Windows Analysis Report http://covidteamclapham@gmail.com

Phishing:

URL contains potential PII (phishing indication)

Source: http://covidteamclapham@gmail.com

Sample URL: PII: covidteamclapham@gmail.com

Found iframes

Source: https://accounts.google.com/signin/v2/identifier?service=mail&passive=true&rm=false&continue=https%3A%2F%2Fmail.google.com%2Fmail%2F&ss=1&scc=1&ltmpl=default&ltmplcache=2&emr=1&osid=1&flowName=GlifWebSignIn&flowEntry=ServiceLogin	HTTP Parser: Iframe src: https://accounts.youtube.com/accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=-144623341&timestamp=1629989439797
Source: https://accounts.google.com/signin/v2/identifier?service=mail&passive=true&rm=false&continue=https%3A%2F%2Fmail.google.com%2Fmail%2F&ss=1&scc=1&ltmpl=default&ltmplcache=2&emr=1&osid=1&flowName=GlifWebSignIn&flowEntry=ServiceLogin	HTTP Parser: Iframe src: /_/bscframe
Source: https://accounts.google.com/signin/v2/identifier?service=mail&passive=true&rm=false&continue=https%3A%2F%2Fmail.google.com%2Fmail%2F&ss=1&scc=1&ltmpl=default&ltmplcache=2&emr=1&osid=1&flowName=GlifWebSignIn&flowEntry=ServiceLogin	HTTP Parser: Iframe src: https://accounts.youtube.com/accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=-144623341&timestamp=1629989439797
Source: https://accounts.google.com/signin/v2/identifier?service=mail&passive=true&rm=false&continue=https%3A%2F%2Fmail.google.com%2Fmail%2F&ss=1&scc=1&ltmpl=default&ltmplcache=2&emr=1&osid=1&flowName=GlifWebSignIn&flowEntry=ServiceLogin	HTTP Parser: Iframe src: /_/bscframe
Source: https://accounts.google.com/signin/v2/identifier?hl=en-GB&passive=true&continue=http%3A%2F%2Fsupport.google.com%2Fchrome%2Fanswer%2F6130773%3Fhl%3Den-GB&ec=GAZAdQ&flowName=GlifWebSignIn&flowEntry=ServiceLogin	HTTP Parser: Iframe src: https://accounts.youtube.com/accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=-1969567377&timestamp=1629989486685
Source: https://accounts.google.com/signin/v2/identifier?hl=en-GB&passive=true&continue=http%3A%2F%2Fsupport.google.com%2Fchrome%2Fanswer%2F6130773%3Fhl%3Den-GB&ec=GAZAdQ&flowName=GlifWebSignIn&flowEntry=ServiceLogin	HTTP Parser: Iframe src: /_/bscframe

No HTML title found

Source: https://accounts.google.com/signin/v2/identifier?service=mail&passive=true&rm=false&continue=https%3A%2F%2Fmail.google.com%2Fmail%2F&ss=1&scc=1&ltmpl=default&ltmplcache=2&emr=1&osid=1&flowName=GlifWebSignIn&flowEntry=ServiceLogin	HTTP Parser: HTML title missing
Source: https://accounts.google.com/signin/v2/identifier?service=mail&passive=true&rm=false&continue=https%3A%2F%2Fmail.google.com%2Fmail%2F&ss=1&scc=1&ltmpl=default&ltmplcache=2&emr=1&osid=1&flowName=GlifWebSignIn&flowEntry=ServiceLogin	HTTP Parser: HTML title missing
Source: https://accounts.google.com/signin/v2/identifier?hl=en-GB&passive=true&continue=http%3A%2F%2Fsupport.google.com%2Fchrome%2Fanswer%2F6130773%3Fhl%3Den-GB&ec=GAZAdQ&flowName=GlifWebSignIn&flowEntry=ServiceLogin	HTTP Parser: HTML title missing

Unusual large HTML page

Source: https://accounts.google.com/signin/v2/identifier?service=mail&passive=true&rm=false&continue=https%3A%2F%2Fmail.google.com%2Fmail%2F&ss=1&scc=1&ltmpl=default&ltmplcache=2&emr=1&osid=1&flowName=GlifWebSignIn&flowEntry=ServiceLogin	HTTP Parser: Total size: 1866028
Source: https://accounts.google.com/signin/v2/identifier?hl=en-GB&passive=true&continue=http%3A%2F%2Fsupport.google.com%2Fchrome%2Fanswer%2F6130773%3Fhl%3Den-GB&ec=GAZAdQ&flowName=GlifWebSignIn&flowEntry=ServiceLogin	HTTP Parser: Total size: 1863374

