Windows Analysis Report
https://eccfo1.eu/1f34fac4-2ab4-4dfb-8248-a8cdec56b8f9/bS5iYWtrZXJAYnBkLm5s

Overview

General Information

Sample URL: https://eccfo1.eu/1f34fac4-2ab4-4dfb-8248-a8cdec56b8f9/bS5iYWtrZXJAYnBkLm5s
Analysis ID: 612086
Infos:

Detection

Score: 52
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Phishing site detected (based on image similarity)
No HTML title found

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: https://eccfo1.eu/1f34fac4-2ab4-4dfb-8248-a8cdec56b8f9/bS5iYWtrZXJAYnBkLm5s SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social Engineering

Phishing
barindex
Phishing site detected (based on image similarity)
Source: https://eccfo1.eu/1f34fac4-2ab4-4dfb-8248-a8cdec56b8f9/bS5iYWtrZXJAYnBkLm5s Matcher: Found strong image similarity, brand: Microsoft image: 13434.0.img.3.gfk.csv A5DBD4393FF6A725C7E62B61DF7E72F0
No HTML title found
Source: https://www.office.com/ HTTP Parser: HTML title missing
Source: https://www.office.com/ HTTP Parser: HTML title missing
Source: https://www.office.com/ HTTP Parser: No <meta name="author".. found
Source: https://www.office.com/ HTTP Parser: No <meta name="author".. found
Source: https://www.office.com/ HTTP Parser: No <meta name="copyright".. found
Source: https://www.office.com/ HTTP Parser: No <meta name="copyright".. found
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic Jump to behavior
Source: unknown HTTPS traffic detected: 185.163.85.65:443 -> 192.168.2.3:49741 version: TLS 1.2
Source: unknown HTTPS traffic detected: 185.163.85.65:443 -> 192.168.2.3:49742 version: TLS 1.2
Source: unknown DNS traffic detected: queries for: clients2.google.com
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50414
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown Network traffic detected: HTTP traffic on port 50414 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown Network traffic detected: HTTP traffic on port 50165 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50185
Source: unknown Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown Network traffic detected: HTTP traffic on port 50029 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50843 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50752
Source: unknown Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50842 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown Network traffic detected: HTTP traffic on port 50752 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50843
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50842
Source: unknown Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50054 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50165
Source: unknown Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50185 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49747
Source: global traffic HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-85.0.4183.121Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /1f34fac4-2ab4-4dfb-8248-a8cdec56b8f9/bS5iYWtrZXJAYnBkLm5s HTTP/1.1Host: eccfo1.euConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /static/windows_logo.png HTTP/1.1Host: eccfo1.euConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://eccfo1.eu/1f34fac4-2ab4-4dfb-8248-a8cdec56b8f9/bS5iYWtrZXJAYnBkLm5sAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /static/icon_check.png HTTP/1.1Host: eccfo1.euConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://eccfo1.eu/1f34fac4-2ab4-4dfb-8248-a8cdec56b8f9/bS5iYWtrZXJAYnBkLm5sAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /static/Background.jpg HTTP/1.1Host: eccfo1.euConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://eccfo1.eu/1f34fac4-2ab4-4dfb-8248-a8cdec56b8f9/bS5iYWtrZXJAYnBkLm5sAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: eccfo1.euConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://eccfo1.eu/1f34fac4-2ab4-4dfb-8248-a8cdec56b8f9/bS5iYWtrZXJAYnBkLm5sAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /static/Background.jpg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: eccfo1.eu
Source: global traffic HTTP traffic detected: GET /static/windows_logo.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: eccfo1.eu
