Windows Analysis Report
https://docs.google.com/presentation/d/e/2PACX-1vQLIu1X0IVnxZJYibfHTDtGdl4umjzrNQRqM8P15_pKuHsxivDaDjKXey0w5atKnGomwg17E-2HUJIW/pub?start=false&loop=false&delayms=3000&slide=id.p

Overview

General Information

Sample URL: https://docs.google.com/presentation/d/e/2PACX-1vQLIu1X0IVnxZJYibfHTDtGdl4umjzrNQRqM8P15_pKuHsxivDaDjKXey0w5atKnGomwg17E-2HUJIW/pub?start=false&loop=false&delayms=3000&slide=id.p
Analysis ID: 635351
Infos:

Detection

Score: 1
Range: 0 - 100
Whitelisted: false
Confidence: 80%

Signatures

HTML body contains low number of good links
No HTML title found

Classification

HTML body contains low number of good links
Source: https://docs.google.com/presentation/d/e/2PACX-1vQLIu1X0IVnxZJYibfHTDtGdl4umjzrNQRqM8P15_pKuHsxivDaDjKXey0w5atKnGomwg17E-2HUJIW/pub?start=false&loop=false&delayms=3000&slide=id.p HTTP Parser: Number of links: 0
Source: https://docs.google.com/presentation/d/e/2PACX-1vQLIu1X0IVnxZJYibfHTDtGdl4umjzrNQRqM8P15_pKuHsxivDaDjKXey0w5atKnGomwg17E-2HUJIW/pub?start=false&loop=false&delayms=3000&slide=id.p HTTP Parser: Number of links: 0
No HTML title found
Source: https://docs.google.com/presentation/d/e/2PACX-1vQLIu1X0IVnxZJYibfHTDtGdl4umjzrNQRqM8P15_pKuHsxivDaDjKXey0w5atKnGomwg17E-2HUJIW/pub?start=false&loop=false&delayms=3000&slide=id.p HTTP Parser: HTML title missing
Source: https://docs.google.com/presentation/d/e/2PACX-1vQLIu1X0IVnxZJYibfHTDtGdl4umjzrNQRqM8P15_pKuHsxivDaDjKXey0w5atKnGomwg17E-2HUJIW/pub?start=false&loop=false&delayms=3000&slide=id.p HTTP Parser: HTML title missing
Source: https://docs.google.com/presentation/d/e/2PACX-1vQLIu1X0IVnxZJYibfHTDtGdl4umjzrNQRqM8P15_pKuHsxivDaDjKXey0w5atKnGomwg17E-2HUJIW/pub?start=false&loop=false&delayms=3000&slide=id.p HTTP Parser: No <meta name="author".. found
Source: https://docs.google.com/presentation/d/e/2PACX-1vQLIu1X0IVnxZJYibfHTDtGdl4umjzrNQRqM8P15_pKuHsxivDaDjKXey0w5atKnGomwg17E-2HUJIW/pub?start=false&loop=false&delayms=3000&slide=id.p HTTP Parser: No <meta name="author".. found
Source: https://docs.google.com/presentation/d/e/2PACX-1vQLIu1X0IVnxZJYibfHTDtGdl4umjzrNQRqM8P15_pKuHsxivDaDjKXey0w5atKnGomwg17E-2HUJIW/pub?start=false&loop=false&delayms=3000&slide=id.p HTTP Parser: No <meta name="copyright".. found
Source: https://docs.google.com/presentation/d/e/2PACX-1vQLIu1X0IVnxZJYibfHTDtGdl4umjzrNQRqM8P15_pKuHsxivDaDjKXey0w5atKnGomwg17E-2HUJIW/pub?start=false&loop=false&delayms=3000&slide=id.p HTTP Parser: No <meta name="copyright".. found
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic Jump to behavior
Source: unknown HTTPS traffic detected: 172.217.168.65:443 -> 192.168.2.3:49767 version: TLS 1.2
Source: unknown HTTPS traffic detected: 142.250.203.100:443 -> 192.168.2.3:49785 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.36.158.100:443 -> 192.168.2.3:49924 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.36.158.100:443 -> 192.168.2.3:49923 version: TLS 1.2
Source: unknown DNS traffic detected: queries for: clients2.google.com
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown Network traffic detected: HTTP traffic on port 49903 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49900
Source: global traffic HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-85.0.4183.121Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /presentation/d/e/2PACX-1vQLIu1X0IVnxZJYibfHTDtGdl4umjzrNQRqM8P15_pKuHsxivDaDjKXey0w5atKnGomwg17E-2HUJIW/pub?start=false&loop=false&delayms=3000&slide=id.p HTTP/1.1Host: docs.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2 HTTP/1.1Host: fonts.gstatic.comConnection: keep-aliveOrigin: https://docs.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://docs.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2 HTTP/1.1Host: fonts.gstatic.comConnection: keep-aliveOrigin: https://docs.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://docs.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /QQO41zWHBvsX36RgqffQ_Q8VKfebeqv6pKrya5ykZ7U3gtz6GuLzEANegUUvsan5C0uMtw-4NjCuShXWV75hTooEURcwc7XPdy3eBByKuPgDkT48ZSwM5OK9YnkTz77CV7XkHuXuImvHBwo HTTP/1.1Host: lh3.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://docs.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /QQO41zWHBvsX36RgqffQ_Q8VKfebeqv6pKrya5ykZ7U3gtz6GuLzEANegUUvsan5C0uMtw-4NjCuShXWV75hTooEURcwc7XPdy3eBByKuPgDkT48ZSwM5OK9YnkTz77CV7XkHuXuImvHBwo HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh3.googleusercontent.com