META author tag missing

Source: https://accounts.google.com/signin/v2/identifier?service=mail&passive=true&rm=false&continue=https%3A%2F%2Fmail.google.com%2Fmail%2F&ss=1&scc=1&ltmpl=default&ltmplcache=2&emr=1&osid=1&flowName=GlifWebSignIn&flowEntry=ServiceLogin	HTTP Parser: No <meta name="author".. found
Source: https://accounts.google.com/signin/v2/identifier?service=mail&passive=true&rm=false&continue=https%3A%2F%2Fmail.google.com%2Fmail%2F&ss=1&scc=1&ltmpl=default&ltmplcache=2&emr=1&osid=1&flowName=GlifWebSignIn&flowEntry=ServiceLogin	HTTP Parser: No <meta name="author".. found
Source: https://accounts.google.com/signin/v2/identifier?hl=en-GB&passive=true&continue=http%3A%2F%2Fsupport.google.com%2Fchrome%2Fanswer%2F6130773%3Fhl%3Den-GB&ec=GAZAdQ&flowName=GlifWebSignIn&flowEntry=ServiceLogin	HTTP Parser: No <meta name="author".. found

META copyright tag missing

Source: https://accounts.google.com/signin/v2/identifier?service=mail&passive=true&rm=false&continue=https%3A%2F%2Fmail.google.com%2Fmail%2F&ss=1&scc=1&ltmpl=default&ltmplcache=2&emr=1&osid=1&flowName=GlifWebSignIn&flowEntry=ServiceLogin	HTTP Parser: No <meta name="copyright".. found
Source: https://accounts.google.com/signin/v2/identifier?service=mail&passive=true&rm=false&continue=https%3A%2F%2Fmail.google.com%2Fmail%2F&ss=1&scc=1&ltmpl=default&ltmplcache=2&emr=1&osid=1&flowName=GlifWebSignIn&flowEntry=ServiceLogin	HTTP Parser: No <meta name="copyright".. found
Source: https://accounts.google.com/signin/v2/identifier?hl=en-GB&passive=true&continue=http%3A%2F%2Fsupport.google.com%2Fchrome%2Fanswer%2F6130773%3Fhl%3Den-GB&ec=GAZAdQ&flowName=GlifWebSignIn&flowEntry=ServiceLogin	HTTP Parser: No <meta name="copyright".. found

Compliance:

Creates a directory in C:\Program Files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic			Jump to behavior

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 172.217.168.68:443 -> 192.168.2.3:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.239.32.29:443 -> 192.168.2.3:49827 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.239.32.29:443 -> 192.168.2.3:49828 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.203.97:443 -> 192.168.2.3:49830 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.203.97:443 -> 192.168.2.3:49829 version: TLS 1.2

Networking:

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: clients2.google.com

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49937 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49959 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443

Downloads files from webservers via HTTP

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: gmail.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Found strings which match to known social media urls

Source: b2cbac092fd30741_0.0.dr

String found in binary or memory: _keyhttps://www.youtube.com/s/player/31389f53/www-widgetapi.vflset/www-widgetapi.js equals www.youtube.com (Youtube)

