Windows Analysis Report
https://c.mail.com/@950756523062077283/jXK93RHJTd6QHf_mxRpglQ

Overview

General Information

Sample URL: https://c.mail.com/@950756523062077283/jXK93RHJTd6QHf_mxRpglQ
Analysis ID: 562288
Infos:

Detection

HTMLPhisher
Score: 64
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Yara detected HtmlPhish10
Phishing site detected (based on logo template match)
Phishing site detected (based on image similarity)
Invalid 'forgot password' link found
HTML body contains low number of good links
None HTTPS page querying sensitive user data (password, username or email)
No HTML title found

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: https://c.mail.com/@950756523062077283/jXK93RHJTd6QHf_mxRpglQ SlashNext: detection malicious, Label: Fake Login Page type: Phishing & Social Engineering

Phishing
barindex
Yara detected HtmlPhish10
Source: Yara match File source: 79343.1.pages.csv, type: HTML
Source: Yara match File source: C:\Users\user\Downloads\ec76792b-097a-48ef-8860-efa82d0c2eb1.tmp, type: DROPPED
Source: Yara match File source: C:\Users\user\Downloads\4be5fe68-231a-4714-bd92-311125aedb56.tmp, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache\data_3, type: DROPPED
Phishing site detected (based on logo template match)
Source: file:///C:/Users/user/Downloads/Remittance%20Copy%20(1).html Matcher: Template: microsoft matched
Phishing site detected (based on image similarity)
Source: file:///C:/Users/user/Downloads/Remittance%20Copy%20(1).html Matcher: Found strong image similarity, brand: Microsoft image: 79343.1.img.1.gfk.csv EE236805D05E24861CE1B6B0E7D94B8D
Invalid 'forgot password' link found
Source: file:///C:/Users/user/Downloads/Remittance%20Copy%20(1).html HTTP Parser: Invalid link: Forgot Password?
Source: file:///C:/Users/user/Downloads/Remittance%20Copy%20(1).html HTTP Parser: Invalid link: Forgot Password?
HTML body contains low number of good links
Source: file:///C:/Users/user/Downloads/Remittance%20Copy%20(1).html HTTP Parser: Number of links: 0
Source: file:///C:/Users/user/Downloads/Remittance%20Copy%20(1).html HTTP Parser: Number of links: 0
None HTTPS page querying sensitive user data (password, username or email)
Source: file:///C:/Users/user/Downloads/Remittance%20Copy%20(1).html HTTP Parser: Has password / email / username input fields
Source: file:///C:/Users/user/Downloads/Remittance%20Copy%20(1).html HTTP Parser: Has password / email / username input fields
No HTML title found
Source: file:///C:/Users/user/Downloads/Remittance%20Copy%20(1).html HTTP Parser: HTML title missing
Source: file:///C:/Users/user/Downloads/Remittance%20Copy%20(1).html HTTP Parser: HTML title missing
Source: file:///C:/Users/user/Downloads/Remittance%20Copy%20(1).html HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/user/Downloads/Remittance%20Copy%20(1).html HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/user/Downloads/Remittance%20Copy%20(1).html HTTP Parser: No <meta name="copyright".. found
Source: file:///C:/Users/user/Downloads/Remittance%20Copy%20(1).html HTTP Parser: No <meta name="copyright".. found
Source: unknown HTTPS traffic detected: 104.19.143.111:443 -> 192.168.2.4:49852 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.19.143.111:443 -> 192.168.2.4:49851 version: TLS 1.2
Source: unknown DNS traffic detected: queries for: clients2.google.com
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49822
Source: global traffic HTTP traffic detected: GET /@950756523062077283/jXK93RHJTd6QHf_mxRpglQ HTTP/1.1Host: c.mail.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-GB&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-85.0.4183.121Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic HTTP traffic detected: GET /js/53681.js HTTP/1.1Host: uim.tifbs.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://c.mail.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic HTTP traffic detected: GET /restfs/guest/@950756523062077283/share/jXK93RHJTd6QHf_mxRpglQ/shareinfo?option=thumbnails&option=metadata&option=displayresource&option=props HTTP/1.1Host: c.mail.comConnection: keep-aliveX-UI-STATISTIC: cloud.dir.generalAccept: application/json, text/plain, */*X-UI-API-KEY: 0-N7-16211-0-a037a5fc56cd8f2eX-UI-APP: mailcom.web.onlinespeichernebula/3.0.5786User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36x-request-id: e2ab5b36-7035-40ab-819a-bb2bfb93fb99Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://c.mail.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic HTTP traffic detected: GET /wa/t.gif?timestamp=1643390031030&software=ngcc&softwareversion=3.0.5786&brand=mailcom&section=general.start&trackingtype=ev&contentposition=en&source=shareexternal&destination=shareread&result=21000127&profileblocked=1&environment=standalone&libname=%40poseidon%2Ftracklib&libversion=3.7.0&attributeset=1&signature=14462 HTTP/1.1Host: wa.mail.