Analysis Report https://docs.google.com/forms/d/e/1FAIpQLScMM9oeboGCqCY9IhNTWcPfX75sr8KJDxUhz1WOhVNCro9dgQ/viewform

AV Detection:

Antivirus / Scanner detection for submitted sample

Source: https://docs.google.com/forms/d/e/1FAIpQLScMM9oeboGCqCY9IhNTWcPfX75sr8KJDxUhz1WOhVNCro9dgQ/viewform

SlashNext: detection malicious, Label: Fake Login Page type: Phishing & Social Engineering

Phishing:

Yara detected HtmlPhish_20

Source: Yara match

File source: 124406.pages.csv, type: HTML

Found iframes

Source: https://www.youtube.com/embed/48l-xdS4pXg?rel=0&showinfo=0&theme=light&version=3&hl=en&cc_lang_pref=en&cc_load_policy=1&enablejsapi=1	HTTP Parser: Iframe src: https://accounts.youtube.com/accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=1020727955&timestamp=1606473848621
Source: https://www.youtube.com/embed/48l-xdS4pXg?rel=0&showinfo=0&theme=light&version=3&hl=en&cc_lang_pref=en&cc_load_policy=1&enablejsapi=1	HTTP Parser: Iframe src: /_/bscframe
Source: https://www.youtube.com/embed/48l-xdS4pXg?rel=0&showinfo=0&theme=light&version=3&hl=en&cc_lang_pref=en&cc_load_policy=1&enablejsapi=1	HTTP Parser: Iframe src: https://accounts.youtube.com/accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=1020727955&timestamp=1606473848621
Source: https://www.youtube.com/embed/48l-xdS4pXg?rel=0&showinfo=0&theme=light&version=3&hl=en&cc_lang_pref=en&cc_load_policy=1&enablejsapi=1	HTTP Parser: Iframe src: /_/bscframe
Source: https://accounts.google.com/signin/v2/identifier?service=wise&passive=1209600&continue=https%3A%2F%2Fdocs.google.com%2Fforms%2Fcreate%3Fusp%3Ddirect_url&followup=https%3A%2F%2Fdocs.google.com%2Fforms%2Fcreate%3Fusp%3Ddirect_url&ltmpl=forms&flowName=GlifWebSignIn&flowEntry=ServiceLogin	HTTP Parser: Iframe src: https://accounts.youtube.com/accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=261022107&timestamp=1606473817653
Source: https://accounts.google.com/signin/v2/identifier?service=wise&passive=1209600&continue=https%3A%2F%2Fdocs.google.com%2Fforms%2Fcreate%3Fusp%3Ddirect_url&followup=https%3A%2F%2Fdocs.google.com%2Fforms%2Fcreate%3Fusp%3Ddirect_url&ltmpl=forms&flowName=GlifWebSignIn&flowEntry=ServiceLogin	HTTP Parser: Iframe src: /_/bscframe
Source: https://accounts.google.com/signin/v2/identifier?service=wise&passive=1209600&continue=https%3A%2F%2Fdocs.google.com%2Fforms%2Fcreate%3Fusp%3Ddirect_url&followup=https%3A%2F%2Fdocs.google.com%2Fforms%2Fcreate%3Fusp%3Ddirect_url&ltmpl=forms&flowName=GlifWebSignIn&flowEntry=ServiceLogin	HTTP Parser: Iframe src: https://accounts.youtube.com/accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=261022107&timestamp=1606473817653
Source: https://accounts.google.com/signin/v2/identifier?service=wise&passive=1209600&continue=https%3A%2F%2Fdocs.google.com%2Fforms%2Fcreate%3Fusp%3Ddirect_url&followup=https%3A%2F%2Fdocs.google.com%2Fforms%2Fcreate%3Fusp%3Ddirect_url&ltmpl=forms&flowName=GlifWebSignIn&flowEntry=ServiceLogin	HTTP Parser: Iframe src: /_/bscframe
Source: https://www.google.com/forms/about/?utm_source=product&utm_medium=forms_logo&utm_campaign=forms	HTTP Parser: Iframe src: //2542116.fls.doubleclick.net/activityi;src=2542116;type=gdrive;cat=googl004;ord=337592002901.6477?
Source: https://www.google.com/forms/about/?utm_source=product&utm_medium=forms_logo&utm_campaign=forms	HTTP Parser: Iframe src: //2542116.fls.doubleclick.net/activityi;src=2542116;type=gdrive;cat=googl004;ord=337592002901.6477?

Unusual large HTML page

Source: https://www.youtube.com/embed/48l-xdS4pXg?rel=0&showinfo=0&theme=light&version=3&hl=en&cc_lang_pref=en&cc_load_policy=1&enablejsapi=1	HTTP Parser: Total size: 1662020
Source: https://www.youtube.com/embed/48l-xdS4pXg?rel=0&showinfo=0&theme=light&version=3&hl=en&cc_lang_pref=en&cc_load_policy=1&enablejsapi=1	HTTP Parser: Total size: 1662020
Source: https://accounts.google.com/signin/v2/identifier?service=wise&passive=1209600&continue=https%3A%2F%2Fdocs.google.com%2Fforms%2Fcreate%3Fusp%3Ddirect_url&followup=https%3A%2F%2Fdocs.google.com%2Fforms%2Fcreate%3Fusp%3Ddirect_url&ltmpl=forms&flowName=GlifWebSignIn&flowEntry=ServiceLogin	HTTP Parser: Total size: 1577689
Source: https://accounts.google.com/signin/v2/identifier?service=wise&passive=1209600&continue=https%3A%2F%2Fdocs.google.com%2Fforms%2Fcreate%3Fusp%3Ddirect_url&followup=https%3A%2F%2Fdocs.google.com%2Fforms%2Fcreate%3Fusp%3Ddirect_url&ltmpl=forms&flowName=GlifWebSignIn&flowEntry=ServiceLogin	HTTP Parser: Total size: 1577689

META author tag missing

Source: https://www.youtube.com/embed/48l-xdS4pXg?rel=0&showinfo=0&theme=light&version=3&hl=en&cc_lang_pref=en&cc_load_policy=1&enablejsapi=1	HTTP Parser: No <meta name="author".. found
Source: https://www.youtube.com/embed/48l-xdS4pXg?rel=0&showinfo=0&theme=light&version=3&hl=en&cc_lang_pref=en&cc_load_policy=1&enablejsapi=1	HTTP Parser: No <meta name="author".. found
Source: https://accounts.google.com/signin/v2/identifier?service=wise&passive=1209600&continue=https%3A%2F%2Fdocs.google.com%2Fforms%2Fcreate%3Fusp%3Ddirect_url&followup=https%3A%2F%2Fdocs.google.com%2Fforms%2Fcreate%3Fusp%3Ddirect_url&ltmpl=forms&flowName=GlifWebSignIn&flowEntry=ServiceLogin	HTTP Parser: No <meta name="author".. found
Source: https://accounts.google.com/signin/v2/identifier?service=wise&passive=1209600&continue=https%3A%2F%2Fdocs.google.com%2Fforms%2Fcreate%3Fusp%3Ddirect_url&followup=https%3A%2F%2Fdocs.google.com%2Fforms%2Fcreate%3Fusp%3Ddirect_url&ltmpl=forms&flowName=GlifWebSignIn&flowEntry=ServiceLogin	HTTP Parser: No <meta name="author".. found
Source: https://www.google.com/forms/about/?utm_source=product&utm_medium=forms_logo&utm_campaign=forms	HTTP Parser: No <meta name="author".. found
Source: https://www.google.com/forms/about/?utm_source=product&utm_medium=forms_logo&utm_campaign=forms	HTTP Parser: No <meta name="author".. found

