Analysis Report https://sites.google.com/view/tribridgeresidential/home

ID:	432846
Product:	CloudBasic
Start time:	20:51:06
Start date:	10.06.2021
Cookbook:	browseurl.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\E5F0NRSV\www.youtube-nocookie[1].xml	ASCII text, with very long lines, with no line terminators	4828DF95C8291EE6EF4FB33F19DF1933	B07DEE925FA79CDB2C8F1E6FD3E8CF6820AC15DB	DC5C66CE45B310EBAEE20EC8C5F9961ECC2EC0BC078F0ED9C226EF33FBCC98F6
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{ECC508A0-CA1C-11EB-90EB-ECF4BBEA1588}.dat	Microsoft Word Document	04F39B4D1BBF5D7B3054C38F8B14F677	4CF030287F5C9DA470B13522AB1AD8EBD7623A30	E9D729F44FBF0523CA39583AB6BF86C5895FCA61544732646FB0032D7946BC2A
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{ECC508A2-CA1C-11EB-90EB-ECF4BBEA1588}.dat	Microsoft Word Document	BE155C2BC8B2EA179874F0325FB4F8B2	5A680E4F885F50C459667789591D66DCFFF21681	FA4E4E1C8F27B6CE09D57EB19B642F7932BB1A58B5D14BFDF6A769FB6654DE8B
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{F2CF8151-CA1C-11EB-90EB-ECF4BBEA1588}.dat	Microsoft Word Document	ED8F2601CCFFDE54EEDAEE2606B83317	C14FDF1F3DCF7C66E3A6364D458EBF682C246CD7	D9FFAE7A4D07C725D2DDE2FC0477AB57AC56FCCD44A7BB10F88ECBDF1B20236F
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\gee00pr\imagestore.dat	data	0CB95DC09C89FA3D1C937071878C759E	A42D1FA77360847364890E341CD6CDA44A823A0F	DB2467F687C142737169E329E7D8FF4F13868F4D1E8B1D3902ACEE3FE75A3D0C
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\8[1].jpg	[TIFF image data, big-endian, direntries=12, height=709, bps=0, PhotometricIntepretation=RGB, orientation=upper-left, width=1200], baseline, precision 8, 1200x646, frames 3	F17B5B1163EFB6D2D47DE6BAE6D3A9CD	6D6964B34BC44C6D2B106ADE1AE675985B96D012	7829F065E0E10C8466F3D57766E0719421B7B652F6A1082F21B98702F1B28A30
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\KFOlCnqEu92Fr1MmWUlfBBc-[1].woff	Web Open Font Format, TrueType, length 20396, version 1.1	68D6DABFE54E245E7D5D5C16C3C4B1A9	7FDAB895EAEBECEDB3FB5473EAB94A1B292CEF19	A01A632E56731A854F35701AA8C3A6A19A113290D9032FF9048F8064C45383BD
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\adobe[1].jpg	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 400x400, frames 3	BE5274AF7D8BD25B8148A190FF515399	B8D0850FD92EE935287E17988B89E53607808C8C	26C62DBDF527B8DCBF378EA62F129CBBBA3B244730687909BA21ECD729C9D2E6
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\base[1].js	ASCII text, with very long lines	F6DB6997C14E9815C1CCC0C5511BB765	C6F8BAE2B4976B468CA046608B949DC43BCE9119	BE46404DF6D8F40E8787D034657072984F9F8DA178C033667BA21D23C179218C
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\cb=gapi[1].js	ASCII text, with very long lines	96DBF8E527CB14D82E294328ABCDA48B	1D10004482E6834A72716425F26D0C43C427A35D	7BEF45A2D66E62100D6A4DAD1B713DDE1DEF59A7B963618E1D96C56593BE00EC
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\client[1].js	ASCII text, with very long lines	CADBEC618439D646834E3C71301A49F0	9CAC182E930D49C0DBCEEE7045D1295D716C525C	DA1A63A10B52159D228C2E42EA36B941811F9F33B2F8367F32369E51ED59B75E
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\favicon[1].ico	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel	EA69A3F95DD5484853D128186DB7E13D	5FDB5FE05108FD6E5386BBDA06778AF4B446DC6A	8179E80BCFEF62154D1FF7371A1C60BD2C6C1E71C3DA2F4A8B1DB518A1900EC2
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\favicon[2].ico	MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel	F3418A443E7D841097C714D69EC4BCB8	49263695F6B0CDD72F45CF1B775E660FDC36C606	6DA5620880159634213E197FAFCA1DDE0272153BE3E4590818533FAB8D040770
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\fetch-polyfill[1].js	Pascal source, ASCII text, with very long lines	04E3CC8A9641B3F9F9C9370F4E9B5BDD	9602A891F583094BB04FD407B253ABCAFFB8C8D0	DE6C4FFA2BD9FD283610E28D0DB2EC48607AAB39D213A51AEF248673A0A7E980
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\gmail[1].png	PNG image data, 1280 x 1280, 8-bit/color RGBA, non-interlaced	DCE2F2B0E50CB1DBB0246D152791CB46	D0A69C159304EDC08DB005163E7A0DAF5A1E98A6	ACF087C1757F08B0CFD53D59066544D7EF0BFCC50999E77C5813739CD9DC1479
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\home[1].htm	HTML document, UTF-8 Unicode text, with very long lines	8692F7FE31E2925412EC2D58B1092D38	D2393D77D79A6CEA705B0F93034A33B880B259A0	CD73A35207554B3854228C7220694C113CDFF53CB5C87C43F5F8DE8F4A54E773
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\hover[1].css	ASCII text	FAC4178C15E5A86139C662DAFC809501	EF1481841399156A880EC31B07DDA9CFAA1ACE39	BB88454962767EB6F2DDB1AABAAF844D8A57DE7E8F848D7F6928F81B54998452
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\jizfRExUiTo99u79B_mh0O6tKw[1].woff	Web Open Font Format, TrueType, length 57524, version 1.1	09D43F89EE9F28893C5D175F5EFF5045	27DF60E5879AA568876F747F3CFACF28564F9B09	A1F431E4973D434EAD97B86815B31BB4553A7A3588FCD6D60D863C6150918F64
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\jquery-3.1.1.min[1].js	ASCII text, with very long lines	E071ABDA8FE61194711CFC2AB99FE104	F647A6D37DC4CA055CED3CF64BBC1F490070ACBA	85556761A8800D14CED8FCD41A6B8B26BF012D44A318866C0D81A62092EFD9BF
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\m=Ae65rd,CuaHnc,sy1i,uY3Nvd,syj,syl,HYv29e,mxS5xe[1].js	ASCII text, with very long lines	F51591533C2C7EF5C0321BA51E4D1867	CF9507BE04BE037FF200C05C6E1F54698C5D314D	9917D466647F9DCA6E681F1C14343314307AF9ADCBA065D759056C7BEDF5C991
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\m=FqLSBc,krBSJd,uiNkee,wmlPKb,IavLJc[1].js	ASCII text, with very long lines	2461C150BC64E235DE1902310E33655F	52FAE2F3D637ABA3FE8ACBFC731CAD1A4BD8322E	C4E77B70ED382ECEFFF9F9232AE28C346DAF3E6C5F28F5002C1A4CB808C3386D
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\m=sy1i,uY3Nvd,syj,syl,HYv29e[1].js	ASCII text, with very long lines	FF48D9DB9AAC7EB98F95AFE49CC68C1D	838A667229554BA2165FCDAD753B5F1FC382EF02	EA1E4218EC448407E6063F856790E79460DE2DDB805DA376BC7FF9C24B369060
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\rs=AA2YrTs7Zb87CqdFxEjh5qFvninf3C7moQ[1].js	ASCII text, with very long lines	89908F7BA39B421A83B0BAAD77BED83E	53EC5B0578EF27E062AF9538A7C17316B723C8B8	D231CD72051434824CCADD4CD4DF4556AD50296D738F4F0855A4275648E800EB
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\rs=AA2YrTtcf0OfTPFS7mDiDHvSrB_YVEoYtg[1].css	ASCII text, with very long lines, with no line terminators	1B72E69FDEF1E3682A3EAFE2F5D81BDE	D4F2DAA025C2CF92332E5F5A2E692C6AC1C0512C	296B72791199FCA038A621E32B7C6AD4EF056FE5C361BCA2797A06D6A0CC0AAA
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\www-embed-player[1].js	ASCII text, with very long lines	43889017AAA093BD462EF758C267519A	ED2500E2E319B4C1C96CD8E14AA50B072CE5368F	2DB1731278FEA4DC5E8BC660CCE5FB2E2DB61306A9F661C81547CF9D9F6593E7
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\4UaGrENHsxJlGDuGo1OIlL3Owpg[1].woff	Web Open Font Format, TrueType, length 26180, version 1.1	4F2E00FBE567FA5C5BE4AB02089AE5F7	5EB9054972461D93427ECAB39FA13AE59A2A19D5	1F75065DFB36706BA3DC0019397FCA1A3A435C9A0437DB038DAAADD3459335D7
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\4UabrENHsxJlGDuGo1OIlLU94YtzCwA[1].woff	Web Open Font Format, TrueType, length 26412, version 1.1	142CAD8531B3C073B7A3CA9C5D6A1422	A33B906ECF28D62EFE4941521FDA567C2B417E4E	F8F2046A2847F22383616CF8A53620E6CECDD29CF2B6044A72688C11370B2FF8
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\4UabrENHsxJlGDuGo1OIlLV154tzCwA[1].woff	Web Open Font Format, TrueType, length 26164, version 1.1	CCDA7B53E281A638F36ED62514815268	CF6D39BAB2A012D008EC9EDF95F4F4BDACF93770	673F112749C21E5BE0D1338E1709A1D981053E239E98CE09D0BB849BB34FCD98
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\EmbeddedImage[1].jpg	[TIFF image data, little-endian, direntries=3, description=Mockup image of male hands using a laptop computer and holing a smart phone both with blank whi, software=Picasa], baseline, precision 8, 5472x3648, frames 3	087A6238EC6F45E5DDF220A02D97B01D	14762F8D4BF4A168812FC425914BA41AC16CCA58	35823A90041E7E13F75C535AA7EAED0EA89EAFA9530B51556FBEA532727C5988