Source: global traffic HTTP traffic detected: GET /url?q=https://accounts.appsgsuite-tunneldrive.tk/eEBrdljc&sa=D&source=editors&ust=1653677947346759&usg=AOvVaw3QU4sK3cAcPp4ymAmsc8mY HTTP/1.1Host: www.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=mTsMIPZRhvSZkLxUg0Zl73ABHi-3PG40VnXj8ujTpOJPOrYf9dQdzUr80tLAfv0Cg7Nze-cAoRN2LSg3aFzK2D5pfO_fWcwb2W1Fy3IOtOll36PY-3KK_I-raNwAnP0XHmJi6AcqtW4QEfx1QKliJeDtiVCEcWrqXCHCc1mSDmU; CONSENT=PENDING+524
Source: global traffic HTTP traffic detected: GET /images/phishing_logo.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: www.google.com
Source: global traffic HTTP traffic detected: GET /gtag/js?id=UA-150292050-1 HTTP/1.1Host: www.googletagmanager.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://safebrowsing.google.com/safebrowsing/report_error/?tpl=websearch&url=https://accounts.appsgsuite-tunneldrive.tk/eEBrdljc&hl=enAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /tools/firefox/common/moz-header-bg-top.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: www.google.com
Source: global traffic HTTP traffic detected: GET /tools/firefox/common/moz-header-bg-bottom.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: www.google.com
Source: global traffic HTTP traffic detected: GET /safe-browsing/overview HTTP/1.1Host: transparencyreport.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=mTsMIPZRhvSZkLxUg0Zl73ABHi-3PG40VnXj8ujTpOJPOrYf9dQdzUr80tLAfv0Cg7Nze-cAoRN2LSg3aFzK2D5pfO_fWcwb2W1Fy3IOtOll36PY-3KK_I-raNwAnP0XHmJi6AcqtW4QEfx1QKliJeDtiVCEcWrqXCHCc1mSDmU; CONSENT=PENDING+524; __Secure-ENID=5.SE=GZjPJiK_TLJA5Cocy9nfr7W4p-MMxNGsecoURQCSiZSoSGssOps8IG1Vm1eISsoFqsR79aYLz_UO8dklyjfWBG-xcwOmmTWyC-uN21rU9cqlByEvAUC2SjfACKKeGHF7igtT3lX1Mj8e6tu-9PJLch6pHU6gC3sm54mxNxa-Bn0
Source: global traffic HTTP traffic detected: GET /favicon.ico?v1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: www.google.com
Source: global traffic HTTP traffic detected: GET /images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: www.google.com
Source: global traffic HTTP traffic detected: GET /images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: www.google.comIf-Modified-Since: Tue, 22 Oct 2019 18:30:00 GMT
Source: global traffic HTTP traffic detected: GET /images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: www.google.comIf-Modified-Since: Tue, 22 Oct 2019 18:30:00 GMT
Source: global traffic HTTP traffic detected: GET /web/fundamentals/security/hacked HTTP/1.1Host: developers.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=mTsMIPZRhvSZkLxUg0Zl73ABHi-3PG40VnXj8ujTpOJPOrYf9dQdzUr80tLAfv0Cg7Nze-cAoRN2LSg3aFzK2D5pfO_fWcwb2W1Fy3IOtOll36PY-3KK_I-raNwAnP0XHmJi6AcqtW4QEfx1QKliJeDtiVCEcWrqXCHCc1mSDmU; CONSENT=PENDING+524; __Secure-ENID=5.SE=GZjPJiK_TLJA5Cocy9nfr7W4p-MMxNGsecoURQCSiZSoSGssOps8IG1Vm1eISsoFqsR79aYLz_UO8dklyjfWBG-xcwOmmTWyC-uN21rU9cqlByEvAUC2SjfACKKeGHF7igtT3lX1Mj8e6tu-9PJLch6pHU6gC3sm54mxNxa-Bn0
Source: global traffic HTTP traffic detected: GET /hacked/ HTTP/1.1Host: web.devConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /css/next.css?v=30010cda HTTP/1.1Host: web.devConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://web.dev/hacked/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /css/legacy-rollout.css?v=c92bcb17 HTTP/1.1Host: web.devConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://web.dev/hacked/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /fonts/google-sans/regular/latin.woff2 HTTP/1.1Host: web.devConnection: keep-aliveOrigin: https://web.devUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://web.dev/hacked/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /fonts/google-sans/bold/latin.woff2 HTTP/1.1Host: web.devConnection: keep-aliveOrigin: https://web.devUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://web.dev/hacked/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /fonts/material-icons/regular.woff2 HTTP/1.1Host: web.devConnection: keep-aliveOrigin: https://web.devUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://web.dev/hacked/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /js/app.js?v=145f0867 HTTP/1.1Host: web.devConnection: keep-aliveOrigin: https://web.devUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /js/content.js?v=00db7c42 HTTP/1.1Host: web.devConnection: keep-aliveOrigin: https://web.devUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /image/kheDArv5csY6rvQUJDbWRscckLr1/INhVTTPZ65TEBG9N4Qpz.gif?auto=format&w=845 HTTP/1.1Host: web-dev.imgix.