1l0zj21glo9rz.cloudfront.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://elink.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /assets/favicon-32x32-a644812140740e0a773efd74decbd7ddb53818dc3e3d6dfe65f44568f6244cc6.png HTTP/1.1Host: d1l0zj21glo9rz.cloudfront.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://elink.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /crx/blobs/Acy1k0bLIjHsvnKaKN_oRpVaYYvFs25d7GKYF1WXrT6yizCMksBO0c_ggE0B6tx6HPRHe6q1GOEe3_NcIbSiGG8kXeLMUY0sAKVvC6R89zvKM13s5VqoAMZSmuUgjQL5vlygJuArQghXXE_qTL7NlQ/extension_8520_615_0_5.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /frk73jk.html HTTP/1.1Host: quickest-cream-ringer.glitch.meConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /css/hover.css HTTP/1.1Host: quickest-cream-ringer.glitch.meConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://quickest-cream-ringer.glitch.me/frk73jk.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /bootstrap/4.0.0/css/bootstrap.min.css HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-aliveOrigin: https://quickest-cream-ringer.glitch.meUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,*/*;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://quickest-cream-ringer.glitch.me/frk73jk.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /bootstrap/4.0.0/js/bootstrap.min.js HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-aliveOrigin: https://quickest-cream-ringer.glitch.meUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://quickest-cream-ringer.glitch.me/frk73jk.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1Host: logincdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://quickest-cream-ringer.glitch.me/frk73jk.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /css/hover.css HTTP/1.1Host: quickest-cream-ringer.glitch.meConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://quickest-cream-ringer.glitch.me/frk73jk.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /ajax/libs/popper.js/1.12.9/umd/popper.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveOrigin: https://quickest-cream-ringer.glitch.meUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://quickest-cream-ringer.glitch.me/frk73jk.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: quickest-cream-ringer.glitch.meConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://quickest-cream-ringer.glitch.me/frk73jk.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "https://elink.io/p/9360a05
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1556,16312033422872035278,3964410953995961333,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1920 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1556,16312033422872035278,3964410953995961333,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1920 /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Program Files\Google\Chrome\Application\Dictionaries Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-61A01B08-18C4.pma Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Local\Temp\7dbe49e8-bc9f-4298-afd7-22ae5961ccc7.tmp Jump to behavior
Source: classification engine Classification label: mal76.phis.win@35/257@15/16
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Automated click: Next
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 528631 URL: https://elink.io/p/9360a05 Startdate: 25/11/2021 Architecture: WINDOWS Score: 76 16 d1l0zj21glo9rz.cloudfront.net 2->16 30 Antivirus detection for URL or domain 2->30 32 Antivirus / Scanner detection for submitted sample 2->32 34 Yara detected HtmlPhish29 2->34 36 2 other signatures 2->36 7 chrome.exe 16 439 2->7         started        signatures3 process4 dnsIp5 18 192.168.2.1 unknown unknown 7->18 20 192.168.2.30 unknown unknown 7->20 22 239.255.255.250 unknown Reserved 7->22 10 chrome.exe 29 7->10         started        process6 dnsIp7 24 elink.io 168.119.1.155, 443, 49748, 49749 HETZNER-ASDE Germany 10->24 26 clients.l.google.com 142.250.186.46, 443, 49747, 50730 GOOGLEUS United States 10->26 28 19 other IPs or domains 10->28 14 C:\Users\user\AppData\Localbehaviorgraphoogle\...\data_3, data 10->14 dropped file8
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
142.250.186.46
 clients.l.google.com United States
15169 GOOGLEUS false
13.224.89.28
 diak46rl5chc7.cloudfront.net United States
16509 AMAZON-02US false
104.18.10.207
 maxcdn.bootstrapcdn.com United States
13335 CLOUDFLARENETUS false
168.119.1.155
 elink.io Germany
24940 HETZNER-ASDE false
34.229.4.215
 quickest-cream-ringer.glitch.me United States
14618 AMAZON-AESUS false
172.217.168.45
 accounts.google.com United States
15169 GOOGLEUS false
142.250.203.97
 googlehosted.l.googleusercontent.com United States
15169 GOOGLEUS false
172.217.168.3
 gstaticadssl.l.google.com United States
15169 GOOGLEUS false
142.250.186.78
 www-google-analytics.l.google.com United States
15169 GOOGLEUS false
13.224.89.220
 d1l0zj21glo9rz.cloudfront.net United States
16509 AMAZON-02US false
239.255.255.250
 unknown Reserved
unknown unknown false
192.229.221.185
 cs1227.wpc.alphacdn.net United States
15133 EDGECASTUS false
104.16.19.94
 cdnjs.cloudflare.com United States
13335 CLOUDFLARENETUS false