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://c.mail.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic HTTP traffic detected: GET /wa/t.gif?timestamp=1643390031074&software=ngcc&softwareversion=3.0.5786&brand=mailcom&section=cloud.start&trackingtype=ev&contentposition=en&source=shareexternalsingle&destination=shareread&profileblocked=1&environment=standalone&libname=%40poseidon%2Ftracklib&libversion=3.7.0&attributeset=1&signature=13746 HTTP/1.1Host: wa.mail.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://c.mail.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic HTTP traffic detected: GET /wa/t.gif?timestamp=1643390031088&software=ngcc&softwareversion=3.0.5786&brand=mailcom&section=cloud.root.view&trackingtype=pi&contentposition=gallery&source=shareexternalsingle&destination=shareread&count=1&profileblocked=1&environment=standalone&libname=%40poseidon%2Ftracklib&libversion=3.7.0&attributeset=1&signature=9531 HTTP/1.1Host: wa.mail.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://c.mail.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic HTTP traffic detected: GET /traffic_p/?md=mailcom&et=CP&agof=1&sc=cloud/share/root&brand=mailcom&region=com&dclass=desktop&dclient=browser&ff=b&tif=53681&tifts=2021-03-15T12:45:09Z&d=39857&anon=1 HTTP/1.1Host: t.uimserv.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://c.mail.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic HTTP traffic detected: GET /restfs/guest/@950756523062077283/share/jXK93RHJTd6QHf_mxRpglQ/resourceAlias/ROOT?option=shares&option=thumbnails&option=metadata&option=props&option=displayresource&sort=resourceType-a,ui:media.visual-a,name-a&length=201&offset=0 HTTP/1.1Host: c.mail.comConnection: keep-aliveX-UI-STATISTIC: cloud.dir.generalAccept: application/json, text/plain, */*X-UI-API-KEY: 0-N7-16211-0-a037a5fc56cd8f2eX-UI-APP: mailcom.web.onlinespeichernebula/3.0.5786User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36x-request-id: 0c624dd2-ee7a-4364-949b-c26975c090c1Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://c.mail.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic HTTP traffic detected: GET /restfs/guest/@950756523062077283/share/jXK93RHJTd6QHf_mxRpglQ/resourceAlias/ROOT?option=shares&option=thumbnails&option=metadata&option=props&option=displayresource&sort=resourceType-a,ui:media.visual-a,name-a&length=1001&offset=0 HTTP/1.1Host: c.mail.comConnection: keep-aliveX-UI-STATISTIC: cloud.dir.generalAccept: application/json, text/plain, */*X-UI-API-KEY: 0-N7-16211-0-a037a5fc56cd8f2eX-UI-APP: mailcom.web.onlinespeichernebula/3.0.5786User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36x-request-id: 04cf098b-8fd2-44a7-b21c-a40946ebb96bSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://c.mail.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic HTTP traffic detected: GET /restfs/guest/@950756523062077283/share/jXK93RHJTd6QHf_mxRpglQ/resourceAlias/ROOT?option=shares&option=thumbnails&option=metadata&option=props&option=displayresource&sort=resourceType-a,ui:media.visual-a,name-a&length=201&offset=0 HTTP/1.1Host: c.mail.comConnection: keep-aliveX-UI-STATISTIC: cloud.dir.generalAccept: application/json, text/plain, */*X-UI-API-KEY: 0-N7-16211-0-a037a5fc56cd8f2eX-UI-APP: mailcom.web.onlinespeichernebula/3.0.5786User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36x-request-id: 77abb7c1-0398-495a-82e1-380c0a58ca0cSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://c.mail.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: wa=opt-outIf-None-Match: "AAABfp11VDkAAAF-nXL0Ug-AABKTA"
Source: global traffic HTTP traffic detected: GET /crx/blobs/Acy1k0bLIjHsvnKaKN_oRpVaYYvFs25d7GKYF1WXrT6yizCMksBO0c_ggE0B6tx6HPRHe6q1GOEe3_NcIbSiGG8kXeLMUY0sAKVvC6R89zvKM13s5VqoAMZSmuUgjQL5vlygJuArQghXXE_qTL7NlQ/extension_8520_615_0_5.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic HTTP traffic detected: GET /wa/t.gif?timestamp=1643390038276&software=ngcc&softwareversion=3.0.5786&brand=mailcom&section=cloud.download.start&trackingtype=cl&eventposition=filelist_directaction&source=shareexternalsingle&destination=shareread&profileblocked=1&environment=standalone&libname=%40poseidon%2Ftracklib&libversion=3.7.0&attributeset=1&signature=10604 HTTP/1.1Host: wa.mail.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://c.mail.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: wa=opt-out
