Windows Analysis Report https://docs.google.com/document/d/1hHFEB09XYOGm1F87Todc5etNXb38nGMo/edit?usp=sharing_eip_m&rtpof=true&sd=true&invite=CKvaqcMD&ts=6178419e

AV Detection:

Antivirus detection for URL or domain

Source: https://marketingandsoftwaretools.com/wp-content/plugins/autoptimize/ANGEL/MicrosoftAccount.html

SlashNext: Label: Fake Login Page type: Phishing & Social Engineering

Phishing:

Phishing site detected (based on favicon image match)

Source: https://marketingandsoftwaretools.com/wp-content/plugins/autoptimize/ANGEL/MicrosoftAccount.html

Matcher: Template: microsoft matched with high similarity

Yara detected HtmlPhish10

Source: Yara match

File source: 36599.2.pages.csv, type: HTML

Phishing site detected (based on logo template match)

Source: https://marketingandsoftwaretools.com/wp-content/plugins/autoptimize/ANGEL/MicrosoftAccount.html

Matcher: Template: office matched

No HTML title found

Source: https://marketingandsoftwaretools.com/wp-content/plugins/autoptimize/ANGEL/MicrosoftAccount.html	HTTP Parser: HTML title missing
Source: https://marketingandsoftwaretools.com/wp-content/plugins/autoptimize/ANGEL/MicrosoftAccount.html	HTTP Parser: HTML title missing

HTML body contains low number of good links

Source: https://marketingandsoftwaretools.com/wp-content/plugins/autoptimize/ANGEL/MicrosoftAccount.html	HTTP Parser: Number of links: 0
Source: https://marketingandsoftwaretools.com/wp-content/plugins/autoptimize/ANGEL/MicrosoftAccount.html	HTTP Parser: Number of links: 0

Invalid T&C link found

Source: https://marketingandsoftwaretools.com/wp-content/plugins/autoptimize/ANGEL/MicrosoftAccount.html	HTTP Parser: Invalid link: Help
Source: https://marketingandsoftwaretools.com/wp-content/plugins/autoptimize/ANGEL/MicrosoftAccount.html	HTTP Parser: Invalid link: Terms of use
Source: https://marketingandsoftwaretools.com/wp-content/plugins/autoptimize/ANGEL/MicrosoftAccount.html	HTTP Parser: Invalid link: Privacy & Cookies
Source: https://marketingandsoftwaretools.com/wp-content/plugins/autoptimize/ANGEL/MicrosoftAccount.html	HTTP Parser: Invalid link: Help
Source: https://marketingandsoftwaretools.com/wp-content/plugins/autoptimize/ANGEL/MicrosoftAccount.html	HTTP Parser: Invalid link: Terms of use
Source: https://marketingandsoftwaretools.com/wp-content/plugins/autoptimize/ANGEL/MicrosoftAccount.html	HTTP Parser: Invalid link: Privacy & Cookies

Suspicious form URL found

Source: https://marketingandsoftwaretools.com/wp-content/plugins/autoptimize/ANGEL/MicrosoftAccount.html	HTTP Parser: Form action: 365.php
Source: https://marketingandsoftwaretools.com/wp-content/plugins/autoptimize/ANGEL/MicrosoftAccount.html	HTTP Parser: Form action: next.php
Source: https://marketingandsoftwaretools.com/wp-content/plugins/autoptimize/ANGEL/MicrosoftAccount.html	HTTP Parser: Form action: 365.php
Source: https://marketingandsoftwaretools.com/wp-content/plugins/autoptimize/ANGEL/MicrosoftAccount.html	HTTP Parser: Form action: next.php

META author tag missing

Source: https://marketingandsoftwaretools.com/wp-content/plugins/autoptimize/ANGEL/MicrosoftAccount.html	HTTP Parser: No <meta name="author".. found
Source: https://marketingandsoftwaretools.com/wp-content/plugins/autoptimize/ANGEL/MicrosoftAccount.html	HTTP Parser: No <meta name="author".. found

META copyright tag missing

Source: https://marketingandsoftwaretools.com/wp-content/plugins/autoptimize/ANGEL/MicrosoftAccount.html	HTTP Parser: No <meta name="copyright".. found
Source: https://marketingandsoftwaretools.com/wp-content/plugins/autoptimize/ANGEL/MicrosoftAccount.html	HTTP Parser: No <meta name="copyright".. found

Compliance:

Creates license or readme file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Temp\6564_244370255\LICENSE.txt

Jump to behavior

Creates a directory in C:\Program Files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic			Jump to behavior

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 142.250.203.97:443 -> 192.168.2.3:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.203.97:443 -> 192.168.2.3:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.203.97:443 -> 192.168.2.3:49806 version: TLS 1.2

Networking:

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767

Found strings which match to known social media urls

Source: Ruleset Data.1.dr	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: Filtering Rules.1.dr	String found in binary or memory: www.facebook.com/ajax/ads/ equals www.facebook.com (Facebook)
Source: Filtering Rules.1.dr	String found in binary or memory: www.facebook.com0 equals www.facebook.com (Facebook)

URLs found in memory or binary data

Source: angular.js.1.dr	String found in binary or memory: http://angularjs.org
Source: data_3.2.dr	String found in binary or memory: http://crl.pki.goog/gsr1/gsr1.crl0;
Source: data_3.2.dr	String found in binary or memory: http://crl.pki.goog/gtsr1/gtsr1.crl0W
Source: data_3.2.dr	String found in binary or memory: http://crls.pki.goog/gts1c3/QOvJ0N1sT2A.crl0
Source: data_3.2.dr	String found in binary or memory: http://crls.pki.goog/gts1c3/QqFxbi9M48c.crl0
Source: data_3.2.dr	String found in binary or memory: http://crls.pki.goog/gts1c3/fVJxbV-Ktmk.crl0
Source: data_3.2.dr	String found in binary or memory: http://crls.pki.goog/gts1c3/zdATt0Ex_Fk.crl0
Source: angular.js.1.dr	String found in binary or memory: http://errors.angularjs.org/1.6.4-local
Source: pnacl_public_x86_64_pnacl_sz_nexe.1.dr	String found in binary or memory: http://llvm.org/):
Source: data_3.2.dr	String found in binary or memory: http://ocsp.pki.goog/gsr10)
Source: data_3.2.dr	String found in binary or memory: http://ocsp.pki.goog/gts1c301
Source: data_3.2.dr	String found in binary or memory: http://ocsp.pki.goog/gtsr100
Source: data_3.2.dr	String found in binary or memory: http://pki.goog/gsr1/gsr1.crt02
Source: data_3.2.dr	String found in binary or memory: http://pki.goog/repo/certs/gts1c3.der0
Source: data_3.2.dr	String found in binary or memory: http://pki.goog/repo/certs/gts1c3.der0M
Source: data_3.2.dr	String found in binary or memory: http://pki.goog/repo/certs/gtsr1.der04
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: http://tools.ietf.org/html/rfc1950
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01
Source: 2b5d6b28-abc9-4340-9ff7-41e8f309b77f.tmp.2.dr, 2707e0e2-4311-4956-91b9-88ef1478870e.tmp.2.dr	String found in binary or memory: https://0.docs.google.com
Source: manifest.json.1.dr, 2c6a0c24-8c93-4014-9329-732aa4582676.tmp.2.dr, 2b5d6b28-abc9-4340-9ff7-41e8f309b77f.tmp.2.dr, 2707e0e2-4311-4956-91b9-88ef1478870e.tmp.2.dr	String found in binary or memory: https://accounts.google.com
Source: craw_window.js.1.dr	String found in binary or memory: https://accounts.google.com/MergeSession
Source: manifest.json.1.dr, 2c6a0c24-8c93-4014-9329-732aa4582676.tmp.2.dr, 2b5d6b28-abc9-4340-9ff7-41e8f309b77f.tmp.2.dr, 2707e0e2-4311-4956-91b9-88ef1478870e.tmp.2.dr	String found in binary or memory: https://apis.google.com
Source: data_1.2.dr	String found in binary or memory: https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.wk7zEZseXNs.O/m=card/exm=config/rt=j/
Source: data_1.2.dr	String found in binary or memory: https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.wk7zEZseXNs.O/m=config/rt=j/sv=1/d=1/
Source: data_1.2.dr	String found in binary or memory: https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.wk7zEZseXNs.O/m=gapi_iframes/rt=j/sv=
Source: data_1.2.dr	String found in binary or memory: https://apis.google.com/js/api.js
Source: data_1.2.dr	String found in binary or memory: https://apis.google.com/js/api.jsCgkKBw2RYZVOGgA=j
Source: mirroring_common.js.1.dr	String found in binary or memory: https://apis.google.com/js/client.js
Source: data_1.2.dr	String found in binary or memory: https://bit.ly/3me0XGn
Source: History.1.dr	String found in binary or memory: https://bit.ly/3me0XGnSign
Source: mirroring_common.js.1.dr	String found in binary or memory: https://castedumessaging-pa.googleapis.com/v1
Source: pnacl_public_x86_64_libcrt_platform_a.1.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-clang.git
Source: pnacl_public_x86_64_libcrt_platform_a.1.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-llvm.git
Source: 2c6a0c24-8c93-4014-9329-732aa4582676.tmp.2.dr, 2b5d6b28-abc9-4340-9ff7-41e8f309b77f.tmp.2.dr, 2707e0e2-4311-4956-91b9-88ef1478870e.tmp.2.dr	String found in binary or memory: https://clients2.google.com
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: https://clients2.google.com/cr/report
Source: manifest.json0.1.dr, manifest.json.1.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 2c6a0c24-8c93-4014-9329-732aa4582676.tmp.2.dr, 2b5d6b28-abc9-4340-9ff7-41e8f309b77f.tmp.2.dr, 2707e0e2-4311-4956-91b9-88ef1478870e.tmp.2.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: https://clients6.google.com
Source: pnacl_public_x86_64_ld_nexe.1.dr	String found in binary or memory: https://code.google.com/p/nativeclient/issues/entry
Source: pnacl_public_x86_64_ld_nexe.1.dr	String found in binary or memory: https://code.google.com/p/nativeclient/issues/entry%s:
Source: Current Session.1.dr, 2b5d6b28-abc9-4340-9ff7-41e8f309b77f.tmp.2.dr, 2707e0e2-4311-4956-91b9-88ef1478870e.tmp.2.dr	String found in binary or memory: https://contacts.google.com
Source: data_1.2.dr	String found in binary or memory: https://contacts.google.com/_/scs/social-static/_/js/k=boq.SocialPeopleHovercardUi.en_US.tOwJwNEluXc
Source: Current Session.1.dr	String found in binary or memory: https://contacts.google.com/widget/hovercard/v/2?authuser&origin=https%3A%2F%2Fdocs.google.com&usega
Source: 2b5d6b28-abc9-4340-9ff7-41e8f309b77f.tmp.2.dr, 2707e0e2-4311-4956-91b9-88ef1478870e.tmp.2.dr	String found in binary or memory: https://content-autofill.googleapis.com
Source: data_1.2.dr	String found in binary or memory: https://content-autofill.googleapis.com/v1/pages/Chc2LjEuMTcxNS4xNDQyL2VuIChHR0xMKRIUCWOw5nM0Lic7Egk
Source: data_1.2.dr	String found in binary or memory: https://content-autofill.googleapis.com/v1/pages/Chc2LjEuMTcxNS4xNDQyL2VuIChHR0xMKRIfCWpMGCmxf_rYEgk
Source: manifest.json.1.dr	String found in binary or memory: https://content.googleapis.com
Source: common.js.1.dr, mirroring_cast_streaming.js.1.dr	String found in binary or memory: https://crash.corp.google.com/samples?reportid=&q=
Source: LICENSE.txt.1.dr	String found in binary or memory: https://creativecommons.org/.
Source: LICENSE.txt.1.dr	String found in binary or memory: https://creativecommons.org/compatiblelicenses
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: https://creativecommons.org/publicdomain/zero/1.0/.
Source: data_3.2.dr, data_2.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/apps-themes
Source: data_2.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/apps-themesCross-Origin-Resource-Policy:
Source: data_3.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/apps-themescross-origin-resource-policy:cross-origincross-origin-open
Source: data_3.2.dr, data_2.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/docs
Source: data_2.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/docsCross-Origin-Resource-Policy:
Source: data_3.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/docscross-origin-resource-policy:cross-origincross-origin-opener-poli
Source: data_2.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/product-feedback-gathering
Source: data_2.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/product-feedback-gatheringCross-Origin-Resource-Policy:
Source: Reporting and NEL.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/IdentityListAccountsHttp/external
Source: data_2.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/apps-themes
Source: Reporting and NEL.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/apps-themesO
Source: data_2.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/docs
Source: Reporting and NEL.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/docs_
Source: data_3.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/encsid_AZM8iraUaxGffpGvzdngqc4Fvn5RSrjjchThcp06-oHT7wAy4gvP
Source: data_3.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/encsid_AZM8iraZH88pL4jQdjcWpuaSZEaZk6SzMEy_nItKJ7e9QFtt
Source: data_2.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/product-feedback-gathering
Source: Reporting and NEL.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/product-feedback-gatheringO
Source: Reporting and NEL.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access
Source: data_3.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/social-frontend-mpm-access
Source: data_3.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/social-frontend-mpm-accesscross-origin-resource-policy:cross-origincr
Source: 2c6a0c24-8c93-4014-9329-732aa4582676.tmp.2.dr, 2b5d6b28-abc9-4340-9ff7-41e8f309b77f.tmp.2.dr, 2e3c3ba8-5ab9-48ca-a3ea-849bb783bcfa.tmp.2.dr, 2707e0e2-4311-4956-91b9-88ef1478870e.tmp.2.dr, 1a9e076c-5189-4c0f-ad8f-53604d4503d9.tmp.2.dr	String found in binary or memory: https://dns.google
Source: 000003.log.1.dr	String found in binary or memory: https://docs.google.com
Source: QuotaManager.1.dr	String found in binary or memory: https://docs.google.com/
Source: Favicons.1.dr, History.1.dr, Current Session.1.dr	String found in binary or memory: https://docs.google.com/document/d/1hHFEB09XYOGm1F87Todc5etNXb38nGMo/edit?invite=CKvaqcMD
Source: Current Session.1.dr	String found in binary or memory: https://docs.google.com/document/d/1hHFEB09XYOGm1F87Todc5etNXb38nGMo/edit?invite=CKvaqcMD)Adjunct
Source: History Provider Cache.1.dr	String found in binary or memory: https://docs.google.com/document/d/1hHFEB09XYOGm1F87Todc5etNXb38nGMo/edit?invite=CKvaqcMD2)Adjunct
Source: History.1.dr	String found in binary or memory: https://docs.google.com/document/d/1hHFEB09XYOGm1F87Todc5etNXb38nGMo/edit?invite=CKvaqcMDAdjunct
Source: History.1.dr, History Provider Cache.1.dr	String found in binary or memory: https://docs.google.com/document/d/1hHFEB09XYOGm1F87Todc5etNXb38nGMo/edit?rtpof=true&sd=true&invite=
Source: History.1.dr, History Provider Cache.1.dr	String found in binary or memory: https://docs.google.com/document/d/1hHFEB09XYOGm1F87Todc5etNXb38nGMo/edit?usp=sharing_eip_m&rtpof=tr
Source: data_1.2.dr	String found in binary or memory: https://docs.google.com/static/document/client/css/390957633-KixCss_ltr.css
Source: data_1.2.dr	String found in binary or memory: https://docs.google.com/static/document/client/css/390957633-KixCss_ltr.csse
Source: data_1.2.dr	String found in binary or memory: https://docs.google.com/static/document/client/js/1222260494-client_js_prod_kix_tertiary__en_gb.js
Source: data_1.2.dr	String found in binary or memory: https://docs.google.com/static/document/client/js/1693417843-client_js_prod_datetimeresources__en_gb
Source: data_1.2.dr	String found in binary or memory: https://docs.google.com/static/document/client/js/1807487000-client_js_prod_peoplehovercard__en_gb.j
Source: data_1.2.dr	String found in binary or memory: https://docs.google.com/static/document/client/js/230979601-client_js_prod_kix_app__en_gb.js
Source: data_1.2.dr	String found in binary or memory: https://docs.google.com/static/document/client/js/2408424249-client_js_prod_kix_explore__en_gb.js
Source: data_1.2.dr	String found in binary or memory: https://docs.google.com/static/document/client/js/2467020024-client_js_prod_kix_approvals__en_gb.js
Source: data_1.2.dr	String found in binary or memory: https://docs.google.com/static/document/client/js/2467020024-client_js_prod_kix_approvals__en_gb.jsA
Source: data_1.2.dr	String found in binary or memory: https://docs.google.com/static/document/client/js/3097510115-client_js_prod_meet__en_gb.js
Source: data_1.2.dr	String found in binary or memory: https://docs.google.com/static/document/client/js/3714220469-client_js_prod_kix_core__en_gb.js
Source: data_1.2.dr	String found in binary or memory: https://docs.google.com/static/document/client/js/3714220469-client_js_prod_kix_core__en_gb.jsW
Source: data_1.2.dr	String found in binary or memory: https://docs.google.com/static/document/client/js/436474874-client_js_prod_voice__en_gb.js
Source: data_1.2.dr	String found in binary or memory: https://docs.google.com/static/document/client/js/436474874-client_js_prod_voice__en_gb.jsb
Source: Current Session.1.dr	String found in binary or memory: https://docs.google.comh
Source: LICENSE.txt.1.dr	String found in binary or memory: https://easylist.to/)
Source: Network Action Predictor.1.dr	String found in binary or memory: https://edadfed.ed.ac.uk/
Source: data_1.2.dr	String found in binary or memory: https://edadfed.ed.ac.uk/adfs/portal/css/style.css
Source: data_1.2.dr	String found in binary or memory: https://edadfed.ed.ac.uk/adfs/portal/illustration/illustration.jpg
Source: data_1.2.dr	String found in binary or memory: https://edadfed.ed.ac.uk/adfs/portal/illustration/illustration.jpgI-
Source: manifest.json.1.dr	String found in binary or memory: https://feedback.googleusercontent.com
Source: 2c6a0c24-8c93-4014-9329-732aa4582676.tmp.2.dr	String found in binary or memory: https://fonts.googleapis.com
Source: manifest.json.1.dr	String found in binary or memory: https://fonts.googleapis.com;
Source: 2c6a0c24-8c93-4014-9329-732aa4582676.tmp.2.dr, 2b5d6b28-abc9-4340-9ff7-41e8f309b77f.tmp.2.dr, 2707e0e2-4311-4956-91b9-88ef1478870e.tmp.2.dr	String found in binary or memory: https://fonts.gstatic.com
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/l/font?kit=J7afnpV-BGlaFfdAhLcY6w&skey=a1029226f80653a8&v=v11
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/l/font?kit=J7afnpV-BGlaFfdAhLcY6w&skey=a1029226f80653a8&v=v11ef
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/amaticsc/v16/TUZ3zwprpvBS1izr_vOMscG6fA.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/amaticsc/v16/TUZyzwprpvBS1izr_vO0CA.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/amaticsc/v16/TUZyzwprpvBS1izr_vO0CA.woff2&
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/amaticsc/v16/TUZyzwprpvBS1izr_vOEDOSf.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/caveat/v10/WnznHAc5bAfYB2QRah7pcpNvOx-pjRV6SIc.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/caveat/v10/WnznHAc5bAfYB2QRah7pcpNvOx-pjfJ9SIc.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/caveat/v10/WnznHAc5bAfYB2QRah7pcpNvOx-pjfJ9eIOpYQ.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/caveat/v10/WnznHAc5bAfYB2QRah7pcpNvOx-pjfJ9eIOpYQ.woff2WTE
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/comfortaa/v30/1Pt_g8LJRfWJmhDAuUsSQamb1W0lwk4S4WjMDrUfIA.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/comfortaa/v30/1Pt_g8LJRfWJmhDAuUsSQamb1W0lwk4S4WjMPrE.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/comfortaa/v30/1Pt_g8LJRfWJmhDAuUsSQamb1W0lwk4S4Y_LPrE.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/ebgaramond/v15/SlGDmQSNjdsmc35JDF1K5E55YMjF_7DPuGi-6_RUBg.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/ebgaramond/v15/SlGDmQSNjdsmc35JDF1K5E55YMjF_7DPuGi-6_RUBg.woff2n
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/ebgaramond/v15/SlGDmQSNjdsmc35JDF1K5E55YMjF_7DPuGi-6_RkAo9_.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/ebgaramond/v15/SlGDmQSNjdsmc35JDF1K5E55YMjF_7DPuGi-DPNUBg.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/ebgaramond/v15/SlGFmQSNjdsmc35JDF1K5GRwUjcdlttVFm-rI7dbR49_.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/ebgaramond/v15/SlGFmQSNjdsmc35JDF1K5GRwUjcdlttVFm-rI7e8QI9_.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/ebgaramond/v15/SlGFmQSNjdsmc35JDF1K5GRwUjcdlttVFm-rI7e8QI9_.woff2w
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/googlesans/v14/4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/productlogos/docs_2020q4/v7/web-144dp/logo_docs_2020q4_color_1x_web_14
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/lobster/v23/neILzCirqoswsqX9_oA.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/lobster/v23/neILzCirqoswsqX9zoSmMw.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/lora/v17/0QI6MX1D_JOuGQbT0gvTJPa787weuxJHkq0.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/lora/v17/0QI6MX1D_JOuGQbT0gvTJPa787weuyJD.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/lora/v17/0QI6MX1D_JOuGQbT0gvTJPa787z5vCJD.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/lora/v17/0QI8MX1D_JOuMw_hLdO6T2wV9KnW-C0Ckq0.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/lora/v17/0QI8MX1D_JOuMw_hLdO6T2wV9KnW-C0Ckq0.woff2C
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/lora/v17/0QI8MX1D_JOuMw_hLdO6T2wV9KnW-MoFkq0.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/lora/v17/0QI8MX1D_JOuMw_hLdO6T2wV9KnW-MoFkq0.woff2J
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/merriweather/v25/u-440qyriQwlOrhSvowK_l5-eiZM.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/merriweather/v25/u-440qyriQwlOrhSvowK_l5Ofg.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/merriweather/v25/u-440qyriQwlOrhSvowK_l5Ofg.woff2Q?
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/merriweather/v25/u-4l0qyriQwlOrhSvowK_l5-eR71Wsf6.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/merriweather/v25/u-4m0qyriQwlOrhSvowK_l5-eSZM.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/merriweather/v25/u-4n0qyriQwlOrhSvowK_l52xwNpWg.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/merriweather/v25/u-4n0qyriQwlOrhSvowK_l52xwNpWg.woff2(
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v18/JTUPjIg1_i6t8kCHKm459WxZcgvD_g.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v18/JTUPjIg1_i6t8kCHKm459WxZcgvD_g.woff2l
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v18/JTUQjIg1_i6t8kCHKm459Wxhyw.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v18/JTUQjIg1_i6t8kCHKm459Wxhyw.woff22
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v18/JTURjIg1_i6t8kCHKm45_dJE7gs.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v18/JTUSjIg1_i6t8kCHKm459W9hyw.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v18/JTUSjIg1_i6t8kCHKm45xWs.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/nunito/v16/XRXQ3I6Li01BKofIMN44Y-vI.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/nunito/v16/XRXV3I6Li01BKof4Nw.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/nunito/v16/XRXV3I6Li01BKofIM-aB.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/nunito/v16/XRXV3I6Li01BKofIM-aB.woff2~xo
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/nunito/v16/XRXW3I6Li01BKofAjsOkYw.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/nunito/v16/XRXX3I6Li01BKofIMOaB.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/nunito/v16/XRXX3I6Li01BKofIMOaB.woff2$?_
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/oswald/v40/TK3_WkUHHAIjg75cFRf3bXL8LICs1_FvgUQ.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/oswald/v40/TK3_WkUHHAIjg75cFRf3bXL8LICs1_FvgUQ.woff2j
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/oswald/v40/TK3_WkUHHAIjg75cFRf3bXL8LICs1_FvsUBiZQ.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/oswald/v40/TK3_WkUHHAIjg75cFRf3bXL8LICs1_FvsUBiZQ.woff2-
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/oswald/v40/TK3_WkUHHAIjg75cFRf3bXL8LICs1xZogUQ.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/pacifico/v17/FwZY7-Qmy14u9lezJ-6B6Mk.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/pacifico/v17/FwZY7-Qmy14u9lezJ-6B6Mk.woff21
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/pacifico/v17/FwZY7-Qmy14u9lezJ96F.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/pacifico/v17/FwZY7-Qmy14u9lezJ96F.woff2J
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/playfairdisplay/v22/nuFRD-vYSZviVYUb_rj3ij__anPXDTnCjmHKM4nYO7KN_k-UbtM.
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/playfairdisplay/v22/nuFRD-vYSZviVYUb_rj3ij__anPXDTnCjmHKM4nYO7KN_qiTbtM.
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/playfairdisplay/v22/nuFvD-vYSZviVYUb_rj3ij__anPXJzDwcbmjWBN2PKdFvUDV.wof
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/playfairdisplay/v22/nuFvD-vYSZviVYUb_rj3ij__anPXJzDwcbmjWBN2PKdFvXDRbtM.
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/playfairdisplay/v22/nuFvD-vYSZviVYUb_rj3ij__anPXJzDwcbmjWBN2PKeiukDV.wof
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/quattrocentosans/v13/va9X4lja2NVIDdIAAoMR5MfuElaRB0zMj_bTPXw.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/quattrocentosans/v13/va9Z4lja2NVIDdIAAoMR5MfuElaRB0RykmrT.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/quattrocentosans/v13/va9a4lja2NVIDdIAAoMR5MfuElaRB0zMt08.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/quattrocentosans/v13/va9c4lja2NVIDdIAAoMR5MfuElaRB0zPt08.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/quattrocentosans/v13/va9c4lja2NVIDdIAAoMR5MfuElaRB3zL.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2I
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2PW
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v29/KFOjCnqEu92Fr1Mu51TzBhc4.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v29/KFOkCnqEu92Fr1Mu52xK.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmWUlvBg.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Me4A.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Me4A.woff2#
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu5GxK.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/robotomono/v13/L0xoDF4xlVMF-BfR8bXMIjhOsXG-q2oeuFoqFrlnAOW4.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/robotomono/v13/L0xoDF4xlVMF-BfR8bXMIjhOsXG-q2oeuFoqFrlnAOW4.woff2br=
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/robotomono/v13/L0xoDF4xlVMF-BfR8bXMIjhOsXG-q2oeuFoqFrmAB-W4.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/robotomono/v13/L0xuDF4xlVMF-BfR8bXMIhJHg45mwgGEFl0_3vqPRg.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/robotomono/v13/L0xuDF4xlVMF-BfR8bXMIhJHg45mwgGEFl0_3vqPRg.woff2Z
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/robotomono/v13/L0xuDF4xlVMF-BfR8bXMIhJHg45mwgGEFl0_3vq_QuW4.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/robotomono/v13/L0xuDF4xlVMF-BfR8bXMIhJHg45mwgGEFl0_Of2PRg.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/robotomono/v13/L0xuDF4xlVMF-BfR8bXMIhJHg45mwgGEFl0_Of2PRg.woff2y
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/spectral/v7/rnCr-xNNww_2s0amA-M7.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/spectral/v7/rnCr-xNNww_2s0amA9M_kng.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/spectral/v7/rnCs-xNNww_2s0amA9uCt13D.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/spectral/v7/rnCt-xNNww_2s0amA9M8kng.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/spectral/v7/rnCu-xNNww_2s0amA9M8qsHDafY.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/spectral/v7/rnCu-xNNww_2s0amA9M8qsHDafY.woff2d
Source: manifest.json.1.dr	String found in binary or memory: https://fonts.gstatic.com;
Source: angular.js.1.dr	String found in binary or memory: https://github.com/angular/material
Source: LICENSE.txt.1.dr	String found in binary or memory: https://github.com/easylist)
Source: craw_background.js.1.dr, craw_window.js.1.dr	String found in binary or memory: https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: https://github.com/madler/zlib/blob/master/zlib.h
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: https://hangouts.clients6.google.com
Source: manifest.json.1.dr	String found in binary or memory: https://hangouts.google.com/
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: https://hangouts.google.com/hangouts/_/logpref
Source: 2b5d6b28-abc9-4340-9ff7-41e8f309b77f.tmp.2.dr, 2707e0e2-4311-4956-91b9-88ef1478870e.tmp.2.dr	String found in binary or memory: https://lh3.googleusercontent.com
Source: data_1.2.dr	String found in binary or memory: https://lh3.googleusercontent.com/a/AATXAJyEMzwYioPomGpTeso8L__wKY3bPrTHt3se5MVa=s50-c-k-no
Source: 2b5d6b28-abc9-4340-9ff7-41e8f309b77f.tmp.2.dr, 2707e0e2-4311-4956-91b9-88ef1478870e.tmp.2.dr	String found in binary or memory: https://lh4.googleusercontent.com
Source: Favicons.1.dr	String found in binary or memory: https://lh4.googleusercontent.com/-6DRE7a5AcB4/AAAAAAAAAAI/AAAAAAAAAKM/5K1J4UolszQ/s0-c-k-no-ns/phot
Source: 2b5d6b28-abc9-4340-9ff7-41e8f309b77f.tmp.2.dr, 2707e0e2-4311-4956-91b9-88ef1478870e.tmp.2.dr	String found in binary or memory: https://lh5.googleusercontent.com
Source: data_1.2.dr	String found in binary or memory: https://lh5.googleusercontent.com/pwYVsXf9mnduU19ekvkzpxBcGkRyYKUMGZ_V8GMa2zfiJJenvGHc7JSftlktCbvWz8
Source: Network Action Predictor.1.dr	String found in binary or memory: https://marketingandsoftwaretools.com/
Source: Current Session.1.dr	String found in binary or memory: https://marketingandsoftwaretools.com/wp-content/plugins/autoptimize/ANGEL/365.php
Source: Favicons.1.dr, Current Session.1.dr, data_2.2.dr	String found in binary or memory: https://marketingandsoftwaretools.com/wp-content/plugins/autoptimize/ANGEL/MicrosoftAccount.html
Source: data_1.2.dr	String found in binary or memory: https://marketingandsoftwaretools.com/wp-content/plugins/autoptimize/ANGEL/MicrosoftAccount.html3
Source: data_2.2.dr	String found in binary or memory: https://marketingandsoftwaretools.com/wp-content/plugins/autoptimize/ANGEL/MicrosoftAccount.htmlRefe
Source: History.1.dr	String found in binary or memory: https://marketingandsoftwaretools.com/wp-content/plugins/autoptimize/ANGEL/MicrosoftAccount.htmlSign
Source: mirroring_common.js.1.dr	String found in binary or memory: https://meet.google.com
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: https://meetings.clients6.google.com
Source: data_2.2.dr	String found in binary or memory: https://msblogs.blob.core.windows.net:443/prod/2012/08/8867.Microsoft_5F00_Logo_2D00_for_2D00_screen
Source: mirroring_common.js.1.dr	String found in binary or memory: https://networktraversal.googleapis.com/v1alpha
Source: 2c6a0c24-8c93-4014-9329-732aa4582676.tmp.2.dr, 2b5d6b28-abc9-4340-9ff7-41e8f309b77f.tmp.2.dr, 2707e0e2-4311-4956-91b9-88ef1478870e.tmp.2.dr	String found in binary or memory: https://ogs.google.com
Source: manifest.json1.1.dr, craw_window.js.1.dr	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: 2b5d6b28-abc9-4340-9ff7-41e8f309b77f.tmp.2.dr, 2707e0e2-4311-4956-91b9-88ef1478870e.tmp.2.dr	String found in binary or memory: https://people-pa.clients6.google.com
Source: data_3.2.dr	String found in binary or memory: https://pki.goog/repository/0
Source: 2c6a0c24-8c93-4014-9329-732aa4582676.tmp.2.dr, 2b5d6b28-abc9-4340-9ff7-41e8f309b77f.tmp.2.dr, 2707e0e2-4311-4956-91b9-88ef1478870e.tmp.2.dr	String found in binary or memory: https://play.google.com
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: https://preprod-hangouts-googleapis.sandbox.google.com
Source: 2b5d6b28-abc9-4340-9ff7-41e8f309b77f.tmp.2.dr, 2707e0e2-4311-4956-91b9-88ef1478870e.tmp.2.dr	String found in binary or memory: https://r4---sn-h0jeln7l.gvt1.com
Source: data_3.2.dr, data_1.2.dr	String found in binary or memory: https://r4---sn-h0jeln7l.gvt1.com/edgedl/chrome/dict/en-us-9-0.bdic?cms_redirect=yes&mh=I2&mip=102.1
Source: 2b5d6b28-abc9-4340-9ff7-41e8f309b77f.tmp.2.dr, 2707e0e2-4311-4956-91b9-88ef1478870e.tmp.2.dr	String found in binary or memory: https://redirector.gvt1.com
Source: data_1.2.dr	String found in binary or memory: https://redirector.gvt1.com/edgedl/chrome/dict/en-us-9-0.bdic
Source: data_1.2.dr	String found in binary or memory: https://redirector.gvt1.com/edgedl/chrome/dict/en-us-9-0.bdicMQ
Source: manifest.json1.1.dr, craw_window.js.1.dr	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: data_1.2.dr	String found in binary or memory: https://secure.aadcdn.microsoftonline-p.com/dbd5a2dd-6ybrougjmflxqw910ieyohr7wb4x4-yvoixrlaidmz4/app
Source: 2c6a0c24-8c93-4014-9329-732aa4582676.tmp.2.dr, 2b5d6b28-abc9-4340-9ff7-41e8f309b77f.tmp.2.dr, 2707e0e2-4311-4956-91b9-88ef1478870e.tmp.2.dr	String found in binary or memory: https://ssl.gstatic.com
Source: data_1.2.dr	String found in binary or memory: https://ssl.gstatic.com/docs/common/material_common_sprite319_grey_medium.svg
Source: data_1.2.dr	String found in binary or memory: https://ssl.gstatic.com/docs/common/warning.png
Source: Favicons.1.dr, data_1.2.dr	String found in binary or memory: https://ssl.gstatic.com/docs/documents/images/kix-favicon7.ico
Source: data_1.2.dr	String found in binary or memory: https://ssl.gstatic.com/docs/documents/images/kix-favicon7.ico%a
Source: messages.json27.1.dr, feedback.html.1.dr	String found in binary or memory: https://support.google.com/chromecast/answer/2998456
Source: messages.json27.1.dr, feedback.html.1.dr	String found in binary or memory: https://support.google.com/chromecast/troubleshooter/2995236
Source: craw_background.js.1.dr, craw_window.js.1.dr	String found in binary or memory: https://www-googleapis-staging.sandbox.google.com
Source: manifest.json.1.dr, 2c6a0c24-8c93-4014-9329-732aa4582676.tmp.2.dr, 2b5d6b28-abc9-4340-9ff7-41e8f309b77f.tmp.2.dr, 2707e0e2-4311-4956-91b9-88ef1478870e.tmp.2.dr	String found in binary or memory: https://www.google.com
Source: manifest.json1.1.dr	String found in binary or memory: https://www.google.com/
Source: craw_window.js.1.dr	String found in binary or memory: https://www.google.com/accounts/OAuthLogin?issueuberauth=1
Source: craw_window.js.1.dr	String found in binary or memory: https://www.google.com/images/cleardot.gif
Source: craw_window.js.1.dr	String found in binary or memory: https://www.google.com/images/dot2.gif
Source: craw_window.js.1.dr	String found in binary or memory: https://www.google.com/images/x2.gif
Source: craw_background.js.1.dr	String found in binary or memory: https://www.google.com/intl/en-US/chrome/blank.html
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: https://www.google.com/log?format=json&hasfast=true
Source: feedback_script.js.1.dr	String found in binary or memory: https://www.google.com/tools/feedback
Source: manifest.json.1.dr	String found in binary or memory: https://www.google.com;
Source: 2c6a0c24-8c93-4014-9329-732aa4582676.tmp.2.dr, craw_background.js.1.dr, craw_window.js.1.dr, 2b5d6b28-abc9-4340-9ff7-41e8f309b77f.tmp.2.dr, 2707e0e2-4311-4956-91b9-88ef1478870e.tmp.2.dr	String found in binary or memory: https://www.googleapis.com
Source: manifest.json1.1.dr	String found in binary or memory: https://www.googleapis.com/
Source: manifest.json.1.dr	String found in binary or memory: https://www.googleapis.com/auth/calendar.readonly
Source: manifest.json.1.dr	String found in binary or memory: https://www.googleapis.com/auth/cast-edu-messaging
Source: manifest.json1.1.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json1.1.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json.1.dr	String found in binary or memory: https://www.googleapis.com/auth/clouddevices
Source: manifest.json.1.dr	String found in binary or memory: https://www.googleapis.com/auth/hangouts
Source: manifest.json.1.dr	String found in binary or memory: https://www.googleapis.com/auth/hangouts.readonly
Source: manifest.json.1.dr	String found in binary or memory: https://www.googleapis.com/auth/meetings
Source: manifest.json.1.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.peopleapi.readwrite
Source: manifest.json1.1.dr	String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json1.1.dr	String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: manifest.json.1.dr	String found in binary or memory: https://www.googleapis.com/auth/userinfo.email
Source: mirroring_common.js.1.dr	String found in binary or memory: https://www.googleapis.com/calendar/v3
Source: mirroring_common.js.1.dr	String found in binary or memory: https://www.googleapis.com/hangouts/v1
Source: 2c6a0c24-8c93-4014-9329-732aa4582676.tmp.2.dr, 2b5d6b28-abc9-4340-9ff7-41e8f309b77f.tmp.2.dr, 2707e0e2-4311-4956-91b9-88ef1478870e.tmp.2.dr	String found in binary or memory: https://www.gstatic.com
Source: data_1.2.dr	String found in binary or memory: https://www.gstatic.com/feedback/js/help/prod/service/lazy.min.js
Source: common.js.1.dr	String found in binary or memory: https://www.gstatic.com/hangouts_echo_detector/release/%
Source: manifest.json.1.dr	String found in binary or memory: https://www.gstatic.com;

Posts data to webserver

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: clients2.google.com

Downloads files from webservers via HTTP

Source: global traffic	HTTP traffic detected: GET /document/d/1hHFEB09XYOGm1F87Todc5etNXb38nGMo/edit?usp=sharing_eip_m&rtpof=true&sd=true&invite=CKvaqcMD&ts=6178419e HTTP/1.1Host: docs.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-85.0.4183.121Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/quattrocentosans/v13/va9c4lja2NVIDdIAAoMR5MfuElaRB3zL.woff2 HTTP/1.1Host: fonts.gstatic.comConnection: keep-aliveOrigin: https://docs.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://docs.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/quattrocentosans/v13/va9a4lja2NVIDdIAAoMR5MfuElaRB0zMt08.woff2 HTTP/1.1Host: fonts.gstatic.comConnection: keep-aliveOrigin: https://docs.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://docs.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/quattrocentosans/v13/va9Z4lja2NVIDdIAAoMR5MfuElaRB0RykmrT.woff2 HTTP/1.1Host: fonts.gstatic.comConnection: keep-aliveOrigin: https://docs.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://docs.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/quattrocentosans/v13/va9X4lja2NVIDdIAAoMR5MfuElaRB0zMj_bTPXw.woff2 HTTP/1.1Host: fonts.gstatic.comConnection: keep-aliveOrigin: https://docs.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://docs.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /a/AATXAJyEMzwYioPomGpTeso8L__wKY3bPrTHt3se5MVa=s50-c-k-no HTTP/1.1Host: lh3.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://docs.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/api.js HTTP/1.1Host: apis.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://docs.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Y92BNZ9vutvPx5gYeR8PaBR1g_mjrmCbnEFTAUIP5QU_3dlIScKiIhC1ufW60kTsfttHGWjfh8tX89A0mP3NPzrSONW4oQZWqfZSyaVggZ0e0Vz6RdOlNYvMWIqXMN_dQQU9K8Lua7RTR5hqBAFF4A5J7LsZ4WTk3rzAAAoLtqY; CONSENT=PENDING+043
Source: global traffic	HTTP traffic detected: GET /widget/hovercard/v/2?authuser&origin=https%3A%2F%2Fdocs.google.com&usegapi=1&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.wk7zEZseXNs.O%2Fam%3DAQ%2Fd%3D1%2Frs%3DAGLTcCOmgtod9hyJVly8FtL6dHsuETJ2AQ%2Fm%3D__features__ HTTP/1.1Host: contacts.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://docs.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Y92BNZ9vutvPx5gYeR8PaBR1g_mjrmCbnEFTAUIP5QU_3dlIScKiIhC1ufW60kTsfttHGWjfh8tX89A0mP3NPzrSONW4oQZWqfZSyaVggZ0e0Vz6RdOlNYvMWIqXMN_dQQU9K8Lua7RTR5hqBAFF4A5J7LsZ4WTk3rzAAAoLtqY; CONSENT=PENDING+043
Source: global traffic	HTTP traffic detected: GET /a/AATXAJyEMzwYioPomGpTeso8L__wKY3bPrTHt3se5MVa=s50-c-k-no HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh3.googleusercontent.com
Source: global traffic	HTTP traffic detected: GET /pwYVsXf9mnduU19ekvkzpxBcGkRyYKUMGZ_V8GMa2zfiJJenvGHc7JSftlktCbvWz8maNXS86sFO_7LkM_SSgolAKJvipGHjICB3qQHQKQBly7B4CT09UXIUvc5r2w HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh5.googleusercontent.com
Source: global traffic	HTTP traffic detected: GET /3me0XGn HTTP/1.1Host: bit.lyConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/autoptimize/ANGEL/MicrosoftAccount.html HTTP/1.1Host: marketingandsoftwaretools.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /adfs/portal/css/style.css HTTP/1.1Host: edadfed.ed.ac.ukConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,*/*;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://marketingandsoftwaretools.com/wp-content/plugins/autoptimize/ANGEL/MicrosoftAccount.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /adfs/portal/illustration/illustration.jpg HTTP/1.1Host: edadfed.ed.ac.ukConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://marketingandsoftwaretools.com/wp-content/plugins/autoptimize/ANGEL/MicrosoftAccount.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /-6DRE7a5AcB4/AAAAAAAAAAI/AAAAAAAAAKM/5K1J4UolszQ/s0-c-k-no-ns/photo.jpg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh4.googleusercontent.com

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 142.250.203.97:443 -> 192.168.2.3:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.203.97:443 -> 192.168.2.3:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.203.97:443 -> 192.168.2.3:49806 version: TLS 1.2

System Summary:

Spawns processes

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --start-maximized --enable-automation 'https://docs.google.com/document/d/1hHFEB09XYOGm1F87Todc5etNXb38nGMo/edit?usp=sharing_eip_m&rtpof=true&sd=true&invite=CKvaqcMD&ts=6178419e'
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1560,8177781781073637063,12308943224005517833,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1912 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1560,8177781781073637063,12308943224005517833,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1912 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior

Found detection on Joe Sandbox Cloud Basic with higher score

Source: https://docs.google.com/document/d/1hHFEB09XYOGm1F87Todc5etNXb38nGMo/edit?usp=sharing_eip_m&rtpof=true&sd=true&invite=CKvaqcMD&ts=6178419e

Joe Sandbox Cloud Basic: Detection: clean Score: 0

Perma Link

Creates files inside the program directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\Chrome\Application\Dictionaries

Jump to behavior

Creates files inside the user directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-6178E0BA-19A4.pma

Jump to behavior

Creates temporary files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Temp\ff8b64d9-6ef5-4fa7-89bf-4331ad3a3312.tmp

Jump to behavior

Classification label

Source: classification engine

Classification label: mal68.phis.win@35/257@23/13

SQL strings found in memory and binary data

Source: QuotaManager.1.dr

Binary or memory string: CREATE TABLE HostQuotaTable(host TEXT NOT NULL, type INTEGER NOT NULL, quota INTEGER DEFAULT 0, UNIQUE(host, type));

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Creates a directory in C:\Program Files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic			Jump to behavior

Persistence and Installation Behavior:

Creates license or readme file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Temp\6564_244370255\LICENSE.txt

Jump to behavior