Private
IP
192.168.2.1
192.168.2.30
127.0.0.1

Contacted Domains

Name IP Active
gstaticadssl.l.google.com 172.217.168.3 true
elink.io 168.119.1.155 true
quickest-cream-ringer.glitch.me 34.229.4.215 true
diak46rl5chc7.cloudfront.net 13.224.89.28 true
accounts.google.com 172.217.168.45 true
www-google-analytics.l.google.com 142.250.186.78 true
cdnjs.cloudflare.com 104.16.19.94 true
maxcdn.bootstrapcdn.com 104.18.10.207 true
d1l0zj21glo9rz.cloudfront.net 13.224.89.220 true
cs1227.wpc.alphacdn.net 192.229.221.185 true
clients.l.google.com 142.250.186.46 true
googlehosted.l.googleusercontent.com 142.250.203.97 true
logincdn.msauth.net unknown unknown
ka-f.fontawesome.com unknown unknown
kit.fontawesome.com unknown unknown
account.live.com unknown unknown
clients2.googleusercontent.com unknown unknown
clients2.google.com unknown unknown
code.jquery.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://d1l0zj21glo9rz.cloudfront.net/packs/js/runtime-b2d3ed74518f437053d6.js false
    		high
    https://logincdn.msauth.net/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg false
    • Avira URL Cloud: safe
    		 unknown
    https://d1l0zj21glo9rz.cloudfront.net/packs/css/824-8b498fe7.css false
      		high
      https://elink.io/p/9360a05 false
        		high
        https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js false
          		high
          https://d1l0zj21glo9rz.cloudfront.net/packs/js/post-39db28324387f530c73f.js false
            		high
            https://d1l0zj21glo9rz.cloudfront.net/packs/css/post-b5651ef6.css false
              		high
              https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 false
                		high
                https://quickest-cream-ringer.glitch.me/frk73jk.html false
                • SlashNext: Fake Login Page type: Phishing & Social Engineering
                		 high
                https://diak46rl5chc7.cloudfront.net/post_editor_images/xr22g7aetsl1rs7l/xr22g7aetsl1rs7l.png false
                  		high
                  https://quickest-cream-ringer.glitch.me/favicon.ico false
                    		high
                    https://clients2.googleusercontent.com/crx/blobs/Acy1k0bLIjHsvnKaKN_oRpVaYYvFs25d7GKYF1WXrT6yizCMksBO0c_ggE0B6tx6HPRHe6q1GOEe3_NcIbSiGG8kXeLMUY0sAKVvC6R89zvKM13s5VqoAMZSmuUgjQL5vlygJuArQghXXE_qTL7NlQ/extension_8520_615_0_5.crx false
                      		high
                      https://d1l0zj21glo9rz.cloudfront.net/packs/js/765-f3e3d2aa0a8cc8fb551a.js false
                        		high
                        https://d1l0zj21glo9rz.cloudfront.net/assets/favicon-32x32-a644812140740e0a773efd74decbd7ddb53818dc3e3d6dfe65f44568f6244cc6.png false
                          		high
                          https://d1l0zj21glo9rz.cloudfront.net/assets/favicon-5ae1a659dd03596c3c7ac832da397a3446bf0877e23e10e6d8805902ab94588f.ico false
                            		high
                            https://d1l0zj21glo9rz.cloudfront.net/packs/js/824-a887e342065a310d7542.js false
                              		high
                              https://elink.io/p/9360a05 false
                                		high
                                https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard false
                                  		high
                                  https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css false
                                    		high