Source: global traffic HTTP traffic detected: GET /restfs/guest/@950756523062077283/share/jXK93RHJTd6QHf_mxRpglQ/resourceAlias/ROOT?option=download&option=open HTTP/1.1Host: c.mail.comConnection: keep-aliveX-UI-STATISTIC: cloud.dir.generalAccept: application/json, text/plain, */*X-UI-API-KEY: 0-N7-16211-0-a037a5fc56cd8f2eX-UI-APP: mailcom.web.onlinespeichernebula/3.0.5786User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36x-request-id: e230fd7e-3941-4238-9f05-5798f7d2e4dcSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://c.mail.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: wa=opt-out
Source: global traffic HTTP traffic detected: GET /cgate-maus/rest/document/os-live-maus/950760097145956129/1068644333537731777/Remittance%20Copy.html?x_cd=attachment&c=AA0xxAU5ACdjDtSNzu4AIEMAAAF-nXL0Uv__jXK93RHJTd6QHf_mxRpglQ&t=1643397239333&h=-I1uJ7H0CgdTe2kmTHvvB4m8V6g HTTP/1.1Host: cgateu03maus.storage-mailcom.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: iframeReferer: https://c.mail.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic HTTP traffic detected: GET /wa/t.gif?timestamp=1643390041407&software=ngcc&softwareversion=3.0.5786&brand=mailcom&section=cloud.download.start&trackingtype=cl&eventposition=filelist_directaction&source=shareexternalsingle&destination=shareread&profileblocked=1&environment=standalone&libname=%40poseidon%2Ftracklib&libversion=3.7.0&attributeset=1&signature=10594 HTTP/1.1Host: wa.mail.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://c.mail.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: wa=opt-out
Source: global traffic HTTP traffic detected: GET /restfs/guest/@950756523062077283/share/jXK93RHJTd6QHf_mxRpglQ/resourceAlias/ROOT?option=download&option=open HTTP/1.1Host: c.mail.comConnection: keep-aliveX-UI-STATISTIC: cloud.dir.generalAccept: application/json, text/plain, */*X-UI-API-KEY: 0-N7-16211-0-a037a5fc56cd8f2eX-UI-APP: mailcom.web.onlinespeichernebula/3.0.5786User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36x-request-id: 4b4f532a-1284-4f92-a628-f53cce9cf72fSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://c.mail.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: wa=opt-outIf-None-Match: "AAABfp11VDkAAAF-nXL0Ug-AAN7mA"
Source: global traffic HTTP traffic detected: GET /bootstrap/4.0.0/css/bootstrap.min.css HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-aliveOrigin: nullUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,*/*;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic HTTP traffic detected: GET /bootstrap/4.0.0/js/bootstrap.min.js HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-aliveOrigin: nullUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic HTTP traffic detected: GET /cc41020ecb5162014937e0d1c83fa617.png HTTP/1.1Host: i.gyazo.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic HTTP traffic detected: GET /ajax/libs/popper.js/1.12.9/umd/popper.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveOrigin: nullUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic HTTP traffic detected: GET /bootstrap/4.1.3/js/bootstrap.min.js HTTP/1.1Host: stackpath.bootstrapcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic HTTP traffic detected: GET /b308246805567e68aad040e42c453a7f.png HTTP/1.1Host: i.gyazo.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: Gyazo_cfwoker=i
Source: global traffic HTTP traffic detected: GET /b308246805567e68aad040e42c453a7f.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: i.gyazo.com
Source: global traffic HTTP traffic detected: GET /cc41020ecb5162014937e0d1c83fa617.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: i.gyazo.com
Source: angular.js.0.dr String found in binary or memory: http://angularjs.org
Source: angular.js.0.dr String found in binary or memory: http://errors.angularjs.org/1.6.4-local
Source: pnacl_public_x86_64_pnacl_sz_nexe.0.dr, pnacl_public_x86_64_pnacl_llc_nexe.0.dr String found in binary or memory: http://llvm.org/):
Source: mirroring_hangouts.js.0.dr String found in binary or memory: http://tools.ietf.org/html/rfc1950
Source: mirroring_hangouts.js.0.dr String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: mirroring_hangouts.js.0.dr String found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions
Source: mirroring_hangouts.js.0.dr String found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01
Source: Reporting and NEL.1.dr String found in binary or memory: https://a.nel.cloudflare.com/report/v3?s=%2BS6QK81%2Bw3VcTIF3HfV7VTEuoo0Pf2CddKeOx%2FUdo0dCUFISoaALQ
Source: manifest.json0.0.dr, 4437e90f-7a93-4d45-92d8-8a702ae4e4be.tmp.1.dr, 438e58b4-3124-447e-b5c0-ab9cf5c4aa2c.tmp.1.dr String found in binary or memory: https://accounts.google.com
Source: craw_window.js.0.dr String found in binary or memory: https://accounts.google.com/MergeSession
Source: 4437e90f-7a93-4d45-92d8-8a702ae4e4be.tmp.1.dr String found in binary or memory: https://ajax.googleapis.com
