Windows Analysis Report
http://document--1111011111.company.com/

Overview

General Information

Sample URL: http://document--1111011111.company.com/
Analysis ID: 635117
Infos:

Detection

HTMLPhisher
Score: 56
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Yara detected HtmlPhish20

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: http://document--1111011111.company.com/ SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social Engineering

Phishing
barindex
Yara detected HtmlPhish20
Source: Yara match File source: 25855.0.pages.csv, type: HTML
Source: unknown DNS traffic detected: queries for: accounts.google.com
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 27 May 2022 12:31:06 GMTServer: ApacheSet-Cookie: is_mobile=0; path=/; domain=document--1111011111.company.comVary: X-W-SSL,Accept-Encoding,User-AgentSet-Cookie: language=en; expires=Fri, 10-Jun-2022 12:31:06 GMT; Max-Age=1209600; path=/Cache-Control: privateETag: W/"9c914c4469a59d58104fecad7951b405-gzip"Content-Encoding: gzipX-Host: blu105.sf2p.intern.weebly.netX-UA-Compatible: IE=edge,chrome=1Content-Length: 5871Keep-Alive: timeout=10, max=72Connection: Keep-AliveContent-Type: text/html; charset=UTF-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 3c fd 77 db 46 8e 3f 5b ef ed ff 30 65 bb a5 dc 88 a2 64 4b fe d0 57 cf 71 dc 6e fa da c4 1b 3b d7 db 8b b3 7a 23 72 24 31 a6 48 86 a4 2c eb 5c fd ef 07 60 86 5f 12 e5 8f a6 e9 de de 8b db 48 e4 0c 80 c1 60 00 0c 06 04 d5 fb ea c5 eb d3 cb 7f 9c 9f b1 69 3c 73 07 95 1e 7e 31 97 7b 93 be 26 3c 6d 50 d9 e9 4d 05 b7 e1 7b a7 17 3b b1 2b 06 cf a1 f3 9a 5d e2 35 33 d8 df fc 99 e8 99 b2 a7 37 13 31 67 41 e8 07 22 8c 97 7d cd 9f 74 22 27 16 43 8f cf 84 c6 2c df 8b 85 17 f7 b5 1c 01 8d 99 30 e4 26 5a 2c 3b 9f 82 62 8b c8 0a 9d 20 76 7c ef 69 88 ce 8c 4f f2 63 4d e3 38 e8 98 a6 ed 5b f3 19 34 18 46 13 fe 1a f8 d1 ac 5b fe 2c e0 de 12 bf cd 79 e0 fa dc 8e cc a6 d9 82 7f 47 66 b3 d5 3c 6a 35 9a 47 07 66 13 38 11 c2 8b a6 7e 6c ec 35 f6 9a 46 a3 65 ec 1d 18 3c 36 9a c7 46 fb 18 da 0c 3f 74 26 d9 c7 10 3f ea 81 37 f9 f3 78 14 b6 13 fb a1 b9 f7 00 ab cd bd 8c 4b 64 f0 fb e6 41 7b af 75 d0 38 6a ec ff 79 bc ee 07 76 f0 04 61 cd 43 f7 77 0c 4f d4 2a 3d d7 01 7d 09 85 db d7 1c 0b 35 29 5e 06 02 ae 71 4e 26 8d 39 0d c5 b8 af 99 e6 62 b1 a8 2f 84 18 b9 45 ee 43 11 09 d7 15 a1 c9 a3 48 c4 91 b9 df 3e 38 3c 68 1d 1d b7 8d 31 bf 41 92 75 f8 90 63 55 14 f3 c8 a1 21 3e ce 9d 9b be 76 2a d9 36 2e 61 d8 dc 24 62 71 1b 9b 68 99 5d 66 4d 79 08 94 fb f3 78 6c 1c 11 21 c6 24 1d 34 b3 be 76 e3 88 45 e0 87 71 0e 7b e1 d8 f1 b4 6f 0b 18 5f 18 74 53 63 8e e7 c4 0e 77 8d c8 e2 ae e8 37 eb 0d c9 d3 ce 0e 1a 3a 09 c1 b1 01 13 ed d7 18 f1 48 18 51 bc 44 1b 22 d1 d0 75 34 15 22 4e 04 44 0c 5a 51 94 c9 c7 b2 bd bd 3a 6a d9 6c 89 44 48 48 00 60 e2 4d 54 87 ab ef 47 73 c7 b5 2f 1d 60 1a 94 0a d6 f9 e0 e8 48 29 55 b6 08 9f 32 92 ef da e6 98 7b d6 72 e4 df d2 80 9f 67 98 c8 b7 50 90 b8 b6 b9 79 c5 eb f3 9a 01 2a 87 91 c8 de 6a a0 b0 1f 84 25 9d d5 93 59 19 3b 00 61 ce b8 e3 0d 09 3a 99 1c 18 66 f3 a0 d1 02 3c f4 77 c9 ea c5 53 31 13 06 e1 a7 23 11 21 dd 34 c7 a0 22 51 7d e2 fb 13 57 f0 c0 89 92 49 7d 3f e6 33 c7 5d f6 7f c1 7e 11 86 3c ee b4 1a 8d da 61 a3 f1 6d 34 1f a1 fa b9 3c 76 bc 1a 7d 1a c0 9f 4e cc eb 19 f3 ba 64 5e 4f 98 d7 a5 79 11 c0 7a d7 Data Ascii: <wF?[0edKWqn;z#r$1H,\`_H`i<s~1{&<mPM{;+]5371gA"}t"'C,0&Z,;b v|iOcM8[4F[,yGf<j5Gf8~l5Fe<6F?t&?7xKdA{u8jyvaCwO*=}
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginxContent-Type: text/cssLast-Modified: Thu, 19 May 2022 17:44:26 GMTETag: W/"628681fa-347ac"Expires: Fri, 03 Jun 2022 19:57:18 GMTCache-Control: max-age=1209600X-Host: grn89.sf2p.intern.weebly.netContent-Encoding: gzipVia: 1.1 varnish, 1.1 varnishContent-Length: 29746Accept-Ranges: bytesDate: Fri, 27 May 2022 12:31:06 GMTAge: 578029Connection: keep-aliveX-Served-By: cache-sjc10034-SJC, cache-mxp6924-MXPX-Cache: HIT, HITX-Cache-Hits: 1, 75X-Timer: S1653654667.651470,VS0,VE0Vary: Accept-EncodingAccess-Control-Allow-Origin: *Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ec bd 8b 92 e3 b8 91 28 fa 2b 3c 55 d1 31 5d b3 a2 9a e2 43 8f 52 78 8e 3d 63 cf ae 23 76 6d c7 f1 9e bd 27 ee b1 a3 83 92 a8 2a ba 29 51 4b 4a f5 b0 a2 fe fd e2 49 26 5e 24 48 51 35 33 77 ba 35 3d 2d 91 40 22 91 48 20 13 89 44 e6 6f bf 24 af db 22 de 25 a5 53 1e d2 fd d9 fb 70 3e 16 f1 be dc e6 c5 ee be c8 8f f1 31 f9 e8 6d 92 87 bb b7 89 a7 7b 17 4c e9 db b7 4f df fe 0f e7 7f 25 db 2c 79 71 9e 26 e3 68 ec 39 ae f3 78 3c 1e ca fb 4f 9f 1e d2 e3 e3 69 35 5e e7 bb 4f 59 92 fc 23 2f 36 f1 fe 53 41 0b 7f fb 69 fc 50 a4 9b f3 26 2d 0f 59 fc 7a 9f ee b3 74 9f b8 ab 2c 5f 7f 59 f2 87 ee ae 74 71 e9 55 fe 52 3d c3 bf 97 df 8a d5 96 ff cc f3 dd fd 64 c9 cb bb cf 45 7c b8 c7 ff 5b 4a 3f 0f f1 66 93 ee 1f ee bd e5 2e 2e 1e d2 3d fa 72 c8 cb f4 98 e6 fb fb 22 c9 e2 63 fa 94 2c 9f d3 cd f1 f1 1e 77 1c 95 42 b5 eb 9f 59 72 3c 26 85 5b 1e e2 35 86 e2 7a e3 60 92 ec 9c ff 91 ee 0e 79 71 8c f7 c7 e5 b7 52 91 3d 22 5a 9c c1 12 cf 88 0e 10 42 18 88 10 b2 b4 3c ba e5 f1 35 4b dc e3 