Source: global traffic HTTP traffic detected: GET /static/icon_check.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: eccfo1.eu
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: www.office.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /meversion?partner=office&market=en-us&uhf=1 HTTP/1.1Host: mem.gfx.msConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.office.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /mscc/lib/v2/wcp-consent.js HTTP/1.1Host: wcpstatic.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.office.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /scripts/me/MeControl/10.21162.3/en-US/meBoot.min.js HTTP/1.1Host: mem.gfx.msConnection: keep-aliveOrigin: https://www.office.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.office.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /sw?cdnDomain=res.cdn.office.net/officehub&workload=officehome HTTP/1.1Host: www.office.comConnection: keep-aliveCache-Control: max-age=0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Service-Worker: scriptSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: serviceworkerReferer: https://www.office.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: OH.SID=f0c36293-6b4d-4da0-acec-3188508b41e6; OH.DCAffinity=OH-weu; OH.FLID=dcc9a78d-5ce4-4bf8-bc2c-2745c3d2072c; MUID=0AB22FE83C71638E10A33E643D0A6238; MSFPC=GUID=587d50bfc2a149aca238a67d4b7ec83d&HASH=587d&LV=202204&V=4&LU=1650459569395
Source: global traffic HTTP traffic detected: GET /scripts/me/MeControl/10.21162.3/en-US/meCore.min.js HTTP/1.1Host: mem.gfx.msConnection: keep-aliveOrigin: https://www.office.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.office.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /c.gif?DI=4050&did=1&t=&CtsSyncId=B1BED8FFFBD34A5C951B4273A8E67A1D&RedC=c1.microsoft.com&MXFR=376D41D8FED76C0E172E5054FAD76A18 HTTP/1.1Host: c.bing.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.office.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /crx/blobs/Acy1k0bLIjHsvnKaKN_oRpVaYYvFs25d7GKYF1WXrT6yizCMksBO0c_ggE0B6tx6HPRHe6q1GOEe3_NcIbSiGG8kXeLMUY0sAKVvC6R89zvKM13s5VqoAMZSmuUgjQL5vlygJuArQghXXE_qTL7NlQ/extension_8520_615_0_5.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /meversion?partner=MSHomePage&market=de-ch&uhf=1 HTTP/1.1Host: mem.gfx.msConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.microsoft.com/de-ch/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /scripts/me/MeControl/10.21162.3/de-DE/meBoot.min.js HTTP/1.1Host: mem.gfx.msConnection: keep-aliveOrigin: https://www.microsoft.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.microsoft.com/de-ch/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /scripts/me/MeControl/10.21162.3/de-DE/meCore.min.js HTTP/1.1Host: mem.gfx.msConnection: keep-aliveOrigin: https://www.microsoft.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.microsoft.com/de-ch/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /meversion?partner=officetemplates&market=en-us&uhf=1 HTTP/1.1Host: mem.gfx.msConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://templates.office.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /meversion?partner=SMCConvergence&market=en-us&uhf=1 HTTP/1.1Host: mem.gfx.msConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://support.microsoft.com/en-us/office?ui=en-us&rs=en-us&ad=usAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Apr 2022 12:59:22 GMTContent-Type: text/html; charset=utf-8Content-Length: 77Connection: closeX-Frame-Options: SAMEORIGIN
Source: 1c24b8db-b3a5-4ee8-bec0-cf737a423ed5.tmp.1.dr, b549085d-74d3-46da-a233-cd98b3b9bbd4.tmp.1.dr String found in binary or memory: https://accounts.google.com
Source: 2cc80dabc69f58b6_1.0.dr String found in binary or memory: https://api.onedrive.com/v1.0/drive/root
Source: 1c24b8db-b3a5-4ee8-bec0-cf737a423ed5.tmp.1.dr, b549085d-74d3-46da-a233-cd98b3b9bbd4.tmp.1.dr String found in binary or memory: https://apis.google.com
Source: 1c24b8db-b3a5-4ee8-bec0-cf737a423ed5.tmp.1.dr, b549085d-74d3-46da-a233-cd98b3b9bbd4.tmp.1.dr String found in binary or memory: https://clients2.google.com