Source: ec76792b-097a-48ef-8860-efa82d0c2eb1.tmp.0.dr, 4be5fe68-231a-4714-bd92-311125aedb56.tmp.0.dr, data_1.1.dr, data_3.1.dr String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
Source: manifest.json0.0.dr, 4437e90f-7a93-4d45-92d8-8a702ae4e4be.tmp.1.dr, 438e58b4-3124-447e-b5c0-ab9cf5c4aa2c.tmp.1.dr String found in binary or memory: https://apis.google.com
Source: mirroring_common.js.0.dr String found in binary or memory: https://apis.google.com/js/client.js
Source: 000003.log7.0.dr String found in binary or memory: https://c.mail.com
Source: 000003.log7.0.dr String found in binary or memory: https://c.mail.com%_https://c.mail.com
Source: History.0.dr String found in binary or memory: https://c.mail.com/
Source: History.0.dr String found in binary or memory: https://c.mail.com/https://c.mail.com/
Source: data_1.1.dr String found in binary or memory: https://c.mail.com/restfs/guest/
Source: Current Session.0.dr String found in binary or memory: https://c.mail.comh
Source: mirroring_common.js.0.dr String found in binary or memory: https://castedumessaging-pa.googleapis.com/v1
Source: ec76792b-097a-48ef-8860-efa82d0c2eb1.tmp.0.dr, 4be5fe68-231a-4714-bd92-311125aedb56.tmp.0.dr, data_1.1.dr, data_3.1.dr String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js
Source: data_1.1.dr String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.jskf
Source: data_1.1.dr, 000003.log2.0.dr, Remittance Copy.html_Zone.Identifier.5.dr, Remittance Copy (1).html_Zone.Identifier.6.dr, History.0.dr String found in binary or memory: https://cgateu03maus.storage-mailcom.com/cgate-maus/rest/document/os-live-maus/950760097145956129/10
Source: pnacl_public_x86_64_libpnacl_irt_shim_dummy_a.0.dr String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-clang.git
Source: pnacl_public_x86_64_libpnacl_irt_shim_dummy_a.0.dr String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-llvm.git
Source: 4437e90f-7a93-4d45-92d8-8a702ae4e4be.tmp.1.dr, 438e58b4-3124-447e-b5c0-ab9cf5c4aa2c.tmp.1.dr String found in binary or memory: https://clients2.google.com
Source: mirroring_hangouts.js.0.dr, mirroring_cast_streaming.js.0.dr String found in binary or memory: https://clients2.google.com/cr/report
Source: manifest.json1.0.dr, manifest.json0.0.dr, manifest.json.0.dr String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 4437e90f-7a93-4d45-92d8-8a702ae4e4be.tmp.1.dr, 438e58b4-3124-447e-b5c0-ab9cf5c4aa2c.tmp.1.dr String found in binary or memory: https://clients2.googleusercontent.com
Source: mirroring_hangouts.js.0.dr String found in binary or memory: https://clients6.google.com
Source: pnacl_public_x86_64_ld_nexe.0.dr String found in binary or memory: https://code.google.com/p/nativeclient/issues/entry
Source: pnacl_public_x86_64_ld_nexe.0.dr String found in binary or memory: https://code.google.com/p/nativeclient/issues/entry%s:
Source: ec76792b-097a-48ef-8860-efa82d0c2eb1.tmp.0.dr, 4be5fe68-231a-4714-bd92-311125aedb56.tmp.0.dr, data_1.1.dr, data_3.1.dr String found in binary or memory: https://code.jquery.com/jquery-3.2.1.slim.min.js
Source: manifest.json0.0.dr String found in binary or memory: https://content.googleapis.com
Source: mirroring_cast_streaming.js.0.dr, common.js.0.dr String found in binary or memory: https://crash.corp.google.com/samples?reportid=&q=
Source: mirroring_hangouts.js.0.dr String found in binary or memory: https://creativecommons.org/publicdomain/zero/1.0/.
Source: data_3.1.dr String found in binary or memory: https://csp.withgoogle.com/csp/hosted-libraries-pushers
Source: data_3.1.dr String found in binary or memory: https://csp.withgoogle.com/csp/hosted-libraries-pushersCross-Origin-Resource-Policy:
Source: data_3.1.dr String found in binary or memory: https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers
Source: data_1.1.dr String found in binary or memory: https://dl.mail.com/tcf/live/v1/js/tcf-api.js
Source: 4437e90f-7a93-4d45-92d8-8a702ae4e4be.tmp.1.dr, fb7399f9-7cdc-4464-8326-0ffb045bd317.tmp.1.dr, 438e58b4-3124-447e-b5c0-ab9cf5c4aa2c.tmp.1.dr, f0503a97-51d0-4f2b-a344-16d18056bd4e.tmp.1.dr String found in binary or memory: https://dns.google
Source: mirroring_common.js.0.dr String found in binary or memory: https://docs.google.com
Source: manifest.json0.0.dr String found in binary or memory: https://feedback.googleusercontent.com
Source: 4437e90f-7a93-4d45-92d8-8a702ae4e4be.tmp.1.dr, 438e58b4-3124-447e-b5c0-ab9cf5c4aa2c.tmp.1.dr String found in binary or memory: https://fonts.googleapis.com
Source: manifest.json0.0.dr String found in binary or memory: https://fonts.googleapis.com;
Source: 4437e90f-7a93-4d45-92d8-8a702ae4e4be.tmp.1.dr, 438e58b4-3124-447e-b5c0-ab9cf5c4aa2c.tmp.1.dr String found in binary or memory: https://fonts.gstatic.com
Source: manifest.json0.0.dr String found in binary or memory: https://fonts.gstatic.com;
