Windows Analysis Report https://dn6orrtz.sibpages.com/

AV Detection:

Antivirus / Scanner detection for submitted sample

Source: https://dn6orrtz.sibpages.com/

SlashNext: detection malicious, Label: Fake Login Page type: Phishing & Social Engineering

Antivirus detection for URL or domain

Source: https://garythegreatesthypnotist.com/CD/One-File/

SlashNext: Label: Fake Login Page type: Phishing & Social Engineering

Phishing:

Yara detected HtmlPhish10

Source: Yara match	File source: 07755.1.pages.csv, type: HTML
Source: Yara match	File source: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache\data_3, type: DROPPED

Phishing site detected (based on logo template match)

Source: https://garythegreatesthypnotist.com/CD/One-File/

Matcher: Template: office matched

No HTML title found

Source: https://garythegreatesthypnotist.com/CD/One-File/	HTTP Parser: HTML title missing
Source: https://garythegreatesthypnotist.com/CD/One-File/	HTTP Parser: HTML title missing

HTML body contains low number of good links

Source: https://garythegreatesthypnotist.com/CD/One-File/	HTTP Parser: Number of links: 0
Source: https://garythegreatesthypnotist.com/CD/One-File/	HTTP Parser: Number of links: 0

Suspicious form URL found

Source: https://garythegreatesthypnotist.com/CD/One-File/	HTTP Parser: Form action: login.php
Source: https://garythegreatesthypnotist.com/CD/One-File/	HTTP Parser: Form action: login.php

META author tag missing

Source: https://garythegreatesthypnotist.com/CD/One-File/	HTTP Parser: No <meta name="author".. found
Source: https://garythegreatesthypnotist.com/CD/One-File/	HTTP Parser: No <meta name="author".. found

META copyright tag missing

Source: https://garythegreatesthypnotist.com/CD/One-File/	HTTP Parser: No <meta name="copyright".. found
Source: https://garythegreatesthypnotist.com/CD/One-File/	HTTP Parser: No <meta name="copyright".. found

Compliance:

Creates license or readme file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Temp\3028_230581275\LICENSE.txt

Jump to behavior

Creates a directory in C:\Program Files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic			Jump to behavior

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 192.124.249.52:443 -> 192.168.2.3:49823 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 161.71.19.193:443 -> 192.168.2.3:49821 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 69.49.245.88:443 -> 192.168.2.3:49822 version: TLS 1.2

Networking:

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Found strings which match to known social media urls

Source: Ruleset Data.0.dr	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: Filtering Rules.0.dr, Ruleset Data.0.dr	String found in binary or memory: www.facebook.com/ajax/ads/ equals www.facebook.com (Facebook)
Source: Filtering Rules.0.dr	String found in binary or memory: www.facebook.com0 equals www.facebook.com (Facebook)

Tries to download or post to a non-existing HTTP route (HTTP/1.1 404 Not Found / 503 Service Unavailable / 403 Forbidden)

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Jan 2022 05:59:18 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeCF-Ray: 6cd4a32bda462c52-FRAAccept-Ranges: bytesAccess-Control-Allow-Origin: *Cache-Control: public, max-age=0, s-maxage=86400Expires: Sat, 15 Jan 2022 05:59:18 GMTLast-Modified: Thu, 10 Aug 2017 21:37:53 GMTCF-Cache-Status: DYNAMICAccess-Control-Expose-Headers: OriginAccess-Control-Expose-Headers: Content-TypeAccess-Control-Expose-Headers: Content-LengthAccess-Control-Expose-Headers: Accept-EncodingAccess-Control-Expose-Headers: Access-Control-Allow-Originx-goog-generation: 1502401073227573x-goog-hash: crc32c=+YKW4g==x-goog-hash: md5=MJKU9zfU5B5WD7MYRo3syQ==x-goog-metageneration: 2x-goog-storage-class: STANDARDx-goog-stored-content-encoding: identityx-goog-stored-content-length: 1458X-GUploader-UploadID: ADPycdtATLe_Uq8hJZLcQDK-SQ4JS6Tq9zgU1hrYuxuhrn9DUo7yAVyvBWveTrcNeuUoErQEDKJ0MykbBedtQUeMngExpect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"Server: cloudflare
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Jan 2022 05:59:24 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Jan 2022 05:59:24 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Jan 2022 05:59:24 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Jan 2022 05:59:27 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Jan 2022 05:59:28 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1

URLs found in memory or binary data

Source: angular.js.0.dr	String found in binary or memory: http://angularjs.org
Source: data_3.1.dr	String found in binary or memory: http://crl.pki.goog/gsr1/gsr1.crl0;
Source: data_3.1.dr	String found in binary or memory: http://crl.pki.goog/gtsr1/gtsr1.crl0W
Source: data_3.1.dr	String found in binary or memory: http://crls.pki.goog/gts1c3/QOvJ0N1sT2A.crl0
Source: data_3.1.dr	String found in binary or memory: http://crls.pki.goog/gts1c3/zdATt0Ex_Fk.crl0
Source: angular.js.0.dr	String found in binary or memory: http://errors.angularjs.org/1.6.4-local
Source: data_3.1.dr	String found in binary or memory: http://feross.org
Source: pnacl_public_x86_64_pnacl_sz_nexe.0.dr, pnacl_public_x86_64_pnacl_llc_nexe.0.dr	String found in binary or memory: http://llvm.org/):
Source: data_3.1.dr	String found in binary or memory: http://ocsp.pki.goog/gsr10)
Source: data_3.1.dr	String found in binary or memory: http://ocsp.pki.goog/gts1c301
Source: data_3.1.dr	String found in binary or memory: http://ocsp.pki.goog/gtsr100
Source: data_3.1.dr	String found in binary or memory: http://pki.goog/gsr1/gsr1.crt02
Source: data_3.1.dr	String found in binary or memory: http://pki.goog/repo/certs/gts1c3.der0
Source: data_3.1.dr	String found in binary or memory: http://pki.goog/repo/certs/gts1c3.der0M
Source: data_3.1.dr	String found in binary or memory: http://pki.goog/repo/certs/gtsr1.der04
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: http://tools.ietf.org/html/rfc1950
Source: mirroring_hangouts.js.0.dr, data_3.1.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01
Source: Reporting and NEL.1.dr	String found in binary or memory: https://a.nel.cloudflare.com/report/v3?s=mGCvoSdFVqjXBhFaYqBtWtSqK9r3HsHzazdRH70aCyccci1nb2M9QffeqM7
Source: 56de4013-6a01-4062-a2ef-3500f84e9638.tmp.1.dr, manifest.json4.0.dr, e91645b6-4ab5-4c29-aa23-58439b7515b3.tmp.1.dr	String found in binary or memory: https://accounts.google.com
Source: craw_window.js.0.dr	String found in binary or memory: https://accounts.google.com/MergeSession
Source: 56de4013-6a01-4062-a2ef-3500f84e9638.tmp.1.dr, manifest.json4.0.dr, e91645b6-4ab5-4c29-aa23-58439b7515b3.tmp.1.dr	String found in binary or memory: https://apis.google.com
Source: data_1.1.dr	String found in binary or memory: https://cdn.convrrt.com/apps/sendinblue/4361062/bf8270e0-f572-4e74-aaba-eec891007c9f.png
Source: data_1.1.dr	String found in binary or memory: https://cdn.convrrt.com/apps/sendinblue/4361062/bf8270e0-f572-4e74-aaba-eec891007c9f.pngD
Source: data_2.1.dr	String found in binary or memory: https://cdn.convrrt.com/assets/ISO-3166/data
Source: data_1.1.dr	String found in binary or memory: https://cdn.convrrt.com/assets/analyze/analytics.f941af9754702a18190a.js
Source: data_1.1.dr	String found in binary or memory: https://cdn.convrrt.com/assets/css/v2/core-67c779b.min.css
Source: data_1.1.dr	String found in binary or memory: https://cdn.convrrt.com/libs/core/v2/6794dd4/0.chunk.js
Source: data_1.1.dr	String found in binary or memory: https://cdn.convrrt.com/libs/core/v2/6794dd4/1.chunk.js
Source: data_1.1.dr	String found in binary or memory: https://cdn.convrrt.com/libs/core/v2/6794dd4/1.chunk.js(window.webpackJsonp=window.webpackJsonp
Source: data_1.1.dr	String found in binary or memory: https://cdn.convrrt.com/libs/core/v2/6794dd4/10.chunk.js
Source: data_1.1.dr	String found in binary or memory: https://cdn.convrrt.com/libs/core/v2/6794dd4/11.chunk.js
Source: data_1.1.dr	String found in binary or memory: https://cdn.convrrt.com/libs/core/v2/6794dd4/11.chunk.jst
Source: data_1.1.dr	String found in binary or memory: https://cdn.convrrt.com/libs/core/v2/6794dd4/12.chunk.js
Source: data_1.1.dr	String found in binary or memory: https://cdn.convrrt.com/libs/core/v2/6794dd4/13.chunk.js
Source: data_1.1.dr	String found in binary or memory: https://cdn.convrrt.com/libs/core/v2/6794dd4/14.chunk.js
Source: data_1.1.dr	String found in binary or memory: https://cdn.convrrt.com/libs/core/v2/6794dd4/14.chunk.js(window.webpackJsonp=window.webpackJsonp
Source: data_1.1.dr	String found in binary or memory: https://cdn.convrrt.com/libs/core/v2/6794dd4/2.chunk.js
Source: data_1.1.dr	String found in binary or memory: https://cdn.convrrt.com/libs/core/v2/6794dd4/3.chunk.js
Source: data_1.1.dr	String found in binary or memory: https://cdn.convrrt.com/libs/core/v2/6794dd4/4.chunk.js
Source: data_1.1.dr	String found in binary or memory: https://cdn.convrrt.com/libs/core/v2/6794dd4/4.chunk.js~
Source: data_1.1.dr	String found in binary or memory: https://cdn.convrrt.com/libs/core/v2/6794dd4/6.chunk.js
Source: data_1.1.dr	String found in binary or memory: https://cdn.convrrt.com/libs/core/v2/6794dd4/7.chunk.js
Source: data_1.1.dr	String found in binary or memory: https://cdn.convrrt.com/libs/core/v2/6794dd4/7.chunk.js5
Source: data_1.1.dr	String found in binary or memory: https://cdn.convrrt.com/libs/core/v2/6794dd4/8.chunk.js
Source: data_1.1.dr	String found in binary or memory: https://cdn.convrrt.com/libs/core/v2/6794dd4/9.chunk.js
Source: data_1.1.dr	String found in binary or memory: https://cdn.convrrt.com/libs/core/v2/6794dd4/9.chunk.js/
Source: data_1.1.dr	String found in binary or memory: https://cdn.convrrt.com/libs/core/v2/6794dd4/main.bundle.js
Source: data_1.1.dr	String found in binary or memory: https://cdn.convrrt.com/vendor/font-awesome/4.7.0/css/font-awesome.min.css
Source: data_1.1.dr	String found in binary or memory: https://cdn.convrrt.com/vendor/themify/themify-icons.css
Source: data_1.1.dr	String found in binary or memory: https://cdn.jsdelivr.net/npm/flatpickr/dist/flatpickr.min.css
Source: data_1.1.dr	String found in binary or memory: https://cdn.jsdelivr.net/npm/flatpickr/dist/flatpickr.min.cssW
Source: data_1.1.dr	String found in binary or memory: https://cdn.jsdelivr.net/npm/froala-editor
Source: data_1.1.dr	String found in binary or memory: https://cdn.jsdelivr.net/npm/gridstack
Source: data_1.1.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/intl-tel-input/16.0.4/css/intlTelInput.css
Source: data_1.1.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/intl-tel-input/16.0.4/js/intlTelInput.min.js
Source: data_2.1.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css
Source: pnacl_public_x86_64_libcrt_platform_a.0.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-clang.git
Source: pnacl_public_x86_64_libcrt_platform_a.0.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-llvm.git
Source: 56de4013-6a01-4062-a2ef-3500f84e9638.tmp.1.dr, e91645b6-4ab5-4c29-aa23-58439b7515b3.tmp.1.dr	String found in binary or memory: https://clients2.google.com
Source: mirroring_hangouts.js.0.dr, mirroring_cast_streaming.js.0.dr	String found in binary or memory: https://clients2.google.com/cr/report
Source: manifest.json0.0.dr, manifest.json4.0.dr, manifest.json.0.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 56de4013-6a01-4062-a2ef-3500f84e9638.tmp.1.dr, e91645b6-4ab5-4c29-aa23-58439b7515b3.tmp.1.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://clients6.google.com
Source: pnacl_public_x86_64_ld_nexe.0.dr	String found in binary or memory: https://code.google.com/p/nativeclient/issues/entry
Source: pnacl_public_x86_64_ld_nexe.0.dr	String found in binary or memory: https://code.google.com/p/nativeclient/issues/entry%s:
Source: e91645b6-4ab5-4c29-aa23-58439b7515b3.tmp.1.dr	String found in binary or memory: https://content-autofill.googleapis.com
Source: data_1.1.dr	String found in binary or memory: https://content-autofill.googleapis.com/v1/pages/Chc2LjEuMTcxNS4xNDQyL2VuIChHR0xMKRIfCUpGpmHrB3_GEgk
Source: manifest.json4.0.dr	String found in binary or memory: https://content.googleapis.com
Source: data_1.1.dr	String found in binary or memory: https://convrrt-v3.firebaseio.com
Source: mirroring_cast_streaming.js.0.dr	String found in binary or memory: https://crash.corp.google.com/samples?reportid=&q=
Source: LICENSE.txt.0.dr	String found in binary or memory: https://creativecommons.org/.
Source: LICENSE.txt.0.dr	String found in binary or memory: https://creativecommons.org/compatiblelicenses
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://creativecommons.org/publicdomain/zero/1.0/.
Source: data_2.1.dr, data_3.1.dr	String found in binary or memory: https://csp.withgoogle.com/csp/apps-themes
Source: data_2.1.dr	String found in binary or memory: https://csp.withgoogle.com/csp/apps-themesCross-Origin-Opener-Policy-Report-Only:
Source: data_2.1.dr	String found in binary or memory: https://csp.withgoogle.com/csp/apps-themesCross-Origin-Resource-Policy:
Source: data_3.1.dr	String found in binary or memory: https://csp.withgoogle.com/csp/apps-themescross-origin-opener-policy-report-only:same-origin;
Source: data_3.1.dr	String found in binary or memory: https://csp.withgoogle.com/csp/apps-themescross-origin-resource-policy:cross-origincross-origin-open
Source: data_2.1.dr	String found in binary or memory: https://csp.withgoogle.com/csp/recaptcha
Source: data_2.1.dr	String found in binary or memory: https://csp.withgoogle.com/csp/recaptchaCross-Origin-Opener-Policy:
Source: data_3.1.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/apps-themes
Source: data_2.1.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/recaptcha
Source: Reporting and NEL.1.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/recaptcha_
Source: 000003.log5.0.dr	String found in binary or memory: https://dn6orrtz.sibpages.com
Source: Current Session.0.dr	String found in binary or memory: https://dn6orrtz.sibpages.com/
Source: Current Session.0.dr	String found in binary or memory: https://dn6orrtz.sibpages.com/%
Source: History Provider Cache.0.dr	String found in binary or memory: https://dn6orrtz.sibpages.com/2
Source: data_1.1.dr	String found in binary or memory: https://dn6orrtz.sibpages.com/favicon.ico
Source: data_1.1.dr	String found in binary or memory: https://dn6orrtz.sibpages.com/favicon.icoD
Source: 7a984880-f815-42c5-80c4-b96023e69993.tmp.1.dr, 56de4013-6a01-4062-a2ef-3500f84e9638.tmp.1.dr, e4bc7d5e-1108-4d52-bbb4-235e5bec2c39.tmp.1.dr, e91645b6-4ab5-4c29-aa23-58439b7515b3.tmp.1.dr	String found in binary or memory: https://dns.google
Source: LICENSE.txt.0.dr	String found in binary or memory: https://easylist.to/)
Source: data_3.1.dr	String found in binary or memory: https://f.fontdeck.com/s/css/js/
Source: manifest.json4.0.dr	String found in binary or memory: https://feedback.googleusercontent.com
Source: 56de4013-6a01-4062-a2ef-3500f84e9638.tmp.1.dr, e91645b6-4ab5-4c29-aa23-58439b7515b3.tmp.1.dr	String found in binary or memory: https://fonts.googleapis.com
Source: data_1.1.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=PT
Source: data_1.1.dr	String found in binary or memory: https://fonts.googleapis.com/icon?family=Material
Source: manifest.json4.0.dr	String found in binary or memory: https://fonts.googleapis.com;
Source: data_3.1.dr, e91645b6-4ab5-4c29-aa23-58439b7515b3.tmp.1.dr	String found in binary or memory: https://fonts.gstatic.com
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/abrilfatface/v12/zOL64pLDlL1D99S8g8PtiKchq-dmjQ.woff2
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/adventpro/v11/V8mAoQfxVT4Dvddr_yOwhTqtKA.woff2
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/adventpro/v11/V8mAoQfxVT4Dvddr_yOwhTqtKA.woff28
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/amiri/v17/J7aRnpd8CGxBHpUutLM.woff2
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/amiri/v17/J7aRnpd8CGxBHpUutLM.woff2En
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/archivonarrow/v18/tss5ApVBdCYD5Q7hcxTE1ArZ0Zz8oY2KRmwvKhhvLFG6o3ms.woff2
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/arimo/v17/P5sMzZCDf9_T_10ZxCE.woff2
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/arimo/v17/P5sMzZCDf9_T_10ZxCE.woff2:
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/bitter/v19/raxhHiqOu8IVPmnRc6SY1KXhnF_Y8fbfOLjOXQ.woff2
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/bitter/v19/raxhHiqOu8IVPmnRc6SY1KXhnF_Y8fbfOLjOXQ.woff2/
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/cantarell/v10/B50NF7ZDq37KMUvlO015jKJr.woff2
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/cantarell/v10/B50NF7ZDq37KMUvlO015jKJr.woff2j$Y
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/cardo/v14/wlp_gwjKBV1pqhv43IE.woff2
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/catamaran/v8/o-0bIpQoyXQa2RxT7-5B6Ryxs2E_6n1iPHjd5a7duw.woff2
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/crimsontext/v13/wlp2gwHKFkZgtmSR3NB0oRJfbwhT.woff2
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/crimsontext/v13/wlp2gwHKFkZgtmSR3NB0oRJfbwhT.woff2A
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/domine/v11/L0xhDFMnlVwD4h3Lt9JWnbX3jG-2X3LAE1ofEw.woff2
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/domine/v11/L0xhDFMnlVwD4h3Lt9JWnbX3jG-2X3LAE1ofEw.woff2s
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/dosis/v22/HhyJU5sn9vOmLxNkIwRSjTVNWLEJN7Ml2xME.woff2
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/droidserif/v13/tDbK2oqRg1oM3QBjjcaDkOr4nAfcHg.woff2
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/droidserif/v13/tDbX2oqRg1oM3QBjjcaDkOr4lLz5CwOnSA.woff2
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/ekmukta/v18/mem9YaCmzCuv3KJUDIYScrg.woff2
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/enriqueta/v10/goksH6L7AUFrRvV44HVjTEqi.woff2
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/enriqueta/v10/goksH6L7AUFrRvV44HVjTEqi.woff2=
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/fanwoodtext/v13/3XFtErwl05Ad_vSCF6Fq7xX2QtzZ.woff2
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/firasans/v11/va9B4kDNxMZdWfMOD5VnLK3eRhf6.woff2
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/firasans/v11/va9B4kDNxMZdWfMOD5VnPKreRhf6.woff2
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/firasans/v11/va9B4kDNxMZdWfMOD5VnZKveRhf6.woff2
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/firasans/v11/va9E4kDNxMZdWfMOD5Vvl4jL.woff2
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/firasans/v11/va9f4kDNxMZdWfMOD5VvkrBiQyf4VFk.woff2
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/fredokaone/v8/k3kUo8kEI-tA1RRcTZGmTlHGCac.woff2
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/inknutantiqua/v12/Y4GSYax7VC4ot_qNB4nYpBdaKUUE4J0.woff2
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/inknutantiqua/v12/Y4GSYax7VC4ot_qNB4nYpBdaKUUE4J0.woff2A-
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v20/S6uyw4BMUTPHjx4wXg.woff2
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/librebaskerville/v9/kmKnZrc3Hgbbcjq75U4uslyuy4kn0qNZaxM.woff2
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/librebaskerville/v9/kmKnZrc3Hgbbcjq75U4uslyuy4kn0qNZaxM.woff2aCb
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/lora/v20/0QI6MX1D_JOuGQbT0gvTJPa787weuxJBkq0.woff2
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/martel/v5/PN_xRfK9oXHga0XdZsg_.woff2
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/martel/v5/PN_xRfK9oXHga0XdZsg_.woff2tf
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/materialicons/v121/flUhRq6tzZclQEJ-Vdg-IuiaDsNc.woff2
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/materialicons/v121/flUhRq6tzZclQEJ-Vdg-IuiaDsNc.woff2)
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/merriweather/v28/u-440qyriQwlOrhSvowK_l5-fCZM.woff2
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v21/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/muli/v22/7Aujp_0qiz-afTfcIyoiGtm2P0wG089z4eqVww.woff2
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/muli/v22/7Aujp_0qiz-afTfcIyoiGtm2P0wG089z4eqVww.woff2&
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/muli/v22/7Auwp_0qiz-afTLGLQ.woff2
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/neuton/v13/UMBTrPtMoH62xUZCz4g6.woff2
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/nunito/v20/XRXI3I6Li01BKofiOc5wtlZ2di8HDLshdTQ3jw.woff2
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v27/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/oswald/v40/TK3_WkUHHAIjg75cFRf3bXL8LICs1_FvsUZiZQ.woff2
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/palanquindark/v7/xn75YHgl1nqmANMB-26xC7yuF86JRks.woff2
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/patuaone/v11/ZXuke1cDvLCKLDcimxB44_lu.woff2
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/patuaone/v11/ZXuke1cDvLCKLDcimxB44_lu.woff21
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/playfairdisplay/v25/nuFvD-vYSZviVYUb_rj3ij__anPXJzDwcbmjWBN2PKdFvXDXbtM.
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/poppins/v15/pxiEyp8kv8JHgFVrJJfecg.woff2
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptserif/v12/EJRVQgYoZZY2vCFuvAFWzr8.woff2
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/questrial/v13/QdVUSTchPBm7nuUeVf70viFl.woff2
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/raleway/v22/1Ptxg8zYS_SKggPN4iEgvnHyvveLxVvaorCIPrE.woff2
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/raleway/v22/1Ptxg8zYS_SKggPN4iEgvnHyvveLxVvaorCIPrE.woff2O
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v29/KFOjCnqEu92Fr1Mu51TjASc6CsQ.woff2
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v29/KFOkCnqEu92Fr1Mu51xIIzI.woff2
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmSU5fBBc4.woff2
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmSU5fBBc4.woff2z4
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmWUlfBBc4.woff2
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmYUtfBBc4.woff2
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff2
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff2q
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/robotocondensed/v19/ieVl2ZhZI2eCN5jzbjEETS9weq8-19K7DQ.woff2
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/rubik/v14/iJWZBXyIfDnIV5PNhY1KTN7Z-Yh-B4iFV0U1.woff2
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/rubik/v14/iJWZBXyIfDnIV5PNhY1KTN7Z-Yh-B4iFV0U1.woff2L
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/sarpanch/v9/hESy6Xt4NCpRuk6Pzi2HTos.woff2
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/titilliumweb/v10/NaPecZTIAOhVxoMyOr9n_E7fdMPmDQ.woff2
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/titilliumweb/v10/NaPecZTIAOhVxoMyOr9n_E7fdMPmDQ.woff2S
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/varelaround/v13/w8gdH283Tvk__Lua32TysjIfp8uP.woff2
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/varelaround/v13/w8gdH283Tvk__Lua32TysjIfp8uP.woff2w
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/worksans/v13/QGYsz_wNahGAdqQ43Rh_fKDp.woff2
Source: manifest.json4.0.dr	String found in binary or memory: https://fonts.gstatic.com;
Source: Network Action Predictor.0.dr	String found in binary or memory: https://garythegreatesthypnotist.com/
Source: Current Session.0.dr, data_1.1.dr	String found in binary or memory: https://garythegreatesthypnotist.com/CD/One-File
Source: Current Session.0.dr, data_1.1.dr, data_2.1.dr	String found in binary or memory: https://garythegreatesthypnotist.com/CD/One-File/
Source: data_1.1.dr	String found in binary or memory: https://garythegreatesthypnotist.com/CD/One-File/5
Source: data_2.1.dr	String found in binary or memory: https://garythegreatesthypnotist.com/CD/One-File/Content-Length:
Source: Current Session.0.dr	String found in binary or memory: https://garythegreatesthypnotist.com/CD/One-File/login.php
Source: data_1.1.dr	String found in binary or memory: https://garythegreatesthypnotist.com/favicon.ico
Source: data_1.1.dr	String found in binary or memory: https://garythegreatesthypnotist.com/img/clear.png
Source: data_1.1.dr	String found in binary or memory: https://garythegreatesthypnotist.com/img/clear.pngn
Source: data_1.1.dr	String found in binary or memory: https://garythegreatesthypnotist.com/jslibrary/LoginHint208.js
Source: material_css_min.css.0.dr, angular.js.0.dr	String found in binary or memory: https://github.com/angular/material
Source: LICENSE.txt.0.dr	String found in binary or memory: https://github.com/easylist)
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://github.com/madler/zlib/blob/master/zlib.h
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://hangouts.clients6.google.com
Source: manifest.json4.0.dr	String found in binary or memory: https://hangouts.google.com/
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://hangouts.google.com/hangouts/_/logpref
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://meetings.clients6.google.com
Source: Network Action Predictor.0.dr	String found in binary or memory: https://my.marealtor.com/
Source: data_1.1.dr	String found in binary or memory: https://my.marealtor.com/css/sfdc_210.css
Source: data_1.1.dr, data_3.1.dr	String found in binary or memory: https://my.marealtor.com/img/icon/capslock_blue.png
Source: data_1.1.dr, data_3.1.dr	String found in binary or memory: https://my.marealtor.com/jslibrary/baselogin.js
Source: data_1.1.dr	String found in binary or memory: https://my.marealtor.com/jslibrary/baselogin.jsnFm
Source: data_1.1.dr	String found in binary or memory: https://my.marealtor.com/login/assets/fonts/SalesforceSans/SalesforceSans-Regular.woff2
Source: data_3.1.dr	String found in binary or memory: https://my.marealtor.com/marketing/survey/survey1/1384
Source: data_3.1.dr	String found in binary or memory: https://my.marealtor.com/marketing/survey/survey4/1384
Source: 56de4013-6a01-4062-a2ef-3500f84e9638.tmp.1.dr, e91645b6-4ab5-4c29-aa23-58439b7515b3.tmp.1.dr	String found in binary or memory: https://ogs.google.com
Source: craw_window.js.0.dr, manifest.json.0.dr	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: data_3.1.dr	String found in binary or memory: https://pki.goog/repository/0
Source: 56de4013-6a01-4062-a2ef-3500f84e9638.tmp.1.dr, e91645b6-4ab5-4c29-aa23-58439b7515b3.tmp.1.dr	String found in binary or memory: https://play.google.com
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: data_1.1.dr	String found in binary or memory: https://polyfill.io/v3/polyfill.min.js?flags=gated%7Calways&callback=initializePage&features=default
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://preprod-hangouts-googleapis.sandbox.google.com
Source: e91645b6-4ab5-4c29-aa23-58439b7515b3.tmp.1.dr	String found in binary or memory: https://r4---sn-4g5ednse.gvt1.com
Source: data_3.1.dr	String found in binary or memory: https://r4---sn-4g5ednse.gvt1.com/edgedl/chrome/dict/en-us-9-0.bdic?cms_redirect=yes&mh=I2&mip=84.17
Source: e91645b6-4ab5-4c29-aa23-58439b7515b3.tmp.1.dr	String found in binary or memory: https://redirector.gvt1.com
Source: data_1.1.dr	String found in binary or memory: https://redirector.gvt1.com/edgedl/chrome/dict/en-us-9-0.bdic
Source: craw_window.js.0.dr, manifest.json.0.dr	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: 56de4013-6a01-4062-a2ef-3500f84e9638.tmp.1.dr, e91645b6-4ab5-4c29-aa23-58439b7515b3.tmp.1.dr	String found in binary or memory: https://ssl.gstatic.com
Source: messages.json15.0.dr, messages.json66.0.dr, messages.json5.0.dr, messages.json7.0.dr, messages.json29.0.dr, messages.json49.0.dr, feedback.html.0.dr, messages.json69.0.dr, messages.json59.0.dr, messages.json27.0.dr, messages.json79.0.dr, messages.json46.0.dr, messages.json70.0.dr, messages.json39.0.dr, messages.json33.0.dr, messages.json0.0.dr, messages.json48.0.dr, messages.json88.0.dr, messages.json14.0.dr, messages.json87.0.dr, messages.json57.0.dr, messages.json18.0.dr, messages.json.0.dr, messages.json68.0.dr, messages.json51.0.dr, messages.json50.0.dr, messages.json28.0.dr, messages.json67.0.dr, messages.json10.0.dr, messages.json9.0.dr, messages.json8.0.dr, messages.json2.0.dr, messages.json52.0.dr, messages.json31.0.dr, messages.json32.0.dr, messages.json11.0.dr, messages.json26.0.dr, messages.json6.0.dr, messages.json1.0.dr, messages.json30.0.dr, messages.json58.0.dr, messages.json12.0.dr, messages.json4.0.dr	String found in binary or memory: https://support.google.com/chromecast/answer/2998456
Source: messages.json15.0.dr, messages.json66.0.dr, messages.json5.0.dr, messages.json7.0.dr, messages.json29.0.dr, messages.json49.0.dr, feedback.html.0.dr, messages.json69.0.dr, messages.json59.0.dr, messages.json27.0.dr, messages.json79.0.dr, messages.json46.0.dr, messages.json70.0.dr, messages.json39.0.dr, messages.json33.0.dr, messages.json0.0.dr, messages.json48.0.dr, messages.json88.0.dr, messages.json14.0.dr, messages.json87.0.dr, messages.json57.0.dr, messages.json18.0.dr, messages.json.0.dr, messages.json68.0.dr, messages.json51.0.dr, messages.json50.0.dr, messages.json28.0.dr, messages.json67.0.dr, messages.json10.0.dr, messages.json9.0.dr, messages.json8.0.dr, messages.json2.0.dr, messages.json52.0.dr, messages.json31.0.dr, messages.json32.0.dr, messages.json11.0.dr, messages.json26.0.dr, messages.json6.0.dr, messages.json1.0.dr, messages.json30.0.dr, messages.json58.0.dr, messages.json12.0.dr, messages.json4.0.dr	String found in binary or memory: https://support.google.com/chromecast/troubleshooter/2995236
Source: data_3.1.dr	String found in binary or memory: https://use.typekit.net
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://www-googleapis-staging.sandbox.google.com
Source: 56de4013-6a01-4062-a2ef-3500f84e9638.tmp.1.dr, manifest.json4.0.dr, e91645b6-4ab5-4c29-aa23-58439b7515b3.tmp.1.dr	String found in binary or memory: https://www.google.com
Source: manifest.json.0.dr	String found in binary or memory: https://www.google.com/
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/accounts/OAuthLogin?issueuberauth=1
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/cleardot.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/dot2.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/x2.gif
Source: craw_background.js.0.dr	String found in binary or memory: https://www.google.com/intl/en-US/chrome/blank.html
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://www.google.com/log?format=json&hasfast=true
Source: data_1.1.dr	String found in binary or memory: https://www.google.com/recaptcha/api.js?onload=__cvt_recaptcha_loaded&render=explicit
Source: data_1.1.dr	String found in binary or memory: https://www.google.com/recaptcha/api2/
Source: feedback_script.js.0.dr	String found in binary or memory: https://www.google.com/tools/feedback
Source: manifest.json4.0.dr	String found in binary or memory: https://www.google.com;
Source: 56de4013-6a01-4062-a2ef-3500f84e9638.tmp.1.dr, craw_window.js.0.dr, craw_background.js.0.dr, e91645b6-4ab5-4c29-aa23-58439b7515b3.tmp.1.dr	String found in binary or memory: https://www.googleapis.com
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/
Source: manifest.json4.0.dr	String found in binary or memory: https://www.googleapis.com/auth/calendar.readonly
Source: manifest.json4.0.dr	String found in binary or memory: https://www.googleapis.com/auth/cast-edu-messaging
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json4.0.dr	String found in binary or memory: https://www.googleapis.com/auth/clouddevices
Source: manifest.json4.0.dr	String found in binary or memory: https://www.googleapis.com/auth/hangouts
Source: manifest.json4.0.dr	String found in binary or memory: https://www.googleapis.com/auth/hangouts.readonly
Source: manifest.json4.0.dr	String found in binary or memory: https://www.googleapis.com/auth/meetings
Source: manifest.json4.0.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.peopleapi.readwrite
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: manifest.json4.0.dr	String found in binary or memory: https://www.googleapis.com/auth/userinfo.email
Source: 56de4013-6a01-4062-a2ef-3500f84e9638.tmp.1.dr, e91645b6-4ab5-4c29-aa23-58439b7515b3.tmp.1.dr	String found in binary or memory: https://www.gstatic.com
Source: data_1.1.dr	String found in binary or memory: https://www.gstatic.com/recaptcha/releases/TDBxTlSsKAUm3tSIa0fwIqNu/recaptcha__en.js
Source: manifest.json4.0.dr	String found in binary or memory: https://www.gstatic.com;
Source: data_1.1.dr	String found in binary or memory: https://www.stratospherenetworks.com/blog/wp-content/uploads/2018/08/office365-logo.png
Source: data_1.1.dr	String found in binary or memory: https://www.stratospherenetworks.com/blog/wp-content/uploads/2018/08/office365-logo.png9HW

Posts data to webserver

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: clients2.google.com

Downloads files from webservers via HTTP

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: dn6orrtz.sibpages.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-85.0.4183.121Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/intl-tel-input/16.0.4/css/intlTelInput.css HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,*/*;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://dn6orrtz.sibpages.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/css/v2/core-67c779b.min.css HTTP/1.1Host: cdn.convrrt.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,*/*;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://dn6orrtz.sibpages.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /vendor/themify/themify-icons.css HTTP/1.1Host: cdn.convrrt.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,*/*;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://dn6orrtz.sibpages.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /vendor/font-awesome/4.7.0/css/font-awesome.min.css HTTP/1.1Host: cdn.convrrt.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,*/*;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://dn6orrtz.sibpages.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/analyze/analytics.f941af9754702a18190a.js HTTP/1.1Host: cdn.convrrt.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://dn6orrtz.sibpages.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /apps/sendinblue/4361062/bf8270e0-f572-4e74-aaba-eec891007c9f.png HTTP/1.1Host: cdn.convrrt.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://dn6orrtz.sibpages.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/intl-tel-input/16.0.4/js/intlTelInput.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://dn6orrtz.sibpages.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v3/polyfill.min.js?flags=gated%7Calways&callback=initializePage&features=default HTTP/1.1Host: polyfill.ioConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://dn6orrtz.sibpages.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /libs/core/v2/6794dd4/main.bundle.js HTTP/1.1Host: cdn.convrrt.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://dn6orrtz.sibpages.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /libs/core/v2/6794dd4/3.chunk.js HTTP/1.1Host: cdn.convrrt.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://dn6orrtz.sibpages.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /libs/core/v2/6794dd4/10.chunk.js HTTP/1.1Host: cdn.convrrt.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://dn6orrtz.sibpages.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /libs/core/v2/6794dd4/4.chunk.js HTTP/1.1Host: cdn.convrrt.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://dn6orrtz.sibpages.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /libs/core/v2/6794dd4/12.chunk.js HTTP/1.1Host: cdn.convrrt.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://dn6orrtz.sibpages.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /libs/core/v2/6794dd4/0.chunk.js HTTP/1.1Host: cdn.convrrt.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://dn6orrtz.sibpages.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /libs/core/v2/6794dd4/8.chunk.js HTTP/1.1Host: cdn.convrrt.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://dn6orrtz.sibpages.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /libs/core/v2/6794dd4/13.chunk.js HTTP/1.1Host: cdn.convrrt.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://dn6orrtz.sibpages.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /libs/core/v2/6794dd4/14.chunk.js HTTP/1.1Host: cdn.convrrt.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://dn6orrtz.sibpages.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /libs/core/v2/6794dd4/2.chunk.js HTTP/1.1Host: cdn.convrrt.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://dn6orrtz.sibpages.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /libs/core/v2/6794dd4/1.chunk.js HTTP/1.1Host: cdn.convrrt.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://dn6orrtz.sibpages.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /libs/core/v2/6794dd4/7.chunk.js HTTP/1.1Host: cdn.convrrt.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://dn6orrtz.sibpages.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /libs/core/v2/6794dd4/11.chunk.js HTTP/1.1Host: cdn.convrrt.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://dn6orrtz.sibpages.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api.js?onload=__cvt_recaptcha_loaded&render=explicit HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://dn6orrtz.sibpages.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /libs/core/v2/6794dd4/9.chunk.js HTTP/1.1Host: cdn.convrrt.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://dn6orrtz.sibpages.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /libs/core/v2/6794dd4/6.chunk.js HTTP/1.1Host: cdn.convrrt.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://dn6orrtz.sibpages.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/arimo/v17/P5sMzZCDf9_T_10ZxCE.woff2 HTTP/1.1Host: fonts.gstatic.comConnection: keep-aliveOrigin: https://dn6orrtz.sibpages.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://fonts.googleapis.com/css?family=PT+Serif%7CMaterial+Icons%7CDroid+Serif:400italic,700italic%7CAbril+Fatface%7CAdvent+Pro%7CAmiri%7CArchivo+Narrow%7CArimo:400,500,600,700%7CBitter%7CCantarell%7CCardo%7CCatamaran%7CCrimson+Text%7CDomine%7CDosis%7CEk+Mukta%7CEnriqueta%7CFanwood+Text%7CFira+Sans:300,300i,400,500,700%7CFredoka+One%7CInknut+Antiqua%7CLato%7CLibre+Baskerville%7CLora%7CMartel%7CMerriweather%7CMontserrat:100,200,300,400,700,900%7CMuli:300,300i,400%7CNeuton%7CNunito%7COpen+Sans%7COswald%7CPT+Serif%7CPalanquin+Dark%7CPatua+One%7CPlayfair+Display%7CPoppins%7CQuestrial%7CRaleway%7CRoboto:300,300i,400,400i,700,900%7CRoboto+Condensed%7CRubik%7CSarpanch%7CTitillium+Web%7CVarela+Round%7CWork+Sans:300,400Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/nunito/v20/XRXI3I6Li01BKofiOc5wtlZ2di8HDLshdTQ3jw.woff2 HTTP/1.1Host: fonts.gstatic.comConnection: keep-aliveOrigin: https://dn6orrtz.sibpages.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://fonts.googleapis.com/css?family=PT+Serif%7CMaterial+Icons%7CDroid+Serif:400italic,700italic%7CAbril+Fatface%7CAdvent+Pro%7CAmiri%7CArchivo+Narrow%7CArimo:400,500,600,700%7CBitter%7CCantarell%7CCardo%7CCatamaran%7CCrimson+Text%7CDomine%7CDosis%7CEk+Mukta%7CEnriqueta%7CFanwood+Text%7CFira+Sans:300,300i,400,500,700%7CFredoka+One%7CInknut+Antiqua%7CLato%7CLibre+Baskerville%7CLora%7CMartel%7CMerriweather%7CMontserrat:100,200,300,400,700,900%7CMuli:300,300i,400%7CNeuton%7CNunito%7COpen+Sans%7COswald%7CPT+Serif%7CPalanquin+Dark%7CPatua+One%7CPlayfair+Display%7CPoppins%7CQuestrial%7CRaleway%7CRoboto:300,300i,400,400i,700,900%7CRoboto+Condensed%7CRubik%7CSarpanch%7CTitillium+Web%7CVarela+Round%7CWork+Sans:300,400Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/ptserif/v12/EJRVQgYoZZY2vCFuvAFWzr8.woff2 HTTP/1.1Host: fonts.gstatic.comConnection: keep-aliveOrigin: https://dn6orrtz.sibpages.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://fonts.googleapis.com/css?family=PT+Serif%7CMaterial+Icons%7CDroid+Serif:400italic,700italic%7CAbril+Fatface%7CAdvent+Pro%7CAmiri%7CArchivo+Narrow%7CArimo:400,500,600,700%7CBitter%7CCantarell%7CCardo%7CCatamaran%7CCrimson+Text%7CDomine%7CDosis%7CEk+Mukta%7CEnriqueta%7CFanwood+Text%7CFira+Sans:300,300i,400,500,700%7CFredoka+One%7CInknut+Antiqua%7CLato%7CLibre+Baskerville%7CLora%7CMartel%7CMerriweather%7CMontserrat:100,200,300,400,700,900%7CMuli:300,300i,400%7CNeuton%7CNunito%7COpen+Sans%7COswald%7CPT+Serif%7CPalanquin+Dark%7CPatua+One%7CPlayfair+Display%7CPoppins%7CQuestrial%7CRaleway%7CRoboto:300,300i,400,400i,700,900%7CRoboto+Condensed%7CRubik%7CSarpanch%7CTitillium+Web%7CVarela+Round%7CWork+Sans:300,400Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/materialicons/v121/flUhRq6tzZclQEJ-Vdg-IuiaDsNc.woff2 HTTP/1.1Host: fonts.gstatic.comConnection: keep-aliveOrigin: https://dn6orrtz.sibpages.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://fonts.googleapis.com/icon?family=Material+IconsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/droidserif/v13/tDbK2oqRg1oM3QBjjcaDkOr4nAfcHg.woff2 HTTP/1.1Host: fonts.gstatic.comConnection: keep-aliveOrigin: https://dn6orrtz.sibpages.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://fonts.googleapis.com/css?family=PT+Serif%7CMaterial+Icons%7CDroid+Serif:400italic,700italic%7CAbril+Fatface%7CAdvent+Pro%7CAmiri%7CArchivo+Narrow%7CArimo:400,500,600,700%7CBitter%7CCantarell%7CCardo%7CCatamaran%7CCrimson+Text%7CDomine%7CDosis%7CEk+Mukta%7CEnriqueta%7CFanwood+Text%7CFira+Sans:300,300i,400,500,700%7CFredoka+One%7CInknut+Antiqua%7CLato%7CLibre+Baskerville%7CLora%7CMartel%7CMerriweather%7CMontserrat:100,200,300,400,700,900%7CMuli:300,300i,400%7CNeuton%7CNunito%7COpen+Sans%7COswald%7CPT+Serif%7CPalanquin+Dark%7CPatua+One%7CPlayfair+Display%7CPoppins%7CQuestrial%7CRaleway%7CRoboto:300,300i,400,400i,700,900%7CRoboto+Condensed%7CRubik%7CSarpanch%7CTitillium+Web%7CVarela+Round%7CWork+Sans:300,400Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/droidserif/v13/tDbX2oqRg1oM3QBjjcaDkOr4lLz5CwOnSA.woff2 HTTP/1.1Host: fonts.gstatic.comConnection: keep-aliveOrigin: https://dn6orrtz.sibpages.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://fonts.googleapis.com/css?family=PT+Serif%7CMaterial+Icons%7CDroid+Serif:400italic,700italic%7CAbril+Fatface%7CAdvent+Pro%7CAmiri%7CArchivo+Narrow%7CArimo:400,500,600,700%7CBitter%7CCantarell%7CCardo%7CCatamaran%7CCrimson+Text%7CDomine%7CDosis%7CEk+Mukta%7CEnriqueta%7CFanwood+Text%7CFira+Sans:300,300i,400,500,700%7CFredoka+One%7CInknut+Antiqua%7CLato%7CLibre+Baskerville%7CLora%7CMartel%7CMerriweather%7CMontserrat:100,200,300,400,700,900%7CMuli:300,300i,400%7CNeuton%7CNunito%7COpen+Sans%7COswald%7CPT+Serif%7CPalanquin+Dark%7CPatua+One%7CPlayfair+Display%7CPoppins%7CQuestrial%7CRaleway%7CRoboto:300,300i,400,400i,700,900%7CRoboto+Condensed%7CRubik%7CSarpanch%7CTitillium+Web%7CVarela+Round%7CWork+Sans:300,400Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/abrilfatface/v12/zOL64pLDlL1D99S8g8PtiKchq-dmjQ.woff2 HTTP/1.1Host: fonts.gstatic.comConnection: keep-aliveOrigin: https://dn6orrtz.sibpages.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://fonts.googleapis.com/css?family=PT+Serif%7CMaterial+Icons%7CDroid+Serif:400italic,700italic%7CAbril+Fatface%7CAdvent+Pro%7CAmiri%7CArchivo+Narrow%7CArimo:400,500,600,700%7CBitter%7CCantarell%7CCardo%7CCatamaran%7CCrimson+Text%7CDomine%7CDosis%7CEk+Mukta%7CEnriqueta%7CFanwood+Text%7CFira+Sans:300,300i,400,500,700%7CFredoka+One%7CInknut+Antiqua%7CLato%7CLibre+Baskerville%7CLora%7CMartel%7CMerriweather%7CMontserrat:100,200,300,400,700,900%7CMuli:300,300i,400%7CNeuton%7CNunito%7COpen+Sans%7COswald%7CPT+Serif%7CPalanquin+Dark%7CPatua+One%7CPlayfair+Display%7CPoppins%7CQuestrial%7CRaleway%7CRoboto:300,300i,400,400i,700,900%7CRoboto+Condensed%7CRubik%7CSarpanch%7CTitillium+Web%7CVarela+Round%7CWork+Sans:300,400Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/adventpro/v11/V8mAoQfxVT4Dvddr_yOwhTqtKA.woff2 HTTP/1.1Host: fonts.gstatic.comConnection: keep-aliveOrigin: https://dn6orrtz.sibpages.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://fonts.googleapis.com/css?family=PT+Serif%7CMaterial+Icons%7CDroid+Serif:400italic,700italic%7CAbril+Fatface%7CAdvent+Pro%7CAmiri%7CArchivo+Narrow%7CArimo:400,500,600,700%7CBitter%7CCantarell%7CCardo%7CCatamaran%7CCrimson+Text%7CDomine%7CDosis%7CEk+Mukta%7CEnriqueta%7CFanwood+Text%7CFira+Sans:300,300i,400,500,700%7CFredoka+One%7CInknut+Antiqua%7CLato%7CLibre+Baskerville%7CLora%7CMartel%7CMerriweather%7CMontserrat:100,200,300,400,700,900%7CMuli:300,300i,400%7CNeuton%7CNunito%7COpen+Sans%7COswald%7CPT+Serif%7CPalanquin+Dark%7CPatua+One%7CPlayfair+Display%7CPoppins%7CQuestrial%7CRaleway%7CRoboto:300,300i,400,400i,700,900%7CRoboto+Condensed%7CRubik%7CSarpanch%7CTitillium+Web%7CVarela+Round%7CWork+Sans:300,400Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/amiri/v17/J7aRnpd8CGxBHpUutLM.woff2 HTTP/1.1Host: fonts.gstatic.comConnection: keep-aliveOrigin: https://dn6orrtz.sibpages.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://fonts.googleapis.com/css?family=PT+Serif%7CMaterial+Icons%7CDroid+Serif:400italic,700italic%7CAbril+Fatface%7CAdvent+Pro%7CAmiri%7CArchivo+Narrow%7CArimo:400,500,600,700%7CBitter%7CCantarell%7CCardo%7CCatamaran%7CCrimson+Text%7CDomine%7CDosis%7CEk+Mukta%7CEnriqueta%7CFanwood+Text%7CFira+Sans:300,300i,400,500,700%7CFredoka+One%7CInknut+Antiqua%7CLato%7CLibre+Baskerville%7CLora%7CMartel%7CMerriweather%7CMontserrat:100,200,300,400,700,900%7CMuli:300,300i,400%7CNeuton%7CNunito%7COpen+Sans%7COswald%7CPT+Serif%7CPalanquin+Dark%7CPatua+One%7CPlayfair+Display%7CPoppins%7CQuestrial%7CRaleway%7CRoboto:300,300i,400,400i,700,900%7CRoboto+Condensed%7CRubik%7CSarpanch%7CTitillium+Web%7CVarela+Round%7CWork+Sans:300,400Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/archivonarrow/v18/tss5ApVBdCYD5Q7hcxTE1ArZ0Zz8oY2KRmwvKhhvLFG6o3ms.woff2 HTTP/1.1Host: fonts.gstatic.comConnection: keep-aliveOrigin: https://dn6orrtz.sibpages.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://fonts.googleapis.com/css?family=PT+Serif%7CMaterial+Icons%7CDroid+Serif:400italic,700italic%7CAbril+Fatface%7CAdvent+Pro%7CAmiri%7CArchivo+Narrow%7CArimo:400,500,600,700%7CBitter%7CCantarell%7CCardo%7CCatamaran%7CCrimson+Text%7CDomine%7CDosis%7CEk+Mukta%7CEnriqueta%7CFanwood+Text%7CFira+Sans:300,300i,400,500,700%7CFredoka+One%7CInknut+Antiqua%7CLato%7CLibre+Baskerville%7CLora%7CMartel%7CMerriweather%7CMontserrat:100,200,300,400,700,900%7CMuli:300,300i,400%7CNeuton%7CNunito%7COpen+Sans%7COswald%7CPT+Serif%7CPalanquin+Dark%7CPatua+One%7CPlayfair+Display%7CPoppins%7CQuestrial%7CRaleway%7CRoboto:300,300i,400,400i,700,900%7CRoboto+Condensed%7CRubik%7CSarpanch%7CTitillium+Web%7CVarela+Round%7CWork+Sans:300,400Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/bitter/v19/raxhHiqOu8IVPmnRc6SY1KXhnF_Y8fbfOLjOXQ.woff2 HTTP/1.1Host: fonts.gstatic.comConnection: keep-aliveOrigin: https://dn6orrtz.sibpages.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://fonts.googleapis.com/css?family=PT+Serif%7CMaterial+Icons%7CDroid+Serif:400italic,700italic%7CAbril+Fatface%7CAdvent+Pro%7CAmiri%7CArchivo+Narrow%7CArimo:400,500,600,700%7CBitter%7CCantarell%7CCardo%7CCatamaran%7CCrimson+Text%7CDomine%7CDosis%7CEk+Mukta%7CEnriqueta%7CFanwood+Text%7CFira+Sans:300,300i,400,500,700%7CFredoka+One%7CInknut+Antiqua%7CLato%7CLibre+Baskerville%7CLora%7CMartel%7CMerriweather%7CMontserrat:100,200,300,400,700,900%7CMuli:300,300i,400%7CNeuton%7CNunito%7COpen+Sans%7COswald%7CPT+Serif%7CPalanquin+Dark%7CPatua+One%7CPlayfair+Display%7CPoppins%7CQuestrial%7CRaleway%7CRoboto:300,300i,400,400i,700,900%7CRoboto+Condensed%7CRubik%7CSarpanch%7CTitillium+Web%7CVarela+Round%7CWork+Sans:300,400Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: dn6orrtz.sibpages.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://dn6orrtz.sibpages.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: cvta-session=92688314-0c63-455e-94a0-02cd8e09441a; cvta-anonymousID=26c69cfc-37f9-499d-a304-e085500a9808
Source: global traffic	HTTP traffic detected: GET /CD/One-File HTTP/1.1Host: garythegreatesthypnotist.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /CD/One-File/ HTTP/1.1Host: garythegreatesthypnotist.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /css/sfdc_210.css HTTP/1.1Host: my.marealtor.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,*/*;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://garythegreatesthypnotist.com/CD/One-File/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jslibrary/SfdcSessionBase208.js HTTP/1.1Host: garythegreatesthypnotist.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://garythegreatesthypnotist.com/CD/One-File/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jslibrary/LoginHint208.js HTTP/1.1Host: garythegreatesthypnotist.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://garythegreatesthypnotist.com/CD/One-File/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jslibrary/baselogin.js HTTP/1.1Host: my.marealtor.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://garythegreatesthypnotist.com/CD/One-File/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /marketing/survey/survey1/1384 HTTP/1.1Host: my.marealtor.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://garythegreatesthypnotist.com/CD/One-File/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /marketing/survey/survey4/1384 HTTP/1.1Host: my.marealtor.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://garythegreatesthypnotist.com/CD/One-File/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /blog/wp-content/uploads/2018/08/office365-logo.png HTTP/1.1Host: www.stratospherenetworks.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://garythegreatesthypnotist.com/CD/One-File/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /login/assets/fonts/SalesforceSans/SalesforceSans-Regular.woff2 HTTP/1.1Host: my.marealtor.comConnection: keep-aliveOrigin: https://garythegreatesthypnotist.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://my.marealtor.com/css/sfdc_210.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/clear.png HTTP/1.1Host: garythegreatesthypnotist.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://garythegreatesthypnotist.com/CD/One-File/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /crx/blobs/Acy1k0bLIjHsvnKaKN_oRpVaYYvFs25d7GKYF1WXrT6yizCMksBO0c_ggE0B6tx6HPRHe6q1GOEe3_NcIbSiGG8kXeLMUY0sAKVvC6R89zvKM13s5VqoAMZSmuUgjQL5vlygJuArQghXXE_qTL7NlQ/extension_8520_615_0_5.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /marketing/survey/survey1/1384 HTTP/1.1Host: my.marealtor.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://garythegreatesthypnotist.com/CD/One-File/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /login/assets/fonts/SalesforceSans/SalesforceSans-Regular.woff HTTP/1.1Host: my.marealtor.comConnection: keep-aliveOrigin: https://garythegreatesthypnotist.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://my.marealtor.com/css/sfdc_210.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /marketing/survey/survey4/1384 HTTP/1.1Host: my.marealtor.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://garythegreatesthypnotist.com/CD/One-File/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/icon/capslock_blue.png HTTP/1.1Host: my.marealtor.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://garythegreatesthypnotist.com/CD/One-File/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: garythegreatesthypnotist.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://garythegreatesthypnotist.com/CD/One-File/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/icon/capslock_blue.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: my.marealtor.com
Source: global traffic	HTTP traffic detected: GET /blog/wp-content/uploads/2018/08/office365-logo.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: www.stratospherenetworks.com
Source: global traffic	HTTP traffic detected: GET /img/clear.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: garythegreatesthypnotist.com

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 192.124.249.52:443 -> 192.168.2.3:49823 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 161.71.19.193:443 -> 192.168.2.3:49821 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 69.49.245.88:443 -> 192.168.2.3:49822 version: TLS 1.2

System Summary:

Spawns processes

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "https://dn6orrtz.sibpages.com/
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1528,17591449162204269841,17934805484148476243,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1904 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1528,17591449162204269841,17934805484148476243,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1904 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior

Creates files inside the program directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\Chrome\Application\Dictionaries

Jump to behavior

Creates files inside the user directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-61E18FBF-BD4.pma

Jump to behavior

Creates temporary files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Temp\ab325483-0a4a-4994-b7b3-022cdb6d8882.tmp

Jump to behavior

Classification label

Source: classification engine

Classification label: mal68.phis.win@35/273@17/17

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Creates a directory in C:\Program Files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic			Jump to behavior

Persistence and Installation Behavior:

Creates license or readme file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Temp\3028_230581275\LICENSE.txt

Jump to behavior