Source: manifest.json.0.dr String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 1c24b8db-b3a5-4ee8-bec0-cf737a423ed5.tmp.1.dr, b549085d-74d3-46da-a233-cd98b3b9bbd4.tmp.1.dr String found in binary or memory: https://clients2.googleusercontent.com
Source: 1c24b8db-b3a5-4ee8-bec0-cf737a423ed5.tmp.1.dr, c7ba09d0-7de1-45fe-8a56-3a1f445c67f0.tmp.1.dr, b549085d-74d3-46da-a233-cd98b3b9bbd4.tmp.1.dr String found in binary or memory: https://dns.google
Source: History Provider Cache.0.dr String found in binary or memory: https://eccfo1.eu/1f34fac4-2ab4-4dfb-8248-a8cdec56b8f9/bS5iYWtrZXJAYnBkLm5s2
Source: 1c24b8db-b3a5-4ee8-bec0-cf737a423ed5.tmp.1.dr String found in binary or memory: https://fonts.googleapis.com
Source: 1c24b8db-b3a5-4ee8-bec0-cf737a423ed5.tmp.1.dr, b549085d-74d3-46da-a233-cd98b3b9bbd4.tmp.1.dr String found in binary or memory: https://fonts.gstatic.com
Source: 1c24b8db-b3a5-4ee8-bec0-cf737a423ed5.tmp.1.dr, b549085d-74d3-46da-a233-cd98b3b9bbd4.tmp.1.dr String found in binary or memory: https://ogs.google.com
Source: manifest.json.0.dr String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: 1c24b8db-b3a5-4ee8-bec0-cf737a423ed5.tmp.1.dr, b549085d-74d3-46da-a233-cd98b3b9bbd4.tmp.1.dr String found in binary or memory: https://play.google.com
Source: b549085d-74d3-46da-a233-cd98b3b9bbd4.tmp.1.dr String found in binary or memory: https://r5---sn-4g5edn6r.gvt1.com
Source: b549085d-74d3-46da-a233-cd98b3b9bbd4.tmp.1.dr String found in binary or memory: https://redirector.gvt1.com
Source: c4cda97bb6908608_0.0.dr String found in binary or memory: https://res.cdn.office.net/officehub/bundles/0.1084f963ccf1e5efe263.chunk.v6.jsH
Source: c4cda97bb6908608_0.0.dr String found in binary or memory: https://res.cdn.office.net/officehub/bundles/0.1084f963ccf1e5efe263.chunk.v6.jsHP
Source: 1e33ede7037c06b6_0.0.dr String found in binary or memory: https://res.cdn.office.net/officehub/bundles/1.fd278158fa9d8b20bceb.chunk.v6.jsH
Source: 1e33ede7037c06b6_0.0.dr String found in binary or memory: https://res.cdn.office.net/officehub/bundles/1.fd278158fa9d8b20bceb.chunk.v6.jsHP
Source: ef132878ad19e2a9_0.0.dr String found in binary or memory: https://res.cdn.office.net/officehub/bundles/11.798076ff0c72108d10d9.chunk.v6.js/
Source: ef132878ad19e2a9_0.0.dr String found in binary or memory: https://res.cdn.office.net/officehub/bundles/11.798076ff0c72108d10d9.chunk.v6.jsH
Source: ef132878ad19e2a9_0.0.dr String found in binary or memory: https://res.cdn.office.net/officehub/bundles/11.798076ff0c72108d10d9.chunk.v6.jsHP
Source: d2ec45260bc56989_0.0.dr String found in binary or memory: https://res.cdn.office.net/officehub/bundles/2.56c3466450fa3caeadef.chunk.v6.js(window.officehome_we
Source: d2ec45260bc56989_0.0.dr String found in binary or memory: https://res.cdn.office.net/officehub/bundles/2.56c3466450fa3caeadef.chunk.v6.jsH
Source: d2ec45260bc56989_0.0.dr String found in binary or memory: https://res.cdn.office.net/officehub/bundles/2.56c3466450fa3caeadef.chunk.v6.jsHP
Source: a550abe32264d142_0.0.dr String found in binary or memory: https://res.cdn.office.net/officehub/bundles/3.ea9cbde63ad89ac51218.chunk.v6.jsH
Source: a550abe32264d142_0.0.dr String found in binary or memory: https://res.cdn.office.net/officehub/bundles/3.ea9cbde63ad89ac51218.chunk.v6.jsHP
Source: 78f8433443804b69_0.0.dr String found in binary or memory: https://res.cdn.office.net/officehub/bundles/4.34c0ddb1f9655892d176.chunk.v6.js(window.officehome_we
Source: 78f8433443804b69_0.0.dr String found in binary or memory: https://res.cdn.office.net/officehub/bundles/4.34c0ddb1f9655892d176.chunk.v6.jsH
Source: 78f8433443804b69_0.0.dr String found in binary or memory: https://res.cdn.office.net/officehub/bundles/4.34c0ddb1f9655892d176.chunk.v6.jsHP
Source: 3a82c52a9f5c535e_0.0.dr String found in binary or memory: https://res.cdn.office.net/officehub/bundles/6.bb3c64a464eb6c7e03fb.chunk.v6.jsH
Source: 3a82c52a9f5c535e_0.0.dr String found in binary or memory: https://res.cdn.office.net/officehub/bundles/6.bb3c64a464eb6c7e03fb.chunk.v6.jsHP
Source: d41d89949079b45d_0.0.dr String found in binary or memory: https://res.cdn.office.net/officehub/bundles/7.9525c69adf30ccb6bbe7.chunk.v6.jsH