eb 21 41 10 f6 c9 1b 21 d6 fd 2a 41 63 90 8c e8 8f 78 8b da 39 6b 9b 13 db e0 cf 1e d3 63 42 1e 26 fc 91 d8 3b da 88 f3 ad d0 0c fa 79 79 43 0c 32 1d 71 3e 48 f7 13 67 e2 c4 a7 63 be 14 7e 71 2c ce 68 d0 dd 32 fd 27 06 bc 42 ad a0 b6 d1 93 66 1c f5 55 fe ef 3a 8b cb f2 db df dc e0 b2 9f 3f af f3 cc bd f9 fb 95 18 6f 93 16 c9 9a 70 13 6a e6 b4 db 2f f5 4f 2f 1a b5 46 86 7d 4a 8a 63 ba 8e 33 37 ce d2 87 fd fd 31 af 79 7e e2 1d 18 fd 10 11 92 2c 3b ab 80 78 ef 28 35 da 46 8a 92 e9 94 65 e5 ba 48 92 bd 03 60 8f d0 42 91 1f e1 93 b3 cc 68 74 24 26 3e 78 b1 fc 96 7e 5f 2c c6 0b b1 d4 84 95 5a 4c c6 53 f4 67 56 17 45 8b 0e 79 20 14 f7 58 f1 79 30 0e f0 9f aa 38 7a e0 93 07 b0 f8 82 95 9e 45 55 b9 59 28 61 30 67 65 a6 53 09 01 f4 40 45 60 c6 4a 47 73 a9 7d f4 40 6d 7f ca 4b d7 14 08 65 0a 44 ac 4c 28 13 20 d4 11 20 64 a5 03 b9 ff 81 ae ff 01 2b ed d7 fd f7 e5 fe 57 c3 24 f7 7f a2 eb 3f 1f 2e b9 fb 55 ef 7f bb 4b 36 69 ec 7c dc a5 7b b6 02 39 e1 1c f1 e7 dd 19 40 79 29 2d d9 03 17 ec c6 21 b8 46 37 26 41 35 6c f8 04 15 eb c6 2a a8 42 37 6e 41 15 6c 18 06 15 eb c6 33 a8 42 37 b6 41 15 6c 38 07 15 eb c6 3c 78 6c da f8 47 cb 40 5e b2 13 f8 a7 dc 59 f2 0f 2e d8 8d 7f 70 8d 6e fc 83 6a d8 f0 0f 2a d6 8d 7f Data Ascii: (+<U1]CRx=c#vm'*)QKJI&^$HQ53w5=-@"H Do$"%Sp>1m{LO%,yq&h9x<O
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginxContent-Type: text/cssLast-Modified: Thu, 19 May 2022 17:44:26 GMTETag: W/"628681fa-3319"Expires: Fri, 03 Jun 2022 19:57:20 GMTCache-Control: max-age=1209600X-Host: blu86.sf2p.intern.weebly.netContent-Encoding: gzipVia: 1.1 varnish, 1.1 varnishContent-Length: 1640Accept-Ranges: bytesDate: Fri, 27 May 2022 12:31:06 GMTAge: 578026Connection: keep-aliveX-Served-By: cache-sjc10031-SJC, cache-mxp6937-MXPX-Cache: HIT, HITX-Cache-Hits: 1, 1479X-Timer: S1653654667.652356,VS0,VE0Vary: Accept-EncodingAccess-Control-Allow-Origin: *Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 5a cb 72 ea 38 10 dd cf 57 64 c8 e6 a6 2a 24 d8 10 02 a6 a6 66 fe 61 b6 b3 91 6d 01 2a 6c 8b b1 45 08 37 95 7f 1f c9 f2 83 47 4b 6a 1b d7 5d 4d 56 29 bb cf e9 a3 3e 46 ef bf d6 3c 13 e3 35 89 e8 57 f5 5f ca 92 53 30 3a 16 3c 62 24 19 ad 8a 3c 0a 0e 79 f2 e3 f5 35 8a 33 ff 85 c6 4c a4 a7 82 09 fa 12 f1 f4 55 61 8a d7 e3 df 65 f0 6b 05 7a a1 5c fc 29 8a 3f bc f9 9b bf 5c f8 fe 7c be 98 2f 9e 06 63 7a 64 74 cd 3e 9f 1e d6 3c 4f 89 f8 31 a2 69 48 e3 98 c6 63 be a7 99 38 ed e9 e8 e9 b9 6b 9e 23 5f af 6f 25 37 29 d4 eb 1e ac 42 d8 48 45 7e a0 3d e5 16 1f 9b db b2 54 2f db 04 32 6a f4 b4 2a 6d 3d 52 b6 d9 8a 20 53 6f 12 fd a8 10 a7 84 56 4f be 5f 8e 2a e3 58 33 8c e3 9c 85 61 28 df 86 54 72 d1 af 48 c6 cb d2 06 a3 7f e8 7c 12 8d ea 68 a9 6f bc cf 79 7c 88 44 47 64 15 1d f1 84 e7 0f 9d 72 af 4a 4c f0 b8 9e bc bf 93 c9 15 5f f1 ef 81 e4 d4 40 f8 0c c5 c2 a1 5f 21 89 76 9b 9c 1f b2 78 dc 3b 5f 40 d6 82 e6 1d b2 6a 80 b1 c1 e5 df 95 80 94 b0 04 2c d4 d4 66 12 02 65 31 c8 82 ae b5 4e e7 d3 70 4a 31 c5 52 64 88 12 a9 30 c0 94 6e 79 d0 86 b4 c1 a6 06 82 66 a8 4e 34 e4 7c 07 16 67 62 33 04 89 b4 98 e2 60 68 8c 09 df 96 cb 05 a6 60 35 21 a2 5c 75 28 64 50 e7 7c 68 93 2e 01 a6 06 c3 46 25 2c da e5 e3 84 ae 05 58 af d8 ea 15 1a 6c b3 cb 49 52 37 60 32 99 4f e3 08 55 c1 96 13 53 be 36 1a f0 ad 57 56 bc 75 d7 18 53 e3 6d ee e5 e5 80 06 15 8f 22 ec c3 a0 dd fe d9 58 da 36 4c 26 8b 59 87 52 96 a4 f8 2a 96 e1 d0 80 d5 2b 6f 57 0f cf 40 e6 02 18 4d 04 4b b7 70 db e7 c0 39 8d 33 e0 fb fe e6 d0 e5 1a e0 97 d6 d1 20 c8 9a 85 dd 9a 7d 72 28 c0 02 cd 6c c6 20 50 16 5b 2c e8 5a 6b 1c cf c2 e9 12 53 28 45 86 28 90 0a 03 0c e9 96 07 6d 47 1b 6c 6a 20 68 06 cb 0a 41 36 39 49 c1 ea bc db 1c c1 42 2d b6 b8 28 9a 69 c5 fa dd 5f 86 98 9a 35 8c 88 92 35 b1 d0 c4 a2 7b 46 b4 55 57 08 53 a3 41 bf 12 96 ed e4 0a 2e 03 0b e6 db ec 42 22 2d 6e 39 18 1a b3 16 0b 12 a2 26 cd 35 21 a2 66 75 28 64 55 e7 7c 68 a7 2e 01 a6 06 c3 bd 1c 93 b1 39 2d e0 e1 7b 69 ed ea 90 50 5b 7f e7 a0 a8 a5 47 91 ef f9 ef a8 ce a8 66 c4 f4 45 75 2c e0 56 8f 8c f8 3e f0 12 61 6a 34 e8 57 5e c0 03 c4 9b cd 29 37 c8 e2 91 19 dc 08 f5 e7 6f be 8f a9 95 e4 42 d4 47 46 41 13 b9 2e 59 d0 5e 34 b1 c6 c6 41 2e 88 43 1a 26 e0 Data Ascii: Zr8Wd*$fam*lE7GKj]MV)>F<5W_S0:<b$<y53LUaekz\)?\|/czdt><O1iH
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginxContent-Type: application/javascriptLast-Modified: Thu, 19 May 2022 17:43:17 GMTETag: "628681b5-2c075"Expires: Fri, 03 Jun 2022 19:57:18 GMTCache-Control: max-age=1209600X-Host: grn87.sf2p.intern.weebly.netContent-Encoding: gzipVia: 1.1 varnish, 1.1 varnishContent-Length: 32604Accept-Ranges: bytesDate: Fri, 27 May 2022 12:31:06 GMTAge: 578028Connection: keep-aliveX-Served-By: cache-sjc10043-SJC, cache-mxp6932-MXPX-Cache: HIT, HITX-Cache-Hits: 1, 22X-Timer: S1653654667.652116,VS0,VE0Vary: Accept-EncodingAccess-Control-Allow-Origin: *Data Raw: 1f 8b 08 00 00 00 00 00 00 03 cc bd db 76 1b 49 92 20 f8 dc fd 15 51 d5 d5 25 e5 94 88 14 25 e5 4d 95 95 35 bc 49 a2 44 52 4c 82 94 5a 39 9a c1 71 00 0e 20 c4 40 04 32 2e a4 90 6a 9d d3 2f fb 05 bb 2f f3 38 67 1f f6 cc 43 bf cd 1f e4 9f f4 97 ac dd