Source: material_css_min.css.0.dr, angular.js.0.dr String found in binary or memory: https://github.com/angular/material
Source: craw_window.js.0.dr, craw_background.js.0.dr String found in binary or memory: https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
Source: mirroring_hangouts.js.0.dr String found in binary or memory: https://github.com/madler/zlib/blob/master/zlib.h
Source: data_2.1.dr String found in binary or memory: https://gyazo.com
Source: data_2.1.dr String found in binary or memory: https://gyazo.comAge:
Source: mirroring_hangouts.js.0.dr String found in binary or memory: https://hangouts.clients6.google.com
Source: manifest.json0.0.dr String found in binary or memory: https://hangouts.google.com/
Source: mirroring_hangouts.js.0.dr String found in binary or memory: https://hangouts.google.com/hangouts/_/logpref
Source: ec76792b-097a-48ef-8860-efa82d0c2eb1.tmp.0.dr, 4be5fe68-231a-4714-bd92-311125aedb56.tmp.0.dr, data_1.1.dr, data_3.1.dr String found in binary or memory: https://i.gyazo.com/b308246805567e68aad040e42c453a7f.png
Source: data_1.1.dr String found in binary or memory: https://i.gyazo.com/b308246805567e68aad040e42c453a7f.pngD
Source: data_1.1.dr, data_3.1.dr String found in binary or memory: https://i.gyazo.com/cc41020ecb5162014937e0d1c83fa617.png
Source: data_1.1.dr String found in binary or memory: https://img.ui-portal.de/ci/mailcom/global/fonts/DroidSans/DroidSans-webfont.woff
Source: data_1.1.dr, data_3.1.dr String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css
Source: ec76792b-097a-48ef-8860-efa82d0c2eb1.tmp.0.dr, 4be5fe68-231a-4714-bd92-311125aedb56.tmp.0.dr, data_1.1.dr, data_3.1.dr String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js
Source: data_1.1.dr String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.jsM
Source: mirroring_common.js.0.dr String found in binary or memory: https://meet.google.com
Source: mirroring_hangouts.js.0.dr String found in binary or memory: https://meetings.clients6.google.com
Source: mirroring_common.js.0.dr String found in binary or memory: https://networktraversal.googleapis.com/v1alpha
Source: 4437e90f-7a93-4d45-92d8-8a702ae4e4be.tmp.1.dr, 438e58b4-3124-447e-b5c0-ab9cf5c4aa2c.tmp.1.dr String found in binary or memory: https://ogs.google.com
Source: craw_window.js.0.dr, manifest.json.0.dr String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: 4437e90f-7a93-4d45-92d8-8a702ae4e4be.tmp.1.dr, 438e58b4-3124-447e-b5c0-ab9cf5c4aa2c.tmp.1.dr String found in binary or memory: https://play.google.com
Source: mirroring_hangouts.js.0.dr String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: mirroring_hangouts.js.0.dr String found in binary or memory: https://preprod-hangouts-googleapis.sandbox.google.com
Source: 438e58b4-3124-447e-b5c0-ab9cf5c4aa2c.tmp.1.dr String found in binary or memory: https://r5---sn-h0jeln7l.gvt1.com
Source: 4437e90f-7a93-4d45-92d8-8a702ae4e4be.tmp.1.dr, 438e58b4-3124-447e-b5c0-ab9cf5c4aa2c.tmp.1.dr String found in binary or memory: https://redirector.gvt1.com
Source: data_1.1.dr String found in binary or memory: https://s.uicdn.com/cloudclient/mailcom/assets/style/bt_mailcom-4eb40dd431.css
Source: data_1.1.dr String found in binary or memory: https://s.uicdn.com/cloudclient/mailcom/assets/style/bt_mailcom-4eb40dd431.css:root
Source: data_1.1.dr String found in binary or memory: https://s.uicdn.com/cloudclient/mailcom/assets/style/cloud_intensebluectagreen-7ebdceb8e1.css
Source: data_1.1.dr String found in binary or memory: https://s.uicdn.com/cloudclient/mailcom/main-es2015.f148c117aa1ea1fa4616.js
Source: data_1.1.dr String found in binary or memory: https://s.uicdn.com/cloudclient/mailcom/main-es2015.f148c117aa1ea1fa4616.js9/9
Source: data_1.1.dr String found in binary or memory: https://s.uicdn.com/cloudclient/mailcom/polyfills-es2015.723cd1080b9f48044248.js
Source: data_1.1.dr String found in binary or memory: https://s.uicdn.com/cloudclient/mailcom/runtime-es2015.3d8a04dcae2d724c8acc.js
Source: data_1.1.dr String found in binary or memory: https://s.uicdn.com/cloudclient/mailcom/vendor-es2015.ac806ff28cf734722e9b.js
Source: data_1.1.dr, Favicons.0.dr String found in binary or memory: https://s.uicdn.com/mailint/7.218.0/assets/favicon.ico
Source: craw_window.js.0.dr, manifest.json.0.dr String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: ec76792b-097a-48ef-8860-efa82d0c2eb1.tmp.0.dr, 4be5fe68-231a-4714-bd92-311125aedb56.tmp.0.dr, data_3.1.dr String found in binary or memory: https://sreckingssonlinefilesdown.com/nextings/rrrrrrrseeeeeeee.php
Source: 4437e90f-7a93-4d45-92d8-8a702ae4e4be.tmp.1.dr, 438e58b4-3124-447e-b5c0-ab9cf5c4aa2c.tmp.1.dr String found in binary or memory: https://ssl.gstatic.com