Source: d41d89949079b45d_0.0.dr String found in binary or memory: https://res.cdn.office.net/officehub/bundles/7.9525c69adf30ccb6bbe7.chunk.v6.jsHP
Source: 2cd1b97aa306dd0f_0.0.dr String found in binary or memory: https://res.cdn.office.net/officehub/bundles/officehome-async-styles.905b2cdbf3c642aad946.chunk.v6.j
Source: 3e87be93f887937a_0.0.dr String found in binary or memory: https://res.cdn.office.net/officehub/bundles/officehome-async-styles.c8a41d69674f50299790.chunk.v6.c
Source: 9bb2c13ad1549e8b_1.0.dr String found in binary or memory: https://res.cdn.office.net/officehub/bundles/otel-logger-2b087f173d4bf7a684cc.js
Source: 9bb2c13ad1549e8b_0.0.dr String found in binary or memory: https://res.cdn.office.net/officehub/bundles/otel-logger-2b087f173d4bf7a684cc.js/
Source: 9bb2c13ad1549e8b_0.0.dr String found in binary or memory: https://res.cdn.office.net/officehub/bundles/otel-logger-2b087f173d4bf7a684cc.jsH
Source: 9bb2c13ad1549e8b_0.0.dr String found in binary or memory: https://res.cdn.office.net/officehub/bundles/otel-logger-2b087f173d4bf7a684cc.jsHP
Source: 9bb2c13ad1549e8b_1.0.dr String found in binary or memory: https://res.cdn.office.net/officehub/bundles/otel-logger-2b087f173d4bf7a684cc.jsa
Source: 9bb2c13ad1549e8b_1.0.dr String found in binary or memory: https://res.cdn.office.net/officehub/bundles/otel-logger-2b087f173d4bf7a684cc.jsaD
Source: 35e53ccd3cabf975_0.0.dr String found in binary or memory: https://res.cdn.office.net/officehub/bundles/vendors~action-context-menu-rc~app-gallery-rc~appbar~cc
Source: 0e751cd85ef9bf6a_0.0.dr String found in binary or memory: https://res.cdn.office.net/officehub/bundles/vendors~action-context-menu-rc~app-host-component~appba
Source: 52ee4db59ff83c5f_0.0.dr String found in binary or memory: https://res.cdn.office.net/officehub/bundles/vendors~app-host-component~appbar~cc~confirmation-dialo
Source: fa813c9ad67834ac_1.0.dr String found in binary or memory: https://res.cdn.office.net/officehub/versionless/workbox-v3.6.2/workbox-cache-expiration.prod.jsa
Source: fa813c9ad67834ac_1.0.dr String found in binary or memory: https://res.cdn.office.net/officehub/versionless/workbox-v3.6.2/workbox-cache-expiration.prod.jsaD
Source: f1cdccba37924bda_1.0.dr String found in binary or memory: https://res.cdn.office.net/officehub/versionless/workbox-v3.6.2/workbox-core.prod.jsa
Source: f1cdccba37924bda_1.0.dr String found in binary or memory: https://res.cdn.office.net/officehub/versionless/workbox-v3.6.2/workbox-core.prod.jsaD
Source: ba23d8ecda68de77_1.0.dr String found in binary or memory: https://res.cdn.office.net/officehub/versionless/workbox-v3.6.2/workbox-routing.prod.js
Source: ba23d8ecda68de77_1.0.dr String found in binary or memory: https://res.cdn.office.net/officehub/versionless/workbox-v3.6.2/workbox-routing.prod.jsaD
Source: 67a473248953641b_1.0.dr String found in binary or memory: https://res.cdn.office.net/officehub/versionless/workbox-v3.6.2/workbox-strategies.prod.js
Source: 67a473248953641b_1.0.dr String found in binary or memory: https://res.cdn.office.net/officehub/versionless/workbox-v3.6.2/workbox-strategies.prod.jsaD
Source: 4cb013792b196a35_1.0.dr String found in binary or memory: https://res.cdn.office.net/officehub/versionless/workbox-v3.6.2/workbox-sw.js
Source: 4cb013792b196a35_1.0.dr String found in binary or memory: https://res.cdn.office.net/officehub/versionless/workbox-v3.6.2/workbox-sw.jsaD
Source: manifest.json.0.dr String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: 1c24b8db-b3a5-4ee8-bec0-cf737a423ed5.tmp.1.dr, b549085d-74d3-46da-a233-cd98b3b9bbd4.tmp.1.dr String found in binary or memory: https://ssl.gstatic.com
Source: 4cb013792b196a35_1.0.dr String found in binary or memory: https://storage.googleapis.com/workbox-cdn/releases/3.6.3
Source: 1c24b8db-b3a5-4ee8-bec0-cf737a423ed5.tmp.1.dr, b549085d-74d3-46da-a233-cd98b3b9bbd4.tmp.1.dr String found in binary or memory: https://www.google.com
Source: manifest.json.0.dr String found in binary or memory: https://www.google.com/
Source: 1c24b8db-b3a5-4ee8-bec0-cf737a423ed5.tmp.1.dr, b549085d-74d3-46da-a233-cd98b3b9bbd4.tmp.1.dr String found in binary or memory: https://www.googleapis.com
Source: manifest.json.0.dr String found in binary or memory: https://www.googleapis.com/
Source: manifest.json.0.dr String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json.0.dr String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json.0.dr String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json.0.dr String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: 1c24b8db-b3a5-4ee8-bec0-cf737a423ed5.tmp.1.dr, b549085d-74d3-46da-a233-cd98b3b9bbd4.tmp.1.dr String found in binary or memory: https://www.gstatic.com
Source: index.txt.tmp.0.dr String found in binary or memory: https://www.office.com/
Source: History Provider Cache.0.dr String found in binary or memory: https://www.office.com/2#Office
Source: 2cc80dabc69f58b6_1.0.dr String found in binary or memory: https://www.office.com/sw?cdnDomain=res.cdn.office.net/officehub&workload=officehomea
Source: 2cc80dabc69f58b6_1.0.dr String found in binary or memory: https://www.office.com/sw?cdnDomain=res.cdn.office.net/officehub&workload=officehomeaD
Source: unknown HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: unknown HTTPS traffic detected: 185.163.85.65:443 -> 192.168.2.3:49741 version: TLS 1.2
Source: unknown HTTPS traffic detected: 185.163.85.65:443 -> 192.168.2.3:49742 version: TLS 1.2
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Local\Temp\1234a213-2489-4cfd-b9c7-327623f08c31.tmp Jump to behavior
Source: classification engine Classification label: mal52.phis.win@32/110@24/12
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "https://eccfo1.eu/1f34fac4-2ab4-4dfb-8248-a8cdec56b8f9/bS5iYWtrZXJAYnBkLm5s
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1588,15692047485436063496,8923512637063361634,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1944 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1588,15692047485436063496,8923512637063361634,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1944 /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Program Files\Google\Chrome\Application\Dictionaries Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-62608233-798.pma Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Automated click: Accept
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Automated click: Accept
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Automated click: Accept
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 612086 URL: https://eccfo1.eu/1f34fac4-... Startdate: 20/04/2022 Architecture: WINDOWS Score: 52 13 templates.office.com 2->13 15 support.office.com 2->15 17 17 other IPs or domains 2->17 29 Antivirus / Scanner detection for submitted sample 2->29 31 Phishing site detected (based on image similarity) 2->31 7 chrome.exe 13 252 2->7         started        signatures3 process4 dnsIp5 19 192.168.2.1 unknown unknown 7->19 21 239.255.255.250 unknown Reserved 7->21 10 chrome.exe 311 7->10         started        process6 dnsIp7 23 part-0032.t-0009.fbs1-t-msedge.net 13.107.219.60, 443, 49774, 49787 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 10->23 25 part-0032.t-0009.t-msedge.net 13.107.246.60, 443, 49775 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 10->25 27 33 other IPs or domains 10->27
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
13.107.6.156
 b-0004.b-msedge.net United States
8068 MICROSOFT-CORP-MSN-AS-BLOCKUS false
13.107.219.60
 part-0032.t-0009.fbs1-t-msedge.net United States
8068 MICROSOFT-CORP-MSN-AS-BLOCKUS false
204.79.197.200
 dual-a-0001.a-msedge.net United States
8068 MICROSOFT-CORP-MSN-AS-BLOCKUS false
142.250.185.205
 accounts.google.com United States
15169 GOOGLEUS false
13.107.246.60
 part-0032.t-0009.t-msedge.net United States
8068 MICROSOFT-CORP-MSN-AS-BLOCKUS false
185.163.85.65
 eccfo1.eu Sweden
12552 IPO-EUSE false
142.250.185.65
 googlehosted.l.googleusercontent.com United States
15169 GOOGLEUS false
239.255.255.250
 unknown Reserved
unknown unknown false
142.250.184.238
 clients.l.google.com United States
15169 GOOGLEUS false
15.236.176.210
 microsoftwindows.112.2o7.net United States
16509 AMAZON-02US false

Private

IP
192.168.2.1
127.0.0.1

Contacted Domains

Name IP Active
sni1gl.wpc.gammacdn.net 152.199.21.175 true
accounts.google.com 142.250.185.205 true
eccfo1.eu 185.163.85.65 true
dual-a-0001.a-msedge.net 204.79.197.200 true
microsoftwindows.112.2o7.net 15.236.176.210 true
sni1gl.wpc.alphacdn.net 152.199.21.175 true
part-0017.t-0009.fbs1-t-msedge.net 13.107.219.45 true
b-0004.b-msedge.net 13.107.6.156 true
part-0032.t-0009.t-msedge.net 13.107.246.60 true
HHN-efz.ms-acdc.office.com 52.98.175.2 true
part-0032.t-0009.fbs1-t-msedge.net 13.107.219.60 true
cs1227.wpc.alphacdn.net 192.229.221.185 true
clients.l.google.com 142.250.184.238 true
FRA-efz.ms-acdc.office.com 52.98.207.226 true
googlehosted.l.googleusercontent.com 142.250.185.65 true
consentreceiverfd-prod.azurefd.net unknown unknown
www.office.com unknown unknown
support.office.com unknown unknown
outlook.office.com unknown unknown
substrate.office.com unknown unknown
assets.onestore.ms unknown unknown
ajax.aspnetcdn.com unknown unknown
mem.gfx.ms unknown unknown
clients2.googleusercontent.com unknown unknown
static2.sharepointonline.com unknown unknown
c.s-microsoft.com unknown unknown
clients2.google.com unknown unknown
templates.office.com unknown unknown
support.content.office.net unknown unknown
login.microsoftonline.com unknown unknown
portal.office.com unknown unknown
acctcdn.msftauth.net unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://www.office.com/ false
    		high
    https://mem.gfx.ms/meversion?partner=office&market=en-us&uhf=1 false
    • Avira URL Cloud: safe
    		 unknown
    https://eccfo1.eu/static/icon_check.png false
    • Avira URL Cloud: safe
    		 unknown
    https://www.office.com/ false
      		high
      https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 false
        		high
        https://eccfo1.eu/favicon.ico false
        • Avira URL Cloud: safe
        		 unknown
        https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard false
          		high
          https://mem.gfx.ms/meversion?partner=officetemplates&market=en-us&uhf=1 false
          • Avira URL Cloud: safe
          		 unknown
          https://eccfo1.eu/1f34fac4-2ab4-4dfb-8248-a8cdec56b8f9/bS5iYWtrZXJAYnBkLm5s true
            		unknown
            https://mem.gfx.ms/meversion?partner=SMCConvergence&market=en-us&uhf=1 false
            • URL Reputation: safe
            		 unknown
            https://mem.gfx.ms/scripts/me/MeControl/10.21162.3/de-DE/meBoot.min.js false
            • URL Reputation: safe
            		 unknown
            https://templates.office.com/ false
              		high
              https://mem.gfx.ms/scripts/me/MeControl/10.21162.3/de-DE/meCore.min.js false
              • URL Reputation: safe
              		 unknown
              https://clients2.googleusercontent.com/crx/blobs/Acy1k0bLIjHsvnKaKN_oRpVaYYvFs25d7GKYF1WXrT6yizCMksBO0c_ggE0B6tx6HPRHe6q1GOEe3_NcIbSiGG8kXeLMUY0sAKVvC6R89zvKM13s5VqoAMZSmuUgjQL5vlygJuArQghXXE_qTL7NlQ/extension_8520_615_0_5.crx false
                		high
                https://eccfo1.eu/static/Background.jpg false
                • Avira URL Cloud: safe
                		 unknown
                https://mem.gfx.ms/scripts/me/MeControl/10.21162.3/en-US/meBoot.min.js false
                • URL Reputation: safe
                		 unknown
                https://eccfo1.eu/static/windows_logo.png false
                • Avira URL Cloud: safe
                		 unknown
                https://mem.gfx.ms/scripts/me/MeControl/10.21162.3/en-US/meCore.min.js false
                • URL Reputation: safe
                		 unknown
                https://eccfo1.eu/1f34fac4-2ab4-4dfb-8248-a8cdec56b8f9/bS5iYWtrZXJAYnBkLm5s true
                  		unknown
                  https://mem.gfx.ms/meversion?partner=MSHomePage&market=de-ch&uhf=1 false
                  • URL Reputation: safe
                  		 unknown