Windows Analysis Report
https://cat-coral-aw9e.squarespace.com/

AV Detection

Source: https://cat-coral-aw9e.squarespace.com/

SlashNext: detection malicious, Label: Fake Login Page type: Phishing & Social Engineering

Source: https://cat-coral-aw9e.squarespace.com/#page	SlashNext: Label: Fake Login Page type: Phishing & Social Engineering
Source: https://sgp1.digitaloceanspaces.com/c8oc473cfg4i3gfhcdib43xd732xddg8cnxbd4873ifd/3nsdfstt.html	SlashNext: Label: Fake Login Page type: Phishing & Social Engineering

Phishing

Source: https://sgp1.digitaloceanspaces.com/c8oc473cfg4i3gfhcdib43xd732xddg8cnxbd4873ifd/3nsdfstt.html

Matcher: Template: office matched with high similarity

Source: Yara match	File source: 12913.2.pages.csv, type: HTML
Source: Yara match	File source: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache\data_3, type: DROPPED

Source: https://sgp1.digitaloceanspaces.com/c8oc473cfg4i3gfhcdib43xd732xddg8cnxbd4873ifd/3nsdfstt.html

Matcher: Template: microsoft matched

Source: https://sgp1.digitaloceanspaces.com/c8oc473cfg4i3gfhcdib43xd732xddg8cnxbd4873ifd/3nsdfstt.html	Matcher: Found strong image similarity, brand: Microsoft image: 12913.2.img.1.gfk.csv EE5C8D9FB6248C938FD0DC19370E90BD
Source: https://sgp1.digitaloceanspaces.com/c8oc473cfg4i3gfhcdib43xd732xddg8cnxbd4873ifd/3nsdfstt.html	Matcher: Found strong image similarity, brand: Microsoft image: 12913.2.img.2.gfk.csv 7916A894EBDE7D29C2CC29B267F1299F

Source: https://sgp1.digitaloceanspaces.com/c8oc473cfg4i3gfhcdib43xd732xddg8cnxbd4873ifd/3nsdfstt.html	HTTP Parser: Number of links: 0
Source: https://sgp1.digitaloceanspaces.com/c8oc473cfg4i3gfhcdib43xd732xddg8cnxbd4873ifd/3nsdfstt.html	HTTP Parser: Number of links: 0

Source: https://sgp1.digitaloceanspaces.com/c8oc473cfg4i3gfhcdib43xd732xddg8cnxbd4873ifd/3nsdfstt.html	HTTP Parser: HTML title missing
Source: https://sgp1.digitaloceanspaces.com/c8oc473cfg4i3gfhcdib43xd732xddg8cnxbd4873ifd/3nsdfstt.html	HTTP Parser: HTML title missing

Source: https://sgp1.digitaloceanspaces.com/c8oc473cfg4i3gfhcdib43xd732xddg8cnxbd4873ifd/3nsdfstt.html	HTTP Parser: No <meta name="author".. found
Source: https://sgp1.digitaloceanspaces.com/c8oc473cfg4i3gfhcdib43xd732xddg8cnxbd4873ifd/3nsdfstt.html	HTTP Parser: No <meta name="author".. found

Source: https://sgp1.digitaloceanspaces.com/c8oc473cfg4i3gfhcdib43xd732xddg8cnxbd4873ifd/3nsdfstt.html	HTTP Parser: No <meta name="copyright".. found
Source: https://sgp1.digitaloceanspaces.com/c8oc473cfg4i3gfhcdib43xd732xddg8cnxbd4873ifd/3nsdfstt.html	HTTP Parser: No <meta name="copyright".. found

Compliance

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Temp\7092_1416688899\LICENSE.txt

Jump to behavior

Source: unknown	HTTPS traffic detected: 151.101.0.238:443 -> 192.168.2.4:49813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.203.100:443 -> 192.168.2.4:49857 version: TLS 1.2

Networking

Source: unknown

DNS traffic detected: queries for: clients2.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-GB&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-85.0.4183.121Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: cat-coral-aw9e.squarespace.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /static/versioned-site-css/61ed37d413329125050ef0db/1/5c5a519771c10ba3470d8101/61ed37d413329125050ef10d/1175/site.css HTTP/1.1Host: static1.squarespace.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://cat-coral-aw9e.squarespace.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /@sqs/polyfiller/1.2.2/modern.js HTTP/1.1Host: assets.squarespace.comConnection: keep-aliveOrigin: https://cat-coral-aw9e.squarespace.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://cat-coral-aw9e.squarespace.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /universal/scripts-compressed/style-loader-runtime-e1419a2de35834b4cc657-min.en-US.js HTTP/1.1Host: assets.squarespace.comConnection: keep-aliveOrigin: https://cat-coral-aw9e.squarespace.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://cat-coral-aw9e.squarespace.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /universal/scripts-compressed/moment-js-vendor-2c8245ba6fac7b95a166c-min.en-US.js HTTP/1.1Host: assets.squarespace.comConnection: keep-aliveOrigin: https://cat-coral-aw9e.squarespace.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://cat-coral-aw9e.squarespace.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /universal/scripts-compressed/cldr-resource-pack-19f316c82441424835c5a-min.en-US.js HTTP/1.1Host: assets.squarespace.comConnection: keep-aliveOrigin: https://cat-coral-aw9e.squarespace.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://cat-coral-aw9e.squarespace.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /universal/scripts-compressed/common-vendors-stable-545adf5039693142a25fb-min.en-US.js HTTP/1.1Host: assets.squarespace.comConnection: keep-aliveOrigin: https://cat-coral-aw9e.squarespace.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://cat-coral-aw9e.squarespace.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /universal/scripts-compressed/common-vendors-223bd45b38abd65f911e3-min.en-US.js HTTP/1.1Host: assets.squarespace.comConnection: keep-aliveOrigin: https://cat-coral-aw9e.squarespace.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://cat-coral-aw9e.squarespace.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /content/v1/61ed37d413329125050ef0db/0dad4311-33ee-475e-965c-693a01d55ac5/offfflineee.jpg?format=1500w HTTP/1.1Host: images.squarespace-cdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cat-coral-aw9e.squarespace.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /universal/scripts-compressed/common-e4e3ca11dc5639f41441c-min.en-US.js HTTP/1.1Host: assets.squarespace.comConnection: keep-aliveOrigin: https://cat-coral-aw9e.squarespace.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://cat-coral-aw9e.squarespace.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /universal/scripts-compressed/performance-f741451202e1f5256043b-min.en-US.js HTTP/1.1Host: assets.squarespace.comConnection: keep-aliveOrigin: https://cat-coral-aw9e.squarespace.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://cat-coral-aw9e.squarespace.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /static/vta/5c5a519771c10ba3470d8101/scripts/site-bundle.eaca1e70ec1b91bda1307ad00a593da1.js HTTP/1.1Host: static1.squarespace.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cat-coral-aw9e.squarespace.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /s/poppins/v19/pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2 HTTP/1.1Host: fonts.gstatic.comConnection: keep-aliveOrigin: https://cat-coral-aw9e.squarespace.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://fonts.googleapis.com/css2?family=Poppins:ital,wght@0,300;0,400;0,500;0,700;1,300Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /s/poppins/v19/pxiByp8kv8JHgFVrLDz8Z1xlFQ.woff2 HTTP/1.1Host: fonts.gstatic.comConnection: keep-aliveOrigin: https://cat-coral-aw9e.squarespace.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://fonts.googleapis.com/css2?family=Poppins:ital,wght@0,300;0,400;0,500;0,700;1,300Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /api/1/performance/settings HTTP/1.1Host: cat-coral-aw9e.squarespace.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://cat-coral-aw9e.squarespace.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: crumb=BXLVvM2BqlJONjgyNzQ0NmUxYzhiMGNmOTVlMDMyZDg0YjQ5ZTg4
Source: global traffic	HTTP traffic detected: GET /static/vta/5c5a519771c10ba3470d8101/scripts/floating-cart.40362ede850e90845b14.js HTTP/1.1Host: static1.squarespace.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cat-coral-aw9e.squarespace.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /universal/default-favicon.ico HTTP/1.1Host: assets.squarespace.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cat-coral-aw9e.squarespace.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /content/v1/61ed37d413329125050ef0db/0dad4311-33ee-475e-965c-693a01d55ac5/offfflineee.jpg?format=1500w HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: images.squarespace-cdn.com
Source: global traffic	HTTP traffic detected: GET /crx/blobs/Acy1k0bLIjHsvnKaKN_oRpVaYYvFs25d7GKYF1WXrT6yizCMksBO0c_ggE0B6tx6HPRHe6q1GOEe3_NcIbSiGG8kXeLMUY0sAKVvC6R89zvKM13s5VqoAMZSmuUgjQL5vlygJuArQghXXE_qTL7NlQ/extension_8520_615_0_5.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: cat-coral-aw9e.squarespace.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: crumb=BXLVvM2BqlJONjgyNzQ0NmUxYzhiMGNmOTVlMDMyZDg0YjQ5ZTg4; ss_cvr=85be44b4-8245-4f7f-b3c9-836c3e8dd148|1643407989603|1643407989603|1643407989603|1; ss_cvt=1643407989603If-None-Match: W/"79788cc40f4fca36b1ea04e495432f7c"
Source: global traffic	HTTP traffic detected: GET /api/1/performance/settings HTTP/1.1Host: cat-coral-aw9e.squarespace.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://cat-coral-aw9e.squarespace.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: crumb=BXLVvM2BqlJONjgyNzQ0NmUxYzhiMGNmOTVlMDMyZDg0YjQ5ZTg4; ss_cvr=85be44b4-8245-4f7f-b3c9-836c3e8dd148|1643407989603|1643407989603|1643407989603|1; ss_cvt=1643407989603
Source: global traffic	HTTP traffic detected: GET /content/v1/61ed37d413329125050ef0db/0dad4311-33ee-475e-965c-693a01d55ac5/offfflineee.jpg?format=1500w HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: images.squarespace-cdn.comIf-None-Match: CLKur+WTyvUCEAE=
Source: global traffic	HTTP traffic detected: GET /c8oc473cfg4i3gfhcdib43xd732xddg8cnxbd4873ifd/3nsdfstt.html HTTP/1.1Host: sgp1.digitaloceanspaces.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.0.0/css/bootstrap.min.css HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-aliveOrigin: https://sgp1.digitaloceanspaces.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,*/*;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://sgp1.digitaloceanspaces.com/c8oc473cfg4i3gfhcdib43xd732xddg8cnxbd4873ifd/3nsdfstt.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.0.0/js/bootstrap.min.js HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-aliveOrigin: https://sgp1.digitaloceanspaces.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://sgp1.digitaloceanspaces.com/c8oc473cfg4i3gfhcdib43xd732xddg8cnxbd4873ifd/3nsdfstt.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /ajax/libs/popper.js/1.12.9/umd/popper.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveOrigin: https://sgp1.digitaloceanspaces.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://sgp1.digitaloceanspaces.com/c8oc473cfg4i3gfhcdib43xd732xddg8cnxbd4873ifd/3nsdfstt.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /simbla-static-2/2020/11/5faba665321d68001d4fc0e4/5faba6db73aef50019af7085/rC56cpX1uS2qJKOxJ-5Sb8u-.svg HTTP/1.1Host: s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://sgp1.digitaloceanspaces.com/c8oc473cfg4i3gfhcdib43xd732xddg8cnxbd4873ifd/3nsdfstt.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /simbla-static-2/2020/11/5faba665321d68001d4fc0e4/5faba6db73aef50019af7085/ZJH_2F3Xi0SopxxCuN7EKeDY.jpg HTTP/1.1Host: s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://sgp1.digitaloceanspaces.com/c8oc473cfg4i3gfhcdib43xd732xddg8cnxbd4873ifd/3nsdfstt.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /s2/favicons?domain=office.com HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://sgp1.digitaloceanspaces.com/c8oc473cfg4i3gfhcdib43xd732xddg8cnxbd4873ifd/3nsdfstt.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /s2/favicons?domain=office.com HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: www.google.comCookie: CONSENT=YES+GB.en-GB+V9+BX

Source: Ruleset Data.0.dr	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: Filtering Rules.0.dr, Ruleset Data.0.dr	String found in binary or memory: www.facebook.com/ajax/ads/ equals www.facebook.com (Facebook)
Source: Filtering Rules.0.dr	String found in binary or memory: www.facebook.com0 equals www.facebook.com (Facebook)

Source: angular.js.0.dr	String found in binary or memory: http://angularjs.org
Source: data_3.2.dr	String found in binary or memory: http://crl.pki.goog/gsr1/gsr1.crl0;
Source: data_3.2.dr	String found in binary or memory: http://crl.pki.goog/gtsr1/gtsr1.crl0W
Source: data_3.2.dr	String found in binary or memory: http://crls.pki.goog/gts1c3/QqFxbi9M48c.crl0
Source: angular.js.0.dr	String found in binary or memory: http://errors.angularjs.org/1.6.4-local
Source: data_3.2.dr	String found in binary or memory: http://ocsp.pki.goog/gsr10)
Source: data_3.2.dr	String found in binary or memory: http://ocsp.pki.goog/gts1c301
Source: data_3.2.dr	String found in binary or memory: http://ocsp.pki.goog/gtsr100
Source: data_1.2.dr, data_2.2.dr	String found in binary or memory: http://office.com&size=16
Source: data_2.2.dr	String found in binary or memory: http://office.com&size=16X-Content-Type-Options:
Source: data_3.2.dr	String found in binary or memory: http://pki.goog/gsr1/gsr1.crt02
Source: data_3.2.dr	String found in binary or memory: http://pki.goog/repo/certs/gts1c3.der0
Source: data_3.2.dr	String found in binary or memory: http://pki.goog/repo/certs/gtsr1.der04
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: http://tools.ietf.org/html/rfc1950
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01
Source: Reporting and NEL.2.dr	String found in binary or memory: https://a.nel.cloudflare.com/report/v3?s=bxB42P6scv2gZX97aMH%2ByNs%2FyKVDTiZHLM%2BJJRKHCSx3hprVGzeP%
Source: Reporting and NEL.2.dr	String found in binary or memory: https://a.nel.cloudflare.com/report/v3?s=eF1kOIDiUdqqkrOJW%2BH6ac%2FTDkntoA8Xo47l%2B8ahrZY1kkK2N2Ge8
Source: manifest.json1.0.dr, af92be77-3de8-4fdb-a7fb-266fe4cd52db.tmp.2.dr, b37fa976-3867-43d4-9069-65c06440bf53.tmp.2.dr	String found in binary or memory: https://accounts.google.com
Source: craw_window.js.0.dr	String found in binary or memory: https://accounts.google.com/MergeSession
Source: af92be77-3de8-4fdb-a7fb-266fe4cd52db.tmp.2.dr	String found in binary or memory: https://ajax.googleapis.com
Source: Network Action Predictor.0.dr	String found in binary or memory: https://ajax.googleapis.com/
Source: data_3.2.dr, data_1.2.dr	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
Source: manifest.json1.0.dr, af92be77-3de8-4fdb-a7fb-266fe4cd52db.tmp.2.dr, b37fa976-3867-43d4-9069-65c06440bf53.tmp.2.dr	String found in binary or memory: https://apis.google.com
Source: mirroring_common.js.0.dr	String found in binary or memory: https://apis.google.com/js/client.js
Source: data_1.2.dr	String found in binary or memory: https://assets.squarespace.com/
Source: data_1.2.dr, Favicons.0.dr	String found in binary or memory: https://assets.squarespace.com/universal/default-favicon.ico
Source: data_1.2.dr	String found in binary or memory: https://assets.squarespace.com/universal/scripts-compressed/cldr-resource-pack-19f316c82441424835c5a
Source: data_1.2.dr	String found in binary or memory: https://assets.squarespace.com/universal/scripts-compressed/common-e4e3ca11dc5639f41441c-min.en-US.j
Source: data_1.2.dr	String found in binary or memory: https://assets.squarespace.com/universal/scripts-compressed/common-vendors-223bd45b38abd65f911e3-min
Source: data_1.2.dr	String found in binary or memory: https://assets.squarespace.com/universal/scripts-compressed/common-vendors-stable-545adf5039693142a2
Source: data_1.2.dr	String found in binary or memory: https://assets.squarespace.com/universal/scripts-compressed/moment-js-vendor-2c8245ba6fac7b95a166c-m
Source: data_1.2.dr	String found in binary or memory: https://assets.squarespace.com/universal/scripts-compressed/performance-f741451202e1f5256043b-min.en
Source: data_1.2.dr	String found in binary or memory: https://assets.squarespace.com/universal/scripts-compressed/style-loader-runtime-e1419a2de35834b4cc6
Source: mirroring_common.js.0.dr	String found in binary or memory: https://castedumessaging-pa.googleapis.com/v1
Source: 000003.log5.0.dr	String found in binary or memory: https://cat-coral-aw9e.squarespace.com
Source: 000003.log4.0.dr, History.0.dr	String found in binary or memory: https://cat-coral-aw9e.squarespace.com/
Source: Favicons.0.dr, History.0.dr	String found in binary or memory: https://cat-coral-aw9e.squarespace.com/#page
Source: History.0.dr	String found in binary or memory: https://cat-coral-aw9e.squarespace.com/#pageNew
Source: History Provider Cache.0.dr	String found in binary or memory: https://cat-coral-aw9e.squarespace.com/2
Source: History.0.dr	String found in binary or memory: https://cat-coral-aw9e.squarespace.com/New
Source: data_1.2.dr	String found in binary or memory: https://cat-coral-aw9e.squarespace.com/api/1/performance/settings
Source: data_3.2.dr, data_1.2.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js
Source: data_1.2.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.jskf
Source: af92be77-3de8-4fdb-a7fb-266fe4cd52db.tmp.2.dr, b37fa976-3867-43d4-9069-65c06440bf53.tmp.2.dr	String found in binary or memory: https://clients2.google.com
Source: mirroring_hangouts.js.0.dr, mirroring_cast_streaming.js.0.dr	String found in binary or memory: https://clients2.google.com/cr/report
Source: manifest.json1.0.dr, manifest.json0.0.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: af92be77-3de8-4fdb-a7fb-266fe4cd52db.tmp.2.dr, b37fa976-3867-43d4-9069-65c06440bf53.tmp.2.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://clients6.google.com
Source: Network Action Predictor.0.dr	String found in binary or memory: https://code.jquery.com/
Source: data_3.2.dr, data_1.2.dr	String found in binary or memory: https://code.jquery.com/jquery-3.1.1.min.js
Source: data_3.2.dr, data_1.2.dr	String found in binary or memory: https://code.jquery.com/jquery-3.2.1.slim.min.js
Source: data_3.2.dr, data_1.2.dr	String found in binary or memory: https://code.jquery.com/jquery-3.3.1.js
Source: data_1.2.dr	String found in binary or memory: https://code.jquery.com/jquery-3.3.1.js&
Source: af92be77-3de8-4fdb-a7fb-266fe4cd52db.tmp.2.dr	String found in binary or memory: https://content-autofill.googleapis.com
Source: data_1.2.dr	String found in binary or memory: https://content-autofill.googleapis.com/v1/pages/Chc2LjEuMTcxNS4xNDQyL2VuIChHR0xMKRIUCYkvXWHctwjHEgk
Source: manifest.json1.0.dr	String found in binary or memory: https://content.googleapis.com
Source: mirroring_cast_streaming.js.0.dr, common.js.0.dr	String found in binary or memory: https://crash.corp.google.com/samples?reportid=&q=
Source: LICENSE.txt.0.dr	String found in binary or memory: https://creativecommons.org/.
Source: LICENSE.txt.0.dr	String found in binary or memory: https://creativecommons.org/compatiblelicenses
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://creativecommons.org/publicdomain/zero/1.0/.
Source: data_2.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/apps-themes
Source: data_2.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/apps-themesCross-Origin-Resource-Policy:
Source: data_3.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/hosted-libraries-pushers
Source: data_3.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/hosted-libraries-pushersCross-Origin-Resource-Policy:
Source: data_2.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/media-favicon
Source: data_2.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/media-faviconCross-Origin-Resource-Policy:
Source: data_2.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/apps-themes
Source: data_3.2.dr, Reporting and NEL.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers
Source: data_2.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/media-favicon
Source: Reporting and NEL.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/media-favicon_
Source: 7af79dd7-f785-4c33-96cf-72b065cad4db.tmp.2.dr, d08d79c0-dc2c-41f0-ac96-3e0465d52cc1.tmp.2.dr, af92be77-3de8-4fdb-a7fb-266fe4cd52db.tmp.2.dr, b37fa976-3867-43d4-9069-65c06440bf53.tmp.2.dr	String found in binary or memory: https://dns.google
Source: mirroring_common.js.0.dr	String found in binary or memory: https://docs.google.com
Source: LICENSE.txt.0.dr	String found in binary or memory: https://easylist.to/)
Source: manifest.json1.0.dr	String found in binary or memory: https://feedback.googleusercontent.com
Source: data_3.2.dr	String found in binary or memory: https://firliamwut.ca/nwalk/
Source: af92be77-3de8-4fdb-a7fb-266fe4cd52db.tmp.2.dr, b37fa976-3867-43d4-9069-65c06440bf53.tmp.2.dr	String found in binary or memory: https://fonts.googleapis.com
Source: Network Action Predictor.0.dr	String found in binary or memory: https://fonts.googleapis.com/
Source: data_1.2.dr	String found in binary or memory: https://fonts.googleapis.com/css2?family=Poppins:ital
Source: data_3.2.dr, data_1.2.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Archivo
Source: manifest.json1.0.dr	String found in binary or memory: https://fonts.googleapis.com;
Source: data_3.2.dr, af92be77-3de8-4fdb-a7fb-266fe4cd52db.tmp.2.dr, b37fa976-3867-43d4-9069-65c06440bf53.tmp.2.dr	String found in binary or memory: https://fonts.gstatic.com
Source: Network Action Predictor.0.dr	String found in binary or memory: https://fonts.gstatic.com/
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/poppins/v19/pxiByp8kv8JHgFVrLCz7Z11lFc-K.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/poppins/v19/pxiByp8kv8JHgFVrLCz7Z1JlFc-K.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/poppins/v19/pxiByp8kv8JHgFVrLCz7Z1xlFQ.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/poppins/v19/pxiByp8kv8JHgFVrLDz8Z11lFc-K.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/poppins/v19/pxiByp8kv8JHgFVrLDz8Z1JlFc-K.woff2)
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/poppins/v19/pxiByp8kv8JHgFVrLDz8Z1xlFQ.woff2
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/poppins/v19/pxiByp8kv8JHgFVrLDz8Z1xlFQ.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/poppins/v19/pxiByp8kv8JHgFVrLGT9Z11lFc-K.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/poppins/v19/pxiByp8kv8JHgFVrLGT9Z1JlFc-K.woff2)
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/poppins/v19/pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/poppins/v19/pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/poppins/v19/pxiDyp8kv8JHgFVrJJLm21lVF9eO.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/poppins/v19/pxiDyp8kv8JHgFVrJJLm21lVFteOcEg.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/poppins/v19/pxiDyp8kv8JHgFVrJJLm21lVGdeOcEg.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/poppins/v19/pxiEyp8kv8JHgFVrJJbecmNE.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/poppins/v19/pxiEyp8kv8JHgFVrJJfecg.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/poppins/v19/pxiEyp8kv8JHgFVrJJnecmNE.woff2)
Source: manifest.json1.0.dr	String found in binary or memory: https://fonts.gstatic.com;
Source: material_css_min.css.0.dr, angular.js.0.dr	String found in binary or memory: https://github.com/angular/material
Source: LICENSE.txt.0.dr	String found in binary or memory: https://github.com/easylist)
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://github.com/madler/zlib/blob/master/zlib.h
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://hangouts.clients6.google.com
Source: manifest.json1.0.dr	String found in binary or memory: https://hangouts.google.com/
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://hangouts.google.com/hangouts/_/logpref
Source: data_1.2.dr	String found in binary or memory: https://images.squarespace-cdn.com/content/v1/61ed37d413329125050ef0db/0dad4311-33ee-475e-965c-693a0
Source: Network Action Predictor.0.dr	String found in binary or memory: https://maxcdn.bootstrapcdn.com/
Source: data_3.2.dr, data_1.2.dr	String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css
Source: data_3.2.dr, data_1.2.dr	String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js
Source: mirroring_common.js.0.dr	String found in binary or memory: https://meet.google.com
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://meetings.clients6.google.com
Source: mirroring_common.js.0.dr	String found in binary or memory: https://networktraversal.googleapis.com/v1alpha
Source: af92be77-3de8-4fdb-a7fb-266fe4cd52db.tmp.2.dr, b37fa976-3867-43d4-9069-65c06440bf53.tmp.2.dr	String found in binary or memory: https://ogs.google.com
Source: data_1.2.dr	String found in binary or memory: https://p.typekit.net/p.gif?s=2&k=646866_61ed37d413329125050ef0db&ht=tk&h=cat-coral-aw9e.squarespace
Source: craw_window.js.0.dr, manifest.json0.0.dr	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: data_3.2.dr	String found in binary or memory: https://pki.goog/repository/0
Source: af92be77-3de8-4fdb-a7fb-266fe4cd52db.tmp.2.dr, b37fa976-3867-43d4-9069-65c06440bf53.tmp.2.dr	String found in binary or memory: https://play.google.com
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://preprod-hangouts-googleapis.sandbox.google.com
Source: b37fa976-3867-43d4-9069-65c06440bf53.tmp.2.dr	String found in binary or memory: https://r5---sn-h0jeln7l.gvt1.com
Source: af92be77-3de8-4fdb-a7fb-266fe4cd52db.tmp.2.dr, b37fa976-3867-43d4-9069-65c06440bf53.tmp.2.dr	String found in binary or memory: https://redirector.gvt1.com
Source: data_2.2.dr	String found in binary or memory: https://res-1.cdn.office.net/officehub/images/content/images/favicon-8f211ea639.ico
Source: data_2.2.dr	String found in binary or memory: https://res-1.cdn.office.net/officehub/images/content/images/favicon-8f211ea639.icoContent-Security-
Source: data_3.2.dr, data_1.2.dr	String found in binary or memory: https://s3.amazonaws.com/simbla-static-2/2020/11/5faba665321d68001d4fc0e4/5faba6db73aef50019af7085/Z
Source: data_1.2.dr	String found in binary or memory: https://s3.amazonaws.com/simbla-static-2/2020/11/5faba665321d68001d4fc0e4/5faba6db73aef50019af7085/r
Source: craw_window.js.0.dr, manifest.json0.0.dr	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: Network Action Predictor.0.dr	String found in binary or memory: https://sgp1.digitaloceanspaces.com/
Source: Current Session.0.dr, data_1.2.dr, Favicons.0.dr, History.0.dr	String found in binary or memory: https://sgp1.digitaloceanspaces.com/c8oc473cfg4i3gfhcdib43xd732xddg8cnxbd4873ifd/3nsdfstt.html
Source: History.0.dr	String found in binary or memory: https://sgp1.digitaloceanspaces.com/c8oc473cfg4i3gfhcdib43xd732xddg8cnxbd4873ifd/3nsdfstt.htmlLogin
Source: data_1.2.dr	String found in binary or memory: https://sgp1.digitaloceanspaces.com/c8oc473cfg4i3gfhcdib43xd732xddg8cnxbd4873ifd/3nsdfstt.htmlM
Source: data_1.2.dr	String found in binary or memory: https://sourcemaps.squarespace.net/universal/scripts-compressed/style-loader-runtime-4763c8de12e6131
Source: af92be77-3de8-4fdb-a7fb-266fe4cd52db.tmp.2.dr, b37fa976-3867-43d4-9069-65c06440bf53.tmp.2.dr	String found in binary or memory: https://ssl.gstatic.com
Source: Network Action Predictor.0.dr	String found in binary or memory: https://static1.squarespace.com/
Source: data_1.2.dr	String found in binary or memory: https://static1.squarespace.com/static/versioned-site-css/61ed37d413329125050ef0db/1/5c5a519771c10ba
Source: data_1.2.dr	String found in binary or memory: https://static1.squarespace.com/static/vta/5c5a519771c10ba3470d8101/scripts/floating-cart.40362ede85
Source: data_1.2.dr	String found in binary or memory: https://static1.squarespace.com/static/vta/5c5a519771c10ba3470d8101/scripts/site-bundle.eaca1e70ec1b
Source: messages.json15.0.dr, messages.json66.0.dr, messages.json5.0.dr, messages.json7.0.dr, messages.json37.0.dr, messages.json49.0.dr, feedback.html.0.dr, messages.json69.0.dr, messages.json71.0.dr, messages.json73.0.dr, messages.json54.0.dr, messages.json70.0.dr, messages.json74.0.dr, messages.json33.0.dr, messages.json35.0.dr, messages.json0.0.dr, messages.json48.0.dr, messages.json85.0.dr, messages.json88.0.dr, messages.json14.0.dr, messages.json87.0.dr	String found in binary or memory: https://support.google.com/chromecast/answer/2998456
Source: messages.json15.0.dr, messages.json66.0.dr, messages.json5.0.dr, messages.json7.0.dr, messages.json37.0.dr, messages.json49.0.dr, feedback.html.0.dr, messages.json69.0.dr, messages.json71.0.dr, messages.json73.0.dr, messages.json54.0.dr, messages.json70.0.dr, messages.json74.0.dr, messages.json33.0.dr, messages.json35.0.dr, messages.json0.0.dr, messages.json48.0.dr, messages.json85.0.dr, messages.json88.0.dr, messages.json14.0.dr, messages.json87.0.dr	String found in binary or memory: https://support.google.com/chromecast/troubleshooter/2995236
Source: af92be77-3de8-4fdb-a7fb-266fe4cd52db.tmp.2.dr	String found in binary or memory: https://t3.gstatic.com
Source: data_2.2.dr	String found in binary or memory: https://t3.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE
Source: Network Action Predictor.0.dr	String found in binary or memory: https://use.fontawesome.com/
Source: data_1.2.dr	String found in binary or memory: https://use.fontawesome.com/releases/v5.7.0/css/all.css
Source: data_1.2.dr	String found in binary or memory: https://use.fontawesome.com/releases/v5.7.0/webfonts/fa-solid-900.woff2
Source: data_1.2.dr	String found in binary or memory: https://use.fontawesome.com/releases/v5.7.0/webfonts/fa-solid-900.woff2m
Source: Network Action Predictor.0.dr	String found in binary or memory: https://use.typekit.net/
Source: data_1.2.dr	String found in binary or memory: https://use.typekit.net/af/18be85/00000000000000003b9acaf9/27/l?subset_id=2&fvd=i5&v=3
Source: data_1.2.dr	String found in binary or memory: https://use.typekit.net/af/6ce26b/00000000000000003b9acafd/27/l?subset_id=2&fvd=i7&v=3
Source: data_1.2.dr	String found in binary or memory: https://use.typekit.net/af/6ce26b/00000000000000003b9acafd/27/l?subset_id=2&fvd=i7&v=3(window.wpJson
Source: data_1.2.dr	String found in binary or memory: https://use.typekit.net/af/6d4bb2/00000000000000003b9acafc/27/l?subset_id=2&fvd=n7&v=3
Source: data_1.2.dr	String found in binary or memory: https://use.typekit.net/af/829fc1/00000000000000003b9acaf8/27/l?subset_id=2&fvd=n5&v=3
Source: data_1.2.dr	String found in binary or memory: https://use.typekit.net/ik/EyMNSHHtGzstEGNMUL3uKsOGOICwk6t62kbSBhgD3EJfeCX2fFHN4UJLFRbh52jhWDjUZAbDF
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://www-googleapis-staging.sandbox.google.com
Source: manifest.json1.0.dr, af92be77-3de8-4fdb-a7fb-266fe4cd52db.tmp.2.dr, b37fa976-3867-43d4-9069-65c06440bf53.tmp.2.dr	String found in binary or memory: https://www.google.com
Source: manifest.json0.0.dr	String found in binary or memory: https://www.google.com/
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/accounts/OAuthLogin?issueuberauth=1
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/cleardot.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/dot2.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/x2.gif
Source: craw_background.js.0.dr	String found in binary or memory: https://www.google.com/intl/en-US/chrome/blank.html
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://www.google.com/log?format=json&hasfast=true
Source: data_3.2.dr, data_1.2.dr, Favicons.0.dr	String found in binary or memory: https://www.google.com/s2/favicons?domain=office.com
Source: Favicons.0.dr	String found in binary or memory: https://www.google.com/s2/favicons?domain=office.comA
Source: feedback_script.js.0.dr	String found in binary or memory: https://www.google.com/tools/feedback
Source: manifest.json1.0.dr	String found in binary or memory: https://www.google.com;
Source: craw_window.js.0.dr, craw_background.js.0.dr, af92be77-3de8-4fdb-a7fb-266fe4cd52db.tmp.2.dr, b37fa976-3867-43d4-9069-65c06440bf53.tmp.2.dr	String found in binary or memory: https://www.googleapis.com
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/
Source: manifest.json1.0.dr	String found in binary or memory: https://www.googleapis.com/auth/calendar.readonly
Source: manifest.json1.0.dr	String found in binary or memory: https://www.googleapis.com/auth/cast-edu-messaging
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json1.0.dr	String found in binary or memory: https://www.googleapis.com/auth/clouddevices
Source: manifest.json1.0.dr	String found in binary or memory: https://www.googleapis.com/auth/hangouts
Source: manifest.json1.0.dr	String found in binary or memory: https://www.googleapis.com/auth/hangouts.readonly
Source: manifest.json1.0.dr	String found in binary or memory: https://www.googleapis.com/auth/meetings
Source: manifest.json1.0.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.peopleapi.readwrite
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: manifest.json1.0.dr	String found in binary or memory: https://www.googleapis.com/auth/userinfo.email
Source: mirroring_common.js.0.dr	String found in binary or memory: https://www.googleapis.com/calendar/v3
Source: mirroring_common.js.0.dr	String found in binary or memory: https://www.googleapis.com/hangouts/v1
Source: af92be77-3de8-4fdb-a7fb-266fe4cd52db.tmp.2.dr, b37fa976-3867-43d4-9069-65c06440bf53.tmp.2.dr	String found in binary or memory: https://www.gstatic.com
Source: common.js.0.dr	String found in binary or memory: https://www.gstatic.com/hangouts_echo_detector/release/%
Source: manifest.json1.0.dr	String found in binary or memory: https://www.gstatic.com;

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8

Source: unknown	HTTPS traffic detected: 151.101.0.238:443 -> 192.168.2.4:49813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.203.100:443 -> 192.168.2.4:49857 version: TLS 1.2

System Summary

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Temp\4434a52a-9ee7-4717-8c98-8ecaf034b671.tmp

Jump to behavior

Source: classification engine

Classification label: mal80.phis.win@35/250@20/15

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "https://cat-coral-aw9e.squarespace.com/
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1504,16609655422503311352,15856707411697341696,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1936 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1504,16609655422503311352,15856707411697341696,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1936 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-61F46A70-1BB4.pma

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next

Source: Window Recorder

Window detected: More than 3 window changes detected

Persistence and Installation Behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Temp\7092_1416688899\LICENSE.txt

Jump to behavior