Windows Analysis Report https://sites.google.com/view/largey-law/home

AV Detection:

Antivirus / Scanner detection for submitted sample

Source: https://sites.google.com/view/largey-law/home

SlashNext: detection malicious, Label: Fake Login Page type: Phishing & Social Engineering

Antivirus detection for URL or domain

Source: https://f002.backblazeb2.com/file/adenopodous-aminobenzine-taciturnity/index.html

SlashNext: Label: Fake Login Page type: Phishing & Social Engineering

Phishing:

Yara detected HtmlPhish20

Source: Yara match

File source: 96078.0.pages.csv, type: HTML

Compliance:

Creates a directory in C:\Program Files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic			Jump to behavior

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 142.250.203.97:443 -> 192.168.2.3:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.203.97:443 -> 192.168.2.3:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.203.97:443 -> 192.168.2.3:49862 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.203.97:443 -> 192.168.2.3:49863 version: TLS 1.2

Networking:

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: clients2.google.com

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822

Downloads files from webservers via HTTP

Source: global traffic	HTTP traffic detected: GET /view/largey-law/home HTTP/1.1Host: sites.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-85.0.4183.121Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/client.js?onload=gapiLoaded HTTP/1.1Host: apis.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://sites.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=JGe-nRa5snTP5OAvnVC5hUnUIMzfwIjKeyBxgmZzjzSA94H3FLgw0P7fZTS2_erEs9nkath0bsFHCMxNhUuqR4nEKA-DYG7lCe341bwOZN9U_PrAL01kx5rw1vcFSdrnc9qbcmDacR4G7dpVHB01nUC_ygt2mBb5Jsg1_87xcQg
Source: global traffic	HTTP traffic detected: GET /G0rnQ-w66xDV0RMnqhQtHvcmZmpLrrfQN6tq9_6dEf56T3Gj8Q8p_TSSeu7uISmlCQJRYF78jkI1-SdYDmrl-w=w16383 HTTP/1.1Host: lh5.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://sites.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /H67jYE9vLDeN45uaM4aYtT8i21utq_XvnK3Oi2n3P8ETKovf1rknwRI2ICtB1l0ejfncNAHwetLoux4U4gH5Ug=w16383 HTTP/1.1Host: lh4.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://sites.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff2 HTTP/1.1Host: fonts.gstatic.comConnection: keep-aliveOrigin: https://sites.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://fonts.googleapis.com/css?family=Google+Sans_old:400,500|Roboto:300,400,500,700|Source+Code+Pro:400,700&display=swapAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/ptsans/v12/jizfRExUiTo99u79B_mh0O6tLQ.woff2 HTTP/1.1Host: fonts.gstatic.comConnection: keep-aliveOrigin: https://sites.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://fonts.googleapis.com/css?family=PT%20Sans%3A400%2C700%7CMerriweather%3A400%2C700&display=swapAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/ptsans/v12/jizaRExUiTo99u79D0KExQ.woff2 HTTP/1.1Host: fonts.gstatic.comConnection: keep-aliveOrigin: https://sites.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://fonts.googleapis.com/css?family=PT%20Sans%3A400%2C700%7CMerriweather%3A400%2C700&display=swapAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /5iRDgMbqQtJfmYxt-KW9OWyOXr8ZY6jLUEc8o_GKPlTEsp8QMqn6vqT73Yx5PJo8rZaQAgqgAJkBB0kQFaRMxyUEhvXKiOpnp-umJ6CwR6w7Fu9fKTabwHkvIoryyaJuYg=w1280 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh6.googleusercontent.com
Source: global traffic	HTTP traffic detected: GET /G0rnQ-w66xDV0RMnqhQtHvcmZmpLrrfQN6tq9_6dEf56T3Gj8Q8p_TSSeu7uISmlCQJRYF78jkI1-SdYDmrl-w=w16383 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh5.googleusercontent.com
Source: global traffic	HTTP traffic detected: GET /G0rnQ-w66xDV0RMnqhQtHvcmZmpLrrfQN6tq9_6dEf56T3Gj8Q8p_TSSeu7uISmlCQJRYF78jkI1-SdYDmrl-w=w16383 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh5.googleusercontent.comIf-None-Match: "v1"
Source: global traffic	HTTP traffic detected: GET /Vgs4iFFz7AqUPw1RP3csLdnZFpRXFn8OnBesJDeWUDrZp7zNbmpxXCbVQ4rE5QBN_im4EXRfs7YFNOhX8UINwdLBMhC6earzzoT5jtCTlA_KmJr91z7pkVZFaMKztOVV8Q=w1280 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh6.googleusercontent.com
Source: global traffic	HTTP traffic detected: GET /nABGKzjFm787i3eb_QrfBRcsF99mxH5LUTCVTYM34cWcIAObvRqOTqDNfx1agbNhpfyIYZqiGSPTmwCg0PuBs1bhPhm4n8HqV9xqovgE7NhmVGwExu33hDeQaxSfCOYZaw=w1280 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh6.googleusercontent.com
Source: global traffic	HTTP traffic detected: GET /url?q=https%3A%2F%2Ff002.backblazeb2.com%2Ffile%2Fadenopodous-aminobenzine-taciturnity%2Findex.html&sa=D&sntz=1&usg=AFQjCNGQfTfk_blQcLJ9Ey57NRy2LfH3dw HTTP/1.1Host: www.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=JGe-nRa5snTP5OAvnVC5hUnUIMzfwIjKeyBxgmZzjzSA94H3FLgw0P7fZTS2_erEs9nkath0bsFHCMxNhUuqR4nEKA-DYG7lCe341bwOZN9U_PrAL01kx5rw1vcFSdrnc9qbcmDacR4G7dpVHB01nUC_ygt2mBb5Jsg1_87xcQg
Source: global traffic	HTTP traffic detected: GET /file/adenopodous-aminobenzine-taciturnity/index.html HTTP/1.1Host: f002.backblazeb2.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://www.google.com/url?q=https%3A%2F%2Ff002.backblazeb2.com%2Ffile%2Fadenopodous-aminobenzine-taciturnity%2Findex.html&sa=D&sntz=1&usg=AFQjCNGQfTfk_blQcLJ9Ey57NRy2LfH3dwAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: f002.backblazeb2.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://f002.backblazeb2.com/file/adenopodous-aminobenzine-taciturnity/index.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /technologies/cookies HTTP/1.1Host: policies.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://www.google.com/policies/technologies/cookies/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=JGe-nRa5snTP5OAvnVC5hUnUIMzfwIjKeyBxgmZzjzSA94H3FLgw0P7fZTS2_erEs9nkath0bsFHCMxNhUuqR4nEKA-DYG7lCe341bwOZN9U_PrAL01kx5rw1vcFSdrnc9qbcmDacR4G7dpVHB01nUC_ygt2mBb5Jsg1_87xcQg; CONSENT=PENDING+957
Source: global traffic	HTTP traffic detected: GET /embed/TBR-xtJVq7E?rel=0&showinfo=0&theme=light&version=3&hl=en&cc_lang_pref=en&cc_load_policy=1 HTTP/1.1Host: www.youtube-nocookie.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://policies.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /vi_webp/TBR-xtJVq7E/sddefault.webp HTTP/1.1Host: i.ytimg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.youtube-nocookie.com/embed/TBR-xtJVq7E?rel=0&showinfo=0&theme=light&version=3&hl=en&cc_lang_pref=en&cc_load_policy=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /analytics.js HTTP/1.1Host: www.google-analytics.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://policies.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ytc/AKedOLQhCqLTkEGQeSzNuaSndU18yVP8hqtaW-zJ4-ylRlw=s68-c-k-c0x00ffffff-no-rj HTTP/1.1Host: yt3.ggpht.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.youtube-nocookie.com/embed/TBR-xtJVq7E?rel=0&showinfo=0&theme=light&version=3&hl=en&cc_lang_pref=en&cc_load_policy=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /KxF602uOt-S6uxjxLAK7IhI-GwM0-DhJ9w5Vh6S_0YLH7cFPulrBfUrnKX0zVCcA2bHy_pDn671BWvAyWoYPmg=w16383 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh4.googleusercontent.com
Source: global traffic	HTTP traffic detected: GET /MiudLpjqSVQl2ih8dzp2oGmMX4iv1UHj55sG8qD_TH8X61eYONRHeRp893wLmK5BGtn6RL0sDLPRZz7_PfrXVtb1WLxg1VEOjeeAHoX5dgXI4bbfMwSVS-2sGdfeEH_u6w=w1280 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh3.googleusercontent.com
Source: global traffic	HTTP traffic detected: GET /KxF602uOt-S6uxjxLAK7IhI-GwM0-DhJ9w5Vh6S_0YLH7cFPulrBfUrnKX0zVCcA2bHy_pDn671BWvAyWoYPmg=w16383 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh4.googleusercontent.comIf-None-Match: "v1"
Source: global traffic	HTTP traffic detected: GET /MiudLpjqSVQl2ih8dzp2oGmMX4iv1UHj55sG8qD_TH8X61eYONRHeRp893wLmK5BGtn6RL0sDLPRZz7_PfrXVtb1WLxg1VEOjeeAHoX5dgXI4bbfMwSVS-2sGdfeEH_u6w=w1280 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh3.googleusercontent.comIf-None-Match: "v1"
Source: global traffic	HTTP traffic detected: GET /KxF602uOt-S6uxjxLAK7IhI-GwM0-DhJ9w5Vh6S_0YLH7cFPulrBfUrnKX0zVCcA2bHy_pDn671BWvAyWoYPmg=w16383 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh4.googleusercontent.comIf-None-Match: "v1"
Source: global traffic	HTTP traffic detected: GET /MiudLpjqSVQl2ih8dzp2oGmMX4iv1UHj55sG8qD_TH8X61eYONRHeRp893wLmK5BGtn6RL0sDLPRZz7_PfrXVtb1WLxg1VEOjeeAHoX5dgXI4bbfMwSVS-2sGdfeEH_u6w=w1280 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh3.googleusercontent.comIf-None-Match: "v1"
Source: global traffic	HTTP traffic detected: GET /8ezfS6tXtSo9i6phbOWKCeoROuz-N9PyeSog-i1-ilbGNmTSboJCIyPKg1kNE2hFj1-Tfh5VNel5rM-Ox8ey9A=w16383 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh3.googleusercontent.com
Source: global traffic	HTTP traffic detected: GET /B-NpZYauOh0G5xpxxkZ6E6-3CmZDmPKWsVD4PhIF3jem5FwwY74cDSYsFGDCmwjSEw4jOZqCdF6UHPDTRBSZkLW_CIEXaJdrBLNh-KDLvLe_iz1xMm33S4WnMMUwSGT7zA=w1280 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh6.googleusercontent.com
Source: global traffic	HTTP traffic detected: GET /e4Ut2zna8Bjo-ZL498MyZn60CppkysjE8TBHx5jA2vVRqMEOcpp7DcKEMP7uIfcwvKwJpUC9bJoAVXVQ_PE4vnr-BuVScXjPrmGEBp5uETE_3ddd67usIi9_dVtc5FI1rg=w1280 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh4.googleusercontent.com

URLs found in memory or binary data

Source: angular.js.0.dr	String found in binary or memory: http://angularjs.org
Source: data_3.2.dr	String found in binary or memory: http://crl.pki.goog/gsr1/gsr1.crl0;
Source: data_3.2.dr	String found in binary or memory: http://crl.pki.goog/gtsr1/gtsr1.crl0W
Source: data_3.2.dr	String found in binary or memory: http://crls.pki.goog/gts1c3/QOvJ0N1sT2A.crl0
Source: data_3.2.dr	String found in binary or memory: http://crls.pki.goog/gts1c3/QqFxbi9M48c.crl0
Source: data_3.2.dr	String found in binary or memory: http://crls.pki.goog/gts1c3/fVJxbV-Ktmk.crl0
Source: data_3.2.dr	String found in binary or memory: http://crls.pki.goog/gts1c3/zdATt0Ex_Fk.crl0
Source: angular.js.0.dr	String found in binary or memory: http://errors.angularjs.org/1.6.4-local
Source: pnacl_public_x86_64_pnacl_sz_nexe.0.dr, pnacl_public_x86_64_pnacl_llc_nexe.0.dr	String found in binary or memory: http://llvm.org/):
Source: data_3.2.dr	String found in binary or memory: http://ocsp.pki.goog/gsr10)
Source: data_3.2.dr	String found in binary or memory: http://ocsp.pki.goog/gts1c301
Source: data_3.2.dr	String found in binary or memory: http://ocsp.pki.goog/gtsr100
Source: data_3.2.dr	String found in binary or memory: http://pki.goog/gsr1/gsr1.crt02
Source: data_3.2.dr	String found in binary or memory: http://pki.goog/repo/certs/gts1c3.der0
Source: data_3.2.dr	String found in binary or memory: http://pki.goog/repo/certs/gts1c3.der0M
Source: data_3.2.dr	String found in binary or memory: http://pki.goog/repo/certs/gts1c3.der0c
Source: data_3.2.dr	String found in binary or memory: http://pki.goog/repo/certs/gtsr1.der04
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: http://tools.ietf.org/html/rfc1950
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01
Source: 144b3a37-1849-426a-9df6-e78ad1449cc3.tmp.2.dr, manifest.json.0.dr, d0e40d87-35a4-417a-91e9-2584bb6541dc.tmp.2.dr	String found in binary or memory: https://accounts.google.com
Source: craw_window.js.0.dr	String found in binary or memory: https://accounts.google.com/MergeSession
Source: data_3.2.dr, 144b3a37-1849-426a-9df6-e78ad1449cc3.tmp.2.dr, manifest.json.0.dr, d0e40d87-35a4-417a-91e9-2584bb6541dc.tmp.2.dr	String found in binary or memory: https://apis.google.com
Source: Network Action Predictor.0.dr	String found in binary or memory: https://apis.google.com/
Source: data_1.2.dr	String found in binary or memory: https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.R9QuLJE0V3o.O/m=gapi_iframes
Source: data_1.2.dr	String found in binary or memory: https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.7Qaqnm_1sO0.O/m=client/rt=j/sv=1/d=1/
Source: mirroring_common.js.0.dr	String found in binary or memory: https://apis.google.com/js/client.js
Source: data_1.2.dr	String found in binary or memory: https://apis.google.com/js/client.js?onload=gapiLoaded
Source: data_1.2.dr	String found in binary or memory: https://apis.google.com/js/client.js?onload=gapiLoadedj-Z
Source: mirroring_common.js.0.dr	String found in binary or memory: https://castedumessaging-pa.googleapis.com/v1
Source: pnacl_public_x86_64_libpnacl_irt_shim_dummy_a.0.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-clang.git
Source: pnacl_public_x86_64_libpnacl_irt_shim_dummy_a.0.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-llvm.git
Source: 144b3a37-1849-426a-9df6-e78ad1449cc3.tmp.2.dr, d0e40d87-35a4-417a-91e9-2584bb6541dc.tmp.2.dr	String found in binary or memory: https://clients2.google.com
Source: mirroring_hangouts.js.0.dr, mirroring_cast_streaming.js.0.dr	String found in binary or memory: https://clients2.google.com/cr/report
Source: manifest.json0.0.dr, manifest.json3.0.dr, manifest.json.0.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 144b3a37-1849-426a-9df6-e78ad1449cc3.tmp.2.dr, d0e40d87-35a4-417a-91e9-2584bb6541dc.tmp.2.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://clients6.google.com
Source: pnacl_public_x86_64_ld_nexe.0.dr	String found in binary or memory: https://code.google.com/p/nativeclient/issues/entry
Source: pnacl_public_x86_64_ld_nexe.0.dr	String found in binary or memory: https://code.google.com/p/nativeclient/issues/entry%s:
Source: d0e40d87-35a4-417a-91e9-2584bb6541dc.tmp.2.dr	String found in binary or memory: https://content-autofill.googleapis.com
Source: data_1.2.dr	String found in binary or memory: https://content-autofill.googleapis.com/v1/pages/Chc2LjEuMTcxNS4xNDQyL2VuIChHR0xMKRIUCUMm1IiBWOoFEgk
Source: manifest.json.0.dr	String found in binary or memory: https://content.googleapis.com
Source: mirroring_cast_streaming.js.0.dr, common.js.0.dr	String found in binary or memory: https://crash.corp.google.com/samples?reportid=&q=
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://creativecommons.org/publicdomain/zero/1.0/.
Source: data_3.2.dr, data_2.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/apps-themes
Source: data_2.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/apps-themesCross-Origin-Resource-Policy:
Source: data_3.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/apps-themescross-origin-resource-policy:cross-origincross-origin-open
Source: data_3.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/boq-infra/identity-boq-js-css-signers
Source: data_3.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/boq-infra/identity-boq-js-css-signerscross-origin-resource-policy:cro
Source: data_3.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/botguard-scs
Source: data_3.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/botguard-scscross-origin-resource-policy:cross-origincross-origin-ope
Source: data_3.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/cloudview
Source: data_3.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/cloudviewcross-origin-resource-policy:cross-origincross-origin-opener
Source: data_3.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/one-google-eng
Source: data_3.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/one-google-engcross-origin-resource-policy:cross-origincross-origin-o
Source: Reporting and NEL.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/IdentityListAccountsHttp/external
Source: data_2.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/apps-sites
Source: data_2.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/apps-themes
Source: Reporting and NEL.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/apps-themes~
Source: Reporting and NEL.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/boq-infra/identity-boq-js-css-signers
Source: data_3.2.dr, Reporting and NEL.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/botguard-scs
Source: Reporting and NEL.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/botguard-scsl
Source: data_3.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/cloudview
Source: Reporting and NEL.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/encsid_AXrpQdcxyaoTJMYdhC5b1IVX_h4UhkFjYl5miMVZgqtCo-gS
Source: Reporting and NEL.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/encsid_AXrpQddlfEQiOc1nRAeNazvQZcE3oXXKrW5FMkFTMDVwZsRgwAaN
Source: data_3.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/one-google-eng
Source: data_3.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access
Source: data_3.2.dr, Reporting and NEL.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/static-on-bigtable
Source: Reporting and NEL.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/static-on-bigtableQ
Source: data_3.2.dr, Reporting and NEL.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/youtube
Source: Reporting and NEL.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/youtube_
Source: data_3.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/social-frontend-mpm-access
Source: data_3.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/social-frontend-mpm-accesscross-origin-resource-policy:cross-origincr
Source: data_3.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/static-on-bigtable;
Source: b2ea5087-f895-42d2-a475-571926568d43.tmp.2.dr, d5f502fc-979c-4ba8-8aff-35347a69a8dc.tmp.2.dr, 144b3a37-1849-426a-9df6-e78ad1449cc3.tmp.2.dr, d0e40d87-35a4-417a-91e9-2584bb6541dc.tmp.2.dr	String found in binary or memory: https://dns.google
Source: mirroring_common.js.0.dr	String found in binary or memory: https://docs.google.com
Source: Network Action Predictor.0.dr	String found in binary or memory: https://f002.backblazeb2.com/
Source: History.0.dr	String found in binary or memory: https://f002.backblazeb2.com/file/adenopodous-aminobenzine-taciturnity/index.html
Source: History.0.dr	String found in binary or memory: https://f002.backblazeb2.com/file/adenopodous-aminobenzine-taciturnity/index.html/0
Source: data_2.2.dr	String found in binary or memory: https://f002.backblazeb2.com/file/adenopodous-aminobenzine-taciturnity/index.htmlCache-Control:
Source: manifest.json.0.dr	String found in binary or memory: https://feedback.googleusercontent.com
Source: 144b3a37-1849-426a-9df6-e78ad1449cc3.tmp.2.dr, d0e40d87-35a4-417a-91e9-2584bb6541dc.tmp.2.dr	String found in binary or memory: https://fonts.googleapis.com
Source: Network Action Predictor.0.dr	String found in binary or memory: https://fonts.googleapis.com/
Source: data_1.2.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Google
Source: data_1.2.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=PT%20Sans%3A400%2C700%7CMerriweather%3A400%2C700&display=swa
Source: manifest.json.0.dr	String found in binary or memory: https://fonts.googleapis.com;
Source: data_3.2.dr, 144b3a37-1849-426a-9df6-e78ad1449cc3.tmp.2.dr, d0e40d87-35a4-417a-91e9-2584bb6541dc.tmp.2.dr	String found in binary or memory: https://fonts.gstatic.com
Source: Network Action Predictor.0.dr	String found in binary or memory: https://fonts.gstatic.com/
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/googlesans/v14/4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/googlesans/v14/4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2I
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/merriweather/v27/u-440qyriQwlOrhSvowK_l5-cSZMZ-Y.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/merriweather/v27/u-440qyriQwlOrhSvowK_l5-ciZMZ-Y.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/merriweather/v27/u-440qyriQwlOrhSvowK_l5-cyZMZ-Y.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/merriweather/v27/u-440qyriQwlOrhSvowK_l5-eCZMZ-Y.woff2)
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/merriweather/v27/u-440qyriQwlOrhSvowK_l5-fCZM.woff2
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/merriweather/v27/u-440qyriQwlOrhSvowK_l5-fCZM.woff2)
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/merriweather/v27/u-440qyriQwlOrhSvowK_l5-fCZM.woff2X
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/merriweather/v27/u-4n0qyriQwlOrhSvowK_l52xwNZV8f6lvg.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/merriweather/v27/u-4n0qyriQwlOrhSvowK_l52xwNZVcf6lvg.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/merriweather/v27/u-4n0qyriQwlOrhSvowK_l52xwNZVsf6lvg.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/merriweather/v27/u-4n0qyriQwlOrhSvowK_l52xwNZWMf6.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/merriweather/v27/u-4n0qyriQwlOrhSvowK_l52xwNZXMf6lvg.woff2)
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/productsans/v9/pxiDypQkot1TnFhsFMOfGShVF9eO.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/productsans/v9/pxiDypQkot1TnFhsFMOfGShVF9eO.woff2%a
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsans/v12/jizaRExUiTo99u79D0-ExdGM.woff2)
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsans/v12/jizaRExUiTo99u79D0KExQ.woff2
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsans/v12/jizaRExUiTo99u79D0KExQ.woff2)
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsans/v12/jizaRExUiTo99u79D0KExQ.woff2qn
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsans/v12/jizaRExUiTo99u79D0aExdGM.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsans/v12/jizaRExUiTo99u79D0yExdGM.woff2)
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsans/v12/jizfRExUiTo99u79B_mh0O6tLQ.woff2
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsans/v12/jizfRExUiTo99u79B_mh0O6tLQ.woff2)
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsans/v12/jizfRExUiTo99u79B_mh0O6tLQ.woff2t
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsans/v12/jizfRExUiTo99u79B_mh0OCtLQ0Z.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsans/v12/jizfRExUiTo99u79B_mh0OOtLQ0Z.woff2)
Source: data_3.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsans/v12/jizfRExUiTo99u79B_mh0OqtLQ0Z.woff2)
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmSU5fBBc4.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff2
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff24
Source: manifest.json.0.dr	String found in binary or memory: https://fonts.gstatic.com;
Source: material_css_min.css.0.dr, angular.js.0.dr	String found in binary or memory: https://github.com/angular/material
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://github.com/madler/zlib/blob/master/zlib.h
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://hangouts.clients6.google.com
Source: manifest.json.0.dr	String found in binary or memory: https://hangouts.google.com/
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://hangouts.google.com/hangouts/_/logpref
Source: d0e40d87-35a4-417a-91e9-2584bb6541dc.tmp.2.dr	String found in binary or memory: https://i.ytimg.com
Source: data_1.2.dr	String found in binary or memory: https://i.ytimg.com/vi_webp/TBR-xtJVq7E/default.webp
Source: data_1.2.dr	String found in binary or memory: https://i.ytimg.com/vi_webp/TBR-xtJVq7E/sddefault.webp
Source: data_1.2.dr	String found in binary or memory: https://lh3.googleusercontent.com/8ezfS6tXtSo9i6phbOWKCeoROuz-N9PyeSog-i1-ilbGNmTSboJCIyPKg1kNE2hFj1
Source: data_1.2.dr	String found in binary or memory: https://lh3.googleusercontent.com/MiudLpjqSVQl2ih8dzp2oGmMX4iv1UHj55sG8qD_TH8X61eYONRHeRp893wLmK5BGt
Source: data_1.2.dr	String found in binary or memory: https://lh3.googleusercontent.com/YcGJRDTq5ZYAXzGU0GM-8qlThuWeinpMwhpaQa8oNVfjlS-1aKgnp3IUSueeB4_dOY
Source: data_1.2.dr	String found in binary or memory: https://lh4.googleusercontent.com/H67jYE9vLDeN45uaM4aYtT8i21utq_XvnK3Oi2n3P8ETKovf1rknwRI2ICtB1l0ejf
Source: data_1.2.dr	String found in binary or memory: https://lh4.googleusercontent.com/KxF602uOt-S6uxjxLAK7IhI-GwM0-DhJ9w5Vh6S_0YLH7cFPulrBfUrnKX0zVCcA2b
Source: data_1.2.dr	String found in binary or memory: https://lh4.googleusercontent.com/e4Ut2zna8Bjo-ZL498MyZn60CppkysjE8TBHx5jA2vVRqMEOcpp7DcKEMP7uIfcwvK
Source: data_1.2.dr	String found in binary or memory: https://lh5.googleusercontent.com/G0rnQ-w66xDV0RMnqhQtHvcmZmpLrrfQN6tq9_6dEf56T3Gj8Q8p_TSSeu7uISmlCQ
Source: data_1.2.dr	String found in binary or memory: https://lh5.googleusercontent.com/NqgOYqcH_6OVi3qb22UXv0tdKM7cjxgpLDx9GPSaeTMrb1TpEB5vVYWUOLBVPn7GGw
Source: data_1.2.dr	String found in binary or memory: https://lh5.googleusercontent.com/oqq7PF4yNU31DSOcGhD3E53FZfOR3Mv5G6-ysVS9fjnqFA9AEorod9IX8e1j5ZCK0d
Source: d0e40d87-35a4-417a-91e9-2584bb6541dc.tmp.2.dr	String found in binary or memory: https://lh6.googleusercontent.com
Source: data_1.2.dr	String found in binary or memory: https://lh6.googleusercontent.com/5iRDgMbqQtJfmYxt-KW9OWyOXr8ZY6jLUEc8o_GKPlTEsp8QMqn6vqT73Yx5PJo8rZ
Source: data_1.2.dr	String found in binary or memory: https://lh6.googleusercontent.com/B-NpZYauOh0G5xpxxkZ6E6-3CmZDmPKWsVD4PhIF3jem5FwwY74cDSYsFGDCmwjSEw
Source: data_1.2.dr	String found in binary or memory: https://lh6.googleusercontent.com/Vgs4iFFz7AqUPw1RP3csLdnZFpRXFn8OnBesJDeWUDrZp7zNbmpxXCbVQ4rE5QBN_i
Source: data_1.2.dr	String found in binary or memory: https://lh6.googleusercontent.com/nABGKzjFm787i3eb_QrfBRcsF99mxH5LUTCVTYM34cWcIAObvRqOTqDNfx1agbNhpf
Source: mirroring_common.js.0.dr	String found in binary or memory: https://meet.google.com
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://meetings.clients6.google.com
Source: mirroring_common.js.0.dr	String found in binary or memory: https://networktraversal.googleapis.com/v1alpha
Source: 144b3a37-1849-426a-9df6-e78ad1449cc3.tmp.2.dr, d0e40d87-35a4-417a-91e9-2584bb6541dc.tmp.2.dr	String found in binary or memory: https://ogs.google.com
Source: craw_window.js.0.dr, manifest.json0.0.dr	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: data_3.2.dr	String found in binary or memory: https://pki.goog/repository/0
Source: 144b3a37-1849-426a-9df6-e78ad1449cc3.tmp.2.dr, d0e40d87-35a4-417a-91e9-2584bb6541dc.tmp.2.dr	String found in binary or memory: https://play.google.com
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: Current Session.0.dr, d0e40d87-35a4-417a-91e9-2584bb6541dc.tmp.2.dr	String found in binary or memory: https://policies.google.com
Source: Current Session.0.dr	String found in binary or memory: https://policies.google.com#
Source: Network Action Predictor.0.dr, Current Session.0.dr	String found in binary or memory: https://policies.google.com/
Source: data_1.2.dr	String found in binary or memory: https://policies.google.com/_/IdentityPoliciesUi/manifest.json
Source: data_1.2.dr	String found in binary or memory: https://policies.google.com/_/IdentityPoliciesUi/manifest.jsonJ
Source: Current Session.0.dr, Favicons.0.dr, History.0.dr	String found in binary or memory: https://policies.google.com/technologies/cookies
Source: Current Session.0.dr	String found in binary or memory: https://policies.google.com/technologies/cookies2
Source: Current Session.0.dr	String found in binary or memory: https://policies.google.com/technologies/cookies2How
Source: History.0.dr	String found in binary or memory: https://policies.google.com/technologies/cookiesHow
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://preprod-hangouts-googleapis.sandbox.google.com
Source: d0e40d87-35a4-417a-91e9-2584bb6541dc.tmp.2.dr	String found in binary or memory: https://r4---sn-4g5edns6.gvt1.com
Source: data_1.2.dr	String found in binary or memory: https://r4---sn-4g5edns6.gvt1.com/edgedl/chrome/dict/en-us-9-0.bdic?cms_redirect=yes&mh=I2&mip=84.17
Source: d0e40d87-35a4-417a-91e9-2584bb6541dc.tmp.2.dr	String found in binary or memory: https://redirector.gvt1.com
Source: data_1.2.dr	String found in binary or memory: https://redirector.gvt1.com/edgedl/chrome/dict/en-us-9-0.bdic
Source: craw_window.js.0.dr, manifest.json0.0.dr	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: Current Session.0.dr, d0e40d87-35a4-417a-91e9-2584bb6541dc.tmp.2.dr	String found in binary or memory: https://sites.google.com
Source: 000003.log4.0.dr	String found in binary or memory: https://sites.google.com/
Source: Current Session.0.dr, Favicons.0.dr, History.0.dr	String found in binary or memory: https://sites.google.com/view/largey-law/faq
Source: Current Session.0.dr	String found in binary or memory: https://sites.google.com/view/largey-law/faq&(
Source: Favicons.0.dr	String found in binary or memory: https://sites.google.com/view/largey-law/faq1
Source: History.0.dr	String found in binary or memory: https://sites.google.com/view/largey-law/faqLargey
Source: Current Session.0.dr, Favicons.0.dr, History.0.dr	String found in binary or memory: https://sites.google.com/view/largey-law/history
Source: Current Session.0.dr, Favicons.0.dr, History.0.dr	String found in binary or memory: https://sites.google.com/view/largey-law/history#h.a887fllea086
Source: Favicons.0.dr	String found in binary or memory: https://sites.google.com/view/largey-law/history#h.a887fllea086D
Source: History.0.dr	String found in binary or memory: https://sites.google.com/view/largey-law/history#h.a887fllea086Largey
Source: Current Session.0.dr, Favicons.0.dr, History.0.dr	String found in binary or memory: https://sites.google.com/view/largey-law/history#h.afyj9j9g00b0
Source: Favicons.0.dr	String found in binary or memory: https://sites.google.com/view/largey-law/history#h.afyj9j9g00b0:
Source: History.0.dr	String found in binary or memory: https://sites.google.com/view/largey-law/history#h.afyj9j9g00b0Largey
Source: Current Session.0.dr, Favicons.0.dr, History.0.dr	String found in binary or memory: https://sites.google.com/view/largey-law/history#h.wz7mar23iqyu
Source: Favicons.0.dr	String found in binary or memory: https://sites.google.com/view/largey-law/history#h.wz7mar23iqyuD
Source: History.0.dr	String found in binary or memory: https://sites.google.com/view/largey-law/history#h.wz7mar23iqyuLargey
Source: Favicons.0.dr	String found in binary or memory: https://sites.google.com/view/largey-law/history1
Source: History.0.dr	String found in binary or memory: https://sites.google.com/view/largey-law/historyLargey
Source: Current Session.0.dr	String found in binary or memory: https://sites.google.com/view/largey-law/historyg
Source: Current Session.0.dr, Favicons.0.dr, History.0.dr	String found in binary or memory: https://sites.google.com/view/largey-law/home
Source: History Provider Cache.0.dr	String found in binary or memory: https://sites.google.com/view/largey-law/home2
Source: History.0.dr	String found in binary or memory: https://sites.google.com/view/largey-law/homeLargey
Source: Current Session.0.dr	String found in binary or memory: https://sites.google.com/view/largey-law/homed
Source: Current Session.0.dr, Favicons.0.dr, History.0.dr	String found in binary or memory: https://sites.google.com/view/largey-law/team
Source: Current Session.0.dr, Favicons.0.dr, History.0.dr	String found in binary or memory: https://sites.google.com/view/largey-law/team#h.a4rji4pxv1xr
Source: Favicons.0.dr	String found in binary or memory: https://sites.google.com/view/largey-law/team#h.a4rji4pxv1xrD
Source: History.0.dr	String found in binary or memory: https://sites.google.com/view/largey-law/team#h.a4rji4pxv1xrLargey
Source: Favicons.0.dr	String found in binary or memory: https://sites.google.com/view/largey-law/team4
Source: History.0.dr	String found in binary or memory: https://sites.google.com/view/largey-law/teamLargey
Source: Current Session.0.dr	String found in binary or memory: https://sites.google.com/view/largey-law/teamcW
Source: data_3.2.dr, 144b3a37-1849-426a-9df6-e78ad1449cc3.tmp.2.dr, d0e40d87-35a4-417a-91e9-2584bb6541dc.tmp.2.dr	String found in binary or memory: https://ssl.gstatic.com
Source: data_1.2.dr, Favicons.0.dr	String found in binary or memory: https://ssl.gstatic.com/atari/images/public/favicon.ico
Source: data_1.2.dr, Favicons.0.dr	String found in binary or memory: https://ssl.gstatic.com/policies/favicon.ico
Source: Favicons.0.dr	String found in binary or memory: https://ssl.gstatic.com/policies/favicon.ico;
Source: d0e40d87-35a4-417a-91e9-2584bb6541dc.tmp.2.dr	String found in binary or memory: https://stats.g.doubleclick.net
Source: messages.json41.0.dr, messages.json66.0.dr, messages.json5.0.dr, messages.json7.0.dr, feedback.html.0.dr, messages.json23.0.dr, messages.json75.0.dr, messages.json73.0.dr, messages.json83.0.dr, messages.json79.0.dr, messages.json25.0.dr, messages.json82.0.dr, messages.json54.0.dr, messages.json74.0.dr, messages.json33.0.dr, messages.json0.0.dr, messages.json85.0.dr, messages.json88.0.dr, messages.json87.0.dr, messages.json76.0.dr, messages.json.0.dr, messages.json80.0.dr, messages.json43.0.dr, messages.json10.0.dr, messages.json9.0.dr, messages.json8.0.dr, messages.json78.0.dr, messages.json2.0.dr, messages.json81.0.dr, messages.json31.0.dr, messages.json32.0.dr, messages.json55.0.dr, messages.json77.0.dr, messages.json11.0.dr, messages.json64.0.dr, messages.json26.0.dr, messages.json6.0.dr, messages.json1.0.dr, messages.json86.0.dr, messages.json84.0.dr, messages.json12.0.dr, messages.json4.0.dr, messages.json40.0.dr, messages.json24.0.dr, messages.json65.0.dr, messages.json3.0.dr, messages.json13.0.dr, messages.json56.0.dr, messages.json63.0.dr, messages.json42.0.dr	String found in binary or memory: https://support.google.com/chromecast/answer/2998456
Source: messages.json41.0.dr, messages.json66.0.dr, messages.json5.0.dr, messages.json7.0.dr, feedback.html.0.dr, messages.json23.0.dr, messages.json75.0.dr, messages.json73.0.dr, messages.json83.0.dr, messages.json79.0.dr, messages.json25.0.dr, messages.json82.0.dr, messages.json54.0.dr, messages.json74.0.dr, messages.json33.0.dr, messages.json0.0.dr, messages.json85.0.dr, messages.json88.0.dr, messages.json87.0.dr, messages.json76.0.dr, messages.json.0.dr, messages.json80.0.dr, messages.json43.0.dr, messages.json10.0.dr, messages.json9.0.dr, messages.json8.0.dr, messages.json78.0.dr, messages.json2.0.dr, messages.json81.0.dr, messages.json31.0.dr, messages.json32.0.dr, messages.json55.0.dr, messages.json77.0.dr, messages.json11.0.dr, messages.json64.0.dr, messages.json26.0.dr, messages.json6.0.dr, messages.json1.0.dr, messages.json86.0.dr, messages.json84.0.dr, messages.json12.0.dr, messages.json4.0.dr, messages.json40.0.dr, messages.json24.0.dr, messages.json65.0.dr, messages.json3.0.dr, messages.json13.0.dr, messages.json56.0.dr, messages.json63.0.dr, messages.json42.0.dr	String found in binary or memory: https://support.google.com/chromecast/troubleshooter/2995236
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://www-googleapis-staging.sandbox.google.com
Source: data_3.2.dr, d0e40d87-35a4-417a-91e9-2584bb6541dc.tmp.2.dr	String found in binary or memory: https://www.google-analytics.com
Source: data_3.2.dr, data_1.2.dr	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: Current Session.0.dr, 144b3a37-1849-426a-9df6-e78ad1449cc3.tmp.2.dr, manifest.json.0.dr, d0e40d87-35a4-417a-91e9-2584bb6541dc.tmp.2.dr	String found in binary or memory: https://www.google.com
Source: manifest.json0.0.dr	String found in binary or memory: https://www.google.com/
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/accounts/OAuthLogin?issueuberauth=1
Source: data_1.2.dr	String found in binary or memory: https://www.google.com/images/branding/googlelogo/1x/googlelogo_color_74x24dp.png
Source: data_1.2.dr	String found in binary or memory: https://www.google.com/images/branding/googlelogo/1x/googlelogo_color_74x24dp.pngf
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/cleardot.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/dot2.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/x2.gif
Source: craw_background.js.0.dr	String found in binary or memory: https://www.google.com/intl/en-US/chrome/blank.html
Source: data_1.2.dr	String found in binary or memory: https://www.google.com/js/th/4sbmeqrqr80QPGBV_Gvxjel0X1Sykh7Xka_e7BmOqgk.js
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://www.google.com/log?format=json&hasfast=true
Source: data_1.2.dr, Favicons.0.dr, History.0.dr	String found in binary or memory: https://www.google.com/policies/technologies/cookies/
Source: History.0.dr	String found in binary or memory: https://www.google.com/policies/technologies/cookies/How
Source: Current Session.0.dr	String found in binary or memory: https://www.google.com/policies/technologies/cookies/Z
Source: Current Session.0.dr	String found in binary or memory: https://www.google.com/policies/technologies/cookies/n
Source: Current Session.0.dr	String found in binary or memory: https://www.google.com/policies/technologies/cookies/q
Source: feedback_script.js.0.dr	String found in binary or memory: https://www.google.com/tools/feedback
Source: History.0.dr	String found in binary or memory: https://www.google.com/url?q=https%3A%2F%2Ff002.backblazeb2.com%2Ffile%2Fadenopodous-aminobenzine-ta
Source: manifest.json.0.dr	String found in binary or memory: https://www.google.com;
Source: craw_window.js.0.dr, craw_background.js.0.dr, 144b3a37-1849-426a-9df6-e78ad1449cc3.tmp.2.dr, d0e40d87-35a4-417a-91e9-2584bb6541dc.tmp.2.dr	String found in binary or memory: https://www.googleapis.com
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/
Source: data_3.2.dr	String found in binary or memory: https://www.googleapis.com/appsmarket/v2/installedApps/;report-uri
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/calendar.readonly
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/cast-edu-messaging
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/clouddevices
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/hangouts
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/hangouts.readonly
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/meetings
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.peopleapi.readwrite
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/userinfo.email
Source: mirroring_common.js.0.dr	String found in binary or memory: https://www.googleapis.com/calendar/v3
Source: mirroring_common.js.0.dr	String found in binary or memory: https://www.googleapis.com/hangouts/v1
Source: data_3.2.dr, 144b3a37-1849-426a-9df6-e78ad1449cc3.tmp.2.dr, d0e40d87-35a4-417a-91e9-2584bb6541dc.tmp.2.dr	String found in binary or memory: https://www.gstatic.com
Source: Network Action Predictor.0.dr	String found in binary or memory: https://www.gstatic.com/
Source: data_1.2.dr	String found in binary or memory: https://www.gstatic.com/_/atari/_/js/k=atari.vw.en_US.X0nbAXHYksM.O/d=0/rs=AGEqA5nR6N9Wj3jUAWiDb1yfC
Source: data_1.2.dr	String found in binary or memory: https://www.gstatic.com/_/atari/_/js/k=atari.vw.en_US.X0nbAXHYksM.O/d=1/rs=AGEqA5nR6N9Wj3jUAWiDb1yfC
Source: data_1.2.dr	String found in binary or memory: https://www.gstatic.com/_/atari/_/ss/k=atari.vw.6YUmxBDoQ0A.L.W.O/d=1/rs=AGEqA5mLV7QaXtKjOwXgAxC6XMt
Source: data_2.2.dr	String found in binary or memory: https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.IdentityPoliciesUi.en_US.Ht4AGofVYc8.
Source: data_1.2.dr	String found in binary or memory: https://www.gstatic.com/cv/js/sender/v1/cast_sender.js
Source: data_1.2.dr	String found in binary or memory: https://www.gstatic.com/cv/js/sender/v1/cast_sender.js5
Source: common.js.0.dr	String found in binary or memory: https://www.gstatic.com/hangouts_echo_detector/release/%
Source: data_1.2.dr	String found in binary or memory: https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Source: data_1.2.dr	String found in binary or memory: https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svgPW
Source: data_1.2.dr	String found in binary or memory: https://www.gstatic.com/og/_/js/k=og.qtm.en_US.JTwxsgT7A28.O/rt=j/m=q_dnp
Source: data_1.2.dr	String found in binary or memory: https://www.gstatic.com/og/_/ss/k=og.qtm.ABfSJOxuv7c.L.W.O/m=qmd
Source: manifest.json.0.dr	String found in binary or memory: https://www.gstatic.com;
Source: 000003.log5.0.dr, d0e40d87-35a4-417a-91e9-2584bb6541dc.tmp.2.dr	String found in binary or memory: https://www.youtube-nocookie.com
Source: Current Session.0.dr	String found in binary or memory: https://www.youtube-nocookie.com#
Source: 000003.log4.0.dr	String found in binary or memory: https://www.youtube-nocookie.com/
Source: Current Session.0.dr	String found in binary or memory: https://www.youtube-nocookie.com/embed/TBR-xtJVq7E?rel=0&showinfo=0&theme=light&version=3&hl=en&cc_l
Source: data_1.2.dr	String found in binary or memory: https://www.youtube-nocookie.com/generate_204?AB0qnA
Source: data_1.2.dr	String found in binary or memory: https://www.youtube-nocookie.com/generate_204?AB0qnA:
Source: data_1.2.dr	String found in binary or memory: https://www.youtube-nocookie.com/generate_204?PiCH2A
Source: data_1.2.dr	String found in binary or memory: https://www.youtube-nocookie.com/s/player/eea703f3/fetch-polyfill.vflset/fetch-polyfill.js
Source: data_1.2.dr	String found in binary or memory: https://www.youtube-nocookie.com/s/player/eea703f3/player_ias.vflset/en_US/base.js
Source: data_1.2.dr	String found in binary or memory: https://www.youtube-nocookie.com/s/player/eea703f3/player_ias.vflset/en_US/base.js/I
Source: data_1.2.dr	String found in binary or memory: https://www.youtube-nocookie.com/s/player/eea703f3/player_ias.vflset/en_US/embed.js
Source: data_1.2.dr	String found in binary or memory: https://www.youtube-nocookie.com/s/player/eea703f3/player_ias.vflset/en_US/remote.js
Source: data_1.2.dr	String found in binary or memory: https://www.youtube-nocookie.com/s/player/eea703f3/www-embed-player.vflset/www-embed-player.js
Source: data_1.2.dr	String found in binary or memory: https://www.youtube-nocookie.com/s/player/eea703f3/www-player-webp.css
Source: data_1.2.dr	String found in binary or memory: https://www.youtube-nocookie.com/s/player/eea703f3/www-player-webp.cssv
Source: d0e40d87-35a4-417a-91e9-2584bb6541dc.tmp.2.dr	String found in binary or memory: https://yt3.ggpht.com
Source: data_1.2.dr	String found in binary or memory: https://yt3.ggpht.com/ytc/AKedOLQhCqLTkEGQeSzNuaSndU18yVP8hqtaW-zJ4-ylRlw=s68-c-k-c0x00ffffff-no-rj

Posts data to webserver

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 142.250.203.97:443 -> 192.168.2.3:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.203.97:443 -> 192.168.2.3:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.203.97:443 -> 192.168.2.3:49862 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.203.97:443 -> 192.168.2.3:49863 version: TLS 1.2

System Summary:

Creates temporary files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Temp\038ed4c5-8ab8-4e88-b242-f9973c6045b1.tmp

Jump to behavior

Classification label

Source: classification engine

Classification label: mal64.phis.win@52/275@23/15

Spawns processes

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "https://sites.google.com/view/largey-law/home
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1532,4117655573879054566,6555697508590942832,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1920 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1532,4117655573879054566,6555697508590942832,131072 --lang=en-US --service-sandbox-type=audio --enable-audio-service-sandbox --mojo-platform-channel-handle=4984 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1532,4117655573879054566,6555697508590942832,131072 --lang=en-US --service-sandbox-type=video_capture --enable-audio-service-sandbox --mojo-platform-channel-handle=5408 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1532,4117655573879054566,6555697508590942832,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1920 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1532,4117655573879054566,6555697508590942832,131072 --lang=en-US --service-sandbox-type=audio --enable-audio-service-sandbox --mojo-platform-channel-handle=4984 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1532,4117655573879054566,6555697508590942832,131072 --lang=en-US --service-sandbox-type=video_capture --enable-audio-service-sandbox --mojo-platform-channel-handle=5408 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior

Creates files inside the program directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\Chrome\Application\Dictionaries

Jump to behavior

Creates files inside the user directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-61A9C633-1A68.pma

Jump to behavior

Found GUI installer (many successful clicks)

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: agree
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: agree
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: agree
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: agree
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: agree
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: agree
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: agree
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: agree
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: agree
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: agree

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Creates a directory in C:\Program Files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic			Jump to behavior