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://web.dev/hacked/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /js/index-a8636400.js HTTP/1.1Host: web.devConnection: keep-aliveOrigin: https://web.devUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://web.dev/js/content.js?v=00db7c42Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /js/index-d1373fab.js HTTP/1.1Host: web.devConnection: keep-aliveOrigin: https://web.devUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://web.dev/js/content.js?v=00db7c42Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /js/index-793a397e.js HTTP/1.1Host: web.devConnection: keep-aliveOrigin: https://web.devUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://web.dev/js/content.js?v=00db7c42Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /js/store-1afdb64d.js HTTP/1.1Host: web.devConnection: keep-aliveOrigin: https://web.devUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://web.dev/js/content.js?v=00db7c42Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /images/lockup-color.png HTTP/1.1Host: web.devConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://web.dev/hacked/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /vi_webp/mbJvL61DOZg/hqdefault.webp HTTP/1.1Host: i.ytimg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://web.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-126406676-2&cid=1778341496.1653706916&jid=207518192&_u=YEBAAAAAAAAAAC~&z=1572055668 HTTP/1.1Host: www.google.co.ukConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://web.dev/hacked/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /manifest.webmanifest HTTP/1.1Host: web.devConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://web.dev/hacked/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /images/favicon.ico HTTP/1.1Host: web.devConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://web.dev/hacked/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _ga=GA1.2.1778341496.1653706916; _gid=GA1.2.1189465226.1653706916; _gat=1
Source: global traffic HTTP traffic detected: GET /images/android-chrome-192x192.png HTTP/1.1Host: web.devConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://web.dev/hacked/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _ga=GA1.2.1778341496.1653706916; _gid=GA1.2.1189465226.1653706916; _gat=1
Source: global traffic HTTP traffic detected: GET /images/favicon-32x32.png HTTP/1.1Host: web.devConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://web.dev/hacked/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _ga=GA1.2.1778341496.1653706916; _gid=GA1.2.1189465226.1653706916; _gat=1
Source: global traffic HTTP traffic detected: GET /images/favicon-16x16.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: web.dev
Source: global traffic HTTP traffic detected: GET /images/lockup-color.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: web.dev
Source: global traffic HTTP traffic detected: GET /safebrowsing/report_error/?tpl=websearch&url=https://accounts.appsgsuite-tunneldrive.tk/eEBrdljc HTTP/1.1Host: www.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundVary: OriginCross-Origin-Resource-Policy: cross-originContent-Type: image/webpDate: Fri, 27 May 2022 18:01:57 GMTExpires: Fri, 27 May 2022 18:02:27 GMTCache-Control: public, max-age=30X-Content-Type-Options: nosniffServer: sffeContent-Length: 552X-XSS-Protection: 0Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"Connection: close
Source: 98ec5fff-17af-491e-a764-2aa173100102.tmp.1.dr, 83a243a1-c135-46b4-bf83-15965a96d979.tmp.1.dr String found in binary or memory: https://accounts.google.com
Source: craw_window.js.0.dr String found in binary or memory: https://accounts.google.com/MergeSession
Source: 98ec5fff-17af-491e-a764-2aa173100102.tmp.1.dr, 83a243a1-c135-46b4-bf83-15965a96d979.tmp.1.dr String found in binary or memory: https://apis.google.com
Source: 98ec5fff-17af-491e-a764-2aa173100102.tmp.1.dr, 83a243a1-c135-46b4-bf83-15965a96d979.tmp.1.dr String found in binary or memory: https://clients2.google.com
Source: manifest.json.0.dr String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 98ec5fff-17af-491e-a764-2aa173100102.tmp.1.dr, 83a243a1-c135-46b4-bf83-15965a96d979.tmp.1.dr String found in binary or memory: https://clients2.googleusercontent.com
Source: 98ec5fff-17af-491e-a764-2aa173100102.tmp.1.dr String found in binary or memory: https://content-autofill.googleapis.com
Source: c5292198-ab1a-48a7-9e6e-848ebbc14452.tmp.1.dr, 98ec5fff-17af-491e-a764-2aa173100102.tmp.1.dr, 83a243a1-c135-46b4-bf83-15965a96d979.tmp.1.dr, e8f43554-03a4-435b-91a2-a1351137ac6d.tmp.1.dr String found in binary or memory: https://dns.google
Source: 98ec5fff-17af-491e-a764-2aa173100102.tmp.1.dr String found in binary or memory: https://docs.google.com
Source: History Provider Cache.0.dr String found in binary or memory: https://docs.google.com/presentation/d/e/2PACX-1vQLIu1X0IVnxZJYibfHTDtGdl4umjzrNQRqM8P15_pKuHsxivDaD
Source: 98ec5fff-17af-491e-a764-2aa173100102.tmp.1.dr, 83a243a1-c135-46b4-bf83-15965a96d979.tmp.1.dr String found in binary or memory: https://fonts.googleapis.com
Source: 98ec5fff-17af-491e-a764-2aa173100102.tmp.1.dr, 83a243a1-c135-46b4-bf83-15965a96d979.tmp.1.dr String found in binary or memory: https://fonts.gstatic.com
Source: craw_window.js.0.dr, craw_background.js.0.dr String found in binary or memory: https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
Source: 98ec5fff-17af-491e-a764-2aa173100102.tmp.1.dr String found in binary or memory: https://lh3.googleusercontent.com
Source: 98ec5fff-17af-491e-a764-2aa173100102.tmp.1.dr, 83a243a1-c135-46b4-bf83-15965a96d979.tmp.1.dr String found in binary or memory: https://ogs.google.com
Source: craw_window.js.0.dr, manifest.json.0.dr String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: 98ec5fff-17af-491e-a764-2aa173100102.tmp.1.dr, 83a243a1-c135-46b4-bf83-15965a96d979.tmp.1.dr String found in binary or memory: https://play.google.com
Source: 98ec5fff-17af-491e-a764-2aa173100102.tmp.1.dr String found in binary or memory: https://r1---sn-4g5lznle.gvt1.com
Source: 98ec5fff-17af-491e-a764-2aa173100102.tmp.1.dr String found in binary or memory: https://redirector.gvt1.com
Source: 98ec5fff-17af-491e-a764-2aa173100102.tmp.1.dr String found in binary or memory: https://safebrowsing.google.com
Source: craw_window.js.0.dr, manifest.json.0.dr String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: 98ec5fff-17af-491e-a764-2aa173100102.tmp.1.dr, 83a243a1-c135-46b4-bf83-15965a96d979.tmp.1.dr String found in binary or memory: https://ssl.gstatic.com
Source: 98ec5fff-17af-491e-a764-2aa173100102.tmp.1.dr String found in binary or memory: https://transparencyreport.google.com
Source: craw_window.js.0.dr, craw_background.js.0.dr String found in binary or memory: https://www-googleapis-staging.sandbox.google.com
Source: 98ec5fff-17af-491e-a764-2aa173100102.tmp.1.dr String found in binary or memory: https://www.google-analytics.com
Source: 98ec5fff-17af-491e-a764-2aa173100102.tmp.1.dr, 83a243a1-c135-46b4-bf83-15965a96d979.tmp.1.dr String found in binary or memory: https://www.google.com
Source: manifest.json.0.dr String found in binary or memory: https://www.google.com/
Source: craw_window.js.0.dr String found in binary or memory: https://www.google.com/accounts/OAuthLogin?issueuberauth=1
Source: craw_window.js.0.dr String found in binary or memory: https://www.google.com/images/cleardot.gif
Source: craw_window.js.0.dr String found in binary or memory: https://www.google.com/images/dot2.gif
Source: craw_window.js.0.dr String found in binary or memory: https://www.google.com/images/x2.gif
Source: craw_background.js.0.dr String found in binary or memory: https://www.google.com/intl/en-US/chrome/blank.html
Source: History Provider Cache.0.dr String found in binary or memory: https://www.google.com/url?q=https://accounts.appsgsuite-tunneldrive.tk/eEBrdljc&sa=D&source=editors
Source: 98ec5fff-17af-491e-a764-2aa173100102.tmp.1.dr, craw_window.js.0.dr, craw_background.js.0.dr, 83a243a1-c135-46b4-bf83-15965a96d979.tmp.1.dr String found in binary or memory: https://www.googleapis.com
Source: manifest.json.0.dr String found in binary or memory: https://www.googleapis.com/
Source: manifest.json.0.dr String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json.0.dr String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json.0.dr String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json.0.dr String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: 98ec5fff-17af-491e-a764-2aa173100102.tmp.1.dr String found in binary or memory: https://www.googletagmanager.com
Source: 98ec5fff-17af-491e-a764-2aa173100102.tmp.1.dr, 83a243a1-c135-46b4-bf83-15965a96d979.tmp.1.dr String found in binary or memory: https://www.gstatic.com
Source: unknown HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: unknown HTTPS traffic detected: 172.217.168.65:443 -> 192.168.2.3:49767 version: TLS 1.2
Source: unknown HTTPS traffic detected: 142.250.203.100:443 -> 192.168.2.3:49785 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.36.158.100:443 -> 192.168.2.3:49924 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.36.158.100:443 -> 192.168.2.3:49923 version: TLS 1.2
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Local\Temp\6ddc5cac-2887-4c30-9d88-b56971765644.tmp Jump to behavior
Source: classification engine Classification label: clean1.win@39/101@19/16
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "https://docs.google.com/presentation/d/e/2PACX-1vQLIu1X0IVnxZJYibfHTDtGdl4umjzrNQRqM8P15_pKuHsxivDaDjKXey0w5atKnGomwg17E-2HUJIW/pub?start=false&loop=false&delayms=3000&slide=id.p
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1600,12104884464461412917,7261113528987720669,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1944 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1600,12104884464461412917,7261113528987720669,131072 --lang=en-US --service-sandbox-type=audio --enable-audio-service-sandbox --mojo-platform-channel-handle=6136 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1600,12104884464461412917,7261113528987720669,131072 --lang=en-US --service-sandbox-type=video_capture --enable-audio-service-sandbox --mojo-platform-channel-handle=6100 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1600,12104884464461412917,7261113528987720669,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1944 /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1600,12104884464461412917,7261113528987720669,131072 --lang=en-US --service-sandbox-type=audio --enable-audio-service-sandbox --mojo-platform-channel-handle=6136 /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1600,12104884464461412917,7261113528987720669,131072 --lang=en-US --service-sandbox-type=video_capture --enable-audio-service-sandbox --mojo-platform-channel-handle=6100 /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Program Files\Google\Chrome\Application\Dictionaries Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-6291905B-17B8.pma Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 635351 URL: https://docs.google.com/pre... Startdate: 27/05/2022 Architecture: WINDOWS Score: 1 16 www.google.com 2->16 18 web.dev 2->18 20 4 other IPs or domains 2->20 6 chrome.exe 14 242 2->6         started        process3 dnsIp4 22 192.168.2.1 unknown unknown 6->22 24 239.255.255.250 unknown Reserved 6->24 9 chrome.exe 38 6->9         started        12 chrome.exe 6->12         started        14 chrome.exe 1 6 6->14         started        process5 dnsIp6 26 stats.l.doubleclick.net 108.177.126.156, 443, 49907 GOOGLEUS United States 9->26 28 www.google.com 142.250.203.100, 443, 49778, 49785 GOOGLEUS United States 9->28 30 22 other IPs or domains 9->30
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
216.58.215.238
 clients.l.google.com United States
15169 GOOGLEUS false
216.58.215.227
 gstaticadssl.l.google.com United States
15169 GOOGLEUS false
142.250.203.100
 www.google.com United States
15169 GOOGLEUS false
172.217.168.46
 www3.l.google.com United States
15169 GOOGLEUS false
199.36.158.100
 web.dev United States
15169 GOOGLEUS false
172.217.168.35
 www.google.co.uk United States
15169 GOOGLEUS false
172.217.168.8
 www-googletagmanager.l.google.com United States
15169 GOOGLEUS false
172.217.168.14
 docs.google.com United States
15169 GOOGLEUS false
239.255.255.250
 unknown Reserved
unknown unknown false
151.101.14.208
 dualstack.com.imgix.map.fastly.net United States
54113 FASTLYUS false
108.177.126.156
 stats.l.doubleclick.net United States
15169 GOOGLEUS false
172.217.168.86
 i.ytimg.com United States
15169 GOOGLEUS false
172.217.168.65
 googlehosted.l.googleusercontent.com United States
15169 GOOGLEUS false
142.250.203.109
 accounts.google.com United States
15169 GOOGLEUS false