META copyright tag missing

Source: https://www.youtube.com/embed/48l-xdS4pXg?rel=0&showinfo=0&theme=light&version=3&hl=en&cc_lang_pref=en&cc_load_policy=1&enablejsapi=1	HTTP Parser: No <meta name="copyright".. found
Source: https://www.youtube.com/embed/48l-xdS4pXg?rel=0&showinfo=0&theme=light&version=3&hl=en&cc_lang_pref=en&cc_load_policy=1&enablejsapi=1	HTTP Parser: No <meta name="copyright".. found
Source: https://accounts.google.com/signin/v2/identifier?service=wise&passive=1209600&continue=https%3A%2F%2Fdocs.google.com%2Fforms%2Fcreate%3Fusp%3Ddirect_url&followup=https%3A%2F%2Fdocs.google.com%2Fforms%2Fcreate%3Fusp%3Ddirect_url&ltmpl=forms&flowName=GlifWebSignIn&flowEntry=ServiceLogin	HTTP Parser: No <meta name="copyright".. found
Source: https://accounts.google.com/signin/v2/identifier?service=wise&passive=1209600&continue=https%3A%2F%2Fdocs.google.com%2Fforms%2Fcreate%3Fusp%3Ddirect_url&followup=https%3A%2F%2Fdocs.google.com%2Fforms%2Fcreate%3Fusp%3Ddirect_url&ltmpl=forms&flowName=GlifWebSignIn&flowEntry=ServiceLogin	HTTP Parser: No <meta name="copyright".. found
Source: https://www.google.com/forms/about/?utm_source=product&utm_medium=forms_logo&utm_campaign=forms	HTTP Parser: No <meta name="copyright".. found
Source: https://www.google.com/forms/about/?utm_source=product&utm_medium=forms_logo&utm_campaign=forms	HTTP Parser: No <meta name="copyright".. found

Networking:

Found strings which match to known social media urls

Source: QuotaManager.0.dr	String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: 082161909dab20de_0.0.dr	String found in binary or memory: "https://www.youtube.com/iframe_api equals www.youtube.com (Youtube)
Source: 000003.log5.0.dr	String found in binary or memory: -_https://www.youtube.com equals www.youtube.com (Youtube)
Source: 07ef20801bad13ca_0.0.dr	String found in binary or memory: 1https://www.youtube.com/subscribe_embed?usegapi=1 equals www.youtube.com (Youtube)
Source: LOG20.0.dr	String found in binary or memory: 2020/11/27-11:43:33.968 1054 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb/MANIFEST-000001 equals www.youtube.com (Youtube)
Source: LOG20.0.dr	String found in binary or memory: 2020/11/27-11:44:05.250 164c Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb/MANIFEST-000001 equals www.youtube.com (Youtube)
Source: LOG20.0.dr	String found in binary or memory: 2020/11/27-11:44:05.252 164c Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb/000004.log equals www.youtube.com (Youtube)
Source: 000003.log5.0.dr	String found in binary or memory: 5_https://www.youtube.com equals www.youtube.com (Youtube)
Source: dc7aac768f45987c_0.0.dr	String found in binary or memory: ://secure-...imrworldwide.com/ ://cdn.imrworldwide.com/ ://aksecure.imrworldwide.com/ ://[^.]*.moatads.com ://youtube[0-9]+.moatpixel.com ://pm.adsafeprotected.com/youtube ://pm.test-adsafeprotected.com/youtube ://e[0-9]+.yt.srs.doubleverify.com www.google.com/pagead/xsul www.youtube.com/pagead/slav equals www.youtube.com (Youtube)
Source: QuotaManager.0.dr	String found in binary or memory: =https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: 000003.log0.0.dr	String found in binary or memory: Gnamespace-6a1fa1ba_a389_4233_a821_5bbda85c8442-https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: 000003.log0.0.dr	String found in binary or memory: Gnamespace-6d6edaeb_eea5_487c_9f13_f9cc6792cc59-https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: 000003.log0.0.dr	String found in binary or memory: Gnamespace-fb0490d5_6fc5_4128_9bd3_5a5278b8d923-https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: dc7aac768f45987c_0.0.dr	String found in binary or memory: Ihttps://www.youtube.com/s/player/77da52cd/player_ias.vflset/en_US/base.jsaD` equals www.youtube.com (Youtube)
Source: 91c6a9ede3ddfff5_0.0.dr	String found in binary or memory: Jhttps://www.youtube.com/s/player/77da52cd/player_ias.vflset/en_US/embed.jsaD` equals www.youtube.com (Youtube)
Source: f7baaacdffcdd6ef_0.0.dr	String found in binary or memory: Khttps://www.youtube.com/s/player/77da52cd/player_ias.vflset/en_US/remote.jsaD` equals www.youtube.com (Youtube)
Source: c9c88edbb2f2b0dc_0.0.dr	String found in binary or memory: Lhttps://www.youtube.com/yts/jsbin/fetch-polyfill-vfl6MZH8P/fetch-polyfill.jsaD` equals www.youtube.com (Youtube)
Source: 000003.log5.0.dr	String found in binary or memory: META:https://www.youtube.com equals www.youtube.com (Youtube)
Source: 5c3c7bdf1979294f_0.0.dr	String found in binary or memory: Ohttps://www.youtube.com/s/player/77da52cd/www-widgetapi.vflset/www-widgetapi.jsaD` equals www.youtube.com (Youtube)
Source: 0e9e344432c75fc9_0.0.dr	String found in binary or memory: Uhttps://www.youtube.com/s/player/77da52cd/www-embed-player.vflset/www-embed-player.jsaD` equals www.youtube.com (Youtube)
Source: 000003.log5.0.dr	String found in binary or memory: _https://www.youtube.com equals www.youtube.com (Youtube)
Source: 05234906b57037c5_0.0.dr	String found in binary or memory: _keyhttps://www.youtube.com/s/player/77da52cd/player_ias.vflset/en_US/base.js equals www.youtube.com (Youtube)
Source: 91c6a9ede3ddfff5_0.0.dr	String found in binary or memory: _keyhttps://www.youtube.com/s/player/77da52cd/player_ias.vflset/en_US/embed.js equals www.youtube.com (Youtube)
Source: 5f9dbdcbdc4b150c_0.0.dr	String found in binary or memory: _keyhttps://www.youtube.com/s/player/77da52cd/player_ias.vflset/en_US/remote.js equals www.youtube.com (Youtube)
Source: 7fec68cb99f7c1d3_0.0.dr	String found in binary or memory: _keyhttps://www.youtube.com/s/player/77da52cd/www-widgetapi.vflset/www-widgetapi.js equals www.youtube.com (Youtube)
Source: c9c88edbb2f2b0dc_0.0.dr	String found in binary or memory: _keyhttps://www.youtube.com/yts/jsbin/fetch-polyfill-vfl6MZH8P/fetch-polyfill.js equals www.youtube.com (Youtube)
Source: 91c6a9ede3ddfff5_0.0.dr	String found in binary or memory: f_keyhttps://www.youtube.com/s/player/77da52cd/player_ias.vflset/en_US/embed.js equals www.youtube.com (Youtube)
Source: Current Session.0.dr	String found in binary or memory: https://www.youtube.com equals www.youtube.com (Youtube)
Source: Current Session.0.dr	String found in binary or memory: https://www.youtube.com# equals www.youtube.com (Youtube)
Source: Network Action Predictor-journal.0.dr	String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: Current Session.0.dr	String found in binary or memory: https://www.youtube.com/embed/48l-xdS4pXg?rel=0&showinfo=0&theme=light&version=3&hl=en&cc_lang_pref=en&cc_load_policy=1&enablejsapi=1 equals www.youtube.com (Youtube)
Source: Current Session.0.dr	String found in binary or memory: https://www.youtube.com/embed/YlmVKT3Zvhw?rel=0&showinfo=0&theme=light&version=3&hl=en&cc_lang_pref=en&cc_load_policy=1&enablejsapi=1 equals www.youtube.com (Youtube)
Source: Current Session.0.dr	String found in binary or memory: https://www.youtube.com/embed/ZdEIZNg3epQ?rel=0&showinfo=0&theme=light&version=3&hl=en&cc_lang_pref=en&cc_load_policy=1&enablejsapi=1 equals www.youtube.com (Youtube)
Source: Current Session.0.dr	String found in binary or memory: https://www.youtube.com/embed/ggoJFaE71W8?rel=0&showinfo=0&theme=light&version=3&hl=en&cc_lang_pref=en&cc_load_policy=1&enablejsapi=1 equals www.youtube.com (Youtube)
Source: 082161909dab20de_0.0.dr	String found in binary or memory: https://www.youtube.com/iframe_api equals www.youtube.com (Youtube)
Source: dc7aac768f45987c_0.0.dr	String found in binary or memory: https://www.youtube.com/s/player/77da52cd/player_ias.vflset/en_US/base.js equals www.youtube.com (Youtube)
Source: 91c6a9ede3ddfff5_0.0.dr	String found in binary or memory: https://www.youtube.com/s/player/77da52cd/player_ias.vflset/en_US/embed.js equals www.youtube.com (Youtube)
Source: f7baaacdffcdd6ef_0.0.dr	String found in binary or memory: https://www.youtube.com/s/player/77da52cd/player_ias.vflset/en_US/remote.js equals www.youtube.com (Youtube)
Source: 0e9e344432c75fc9_0.0.dr	String found in binary or memory: https://www.youtube.com/s/player/77da52cd/www-embed-player.vflset/www-embed-player.js equals www.youtube.com (Youtube)
Source: 5c3c7bdf1979294f_0.0.dr	String found in binary or memory: https://www.youtube.com/s/player/77da52cd/www-widgetapi.vflset/www-widgetapi.js equals www.youtube.com (Youtube)
Source: 07ef20801bad13ca_0.0.dr	String found in binary or memory: https://www.youtube.com/subscribe_embed?usegapi=1 equals www.youtube.com (Youtube)
Source: c9c88edbb2f2b0dc_0.0.dr	String found in binary or memory: https://www.youtube.com/yts/jsbin/fetch-polyfill-vfl6MZH8P/fetch-polyfill.jsa equals www.youtube.com (Youtube)
Source: 000005.ldb.0.dr	String found in binary or memory: https_www.youtube.com_0@1 equals www.youtube.com (Youtube)
Source: dc7aac768f45987c_0.0.dr	String found in binary or memory: www.youtube-nocookie.com youtube-nocookie.com www.youtube-nocookie.com:443 youtube.googleapis.com www.youtubeedu.com www.youtubeeducation.com video.google.com redirector.gvt1.com equals www.youtube.com (Youtube)