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\EmbeddedImage[2].jpg	[TIFF image data, little-endian, direntries=3, description=Mockup image of male hands using a laptop computer and holing a smart phone both with blank whi, software=Picasa], baseline, precision 8, 5472x3648, frames 3	087A6238EC6F45E5DDF220A02D97B01D	14762F8D4BF4A168812FC425914BA41AC16CCA58	35823A90041E7E13F75C535AA7EAED0EA89EAFA9530B51556FBEA532727C5988
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\KFOlCnqEu92Fr1MmSU5fBBc-[1].woff	Web Open Font Format, TrueType, length 20404, version 1.1	BF0F407102FAF3A0B521D3B545F547A5	CA357CD0DE5DD0242E8EFACFB8D24AB60FDC86AB	855A06974032BB69157D469ABA6F63440E8BE47C421F45C3F396F4E0B87B6DE8
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\bootstrap.min[1].js	ASCII text, with very long lines	14D449EB8876FA55E1EF3C2CC52B0C17	A9545831803B1359CFEED47E3B4D6BAE68E40E99	E7ED36CEEE5450B4243BBC35188AFABDFB4280C7C57597001DE0ED167299B01B
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\css[1].css	ASCII text	271F7F08583B0FF51B875073985EEF7A	F0CF1FFCD071B020D761C8B3B19FA27A811CB694	CD2AB98D26494918A67D4D439CD43BFAC5040D52A2EA9995624AB9358EEE4513
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\css[2].css	ASCII text	04F7435B2672FBE66984EA436E7087C6	44896875E69B297EB979CC0D3E8522D872656BA8	F9088C15A062F0C7708C3864C5E261A2E4961DFEB0F150DF744FAEC2E3B74AD6
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\faq[1].htm	HTML document, UTF-8 Unicode text, with very long lines	61BD944BF3904654A75176D440CC4EED	AE4D4D96CFECCD9C090D9ECC279F662DEA6E5BB1	48B722E0B0B28D5AC591E630B27F54954F81B668469C814DCBC03D43B65E9615
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\favicon[1].ico	MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel	F3418A443E7D841097C714D69EC4BCB8	49263695F6B0CDD72F45CF1B775E660FDC36C606	6DA5620880159634213E197FAFCA1DDE0272153BE3E4590818533FAB8D040770
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\googlelogo_color_74x24dp[1].png	PNG image data, 74 x 24, 8-bit/color RGBA, non-interlaced	DE327BF69212B7255BBB0C8F40F52A3C	8C9E7517E6456E13F3F4640E39743B74F98B8F39	0793CEFA320C6C622E8B143B35FAFB577BD7584C26796D3B5E1321463494FE76
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\index[1].htm	HTML document, ASCII text, with very long lines, with no line terminators	C264B2395B1F9CF424E5A463BCD4D8F5	CC0FF42A956B3BB150431483B46EFCF0C3278EEA	E1CC7F9DC3DF7A2C30B04C41B1C30B4A3462118EDFE9F82F3D4E465998EED645
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\jizaRExUiTo99u79D0KEww[1].woff	Web Open Font Format, TrueType, length 55340, version 1.1	7A9A412D3B5F0FCF44A43035EF5749EB	0515F781A37C8775C466577EC40AEF136CBCF3CB	1EC30E5248358ADF73BA90108EB2978F9E3A4855EE52BB64BCF3FB1CEF68DE7C
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\m=Ae65rd,CuaHnc,sy1i,uY3Nvd,kTx9td,syj,syl,HYv29e,mxS5xe[1].js	ASCII text, with very long lines	8FE1D19C55DACDA5606B58F79783E306	54BFB902C9EA61A7A5909D14D6085945A85E1BFD	D5FD544BBA00FFC58C199DD00F90332EDF34DDAFD2FCD6E8A8125893E58AB14A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\m=pB6Zqd,syw,IZT63,SF3gsd,vfuNJf,sys,syq,syx,O8k1Cd,sy17,siKnQd,syr,syv,sy11,YNjGDd,sy10,sy12,PrPYRd,xs1Gy,hc6Ubd,o02Jie,SpsfSb,sy19,sy18,syn,zbML3c[1].js	ASCII text, with very long lines	20A9810E91DE0B5B482FAB4ED6F6CB1C	8C9EF3938F1D015CEE97601FCD9C543B52D5460D	08CF1ADAED56E9342B958F5700C1A1BB7E1C47436DE346D58C088ABA5E798EE8
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\office3651[1].png	PNG image data, 187 x 188, 8-bit/color RGBA, non-interlaced	FE22440D79FFA34950F512EF4A718B2A	0E147E59544EE6580D3095353D4420849FA5EB8A	A2F26B68A6C8810C1AEB4048C938F835A86BA83756A7A440F989B967E78F3BA8
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\outlook1[1].png	PNG image data, 26 x 26, 8-bit/color RGBA, non-interlaced	C3FC46C5799C76F9107504028F39190F	519096AD3F03410CF9CE3C9B9FCCA6B439D97B23	57898461712A639D119BDF88B7145919DCC8956C7A271D2E4A1084B29EAE6785
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\pxiDypQkot1TnFhsFMOfGShVF9eI[1].woff	Web Open Font Format, TrueType, length 38064, version 1.1	E7BBF7E9E89975E144CBC167F2293FDE	0CB43D4E0ECF79C8AF6629CA1C386EA23FA02C02	A87A298223B431522629F284F2D237773F8257B2DB427904CA95EC20DFC34CDD
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\remote[1].js	ASCII text, with very long lines	F4FDA7A202A3EF6F55E3D0001E3B556C	65CDE0A38E9A4DC0CA590EA45769B7F3ABFEF194	BD2808457ADFD2D1016BEA1AD38EF08F55E4E69CDA8E0785D8808D3168BE636E
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\585b051251[1].js	ASCII text, with very long lines	D8CA71772D1E86D5FB9D5E2F6CC1AE70	9B043E60997FE552D652E4474E16AFF923D7AA76	7D840153F02AD6D91D652354E35B590721916D16C33956631EEF0E7D3B5613EE
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\EmbeddedImage[1].jpg	[TIFF image data, little-endian, direntries=2, software=Picasa], baseline, precision 8, 1280x740, frames 3	7163EA61402B5A78AF49CF9A35F47733	2E424471873B349280A62BCC964D6BC9D0F137DC	3D8AFD9036E89FDC543B20D109314C9B282104465B640CCCED689C8A0E1D5BC4
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\KFOlCnqEu92Fr1MmEU9fBBc-[1].woff	Web Open Font Format, TrueType, length 20532, version 1.1	DA2721C68B4BC80DB8D4C404F76B118C	3A32E8B7EFBC9DFB52F024D657B8C8C0A80E5804	BD811625271ACCA47F7DAC48B460F13E08EE947B2A8E17E278C4D5CCB5D9323C
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\KFOmCnqEu92Fr1Mu4mxM[1].woff	Web Open Font Format, TrueType, length 20332, version 1.1	DC3E086FC0C5ADDC09702E111D2ADB42	B1138B84FF19EAC5F43C4202297529D389BD09B7	EA50AC7FDDB61A5CE248A7F8B3A31A98FE16285E076B16E6DA6B4E10910724BB
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\RKK2G0P6.js	ASCII text, with very long lines	1ABE18A516BD0F2DCB7CF9F48E30311C	4AFFE4AA230BF6B713E9FDBB5A742C171C1014F8	136E0FE2AFDA1DCC46608D80A1BBB8D1D86599779D2C9FAA2E3AAA1C97D7FEE2
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\TBR-xtJVq7E[1].htm	HTML document, UTF-8 Unicode text, with very long lines	C1C87DC5F46FA8B090F53275E101E546	E2CCF3550AD168D5012CE1D11AB1156DF30C653A	F270CC61DB9DF83937CF20CCA43A82ABAAB31F22438E2D24C8C6965BF30D25C5
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\adobe-pdf-icon-logo-png-transparent-285x300[1].png	PNG image data, 285 x 300, 8-bit/color RGBA, non-interlaced	2499C2758E9581401BDA79616C11BC23	3484F31C3E550A20BC52E9D124038E24869D3253	3CF94D7F901B97A6697F2E7AC4B4688779B0C705F48939A2E09BC86D7C24E350
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\cb=gapi[1].js	ASCII text, with very long lines	A611C6714CEED4239A9CD09EDC362466	217FBF4900783F474F611B0A01A0386D4E0CF473	E778E381055F2780B7816AF2D8F319EEEC9A62E9F82CE320CDC3F561F22AAA63
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\cookies[1].htm	HTML document, ASCII text, with very long lines	9D515063CEB30849D780B77615BCC85F	BDA02BC86A65BAF0D9C4B9ED2B9E0FC42EE976CB	51047D749CD38B4990D40DC6ED8E01B32007C5E225E2D504A48BC6179AFF35BA
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\cookies[2].htm	HTML document, UTF-8 Unicode text, with very long lines	93588142DEAD26C1EBAB6C79E29D24C5	E5FB331C411C406D5EE53BC3C0908338A46DE076	5E6F5492A1A39D47DFFF2CFF785A11DEDFF576CC40215BA29000BA39EF4B20DB
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\googlelogo_clr_74x24px[1].svg	SVG Scalable Vector Graphics image	554640F465EB3ED903B543DAE0A1BCAC	E0E6E2C8939008217EB76A3B3282CA75F3DC401A	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\history[1].htm	HTML document, UTF-8 Unicode text, with very long lines	C3BA4DAD0A4FDCC57398AEEE6A35B35D	FCD9BB4C8E77BE8A7B94A58ADA8D5A1386CB3D68	1FA9CEE0CA6BB42094433C80DED74BED7EB7A5A5333E15130A9A757E9BE1C7F7
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\jquery-3.2.1.slim.min[1].js	ASCII text, with very long lines	5F48FC77CAC90C4778FA24EC9C57F37D	9E89D1515BC4C371B86F4CB1002FD8E377C1829F	9365920887B11B33A3DC4BA28A0F93951F200341263E3B9CEFD384798E4BE398
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\jquery.min[1].js	ASCII text, with very long lines	2F6B11A7E914718E0290410E85366FE9	69BB69E25CA7D5EF0935317584E6153F3FD9A88C	05B85D96F41FFF14D8F608DAD03AB71E2C1017C2DA0914D7C59291BAD7A54F8E
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\m=Wt6vjf,_latency,FCpbqb,WhJNk[1].js	ASCII text, with very long lines	C6E57C5ACB2449E3F87D5E5213AF1BAC	EAEB094AF290DBD20673F715FF2745F3365DF261	16BB9266943940735BB4C8105F68F14B6272EDC7F2CA52F8AEACB22057C93819