Source: ec76792b-097a-48ef-8860-efa82d0c2eb1.tmp.0.dr, 4be5fe68-231a-4714-bd92-311125aedb56.tmp.0.dr, data_1.1.dr, data_3.1.dr String found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js
Source: messages.json41.0.dr, messages.json5.0.dr, messages.json7.0.dr, messages.json37.0.dr, feedback.html.0.dr, messages.json23.0.dr, messages.json69.0.dr, messages.json75.0.dr, messages.json71.0.dr, messages.json73.0.dr, messages.json83.0.dr, messages.json79.0.dr, messages.json25.0.dr, messages.json82.0.dr, messages.json54.0.dr, messages.json70.0.dr, messages.json74.0.dr, messages.json39.0.dr, messages.json33.0.dr, messages.json57.0.dr, messages.json18.0.dr String found in binary or memory: https://support.google.com/chromecast/answer/2998456
Source: messages.json41.0.dr, messages.json5.0.dr, messages.json7.0.dr, messages.json37.0.dr, feedback.html.0.dr, messages.json23.0.dr, messages.json69.0.dr, messages.json75.0.dr, messages.json71.0.dr, messages.json73.0.dr, messages.json83.0.dr, messages.json79.0.dr, messages.json25.0.dr, messages.json82.0.dr, messages.json54.0.dr, messages.json70.0.dr, messages.json74.0.dr, messages.json39.0.dr, messages.json33.0.dr, messages.json57.0.dr, messages.json18.0.dr String found in binary or memory: https://support.google.com/chromecast/troubleshooter/2995236
Source: data_1.1.dr String found in binary or memory: https://uim.tifbs.net/js/53681.js
Source: craw_window.js.0.dr, craw_background.js.0.dr String found in binary or memory: https://www-googleapis-staging.sandbox.google.com
Source: manifest.json0.0.dr, 4437e90f-7a93-4d45-92d8-8a702ae4e4be.tmp.1.dr, 438e58b4-3124-447e-b5c0-ab9cf5c4aa2c.tmp.1.dr String found in binary or memory: https://www.google.com
Source: manifest.json.0.dr String found in binary or memory: https://www.google.com/
Source: craw_window.js.0.dr String found in binary or memory: https://www.google.com/accounts/OAuthLogin?issueuberauth=1
Source: craw_window.js.0.dr String found in binary or memory: https://www.google.com/images/cleardot.gif
Source: craw_window.js.0.dr String found in binary or memory: https://www.google.com/images/dot2.gif
Source: craw_window.js.0.dr String found in binary or memory: https://www.google.com/images/x2.gif
Source: craw_background.js.0.dr String found in binary or memory: https://www.google.com/intl/en-US/chrome/blank.html
Source: mirroring_hangouts.js.0.dr String found in binary or memory: https://www.google.com/log?format=json&hasfast=true
Source: feedback_script.js.0.dr String found in binary or memory: https://www.google.com/tools/feedback
Source: manifest.json0.0.dr String found in binary or memory: https://www.google.com;
Source: craw_window.js.0.dr, craw_background.js.0.dr, 4437e90f-7a93-4d45-92d8-8a702ae4e4be.tmp.1.dr, 438e58b4-3124-447e-b5c0-ab9cf5c4aa2c.tmp.1.dr String found in binary or memory: https://www.googleapis.com
Source: manifest.json.0.dr String found in binary or memory: https://www.googleapis.com/
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/calendar.readonly
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/cast-edu-messaging
Source: manifest.json.0.dr String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json.0.dr String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/clouddevices
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/hangouts
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/hangouts.readonly
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/meetings
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/plus.peopleapi.readwrite
Source: manifest.json.0.dr String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json.0.dr String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/userinfo.email
Source: mirroring_common.js.0.dr String found in binary or memory: https://www.googleapis.com/calendar/v3
Source: mirroring_common.js.0.dr String found in binary or memory: https://www.googleapis.com/hangouts/v1
Source: 4437e90f-7a93-4d45-92d8-8a702ae4e4be.tmp.1.dr, 438e58b4-3124-447e-b5c0-ab9cf5c4aa2c.tmp.1.dr String found in binary or memory: https://www.gstatic.com
Source: common.js.0.dr String found in binary or memory: https://www.gstatic.com/hangouts_echo_detector/release/%
Source: manifest.json0.0.dr String found in binary or memory: https://www.gstatic.com;
Source: unknown HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: unknown HTTPS traffic detected: 104.19.143.111:443 -> 192.168.2.4:49852 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.19.143.111:443 -> 192.168.2.4:49851 version: TLS 1.2
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Local\Temp\204b2931-920e-4a8a-b22d-8c2c3ee4937b.tmp Jump to behavior
Source: classification engine Classification label: mal64.phis.win@40/263@18/15