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: lh6.googleusercontent.com

Urls found in memory or binary data

Source: 3119773edcbc634b_0.0.dr	String found in binary or memory: http://www.google-analytics.com
Source: Current Session.0.dr	String found in binary or memory: https://2542116.fls.doubleclick.net/activityi;dc_pre=CM_g9qXFou0CFbLauwgddnkJYw;src=2542116;type=gdr
Source: Network Action Predictor-journal.0.dr, 588e6311b9075013_0.0.dr	String found in binary or memory: https://about.google/
Source: 4739ef39d3645e5f_0.0.dr	String found in binary or memory: https://about.google/P
Source: ca5dd8c4d05c0b30_0.0.dr	String found in binary or memory: https://about.google/assets-products/js/index.min.js?cache=627e25d
Source: 1154c6710157da27_0.0.dr	String found in binary or memory: https://about.google/f
Source: Favicons.0.dr	String found in binary or memory: https://about.google/favicon.ico
Source: Favicons.0.dr	String found in binary or memory: https://about.google/favicon.ico)
Source: Favicons.0.dr	String found in binary or memory: https://about.google/intl/en/products
Source: Current Session.0.dr	String found in binary or memory: https://about.google/intl/en/products/
Source: Current Session.0.dr	String found in binary or memory: https://about.google/intl/en/products/3Browse
Source: History-journal.0.dr	String found in binary or memory: https://about.google/intl/en/products/Browse
Source: History-journal.0.dr	String found in binary or memory: https://about.google/intl/en/productsBrowse
Source: 1dfa01c69b3f0b46_0.0.dr	String found in binary or memory: https://about.google/lTR
Source: 000003.log5.0.dr, Current Session.0.dr, 681b349e-2088-4df0-a7d1-5213f7f5b54e.tmp.1.dr, manifest.json0.0.dr	String found in binary or memory: https://accounts.google.com
Source: Current Session.0.dr	String found in binary or memory: https://accounts.google.com#
Source: 07ef20801bad13ca_0.0.dr	String found in binary or memory: https://accounts.google.com/
Source: Current Session.0.dr, History-journal.0.dr	String found in binary or memory: https://accounts.google.com/ServiceLogin?passive=1209600&continue=https://policies.google.com/terms&
Source: Current Session.0.dr, History-journal.0.dr	String found in binary or memory: https://accounts.google.com/ServiceLogin?service=wise&passive=1209600&continue=https://docs.google.c
Source: 8a9e3602322321ad_0.0.dr	String found in binary or memory: https://accounts.google.com/T
Source: Current Session.0.dr	String found in binary or memory: https://accounts.google.com/_/bscframe
Source: 703be6558b4a4b13_0.0.dr	String found in binary or memory: https://accounts.google.com/fY
Source: f0b802191aedee87_0.0.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: f0b802191aedee87_0.0.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/iframe
Source: 2b8d5dddd6dd1e72_0.0.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: Current Session.0.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay?parent=https%3A%2F%2Fgroups.google.com&jsh=m%3
Source: Current Session.0.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay?parent=https%3A%2F%2Fsupport.google.com&jsh=m%
Source: Current Session.0.dr, History-journal.0.dr	String found in binary or memory: https://accounts.google.com/signin/v2/identifier?passive=1209600&continue=https%3A%2F%2Fpolicies.goo
Source: History-journal.0.dr	String found in binary or memory: https://accounts.google.com/signin/v2/identifier?service=wise&passive=1209600&continue=https%3A%2F%2
Source: Current Session.0.dr	String found in binary or memory: https://accounts.google.comh
Source: Current Session.0.dr	String found in binary or memory: https://accounts.youtube.com/accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=10207
Source: Current Session.0.dr	String found in binary or memory: https://accounts.youtube.com/accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=26102
Source: 2b8d5dddd6dd1e72_0.0.dr, 681b349e-2088-4df0-a7d1-5213f7f5b54e.tmp.1.dr, manifest.json0.0.dr	String found in binary or memory: https://apis.google.com
Source: Network Action Predictor.0.dr	String found in binary or memory: https://apis.google.com/
Source: ce4273d90c90eba1_0.0.dr	String found in binary or memory: https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.uhBKOtz6fOw.O/m=client/exm=gapi_iframes
Source: 6d788602d9397b51_0.0.dr	String found in binary or memory: https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.uhBKOtz6fOw.O/m=cloudsearch/exm=gapi_if
Source: 26d197d0a9d08372_0.0.dr	String found in binary or memory: https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.uhBKOtz6fOw.O/m=gapi_iframes
Source: 4429b390a455788d_0.0.dr	String found in binary or memory: https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.uhBKOtz6fOw.O/m=googleapis_proxy/rt=j/s
Source: 2b8d5dddd6dd1e72_0.0.dr, d9ea1b398286188d_0.0.dr	String found in binary or memory: https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.uhBKOtz6fOw.O/m=rpc
Source: 5a4ad82dcdf2bc1d_0.0.dr, e769cbdaa62069cc_0.0.dr	String found in binary or memory: https://apis.google.com/js/api.js
Source: 0c23a985777e7777_0.0.dr	String found in binary or memory: https://apis.google.com/js/googleapis.proxy.js?onload=startup
Source: 07ef20801bad13ca_0.0.dr	String found in binary or memory: https://apis.google.com/js/rpc:shindig_random.js?onload=init
Source: 07ef20801bad13ca_0.0.dr	String found in binary or memory: https://apis.google.com/js/rpc:shindig_random.js?onload=inita
Source: 07ef20801bad13ca_0.0.dr	String found in binary or memory: https://apis.google.com/js/rpc:shindig_random.js?onload=initaD
Source: 07ef20801bad13ca_0.0.dr	String found in binary or memory: https://apis.google.com/marketplace/button?usegapi=1
Source: 681b349e-2088-4df0-a7d1-5213f7f5b54e.tmp.1.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.0.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 681b349e-2088-4df0-a7d1-5213f7f5b54e.tmp.1.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: 07ef20801bad13ca_0.0.dr	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/widget/backdrop?usegapi=1
Source: f0b802191aedee87_0.0.dr	String found in binary or memory: https://clients6.google.com
Source: Current Session.0.dr	String found in binary or memory: https://consent.google.com
Source: Current Session.0.dr	String found in binary or memory: https://consent.google.com/intro/?continue=https://www.google.com/&origin=https://www.google.com&if=
Source: 157ac5dc69855318_0.0.dr	String found in binary or memory: https://content-googleapis-staging.sandbox.google.com
Source: 157ac5dc69855318_0.0.dr	String found in binary or memory: https://content-googleapis-test.sandbox.google.com
Source: 0c23a985777e7777_0.0.dr	String found in binary or memory: https://content-people-pa.googleapis.com/
Source: 2ba061c82dbc02c3_0.0.dr	String found in binary or memory: https://content-people-pa.googleapis.com/M
Source: Current Session.0.dr	String found in binary or memory: https://content-people-pa.googleapis.com/static/proxy.html?usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static
Source: f0b802191aedee87_0.0.dr, manifest.json0.0.dr	String found in binary or memory: https://content.googleapis.com
Source: 07ef20801bad13ca_0.0.dr	String found in binary or memory: https://dataconnector.corp.google.com/:session_prefix:ui/widgetview?usegapi=1
Source: e7a704ea-461a-4375-a028-81478b76e997.tmp.1.dr, 37eee103-0cd9-4eeb-9bc3-d3909676e7a0.tmp.1.dr, 681b349e-2088-4df0-a7d1-5213f7f5b54e.tmp.1.dr	String found in binary or memory: https://dns.google
Source: Current Session.0.dr	String found in binary or memory: https://docs.google.com
Source: Network Action Predictor-journal.0.dr	String found in binary or memory: https://docs.google.com/
Source: History-journal.0.dr	String found in binary or memory: https://docs.google.com/forms/?usp=direct_url
Source: History-journal.0.dr	String found in binary or memory: https://docs.google.com/forms/?usp=direct_urlGoogle
Source: History-journal.0.dr, Favicons-journal.0.dr	String found in binary or memory: https://docs.google.com/forms/create?usp=direct_url
Source: History-journal.0.dr	String found in binary or memory: https://docs.google.com/forms/create?usp=direct_urlGoogle
Source: Current Session.0.dr, History-journal.0.dr, Favicons-journal.0.dr	String found in binary or memory: https://docs.google.com/forms/d/e/1FAIpQLScMM9oeboGCqCY9IhNTWcPfX75sr8KJDxUhz1WOhVNCro9dgQ/reportabu
Source: History-journal.0.dr	String found in binary or memory: https://docs.google.com/forms/d/e/1FAIpQLScMM9oeboGCqCY9IhNTWcPfX75sr8KJDxUhz1WOhVNCro9dgQ/viewform