URLs found in memory or binary data

Source: History-journal.0.dr	String found in binary or memory: http://gmail.com/
Source: History Provider Cache.0.dr	String found in binary or memory: http://gmail.com/2
Source: Favicons-journal.0.dr	String found in binary or memory: http://gmail.com/C
Source: History-journal.0.dr	String found in binary or memory: http://gmail.com/Gmail
Source: History-journal.0.dr	String found in binary or memory: http://gmail.com/Gmail/)
Source: Favicons-journal.0.dr	String found in binary or memory: http://gmail.com/h6
Source: Current Session.0.dr	String found in binary or memory: https://2542116.fls.doubleclick.net
Source: Current Session.0.dr	String found in binary or memory: https://2542116.fls.doubleclick.net/activityi;dc_pre=CIj886__zfICFdaTGwodwDAOFg;src=2542116;type=chr
Source: 000003.log4.0.dr	String found in binary or memory: https://about.google
Source: 1d9307e50ef6b7b0_0.0.dr, edf93f9e20175326_0.0.dr, 000003.log0.0.dr	String found in binary or memory: https://about.google/
Source: 33d8ea273e8e208e_0.0.dr	String found in binary or memory: https://about.google/$_
Source: 11872aa7eaefe3b0_0.0.dr	String found in binary or memory: https://about.google/9
Source: 6718ea04bafb0e3e_0.0.dr	String found in binary or memory: https://about.google/L
Source: 346866bbe969e451_0.0.dr	String found in binary or memory: https://about.google/R
Source: ec917b5dce596813_0.0.dr	String found in binary or memory: https://about.google/S
Source: 3eb7118a6f9ed95d_0.0.dr	String found in binary or memory: https://about.google/a_
Source: d5c2481f810214e6_0.0.dr	String found in binary or memory: https://about.google/assets-products/js/detect.min.js?cache=c84f19a
Source: ae8d89bf4087b90b_0.0.dr	String found in binary or memory: https://about.google/assets-products/js/main.min.js?cache=59c1266
Source: Favicons-journal.0.dr	String found in binary or memory: https://about.google/favicon.ico
Source: Favicons-journal.0.dr	String found in binary or memory: https://about.google/favicon.ico0
Source: Current Session.0.dr	String found in binary or memory: https://about.google/intl/en-GB/products/?tab=uh
Source: Current Session.0.dr	String found in binary or memory: https://about.google/intl/en-GB/products/?tab=uh6
Source: Current Session.0.dr	String found in binary or memory: https://about.google/intl/en-GB/products/?tab=uh6Browse
Source: History-journal.0.dr	String found in binary or memory: https://about.google/intl/en-GB/products/?tab=uhBrowse
Source: History-journal.0.dr	String found in binary or memory: https://about.google/intl/en-GB/products?tab=uh
Source: History-journal.0.dr	String found in binary or memory: https://about.google/intl/en-GB/products?tab=uhBrowse
Source: 708b0d476bdfeb05_0.0.dr	String found in binary or memory: https://about.google/x
Source: 000003.log4.0.dr	String found in binary or memory: https://accounts.google.com
Source: Current Session.0.dr	String found in binary or memory: https://accounts.google.com#
Source: 76de4dcbb9e41e4e_0.0.dr	String found in binary or memory: https://accounts.google.com/
Source: ef977d45ec95f84e_0.0.dr	String found in binary or memory: https://accounts.google.com/1
Source: 6f03eee6c655138e_0.0.dr	String found in binary or memory: https://accounts.google.com/7
Source: 36f490bb56fc958e_0.0.dr	String found in binary or memory: https://accounts.google.com/?W
Source: 4f5681f2e8ddfb33_0.0.dr	String found in binary or memory: https://accounts.google.com/L
Source: Current Session.0.dr, History-journal.0.dr, Favicons-journal.0.dr	String found in binary or memory: https://accounts.google.com/ServiceLogin?hl=en-GB&passive=true&continue=http://support.google.com/ch
Source: History-journal.0.dr, Favicons-journal.0.dr	String found in binary or memory: https://accounts.google.com/ServiceLogin?service=mail&passive=true&rm=false&continue=https://mail.go
Source: 53a90dd59b2449a8_0.0.dr	String found in binary or memory: https://accounts.google.com/V
Source: Current Session.0.dr	String found in binary or memory: https://accounts.google.com/_/bscframe
Source: df775ea48d3e6f57_0.0.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: df775ea48d3e6f57_0.0.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/iframe
Source: 8e58b43f8513815d_0.0.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: Current Session.0.dr, History-journal.0.dr, Favicons-journal.0.dr	String found in binary or memory: https://accounts.google.com/signin/v2/identifier?hl=en-GB&passive=true&continue=http%3A%2F%2Fsupport
Source: History-journal.0.dr, Favicons-journal.0.dr	String found in binary or memory: https://accounts.google.com/signin/v2/identifier?service=mail&passive=true&rm=false&continue=https%3
Source: Current Session.0.dr	String found in binary or memory: https://accounts.google.comh
Source: Current Session.0.dr	String found in binary or memory: https://accounts.youtube.com/accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=-1446
Source: Current Session.0.dr	String found in binary or memory: https://accounts.youtube.com/accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=-1969
Source: Current Session.0.dr	String found in binary or memory: https://adservice.google.co.uk/ddm/fls/i/dc_pre=CIj886__zfICFdaTGwodwDAOFg;src=2542116;type=chrom322
Source: Current Session.0.dr	String found in binary or memory: https://adservice.google.com
Source: Current Session.0.dr	String found in binary or memory: https://adservice.google.com/ddm/fls/i/dc_pre=CIj886__zfICFdaTGwodwDAOFg;src=2542116;type=chrom322;c
Source: 5cd6a02fcd5e00de_0.0.dr	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/angularjs/1.6.6/angular-animate.min.js
Source: ec917b5dce596813_0.0.dr	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/angularjs/1.6.6/angular-sanitize.min.js
Source: caab0a9ff213e86d_0.0.dr	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/angularjs/1.6.6/angular-touch.min.js
Source: edf93f9e20175326_0.0.dr	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/angularjs/1.6.6/angular.min.js
Source: 39f8c41a-d41f-4341-b575-72564adf3230.tmp.3.dr, manifest.json0.0.dr, 8e58b43f8513815d_0.0.dr	String found in binary or memory: https://apis.google.com
Source: 3bae4111b6f3d84b_0.0.dr	String found in binary or memory: https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.7RphtNcGHDQ.O/m=client/exm=gapi_iframes
Source: 8e58b43f8513815d_0.0.dr	String found in binary or memory: https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.7RphtNcGHDQ.O/m=gapi_iframes
Source: 5b75b2982b074f80_0.0.dr	String found in binary or memory: https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.7RphtNcGHDQ.O/m=googleapis_proxy/rt=j/s
Source: 6718ea04bafb0e3e_0.0.dr	String found in binary or memory: https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_GB.tmPnhifxyTQ.O/m=client/rt=j/sv=1/d=1/
Source: a7389ced353d126f_0.0.dr	String found in binary or memory: https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_GB.tmPnhifxyTQ.O/m=googleapis_proxy/rt=j
Source: 7d5864097a21e950_0.0.dr	String found in binary or memory: https://apis.google.com/js/api.js
Source: 092afaa13060536d_0.0.dr	String found in binary or memory: https://apis.google.com/js/client.js
Source: 3653004befb613c5_0.0.dr	String found in binary or memory: https://apis.google.com/js/googleapis.proxy.js?onload=startup
Source: 39f8c41a-d41f-4341-b575-72564adf3230.tmp.3.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.0.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 39f8c41a-d41f-4341-b575-72564adf3230.tmp.3.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: df775ea48d3e6f57_0.0.dr	String found in binary or memory: https://clients6.google.com
Source: df775ea48d3e6f57_0.0.dr, manifest.json0.0.dr	String found in binary or memory: https://content.googleapis.com
Source: Reporting and NEL.3.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/IdentityListAccountsHttp/external
Source: 39f8c41a-d41f-4341-b575-72564adf3230.tmp.3.dr, 8428273f-e850-497f-9758-cd374e8d4adc.tmp.3.dr, af0d0217-ae96-4b28-8815-457d679fd0fb.tmp.3.dr	String found in binary or memory: https://dns.google
Source: 8e58b43f8513815d_0.0.dr	String found in binary or memory: https://domains.google.com/suggest/flow
Source: manifest.json0.0.dr	String found in binary or memory: https://feedback.googleusercontent.com
Source: 39f8c41a-d41f-4341-b575-72564adf3230.tmp.3.dr	String found in binary or memory: https://fonts.googleapis.com
Source: manifest.json0.0.dr	String found in binary or memory: https://fonts.googleapis.com;
Source: 39f8c41a-d41f-4341-b575-72564adf3230.tmp.3.dr	String found in binary or memory: https://fonts.gstatic.com
Source: Network Action Predictor-journal.0.dr	String found in binary or memory: https://fonts.gstatic.com/
Source: manifest.json0.0.dr	String found in binary or memory: https://fonts.gstatic.com;
Source: dbdcbf2257d3331b_0.0.dr, 85b7abb2920b83dd_0.0.dr, eda794984c784804_0.0.dr	String found in binary or memory: https://google.com/
Source: 7d68fe18908d14d1_0.0.dr	String found in binary or memory: https://google.com//f
Source: 2fc3d3a085992c47_0.0.dr	String found in binary or memory: https://google.com/A
Source: 3653004befb613c5_0.0.dr	String found in binary or memory: https://google.com/MO
Source: 157ac5dc69855318_0.0.dr	String found in binary or memory: https://google.com/N
Source: 3dbe54b7c92541c6_0.0.dr	String found in binary or memory: https://google.com/T
Source: 25f13bc86c899fc9_0.0.dr	String found in binary or memory: https://google.com/T:
Source: be96a6ccc9ef92b1_0.0.dr	String found in binary or memory: https://google.com/U
Source: 3653004befb613c5_0.0.dr	String found in binary or memory: https://google.com/Zp
Source: a7389ced353d126f_0.0.dr	String found in binary or memory: https://google.com/_
Source: 157ac5dc69855318_0.0.dr	String found in binary or memory: https://google.com/h
Source: cc687809cee3523e_0.0.dr	String found in binary or memory: https://google.com/jT
Source: 157ac5dc69855318_0.0.dr	String found in binary or memory: https://google.com/m
Source: 3dbe54b7c92541c6_0.0.dr, 0cd82a09b7413176_0.0.dr	String found in binary or memory: https://google.com/w
Source: 9b166c217628efab_0.0.dr	String found in binary or memory: https://google.com/w1
Source: 7d6ab3bbe008e7cb_0.0.dr	String found in binary or memory: https://google.com/z
Source: manifest.json0.0.dr	String found in binary or memory: https://hangouts.google.com/
Source: History-journal.0.dr, Favicons-journal.0.dr	String found in binary or memory: https://mail.google.com/mail/
Source: History Provider Cache.0.dr	String found in binary or memory: https://mail.google.com/mail/2
Source: History-journal.0.dr	String found in binary or memory: https://mail.google.com/mail/Gmail
Source: History-journal.0.dr	String found in binary or memory: https://mail.google.com/mail/Gmail/)
Source: 39f8c41a-d41f-4341-b575-72564adf3230.tmp.3.dr, Current Session.0.dr	String found in binary or memory: https://ogs.google.com
Source: Current Session.0.dr	String found in binary or memory: https://ogs.google.com/widget/callout?prid=19022645&pgid=1151720448&puid=43a541cbad6c87d4&cce=1&dc=1
Source: Current Session.0.dr	String found in binary or memory: https://ogs.google.com/widget/callout?prid=19022645&pgid=1151720448&puid=61a0eb6c838359b5&cce=1&dc=1
Source: Current Session.0.dr	String found in binary or memory: https://ogs.google.comh
Source: manifest.json.0.dr	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: 39f8c41a-d41f-4341-b575-72564adf3230.tmp.3.dr	String found in binary or memory: https://play.google.com
Source: 8e58b43f8513815d_0.0.dr	String found in binary or memory: https://plus.google.com
Source: 8e58b43f8513815d_0.0.dr	String found in binary or memory: https://plus.googleapis.com
Source: Current Session.0.dr	String found in binary or memory: https://policies.google.com
Source: Current Session.0.dr	String found in binary or memory: https://policies.google.com#
Source: Network Action Predictor-journal.0.dr	String found in binary or memory: https://policies.google.com/
Source: Current Session.0.dr, History-journal.0.dr	String found in binary or memory: https://policies.google.com/technologies/cookies
Source: Current Session.0.dr	String found in binary or memory: https://policies.google.com/technologies/cookies2
Source: Current Session.0.dr	String found in binary or memory: https://policies.google.com/technologies/cookies2How
Source: History-journal.0.dr	String found in binary or memory: https://policies.google.com/technologies/cookiesHow
Source: manifest.json.0.dr	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: Current Session.0.dr	String found in binary or memory: https://scone-pa.clients6.google.com/static/proxy.html?usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_
Source: Current Session.0.dr	String found in binary or memory: https://scone-pa.clients6.google.com/static/proxy.html?usegapi=1&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F
Source: 39f8c41a-d41f-4341-b575-72564adf3230.tmp.3.dr	String found in binary or memory: https://ssl.gstatic.com
Source: ef977d45ec95f84e_0.0.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/static/_/js/k=gaia.gaiafe_glif.en_GB.wxcShFhZxXM.O/am=B0jRwgiSeAEBA
Source: Favicons-journal.0.dr	String found in binary or memory: https://ssl.gstatic.com/policies/favicon.ico
Source: 000003.log4.0.dr	String found in binary or memory: https://support.google.com
Source: 000003.log4.0.dr	String found in binary or memory: https://support.google.com-_https://support.google.com
Source: 000003.log0.0.dr	String found in binary or memory: https://support.google.com/
Source: Current Session.0.dr	String found in binary or memory: https://support.google.com/accounts?hl=en-GB
Source: Current Session.0.dr	String found in binary or memory: https://support.google.com/accounts?hl=en-GB#topic=3382296
Source: History-journal.0.dr	String found in binary or memory: https://support.google.com/accounts?hl=en-GB#topic=3382296Google
Source: History-journal.0.dr	String found in binary or memory: https://support.google.com/accounts?hl=en-GBGoogle
Source: Current Session.0.dr	String found in binary or memory: https://support.google.com/accounts?hl=en-GBQ
Source: Current Session.0.dr	String found in binary or memory: https://support.google.com/chrome
Source: Current Session.0.dr	String found in binary or memory: https://support.google.com/chrome#topic=9796470
Source: History-journal.0.dr	String found in binary or memory: https://support.google.com/chrome#topic=9796470Google
Source: Current Session.0.dr	String found in binary or memory: https://support.google.com/chrome/?hl=en-GB
Source: Current Session.0.dr	String found in binary or memory: https://support.google.com/chrome/?hl=en-GB#topic=9796470
Source: History-journal.0.dr	String found in binary or memory: https://support.google.com/chrome/?hl=en-GB#topic=9796470Google
Source: History-journal.0.dr	String found in binary or memory: https://support.google.com/chrome/?hl=en-GBGoogle
Source: Current Session.0.dr	String found in binary or memory: https://support.google.com/chrome/answer/6130773?hl=en-GB
Source: Current Session.0.dr	String found in binary or memory: https://support.google.com/chrome/answer/6130773?hl=en-GB8Browse
Source: History-journal.0.dr	String found in binary or memory: https://support.google.com/chrome/answer/6130773?hl=en-GBBrowse
Source: Current Session.0.dr	String found in binary or memory: https://support.google.com/chrome/answer/95464
Source: Current Session.0.dr	String found in binary or memory: https://support.google.com/chrome/answer/954641Browse
Source: History.0.dr	String found in binary or memory: https://support.google.com/chrome/answer/95464Browse
Source: Current Session.0.dr	String found in binary or memory: https://support.google.com/chrome/community?hl=en-GB
Source: History-journal.0.dr	String found in binary or memory: https://support.google.com/chrome/community?hl=en-GBGoogle
Source: History-journal.0.dr	String found in binary or memory: https://support.google.com/chromeGoogle
Source: messages.json41.0.dr	String found in binary or memory: https://support.google.com/chromecast/answer/2998456
Source: messages.json41.0.dr	String found in binary or memory: https://support.google.com/chromecast/troubleshooter/2995236
Source: Current Session.0.dr	String found in binary or memory: https://support.google.com/chromeu
Source: Favicons-journal.0.dr	String found in binary or memory: https://support.google.com/favicon.ico
Source: Favicons-journal.0.dr	String found in binary or memory: https://support.google.com/favicon.ico&
Source: 000003.log0.0.dr	String found in binary or memory: https://tools.google.com/service/update2/dlpageping?appguid=
Source: 7d5864097a21e950_0.0.dr, 49262f63b44e3629_0.0.dr	String found in binary or memory: https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=
Source: 8e58b43f8513815d_0.0.dr	String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: 1154c6710157da27_0.0.dr	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: a186a289234292fe_0.0.dr	String found in binary or memory: https://www.google-analytics.com/analytics.jsaD
Source: a186a289234292fe_0.0.dr	String found in binary or memory: https://www.google-analytics.com/gtm/js?id=
Source: 3ef1db799a99929f_0.0.dr	String found in binary or memory: https://www.google-analytics.com/gtm/js?id=GTM-N7S69J3&cid=125137350.1629989500
Source: Current Session.0.dr	String found in binary or memory: https://www.google.co.uk/intl/en-GB/about/products?tab=uh
Source: History-journal.0.dr	String found in binary or memory: https://www.google.co.uk/intl/en-GB/about/products?tab=uhBrowse
Source: 000003.log4.0.dr	String found in binary or memory: https://www.google.com
Source: manifest.json.0.dr, 000003.log0.0.dr	String found in binary or memory: https://www.google.com/
Source: Current Session.0.dr	String found in binary or memory: https://www.google.com/chrome
Source: Current Session.0.dr	String found in binary or memory: https://www.google.com/chrome/
Source: Current Session.0.dr	String found in binary or memory: https://www.google.com/chrome/=Google
Source: History.0.dr	String found in binary or memory: https://www.google.com/chrome/Google
Source: Favicons.0.dr	String found in binary or memory: https://www.google.com/chrome/static/images/favicons/favicon-32x32.png
Source: Favicons.0.dr	String found in binary or memory: https://www.google.com/chrome/static/images/favicons/favicon-32x32.png$
Source: 12318cd0c335b8e0_0.0.dr	String found in binary or memory: https://www.google.com/chrome/static/js/installer.min.js
Source: 9b166c217628efab_0.0.dr	String found in binary or memory: https://www.google.com/chrome/static/js/main.v2.min.js
Source: History.0.dr	String found in binary or memory: https://www.google.com/chromeGoogle
Source: Favicons-journal.0.dr	String found in binary or memory: https://www.google.com/favicon.ico
Source: Favicons-journal.0.dr	String found in binary or memory: https://www.google.com/favicon.icoC
Source: Favicons-journal.0.dr	String found in binary or memory: https://www.google.com/favicon.icoh6
Source: History-journal.0.dr, Favicons-journal.0.dr	String found in binary or memory: https://www.google.com/gmail/
Source: History Provider Cache.0.dr	String found in binary or memory: https://www.google.com/gmail/2
Source: History-journal.0.dr	String found in binary or memory: https://www.google.com/gmail/Gmail
Source: History-journal.0.dr	String found in binary or memory: https://www.google.com/gmail/Gmail/)
Source: c5ebfc220da3bb5b_0.0.dr	String found in binary or memory: https://www.google.com/js/th/vn5A_TjKRXDA00Zeyc5KbWJpUGORQjAB309y4DKYpfM.js
Source: 8f3ce531f12f3367_0.0.dr, 2c9e2bb71fa794ce_0.0.dr	String found in binary or memory: https://www.google.com/log?format=json&hasfast=true
Source: manifest.json0.0.dr	String found in binary or memory: https://www.google.com;
Source: 39f8c41a-d41f-4341-b575-72564adf3230.tmp.3.dr	String found in binary or memory: https://www.googleapis.com
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/calendar.readonly
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/cast-edu-messaging
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/clouddevices
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/hangouts
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/hangouts.readonly
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/meetings
Source: 8e58b43f8513815d_0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: 8e58b43f8513815d_0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.peopleapi.readwrite
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/userinfo.email
Source: a186a289234292fe_0.0.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=
Source: 15a5acad06e31190_0.0.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=UA-26908291-4
Source: 25f13bc86c899fc9_0.0.dr	String found in binary or memory: https://www.googletagmanager.com/gtm.js?id=GTM-PZ6TRJB
Source: 588e6311b9075013_0.0.dr	String found in binary or memory: https://www.googletagmanager.com/gtm.js?id=GTM-WQZB4J
Source: 39f8c41a-d41f-4341-b575-72564adf3230.tmp.3.dr	String found in binary or memory: https://www.gstatic.com
Source: Network Action Predictor-journal.0.dr	String found in binary or memory: https://www.gstatic.com/
Source: 0faaa62c8524df0d_0.0.dr	String found in binary or memory: https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.IdentityPoliciesUi.en_GB.WJPKByKq9sg.
Source: 49262f63b44e3629_0.0.dr	String found in binary or memory: https://www.gstatic.com/_/mss/boq-one-google/_/js/k=boq-one-google.OneGoogleWidgetUi.en.iRny_Wkefus.
Source: 7d5864097a21e950_0.0.dr	String found in binary or memory: https://www.gstatic.com/_/mss/boq-one-google/_/js/k=boq-one-google.OneGoogleWidgetUi.en_GB.wVRNMqnU4
Source: 1d9307e50ef6b7b0_0.0.dr	String found in binary or memory: https://www.gstatic.com/brandstudio/kato/cookie_choice_component/cookie_consent_bar.v3.js
Source: c20153606dcb180a_0.0.dr	String found in binary or memory: https://www.gstatic.com/charts/loader.js
Source: ef573254f07aabf4_0.0.dr	String found in binary or memory: https://www.gstatic.com/cv/js/sender/v1/cast_sender.js
Source: 39208e3502e0f8fa_0.0.dr	String found in binary or memory: https://www.gstatic.com/external_hosted/autotrack/autotrack.js
Source: d73906a901c7bc7b_0.0.dr	String found in binary or memory: https://www.gstatic.com/external_hosted/gsap/v1_18_0/TweenMax.min.js
Source: 33d8ea273e8e208e_0.0.dr	String found in binary or memory: https://www.gstatic.com/external_hosted/gsap/v1_18_0/plugins/ScrollToPlugin.min.js
Source: 11872aa7eaefe3b0_0.0.dr	String found in binary or memory: https://www.gstatic.com/external_hosted/intersectionobserver_polyfill/intersection-observer.min.js
Source: 922dfb03cc343c93_0.0.dr	String found in binary or memory: https://www.gstatic.com/external_hosted/modernizr/modernizr.js
Source: 0a57bd28b832522f_0.0.dr	String found in binary or memory: https://www.gstatic.com/external_hosted/ng_ui_router/release/angular-ui-router.min.js
Source: b8c3df9b5168fca9_0.0.dr	String found in binary or memory: https://www.gstatic.com/external_hosted/picturefill/picturefill.min.js
Source: 708b0d476bdfeb05_0.0.dr	String found in binary or memory: https://www.gstatic.com/external_hosted/pixi/pixi.min.js
Source: a7fba63d58298f37_0.0.dr	String found in binary or memory: https://www.gstatic.com/external_hosted/scrollmagic/ScrollMagic.min.js
Source: 3eb7118a6f9ed95d_0.0.dr, 0cd82a09b7413176_0.0.dr	String found in binary or memory: https://www.gstatic.com/external_hosted/scrollmagic/animation.gsap.min.js
Source: 157ac5dc69855318_0.0.dr	String found in binary or memory: https://www.gstatic.com/feedback/js/help/prod/service/lazy.min.js
Source: 2f3ce0ee52f9749b_0.0.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: 2f3ce0ee52f9749b_0.0.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: 2f3ce0ee52f9749b_0.0.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: 2f3ce0ee52f9749b_0.0.dr	String found in binary or memory: https://www.gstatic.com/og/_/js/k=og.qtm.en_US.eyZtLN7gU00.O/rt=j/m=q_d
Source: 38d11efdcdf6f350_0.0.dr	String found in binary or memory: https://www.gstatic.com/og/_/js/k=og.qtm.en_US.eyZtLN7gU00.O/rt=j/m=q_dnp
Source: manifest.json0.0.dr	String found in binary or memory: https://www.gstatic.com;
Source: 000003.log4.0.dr	String found in binary or memory: https://www.youtube-nocookie.com
Source: 000003.log0.0.dr	String found in binary or memory: https://www.youtube-nocookie.com/
Source: Current Session.0.dr	String found in binary or memory: https://www.youtube-nocookie.com/embed/TBR-xtJVq7E?rel=0&showinfo=0&theme=light&version=3&hl=en-GB&c
Source: 799b92ba7b10a353_0.0.dr	String found in binary or memory: https://www.youtube-nocookie.com/s/player/31389f53/fetch-polyfill.vflset/fetch-polyfill.js
Source: 7901112cde0ff08f_0.0.dr	String found in binary or memory: https://www.youtube-nocookie.com/s/player/31389f53/player_ias.vflset/en_GB/base.js
Source: b110e5c2b4ae8737_0.0.dr	String found in binary or memory: https://www.youtube-nocookie.com/s/player/31389f53/player_ias.vflset/en_GB/embed.js
Source: a5beba0ee4c90e07_0.0.dr	String found in binary or memory: https://www.youtube-nocookie.com/s/player/31389f53/player_ias.vflset/en_GB/remote.js
Source: b37008cdefa8ac53_0.0.dr	String found in binary or memory: https://www.youtube-nocookie.com/s/player/31389f53/www-embed-player.vflset/www-embed-player.js
Source: b2cbac092fd30741_0.0.dr	String found in binary or memory: https://www.youtube.com/s/player/31389f53/www-widgetapi.vflset/www-widgetapi.js
Source: b110e5c2b4ae8737_0.0.dr	String found in binary or memory: https://youtube-nocookie.com/
Source: 799b92ba7b10a353_0.0.dr	String found in binary or memory: https://youtube-nocookie.com/u

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 172.217.168.68:443 -> 192.168.2.3:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.239.32.29:443 -> 192.168.2.3:49827 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.239.32.29:443 -> 192.168.2.3:49828 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.203.97:443 -> 192.168.2.3:49830 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.203.97:443 -> 192.168.2.3:49829 version: TLS 1.2

System Summary:

Creates temporary files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Temp\72c347cd-9cb1-4b9a-a6a3-90daee99e022.tmp

Jump to behavior

Classification label

Source: classification engine

Classification label: clean2.win@50/303@39/25

Spawns processes

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --start-maximized --enable-automation 'http://covidteamclapham@gmail.com'
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1600,818200865018122053,4149282262256251718,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1764 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1600,818200865018122053,4149282262256251718,131072 --lang=en-US --service-sandbox-type=audio --enable-audio-service-sandbox --mojo-platform-channel-handle=5704 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1600,818200865018122053,4149282262256251718,131072 --lang=en-US --service-sandbox-type=video_capture --enable-audio-service-sandbox --mojo-platform-channel-handle=5720 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1600,818200865018122053,4149282262256251718,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1764 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1600,818200865018122053,4149282262256251718,131072 --lang=en-US --service-sandbox-type=audio --enable-audio-service-sandbox --mojo-platform-channel-handle=5704 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1600,818200865018122053,4149282262256251718,131072 --lang=en-US --service-sandbox-type=video_capture --enable-audio-service-sandbox --mojo-platform-channel-handle=5720 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior

Creates files inside the program directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\Chrome\Application\Dictionaries

Jump to behavior

Creates files inside the user directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-6127AA37-DC8.pma

Jump to behavior

Found GUI installer (many successful clicks)

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Ok
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Run
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Creates a directory in C:\Program Files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic			Jump to behavior