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "https://c.mail.com/@950756523062077283/jXK93RHJTd6QHf_mxRpglQ
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1540,12121304557946197679,11161055878062121502,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1948 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1540,12121304557946197679,11161055878062121502,131072 --lang=en-GB --service-sandbox-type=none --enable-audio-service-sandbox --mojo-platform-channel-handle=3792 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1540,12121304557946197679,11161055878062121502,131072 --lang=en-GB --service-sandbox-type=none --enable-audio-service-sandbox --mojo-platform-channel-handle=3300 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1540,12121304557946197679,11161055878062121502,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1948 /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1540,12121304557946197679,11161055878062121502,131072 --lang=en-GB --service-sandbox-type=none --enable-audio-service-sandbox --mojo-platform-channel-handle=3792 /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1540,12121304557946197679,11161055878062121502,131072 --lang=en-GB --service-sandbox-type=none --enable-audio-service-sandbox --mojo-platform-channel-handle=3300 /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-61F4244A-1908.pma Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Automated click: Next
Source: Window Recorder Window detected: More than 3 window changes detected
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 562288 URL: https://c.mail.com/@9507565... Startdate: 28/01/2022 Architecture: WINDOWS Score: 64 29 s.uicdn.com 2->29 31 i.gyazo.com 2->31 43 Antivirus / Scanner detection for submitted sample 2->43 45 Yara detected HtmlPhish10 2->45 47 Phishing site detected (based on image similarity) 2->47 49 Phishing site detected (based on logo template match) 2->49 7 chrome.exe 15 448 2->7         started        signatures3 process4 dnsIp5 33 192.168.2.1 unknown unknown 7->33 35 239.255.255.250 unknown Reserved 7->35 19 ec76792b-097a-48ef-8860-efa82d0c2eb1.tmp, HTML 7->19 dropped 21 4be5fe68-231a-4714-bd92-311125aedb56.tmp, HTML 7->21 dropped 23 C:\...\pnacl_public_x86_64_pnacl_sz_nexe, ELF 7->23 dropped 25 2 other files (none is malicious) 7->25 dropped 11 chrome.exe 29 7->11         started        15 chrome.exe 1 7->15         started        17 chrome.exe 1 1 7->17         started        file6 process7 dnsIp8 37 uim-tifbs.ha-cdn.de 195.20.250.111, 443, 49788 ONEANDONE-ASBrauerstrasse48DE Germany 11->37 39 t-uimserv-net.ha-cdn.de 195.20.250.183, 443, 49801 ONEANDONE-ASBrauerstrasse48DE Germany 11->39 41 21 other IPs or domains 11->41 27 C:\Users\user\AppData\Localbehaviorgraphoogle\...\data_3, data 11->27 dropped file9
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
104.18.10.207
 maxcdn.bootstrapcdn.com United States
13335 CLOUDFLARENETUS false
104.19.143.111
 i.gyazo.com United States
13335 CLOUDFLARENETUS false
74.208.232.71
 cloud.mail.com United States
8560 ONEANDONE-ASBrauerstrasse48DE false
216.58.215.238
 clients.l.google.com United States
15169 GOOGLEUS false
195.20.250.111
 uim-tifbs.ha-cdn.de Germany
8560 ONEANDONE-ASBrauerstrasse48DE false
74.208.232.132
 cgateu03lxa.storage-mailcom.com United States
8560 ONEANDONE-ASBrauerstrasse48DE false
82.165.229.16
 wa.mail.com Germany
8560 ONEANDONE-ASBrauerstrasse48DE false
104.18.11.207
 stackpath.bootstrapcdn.com United States
13335 CLOUDFLARENETUS false
239.255.255.250
 unknown Reserved
unknown unknown false
172.217.168.33
 googlehosted.l.googleusercontent.com United States
15169 GOOGLEUS false
195.20.250.183
 t-uimserv-net.ha-cdn.de Germany
8560 ONEANDONE-ASBrauerstrasse48DE false
104.16.18.94
 cdnjs.cloudflare.com United States
13335 CLOUDFLARENETUS false
142.250.203.109
 accounts.google.com United States
15169 GOOGLEUS false

Private

IP
192.168.2.1
127.0.0.1

Contacted Domains

Name IP Active
stackpath.bootstrapcdn.com 104.18.11.207 true
accounts.google.com 142.250.203.109 true
cloud.mail.com 74.208.232.71 true
i.gyazo.com 104.19.143.111 true
cdnjs.cloudflare.com 104.16.18.94 true
maxcdn.bootstrapcdn.com 104.18.10.207 true
uim-tifbs.ha-cdn.de 195.20.250.111 true
clients.l.google.com 216.58.215.238 true
t-uimserv-net.ha-cdn.de 195.20.250.183 true
googlehosted.l.googleusercontent.com 172.217.168.33 true
wa.mail.com 82.165.229.16 true
cgateu03lxa.storage-mailcom.com 74.208.232.132 true
t.uimserv.net unknown unknown
uim.tifbs.net unknown unknown
clients2.googleusercontent.com unknown unknown
c.mail.com unknown unknown
clients2.google.com unknown unknown
s.uicdn.com unknown unknown
code.jquery.com unknown unknown
cgateu03maus.storage-mailcom.com unknown unknown
img.ui-portal.de unknown unknown
dl.mail.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://wa.mail.com/wa/t.gif?timestamp=1643390031074&software=ngcc&softwareversion=3.0.5786&brand=mailcom&section=cloud.start&trackingtype=ev&contentposition=en&source=shareexternalsingle&destination=shareread&profileblocked=1&environment=standalone&libname=%40poseidon%2Ftracklib&libversion=3.7.0&attributeset=1&signature=13746 false
    		high
    https://c.mail.com/@950756523062077283/jXK93RHJTd6QHf_mxRpglQ false
      		high
      https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js false
        		high
        https://wa.mail.com/wa/t.gif?timestamp=1643390041407&software=ngcc&softwareversion=3.0.5786&brand=mailcom&section=cloud.download.start&trackingtype=cl&eventposition=filelist_directaction&source=shareexternalsingle&destination=shareread&profileblocked=1&environment=standalone&libname=%40poseidon%2Ftracklib&libversion=3.7.0&attributeset=1&signature=10594 false
          		high
          https://i.gyazo.com/b308246805567e68aad040e42c453a7f.png false
            		high
            https://c.mail.com/restfs/guest/@950756523062077283/share/jXK93RHJTd6QHf_mxRpglQ/shareinfo?option=thumbnails&option=metadata&option=displayresource&option=props false
              		high
              https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js false
                		high
                https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-GB&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 false
                  		high
                  https://wa.mail.com/wa/t.gif?timestamp=1643390038276&software=ngcc&softwareversion=3.0.5786&brand=mailcom&section=cloud.download.start&trackingtype=cl&eventposition=filelist_directaction&source=shareexternalsingle&destination=shareread&profileblocked=1&environment=standalone&libname=%40poseidon%2Ftracklib&libversion=3.7.0&attributeset=1&signature=10604 false
                    		high
                    https://c.mail.com/restfs/guest/@950756523062077283/share/jXK93RHJTd6QHf_mxRpglQ/resourceAlias/ROOT?option=download&option=open false
                      		high
                      https://i.gyazo.com/cc41020ecb5162014937e0d1c83fa617.png false
                        		high
                        https://wa.mail.com/wa/t.gif?timestamp=1643390031030&software=ngcc&softwareversion=3.0.5786&brand=mailcom&section=general.start&trackingtype=ev&contentposition=en&source=shareexternal&destination=shareread&result=21000127&profileblocked=1&environment=standalone&libname=%40poseidon%2Ftracklib&libversion=3.7.0&attributeset=1&signature=14462 false
                          		high
                          https://c.mail.com/@950756523062077283/jXK93RHJTd6QHf_mxRpglQ false
                            		high
                            https://c.mail.com/restfs/guest/@950756523062077283/share/jXK93RHJTd6QHf_mxRpglQ/resourceAlias/ROOT?option=shares&option=thumbnails&option=metadata&option=props&option=displayresource&sort=resourceType-a,ui:media.visual-a,name-a&length=1001&offset=0 false
                              		high
                              https://clients2.googleusercontent.com/crx/blobs/Acy1k0bLIjHsvnKaKN_oRpVaYYvFs25d7GKYF1WXrT6yizCMksBO0c_ggE0B6tx6HPRHe6q1GOEe3_NcIbSiGG8kXeLMUY0sAKVvC6R89zvKM13s5VqoAMZSmuUgjQL5vlygJuArQghXXE_qTL7NlQ/extension_8520_615_0_5.crx false
                                		high
                                https://uim.tifbs.net/js/53681.js false
                                • Avira URL Cloud: safe
                                		 unknown
                                https://c.mail.com/restfs/guest/@950756523062077283/share/jXK93RHJTd6QHf_mxRpglQ/resourceAlias/ROOT?option=shares&option=thumbnails&option=metadata&option=props&option=displayresource&sort=resourceType-a,ui:media.visual-a,name-a&length=201&offset=0 false
                                  		high
                                  https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard false
                                    		high
                                    https://t.uimserv.net/traffic_p/?md=mailcom&et=CP&agof=1&sc=cloud/share/root&brand=mailcom&region=com&dclass=desktop&dclient=browser&ff=b&tif=53681&tifts=2021-03-15T12:45:09Z&d=39857&anon=1 false
                                      		high
                                      file:///C:/Users/user/Downloads/Remittance%20Copy%20(1).html true
                                        		low
                                        https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css false
                                          		high
                                          https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js false
                                            		high