Private

IP
192.168.2.1
127.0.0.1

Contacted Domains

Name IP Active
gstaticadssl.l.google.com 216.58.215.227 true
docs.google.com 172.217.168.14 true
web.dev 199.36.158.100 true
accounts.google.com 142.250.203.109 true
www-google-analytics.l.google.com 142.250.203.110 true
stats.l.doubleclick.net 108.177.126.156 true
www-googletagmanager.l.google.com 172.217.168.8 true
i.ytimg.com 172.217.168.86 true
play.google.com 142.250.203.110 true
www3.l.google.com 172.217.168.46 true
developers.google.com 172.217.168.14 true
sb.l.google.com 142.250.203.110 true
www.google.co.uk 172.217.168.35 true
www.google.com 142.250.203.100 true
clients.l.google.com 216.58.215.238 true
dualstack.com.imgix.map.fastly.net 151.101.14.208 true
googlehosted.l.googleusercontent.com 172.217.168.65 true
transparencyreport.google.com unknown unknown
lh3.googleusercontent.com unknown unknown
stats.g.doubleclick.net unknown unknown
clients2.google.com unknown unknown
web-dev.imgix.net unknown unknown
safebrowsing.google.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://www.google.com/url?q=https://accounts.appsgsuite-tunneldrive.tk/eEBrdljc&sa=D&source=editors&ust=1653677947346759&usg=AOvVaw3QU4sK3cAcPp4ymAmsc8mY false
    		high
    https://web.dev/js/store-1afdb64d.js false
    • Avira URL Cloud: safe
    		 unknown
    https://web.dev/js/index-793a397e.js false
    • Avira URL Cloud: safe
    		 unknown
    https://transparencyreport.google.com/safe-browsing/search false
      		high
      https://www.google.com/url?q=https://accounts.appsgsuite-tunneldrive.tk/eEBrdljc&sa=D&source=editors&ust=1653677947346759&usg=AOvVaw3QU4sK3cAcPp4ymAmsc8mY false
        		high
        https://web.dev/hacked/ false
          		unknown
          https://transparencyreport.google.com/ false
            		high
            https://web.dev/css/next.css?v=30010cda false
            • Avira URL Cloud: safe
            		 unknown
            https://web.dev/fonts/google-sans/bold/latin.woff2 false
            • 0%, Virustotal, Browse
            • Avira URL Cloud: safe
            		 unknown
            https://web.dev/js/app.js?v=145f0867 false
            • Avira URL Cloud: safe
            		 unknown
            https://www.google.co.uk/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-126406676-2&cid=1778341496.1653706916&jid=207518192&_u=YEBAAAAAAAAAAC~&z=1572055668 false
            • Avira URL Cloud: safe
            		 unknown
            https://www.google.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg false
              		high
              https://web.dev/images/favicon-32x32.png false
              • Avira URL Cloud: safe
              		 unknown
              https://web.dev/images/lockup-color.png false
              • Avira URL Cloud: safe
              		 unknown
              https://www.google.com/favicon.ico?v1 false
                		high
                https://web.dev/images/android-chrome-192x192.png false
                • Avira URL Cloud: safe
                		 unknown
                https://docs.google.com/presentation/d/e/2PACX-1vQLIu1X0IVnxZJYibfHTDtGdl4umjzrNQRqM8P15_pKuHsxivDaDjKXey0w5atKnGomwg17E-2HUJIW/pub?start=false&loop=false&delayms=3000&slide=id.p false
                  		high
                  https://web.dev/manifest.webmanifest false
                  • Avira URL Cloud: safe
                  		 unknown
                  https://web.dev/images/favicon-16x16.png false
                  • Avira URL Cloud: safe
                  		 unknown
                  https://transparencyreport.google.com/safe-browsing/overview false
                    		high
                    https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdCiQETAAAAADLZgnQbEQ8zAGa1eL7YA7TtN4N1&co=aHR0cHM6Ly9zYWZlYnJvd3NpbmcuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=M-QqaF9xk6BpjLH22uHZRhXt&size=normal&cb=cg7d3oeuaspl false
                      		high
                      https://www.google.com/tools/firefox/common/moz-header-bg-bottom.png false
                        		high
                        https://web.dev/images/favicon.ico false
                        • Avira URL Cloud: safe
                        		 unknown
                        https://transparencyreport.google.com/safe-browsing/overview false
                          		high
                          https://web.dev/css/legacy-rollout.css?v=c92bcb17 false
                          • Avira URL Cloud: safe
                          		 unknown
                          https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 false
                            		high
                            https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard false
                              		high
                              https://docs.google.com/presentation/d/e/2PACX-1vQLIu1X0IVnxZJYibfHTDtGdl4umjzrNQRqM8P15_pKuHsxivDaDjKXey0w5atKnGomwg17E-2HUJIW/pub?start=false&loop=false&delayms=3000&slide=id.p false
                                		high
                                https://web.dev/fonts/google-sans/regular/latin.woff2 false
                                • Avira URL Cloud: safe
                                		 unknown
                                https://web.dev/js/index-a8636400.js false
                                • Avira URL Cloud: safe
                                		 unknown
                                https://web.dev/js/index-d1373fab.js false
                                • Avira URL Cloud: safe
                                		 unknown
                                https://web.dev/hacked/ false
                                  		unknown
                                  https://web-dev.imgix.net/image/kheDArv5csY6rvQUJDbWRscckLr1/INhVTTPZ65TEBG9N4Qpz.gif?auto=format&w=845 false
                                    		high
                                    https://www.google.com/images/phishing_logo.png false
                                      		high
                                      https://developers.google.com/web/fundamentals/security/hacked false
                                        		high
                                        https://i.ytimg.com/vi_webp/mbJvL61DOZg/hqdefault.webp false
                                          		high
                                          https://web.dev/js/content.js?v=00db7c42 false
                                          • Avira URL Cloud: safe
                                          		 unknown
                                          https://www.google.com/tools/firefox/common/moz-header-bg-top.png false
                                            		high
                                            https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-126406676-2&cid=1778341496.1653706916&jid=207518192&gjid=2063473025&_gid=1189465226.1653706916&_u=YEBAAAAAAAAAAC~&z=487429079 false
                                              		high
                                              https://web.dev/fonts/material-icons/regular.woff2 false
                                              • Avira URL Cloud: safe
                                              		 unknown
                                              http://www.google.com/safebrowsing/report_error/?tpl=websearch&url=https://accounts.appsgsuite-tunneldrive.tk/eEBrdljc false
                                                		high
                                                https://safebrowsing.google.com/safebrowsing/report_error/?tpl=websearch&url=https://accounts.appsgsuite-tunneldrive.tk/eEBrdljc&hl=en false
                                                  		high
                                                  https://www.google.com/recaptcha/api2/bframe?hl=en&v=M-QqaF9xk6BpjLH22uHZRhXt&k=6LdCiQETAAAAADLZgnQbEQ8zAGa1eL7YA7TtN4N1 false
                                                    		high