dc c3 03 f0 40 04 40 68 67 cf 51 26 23 02 e6 e6 e6 ee e6 e6 66 e6 e6 e6 ff 78 1b c6 c3 e4 b6 d3 7b 1b fc 2d 90 e7 b7 5a f7 a3 f9 d2 fb bf fe 6b f0 e9 f3 5f ff b1 f7 b6 33 d6 79 37 cc f5 89 8a c7 85 1a eb ab 8b 13 00 1e 15 f1 20 0f 93 f8 7e 04 9f bf fa f4 8f ff 90 ea bc 48 e3 e0 de d7 5f ab 2c d3 79 b6 93 e5 6a 1c c6 e3 ce 2d e1 eb c4 3a ff fa 43 f6 35 82 7f fd cf f8 ff 7f fe 3a cb a3 ce 87 ec ef fd 22 8c 86 97 e1 54 ff 6d f7 d1 e3 27 7f be d7 49 f5 2c 52 03 7d ff 1e c3 dd 7b 10 50 25 7f fd c7 cf 48 4e 1e 85 7f b3 b5 67 5f 7d 92 8a b3 bf d2 af 99 50 0a 24 de d3 f1 3d 6a c0 28 8f fe 86 3f c1 9f fb b6 e4 57 01 10 7d a3 d2 60 e4 b6 26 a3 cf f4 3d 87 ef 79 94 fd 97 ec bf 62 5f 64 7f 95 cf 0a 3e ef a5 a9 9a 77 66 69 92 27 f9 7c a6 3b 59 14 0e 74 67 a0 a2 e8 be 4a c7 c5 54 c7 79 f6 20 d8 fd 0a cb 8c 92 34 b8 8f 05 43 28 f8 f0 af f0 e7 c7 40 75 22 1d 8f f3 09 bc fd e5 2f 5c e3 3f 50 75 9d 6c 16 85 f9 fd 7b 9f 3e dd fb 4b f8 97 7b 9f 3f df fb aa f3 21 09 e3 fb ea bf 84 ff 95 d0 7d 86 ff e0 9f 34 3a 0f fe 0e 85 4c 7f 7d fd df de bf cf fe d3 fd ce 5f fe fe 15 3e fc e9 eb 07 c1 bd 3f ed de fb 2a 78 4a e4 7f 7e f0 8f ff 00 0d 82 7a 5e 76 5f 9f 75 66 2a cd a0 8f 3f bd ff 63 3e d1 53 dd 19 ea 5c 85 51 f6 fe 8f 4f df ff f1 d0 3c 3f 30 bf 66 45 1f 1a ab 22 fa b9 6b 5f ec ef 83 89 1e 5c 27 45 4e bf 1f d8 17 fb 7b aa d5 f0 2c b9 a5 9f 2f e0 39 a0 17 fb 73 5f 0d ae 2f 93 fd 28 19 13 c4 3e bc 06 79 12 f0 87 92 88 89 4a 35 53 c0 4f 0f 4a e2 b3 41 1a ce 70 0c a5 01 ce bb 85 fa 35 9f d3 af 3f e3 5f fc aa a7 d0 73 b9 ce 3a 3a d2 34 6a 9d 41 92 5c 87 7a 27 99 e5 3b d0 80 ce 30 cc 06 91 02 de 4c a9 e0 e5 24 cc 82 5b dd 47 2e 0b 8a 4c 67 c1 54 a5 d7 3a 07 3e 0f 54 3c 0c f2 14 08 c7 97 5c 0f 26 71 02 d4 87 80 3c 78 3d 23 08 40 18 24 a3 20 27 24 61 14 05 50 4b 30 4f 0a f3 03 f0 4f c0 f5 03 f7 e8 8f 03 0d 3f 23 fb e4 93 24 d3 41 ac f5 50 0f b1 57 d2 02 46 7e a2 0d 21 1d e8 4b 20 27 9f a8 3c c8 92 a9 0e 80 31 87 c5 20 47 e2 e6 41 9c Data Ascii: vI Q%%M5IDRLZ9q @2.j//8gC@@hgQ&#fx{-Zk_3y7 ~H_,y
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginxContent-Type: application/javascriptLast-Modified: Thu, 19 May 2022 17:44:49 GMTETag: "62868211-8250f"Expires: Fri, 03 Jun 2022 19:57:19 GMTCache-Control: max-age=1209600X-Host: blu94.sf2p.intern.weebly.netContent-Encoding: gzipVia: 1.1 varnish, 1.1 varnishContent-Length: 158975Accept-Ranges: bytesDate: Fri, 27 May 2022 12:31:07 GMTAge: 578028Connection: keep-aliveX-Served-By: cache-sjc10033-SJC, cache-mxp6962-MXPX-Cache: HIT, HITX-Cache-Hits: 1, 5X-Timer: S1653654667.045205,VS0,VE0Vary: Accept-EncodingAccess-Control-Allow-Origin: *Data Raw: 1f 8b 08 00 00 00 00 00 00 03 e4 bd 7b 77 db 46 f2 28 f8 ff 7e 0a 09 e3 91 01 13 a2 44 d9 71 62 d0 08 af fc 4a 3c 63 c5 1e 4b 1e 27 a1 18 2e 44 36 25 d8 14 c0 00 a0 65 45 e4 7e f6 ad 47 3f 01 50 b6 e7 37 77 cf 3d 67 f3 10 81 46 3f aa bb ab eb d5 d5 d5 fe 6c 99 4d aa 34 cf 7c 11 dc 7c 4a 8a ad 2a be 59 f7 55 e2 56 e6 17 c1 4d 3a f3 ab 61 31 0a 0a 51 2d 8b 6c 0b 9f bb e2 f3 22 2f aa b2 8f 45 d2 18 93 e2 1b 99 16 dd ac c3 74 1a 15 e1 3c 4f a6 62 1a cd 92 79 29 d6 7d 81 c5 26 c9 7c ee a7 aa 74 98 86 e6 39 0b fa 69 97 8b c4 55 b1 14 7d d9 9c ce b1 ce ba 97 b1 e8 67 dd 49 5c c1 df 45 ec 5d 54 d5 a2 8c f6 f6 26 d3 ec a0 2b a6 69 75 79 5d a6 95 e8 4e f2 cb bd 0f e5 9e e7 e6 f2 3a 57 69 36 cd af ba 87 c7 c7 cf 4f 8e c7 4f 0e 8f 9f 77 3c ca b8 5a 41 4e d5 60 e6 ef 07 eb c0 1f 9a 91 09 2b 80 ee 46 28 40 e2 cc bf 7f d0 0b d6 61 3d 07 0e 46 d1 df f6 8b 58 7f a1 d1 93 ed be 17 e2 6c 7e bd 1d c7 cb 6c 2a 66 69 26 a6 3b 3b ce a7 ee 87 7f 2d 45 e1 e4 08 6e 24 54 6d 19 d7 ee 37 99 c8 83 0c 00 01 50 22 08 0b b7 41 df 74 a3 08 36 f5 21 4c a9 17 c3 cc ef 05 a3 30 8d 6d 24 71 00 89 e5 db f8 bd 79 5a ad 00 83 f4 5b 77 59 cd 63 e7 6d b5 6a a9 0e 3e cd 92 74 2e a6 27 f3 32 6e 49 5b ad 86 a3 7e 4b 7a 77 b1 2c 2f a0 1e 35 79 c2 6e 7a e6 34 3d fb 52 d3 2f aa 96 b6 31 b1 b5 71 fc 50 6b dd f3 fe 07 1d 7f d7 d6 fa bb 4d ad bf fb 52 eb a5 d3 7a f9 a5 d6 8f db 5a 3f de d4 fa f1 17 5b 17 d5 d3 3c ff 98 8a b8 15 bf e2 4c 5c 6d 3d 4b 2a 58 e4 98 f5 24 bd 14 7e d1 3d 97 4f 41 27 bb 77 f0 e0 de c3 7d fc af 27 ee 07 92 ca 78 80 b8 69 21 ca d8 eb 14 dd 2a 7f 77 f2 f4 b8 2a d2 ec dc 0f fa d3 7c b2 bc 14 59 05 4b 9f 5a 15 1d 0f 72 55 1d af bf e5 75 52 1b b2 c9 5c 24 45 03 36 7b 40 34 ec 00 b2 e7 85 bb b0 d2 ad f2 e7 2d 3d 53 94 93 5a 25 60 b3 b8 06 51 b7 5c cc d3 ca f7 fa 5e d0 9f e5 85 cf c3 b0 df 2f 1e 67 dd b9 c8 ce ab 8b 7e d1 e9 70 45 69 9c 01 ad ec 5f 5d c0 50 03 b1 9c 5c 24 c5 61 05 44 29 8e bd 2d 2f 48 e3 b4 5b 2e cf 4a ee 7a 0f a8 e6 0c 32 01 7c e2 f3 6b 20 d4 90 6b 3f d0 a4 d3 64 ac 64 33 40 71 f9 21 58 b7 4d 1c d3 10 20 b3 26 e9 ed f3 a7 87 6f 4e 9e fe 7c 38 7e f3 ee c9 ab 97 4f c7 ff 7c fe 9b 44 95 a1 d7 f6 d1 1b c5 de c3 57 b3 07 af 1f bd 3b 3e c4 7f 5e 1f 27 8f 26 2f 1e 1c Data Ascii: {wF(~DqbJ<cK'.D6%eE~G?P7w=gF?lM4||J*YUVM:a1Q-l"/Et<Oby)}&|t9iU}
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginxContent-Type: application/javascriptLast-Modified: Wed, 25 May 2022 14:22:37 GMTETag: "628e3bad-124fe"Expires: Thu, 09 Jun 2022 08:38:41 GMTCache-Control: max-age=1209600X-Host: blu11.sf2p.intern.weebly.netContent-Encoding: gzipVia: 1.1 varnish, 1.1 varnishContent-Length: 25752Accept-Ranges: bytesDate: Fri, 27 May 2022 12:31:07 GMTAge: 100346Connection: keep-aliveX-Served-By: cache-sjc10069-SJC, cache-mxp6962-MXPX-Cache: HIT, HITX-Cache-Hits: 1, 1953X-Timer: S1653654668.533048,VS0,VE0Vary: Accept-EncodingAccess-Control-Allow-Origin: *Data Raw: 1f 8b 08 00 00 00 00 00 00 03 c4 7d 6b 7b da c8 92 f0 e7 33 bf c2 d6 d9 f5 48 43 1b 03 be 06 ac 78 6d 27 76 ee c9 24 76 9c 84 30 7e 1a 10 20 0c 08 24 71 b3 61 7f fb 5b 55 7d 51 4b e0 24 73 ce ee be e7 64 8c d4 97 ea ee ea ea ba 75 a9 db 6e 8d 07 8d d8 0f 06 1b 9e 5d 67 6d d6 74 1e 74 4a c3 1e b0 ae f3 e0 b7 ec cd 76 75 50 13 4f 75 7a 9a f0 70 c3 77 e3 f9 d0 0b 5a 1b a1 37 1a fb a1 e7 ba 96 aa 6a 6d 6d c9 c4 0a d6 e9 6e 6d f9 ce 43 e8 c5 e3 70 b0 e1 03 d4 cd 82 b3 84 0c ae 13 b9 4c 44 b8 7d 77 e0 4d 37 9e 87 61 10 da d6 39 1f 0c 82 78 a3 e5 0f 9a 1b fd a0 39 ee 79 1b bf 5b b9 41 ce fa dd 72 2a 71 27 0c a6 1b fd 7c 23 68 7a ae f5 f6 fd b3 eb 37 cf 6f df bd bf ba bd 78 7f fd ee 99 c5 fa 04 af e3 62 ef dd 07 6f 36 0c c2 38 2a 3f 2c 97 15 1c 45 b5 50 cb 37 78 af 67 77 f2 32 8b a9 fe db 3d 31 c4 c0 a5 82 c5 5a b5 57 ab c8 ae 36 ec e0 24 28 f7 9c 25 eb b0 a4 a6 c7 04 f6 96 b2 14 36 a9 32 a9 17 fc 97 b0 d5 82 31 63 e9 96 5b a8 b4 8e 9b f9 9e 37 68 c7 9d 4a 2b 97 73 1e 1a 76 b3 da aa e9 16 1a 4b c7 7e 28 96 ab ba cf 12 06 13 68 62 b2 71 31 90 57 9f de bf a3 a9 c0 07 e7 01 ff ba 80 07 5b 57 16 c5 da bd a0 ce 7b ee 85 4a b5 64 5b 71 c7 8f 2c c7 76 18 55 14 a5 f2 8f c0 d4 e4 d3 b2 07 7a 7e 07 c7 c5 c2 89 55 80 99 2b 0f 70 e6 25 2e 9e f1 d8 cb 0f c3 20 0e 30 21 1f 07 08 64 d3 44 8d f3 b0 b6 8c ab 3b 7e e7 cd 13 d2 8a 2e fc 81 1f 7b 36 f6 37 3f e1 bd b1 f7 be 65 3b ce 09 bd b7 bd f8 fa ea fc 62 dc eb 7d f5 78 68 3b 39 6b db ca b5 6c 23 ef 6d 30 88 3b 90 51 5c 93 87 dd 00 50 39 eb 2a 93 f1 22 18 87 11 e5 94 b3 e0 fc c1 38 f6 d6 e7 7d f2 1a c1 a0 29 f2 be 59 e5 01 f4 ea b7 65 e5 53 1c fa 83 f6 ea 68 df 8d fb 75 2f 5c 4d 3f 0b 82 9e c7 07 bf 88 9e 34 56 96 44 96 8d 99 bb 53 fd 3e 2e c0 ff f0 2f 6f c2 df 83 42 61 9b 7e f6 e0 ef 61 a1 f5 7d 5c 3c ac ef d1 df fd ef e3 52 a1 d0 d8 a6 9f 16 fe 2d 1d d1 4b 89 5e 0e 0a f4 72 00 2f 2d af 85 7f 5b 2d 4c 82 9f 56 6d a7 cd bc a8 c1 87 bc de f3 b0 d1 ef df ad ef 33 6c 6a 56 6c 7d 9f 1d b6 e0 e1 49 eb ff a0 13 6d 3e 64 c0 4e bc 41 cc fa 5e cc dd 07 eb 7b 1d e6 e7 3b fc 65 d6 f7 98 1e 63 7c 1c d0 e3 00 1f 5b f4 d8 c2 c7 90 1e 43 8b fd 6e fd 5e fe 1d 06 f1 3b 24 7e a7 44 f8 59 b2 d0 1b 56 f4 1a 18 8d 03 20 9b 88 a6 d5 79 Data Ascii: }k{3HCxm'v$v0~ $qa[U}QK$sdun]gmttJvuPOuzpwZ7jmmnmCpLD}wM7a9x9
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 54599
Source: unknown Network traffic detected: HTTP traffic on port 54599 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57477 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57477
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /recaptcha/api.js?_=1653687066398 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Google Chrome";v="92"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://document--1111011111.company.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: document--1111011111.company.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /files/main_style.css?1652461604 HTTP/1.1Host: document--1111011111.company.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36Accept: text/css,*/*;q=0.1Referer: http://document--1111011111.company.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: is_mobile=0; language=en
Source: global traffic HTTP traffic detected: GET /css/sites.css?buildTime=1651866883 HTTP/1.1Host: cdn2.editmysite.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36Accept: text/css,*/*;q=0.1Referer: http://document--1111011111.company.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /css/old/fancybox.css?1651866883 HTTP/1.1Host: cdn2.editmysite.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36Accept: text/css,*/*;q=0.1Referer: http://document--1111011111.company.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /css/social-icons.css?buildtime=1651866883 HTTP/1.1Host: cdn2.editmysite.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36Accept: text/css,*/*;q=0.1Referer: http://document--1111011111.company.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /js/lang/en/stl.js?buildTime=1651866883& HTTP/1.1Host: cdn2.editmysite.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36Accept: */*Referer: http://document--1111011111.company.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /js/site/main.js?buildTime=1651866883 HTTP/1.1Host: cdn2.editmysite.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36Accept: */*Referer: http://document--1111011111.company.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /files/theme/plugins.js?1565969634 HTTP/1.1Host: document--1111011111.company.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36Accept: */*Referer: http://document--1111011111.company.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: is_mobile=0; language=en
Source: global traffic HTTP traffic detected: GET /files/theme/custom.js?1565969634 HTTP/1.1Host: document--1111011111.company.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36Accept: */*Referer: http://document--1111011111.company.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: is_mobile=0; language=en
Source: global traffic HTTP traffic detected: GET /js/site/main-customer-accounts-site.js?buildTime=1651866883 HTTP/1.1Host: cdn2.editmysite.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36Accept: */*Referer: http://document--1111011111.company.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /uploads/1/4/1/8/141840186/1screenshot-2021-04-26-at-19-59-20-orig-orig-orig_orig.png HTTP/1.1Host: document--1111011111.company.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://document--1111011111.company.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: is_mobile=0; language=en
Source: global traffic HTTP traffic detected: GET /uploads/1/4/1/8/141840186/editor/2screenshot-2021-04-26-at-19-59-12-orig-orig.png?1652460803 HTTP/1.1Host: document--1111011111.company.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://document--1111011111.company.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: is_mobile=0; language=en
Source: global traffic HTTP traffic detected: GET /uploads/1/4/1/8/141840186/3pdp-orig-orig_orig.png HTTP/1.1Host: document--1111011111.company.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://document--1111011111.company.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: is_mobile=0; language=en
Source: global traffic HTTP traffic detected: GET /files/theme/fonts/627fbb5a-3bae-4cd9-b617-2f923e29d55e.woff2?1652461604 HTTP/1.1Host: document--1111011111.company.comConnection: keep-aliveOrigin: http://document--1111011111.company.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36Accept: */*Referer: http://document--1111011111.company.com/files/main_style.css?1652461604Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: is_mobile=0; language=en
Source: global traffic HTTP traffic detected: GET /files/theme/fonts/2cd55546-ec00-4af9-aeca-4a3cd186da53.woff2?1652461604 HTTP/1.1Host: document--1111011111.company.comConnection: keep-aliveOrigin: http://document--1111011111.company.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36Accept: */*Referer: http://document--1111011111.company.com/files/main_style.css?1652461604Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: is_mobile=0; language=en
Source: global traffic HTTP traffic detected: GET /files/theme/fonts/2e3f5cb9-101f-46cf-a7b3-dfaa58261e03.woff2?1652461604 HTTP/1.1Host: document--1111011111.company.comConnection: keep-aliveOrigin: http://document--1111011111.company.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36Accept: */*Referer: http://document--1111011111.company.com/files/main_style.css?1652461604Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: is_mobile=0; language=en
Source: global traffic HTTP traffic detected: GET /js/wsnbn/snowday262.js HTTP/1.1Host: cdn2.editmysite.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36Accept: */*Referer: http://document--1111011111.company.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /files/theme/fonts/f26faddb-86cc-4477-a253-1e1287684336.woff?1652461604 HTTP/1.1Host: document--1111011111.company.comConnection: keep-aliveOrigin: http://document--1111011111.company.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36Accept: */*Referer: http://document--1111011111.company.com/files/main_style.css?1652461604Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: is_mobile=0; language=en; _snow_id.8a80=cdee608d-345c-4729-a8ec-f49d163ae349.1653687067.1.1653687067.1653687067.284b84f9-1721-4504-87d0-8d672f14f019; _snow_ses.8a80=*
Source: global traffic HTTP traffic detected: GET /files/theme/fonts/1e9892c0-6927-4412-9874-1b82801ba47a.woff?1652461604 HTTP/1.1Host: document--1111011111.company.comConnection: keep-aliveOrigin: http://document--1111011111.company.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36Accept: */*Referer: http://document--1111011111.company.com/files/main_style.css?1652461604Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: is_mobile=0; language=en; _snow_id.8a80=cdee608d-345c-4729-a8ec-f49d163ae349.1653687067.1.1653687067.1653687067.284b84f9-1721-4504-87d0-8d672f14f019; _snow_ses.8a80=*
Source: global traffic HTTP traffic detected: GET /files/theme/fonts/fa19948e-5e38-4909-b31e-41acd170d6f2.woff?1652461604 HTTP/1.1Host: document--1111011111.company.comConnection: keep-aliveOrigin: http://document--1111011111.company.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36Accept: */*Referer: http://document--1111011111.company.com/files/main_style.css?1652461604Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: is_mobile=0; language=en; _snow_id.8a80=cdee608d-345c-4729-a8ec-f49d163ae349.1653687067.1.1653687067.1653687067.284b84f9-1721-4504-87d0-8d672f14f019; _snow_ses.8a80=*
Source: global traffic HTTP traffic detected: GET /files/theme/fonts/63a74598-733c-4d0c-bd91-b01bffcd6e69.ttf?1652461604 HTTP/1.1Host: document--1111011111.company.comConnection: keep-aliveOrigin: http://document--1111011111.company.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36Accept: */*Referer: http://document--1111011111.company.com/files/main_style.css?1652461604Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: is_mobile=0; language=en; _snow_id.8a80=cdee608d-345c-4729-a8ec-f49d163ae349.1653687067.1.1653687067.1653687067.284b84f9-1721-4504-87d0-8d672f14f019; _snow_ses.8a80=*
Source: global traffic HTTP traffic detected: GET /files/theme/fonts/46cf1067-688d-4aab-b0f7-bd942af6efd8.ttf?1652461604 HTTP/1.1Host: document--1111011111.company.comConnection: keep-aliveOrigin: http://document--1111011111.company.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36Accept: */*Referer: http://document--1111011111.company.com/files/main_style.css?1652461604Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: is_mobile=0; language=en; _snow_id.8a80=cdee608d-345c-4729-a8ec-f49d163ae349.1653687067.1.1653687067.1653687067.284b84f9-1721-4504-87d0-8d672f14f019; _snow_ses.8a80=*
Source: global traffic HTTP traffic detected: GET /files/theme/fonts/6de0ce4d-9278-467b-b96f-c1f5f0a4c375.ttf?1652461604 HTTP/1.1Host: document--1111011111.company.comConnection: keep-aliveOrigin: http://document--1111011111.company.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36Accept: */*Referer: http://document--1111011111.company.com/files/main_style.css?1652461604Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: is_mobile=0; language=en; _snow_id.8a80=cdee608d-345c-4729-a8ec-f49d163ae349.1653687067.1.1653687067.1653687067.284b84f9-1721-4504-87d0-8d672f14f019; _snow_ses.8a80=*
Source: global traffic HTTP traffic detected: GET /uploads/reseller/assets/356764895-favicon.ico HTTP/1.1Host: www.weebly.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://document--1111011111.company.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /uploads/1/4/1/8/141840186/1screenshot-2021-04-26-at-19-59-20-orig-orig-orig_orig.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: document--1111011111.company.com
Source: global traffic HTTP traffic detected: GET /uploads/1/4/1/8/141840186/editor/2screenshot-2021-04-26-at-19-59-12-orig-orig.png?1652460803 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: document--1111011111.company.com
Source: global traffic HTTP traffic detected: GET /uploads/1/4/1/8/141840186/3pdp-orig-orig_orig.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: document--1111011111.company.com
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 27 May 2022 12:31:09 GMTContent-Type: text/htmlContent-Length: 3739Connection: keep-aliveETag: "61c39c46-e9b"X-Host: grn63.sf2p.intern.weebly.netX-W-DC: SFO
Source: History Provider Cache.1.dr String found in binary or memory: http://document--1111011111.company.com/2
Source: 67268b83-2658-4083-928c-f181c95a7676.tmp.1.dr, a2acd1b4-60a6-4573-adf6-b0849a814490.tmp.1.dr String found in binary or memory: http://document--1111011111.company.com:80
Source: pnacl_public_x86_64_pnacl_sz_nexe.1.dr, pnacl_public_x86_64_pnacl_llc_nexe.1.dr String found in binary or memory: http://llvm.org/):
Source: 326a7714-6c2f-4802-b696-f5cb4eb8e13f.tmp.3.dr, 2cea7aa6-e8dc-403b-8fb0-13dc2cb9b77c.tmp.3.dr String found in binary or memory: https://accounts.google.com
Source: craw_window.js.1.dr String found in binary or memory: https://accounts.google.com/MergeSession
Source: 2cea7aa6-e8dc-403b-8fb0-13dc2cb9b77c.tmp.3.dr String found in binary or memory: https://ajax.googleapis.com
Source: 326a7714-6c2f-4802-b696-f5cb4eb8e13f.tmp.3.dr, 2cea7aa6-e8dc-403b-8fb0-13dc2cb9b77c.tmp.3.dr String found in binary or memory: https://apis.google.com
Source: pnacl_public_x86_64_libcrt_platform_a.1.dr, pnacl_public_x86_64_ld_nexe.1.dr String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-clang.git
Source: pnacl_public_x86_64_libcrt_platform_a.1.dr, pnacl_public_x86_64_ld_nexe.1.dr String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-llvm.git
Source: 326a7714-6c2f-4802-b696-f5cb4eb8e13f.tmp.3.dr, 2cea7aa6-e8dc-403b-8fb0-13dc2cb9b77c.tmp.3.dr String found in binary or memory: https://clients2.google.com
Source: manifest.json.1.dr, manifest.json0.1.dr String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 326a7714-6c2f-4802-b696-f5cb4eb8e13f.tmp.3.dr, 2cea7aa6-e8dc-403b-8fb0-13dc2cb9b77c.tmp.3.dr String found in binary or memory: https://clients2.googleusercontent.com
Source: pnacl_public_x86_64_ld_nexe.1.dr String found in binary or memory: https://code.google.com/p/nativeclient/issues/entry
Source: pnacl_public_x86_64_ld_nexe.1.dr String found in binary or memory: https://code.google.com/p/nativeclient/issues/entry%s:
Source: 2cea7aa6-e8dc-403b-8fb0-13dc2cb9b77c.tmp.3.dr String found in binary or memory: https://content-autofill.googleapis.com
Source: craw_background.js.1.dr, craw_window.js.1.dr String found in binary or memory: https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
Source: 326a7714-6c2f-4802-b696-f5cb4eb8e13f.tmp.3.dr, 2cea7aa6-e8dc-403b-8fb0-13dc2cb9b77c.tmp.3.dr String found in binary or memory: https://ogs.google.com
Source: manifest.json.1.dr, craw_window.js.1.dr String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: manifest.json.1.dr, craw_window.js.1.dr String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: 326a7714-6c2f-4802-b696-f5cb4eb8e13f.tmp.3.dr, 2cea7aa6-e8dc-403b-8fb0-13dc2cb9b77c.tmp.3.dr String found in binary or memory: https://ssl.gstatic.com
Source: 326a7714-6c2f-4802-b696-f5cb4eb8e13f.tmp.3.dr, 2cea7aa6-e8dc-403b-8fb0-13dc2cb9b77c.tmp.3.dr String found in binary or memory: https://update.googleapis.com
Source: craw_background.js.1.dr, craw_window.js.1.dr String found in binary or memory: https://www-googleapis-staging.sandbox.google.com
Source: 326a7714-6c2f-4802-b696-f5cb4eb8e13f.tmp.3.dr, 2cea7aa6-e8dc-403b-8fb0-13dc2cb9b77c.tmp.3.dr String found in binary or memory: https://www.google.com
Source: manifest.json.1.dr String found in binary or memory: https://www.google.com/
Source: craw_window.js.1.dr String found in binary or memory: https://www.google.com/accounts/OAuthLogin?issueuberauth=1
Source: craw_window.js.1.dr String found in binary or memory: https://www.google.com/images/cleardot.gif
Source: craw_window.js.1.dr String found in binary or memory: https://www.google.com/images/dot2.gif
Source: craw_window.js.1.dr String found in binary or memory: https://www.google.com/images/x2.gif
Source: craw_background.js.1.dr String found in binary or memory: https://www.google.com/intl/en-US/chrome/blank.html
Source: 326a7714-6c2f-4802-b696-f5cb4eb8e13f.tmp.3.dr, craw_background.js.1.dr, craw_window.js.1.dr, 2cea7aa6-e8dc-403b-8fb0-13dc2cb9b77c.tmp.3.dr String found in binary or memory: https://www.googleapis.com
Source: manifest.json.1.dr String found in binary or memory: https://www.googleapis.com/
Source: manifest.json.1.dr String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json.1.dr String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json.1.dr String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json.1.dr String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: 326a7714-6c2f-4802-b696-f5cb4eb8e13f.tmp.3.dr, 2cea7aa6-e8dc-403b-8fb0-13dc2cb9b77c.tmp.3.dr String found in binary or memory: https://www.gstatic.com
Source: unknown HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CONSENT=PENDING+620
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Local\Temp\5ae4c494-9b98-4270-8ec8-e8c7e50b1839.tmp Jump to behavior
Source: classification engine Classification label: mal56.phis.win@26/127@10/9
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation --single-argument http://document--1111011111.company.com/
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1740,10588110985535776619,16488514565616499681,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1740,10588110985535776619,16488514565616499681,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-62914314-1DF4.pma Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 635117 URL: http://document--1111011111... Startdate: 27/05/2022 Architecture: WINDOWS Score: 56 20 www.weebly.com 2->20 22 weebly.com 2->22 24 document--1111011111.company.com 2->24 36 Antivirus / Scanner detection for submitted sample 2->36 38 Yara detected HtmlPhish20 2->38 7 chrome.exe 18 285 2->7         started        signatures3 process4 dnsIp5 26 192.168.2.1 unknown unknown 7->26 28 239.255.255.250 unknown Reserved 7->28 14 C:\...\pnacl_public_x86_64_pnacl_sz_nexe, ELF 7->14 dropped 16 C:\...\pnacl_public_x86_64_pnacl_llc_nexe, ELF 7->16 dropped 18 C:\Users\user\...\pnacl_public_x86_64_ld_nexe, ELF 7->18 dropped 11 chrome.exe 34 7->11         started        file6 process7 dnsIp8 30 document--1111011111.company.com 199.34.228.55, 49266, 50986, 52791 WEEBLYUS United States 11->30 32 weebly.com 74.115.50.110, 57143, 80 WEEBLYUS United States 11->32 34 14 other IPs or domains 11->34
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
74.115.50.110
 weebly.com United States
27647 WEEBLYUS false
151.101.1.46
 weebly.map.fastly.net United States
54113 FASTLYUS false
199.34.228.55
 document--1111011111.company.com United States
27647 WEEBLYUS false
239.255.255.250
 unknown Reserved
unknown unknown false
142.250.185.141
 accounts.google.com United States
15169 GOOGLEUS false
52.25.131.159
 sp-2020021412301152490000000a-1069308460.us-west-2.elb.amazonaws.com United States
16509 AMAZON-02US false
142.251.37.100
 www.google.com United States
15169 GOOGLEUS false

Private

IP
192.168.2.1
127.0.0.1

Contacted Domains

Name IP Active
gstaticadssl.l.google.com 142.250.185.99 true
company.com 35.71.162.193 true
accounts.google.com 142.250.185.141 true
www-google-analytics.l.google.com 142.250.185.174 true
sp-2020021412301152490000000a-1069308460.us-west-2.elb.amazonaws.com 52.25.131.159 true
weebly.map.fastly.net 151.101.1.46 true
www.google.com 142.251.37.100 true
clients.l.google.com 142.250.185.174 true
weebly.com 74.115.50.110 true
document--1111011111.company.com 199.34.228.55 true
www.company.com unknown unknown
ec.editmysite.com unknown unknown
clients2.google.com unknown unknown
cdn2.editmysite.com unknown unknown
www.weebly.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://document--1111011111.company.com/files/theme/fonts/2cd55546-ec00-4af9-aeca-4a3cd186da53.woff2?1652461604 false
    		high
    http://document--1111011111.company.com/ false
      		high
      http://document--1111011111.company.com/files/theme/fonts/2e3f5cb9-101f-46cf-a7b3-dfaa58261e03.woff2?1652461604 false
        		high
        http://document--1111011111.company.com/files/theme/fonts/63a74598-733c-4d0c-bd91-b01bffcd6e69.ttf?1652461604 false
          		high
          http://document--1111011111.company.com/files/theme/fonts/627fbb5a-3bae-4cd9-b617-2f923e29d55e.woff2?1652461604 false
            		high
            http://cdn2.editmysite.com/js/site/main-customer-accounts-site.js?buildTime=1651866883 false
              		high
              http://www.weebly.com/uploads/reseller/assets/356764895-favicon.ico false
                		high
                http://cdn2.editmysite.com/css/old/fancybox.css?1651866883 false
                  		high
                  http://cdn2.editmysite.com/js/lang/en/stl.js?buildTime=1651866883& false
                    		high
                    http://document--1111011111.company.com/ false
                      		high
                      http://ec.editmysite.com/com.snowplowanalytics.snowplow/tp2 false
                        		high
                        http://cdn2.editmysite.com/css/social-icons.css?buildtime=1651866883 false
                          		high
                          http://document--1111011111.company.com/uploads/1/4/1/8/141840186/editor/2screenshot-2021-04-26-at-19-59-12-orig-orig.png?1652460803 false
                            		high
                            https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard false
                              		high
                              http://document--1111011111.company.com/files/main_style.css?1652461604 false
                                		high
                                http://document--1111011111.company.com/files/theme/plugins.js?1565969634 false
                                  		high
                                  http://cdn2.editmysite.com/js/wsnbn/snowday262.js false
                                    		high
                                    http://cdn2.editmysite.com/css/sites.css?buildTime=1651866883 false
                                      		high
                                      http://document--1111011111.company.com/uploads/1/4/1/8/141840186/3pdp-orig-orig_orig.png false
                                        		high
                                        http://document--1111011111.company.com/uploads/1/4/1/8/141840186/1screenshot-2021-04-26-at-19-59-20-orig-orig-orig_orig.png false
                                          		high
                                          http://document--1111011111.company.com/files/theme/fonts/6de0ce4d-9278-467b-b96f-c1f5f0a4c375.ttf?1652461604 false
                                            		high
                                            http://document--1111011111.company.com/files/theme/fonts/46cf1067-688d-4aab-b0f7-bd942af6efd8.ttf?1652461604 false
                                              		high
                                              http://document--1111011111.company.com/ajax/api/JsonRPC/CustomerAccounts/?CustomerAccounts[CustomerAccounts::getAccountDetails] false
                                                		high
                                                http://document--1111011111.company.com/files/theme/fonts/f26faddb-86cc-4477-a253-1e1287684336.woff?1652461604 false
                                                  		high
                                                  http://document--1111011111.company.com/files/theme/custom.js?1565969634 false
                                                    		high
                                                    http://document--1111011111.company.com/files/theme/fonts/1e9892c0-6927-4412-9874-1b82801ba47a.woff?1652461604 false
                                                      		high
                                                      http://document--1111011111.company.com/files/theme/fonts/fa19948e-5e38-4909-b31e-41acd170d6f2.woff?1652461604 false
                                                        		high
                                                        http://cdn2.editmysite.com/js/site/main.js?buildTime=1651866883 false
                                                          		high
                                                          https://www.google.com/recaptcha/api.js?_=1653687066398 false
                                                            		high