Source: Favicons-journal.0.dr	String found in binary or memory: https://docs.google.com/forms/d/e/1FAIpQLScMM9oeboGCqCY9IhNTWcPfX75sr8KJDxUhz1WOhVNCro9dgQ/viewform$
Source: History Provider Cache.0.dr	String found in binary or memory: https://docs.google.com/forms/d/e/1FAIpQLScMM9oeboGCqCY9IhNTWcPfX75sr8KJDxUhz1WOhVNCro9dgQ/viewform2
Source: Favicons-journal.0.dr	String found in binary or memory: https://docs.google.com/forms/d/e/1FAIpQLScMM9oeboGCqCY9IhNTWcPfX75sr8KJDxUhz1WOhVNCro9dgQ/viewform5
Source: History-journal.0.dr	String found in binary or memory: https://docs.google.com/forms/d/e/1FAIpQLScMM9oeboGCqCY9IhNTWcPfX75sr8KJDxUhz1WOhVNCro9dgQ/viewformO
Source: Favicons-journal.0.dr	String found in binary or memory: https://docs.google.com/forms/d/e/1FAIpQLScMM9oeboGCqCY9IhNTWcPfX75sr8KJDxUhz1WOhVNCro9dgQ/viewformu
Source: History-journal.0.dr, Favicons-journal.0.dr, Favicons.0.dr	String found in binary or memory: https://docs.google.com/forms?usp=direct_url
Source: History-journal.0.dr	String found in binary or memory: https://docs.google.com/forms?usp=direct_urlGoogle
Source: 2b8d5dddd6dd1e72_0.0.dr	String found in binary or memory: https://domains.google.com/suggest/flow
Source: 07ef20801bad13ca_0.0.dr	String found in binary or memory: https://drive.google.com/savetodrivebutton?usegapi=1
Source: 07ef20801bad13ca_0.0.dr	String found in binary or memory: https://families.google.com/webcreation?usegapi=1&usegapi=1
Source: manifest.json0.0.dr	String found in binary or memory: https://feedback.googleusercontent.com
Source: 681b349e-2088-4df0-a7d1-5213f7f5b54e.tmp.1.dr	String found in binary or memory: https://fonts.googleapis.com
Source: Network Action Predictor-journal.0.dr	String found in binary or memory: https://fonts.googleapis.com/
Source: manifest.json0.0.dr	String found in binary or memory: https://fonts.googleapis.com;
Source: 681b349e-2088-4df0-a7d1-5213f7f5b54e.tmp.1.dr	String found in binary or memory: https://fonts.gstatic.com
Source: Network Action Predictor-journal.0.dr	String found in binary or memory: https://fonts.gstatic.com/
Source: manifest.json0.0.dr	String found in binary or memory: https://fonts.gstatic.com;
Source: Current Session.0.dr	String found in binary or memory: https://forms.google.com/
Source: History-journal.0.dr	String found in binary or memory: https://forms.google.com/Google
Source: 718a1a1d7be9c6c6_0.0.dr, dbada67b2b04875a_0.0.dr, df2db86ec0c3b16d_0.0.dr	String found in binary or memory: https://google.com/
Source: 26d197d0a9d08372_0.0.dr	String found in binary or memory: https://google.com/&
Source: 549e8d03fe1c0183_0.0.dr	String found in binary or memory: https://google.com/2
Source: 5a9b93b880dd5d0d_0.0.dr	String found in binary or memory: https://google.com/4
Source: fc74ba6096babd64_0.0.dr	String found in binary or memory: https://google.com/7
Source: 7a4bf1395505a2f0_0.0.dr	String found in binary or memory: https://google.com/9A
Source: b3d98f6062aa0a1b_0.0.dr, 97171a3029d97be8_0.0.dr	String found in binary or memory: https://google.com/G
Source: 3f2d3790776e7f74_0.0.dr	String found in binary or memory: https://google.com/H
Source: c5f181eec6c11bbd_0.0.dr	String found in binary or memory: https://google.com/I
Source: 3b7f8d8816278017_0.0.dr	String found in binary or memory: https://google.com/J7
Source: b871161b0ea2aeec_0.0.dr	String found in binary or memory: https://google.com/L
Source: 4429b390a455788d_0.0.dr	String found in binary or memory: https://google.com/M
Source: 794694e376b2332a_0.0.dr	String found in binary or memory: https://google.com/U
Source: 6b796979063fb543_0.0.dr	String found in binary or memory: https://google.com/W
Source: a85ef9f0b361d948_0.0.dr	String found in binary or memory: https://google.com/Xo
Source: c68013b137647bd6_0.0.dr	String found in binary or memory: https://google.com/dy
Source: 3dbe54b7c92541c6_0.0.dr	String found in binary or memory: https://google.com/f
Source: 9e3c9641802413bb_0.0.dr	String found in binary or memory: https://google.com/h
Source: d73d3b79fae57c46_0.0.dr	String found in binary or memory: https://google.com/n3L
Source: 762f6db8d3c32da2_0.0.dr	String found in binary or memory: https://google.com/o
Source: Current Session.0.dr	String found in binary or memory: https://groups.google.com
Source: Network Action Predictor.0.dr, 000003.log0.0.dr	String found in binary or memory: https://groups.google.com/
Source: Current Session.0.dr	String found in binary or memory: https://groups.google.com/access-error?continue=https://groups.google.com/g/googledocs
Source: History-journal.0.dr	String found in binary or memory: https://groups.google.com/access-error?continue=https://groups.google.com/g/googledocsGoogle
Source: History-journal.0.dr	String found in binary or memory: https://groups.google.com/d/forum/GoogleDocs
Source: History-journal.0.dr	String found in binary or memory: https://groups.google.com/d/forum/GoogleDocsGoogle
Source: Favicons-journal.0.dr	String found in binary or memory: https://groups.google.com/favicon.ico
Source: History-journal.0.dr	String found in binary or memory: https://groups.google.com/forum/#
Source: d73d3b79fae57c46_0.0.dr	String found in binary or memory: https://groups.google.com/forum/0BE3F56D82FFB8F0104D8717E39C1184.cache.js
Source: Favicons-journal.0.dr	String found in binary or memory: https://groups.google.com/forum/favicon.ico
Source: Favicons-journal.0.dr	String found in binary or memory: https://groups.google.com/forum/favicon.ico&
Source: 9e3c9641802413bb_0.0.dr	String found in binary or memory: https://groups.google.com/forum/resources/4155270707-legacy-native-bundle-js__en_gb.js
Source: History-journal.0.dr	String found in binary or memory: https://groups.google.com/g/googledocs
Source: History-journal.0.dr	String found in binary or memory: https://groups.google.com/g/googledocsGoogle
Source: Current Session.0.dr	String found in binary or memory: https://groups.google.com/group/GoogleDocs
Source: History-journal.0.dr	String found in binary or memory: https://groups.google.com/group/GoogleDocsGoogle
Source: Current Session.0.dr	String found in binary or memory: https://groups.google.com/group/GoogleDocsWDI
Source: Current Session.0.dr	String found in binary or memory: https://groups.google.comh
Source: manifest.json0.0.dr	String found in binary or memory: https://hangouts.google.com/
Source: 681b349e-2088-4df0-a7d1-5213f7f5b54e.tmp.1.dr	String found in binary or memory: https://ogs.google.com
Source: dc7aac768f45987c_0.0.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/osd.js
Source: 07ef20801bad13ca_0.0.dr	String found in binary or memory: https://pay.google.com/gp/v/widget/save
Source: manifest.json.0.dr	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: 681b349e-2088-4df0-a7d1-5213f7f5b54e.tmp.1.dr	String found in binary or memory: https://play.google.com
Source: 07ef20801bad13ca_0.0.dr	String found in binary or memory: https://play.google.com/work/embedded/search?usegapi=1&usegapi=1
Source: 2b8d5dddd6dd1e72_0.0.dr	String found in binary or memory: https://plus.google.com
Source: 2b8d5dddd6dd1e72_0.0.dr	String found in binary or memory: https://plus.googleapis.com
Source: Current Session.0.dr	String found in binary or memory: https://policies.google.com
Source: Current Session.0.dr	String found in binary or memory: https://policies.google.com#
Source: Network Action Predictor-journal.0.dr, Current Session.0.dr	String found in binary or memory: https://policies.google.com/
Source: History-journal.0.dr	String found in binary or memory: https://policies.google.com/Privacy
Source: Current Session.0.dr	String found in binary or memory: https://policies.google.com/privacy
Source: Current Session.0.dr	String found in binary or memory: https://policies.google.com/privacy)Privacy
Source: Current Session.0.dr	String found in binary or memory: https://policies.google.com/privacy?hl=en&gl=uk
Source: Current Session.0.dr	String found in binary or memory: https://policies.google.com/privacy?hl=en&gl=uk)Privacy
Source: History-journal.0.dr	String found in binary or memory: https://policies.google.com/privacy?hl=en&gl=ukPrivacy
Source: Current Session.0.dr	String found in binary or memory: https://policies.google.com/privacyP
Source: History-journal.0.dr	String found in binary or memory: https://policies.google.com/privacyPrivacy
Source: Current Session.0.dr	String found in binary or memory: https://policies.google.com/terms
Source: Current Session.0.dr	String found in binary or memory: https://policies.google.com/terms2Google
Source: History-journal.0.dr	String found in binary or memory: https://policies.google.com/termsGoogle
Source: Current Session.0.dr	String found in binary or memory: https://policies.google.com/termsoe
Source: Current Session.0.dr	String found in binary or memory: https://policies.google.com/termsow
Source: Current Session.0.dr	String found in binary or memory: https://policies.google.com/v
Source: Current Session.0.dr	String found in binary or memory: https://policies.google.comh
Source: 681b349e-2088-4df0-a7d1-5213f7f5b54e.tmp.1.dr	String found in binary or memory: https://r5---sn-h0jeln7l.gvt1.com
Source: Current Session.0.dr	String found in binary or memory: https://realtimesupport.clients6.google.com/static/proxy.html?usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-sta
Source: 681b349e-2088-4df0-a7d1-5213f7f5b54e.tmp.1.dr	String found in binary or memory: https://redirector.gvt1.com
Source: manifest.json.0.dr	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: 3119773edcbc634b_0.0.dr	String found in binary or memory: https://ssl.google-analytics.com
Source: df2db86ec0c3b16d_0.0.dr	String found in binary or memory: https://ssl.google-analytics.com/ga.js
Source: 3119773edcbc634b_0.0.dr	String found in binary or memory: https://ssl.google-analytics.com/ga.jsaD
Source: 3119773edcbc634b_0.0.dr	String found in binary or memory: https://ssl.google-analytics.com/j/__utm.gif
Source: 681b349e-2088-4df0-a7d1-5213f7f5b54e.tmp.1.dr	String found in binary or memory: https://ssl.gstatic.com
Source: Network Action Predictor.0.dr	String found in binary or memory: https://ssl.gstatic.com/
Source: 703be6558b4a4b13_0.0.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/o/2231879498-postmessagerelay.js
Source: 703be6558b4a4b13_0.0.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/o/2231879498-postmessagerelay.jsaD
Source: 8a9e3602322321ad_0.0.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/static/_/js/k=gaia.gaiafe_glif.en_GB.-ALgbehIEd4.O/am=LwACPnABNOAHA
Source: Favicons-journal.0.dr	String found in binary or memory: https://ssl.gstatic.com/docs/spreadsheets/forms/favicon_qp2.png
Source: Favicons-journal.0.dr	String found in binary or memory: https://ssl.gstatic.com/docs/spreadsheets/forms/favicon_qp2.png$b9
Source: Favicons-journal.0.dr	String found in binary or memory: https://ssl.gstatic.com/docs/spreadsheets/forms/favicon_qp2.png$b:%
Source: Favicons-journal.0.dr	String found in binary or memory: https://ssl.gstatic.com/docs/spreadsheets/forms/favicon_qp2.png5ZYD
Source: Favicons-journal.0.dr	String found in binary or memory: https://ssl.gstatic.com/docs/spreadsheets/forms/favicon_qp2.png5ZYL
Source: Favicons-journal.0.dr	String found in binary or memory: https://ssl.gstatic.com/docs/spreadsheets/forms/favicon_qp2.pngu
Source: 3f2d3790776e7f74_0.0.dr	String found in binary or memory: https://ssl.gstatic.com/feedback/api.js
Source: 157ac5dc69855318_0.0.dr	String found in binary or memory: https://ssl.gstatic.com/inproduct_help/guidedhelp/guide_inproduct.js
Source: 07ef20801bad13ca_0.0.dr	String found in binary or memory: https://ssl.gstatic.com/microscope/embed/
Source: Favicons-journal.0.dr	String found in binary or memory: https://ssl.gstatic.com/policies/favicon.ico
Source: Favicons-journal.0.dr	String found in binary or memory: https://ssl.gstatic.com/policies/favicon.icoD
Source: 50c0e7e089c884cf_0.0.dr	String found in binary or memory: https://ssl.gstatic.com/support/content/gpf/gpf_stats.js
Source: 794694e376b2332a_0.0.dr	String found in binary or memory: https://ssl.gstatic.com/support/realtime/operator/1605690075554/operatordeferred_bin_base__en.js
Source: Network Action Predictor-journal.0.dr	String found in binary or memory: https://static.doubleclick.net/
Source: Current Session.0.dr	String found in binary or memory: https://support.google.com
Source: 000003.log5.0.dr	String found in binary or memory: https://support.google.com-_https://support.google.com
Source: 000003.log0.0.dr	String found in binary or memory: https://support.google.com/
Source: messages.json41.0.dr	String found in binary or memory: https://support.google.com/chromecast/answer/2998456
Source: messages.json41.0.dr	String found in binary or memory: https://support.google.com/chromecast/troubleshooter/2995236
Source: Current Session.0.dr	String found in binary or memory: https://support.google.com/docs
Source: Current Session.0.dr	String found in binary or memory: https://support.google.com/docs#topic=1382883
Source: History-journal.0.dr	String found in binary or memory: https://support.google.com/docs#topic=1382883Docs
Source: History-journal.0.dr	String found in binary or memory: https://support.google.com/docsDocs
Source: Current Session.0.dr	String found in binary or memory: https://support.google.com/docsb
Source: Favicons-journal.0.dr	String found in binary or memory: https://support.google.com/favicon.ico
Source: Favicons-journal.0.dr	String found in binary or memory: https://support.google.com/favicon.ico&
Source: Current Session.0.dr	String found in binary or memory: https://support.google.comh
Source: 07ef20801bad13ca_0.0.dr	String found in binary or memory: https://talkgadget.google.com/:session_prefix:talkgadget/_/widget
Source: 5a4ad82dcdf2bc1d_0.0.dr, e769cbdaa62069cc_0.0.dr	String found in binary or memory: https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=
Source: 2b8d5dddd6dd1e72_0.0.dr	String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: Network Action Predictor-journal.0.dr	String found in binary or memory: https://www.google-analytics.com/
Source: 1154c6710157da27_0.0.dr	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: 4f965f7904d2a402_0.0.dr	String found in binary or memory: https://www.google-analytics.com/analytics.jsaD
Source: 4f965f7904d2a402_0.0.dr	String found in binary or memory: https://www.google-analytics.com/gtm/js?id=
Source: 1dfa01c69b3f0b46_0.0.dr	String found in binary or memory: https://www.google-analytics.com/gtm/js?id=GTM-T4DMR6H&t=gtm2&cid=1629107036.1606473844&aip=true
Source: Current Session.0.dr	String found in binary or memory: https://www.google.co.uk
Source: Current Session.0.dr	String found in binary or memory: https://www.google.co.uk/intl/en/about/products
Source: History-journal.0.dr	String found in binary or memory: https://www.google.co.uk/intl/en/about/productsBrowse
Source: History-journal.0.dr	String found in binary or memory: https://www.google.co.uk/intl/en/policies/privacy/
Source: History-journal.0.dr	String found in binary or memory: https://www.google.co.uk/intl/en/policies/privacy/Privacy
Source: 000003.log5.0.dr, Current Session.0.dr, 681b349e-2088-4df0-a7d1-5213f7f5b54e.tmp.1.dr, manifest.json0.0.dr	String found in binary or memory: https://www.google.com
Source: 000003.log0.0.dr	String found in binary or memory: https://www.google.com/
Source: History-journal.0.dr	String found in binary or memory: https://www.google.com/Google
Source: 3119773edcbc634b_0.0.dr	String found in binary or memory: https://www.google.com/analytics/web/inpage/pub/inpage.js?
Source: Favicons-journal.0.dr	String found in binary or memory: https://www.google.com/favicon.ico
Source: Favicons-journal.0.dr	String found in binary or memory: https://www.google.com/favicon.ico0
Source: Current Session.0.dr	String found in binary or memory: https://www.google.com/forms/about/?utm_source=product&utm_medium=forms_logo&utm_campaign=forms
Source: Favicons-journal.0.dr	String found in binary or memory: https://www.google.com/forms/about/?utm_source=product&utm_medium=forms_logo&utm_campaign=forms(
Source: Current Session.0.dr	String found in binary or memory: https://www.google.com/forms/about/?utm_source=product&utm_medium=forms_logo&utm_campaign=forms2Goog
Source: History-journal.0.dr	String found in binary or memory: https://www.google.com/forms/about/?utm_source=product&utm_medium=forms_logo&utm_campaign=formsGoogl
Source: cdb496d073d140fd_0.0.dr	String found in binary or memory: https://www.google.com/forms/about/js/site.en.min.js
Source: History-journal.0.dr	String found in binary or memory: https://www.google.com/google-d-s/intl/en-GB/privacy.html
Source: History-journal.0.dr	String found in binary or memory: https://www.google.com/google-d-s/intl/en-GB/privacy.htmlPrivacy
Source: c5f181eec6c11bbd_0.0.dr	String found in binary or memory: https://www.google.com/insights/consumersurveys/async_survey?site=o2wf7v7b3vtysenpfxlgwdgxiy
Source: 4e490432524321ff_0.0.dr	String found in binary or memory: https://www.google.com/insights/consumersurveys/gk/static/hats-integration-release.js
Source: 24db904a44e6e21b_0.0.dr	String found in binary or memory: https://www.google.com/js/bg/7ACX1ll8pxmp-W5IFnwplmFbwq_vDvpxp5bFF4q7ftk.js
Source: 24db904a44e6e21b_0.0.dr	String found in binary or memory: https://www.google.com/js/bg/7ACX1ll8pxmp-W5IFnwplmFbwq_vDvpxp5bFF4q7ftk.jsaD
Source: 686aa154ad8e9b94_0.0.dr	String found in binary or memory: https://www.google.com/js/google.js
Source: 9e1cedda52c230fd_0.0.dr	String found in binary or memory: https://www.google.com/js/gweb/analytics/doubletrack.js
Source: 082161909dab20de_0.0.dr, 27dd1a1ddacdef66_0.0.dr	String found in binary or memory: https://www.google.com/log?format=json&hasfast=true
Source: 07ef20801bad13ca_0.0.dr	String found in binary or memory: https://www.google.com/shopping/customerreviews/badge?usegapi=1
Source: 07ef20801bad13ca_0.0.dr	String found in binary or memory: https://www.google.com/shopping/customerreviews/optin?usegapi=1
Source: Current Session.0.dr	String found in binary or memory: https://www.google.com/w
Source: b871161b0ea2aeec_0.0.dr, 762f6db8d3c32da2_0.0.dr	String found in binary or memory: https://www.google.com/xjs/_/js/k=xjs.s.en_GB.TPGHXybyp6g.O/ck=xjs.s.gIm4S-odnPA.L.W.O/am=ABAAAAAAUA
Source: 549e8d03fe1c0183_0.0.dr	String found in binary or memory: https://www.google.com/xjs/_/js/k=xjs.s.en_GB.TPGHXybyp6g.O/ck=xjs.s.gIm4S-odnPA.L.W.O/m=cdos
Source: manifest.json0.0.dr	String found in binary or memory: https://www.google.com;
Source: 681b349e-2088-4df0-a7d1-5213f7f5b54e.tmp.1.dr	String found in binary or memory: https://www.googleapis.com
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/calendar.readonly
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/cast-edu-messaging
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/clouddevices
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/hangouts
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/hangouts.readonly
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/meetings
Source: 2b8d5dddd6dd1e72_0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: 2b8d5dddd6dd1e72_0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.peopleapi.readwrite
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/userinfo.email
Source: 4f965f7904d2a402_0.0.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=
Source: 588e6311b9075013_0.0.dr	String found in binary or memory: https://www.googletagmanager.com/gtm.js?id=GTM-WQZB4J
Source: 681b349e-2088-4df0-a7d1-5213f7f5b54e.tmp.1.dr	String found in binary or memory: https://www.gstatic.com
Source: Network Action Predictor-journal.0.dr	String found in binary or memory: https://www.gstatic.com/
Source: e114547ea7a5dce6_0.0.dr	String found in binary or memory: https://www.gstatic.com/_/freebird/_/js/k=freebird.v.en_GB.eZyF8I6wdhY.O/d=1/ct=zgms/rs=AMjVe6ihXnQz
Source: 6b25915c4efc465e_0.0.dr, 7a4bf1395505a2f0_0.0.dr, 21c32ed72bd61c9b_0.0.dr, ba745e4f9f3d04e5_0.0.dr, 026f2c2febf05431_0.0.dr, ac82024ce7195ba3_0.0.dr	String found in binary or memory: https://www.gstatic.com/_/mss/boq-groups/_/js/k=boq-groups.GroupsFrontendUi.en_US.262DT0GfvWg.es5.O/
Source: b9a421c6599725ee_0.0.dr, 3b7f8d8816278017_0.0.dr	String found in binary or memory: https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.ConsentUi.en_GB.kBmSBeixNb8.es5.O/ck=
Source: e3edda84c54c49ed_0.0.dr	String found in binary or memory: https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.IdentityPoliciesUi.en.Fu6DmJe75js.es5
Source: c68013b137647bd6_0.0.dr	String found in binary or memory: https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.IdentityPoliciesUi.en_US.t6APRRItk9c.
Source: 07ef20801bad13ca_0.0.dr	String found in binary or memory: https://www.gstatic.com/classroom/sharewidget/widget_stable.html?usegapi=1
Source: f7baaacdffcdd6ef_0.0.dr	String found in binary or memory: https://www.gstatic.com/cv/js/sender/v1/cast_sender.js
Source: 5a9b93b880dd5d0d_0.0.dr	String found in binary or memory: https://www.gstatic.com/external_hosted/gsap/TweenMax.min.js
Source: 4739ef39d3645e5f_0.0.dr	String found in binary or memory: https://www.gstatic.com/external_hosted/hammerjs/v2_0_2/hammer.min.js
Source: 922dfb03cc343c93_0.0.dr	String found in binary or memory: https://www.gstatic.com/external_hosted/modernizr/modernizr.js
Source: aaef0d8aae497e0f_0.0.dr	String found in binary or memory: https://www.gstatic.com/external_hosted/morlock/morlock.min.js
Source: b8c3df9b5168fca9_0.0.dr	String found in binary or memory: https://www.gstatic.com/external_hosted/picturefill/picturefill.min.js
Source: 157ac5dc69855318_0.0.dr	String found in binary or memory: https://www.gstatic.com/feedback/js/help/prod/service/lazy.min.js
Source: 157ac5dc69855318_0.0.dr	String found in binary or memory: https://www.gstatic.com/feedback/js/help/prod/service/lazy.min.jsaD
Source: c3c152432344545a_0.0.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: c3c152432344545a_0.0.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: c3c152432344545a_0.0.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: 97171a3029d97be8_0.0.dr	String found in binary or memory: https://www.gstatic.com/og/_/js/k=og.og.en_US.XgQyWqg3xW0.O/rt=j/m=ld
Source: b3fb18476be52abf_0.0.dr	String found in binary or memory: https://www.gstatic.com/og/_/js/k=og.og2.en_US.hFR1GIOTOWw.O/rt=j/m=def
Source: 39827f518af93149_0.0.dr	String found in binary or memory: https://www.gstatic.com/og/_/js/k=og.qtm.en_US.eDa9r_TVF5I.O/rt=j/m=q_d
Source: 07ef20801bad13ca_0.0.dr	String found in binary or memory: https://www.gstatic.com/partners/badge/templates/badge.html?usegapi=1
Source: manifest.json0.0.dr	String found in binary or memory: https://www.gstatic.com;
Source: 000003.log5.0.dr, Current Session.0.dr	String found in binary or memory: https://www.youtube.com
Source: Current Session.0.dr	String found in binary or memory: https://www.youtube.com#
Source: 000003.log0.0.dr	String found in binary or memory: https://www.youtube.com/
Source: Current Session.0.dr	String found in binary or memory: https://www.youtube.com/embed/48l-xdS4pXg?rel=0&showinfo=0&theme=light&version=3&hl=en&cc_lang_pref=
Source: Current Session.0.dr	String found in binary or memory: https://www.youtube.com/embed/YlmVKT3Zvhw?rel=0&showinfo=0&theme=light&version=3&hl=en&cc_lang_pref=
Source: Current Session.0.dr	String found in binary or memory: https://www.youtube.com/embed/ZdEIZNg3epQ?rel=0&showinfo=0&theme=light&version=3&hl=en&cc_lang_pref=
Source: Current Session.0.dr	String found in binary or memory: https://www.youtube.com/embed/ggoJFaE71W8?rel=0&showinfo=0&theme=light&version=3&hl=en&cc_lang_pref=
Source: 082161909dab20de_0.0.dr	String found in binary or memory: https://www.youtube.com/iframe_api
Source: dc7aac768f45987c_0.0.dr, 05234906b57037c5_0.0.dr	String found in binary or memory: https://www.youtube.com/s/player/77da52cd/player_ias.vflset/en_US/base.js
Source: dc7aac768f45987c_0.0.dr	String found in binary or memory: https://www.youtube.com/s/player/77da52cd/player_ias.vflset/en_US/base.jsaD
Source: 91c6a9ede3ddfff5_0.0.dr	String found in binary or memory: https://www.youtube.com/s/player/77da52cd/player_ias.vflset/en_US/embed.js
Source: 91c6a9ede3ddfff5_0.0.dr	String found in binary or memory: https://www.youtube.com/s/player/77da52cd/player_ias.vflset/en_US/embed.jsaD
Source: f7baaacdffcdd6ef_0.0.dr, 5f9dbdcbdc4b150c_0.0.dr	String found in binary or memory: https://www.youtube.com/s/player/77da52cd/player_ias.vflset/en_US/remote.js
Source: f7baaacdffcdd6ef_0.0.dr	String found in binary or memory: https://www.youtube.com/s/player/77da52cd/player_ias.vflset/en_US/remote.jsaD
Source: 0e9e344432c75fc9_0.0.dr	String found in binary or memory: https://www.youtube.com/s/player/77da52cd/www-embed-player.vflset/www-embed-player.js
Source: 0e9e344432c75fc9_0.0.dr	String found in binary or memory: https://www.youtube.com/s/player/77da52cd/www-embed-player.vflset/www-embed-player.jsaD
Source: 7fec68cb99f7c1d3_0.0.dr, 5c3c7bdf1979294f_0.0.dr	String found in binary or memory: https://www.youtube.com/s/player/77da52cd/www-widgetapi.vflset/www-widgetapi.js
Source: 5c3c7bdf1979294f_0.0.dr	String found in binary or memory: https://www.youtube.com/s/player/77da52cd/www-widgetapi.vflset/www-widgetapi.jsaD
Source: 07ef20801bad13ca_0.0.dr	String found in binary or memory: https://www.youtube.com/subscribe_embed?usegapi=1
Source: c9c88edbb2f2b0dc_0.0.dr	String found in binary or memory: https://www.youtube.com/yts/jsbin/fetch-polyfill-vfl6MZH8P/fetch-polyfill.js
Source: c9c88edbb2f2b0dc_0.0.dr	String found in binary or memory: https://www.youtube.com/yts/jsbin/fetch-polyfill-vfl6MZH8P/fetch-polyfill.jsa
Source: c9c88edbb2f2b0dc_0.0.dr	String found in binary or memory: https://www.youtube.com/yts/jsbin/fetch-polyfill-vfl6MZH8P/fetch-polyfill.jsaD
Source: 24db904a44e6e21b_0.0.dr	String found in binary or memory: https://youtube.com/
Source: 05234906b57037c5_0.0.dr	String found in binary or memory: https://youtube.com/B

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50175
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50174
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50177
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50176
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50179
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 50131 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50154 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50182
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50181
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50184
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50183
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50125 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50177 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50183 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 50159 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50147 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50172 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50142 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 50136 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50139
Source: unknown	Network traffic detected: HTTP traffic on port 50170 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50149 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50131
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50130
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50133
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50132
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50135
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50134
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50137
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50136
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50161 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50140
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 50144 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50149
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50142
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50141
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50144
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50143
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50146
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50147
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50151
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50150
Source: unknown	Network traffic detected: HTTP traffic on port 50155 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50103 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50176 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50166 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50143 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50152
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50155
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50154
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50157
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50156
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50159
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50158
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50182 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50160
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 50137 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50162
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50161
Source: unknown	Network traffic detected: HTTP traffic on port 50104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50089 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50164
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50166
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50165
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50168
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50167
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50169
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50132 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50160 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50170
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50173
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50172
Source: unknown	Network traffic detected: HTTP traffic on port 50044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50122 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50174 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50139 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50151 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50077 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50134 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50162 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 50076 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 50133 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50156 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50127 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50175 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50128
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50129
Source: unknown	Network traffic detected: HTTP traffic on port 50167 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 50150 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 50111 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50181 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50065 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50164 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50098
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50097
Source: unknown	Network traffic detected: HTTP traffic on port 50112 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50075 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50158 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50129 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50052 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50135 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50184 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50169 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50064 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50123 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50173 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50152 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50098 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50029 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50141 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50086 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50124 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50019 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50179 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50140 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50041 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50146 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50097 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50157 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50030 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50101 -> 443

System Summary:

Classification label

Source: classification engine

Classification label: mal56.phis.win@54/283@15/12

Creates files inside the user directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-5FC0D837-1B2C.pma

Jump to behavior

Creates temporary files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Temp\e9a1d6a0-1c29-46c2-970b-a17eef9ffe79.tmp

Jump to behavior

SQL strings found in memory and binary data

Source: QuotaManager.0.dr

Binary or memory string: CREATE TABLE HostQuotaTable(host TEXT NOT NULL, type INTEGER NOT NULL, quota INTEGER DEFAULT 0, UNIQUE(host, type));

Spawns processes

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --start-maximized 'https://docs.google.com/forms/d/e/1FAIpQLScMM9oeboGCqCY9IhNTWcPfX75sr8KJDxUhz1WOhVNCro9dgQ/viewform'
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1540,1250019913897208592,7982273459944917573,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1776 /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1540,1250019913897208592,7982273459944917573,131072 --lang=en-GB --service-sandbox-type=audio --enable-audio-service-sandbox --mojo-platform-channel-handle=4056 /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1540,1250019913897208592,7982273459944917573,131072 --lang=en-GB --service-sandbox-type=video_capture --enable-audio-service-sandbox --mojo-platform-channel-handle=4044 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1540,1250019913897208592,7982273459944917573,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1776 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1540,1250019913897208592,7982273459944917573,131072 --lang=en-GB --service-sandbox-type=audio --enable-audio-service-sandbox --mojo-platform-channel-handle=4056 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1540,1250019913897208592,7982273459944917573,131072 --lang=en-GB --service-sandbox-type=video_capture --enable-audio-service-sandbox --mojo-platform-channel-handle=4044 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected