Windows Analysis Report https://sites.google.com/view/49ershome/home

AV Detection:

Antivirus / Scanner detection for submitted sample

Source: https://sites.google.com/view/49ershome/home

SlashNext: detection malicious, Label: Fake Login Page type: Phishing & Social Engineering

Antivirus detection for URL or domain

Source: https://chelp-ethanim-mosetena.s3.us-west-002.backblazeb2.com/index.html

SlashNext: Label: Fake Login Page type: Phishing & Social Engineering

Phishing:

Yara detected HtmlPhish7

Source: Yara match

File source: 22427.5.pages.csv, type: HTML

Yara detected HtmlPhish20

Source: Yara match

File source: 87841.0.pages.csv, type: HTML

Yara detected HtmlPhish10

Source: Yara match

File source: 22427.5.pages.csv, type: HTML

Phishing site detected (based on image similarity)

Source: https://chelp-ethanim-mosetena.s3.us-west-002.backblazeb2.com/index.html	Matcher: Found strong image similarity, brand: Microsoft image: 22427.5.img.2.gfk.csv C3FC46C5799C76F9107504028F39190F
Source: https://chelp-ethanim-mosetena.s3.us-west-002.backblazeb2.com/index.html	Matcher: Found strong image similarity, brand: Microsoft image: 22427.5.img.3.gfk.csv FE22440D79FFA34950F512EF4A718B2A

HTML body contains low number of good links

Source: https://chelp-ethanim-mosetena.s3.us-west-002.backblazeb2.com/index.html

HTTP Parser: Number of links: 0

No HTML title found

Source: https://chelp-ethanim-mosetena.s3.us-west-002.backblazeb2.com/index.html

HTTP Parser: HTML title missing

META author tag missing

Source: https://chelp-ethanim-mosetena.s3.us-west-002.backblazeb2.com/index.html

HTTP Parser: No <meta name="author".. found

META copyright tag missing

Source: https://chelp-ethanim-mosetena.s3.us-west-002.backblazeb2.com/index.html

HTTP Parser: No <meta name="copyright".. found

Compliance:

Creates a directory in C:\Program Files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic			Jump to behavior

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 216.58.212.161:443 -> 192.168.2.5:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.212.161:443 -> 192.168.2.5:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.212.161:443 -> 192.168.2.5:49807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.87.42:443 -> 192.168.2.5:49849 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.87.42:443 -> 192.168.2.5:49848 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.212.161:443 -> 192.168.2.5:49879 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.212.161:443 -> 192.168.2.5:49880 version: TLS 1.2

Networking:

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: sites.google.com

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 49948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443

Downloads files from webservers via HTTP

Source: global traffic	HTTP traffic detected: GET /view/49ershome/home HTTP/1.1Host: sites.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-85.0.4183.121Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/client.js?onload=gapiLoaded HTTP/1.1Host: apis.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://sites.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=VPIhOCoVqI1cC1KRS1qmzBA6NkYTKUtkQZOxJp03Ir5tyTzRV6ynBqtC-DoHangKMxJ6Rt8mZvhdBlHuZBgS0glmGNO8ULGfZoPBUtnfgS0Fc619s1N_Zcijaxqa9GjACyBV6VrD7cZMc8_N3UeS_ZYGT2QSpuw-a_sOwa18Rfw
Source: global traffic	HTTP traffic detected: GET /SDY-NvgrYAl40__zoIzYoPyOmAaFt9r_mfo5Qe3WIZAGcol2bp1pfQg7VYL4jME-lhbwPX2uAKZafyHRp5_IieM=w16383 HTTP/1.1Host: lh3.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://sites.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mnBG68NCBxKJ8IXvdb5REYiZ31mapY2Xx6EnK4hAisZBJ_g5ueUBNY3Quna9e8WEo2vmUf6qEjB4qkNarsvYkXg=w16383 HTTP/1.1Host: lh5.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://sites.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff2 HTTP/1.1Host: fonts.gstatic.comConnection: keep-aliveOrigin: https://sites.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://fonts.googleapis.com/css?family=Google+Sans:400,500|Roboto:300,400,500,700|Source+Code+Pro:400,700&display=swapAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/ptsans/v12/jizfRExUiTo99u79B_mh0O6tLQ.woff2 HTTP/1.1Host: fonts.gstatic.comConnection: keep-aliveOrigin: https://sites.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://fonts.googleapis.com/css?family=PT%20Sans%3A400%2C700%7CMerriweather%3A400%2C700&display=swapAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/ptsans/v12/jizaRExUiTo99u79D0KExQ.woff2 HTTP/1.1Host: fonts.gstatic.comConnection: keep-aliveOrigin: https://sites.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://fonts.googleapis.com/css?family=PT%20Sans%3A400%2C700%7CMerriweather%3A400%2C700&display=swapAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Wuju_iSfQw98vVM2cidnCzo5aJ_ludxJNUaULDvbhm5jbhXwX9kkiMmUcAvpLCUE5D89aLEaDzaQDln_GHCpXjE=w16383 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh6.googleusercontent.com
Source: global traffic	HTTP traffic detected: GET /ckIxcdzCDH0ydZ5pgF75ycZexs1Wq6Pk3oB8rTWv6g4b9FCcq8TZILzzZ6hoB4Ek0JI2_EO2rxmUggv23Nwz77-UTfbUA7yo5Hj7tKaaSYTUlGeZIiGiv0cWHMK5UOMQ4A=w1280 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh3.googleusercontent.com
Source: global traffic	HTTP traffic detected: GET /Wuju_iSfQw98vVM2cidnCzo5aJ_ludxJNUaULDvbhm5jbhXwX9kkiMmUcAvpLCUE5D89aLEaDzaQDln_GHCpXjE=w16383 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh6.googleusercontent.comIf-None-Match: "v1"
Source: global traffic	HTTP traffic detected: GET /pSnATPPoYUFrOvgsRmaNvw15Cnf_nxEPsmWWAPHiTO7_Pg7orNNTok24Nh1jg2SlfR5kwDat1cd44n-XchKd3VW08RQwfJCLg6-2OMtGiBdMYx7QtbRLCtwyvA71wwknMg=w1280 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh6.googleusercontent.com
Source: global traffic	HTTP traffic detected: GET /a-YMp0JaYoEhpKIppbVSS1sgxNbwPPdyIgQXPKb-sws32f2UraEI3Md4Sj_yF9B94rPRr-E7Zm_VzC1pw1j07nsYFc1DUWwySjjo7RGcU1kdI7rdFE5l074Osh-HTS3Z=w1280 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh5.googleusercontent.com
Source: global traffic	HTTP traffic detected: GET /url?q=https%3A%2F%2Fchelp-ethanim-mosetena.s3.us-west-002.backblazeb2.com%2Findex.html&sa=D&sntz=1&usg=AFQjCNE6yDwBCn9hUlu_ES3hSaZDaLwfXA HTTP/1.1Host: www.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=VPIhOCoVqI1cC1KRS1qmzBA6NkYTKUtkQZOxJp03Ir5tyTzRV6ynBqtC-DoHangKMxJ6Rt8mZvhdBlHuZBgS0glmGNO8ULGfZoPBUtnfgS0Fc619s1N_Zcijaxqa9GjACyBV6VrD7cZMc8_N3UeS_ZYGT2QSpuw-a_sOwa18Rfw
Source: global traffic	HTTP traffic detected: GET /index.html HTTP/1.1Host: chelp-ethanim-mosetena.s3.us-west-002.backblazeb2.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://www.google.com/url?q=https%3A%2F%2Fchelp-ethanim-mosetena.s3.us-west-002.backblazeb2.com%2Findex.html&sa=D&sntz=1&usg=AFQjCNE6yDwBCn9hUlu_ES3hSaZDaLwfXAAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.0.0/css/bootstrap.min.css HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-aliveOrigin: https://chelp-ethanim-mosetena.s3.us-west-002.backblazeb2.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,*/*;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://chelp-ethanim-mosetena.s3.us-west-002.backblazeb2.com/index.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /email-list/mnb/css/hover.css HTTP/1.1Host: seedsmtp.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,*/*;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://chelp-ethanim-mosetena.s3.us-west-002.backblazeb2.com/index.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /email-list/mnb/images/adobe.jpg HTTP/1.1Host: seedsmtp.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://chelp-ethanim-mosetena.s3.us-west-002.backblazeb2.com/index.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /email-list/mnb/images/outlook1.png HTTP/1.1Host: seedsmtp.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://chelp-ethanim-mosetena.s3.us-west-002.backblazeb2.com/index.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/popper.js/1.12.9/umd/popper.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveOrigin: https://chelp-ethanim-mosetena.s3.us-west-002.backblazeb2.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://chelp-ethanim-mosetena.s3.us-west-002.backblazeb2.com/index.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /email-list/mnb/images/office3651.png HTTP/1.1Host: seedsmtp.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://chelp-ethanim-mosetena.s3.us-west-002.backblazeb2.com/index.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /email-list/mnb/images/other1.png HTTP/1.1Host: seedsmtp.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://chelp-ethanim-mosetena.s3.us-west-002.backblazeb2.com/index.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.0.0/js/bootstrap.min.js HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-aliveOrigin: https://chelp-ethanim-mosetena.s3.us-west-002.backblazeb2.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://chelp-ethanim-mosetena.s3.us-west-002.backblazeb2.com/index.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /email-list/mnb/images/gmail.png HTTP/1.1Host: seedsmtp.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://chelp-ethanim-mosetena.s3.us-west-002.backblazeb2.com/index.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /email-list/mnb/images/8.jpg HTTP/1.1Host: seedsmtp.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://chelp-ethanim-mosetena.s3.us-west-002.backblazeb2.com/index.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: chelp-ethanim-mosetena.s3.us-west-002.backblazeb2.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://chelp-ethanim-mosetena.s3.us-west-002.backblazeb2.com/index.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /email-list/mnb/images/outlook1.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: seedsmtp.com
Source: global traffic	HTTP traffic detected: GET /email-list/mnb/images/adobe.jpg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: seedsmtp.com
Source: global traffic	HTTP traffic detected: GET /email-list/mnb/images/office3651.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: seedsmtp.com
Source: global traffic	HTTP traffic detected: GET /email-list/mnb/images/other1.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: seedsmtp.com
Source: global traffic	HTTP traffic detected: GET /email-list/mnb/images/gmail.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: seedsmtp.com
Source: global traffic	HTTP traffic detected: GET /hHPMlNEXVwxMRGKK82th9B9-Z3K7k4HkxEU_RVWKMt7TFGoqxx7HxSvuOkj6bD_VtTy457sQ9rvTYWvfE80wHMQ=w16383 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh4.googleusercontent.com
Source: global traffic	HTTP traffic detected: GET /leXlyFb8ZAw9ToXNOiNfX8L0P48pVl2oVk7o6q5gOoch1PQJXKM7kKnRUk5ztXf0TbFS0ud93zeItUbpd8qD6nznDXwDDF4ILKPCwrxjuO8uyrdU5jx4fqTcc09KaSOr_g=w1280 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh4.googleusercontent.com
Source: global traffic	HTTP traffic detected: GET /hHPMlNEXVwxMRGKK82th9B9-Z3K7k4HkxEU_RVWKMt7TFGoqxx7HxSvuOkj6bD_VtTy457sQ9rvTYWvfE80wHMQ=w16383 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh4.googleusercontent.comIf-None-Match: "v1"
Source: global traffic	HTTP traffic detected: GET /leXlyFb8ZAw9ToXNOiNfX8L0P48pVl2oVk7o6q5gOoch1PQJXKM7kKnRUk5ztXf0TbFS0ud93zeItUbpd8qD6nznDXwDDF4ILKPCwrxjuO8uyrdU5jx4fqTcc09KaSOr_g=w1280 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh4.googleusercontent.comIf-None-Match: "v1"
Source: global traffic	HTTP traffic detected: GET /hHPMlNEXVwxMRGKK82th9B9-Z3K7k4HkxEU_RVWKMt7TFGoqxx7HxSvuOkj6bD_VtTy457sQ9rvTYWvfE80wHMQ=w16383 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh4.googleusercontent.comIf-None-Match: "v1"
Source: global traffic	HTTP traffic detected: GET /leXlyFb8ZAw9ToXNOiNfX8L0P48pVl2oVk7o6q5gOoch1PQJXKM7kKnRUk5ztXf0TbFS0ud93zeItUbpd8qD6nznDXwDDF4ILKPCwrxjuO8uyrdU5jx4fqTcc09KaSOr_g=w1280 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh4.googleusercontent.comIf-None-Match: "v1"
Source: global traffic	HTTP traffic detected: GET /hHPMlNEXVwxMRGKK82th9B9-Z3K7k4HkxEU_RVWKMt7TFGoqxx7HxSvuOkj6bD_VtTy457sQ9rvTYWvfE80wHMQ=w16383 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh4.googleusercontent.comIf-None-Match: "v1"
Source: global traffic	HTTP traffic detected: GET /IwmLUvtIqThIvnfdEEHHoPhAe5C_NUEitKRzYMy7kPDgx38hd85CBDIx9U8O5vD0hnvG7ixUlnP7-xnraZm-OTT0q9cE8NodhKFjCHLh6E0WIyO0svLtnpDsoVVLi6vs=w1280 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh3.googleusercontent.com
Source: global traffic	HTTP traffic detected: GET /Ux__2ZuxpaNRY_9zrbSlXuT6zXkFB6lmFsGEf2eh-z1pjDCn6dh2A2NokwQRencZ-eTU3aXVZR_jMx_fOAv3P8zvVmd1Lt4JN14Flumk3ZxE2h7le_as1nCF2oTxFzXiaA=w1280 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh6.googleusercontent.com
Source: global traffic	HTTP traffic detected: GET /h80L2troHbBjeeTEyaqQzG8iJgPapwnTUyxCbccoS80Iq7PXsqof7YGqgw0Vegn2O4h0d8TzNzxsM8tsXVDeY_w=w16383 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh5.googleusercontent.com
Source: global traffic	HTTP traffic detected: GET /57f7rkt25N-Sz_RrSHdJ4Rky7sTiMjAg5pqhozAjUc3pKi17UV7x1mQRJQJTB6cgoly0N2QlkU6n1MGsjlaJ4A2gW6EqShZ6HbQYab_pTu28Ju_4jfDaH_vs8xVd8ON6=w1280 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh4.googleusercontent.com
Source: global traffic	HTTP traffic detected: GET /JQ6sqiCzBsJ2xkg8EN5RNmmF0WPptTvvHXEJZ3IFFtidowlpGMVtxfg7C3TisXVOsCPmHGQMglnY55CeaBBQTKx6cBt-hkmhjm2iaUUwapyFiI1kzygngRrmuLWJ76nXfg=w1280 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh4.googleusercontent.com
Source: global traffic	HTTP traffic detected: GET /h80L2troHbBjeeTEyaqQzG8iJgPapwnTUyxCbccoS80Iq7PXsqof7YGqgw0Vegn2O4h0d8TzNzxsM8tsXVDeY_w=w16383 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh5.googleusercontent.comIf-None-Match: "v1"
Source: global traffic	HTTP traffic detected: GET /57f7rkt25N-Sz_RrSHdJ4Rky7sTiMjAg5pqhozAjUc3pKi17UV7x1mQRJQJTB6cgoly0N2QlkU6n1MGsjlaJ4A2gW6EqShZ6HbQYab_pTu28Ju_4jfDaH_vs8xVd8ON6=w1280 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh4.googleusercontent.comIf-None-Match: "v1"
Source: global traffic	HTTP traffic detected: GET /JQ6sqiCzBsJ2xkg8EN5RNmmF0WPptTvvHXEJZ3IFFtidowlpGMVtxfg7C3TisXVOsCPmHGQMglnY55CeaBBQTKx6cBt-hkmhjm2iaUUwapyFiI1kzygngRrmuLWJ76nXfg=w1280 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh4.googleusercontent.comIf-None-Match: "v1"

URLs found in memory or binary data

Source: angular.js.1.dr	String found in binary or memory: http://angularjs.org
Source: data_3.2.dr	String found in binary or memory: http://crl.pki.goog/gsr1/gsr1.crl0;
Source: data_3.2.dr	String found in binary or memory: http://crl.pki.goog/gtsr1/gtsr1.crl0W
Source: data_3.2.dr	String found in binary or memory: http://crls.pki.goog/gts1c3/QOvJ0N1sT2A.crl0
Source: data_3.2.dr	String found in binary or memory: http://crls.pki.goog/gts1c3/QqFxbi9M48c.crl0
Source: data_3.2.dr	String found in binary or memory: http://crls.pki.goog/gts1c3/fVJxbV-Ktmk.crl0
Source: data_3.2.dr	String found in binary or memory: http://crls.pki.goog/gts1c3/zdATt0Ex_Fk.crl0
Source: angular.js.1.dr	String found in binary or memory: http://errors.angularjs.org/1.6.4-local
Source: pnacl_public_x86_64_pnacl_sz_nexe.1.dr	String found in binary or memory: http://llvm.org/):
Source: data_3.2.dr	String found in binary or memory: http://ocsp.pki.goog/gsr10)
Source: data_3.2.dr	String found in binary or memory: http://ocsp.pki.goog/gts1c301
Source: data_3.2.dr	String found in binary or memory: http://ocsp.pki.goog/gtsr100
Source: data_3.2.dr	String found in binary or memory: http://pki.goog/gsr1/gsr1.crt02
Source: data_3.2.dr	String found in binary or memory: http://pki.goog/repo/certs/gts1c3.der0
Source: data_3.2.dr	String found in binary or memory: http://pki.goog/repo/certs/gts1c3.der0M
Source: data_3.2.dr	String found in binary or memory: http://pki.goog/repo/certs/gtsr1.der04
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: http://tools.ietf.org/html/rfc1950
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01
Source: Reporting and NEL.2.dr	String found in binary or memory: https://a.nel.cloudflare.com/report/v3?s=DriRru21D6NqLBFwLYuMWyIKVjxuIlzrrto5jIDMjKUFNgpf6Iuy1elLzUb
Source: Reporting and NEL.2.dr	String found in binary or memory: https://a.nel.cloudflare.com/report/v3?s=YP3i1cCKqaOu3Sy%2BHDYxfdvyUYM7OnUDfQF%2BVuzhBS8eWq69U8baz7L
Source: Reporting and NEL.2.dr	String found in binary or memory: https://a.nel.cloudflare.com/report/v3?s=hwgGp6u9KumhqaiUZjfqWse8Rc3KHCiplDqsf3%2FyKgC4oWMIB1%2F5uFV
Source: manifest.json0.1.dr, 2bfd2cea-8496-4f4b-892a-dae10d8b850f.tmp.2.dr, d7dfb4f8-9e9c-4041-9cb8-f2c60e0843d7.tmp.2.dr	String found in binary or memory: https://accounts.google.com
Source: craw_window.js.1.dr	String found in binary or memory: https://accounts.google.com/MergeSession
Source: d7dfb4f8-9e9c-4041-9cb8-f2c60e0843d7.tmp.2.dr	String found in binary or memory: https://ajax.googleapis.com
Source: Network Action Predictor.1.dr	String found in binary or memory: https://ajax.googleapis.com/
Source: data_1.2.dr	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
Source: manifest.json0.1.dr, 2bfd2cea-8496-4f4b-892a-dae10d8b850f.tmp.2.dr, d7dfb4f8-9e9c-4041-9cb8-f2c60e0843d7.tmp.2.dr	String found in binary or memory: https://apis.google.com
Source: Network Action Predictor.1.dr	String found in binary or memory: https://apis.google.com/
Source: data_1.2.dr	String found in binary or memory: https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.wk7zEZseXNs.O/m=client/rt=j/sv=1/d=1/
Source: mirroring_common.js.1.dr	String found in binary or memory: https://apis.google.com/js/client.js
Source: data_1.2.dr	String found in binary or memory: https://apis.google.com/js/client.js?onload=gapiLoaded
Source: data_1.2.dr	String found in binary or memory: https://apis.google.com/js/client.js?onload=gapiLoadedV_
Source: mirroring_common.js.1.dr	String found in binary or memory: https://castedumessaging-pa.googleapis.com/v1
Source: data_1.2.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js
Source: data_1.2.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.jskf
Source: Network Action Predictor.1.dr	String found in binary or memory: https://chelp-ethanim-mosetena.s3.us-west-002.backblazeb2.com/
Source: data_1.2.dr, Current Session.1.dr, data_2.2.dr	String found in binary or memory: https://chelp-ethanim-mosetena.s3.us-west-002.backblazeb2.com/index.html
Source: data_2.2.dr	String found in binary or memory: https://chelp-ethanim-mosetena.s3.us-west-002.backblazeb2.com/index.htmlCache-Control:
Source: History.1.dr	String found in binary or memory: https://chelp-ethanim-mosetena.s3.us-west-002.backblazeb2.com/index.htmlShare
Source: pnacl_public_x86_64_libgcc_a.1.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-clang.git
Source: pnacl_public_x86_64_libgcc_a.1.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-llvm.git
Source: 2bfd2cea-8496-4f4b-892a-dae10d8b850f.tmp.2.dr, d7dfb4f8-9e9c-4041-9cb8-f2c60e0843d7.tmp.2.dr	String found in binary or memory: https://clients2.google.com
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: https://clients2.google.com/cr/report
Source: manifest.json0.1.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 2bfd2cea-8496-4f4b-892a-dae10d8b850f.tmp.2.dr, d7dfb4f8-9e9c-4041-9cb8-f2c60e0843d7.tmp.2.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: https://clients6.google.com
Source: Network Action Predictor.1.dr	String found in binary or memory: https://code.jquery.com/
Source: data_1.2.dr	String found in binary or memory: https://code.jquery.com/jquery-3.1.1.min.js
Source: data_1.2.dr	String found in binary or memory: https://code.jquery.com/jquery-3.1.1.min.js&
Source: data_1.2.dr	String found in binary or memory: https://code.jquery.com/jquery-3.2.1.slim.min.js
Source: d7dfb4f8-9e9c-4041-9cb8-f2c60e0843d7.tmp.2.dr	String found in binary or memory: https://content-autofill.googleapis.com
Source: data_1.2.dr	String found in binary or memory: https://content-autofill.googleapis.com/v1/pages/Chc2LjEuMTcxNS4xNDQyL2VuIChHR0xMKRIUCUMm1IiBWOoFEgk
Source: data_1.2.dr	String found in binary or memory: https://content-autofill.googleapis.com/v1/pages/Chc2LjEuMTcxNS4xNDQyL2VuIChHR0xMKRIfCUKbM7M9IZCNEgk
Source: manifest.json0.1.dr	String found in binary or memory: https://content.googleapis.com
Source: common.js.1.dr, mirroring_cast_streaming.js.1.dr	String found in binary or memory: https://crash.corp.google.com/samples?reportid=&q=
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: https://creativecommons.org/publicdomain/zero/1.0/.
Source: data_3.2.dr, data_2.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/apps-themes
Source: data_2.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/apps-themesCross-Origin-Resource-Policy:
Source: data_3.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/apps-themescross-origin-resource-policy:cross-origincross-origin-open
Source: data_3.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/hosted-libraries-pushers
Source: data_3.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/hosted-libraries-pushersCross-Origin-Resource-Policy:
Source: data_2.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/apps-sites
Source: data_2.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/apps-themes
Source: Reporting and NEL.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/encsid_AXrpQdcxyaoTJMYdhC5b1IVX_h4UhkFjYl5miMVZgqtCo-gS
Source: data_3.2.dr, Reporting and NEL.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/encsid_AXrpQdfmR0fDhCOPhF1MuC4lh4qBOg6Nc66MCVJYeKk
Source: Reporting and NEL.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/encsid_AXrpQdfshzicv7_VskvwG2bjOovrglCIO4nYwHSdXf_gRroAlOw
Source: data_3.2.dr, Reporting and NEL.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers
Source: data_3.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access
Source: data_3.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/social-frontend-mpm-access
Source: data_3.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/social-frontend-mpm-accesscross-origin-resource-policy:cross-origincr
Source: 2bfd2cea-8496-4f4b-892a-dae10d8b850f.tmp.2.dr, 69793359-1ff7-4838-afcc-1bd3a7218fc0.tmp.2.dr, 30469143-4a5e-4c03-b00c-b992996d939d.tmp.2.dr, d7dfb4f8-9e9c-4041-9cb8-f2c60e0843d7.tmp.2.dr	String found in binary or memory: https://dns.google
Source: mirroring_common.js.1.dr	String found in binary or memory: https://docs.google.com
Source: manifest.json0.1.dr	String found in binary or memory: https://feedback.googleusercontent.com
Source: data_3.2.dr	String found in binary or memory: https://fonts.google.com/license/googlerestricted
Source: 2bfd2cea-8496-4f4b-892a-dae10d8b850f.tmp.2.dr, d7dfb4f8-9e9c-4041-9cb8-f2c60e0843d7.tmp.2.dr	String found in binary or memory: https://fonts.googleapis.com
Source: Network Action Predictor.1.dr	String found in binary or memory: https://fonts.googleapis.com/
Source: data_1.2.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Google
Source: data_1.2.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=PT%20Sans%3A400%2C700%7CMerriweather%3A400%2C700&display=swa
Source: data_1.2.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Yellowtail&display=swap
Source: manifest.json0.1.dr	String found in binary or memory: https://fonts.googleapis.com;
Source: data_3.2.dr, d7dfb4f8-9e9c-4041-9cb8-f2c60e0843d7.tmp.2.dr	String found in binary or memory: https://fonts.gstatic.com
Source: Network Action Predictor.1.dr	String found in binary or memory: https://fonts.gstatic.com/
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/googlesans/v36/4UaGrENHsxJlGDuGo1OIlL3Awp5MKg.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/googlesans/v36/4UaGrENHsxJlGDuGo1OIlL3Bwp5MKg.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/googlesans/v36/4UaGrENHsxJlGDuGo1OIlL3Kwp5MKg.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/googlesans/v36/4UaGrENHsxJlGDuGo1OIlL3Nwp5MKg.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/googlesans/v36/4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/googlesans/v36/4UabrENHsxJlGDuGo1OIlLU94Yt3CwZ-Pw.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/googlesans/v36/4UabrENHsxJlGDuGo1OIlLU94Yt8CwZ-Pw.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/googlesans/v36/4UabrENHsxJlGDuGo1OIlLU94Yt9CwZ-Pw.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/googlesans/v36/4UabrENHsxJlGDuGo1OIlLU94YtwCwZ-Pw.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/googlesans/v36/4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/merriweather/v25/u-440qyriQwlOrhSvowK_l5-cSZMZ-Y.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/merriweather/v25/u-440qyriQwlOrhSvowK_l5-ciZMZ-Y.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/merriweather/v25/u-440qyriQwlOrhSvowK_l5-cyZMZ-Y.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/merriweather/v25/u-440qyriQwlOrhSvowK_l5-eCZMZ-Y.woff2)
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/merriweather/v25/u-440qyriQwlOrhSvowK_l5-fCZM.woff2
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/merriweather/v25/u-440qyriQwlOrhSvowK_l5-fCZM.woff2)
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/merriweather/v25/u-440qyriQwlOrhSvowK_l5-fCZM.woff29
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/merriweather/v25/u-4n0qyriQwlOrhSvowK_l52xwNZV8f6lvg.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/merriweather/v25/u-4n0qyriQwlOrhSvowK_l52xwNZVcf6lvg.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/merriweather/v25/u-4n0qyriQwlOrhSvowK_l52xwNZVsf6lvg.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/merriweather/v25/u-4n0qyriQwlOrhSvowK_l52xwNZWMf6.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/merriweather/v25/u-4n0qyriQwlOrhSvowK_l52xwNZXMf6lvg.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsans/v12/jizaRExUiTo99u79D0-ExdGM.woff2)
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsans/v12/jizaRExUiTo99u79D0KExQ.woff2
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsans/v12/jizaRExUiTo99u79D0KExQ.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsans/v12/jizaRExUiTo99u79D0aExdGM.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsans/v12/jizaRExUiTo99u79D0yExdGM.woff2)
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsans/v12/jizfRExUiTo99u79B_mh0O6tLQ.woff2
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsans/v12/jizfRExUiTo99u79B_mh0O6tLQ.woff2)
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsans/v12/jizfRExUiTo99u79B_mh0O6tLQ.woff2t
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsans/v12/jizfRExUiTo99u79B_mh0OCtLQ0Z.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsans/v12/jizfRExUiTo99u79B_mh0OOtLQ0Z.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsans/v12/jizfRExUiTo99u79B_mh0OqtLQ0Z.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmEU9fABc4EsA.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmEU9fBBc4.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmEU9fBxc4EsA.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmEU9fCBc4EsA.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmEU9fCRc4EsA.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmEU9fChc4EsA.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmEU9fCxc4EsA.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmSU5fABc4EsA.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmSU5fBBc4.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmSU5fBxc4EsA.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmSU5fCBc4EsA.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmSU5fCRc4EsA.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmSU5fChc4EsA.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmSU5fCxc4EsA.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmWUlfABc4EsA.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmWUlfBBc4.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmWUlfBxc4EsA.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmWUlfCBc4EsA.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmWUlfCRc4EsA.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmWUlfChc4EsA.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmWUlfCxc4EsA.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu4WxKOzY.woff2)
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff2
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff2)
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff24
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu5mxKOzY.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu72xKOzY.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu7GxKOzY.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu7WxKOzY.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu7mxKOzY.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/sourcecodepro/v14/HI_SiYsKILxRpg3hIP6sJ7fM7PqlM-vWjMY.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/sourcecodepro/v14/HI_SiYsKILxRpg3hIP6sJ7fM7PqlMOvWjMY.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/sourcecodepro/v14/HI_SiYsKILxRpg3hIP6sJ7fM7PqlMuvWjMY.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/sourcecodepro/v14/HI_SiYsKILxRpg3hIP6sJ7fM7PqlOevWjMY.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/sourcecodepro/v14/HI_SiYsKILxRpg3hIP6sJ7fM7PqlPevW.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/sourcecodepro/v14/HI_SiYsKILxRpg3hIP6sJ7fM7PqlPuvWjMY.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/sourcecodepro/v14/HI_XiYsKILxRpg3hIP6sJ7fM7Pqths7Ds-cq.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/sourcecodepro/v14/HI_XiYsKILxRpg3hIP6sJ7fM7Pqths7DsOcq_mk.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/sourcecodepro/v14/HI_XiYsKILxRpg3hIP6sJ7fM7Pqths7Dt-cq_mk.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/sourcecodepro/v14/HI_XiYsKILxRpg3hIP6sJ7fM7Pqths7DvOcq_mk.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/sourcecodepro/v14/HI_XiYsKILxRpg3hIP6sJ7fM7Pqths7Dvecq_mk.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/sourcecodepro/v14/HI_XiYsKILxRpg3hIP6sJ7fM7Pqths7Dvucq_mk.woff2)
Source: manifest.json0.1.dr	String found in binary or memory: https://fonts.gstatic.com;
Source: angular.js.1.dr	String found in binary or memory: https://github.com/angular/material
Source: craw_background.js.1.dr, craw_window.js.1.dr	String found in binary or memory: https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: https://github.com/madler/zlib/blob/master/zlib.h
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: https://hangouts.clients6.google.com
Source: manifest.json0.1.dr	String found in binary or memory: https://hangouts.google.com/
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: https://hangouts.google.com/hangouts/_/logpref
Source: data_3.2.dr	String found in binary or memory: https://ka-f.fontawesome.com
Source: Network Action Predictor.1.dr	String found in binary or memory: https://ka-f.fontawesome.com/
Source: data_1.2.dr	String found in binary or memory: https://ka-f.fontawesome.com/releases/v5.15.4/css/free-v4-shims.min.css?token=585b051251
Source: data_1.2.dr	String found in binary or memory: https://ka-f.fontawesome.com/releases/v5.15.4/css/free.min.css?token=585b051251
Source: data_3.2.dr	String found in binary or memory: https://kit.fontawesome.com
Source: Network Action Predictor.1.dr	String found in binary or memory: https://kit.fontawesome.com/
Source: data_1.2.dr	String found in binary or memory: https://kit.fontawesome.com/585b051251.js
Source: data_1.2.dr	String found in binary or memory: https://lh3.googleusercontent.com/IwmLUvtIqThIvnfdEEHHoPhAe5C_NUEitKRzYMy7kPDgx38hd85CBDIx9U8O5vD0hn
Source: data_1.2.dr	String found in binary or memory: https://lh3.googleusercontent.com/SDY-NvgrYAl40__zoIzYoPyOmAaFt9r_mfo5Qe3WIZAGcol2bp1pfQg7VYL4jME-lh
Source: data_1.2.dr	String found in binary or memory: https://lh3.googleusercontent.com/ckIxcdzCDH0ydZ5pgF75ycZexs1Wq6Pk3oB8rTWv6g4b9FCcq8TZILzzZ6hoB4Ek0J
Source: data_1.2.dr	String found in binary or memory: https://lh4.googleusercontent.com/57f7rkt25N-Sz_RrSHdJ4Rky7sTiMjAg5pqhozAjUc3pKi17UV7x1mQRJQJTB6cgol
Source: data_1.2.dr	String found in binary or memory: https://lh4.googleusercontent.com/JQ6sqiCzBsJ2xkg8EN5RNmmF0WPptTvvHXEJZ3IFFtidowlpGMVtxfg7C3TisXVOsC
Source: data_1.2.dr	String found in binary or memory: https://lh4.googleusercontent.com/hHPMlNEXVwxMRGKK82th9B9-Z3K7k4HkxEU_RVWKMt7TFGoqxx7HxSvuOkj6bD_VtT
Source: data_1.2.dr	String found in binary or memory: https://lh4.googleusercontent.com/leXlyFb8ZAw9ToXNOiNfX8L0P48pVl2oVk7o6q5gOoch1PQJXKM7kKnRUk5ztXf0Tb
Source: d7dfb4f8-9e9c-4041-9cb8-f2c60e0843d7.tmp.2.dr	String found in binary or memory: https://lh5.googleusercontent.com
Source: data_1.2.dr	String found in binary or memory: https://lh5.googleusercontent.com/a-YMp0JaYoEhpKIppbVSS1sgxNbwPPdyIgQXPKb-sws32f2UraEI3Md4Sj_yF9B94r
Source: data_1.2.dr	String found in binary or memory: https://lh5.googleusercontent.com/h80L2troHbBjeeTEyaqQzG8iJgPapwnTUyxCbccoS80Iq7PXsqof7YGqgw0Vegn2O4
Source: data_1.2.dr	String found in binary or memory: https://lh5.googleusercontent.com/mnBG68NCBxKJ8IXvdb5REYiZ31mapY2Xx6EnK4hAisZBJ_g5ueUBNY3Quna9e8WEo2
Source: data_1.2.dr	String found in binary or memory: https://lh6.googleusercontent.com/Ux__2ZuxpaNRY_9zrbSlXuT6zXkFB6lmFsGEf2eh-z1pjDCn6dh2A2NokwQRencZ-e
Source: data_1.2.dr	String found in binary or memory: https://lh6.googleusercontent.com/Wuju_iSfQw98vVM2cidnCzo5aJ_ludxJNUaULDvbhm5jbhXwX9kkiMmUcAvpLCUE5D
Source: data_1.2.dr	String found in binary or memory: https://lh6.googleusercontent.com/pSnATPPoYUFrOvgsRmaNvw15Cnf_nxEPsmWWAPHiTO7_Pg7orNNTok24Nh1jg2SlfR
Source: Network Action Predictor.1.dr	String found in binary or memory: https://maxcdn.bootstrapcdn.com/
Source: data_1.2.dr	String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css
Source: data_1.2.dr	String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js
Source: mirroring_common.js.1.dr	String found in binary or memory: https://meet.google.com
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: https://meetings.clients6.google.com
Source: mirroring_common.js.1.dr	String found in binary or memory: https://networktraversal.googleapis.com/v1alpha
Source: 2bfd2cea-8496-4f4b-892a-dae10d8b850f.tmp.2.dr, d7dfb4f8-9e9c-4041-9cb8-f2c60e0843d7.tmp.2.dr	String found in binary or memory: https://ogs.google.com
Source: manifest.json.1.dr, craw_window.js.1.dr	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: data_3.2.dr	String found in binary or memory: https://pki.goog/repository/0
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: https://preprod-hangouts-googleapis.sandbox.google.com
Source: d7dfb4f8-9e9c-4041-9cb8-f2c60e0843d7.tmp.2.dr	String found in binary or memory: https://r4---sn-4g5ednsl.gvt1.com
Source: data_1.2.dr	String found in binary or memory: https://r4---sn-4g5ednsl.gvt1.com/edgedl/chrome/dict/en-us-9-0.bdic?cms_redirect=yes&mh=I2&mip=84.17
Source: d7dfb4f8-9e9c-4041-9cb8-f2c60e0843d7.tmp.2.dr	String found in binary or memory: https://redirector.gvt1.com
Source: data_1.2.dr	String found in binary or memory: https://redirector.gvt1.com/edgedl/chrome/dict/en-us-9-0.bdic
Source: manifest.json.1.dr, craw_window.js.1.dr	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: Network Action Predictor.1.dr	String found in binary or memory: https://seedsmtp.com/
Source: data_1.2.dr	String found in binary or memory: https://seedsmtp.com/email-list/mnb/css/hover.css
Source: data_1.2.dr	String found in binary or memory: https://seedsmtp.com/email-list/mnb/css/hover.cssoP
Source: data_1.2.dr	String found in binary or memory: https://seedsmtp.com/email-list/mnb/images/8.jpg
Source: data_1.2.dr	String found in binary or memory: https://seedsmtp.com/email-list/mnb/images/adobe.jpg
Source: data_1.2.dr	String found in binary or memory: https://seedsmtp.com/email-list/mnb/images/gmail.png
Source: data_1.2.dr	String found in binary or memory: https://seedsmtp.com/email-list/mnb/images/office3651.png
Source: data_1.2.dr	String found in binary or memory: https://seedsmtp.com/email-list/mnb/images/other1.png
Source: data_1.2.dr	String found in binary or memory: https://seedsmtp.com/email-list/mnb/images/other1.pngMc
Source: data_1.2.dr	String found in binary or memory: https://seedsmtp.com/email-list/mnb/images/outlook1.png
Source: Current Session.1.dr, d7dfb4f8-9e9c-4041-9cb8-f2c60e0843d7.tmp.2.dr	String found in binary or memory: https://sites.google.com
Source: 000003.log5.1.dr	String found in binary or memory: https://sites.google.com/
Source: Current Session.1.dr	String found in binary or memory: https://sites.google.com/view/49ershome/faq
Source: Favicons.1.dr	String found in binary or memory: https://sites.google.com/view/49ershome/faq0
Source: Current Session.1.dr	String found in binary or memory: https://sites.google.com/view/49ershome/faq11
Source: History.1.dr	String found in binary or memory: https://sites.google.com/view/49ershome/faq49ers
Source: Current Session.1.dr	String found in binary or memory: https://sites.google.com/view/49ershome/faqmW
Source: Current Session.1.dr	String found in binary or memory: https://sites.google.com/view/49ershome/history
Source: Current Session.1.dr	String found in binary or memory: https://sites.google.com/view/49ershome/history#h.a887fllea086
Source: History.1.dr	String found in binary or memory: https://sites.google.com/view/49ershome/history#h.a887fllea08649ers
Source: Favicons.1.dr	String found in binary or memory: https://sites.google.com/view/49ershome/history#h.a887fllea086C
Source: Current Session.1.dr	String found in binary or memory: https://sites.google.com/view/49ershome/history#h.a887fllea086Z
Source: Current Session.1.dr	String found in binary or memory: https://sites.google.com/view/49ershome/history#h.afyj9j9g00b0
Source: Favicons.1.dr	String found in binary or memory: https://sites.google.com/view/49ershome/history#h.afyj9j9g00b0/
Source: History.1.dr	String found in binary or memory: https://sites.google.com/view/49ershome/history#h.afyj9j9g00b049ers
Source: Current Session.1.dr	String found in binary or memory: https://sites.google.com/view/49ershome/history#h.wz7mar23iqyu
Source: History.1.dr	String found in binary or memory: https://sites.google.com/view/49ershome/history#h.wz7mar23iqyu49ers
Source: Favicons.1.dr	String found in binary or memory: https://sites.google.com/view/49ershome/history#h.wz7mar23iqyuC
Source: Current Session.1.dr	String found in binary or memory: https://sites.google.com/view/49ershome/history#h.wz7mar23iqyuS
Source: Favicons.1.dr	String found in binary or memory: https://sites.google.com/view/49ershome/history0
Source: History.1.dr	String found in binary or memory: https://sites.google.com/view/49ershome/history49ers
Source: Current Session.1.dr	String found in binary or memory: https://sites.google.com/view/49ershome/home
Source: History Provider Cache.1.dr	String found in binary or memory: https://sites.google.com/view/49ershome/home2
Source: History.1.dr	String found in binary or memory: https://sites.google.com/view/49ershome/home49ers
Source: Current Session.1.dr	String found in binary or memory: https://sites.google.com/view/49ershome/homeOBM
Source: Current Session.1.dr	String found in binary or memory: https://sites.google.com/view/49ershome/team
Source: Current Session.1.dr	String found in binary or memory: https://sites.google.com/view/49ershome/team#h.a4rji4pxv1xr
Source: History.1.dr	String found in binary or memory: https://sites.google.com/view/49ershome/team#h.a4rji4pxv1xr49ers
Source: Favicons.1.dr	String found in binary or memory: https://sites.google.com/view/49ershome/team#h.a4rji4pxv1xrC
Source: Current Session.1.dr	String found in binary or memory: https://sites.google.com/view/49ershome/team#h.mc9c3iu9koq0
Source: History.1.dr	String found in binary or memory: https://sites.google.com/view/49ershome/team#h.mc9c3iu9koq049ers
Source: Current Session.1.dr	String found in binary or memory: https://sites.google.com/view/49ershome/team#h.mc9c3iu9koq0U
Source: Current Session.1.dr	String found in binary or memory: https://sites.google.com/view/49ershome/team#h.mc9c3iu9koq0f
Source: Current Session.1.dr	String found in binary or memory: https://sites.google.com/view/49ershome/team#h.u12q2quik1io
Source: History.1.dr	String found in binary or memory: https://sites.google.com/view/49ershome/team#h.u12q2quik1io49ers
Source: Favicons.1.dr	String found in binary or memory: https://sites.google.com/view/49ershome/team3
Source: History.1.dr	String found in binary or memory: https://sites.google.com/view/49ershome/team49ers
Source: 2bfd2cea-8496-4f4b-892a-dae10d8b850f.tmp.2.dr, d7dfb4f8-9e9c-4041-9cb8-f2c60e0843d7.tmp.2.dr	String found in binary or memory: https://ssl.gstatic.com
Source: data_1.2.dr	String found in binary or memory: https://ssl.gstatic.com/atari/images/public/favicon.ico
Source: messages.json109.1.dr, feedback.html.1.dr	String found in binary or memory: https://support.google.com/chromecast/answer/2998456
Source: messages.json109.1.dr, feedback.html.1.dr	String found in binary or memory: https://support.google.com/chromecast/troubleshooter/2995236
Source: craw_background.js.1.dr, craw_window.js.1.dr	String found in binary or memory: https://www-googleapis-staging.sandbox.google.com
Source: Current Session.1.dr, d7dfb4f8-9e9c-4041-9cb8-f2c60e0843d7.tmp.2.dr	String found in binary or memory: https://www.google.com
Source: manifest.json.1.dr	String found in binary or memory: https://www.google.com/
Source: craw_window.js.1.dr	String found in binary or memory: https://www.google.com/accounts/OAuthLogin?issueuberauth=1
Source: craw_window.js.1.dr	String found in binary or memory: https://www.google.com/images/cleardot.gif
Source: craw_window.js.1.dr	String found in binary or memory: https://www.google.com/images/dot2.gif
Source: craw_window.js.1.dr	String found in binary or memory: https://www.google.com/images/x2.gif
Source: craw_background.js.1.dr	String found in binary or memory: https://www.google.com/intl/en-US/chrome/blank.html
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: https://www.google.com/log?format=json&hasfast=true
Source: feedback_script.js.1.dr	String found in binary or memory: https://www.google.com/tools/feedback
Source: data_1.2.dr, Current Session.1.dr	String found in binary or memory: https://www.google.com/url?q=https%3A%2F%2Fchelp-ethanim-mosetena.s3.us-west-002.backblazeb2.com%2Fi
Source: manifest.json0.1.dr	String found in binary or memory: https://www.google.com;
Source: 2bfd2cea-8496-4f4b-892a-dae10d8b850f.tmp.2.dr, craw_background.js.1.dr, craw_window.js.1.dr, d7dfb4f8-9e9c-4041-9cb8-f2c60e0843d7.tmp.2.dr	String found in binary or memory: https://www.googleapis.com
Source: manifest.json.1.dr	String found in binary or memory: https://www.googleapis.com/
Source: manifest.json0.1.dr	String found in binary or memory: https://www.googleapis.com/auth/calendar.readonly
Source: manifest.json0.1.dr	String found in binary or memory: https://www.googleapis.com/auth/cast-edu-messaging
Source: manifest.json.1.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json.1.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json0.1.dr	String found in binary or memory: https://www.googleapis.com/auth/clouddevices
Source: manifest.json0.1.dr	String found in binary or memory: https://www.googleapis.com/auth/hangouts
Source: manifest.json0.1.dr	String found in binary or memory: https://www.googleapis.com/auth/hangouts.readonly
Source: manifest.json0.1.dr	String found in binary or memory: https://www.googleapis.com/auth/meetings
Source: manifest.json0.1.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.peopleapi.readwrite
Source: manifest.json.1.dr	String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json.1.dr	String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: manifest.json0.1.dr	String found in binary or memory: https://www.googleapis.com/auth/userinfo.email
Source: mirroring_common.js.1.dr	String found in binary or memory: https://www.googleapis.com/calendar/v3
Source: mirroring_common.js.1.dr	String found in binary or memory: https://www.googleapis.com/hangouts/v1
Source: 2bfd2cea-8496-4f4b-892a-dae10d8b850f.tmp.2.dr, d7dfb4f8-9e9c-4041-9cb8-f2c60e0843d7.tmp.2.dr	String found in binary or memory: https://www.gstatic.com
Source: Network Action Predictor.1.dr	String found in binary or memory: https://www.gstatic.com/
Source: data_1.2.dr	String found in binary or memory: https://www.gstatic.com/_/atari/_/js/k=atari.vw.en_US.m14rGEYw8fs.O/d=0/rs=AGEqA5m5P6w8g6GLcp5Wq4Su3
Source: data_1.2.dr	String found in binary or memory: https://www.gstatic.com/_/atari/_/js/k=atari.vw.en_US.m14rGEYw8fs.O/d=1/rs=AGEqA5m5P6w8g6GLcp5Wq4Su3
Source: data_1.2.dr	String found in binary or memory: https://www.gstatic.com/_/atari/_/ss/k=atari.vw.wbBIHhCxm1k.L.W.O/d=1/rs=AGEqA5kjq1g0trBB7Qrv-sqvQrW
Source: common.js.1.dr	String found in binary or memory: https://www.gstatic.com/hangouts_echo_detector/release/%
Source: manifest.json0.1.dr	String found in binary or memory: https://www.gstatic.com;

Posts data to webserver

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 216.58.212.161:443 -> 192.168.2.5:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.212.161:443 -> 192.168.2.5:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.212.161:443 -> 192.168.2.5:49807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.87.42:443 -> 192.168.2.5:49849 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.87.42:443 -> 192.168.2.5:49848 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.212.161:443 -> 192.168.2.5:49879 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.212.161:443 -> 192.168.2.5:49880 version: TLS 1.2

System Summary:

Creates temporary files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Temp\4bd3eda2-d36e-4852-9670-24aa6a23d805.tmp

Jump to behavior

Classification label

Source: classification engine

Classification label: mal84.phis.win@43/234@24/14

Spawns processes

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --start-maximized --enable-automation 'https://sites.google.com/view/49ershome/home'
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1528,8355766382578731240,2161950285944953377,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1908 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1528,8355766382578731240,2161950285944953377,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1908 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior

Found detection on Joe Sandbox Cloud Basic with higher score

Source: https://sites.google.com/view/49ershome/home

Joe Sandbox Cloud Basic: Detection: clean Score: 0

Perma Link

Creates files inside the program directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\Chrome\Application\Dictionaries

Jump to behavior

Creates files inside the user directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-617A196F-CA8.pma

Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Creates a directory in C:\Program Files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic			Jump to behavior