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\m=_b,_tp[1].js	ASCII text, with very long lines	784A6AD1FDA9BD7EF23A403025EFD8C4	16DE704D66CEFD1D1B6FECBC5FA8110364830A5C	D69D6ED2C077EB970E5B646A422BA904E477803D089BBEB52535DF7D45AA9E1D
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\m=byfTOb,lsjVmc,LEikZe[1].js	ASCII text, with very long lines	165862D91EB3F10FC4FBB5E1283D0B31	2EA1BC33C615763F2E674D9D77524BE00BBB35BD	5CBE095F37504C210B4787D63E23E4BE3A0250DBFC86A04C03B6EC78110CBBB0
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\m=sy1w,sy1q,sy27,sy29,sy2h,fuVYe,vVEdxc,sy22,CG0Qwb[1].js	ASCII text, with very long lines	033D1C7F7670A2BC62FBCF3B7226DBB1	42B7A7AAAB142B9A669641CE02C713324AAE587D	DB62CCE0C21DED784700D98A48AFB4107A1963A9C3634D8847293FA27F721022
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\m=view[1].js	ASCII text, with very long lines	F9B0702763D41ABAFEA4577D1D6EC31D	DACA448ECA31FFF6F3BC5486798BAA343114CB00	29CF633C2A06C572F229D89372D27455E92B38DA5E71E1CE18771F190C985327
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\other1[1].png	PNG image data, 190 x 187, 8-bit/color RGBA, non-interlaced	6843A244E12FAB158AA189680B5E7049	0E1C691F87CC4FA35C88344974F2829C40176B70	3A9B144D6482B78AFC4E0A940A1D3C22240F14FA535B808CF4DAB9635339569F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\url[1].htm	HTML document, ASCII text, with CRLF, LF line terminators	0B8C4E1352D9920E57C197A02458C655	3EAF6D42A3654594179A98B17224EB23E0E7E4B2	B85DCABF97A9233CA849DBCC03F57DB21C481300F289494288F3E361636EC66D
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\wRcAf4HBykrYGCiISWytwERk8zO7uq9J4sRwSdSz-hE[1].js	ASCII text, with very long lines, with no line terminators	788F3CEB3EE01EF6C06ED0576C5A4CDE	CF4E646B0E7D5ED374D849C20D8C3B3FF03208B2	C117007F81C1CA4AD8182888496CADC04464F333BBBAAF49E2C47049D4B3FA11
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\www-player[1].css	ASCII text, with very long lines, with no line terminators	C54DBC7C85EC7A79949AB4859FED425B	1FA028B61E520E8077F9B21359A5932B3FB8BB5F	247B9E16EA3C98F31C71C6921191F1BC4D96F56564C3E38C7AAC5F46D82CFBCB
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\EmbeddedImage[1].jpg	[TIFF image data, little-endian, direntries=3, software=Picasa], baseline, precision 8, 1280x720, frames 3	22FA2342F9A5D8DB9C50302304C7298B	219B50CB469D088502875E57F51C4438F07B0C10	9723C7ECCB08342641FDF7D40E8F35288BDCCDC40FE6314FC54CEFDF30803D2F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\EmbeddedImage[2].jpg	[TIFF image data, little-endian, direntries=3, software=Picasa], baseline, precision 8, 1280x720, frames 3	0B7C67960E94094684E6AECEFC2E11C4	6D8376B0711E801B39499BF32F43982B161640A3	5752B65F3EB5E4603C3665ECD2F5C71398FA61EBA9F0F8D71303C458347FCA2C
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\FUGK6LE5.js	ASCII text, with very long lines	F4016515D3D21FF446303A8B93F11AD6	2081A239030E307AE969F47CC3A3882B444CBA80	A0F43F561A82479F0716D4BC0914783FF612325A50AF17B2D89E6B3246770877
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\KFOlCnqEu92Fr1MmEU9fBBc-[1].woff	Web Open Font Format, TrueType, length 20012, version 1.1	DE8B7431B74642E830AF4D4F4B513EC9	F549F1FE8A0B86EF3FBDCB8D508440AFF84C385C	3BFE46BB1CA35B205306C5EC664E99E4A816F48A417B6B42E77A1F43F0BC4E7A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\KFOlCnqEu92Fr1MmSU5fBBc-[1].woff	Web Open Font Format, TrueType, length 19916, version 1.1	A1471D1D6431C893582A5F6A250DB3F9	FF5673D89E6C2893D24C87BC9786C632290E150E	3AB30E780C8B0BCC4998B838A5B30C3BFE28EDEAD312906DC3C12271FAE0699A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\KFOlCnqEu92Fr1MmWUlfBBc-[1].woff	Web Open Font Format, TrueType, length 19888, version 1.1	CF6613D1ADF490972C557A8E318E0868	B2198C3FC1C72646D372F63E135E70BA2C9FED8E	468E579FE1210FA55525B1C470ED2D1958404512A2DD4FB972CAC5CE0FF00B1F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\KFOmCnqEu92Fr1Mu4mxM[1].woff	Web Open Font Format, TrueType, length 19824, version 1.1	BAFB105BAEB22D965C70FE52BA6B49D9	934014CC9BBE5883542BE756B3146C05844B254F	1570F866BF6EAE82041E407280894A86AD2B8B275E01908AE156914DC693A4ED
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\adobe-pdf-icon-logo-png-transparent-285x300[1].png	PNG image data, 285 x 300, 8-bit/color RGBA, non-interlaced	2499C2758E9581401BDA79616C11BC23	3484F31C3E550A20BC52E9D124038E24869D3253	3CF94D7F901B97A6697F2E7AC4B4688779B0C705F48939A2E09BC86D7C24E350
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\analytics[1].js	ASCII text, with very long lines	6DF1787C4BE82D1BB24F8BFFA10C7738	3634E839429E462E49C5F42B75FBFB4BA318AF6D	2CB09C7B3E19BFC41743CA3624EF81C3258D56525647FEAC76AA757E0292627A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\bootstrap.min[1].css	ASCII text, with very long lines	450FC463B8B1A349DF717056FBB3E078	895125A4522A3B10EE7ADA06EE6503587CBF95C5	2C0F3DCFE93D7E380C290FE4AB838ED8CADFF1596D62697F5444BE460D1F876D
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\css[1].css	ASCII text	EB0CD88A60302BF95C95366E2C82FF29	47FF9E436F413113B215513E0EF08ED150AA3C2A	1CDD30E7B0C4E941967839C5DD5671F1A95648EE30E61B554513B3692F8D1640
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\embed[1].js	ASCII text, with very long lines	A5135971F228CB828E685A57AEAB4AE3	7D504C0F2E59B084D18CD4C8FE8688E99B92CB86	174502AF11014B8EA0CFC43F0053BA6BF66C8C31448B622DA0957647DC63BC4C
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\free-v4-shims.min[1].css	ASCII text, with very long lines	8A99CE81EC2F89FBCA03F2C8CF1A3679	58F9EF32D12A5DA52CBAB7BD518BCC998FC59EF9	362DAEAF1F7E05FEE9A609E549F148AACBE518C166FBD96EAD69057E295742AF
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\free.min[1].css	ASCII text, with very long lines	390B4210E10C744C3C597500BCF0B31A	2600C7C2F25D7DBCBC668231601E426010DC6489	C2819CA1F7AD1AF7BA53C4EDFDFD395C547BCB16D29892A234D7860C689ED929
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\home[1].htm	HTML document, UTF-8 Unicode text, with very long lines	1A6820BCEC81BE35FA6DCFD5D9952CC2	329C13B34D1B3C0CB5A75000404056648CC936ED	075BA605CE66FDEA585D29826F5756397A54503F807270E0EAEF907D67E5B485
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\popper.min[1].js	ASCII text, with very long lines	70D3FDA195602FE8B75E0097EED74DDE	C3B977AA4B8DFB69D651E07015031D385DED964B	A52F7AA54D7BCAAFA056EE0A050262DFC5694AE28DEE8B4CAC3429AF37FF0D66
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\rs=AGEqA5lU6_p3Xs6-mgc-DsOLuNR8p1pPPg[1].css	ASCII text, with very long lines, with no line terminators	0BFE0410F4DD6AB56086A8CBA64C4D44	955A2AB0F81ED59B0EC9DEB3F47C4497903066CF	26434455023C8B96A93DEA398EAD43B3F235658B87CBE33E7DE1F5E94E4118EB
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\so[1].htm	HTML document, ASCII text, with very long lines	CBEB6D1EB9CB3501AD133EEAD845037A	025C11A397BD5E53273CBD30500ABA32E94FB114	B56E748865923BD6E079107FB5FFED2A5272E8EF734F7018DCF220392C21EAA0
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\team[1].htm	HTML document, UTF-8 Unicode text, with very long lines	9E8E838E0570B3E0E6241B07F4982393	5B2EB15B6C3110E743ED1290D521F3E89027B1CF	253DC2F9F7648EBBF4436922EC7C2EDBF9142494EF6AD09EE0C1ADCDE87F7D7C
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\u-440qyriQwlOrhSvowK_l5-fCZK[1].woff	Web Open Font Format, TrueType, length 23600, version 1.1	69F09800F4F6479D06E44EBA837DF872	5C889B1BEE3D4E75A5FC0749617A15C0E6922072	8E0F8D862D80DB8B358C03FCCD1FCEB993DEA6A22569620BCD0959806D3D1D12
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\u-4n0qyriQwlOrhSvowK_l52xwNZWMf8[1].woff	Web Open Font Format, TrueType, length 23260, version 1.1	BA56EA84B8084B7FF9677F50D3CD81BD	799C0C07912F6996B80459937AC097813B6B461C	649C6472A611C5BCFEBB341109E5754F205EE57550F5614577C6B6CB963D17AE
C:\Users\user\AppData\Local\Temp\~DF22D972DD4D0EC9B9.TMP	data	F80D133C0BE7FF986E4996A697DBFAF5	4B5EEBBC61B1DCA0F7FBDB211E964ED07A1DF2C5	B77F0950ABC25F315FF3B6A2FB0169518C6B18E9C63AE45DC56A19CB3B2235C6
C:\Users\user\AppData\Local\Temp\~DFB6DAB596898A4284.TMP	data	AB889A32AB9ACD33E816C2422337C69A	1190C6B34DED2D295827C2A88310D10A8B90B59B	4D6EC54B8D244E63B0F04FBE2B97402A3DF722560AD12F218665BA440F4CEFDA
C:\Users\user\AppData\Local\Temp\~DFF71A325E2F2F2688.TMP	data	D2FA83B7AAE12C1C63204547814724AE	8A98A5F52DC51F828F8787D24F6BC1629ECFC16C	ACCCEFE26A13A686DA323160BE23BD4F654E084487FE5C05B47E63BE7CF5FCE9

AV Detection:

Antivirus / Scanner detection for submitted sample

Source: https://sites.google.com/view/tribridgeresidential/home

SlashNext: detection malicious, Label: Fake Login Page type: Phishing & Social Engineering

Antivirus detection for URL or domain

Source: https://kanaan.s3.eu-de.cloud-object-storage.appdomain.cloud/archaizes/index.html

SlashNext: Label: Fake Login Page type: Phishing & Social Engineering

Multi AV Scanner detection for domain / URL

Source: https://kanaan.s3.eu-de.cloud-object-storage.appdomain.cloud/archaizes/index.html

Virustotal: Detection: 5%

Perma Link

Phishing:

Phishing site detected (based on shot template match)

Source: https://kanaan.s3.eu-de.cloud-object-storage.appdomain.cloud/archaizes/index.html

Matcher: Template: office matched

Yara detected HtmlPhish10

Source: Yara match

File source: 849224.4.links.csv, type: HTML

Yara detected HtmlPhish20

Source: Yara match	File source: 849224.pages.csv, type: HTML
Source: Yara match	File source: 849224.0.links.csv, type: HTML
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\home[1].htm, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\home[1].htm, type: DROPPED

Yara detected HtmlPhish7

Source: Yara match

File source: 849224.4.links.csv, type: HTML

HTML body contains low number of good links

Source: https://kanaan.s3.eu-de.cloud-object-storage.appdomain.cloud/archaizes/index.html	HTTP Parser: Number of links: 0
Source: https://kanaan.s3.eu-de.cloud-object-storage.appdomain.cloud/archaizes/index.html	HTTP Parser: Number of links: 0

HTML title does not match URL

Source: https://kanaan.s3.eu-de.cloud-object-storage.appdomain.cloud/archaizes/index.html	HTTP Parser: Title: Share Point Online does not match URL
Source: https://kanaan.s3.eu-de.cloud-object-storage.appdomain.cloud/archaizes/index.html	HTTP Parser: Title: Share Point Online does not match URL

META author tag missing

Source: https://kanaan.s3.eu-de.cloud-object-storage.appdomain.cloud/archaizes/index.html	HTTP Parser: No <meta name="author".. found
Source: https://kanaan.s3.eu-de.cloud-object-storage.appdomain.cloud/archaizes/index.html	HTTP Parser: No <meta name="author".. found

META copyright tag missing

Source: https://kanaan.s3.eu-de.cloud-object-storage.appdomain.cloud/archaizes/index.html	HTTP Parser: No <meta name="copyright".. found
Source: https://kanaan.s3.eu-de.cloud-object-storage.appdomain.cloud/archaizes/index.html	HTTP Parser: No <meta name="copyright".. found

Compliance:

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 142.250.180.225:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.180.225:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.180.225:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.180.225:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.180.225:443 -> 192.168.2.4:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.180.225:443 -> 192.168.2.4:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.180.225:443 -> 192.168.2.4:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.180.225:443 -> 192.168.2.4:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.11.207:443 -> 192.168.2.4:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.11.207:443 -> 192.168.2.4:49790 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.194.129:443 -> 192.168.2.4:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.194.129:443 -> 192.168.2.4:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.18.94:443 -> 192.168.2.4:49799 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.18.94:443 -> 192.168.2.4:49798 version: TLS 1.2

Networking:

Found strings which match to known social media urls

Source: base[1].js.3.dr	String found in binary or memory: (g.Ym(b,"www.youtube.com"),c=b.toString()):c=Tv(c);b=new ty(c);b.set("cmo=pf","1");d&&b.set("cmo=td","a1.googlevideo.com");return b}; equals www.youtube.com (Youtube)
Source: so[1].htm.3.dr	String found in binary or memory: ,[36,"YouTube","0 -2622px","https://www.youtube.com/?gl\u003dDE","_blank",false,null,""] equals www.youtube.com (Youtube)
Source: base[1].js.3.dr	String found in binary or memory: Cha=function(a,b){if(!a.i["0"]){var c=new bB("0","fakesb",{video:new YA(0,0,0,void 0,void 0,"auto")});a.i["0"]=b?new jA(new ty("http://www.youtube.com/videoplayback"),c,"fake"):new UA(new ty("http://www.youtube.com/videoplayback"),c,new Qz(0,0),new Qz(0,0))}}; equals www.youtube.com (Youtube)
Source: base[1].js.3.dr	String found in binary or memory: g.SD=function(a){a=HD(a.Ea);return"www.youtube-nocookie.com"===a?"www.youtube.com":a}; equals www.youtube.com (Youtube)
Source: base[1].js.3.dr	String found in binary or memory: g.iE=function(a){var b=g.TD(a);!a.Z("yt_embeds_disable_new_error_lozenge_url")&&cia.includes(b)&&(b="www.youtube.com");return a.protocol+"://"+b}; equals www.youtube.com (Youtube)
Source: base[1].js.3.dr	String found in binary or memory: g.k.clone=function(){var a=new bn;a.u=this.u;this.i&&(a.i=this.i.clone(),a.l=this.l);return a};var jn="://secure-...imrworldwide.com/ ://cdn.imrworldwide.com/ ://aksecure.imrworldwide.com/ ://[^.]*.moatads.com ://youtube[0-9]+.moatpixel.com ://pm.adsafeprotected.com/youtube ://pm.test-adsafeprotected.com/youtube ://e[0-9]+.yt.srs.doubleverify.com www.google.com/pagead/xsul www.youtube.com/pagead/slav".split(" "),fea=/\bocr\b/;var gea=/(?:\[|%5B)([a-zA-Z0-9_]+)(?:\]|%5D)/g;var OD={OZ:"LIVING_ROOM_APP_MODE_UNSPECIFIED",LZ:"LIVING_ROOM_APP_MODE_MAIN",KZ:"LIVING_ROOM_APP_MODE_KIDS",MZ:"LIVING_ROOM_APP_MODE_MUSIC",NZ:"LIVING_ROOM_APP_MODE_UNPLUGGED",JZ:"LIVING_ROOM_APP_MODE_GAMING"};mn.prototype.set=function(a,b){b=void 0===b?!0:b;0<=a&&52>a&&0===a%1&&this.data_[a]!=b&&(this.data_[a]=b,this.i=-1)}; equals www.youtube.com (Youtube)
Source: base[1].js.3.dr	String found in binary or memory: g.k.getVideoUrl=function(a,b,c,d,e){b={list:b};c&&(e?b.time_continue=c:b.t=c);c=g.TD(this);d&&"www.youtube.com"===c?d="https://youtu.be/"+a:g.BD(this)?(d="https://"+c+"/fire",b.v=a):(d=this.protocol+"://"+c+"/watch",b.v=a,Jq&&(a=Lo())&&(b.ebc=a));return g.Hd(d,b)}; equals www.youtube.com (Youtube)
Source: base[1].js.3.dr	String found in binary or memory: g.zM.prototype.l=function(a){var b=this;gpa(this);var c=a.qA,d=this.api.T();"GENERIC_WITHOUT_LINK"!==c||d.C?"TOO_MANY_REQUESTS"===c?(d=this.api.getVideoData(),this.Tc(CM(this,"TOO_MANY_REQUESTS_WITH_LINK",d.lm(),void 0,void 0,void 0,!1))):"HTML5_NO_AVAILABLE_FORMATS_FALLBACK"!==c||d.C?this.Tc(g.AM(a.errorMessage)):this.Tc(CM(this,"HTML5_NO_AVAILABLE_FORMATS_FALLBACK_WITH_LINK_SHORT","//www.youtube.com/supported_browsers")):(a=d.hostLanguage,c="//support.google.com/youtube/?p=player_error1",a&&(c= equals www.youtube.com (Youtube)
Source: base[1].js.3.dr	String found in binary or memory: lD("",a.embedsTokenValue));this.u=Mv(this.loaderUrl,Xha,Yha);h=this.loaderUrl;var l=void 0===l?!1:l;this.Bj=Kv(Mv(h,Zha,null),h,l,"Trusted Ad Domain URL");this.xa=iD(!1,a.privembed);this.protocol=0===this.Jb.indexOf("http:")?"http":"https";this.Ea=Ov((b?b.customBaseYoutubeUrl:a.BASE_YT_URL)||"")||Ov(this.Jb)||this.protocol+"://www.youtube.com/";l=b?b.eventLabel:a.el;h="detailpage";"adunit"===l?h=this.l?"embedded":"detailpage":"embedded"===l||this.u?h=jD(h,l,$ha):l&&(h="embedded");this.Da=h;tq();l= equals www.youtube.com (Youtube)
Source: base[1].js.3.dr	String found in binary or memory: lD("en",a.host_language);this.pj=!this.xa&&Math.random()<g.T(this.experiments,"web_player_api_logging_fraction");this.Ga=!this.xa;this.enabledEngageTypes=new Set;this.deviceHasDisplay=b?!b.deviceIsAudioOnly:iD(!0,a.deviceHasDisplay);this.Zc=kD(this.Zc,a.ismb);t=a;g.wC(this.experiments,"html5_qoe_intercept")?t=g.wC(this.experiments,"html5_qoe_intercept"):this.Aj?(t=t.vss_host||"s.youtube.com",this.Z("www_for_videostats")&&"s.youtube.com"===t&&(t=HD(this.Ea)||"www.youtube.com")):t="video.google.com"; equals www.youtube.com (Youtube)
Source: base[1].js.3.dr	String found in binary or memory: mJ.prototype.createUnpluggedLocationInfo=function(a){var b={};a=a.coords;if(null===a||void 0===a?0:a.latitude)b.latitudeE7=Math.floor(1E7*a.latitude);if(null===a||void 0===a?0:a.longitude)b.longitudeE7=Math.floor(1E7*a.longitude);if(null===a||void 0===a?0:a.accuracy)b.locationRadiusMeters=Math.round(a.accuracy);return b};var qJ;g.v(pJ,ls);pJ.prototype.Pv=function(a,b){a=ls.prototype.Pv.call(this,a,b);return Object.assign(Object.assign({},a),this.i)};var Mla=/[&\?]action_proxy=1/,Lla=/[&\?]token=([\w-]*)/,Nla=/[&\?]video_id=([\w-]*)/,Ola=/[&\?]index=([\d-]*)/,Pla=/[&\?]m_pos_ms=([\d-]*)/,Sla=/[&\?]vvt=([\w-]*)/,Gla="ca_type dt el flash u_tz u_his u_h u_w u_ah u_aw u_cd u_nplug u_nmime frm u_java bc bih biw brdim vis wgl".split(" "),Qla="www.youtube-nocookie.com youtube-nocookie.com www.youtube-nocookie.com:443 youtube.googleapis.com www.youtubeedu.com www.youtubeeducation.com video.google.com redirector.gvt1.com".split(" "),Ila={android:"ANDROID", equals www.youtube.com (Youtube)
Source: base[1].js.3.dr	String found in binary or memory: {HC:!0}),mja(this.videoData),this.W("highrepfallback");else if(a.i){b=this.l?this.l.l.u:null;if(Gxa(a)&&b&&b.isLocked())var d="FORMAT_UNAVAILABLE";else if(!this.i.C&&"auth"===a.errorCode&&"429"===a.details.rc){d="TOO_MANY_REQUESTS";var e="6"}this.W("playererror",a.errorCode,d,g.AB(a.details),e)}else this.W("nonfatalerror",a),d=/^pp/.test(this.videoData.clientPlaybackNonce),JU(this,a.errorCode,a.details),d&&"manifest.net.connect"===a.errorCode&&(a="https://www.youtube.com/generate_204?cpn="+this.videoData.clientPlaybackNonce+ equals www.youtube.com (Youtube)

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: lh6.googleusercontent.com

URLs found in memory or binary data

Source: cb=gapi[1].js.3.dr	String found in binary or memory: http://csi.gstatic.com/csi
Source: hover[1].css.3.dr	String found in binary or memory: http://ianlunn.co.uk/
Source: hover[1].css.3.dr	String found in binary or memory: http://ianlunn.github.io/Hover/)
Source: popper.min[1].js.3.dr	String found in binary or memory: http://opensource.org/licenses/MIT).
Source: history[1].htm.3.dr, home[1].htm0.3.dr, faq[1].htm.3.dr, team[1].htm.3.dr, home[1].htm.3.dr	String found in binary or memory: http://schema.org/WebPage
Source: RKK2G0P6.js.3.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: rs=AA2YrTs7Zb87CqdFxEjh5qFvninf3C7moQ[1].js.3.dr	String found in binary or memory: http://www.broofa.com
Source: base[1].js.3.dr	String found in binary or memory: http://www.youtube.com/videoplayback
Source: base[1].js.3.dr	String found in binary or memory: http://youtube.com/drm/2012/10/10
Source: base[1].js.3.dr	String found in binary or memory: http://youtube.com/streaming/metadata/segment/102015
Source: base[1].js.3.dr	String found in binary or memory: http://youtube.com/streaming/otf/durations/112015
Source: base[1].js.3.dr	String found in binary or memory: http://youtube.com/yt/2012/10/10
Source: home[1].htm.3.dr	String found in binary or memory: https://1316010704-atari-embeds.googleusercontent.com/embeds/16cb204cf3a9d4d223a0a3fd8b0eec5d/inner-
Source: faq[1].htm.3.dr	String found in binary or memory: https://1630025509-atari-embeds.googleusercontent.com/embeds/16cb204cf3a9d4d223a0a3fd8b0eec5d/inner-
Source: home[1].htm0.3.dr	String found in binary or memory: https://1874252041-atari-embeds.googleusercontent.com/embeds/16cb204cf3a9d4d223a0a3fd8b0eec5d/inner-
Source: history[1].htm.3.dr	String found in binary or memory: https://399563920-atari-embeds.googleusercontent.com/embeds/16cb204cf3a9d4d223a0a3fd8b0eec5d/inner-f
Source: team[1].htm.3.dr	String found in binary or memory: https://592948621-atari-embeds.googleusercontent.com/embeds/16cb204cf3a9d4d223a0a3fd8b0eec5d/inner-f
Source: cookies[2].htm.3.dr	String found in binary or memory: https://about.google/
Source: cb=gapi[1].js.3.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: cb=gapi[1].js.3.dr, faq[1].htm.3.dr, team[1].htm.3.dr, home[1].htm.3.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/iframe
Source: history[1].htm.3.dr, cb=gapi[1].js0.3.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: base[1].js.3.dr	String found in binary or memory: https://admin.youtube.com
Source: so[1].htm.3.dr	String found in binary or memory: https://ads.google.com/home/?subid
Source: {ECC508A2-CA1C-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
Source: analytics[1].js.3.dr	String found in binary or memory: https://ampcid.google.com/v1/publisher:getClientId
Source: cookies[2].htm.3.dr	String found in binary or memory: https://analytics.google.com/analytics/academy/
Source: cb=gapi[1].js0.3.dr, client[1].js.3.dr, rs=AA2YrTs7Zb87CqdFxEjh5qFvninf3C7moQ[1].js.3.dr, so[1].htm.3.dr	String found in binary or memory: https://apis.google.com
Source: m=_b,_tp[1].js.3.dr, so[1].htm.3.dr	String found in binary or memory: https://apis.google.com/js/api.js
Source: history[1].htm.3.dr, home[1].htm0.3.dr, faq[1].htm.3.dr, team[1].htm.3.dr, home[1].htm.3.dr	String found in binary or memory: https://apis.google.com/js/client.js?onload=gapiLoaded
Source: so[1].htm.3.dr	String found in binary or memory: https://artsandculture.google.com/?hl
Source: so[1].htm.3.dr	String found in binary or memory: https://books.google.de/?hl
Source: so[1].htm.3.dr	String found in binary or memory: https://calendar.google.com/calendar
Source: {ECC508A2-CA1C-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js
Source: so[1].htm.3.dr	String found in binary or memory: https://chat.google.com/
Source: cb=gapi[1].js0.3.dr, cb=gapi[1].js.3.dr	String found in binary or memory: https://clients6.google.com
Source: {ECC508A2-CA1C-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://code.jquery.com/jquery-3.1.1.min.js
Source: {ECC508A2-CA1C-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://code.jquery.com/jquery-3.2.1.slim.min.js
Source: {ECC508A2-CA1C-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://code.jquery.com/jquery-3.3.1.js
Source: cb=gapi[1].js.3.dr	String found in binary or memory: https://console.developers.google.com/
Source: so[1].htm.3.dr	String found in binary or memory: https://contacts.google.com/?hl
Source: cb=gapi[1].js0.3.dr, cb=gapi[1].js.3.dr	String found in binary or memory: https://content.googleapis.com
Source: cb=gapi[1].js.3.dr	String found in binary or memory: https://csi.gstatic.com/csi
Source: cb=gapi[1].js.3.dr	String found in binary or memory: https://developers.google.com/
Source: cb=gapi[1].js.3.dr	String found in binary or memory: https://developers.google.com/api-client-library/javascript/reference/referencedocs
Source: cb=gapi[1].js.3.dr	String found in binary or memory: https://developers.googleblog.com/2018/03/discontinuing-support-for-json-rpc-and.html
Source: history[1].htm.3.dr	String found in binary or memory: https://docs.google.com
Source: so[1].htm.3.dr	String found in binary or memory: https://docs.google.com/document/?usp
Source: so[1].htm.3.dr	String found in binary or memory: https://docs.google.com/forms/?usp
Source: base[1].js.3.dr	String found in binary or memory: https://docs.google.com/get_video_info
Source: so[1].htm.3.dr	String found in binary or memory: https://docs.google.com/presentation/?usp
Source: so[1].htm.3.dr	String found in binary or memory: https://docs.google.com/spreadsheets/?usp
Source: history[1].htm.3.dr	String found in binary or memory: https://domains.google.com
Source: cb=gapi[1].js0.3.dr	String found in binary or memory: https://domains.google.com/suggest/flow
Source: history[1].htm.3.dr	String found in binary or memory: https://drive.google.com
Source: so[1].htm.3.dr	String found in binary or memory: https://drive.google.com/
Source: so[1].htm.3.dr	String found in binary or memory: https://duo.google.com/?usp
Source: so[1].htm.3.dr	String found in binary or memory: https://earth.google.com/web/
Source: free.min[1].css.3.dr	String found in binary or memory: https://fontawesome.com
Source: free.min[1].css.3.dr	String found in binary or memory: https://fontawesome.com/license/free
Source: css[1].css.3.dr	String found in binary or memory: https://fonts.google.com/license/googlerestricted
Source: history[1].htm.3.dr, home[1].htm0.3.dr, faq[1].htm.3.dr, team[1].htm.3.dr, home[1].htm.3.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Google
Source: history[1].htm.3.dr, home[1].htm0.3.dr, faq[1].htm.3.dr, team[1].htm.3.dr, home[1].htm.3.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=PT%20Sans%3A400%2C700%7CMerriweather%3A400%2C700&display=swa
Source: {ECC508A2-CA1C-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Yellowtail&display=swap
Source: css[1].css.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/googlesans/v27/4UaGrENHsxJlGDuGo1OIlL3Owpg.woff)
Source: css[1].css.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/googlesans/v27/4UabrENHsxJlGDuGo1OIlLU94YtzCwA.woff)
Source: css[1].css0.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/merriweather/v22/u-440qyriQwlOrhSvowK_l5-fCZK.woff)
Source: css[1].css0.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/merriweather/v22/u-4n0qyriQwlOrhSvowK_l52xwNZWMf8.woff)
Source: css[1].css0.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsans/v12/jizaRExUiTo99u79D0KEww.woff)
Source: css[1].css0.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsans/v12/jizfRExUiTo99u79B_mh0O6tKw.woff)
Source: css[1].css.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v27/KFOlCnqEu92Fr1MmEU9fBBc-.woff)
Source: css[1].css.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v27/KFOlCnqEu92Fr1MmSU5fBBc-.woff)
Source: css[1].css.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v27/KFOlCnqEu92Fr1MmWUlfBBc-.woff)
Source: css[1].css.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v27/KFOmCnqEu92Fr1Mu4mxM.woff)
Source: css[1].css.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/sourcecodepro/v14/HI_SiYsKILxRpg3hIP6sJ7fM7PqlPevQ.woff)
Source: css[1].css.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/sourcecodepro/v14/HI_XiYsKILxRpg3hIP6sJ7fM7Pqths7Ds-cs.woff)
Source: css[2].css.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/yellowtail/v11/OZpGg_pnoDtINPfRIlLohlvHxw.woff)
Source: cookies[2].htm.3.dr	String found in binary or memory: https://g.co/adsettings
Source: cookies[2].htm.3.dr	String found in binary or memory: https://g.co/privacytools
Source: bootstrap.min[1].css.3.dr, bootstrap.min[1].js.3.dr	String found in binary or memory: https://getbootstrap.com)
Source: hover[1].css.3.dr	String found in binary or memory: https://github.com/IanLunn/Hover
Source: bootstrap.min[1].css.3.dr, bootstrap.min[1].js.3.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: bootstrap.min[1].js.3.dr	String found in binary or memory: https://github.com/twbs/bootstrap/graphs/contributors)
Source: so[1].htm.3.dr	String found in binary or memory: https://hangouts.google.com/
Source: so[1].htm.3.dr	String found in binary or memory: https://jamboard.google.com/?usp
Source: 585b051251[1].js.3.dr	String found in binary or memory: https://ka-f.fontawesome.com
Source: {ECC508A2-CA1C-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://kanaan.s3.eu-d
Source: {ECC508A2-CA1C-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://kanaan.s3.eu-de.cloud-object-storage.appdomain.clouRoot
Source: url[1].htm.3.dr	String found in binary or memory: https://kanaan.s3.eu-de.cloud-object-storage.appdomain.cloud/archaizes/index.html
Source: {ECC508A2-CA1C-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://kanaan.s3.eu-de.cloud-object-storage.appdomain.cloud/archaizes/index.html$Share
Source: ~DF22D972DD4D0EC9B9.TMP.1.dr	String found in binary or memory: https://kanaan.s3.eu-de.cloud-object-storage.appdomain.cloud/archaizes/index.htmlpdomain.cloud%2Farc
Source: so[1].htm.3.dr	String found in binary or memory: https://keep.google.com
Source: 585b051251[1].js.3.dr	String found in binary or memory: https://kit.fontawesome.com
Source: {ECC508A2-CA1C-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://kit.fontawesome.com/585b051251.js
Source: team[1].htm.3.dr	String found in binary or memory: https://lh6.googleusercontent.com/MPisMsKgfWPH_wyQtxwiETVIZ7-3oktBmkawItaNgMz0NXMp-_nwwU28HJuThaptRJ
Source: home[1].htm.3.dr	String found in binary or memory: https://lh6.googleusercontent.com/zpO9kHTvpLtyF0occuD5iEjTbotrMbK6h-VvR6YrxCosY8V3x5Cp6-iMKe6v8WpZW4
Source: {ECC508A2-CA1C-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://login.microsoftonline.com/common/login
Source: so[1].htm.3.dr	String found in binary or memory: https://mail.google.com/mail/
Source: so[1].htm.3.dr	String found in binary or memory: https://maps.google.de/maps?hl
Source: {ECC508A2-CA1C-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css
Source: {ECC508A2-CA1C-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js
Source: so[1].htm.3.dr	String found in binary or memory: https://meet.google.com?hs
Source: RKK2G0P6.js.3.dr	String found in binary or memory: https://myaccount.google.com/
Source: so[1].htm.3.dr	String found in binary or memory: https://myaccount.google.com/?utm_source
Source: so[1].htm.3.dr	String found in binary or memory: https://news.google.com/
Source: so[1].htm.3.dr	String found in binary or memory: https://ogs.google.com/
Source: so[1].htm.3.dr	String found in binary or memory: https://ogs.google.com/widget/app/so
Source: base[1].js.3.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/osd.js
Source: so[1].htm.3.dr	String found in binary or memory: https://photos.google.com/?pageId
Source: so[1].htm.3.dr	String found in binary or memory: https://play.google.com/?hl
Source: RKK2G0P6.js.3.dr, rs=AA2YrTs7Zb87CqdFxEjh5qFvninf3C7moQ[1].js.3.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: cb=gapi[1].js0.3.dr	String found in binary or memory: https://plus.google.com
Source: cb=gapi[1].js0.3.dr	String found in binary or memory: https://plus.googleapis.com
Source: so[1].htm.3.dr	String found in binary or memory: https://podcasts.google.com/
Source: {ECC508A2-CA1C-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://policies.googl
Source: so[1].htm.3.dr	String found in binary or memory: https://policies.google.com
Source: {ECC508A2-CA1C-11EB-90EB-ECF4BBEA1588}.dat.1.dr, cookies[2].htm.3.dr	String found in binary or memory: https://policies.google.com/
Source: cookies[1].htm.3.dr	String found in binary or memory: https://policies.google.com/technologies/cookies
Source: {ECC508A2-CA1C-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://policies.google.com/technologies/cookiesdHow
Source: ~DF22D972DD4D0EC9B9.TMP.1.dr	String found in binary or memory: https://policies.google.com/technologies/cookieses/.cloud/archaizes/index.htmlpdomain.cloud%2Farchai
Source: base[1].js.3.dr	String found in binary or memory: https://redux.js.org/api/store#subscribelistener
Source: {ECC508A2-CA1C-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://sites.goo/home
Source: {ECC508A2-CA1C-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://sites.goo/policies/technologies/cookies/.cloud/archaizes/index.htmlpdomain.cloud%2Farchaizes
Source: {ECC508A2-CA1C-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://sites.goo/url?q=https%3A%2F%2Fkanaan.s3.eu-de.cloud-object-storage.appdomain.cloud%2Farchaiz
Source: {ECC508A2-CA1C-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://sites.gooPH0
Source: {ECC508A2-CA1C-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://sites.gooRoot
Source: {ECC508A2-CA1C-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://sites.gooe.cloud-object-storage.appdomain.cloud/archaizes/index.htmlpdomain.cloud%2Farchaize
Source: {ECC508A2-CA1C-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://sites.gooe.com/technologies/cookieses/.cloud/archaizes/index.htmlpdomain.cloud%2Farchaizes%2
Source: {ECC508A2-CA1C-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://sites.google.c
Source: {ECC508A2-CA1C-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://sites.google.com/
Source: history[1].htm.3.dr	String found in binary or memory: https://sites.google.com/new/
Source: history[1].htm.3.dr	String found in binary or memory: https://sites.google.com/new/?usp
Source: faq[1].htm.3.dr	String found in binary or memory: https://sites.google.com/view/tribridgeresidential/faq
Source: {ECC508A2-CA1C-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://sites.google.com/view/tribridgeresidential/faq6TRIBRIDGE
Source: ~DF22D972DD4D0EC9B9.TMP.1.dr	String found in binary or memory: https://sites.google.com/view/tribridgeresidential/faqry
Source: ~DF22D972DD4D0EC9B9.TMP.1.dr	String found in binary or memory: https://sites.google.com/view/tribridgeresidential/faqryoogle.com/view/tribridgeresidential/faq
Source: {ECC508A2-CA1C-11EB-90EB-ECF4BBEA1588}.dat.1.dr, ~DF22D972DD4D0EC9B9.TMP.1.dr	String found in binary or memory: https://sites.google.com/view/tribridgeresidential/history
Source: home[1].htm.3.dr	String found in binary or memory: https://sites.google.com/view/tribridgeresidential/home
Source: {ECC508A2-CA1C-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://sites.google.com/view/tribridgeresidential/homeRoot
Source: ~DF22D972DD4D0EC9B9.TMP.1.dr	String found in binary or memory: https://sites.google.com/view/tribridgeresidential/homeogle.com/view/tribridgeresidential/home
Source: {ECC508A2-CA1C-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://sites.google.com/view/tribridgeresidential/homeom/view/tribridgeresidential/homeRoot
Source: team[1].htm.3.dr	String found in binary or memory: https://sites.google.com/view/tribridgeresidential/team
Source: {ECC508A2-CA1C-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://sites.google.com/view/tribridgeresidential/team8TRIBRIDGE
Source: ~DF22D972DD4D0EC9B9.TMP.1.dr	String found in binary or memory: https://sites.google.com/view/tribridgeresidential/teamry
Source: {ECC508A2-CA1C-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://sites.google.com/view/tribridgeresidentialRoot
Source: {ECC508A2-CA1C-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://sites.gooom/view/tribridgeresidential/faqryRoot
Source: {ECC508A2-CA1C-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://sites.gooom/view/tribridgeresidential/historyRoot
Source: {ECC508A2-CA1C-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://sites.gooom/view/tribridgeresidential/homeRoot
Source: {ECC508A2-CA1C-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://sites.gooom/view/tribridgeresidential/teamryRoot
Source: {ECC508A2-CA1C-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://smtpro101.com/email-list/mnb/css/hover.css
Source: {ECC508A2-CA1C-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://smtpro101.com/email-list/mnb/images/8.jpg
Source: {ECC508A2-CA1C-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://smtpro101.com/email-list/mnb/images/adobe.jpg
Source: {ECC508A2-CA1C-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://smtpro101.com/email-list/mnb/images/aol.png
Source: {ECC508A2-CA1C-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://smtpro101.com/email-list/mnb/images/gmail.png
Source: {ECC508A2-CA1C-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://smtpro101.com/email-list/mnb/images/office365.png
Source: {ECC508A2-CA1C-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://smtpro101.com/email-list/mnb/images/office3651.png
Source: {ECC508A2-CA1C-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://smtpro101.com/email-list/mnb/images/other1.png
Source: {ECC508A2-CA1C-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://smtpro101.com/email-list/mnb/images/othermail.ico
Source: {ECC508A2-CA1C-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://smtpro101.com/email-list/mnb/images/outlook.png
Source: {ECC508A2-CA1C-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://smtpro101.com/email-list/mnb/images/outlook1.png
Source: {ECC508A2-CA1C-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://smtpro101.com/email-list/mnb/images/yahoo.png
Source: {ECC508A2-CA1C-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://smtpro101.com/email-list/onedrive25/finish.php
Source: so[1].htm.3.dr	String found in binary or memory: https://ssl.gstatic.com
Source: FUGK6LE5.js.3.dr	String found in binary or memory: https://ssl.gstatic.com/atari/images/no_results_error.png
Source: history[1].htm.3.dr, home[1].htm0.3.dr, faq[1].htm.3.dr, team[1].htm.3.dr, home[1].htm.3.dr	String found in binary or memory: https://ssl.gstatic.com/atari/images/public/favicon.ico
Source: imagestore.dat.3.dr	String found in binary or memory: https://ssl.gstatic.com/atari/images/public/favicon.ico~
Source: so[1].htm.3.dr	String found in binary or memory: https://ssl.gstatic.com/gb/images/p1_c9bc74a1.png
Source: so[1].htm.3.dr	String found in binary or memory: https://ssl.gstatic.com/gb/images/p2_4b3829c9.png
Source: cb=gapi[1].js.3.dr	String found in binary or memory: https://ssl.gstatic.com/gb/js/
Source: imagestore.dat.3.dr	String found in binary or memory: https://ssl.gstatic.com/policies/favicon.ico
Source: imagestore.dat.3.dr	String found in binary or memory: https://ssl.gstatic.com/policies/favicon.ico~
Source: so[1].htm.3.dr	String found in binary or memory: https://stadia.google.com/
Source: analytics[1].js.3.dr	String found in binary or memory: https://stats.g.doubleclick.net/j/collect
Source: RKK2G0P6.js.3.dr	String found in binary or memory: https://support.google.com/
Source: cookies[2].htm.3.dr	String found in binary or memory: https://support.google.com/chrome/answer/95464
Source: FUGK6LE5.js.3.dr	String found in binary or memory: https://support.google.com/cloudsearch/answer/6172299
Source: base[1].js.3.dr	String found in binary or memory: https://support.google.com/youtube/?p=missing_quality
Source: base[1].js.3.dr	String found in binary or memory: https://support.google.com/youtube/?p=noaudio
Source: base[1].js.3.dr	String found in binary or memory: https://support.google.com/youtube/?p=report_playback
Source: base[1].js.3.dr	String found in binary or memory: https://support.google.com/youtube/answer/6276924
Source: remote[1].js.3.dr	String found in binary or memory: https://support.google.com/youtube/answer/7640706
Source: analytics[1].js.3.dr	String found in binary or memory: https://tagassistant.google.com/
Source: so[1].htm.3.dr	String found in binary or memory: https://translate.google.de/?hl
Source: m=view[1].js.3.dr, m=_b,_tp[1].js.3.dr	String found in binary or memory: https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=
Source: base[1].js.3.dr	String found in binary or memory: https://viacon.corp.google.com
Source: cb=gapi[1].js0.3.dr	String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: so[1].htm.3.dr	String found in binary or memory: https://workspace.google.com/marketplace?pann
Source: so[1].htm.3.dr	String found in binary or memory: https://www.blogger.com/
Source: RKK2G0P6.js.3.dr	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: analytics[1].js.3.dr	String found in binary or memory: https://www.google-analytics.com/debug/bootstrap
Source: analytics[1].js.3.dr	String found in binary or memory: https://www.google-analytics.com/gtm/js?id=
Source: RKK2G0P6.js.3.dr	String found in binary or memory: https://www.google.
Source: analytics[1].js.3.dr	String found in binary or memory: https://www.google.%/ads/ga-audiences
Source: {ECC508A2-CA1C-11EB-90EB-ECF4BBEA1588}.dat.1.dr, cookies[2].htm.3.dr	String found in binary or memory: https://www.google.com
Source: cookies[2].htm.3.dr	String found in binary or memory: https://www.google.com/
Source: so[1].htm.3.dr	String found in binary or memory: https://www.google.com/chrome/?brand
Source: imagestore.dat.3.dr	String found in binary or memory: https://www.google.com/favicon.ico
Source: imagestore.dat.3.dr	String found in binary or memory: https://www.google.com/favicon.ico~
Source: RKK2G0P6.js.3.dr, rs=AA2YrTs7Zb87CqdFxEjh5qFvninf3C7moQ[1].js.3.dr	String found in binary or memory: https://www.google.com/log?format=json&hasfast=true
Source: ~DF22D972DD4D0EC9B9.TMP.1.dr	String found in binary or memory: https://www.google.com/policies/technologies/cookies/.cloud/archaizes/index.htmlpdomain.cloud%2Farch
Source: so[1].htm.3.dr	String found in binary or memory: https://www.google.com/travel/?dest_src
Source: {ECC508A2-CA1C-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.google.com/url?q=https%3A%2F%2Fkanaan.s3.eu-de.cloud-object-storage.appdomain.cloud%2Far
Source: so[1].htm.3.dr	String found in binary or memory: https://www.google.de/intl/en/about/products
Source: so[1].htm.3.dr	String found in binary or memory: https://www.google.de/save
Source: so[1].htm.3.dr	String found in binary or memory: https://www.google.de/shopping?hl
Source: so[1].htm.3.dr	String found in binary or memory: https://www.google.de/webhp
Source: cb=gapi[1].js.3.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.login
Source: cb=gapi[1].js0.3.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: cb=gapi[1].js0.3.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: base[1].js.3.dr	String found in binary or memory: https://www.googleapis.com/certificateprovisioning/v1/devicecertificates/create?key=AIzaSyB-5OLKTx2i
Source: analytics[1].js.3.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=
Source: RKK2G0P6.js.3.dr	String found in binary or memory: https://www.gstatic.
Source: so[1].htm.3.dr	String found in binary or memory: https://www.gstatic.com
Source: history[1].htm.3.dr, home[1].htm0.3.dr, faq[1].htm.3.dr, team[1].htm.3.dr, home[1].htm.3.dr	String found in binary or memory: https://www.gstatic.com/_/atari/_/ss/k=atari.vw.H9gJArw3r2Q.L.I11.O/d=1/rs=AGEqA5lU6_p3Xs6-mgc-DsOLu
Source: cookies[2].htm.3.dr	String found in binary or memory: https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.IdentityPoliciesUi.en_US.pWi_f_o0gHU.
Source: so[1].htm.3.dr	String found in binary or memory: https://www.gstatic.com/_/mss/boq-one-google/_/js/k=boq-one-google.OneGoogleWidgetUi.en.Y7LEhkj7g0U.
Source: history[1].htm.3.dr, home[1].htm0.3.dr, faq[1].htm.3.dr, team[1].htm.3.dr, home[1].htm.3.dr	String found in binary or memory: https://www.gstatic.com/atari/embeds/5de913a2354e93acf4d43c4db53928e5/intermediate-frame-minified.ht
Source: remote[1].js.3.dr	String found in binary or memory: https://www.gstatic.com/cv/js/sender/v1/cast_sender.js
Source: rs=AA2YrTs7Zb87CqdFxEjh5qFvninf3C7moQ[1].js.3.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: rs=AA2YrTs7Zb87CqdFxEjh5qFvninf3C7moQ[1].js.3.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: rs=AA2YrTs7Zb87CqdFxEjh5qFvninf3C7moQ[1].js.3.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: cookies[2].htm.3.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/1x/search_black_24dp.png
Source: RKK2G0P6.js.3.dr	String found in binary or memory: https://www.youtube-nocookie.com/embed/
Source: {ECC508A2-CA1C-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.youtube-nocookie.com/embed/TBR-xtJVq7E?rel=0&showinfo=0&theme=light&version=3&hl=en&cc_l
Source: so[1].htm.3.dr	String found in binary or memory: https://www.youtube.com/?gl
Source: base[1].js.3.dr	String found in binary or memory: https://www.youtube.com/generate_204?cpn=
Source: base[1].js.3.dr	String found in binary or memory: https://youtu.be/
Source: base[1].js.3.dr	String found in binary or memory: https://youtube.com/api/drm/fps?ek=uninitialized
Source: base[1].js.3.dr	String found in binary or memory: https://youtubei.googleapis.com/youtubei/
Source: base[1].js.3.dr	String found in binary or memory: https://yurt.corp.google.com

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 142.250.180.225:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.180.225:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.180.225:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.180.225:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.180.225:443 -> 192.168.2.4:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.180.225:443 -> 192.168.2.4:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.180.225:443 -> 192.168.2.4:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.180.225:443 -> 192.168.2.4:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.11.207:443 -> 192.168.2.4:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.11.207:443 -> 192.168.2.4:49790 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.194.129:443 -> 192.168.2.4:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.194.129:443 -> 192.168.2.4:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.18.94:443 -> 192.168.2.4:49799 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.18.94:443 -> 192.168.2.4:49798 version: TLS 1.2

System Summary:

Yara signature match

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\index[1].htm, type: DROPPED

Matched rule: SUSP_Base64_Encoded_Hex_Encoded_Code date = 2019-04-29, author = Florian Roth, description = Detects hex encoded code that has been base64 encoded, score = https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/

Classification label

Source: classification engine

Classification label: mal96.phis.win@3/92@12/6

Creates files inside the user directory

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{ECC508A0-CA1C-11EB-90EB-ECF4BBEA1588}.dat

Jump to behavior

Creates temporary files

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DFF71A325E2F2F2688.TMP

Jump to behavior

Reads ini files

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Spawns processes

Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6784 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6784 CREDAT:17410 /prefetch:2			Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior