Windows Analysis Report https://sites.google.com/view/greenberg-ramon-alonso-urbano/home

AV Detection:

Antivirus / Scanner detection for submitted sample

Source: https://sites.google.com/view/greenberg-ramon-alonso-urbano/home

SlashNext: detection malicious, Label: Fake Login Page type: Phishing & Social Engineering

Antivirus detection for URL or domain

Source: https://aliyahaliyahs-amyloses-knackwursts.s3.us-west-002.backblazeb2.com/index.html

SlashNext: Label: Fake Login Page type: Phishing & Social Engineering

Phishing:

Yara detected HtmlPhish10

Source: Yara match

File source: 76129.7.pages.csv, type: HTML

Yara detected HtmlPhish20

Source: Yara match

File source: 70118.0.pages.csv, type: HTML

No HTML title found

Source: https://aliyahaliyahs-amyloses-knackwursts.s3.us-west-002.backblazeb2.com/index.html

HTTP Parser: HTML title missing

HTML body contains low number of good links

Source: https://aliyahaliyahs-amyloses-knackwursts.s3.us-west-002.backblazeb2.com/index.html

HTTP Parser: Number of links: 0

META author tag missing

Source: https://aliyahaliyahs-amyloses-knackwursts.s3.us-west-002.backblazeb2.com/index.html

HTTP Parser: No <meta name="author".. found

META copyright tag missing

Source: https://aliyahaliyahs-amyloses-knackwursts.s3.us-west-002.backblazeb2.com/index.html

HTTP Parser: No <meta name="copyright".. found

Compliance:

Creates license or readme file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Temp\3232_1092924051\LICENSE.txt

Jump to behavior

Creates a directory in C:\Program Files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic			Jump to behavior

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 142.250.185.225:443 -> 192.168.2.5:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.225:443 -> 192.168.2.5:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.225:443 -> 192.168.2.5:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.225:443 -> 192.168.2.5:49742 version: TLS 1.2

Networking:

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 49682 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49696
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49695
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49694
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49693
Source: unknown	Network traffic detected: HTTP traffic on port 49696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49692
Source: unknown	Network traffic detected: HTTP traffic on port 49692 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49690
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49685 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49685
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49684
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49683
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49682
Source: unknown	Network traffic detected: HTTP traffic on port 49693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49690 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49684 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49683 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Found strings which match to known social media urls

Source: Ruleset Data.0.dr	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: Filtering Rules.0.dr	String found in binary or memory: www.facebook.com/ajax/ads/ equals www.facebook.com (Facebook)
Source: Filtering Rules.0.dr	String found in binary or memory: www.facebook.com0 equals www.facebook.com (Facebook)

URLs found in memory or binary data

Source: angular.js.0.dr	String found in binary or memory: http://angularjs.org
Source: angular.js.0.dr	String found in binary or memory: http://errors.angularjs.org/1.6.4-local
Source: pnacl_public_x86_64_pnacl_sz_nexe.0.dr	String found in binary or memory: http://llvm.org/):
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: http://tools.ietf.org/html/rfc1950
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01
Source: 188ac110-956b-4790-b895-cfe1b3813cf5.tmp.1.dr, 22612e26-6f41-4bbe-93e3-72749262755a.tmp.1.dr	String found in binary or memory: https://accounts.google.com
Source: craw_window.js.0.dr	String found in binary or memory: https://accounts.google.com/MergeSession
Source: Network Action Predictor.0.dr	String found in binary or memory: https://ajax.aspnetcdn.com/
Source: data_1.1.dr	String found in binary or memory: https://ajax.aspnetcdn.com/ajax/jQuery/jquery-3.3.1.min.js
Source: Network Action Predictor.0.dr	String found in binary or memory: https://aliyahaliyahs-amyloses-knackwursts.s3.us-west-002.backblazeb2.com/
Source: data_1.1.dr, data_2.1.dr	String found in binary or memory: https://aliyahaliyahs-amyloses-knackwursts.s3.us-west-002.backblazeb2.com/index.html
Source: data_2.1.dr	String found in binary or memory: https://aliyahaliyahs-amyloses-knackwursts.s3.us-west-002.backblazeb2.com/index.htmlCache-Control:
Source: 188ac110-956b-4790-b895-cfe1b3813cf5.tmp.1.dr, 22612e26-6f41-4bbe-93e3-72749262755a.tmp.1.dr	String found in binary or memory: https://apis.google.com
Source: Network Action Predictor.0.dr	String found in binary or memory: https://apis.google.com/
Source: data_1.1.dr	String found in binary or memory: https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.hvE_rrhCzPE.O/m=gapi_iframes
Source: data_1.1.dr	String found in binary or memory: https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.wk7zEZseXNs.O/m=client/rt=j/sv=1/d=1/
Source: data_1.1.dr	String found in binary or memory: https://apis.google.com/js/client.js?onload=gapiLoaded
Source: pnacl_public_x86_64_libgcc_a.0.dr, pnacl_public_x86_64_crtend_o.0.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-clang.git
Source: pnacl_public_x86_64_libgcc_a.0.dr, pnacl_public_x86_64_crtend_o.0.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-llvm.git
Source: 188ac110-956b-4790-b895-cfe1b3813cf5.tmp.1.dr, 22612e26-6f41-4bbe-93e3-72749262755a.tmp.1.dr	String found in binary or memory: https://clients2.google.com
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://clients2.google.com/cr/report
Source: manifest.json3.0.dr, manifest.json.0.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 188ac110-956b-4790-b895-cfe1b3813cf5.tmp.1.dr, 22612e26-6f41-4bbe-93e3-72749262755a.tmp.1.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://clients6.google.com
Source: pnacl_public_x86_64_ld_nexe.0.dr	String found in binary or memory: https://code.google.com/p/nativeclient/issues/entry
Source: pnacl_public_x86_64_ld_nexe.0.dr	String found in binary or memory: https://code.google.com/p/nativeclient/issues/entry%s:
Source: 188ac110-956b-4790-b895-cfe1b3813cf5.tmp.1.dr	String found in binary or memory: https://content-autofill.googleapis.com
Source: data_1.1.dr	String found in binary or memory: https://content-autofill.googleapis.com/v1/pages/Chc2LjEuMTcxNS4xNDQyL2VuIChHR0xMKRIUCUMm1IiBWOoFEgk
Source: data_1.1.dr	String found in binary or memory: https://content-autofill.googleapis.com/v1/pages/Chc2LjEuMTcxNS4xNDQyL2VuIChHR0xMKRIqCc5kh36CJvzUEgk
Source: LICENSE.txt.0.dr	String found in binary or memory: https://creativecommons.org/.
Source: LICENSE.txt.0.dr	String found in binary or memory: https://creativecommons.org/compatiblelicenses
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://creativecommons.org/publicdomain/zero/1.0/.
Source: data_2.1.dr	String found in binary or memory: https://csp.withgoogle.com/csp/apps-themes
Source: data_2.1.dr	String found in binary or memory: https://csp.withgoogle.com/csp/apps-themesCross-Origin-Resource-Policy:
Source: Reporting and NEL.1.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/IdentityPoliciesUi/external
Source: Reporting and NEL.1.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/IdentityPoliciesUi/externalQ
Source: data_2.1.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/apps-sites
Source: data_2.1.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/apps-themes
Source: Reporting and NEL.1.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/botguard-scs
Source: Reporting and NEL.1.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/botguard-scsl
Source: Reporting and NEL.1.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/cloudview
Source: Reporting and NEL.1.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/encsid_AXrpQdcxyaoTJMYdhC5b1IVX_h4UhkFjYl5miMVZgqtCo-gS
Source: Reporting and NEL.1.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/encsid_AXrpQddlfEQiOc1nRAeNazvQZcE3oXXKrW5FMkFTMDVwZsRgwAaN
Source: Reporting and NEL.1.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/encsid_AXrpQdfmR0fDhCOPhF1MuC4lh4qBOg6Nc66MCVJYeKk
Source: Reporting and NEL.1.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/encsid_AXrpQdfmR0fDhCOPhF1MuC4lh4qBOg6Nc66MCVJYeKk~
Source: Reporting and NEL.1.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/encsid_AXrpQdfshzicv7_VskvwG2bjOovrglCIO4nYwHSdXf_gRroAlOw
Source: Reporting and NEL.1.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/encsid_AXrpQdfshzicv7_VskvwG2bjOovrglCIO4nYwHSdXf_gRroAlOwy
Source: Reporting and NEL.1.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/static-on-bigtable
Source: Reporting and NEL.1.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/youtube
Source: Reporting and NEL.1.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/youtube_
Source: ed144265-61a4-412d-9357-f59857f6a225.tmp.1.dr, ebb50bf9-872f-47bc-8467-bc2818962431.tmp.1.dr, 188ac110-956b-4790-b895-cfe1b3813cf5.tmp.1.dr, 22612e26-6f41-4bbe-93e3-72749262755a.tmp.1.dr	String found in binary or memory: https://dns.google
Source: LICENSE.txt.0.dr	String found in binary or memory: https://easylist.to/)
Source: 188ac110-956b-4790-b895-cfe1b3813cf5.tmp.1.dr, 22612e26-6f41-4bbe-93e3-72749262755a.tmp.1.dr	String found in binary or memory: https://fonts.googleapis.com
Source: Network Action Predictor.0.dr	String found in binary or memory: https://fonts.googleapis.com/
Source: data_1.1.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Google
Source: data_1.1.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=PT%20Sans%3A400%2C700%7CMerriweather%3A400%2C700&display=swa
Source: 188ac110-956b-4790-b895-cfe1b3813cf5.tmp.1.dr, 22612e26-6f41-4bbe-93e3-72749262755a.tmp.1.dr	String found in binary or memory: https://fonts.gstatic.com
Source: Network Action Predictor.0.dr	String found in binary or memory: https://fonts.gstatic.com/
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/googlesans/v14/4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/googlesans/v14/4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2I
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/merriweather/v25/u-440qyriQwlOrhSvowK_l5-fCZM.woff2
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/merriweather/v25/u-440qyriQwlOrhSvowK_l5-fCZM.woff2-%
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/productsans/v9/pxiDypQkot1TnFhsFMOfGShVF9eO.woff2
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/productsans/v9/pxiDypQkot1TnFhsFMOfGShVF9eO.woff2PW
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsans/v12/jizaRExUiTo99u79D0KExQ.woff2
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsans/v12/jizfRExUiTo99u79B_mh0O6tLQ.woff2
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsans/v12/jizfRExUiTo99u79B_mh0O6tLQ.woff2t
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmSU5fBBc4.woff2
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2%a
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff2
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff24
Source: material_css_min.css.0.dr	String found in binary or memory: https://github.com/angular/material
Source: LICENSE.txt.0.dr	String found in binary or memory: https://github.com/easylist)
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://github.com/madler/zlib/blob/master/zlib.h
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://hangouts.clients6.google.com
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://hangouts.google.com/hangouts/_/logpref
Source: data_1.1.dr	String found in binary or memory: https://i.imgur.com/qLcPmYb.jpg
Source: data_1.1.dr	String found in binary or memory: https://i.imgur.com/qLcPmYb.jpg9Yr2#
Source: 188ac110-956b-4790-b895-cfe1b3813cf5.tmp.1.dr	String found in binary or memory: https://i.ytimg.com
Source: data_1.1.dr	String found in binary or memory: https://i.ytimg.com/vi_webp/TBR-xtJVq7E/sddefault.webp
Source: data_1.1.dr	String found in binary or memory: https://i.ytimg.com/vi_webp/TBR-xtJVq7E/sddefault.webpj1
Source: data_1.1.dr	String found in binary or memory: https://lh3.googleusercontent.com/FKx5L2soM9KjyYuNE3Oc_OqckaR8EtzNCLl4KmfOaGp7Z99j0pSaezKLgucDwZXBg3
Source: data_1.1.dr	String found in binary or memory: https://lh3.googleusercontent.com/GAyWSyj34xvzFZZYYpwdjyUYX38ssxdrSeCvk972j1eg8hV_oyHoHHvLFwDzkgj8Bf
Source: data_1.1.dr	String found in binary or memory: https://lh3.googleusercontent.com/_8UJS2ieeqKvOtI79D8dcdWLSCe55nQLsuG3iai1SusUET5edLpPmFUnQMVCZY8ApS
Source: data_1.1.dr	String found in binary or memory: https://lh4.googleusercontent.com/7Qqga5mGtDkZ-g0iIYkQ2bvanCxpRvmaiB8W-XkDYTjwGFPB_UG4s9M0bkXQfLbsaR
Source: data_1.1.dr	String found in binary or memory: https://lh4.googleusercontent.com/su5gQTMChl_3cMVQwycJjxz2LLoqqlDzVzIw3fJ4_6CDwzy4i3Ctu2jDniWUXJvK0B
Source: data_1.1.dr	String found in binary or memory: https://lh5.googleusercontent.com/5HNYodXPrsEcpuh3-ITfxo4MpMUNDKAitjSO_NzT8gU_mAc18rskv1aABFatKT-cur
Source: data_1.1.dr	String found in binary or memory: https://lh5.googleusercontent.com/YyCnndu4qV2D9cKfELPcky4GZPXiBI1N80uV4xL6beLRKC_5hgiv8yvmjbrG--n6Xx
Source: data_1.1.dr	String found in binary or memory: https://lh5.googleusercontent.com/Z_7UHB9pK7hYkmoZO7HMOP_arIZYyi-zPcKD_7ij49f5QuoYj4UlT9U-yky8vBg4kO
Source: data_1.1.dr	String found in binary or memory: https://lh5.googleusercontent.com/psRgWXnZTmhW9E7AVDP3VkPMAnJXhhbS3pdXLLpZndwTn8Tolu3eZlxTjziM3BVemG
Source: data_1.1.dr	String found in binary or memory: https://lh5.googleusercontent.com/t8ugzkrMuS7OCmMEqKSIM-PyDdfa5-GyY04bGMM70VRx16xIXH95-xanz5CxKaGERx
Source: data_1.1.dr	String found in binary or memory: https://lh6.googleusercontent.com/DKGMAakCDInSD5m0XDWz3B08SHp3WYCQyvX8-1B_EJTKEwHv10MIzkv4_TGE46SlJC
Source: data_1.1.dr	String found in binary or memory: https://lh6.googleusercontent.com/VhsBRL-0xk3iyBgeyCTnNT6t7h9NmfDXgEduISKkAC1N-W2WLfB75-9eLph0Jybh73
Source: data_1.1.dr	String found in binary or memory: https://lh6.googleusercontent.com/VqulTL2PkGd_PYN0YRTxtXXDXFk8xcvmfWlYtSDN9y0Cdan3iRrwCdxEA3l7cmSl4G
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://meetings.clients6.google.com
Source: 188ac110-956b-4790-b895-cfe1b3813cf5.tmp.1.dr, 22612e26-6f41-4bbe-93e3-72749262755a.tmp.1.dr	String found in binary or memory: https://ogs.google.com
Source: craw_window.js.0.dr, manifest.json.0.dr	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: 188ac110-956b-4790-b895-cfe1b3813cf5.tmp.1.dr	String found in binary or memory: https://play.google.com
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: Current Session.0.dr	String found in binary or memory: https://policies.google.com
Source: Current Session.0.dr	String found in binary or memory: https://policies.google.com#
Source: Network Action Predictor.0.dr	String found in binary or memory: https://policies.google.com/
Source: data_1.1.dr	String found in binary or memory: https://policies.google.com/_/IdentityPoliciesUi/manifest.json
Source: Current Session.0.dr	String found in binary or memory: https://policies.google.com/technologies/cookies
Source: Current Session.0.dr	String found in binary or memory: https://policies.google.com/technologies/cookies2
Source: Current Session.0.dr	String found in binary or memory: https://policies.google.com/technologies/cookies2How
Source: Current Session.0.dr	String found in binary or memory: https://policies.google.com/technologies/cookiesT
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://preprod-hangouts-googleapis.sandbox.google.com
Source: 188ac110-956b-4790-b895-cfe1b3813cf5.tmp.1.dr	String found in binary or memory: https://r5---sn-4g5ednsd.gvt1.com
Source: data_1.1.dr	String found in binary or memory: https://r5---sn-4g5ednsd.gvt1.com/edgedl/chrome/dict/en-us-9-0.bdic?cms_redirect=yes&mh=I2&mip=84.17
Source: 188ac110-956b-4790-b895-cfe1b3813cf5.tmp.1.dr	String found in binary or memory: https://redirector.gvt1.com
Source: data_1.1.dr	String found in binary or memory: https://redirector.gvt1.com/edgedl/chrome/dict/en-us-9-0.bdic
Source: craw_window.js.0.dr, manifest.json.0.dr	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: 188ac110-956b-4790-b895-cfe1b3813cf5.tmp.1.dr, Current Session.0.dr	String found in binary or memory: https://sites.google.com
Source: Network Action Predictor.0.dr	String found in binary or memory: https://sites.google.com/
Source: Current Session.0.dr	String found in binary or memory: https://sites.google.com/view/greenberg-ramon-alonso-urbano/faq
Source: Current Session.0.dr	String found in binary or memory: https://sites.google.com/view/greenberg-ramon-alonso-urbano/faq%Greenberg
Source: Current Session.0.dr	String found in binary or memory: https://sites.google.com/view/greenberg-ramon-alonso-urbano/faq;
Source: Current Session.0.dr	String found in binary or memory: https://sites.google.com/view/greenberg-ramon-alonso-urbano/faqB
Source: Current Session.0.dr	String found in binary or memory: https://sites.google.com/view/greenberg-ramon-alonso-urbano/faqZ
Source: Current Session.0.dr	String found in binary or memory: https://sites.google.com/view/greenberg-ramon-alonso-urbano/faqu
Source: Current Session.0.dr	String found in binary or memory: https://sites.google.com/view/greenberg-ramon-alonso-urbano/history
Source: Current Session.0.dr	String found in binary or memory: https://sites.google.com/view/greenberg-ramon-alonso-urbano/history#h.a887fllea086
Source: Current Session.0.dr	String found in binary or memory: https://sites.google.com/view/greenberg-ramon-alonso-urbano/history#h.a887fllea086)Greenberg
Source: Current Session.0.dr	String found in binary or memory: https://sites.google.com/view/greenberg-ramon-alonso-urbano/history#h.a887fllea086j
Source: Current Session.0.dr	String found in binary or memory: https://sites.google.com/view/greenberg-ramon-alonso-urbano/history#h.afyj9j9g00b0
Source: Current Session.0.dr	String found in binary or memory: https://sites.google.com/view/greenberg-ramon-alonso-urbano/history#h.afyj9j9g00b0)Greenberg
Source: Current Session.0.dr	String found in binary or memory: https://sites.google.com/view/greenberg-ramon-alonso-urbano/history#h.wz7mar23iqyu
Source: Current Session.0.dr	String found in binary or memory: https://sites.google.com/view/greenberg-ramon-alonso-urbano/history#h.wz7mar23iqyu)Greenberg
Source: Current Session.0.dr	String found in binary or memory: https://sites.google.com/view/greenberg-ramon-alonso-urbano/history#h.wz7mar23iqyub
Source: Current Session.0.dr	String found in binary or memory: https://sites.google.com/view/greenberg-ramon-alonso-urbano/history)Greenberg
Source: Current Session.0.dr	String found in binary or memory: https://sites.google.com/view/greenberg-ramon-alonso-urbano/home
Source: History Provider Cache.0.dr	String found in binary or memory: https://sites.google.com/view/greenberg-ramon-alonso-urbano/home2
Source: Current Session.0.dr	String found in binary or memory: https://sites.google.com/view/greenberg-ramon-alonso-urbano/team
Source: Current Session.0.dr	String found in binary or memory: https://sites.google.com/view/greenberg-ramon-alonso-urbano/team#h.a4rji4pxv1xr
Source: Current Session.0.dr	String found in binary or memory: https://sites.google.com/view/greenberg-ramon-alonso-urbano/team#h.a4rji4pxv1xr&Greenberg
Source: Current Session.0.dr	String found in binary or memory: https://sites.google.com/view/greenberg-ramon-alonso-urbano/team#h.a4rji4pxv1xrl.Y
Source: Current Session.0.dr	String found in binary or memory: https://sites.google.com/view/greenberg-ramon-alonso-urbano/team#h.mc9c3iu9koq0
Source: Current Session.0.dr	String found in binary or memory: https://sites.google.com/view/greenberg-ramon-alonso-urbano/team#h.mc9c3iu9koq0&Greenberg
Source: Current Session.0.dr	String found in binary or memory: https://sites.google.com/view/greenberg-ramon-alonso-urbano/team&
Source: Current Session.0.dr	String found in binary or memory: https://sites.google.com/view/greenberg-ramon-alonso-urbano/team&Greenberg
Source: 188ac110-956b-4790-b895-cfe1b3813cf5.tmp.1.dr, 22612e26-6f41-4bbe-93e3-72749262755a.tmp.1.dr	String found in binary or memory: https://ssl.gstatic.com
Source: data_1.1.dr	String found in binary or memory: https://ssl.gstatic.com/atari/images/public/favicon.ico
Source: data_1.1.dr	String found in binary or memory: https://ssl.gstatic.com/policies/favicon.ico
Source: 188ac110-956b-4790-b895-cfe1b3813cf5.tmp.1.dr	String found in binary or memory: https://stats.g.doubleclick.net
Source: messages.json15.0.dr, feedback.html.0.dr	String found in binary or memory: https://support.google.com/chromecast/answer/2998456
Source: messages.json15.0.dr, feedback.html.0.dr	String found in binary or memory: https://support.google.com/chromecast/troubleshooter/2995236
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://www-googleapis-staging.sandbox.google.com
Source: 188ac110-956b-4790-b895-cfe1b3813cf5.tmp.1.dr	String found in binary or memory: https://www.google-analytics.com
Source: data_1.1.dr	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: data_1.1.dr	String found in binary or memory: https://www.google-analytics.com/analytics.jsh
Source: Current Session.0.dr, 22612e26-6f41-4bbe-93e3-72749262755a.tmp.1.dr	String found in binary or memory: https://www.google.com
Source: manifest.json.0.dr	String found in binary or memory: https://www.google.com/
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/accounts/OAuthLogin?issueuberauth=1
Source: data_1.1.dr	String found in binary or memory: https://www.google.com/images/branding/googlelogo/1x/googlelogo_color_74x24dp.png
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/cleardot.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/dot2.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/x2.gif
Source: craw_background.js.0.dr	String found in binary or memory: https://www.google.com/intl/en-US/chrome/blank.html
Source: data_1.1.dr	String found in binary or memory: https://www.google.com/js/th/xM3nE4Rqf8Lmby-AYZk2Alo28IFgPHmQ9Cgz8Y4hA8M.js
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://www.google.com/log?format=json&hasfast=true
Source: Current Session.0.dr	String found in binary or memory: https://www.google.com/policies/technologies/cookies/
Source: Current Session.0.dr	String found in binary or memory: https://www.google.com/policies/technologies/cookies/B
Source: data_1.1.dr	String found in binary or memory: https://www.google.com/policies/technologies/cookies/f
Source: data_1.1.dr	String found in binary or memory: https://www.google.com/url?q=https%3A%2F%2Faliyahaliyahs-amyloses-knackwursts.s3.us-west-002.backbla
Source: 188ac110-956b-4790-b895-cfe1b3813cf5.tmp.1.dr, craw_window.js.0.dr, craw_background.js.0.dr, 22612e26-6f41-4bbe-93e3-72749262755a.tmp.1.dr	String found in binary or memory: https://www.googleapis.com
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: 188ac110-956b-4790-b895-cfe1b3813cf5.tmp.1.dr, 22612e26-6f41-4bbe-93e3-72749262755a.tmp.1.dr	String found in binary or memory: https://www.gstatic.com
Source: Network Action Predictor.0.dr	String found in binary or memory: https://www.gstatic.com/
Source: data_1.1.dr	String found in binary or memory: https://www.gstatic.com/_/atari/_/js/k=atari.vw.en_US.x2vLtpY3xEU.O/d=0/rs=AGEqA5m196ioUWiwkoyCAkKZy
Source: data_1.1.dr	String found in binary or memory: https://www.gstatic.com/_/atari/_/js/k=atari.vw.en_US.x2vLtpY3xEU.O/d=1/rs=AGEqA5m196ioUWiwkoyCAkKZy
Source: data_1.1.dr	String found in binary or memory: https://www.gstatic.com/_/atari/_/ss/k=atari.vw.muEDoYdbUmc.L.W.O/d=1/rs=AGEqA5njKlpjzmlyywIoNpdY65c
Source: data_1.1.dr	String found in binary or memory: https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.IdentityPoliciesUi.en_US._iJXK6g-iX0.
Source: data_1.1.dr	String found in binary or memory: https://www.gstatic.com/cv/js/sender/v1/cast_sender.js
Source: data_1.1.dr	String found in binary or memory: https://www.gstatic.com/cv/js/sender/v1/cast_sender.jsJ
Source: data_1.1.dr	String found in binary or memory: https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Source: data_1.1.dr	String found in binary or memory: https://www.gstatic.com/og/_/js/k=og.qtm.en_US.75zE3OGOif4.O/rt=j/m=q_dnp
Source: data_1.1.dr	String found in binary or memory: https://www.gstatic.com/og/_/ss/k=og.qtm.Y8jBJNhuaXI.L.W.O/m=qmd
Source: 000003.log2.0.dr	String found in binary or memory: https://www.youtube-nocookie.com
Source: Network Action Predictor.0.dr	String found in binary or memory: https://www.youtube-nocookie.com/
Source: Current Session.0.dr	String found in binary or memory: https://www.youtube-nocookie.com/embed/TBR-xtJVq7E?rel=0&showinfo=0&theme=light&version=3&hl=en&cc_l
Source: data_1.1.dr	String found in binary or memory: https://www.youtube-nocookie.com/generate_204?AfzKSw
Source: data_1.1.dr	String found in binary or memory: https://www.youtube-nocookie.com/generate_204?AfzKSwQ
Source: data_1.1.dr	String found in binary or memory: https://www.youtube-nocookie.com/generate_204?w-wMwQ
Source: data_1.1.dr	String found in binary or memory: https://www.youtube-nocookie.com/generate_204?w-wMwQ7
Source: data_1.1.dr	String found in binary or memory: https://www.youtube-nocookie.com/s/player/8eb5bf0c/fetch-polyfill.vflset/fetch-polyfill.js
Source: data_1.1.dr	String found in binary or memory: https://www.youtube-nocookie.com/s/player/8eb5bf0c/fetch-polyfill.vflset/fetch-polyfill.jsTT
Source: data_1.1.dr	String found in binary or memory: https://www.youtube-nocookie.com/s/player/8eb5bf0c/player_ias.vflset/en_US/base.js
Source: data_1.1.dr	String found in binary or memory: https://www.youtube-nocookie.com/s/player/8eb5bf0c/player_ias.vflset/en_US/embed.js
Source: data_1.1.dr	String found in binary or memory: https://www.youtube-nocookie.com/s/player/8eb5bf0c/player_ias.vflset/en_US/remote.js
Source: data_1.1.dr	String found in binary or memory: https://www.youtube-nocookie.com/s/player/8eb5bf0c/player_ias.vflset/en_US/remote.jsCz
Source: data_1.1.dr	String found in binary or memory: https://www.youtube-nocookie.com/s/player/8eb5bf0c/www-embed-player.vflset/www-embed-player.js
Source: data_1.1.dr	String found in binary or memory: https://www.youtube-nocookie.com/s/player/8eb5bf0c/www-player-webp.css
Source: 188ac110-956b-4790-b895-cfe1b3813cf5.tmp.1.dr	String found in binary or memory: https://yt3.ggpht.com
Source: data_1.1.dr	String found in binary or memory: https://yt3.ggpht.com/ytc/AKedOLQhCqLTkEGQeSzNuaSndU18yVP8hqtaW-zJ4-ylRlw=s68-c-k-c0x00ffffff-no-rj

Posts data to webserver

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: sites.google.com

Downloads files from webservers via HTTP

Source: global traffic	HTTP traffic detected: GET /view/greenberg-ramon-alonso-urbano/home HTTP/1.1Host: sites.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-85.0.4183.121Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/client.js?onload=gapiLoaded HTTP/1.1Host: apis.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://sites.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=lfQ0_q8fbEEy0qkVL9niB4tHhiAEcCx_mVCgNmU2ku2zdQlzl3Bv7PNHwhsq4JRqTsJklumpTwqEj9SMNi_8TZA_j3smagUMllPq0Gy7XqUwNBPrsa3MXTxIeQ-3l8TAlHq8_bFby6pcXuh5zlhKAZp_R8q3_aWgLL3oGIHvImQ
Source: global traffic	HTTP traffic detected: GET /GAyWSyj34xvzFZZYYpwdjyUYX38ssxdrSeCvk972j1eg8hV_oyHoHHvLFwDzkgj8BfykQOBzxj4a93aHnExN-kk=w16383 HTTP/1.1Host: lh3.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://sites.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /t8ugzkrMuS7OCmMEqKSIM-PyDdfa5-GyY04bGMM70VRx16xIXH95-xanz5CxKaGERxPFGijhx5qNkuGmjhVYlXU=w16383 HTTP/1.1Host: lh5.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://sites.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff2 HTTP/1.1Host: fonts.gstatic.comConnection: keep-aliveOrigin: https://sites.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://fonts.googleapis.com/css?family=Google+Sans:400,500|Roboto:300,400,500,700|Source+Code+Pro:400,700&display=swapAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/ptsans/v12/jizfRExUiTo99u79B_mh0O6tLQ.woff2 HTTP/1.1Host: fonts.gstatic.comConnection: keep-aliveOrigin: https://sites.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://fonts.googleapis.com/css?family=PT%20Sans%3A400%2C700%7CMerriweather%3A400%2C700&display=swapAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/ptsans/v12/jizaRExUiTo99u79D0KExQ.woff2 HTTP/1.1Host: fonts.gstatic.comConnection: keep-aliveOrigin: https://sites.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://fonts.googleapis.com/css?family=PT%20Sans%3A400%2C700%7CMerriweather%3A400%2C700&display=swapAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /GAyWSyj34xvzFZZYYpwdjyUYX38ssxdrSeCvk972j1eg8hV_oyHoHHvLFwDzkgj8BfykQOBzxj4a93aHnExN-kk=w16383 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh3.googleusercontent.com
Source: global traffic	HTTP traffic detected: GET /5HNYodXPrsEcpuh3-ITfxo4MpMUNDKAitjSO_NzT8gU_mAc18rskv1aABFatKT-cur_kJQFofT5OdFFHAXojzXPJmD8iDOGAb12Kf43LClfgw56jSnM_XFTBlhO2-zvaDg=w1280 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh5.googleusercontent.com
Source: global traffic	HTTP traffic detected: GET /GAyWSyj34xvzFZZYYpwdjyUYX38ssxdrSeCvk972j1eg8hV_oyHoHHvLFwDzkgj8BfykQOBzxj4a93aHnExN-kk=w16383 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh3.googleusercontent.comIf-None-Match: "v1"
Source: global traffic	HTTP traffic detected: GET /VhsBRL-0xk3iyBgeyCTnNT6t7h9NmfDXgEduISKkAC1N-W2WLfB75-9eLph0Jybh73YuatZ1m4FpwGsq5C2sGHc_z2TLvlj40ZJK2XU-ecoLkROQOCVL2pAisQNMKes5SA=w1280 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh6.googleusercontent.com
Source: global traffic	HTTP traffic detected: GET /VqulTL2PkGd_PYN0YRTxtXXDXFk8xcvmfWlYtSDN9y0Cdan3iRrwCdxEA3l7cmSl4Go6px8LFgaxSVI6rtbgzsWpakQvkWJdIQDQPqdrYlkJXUX-SAFu6KO5DxwABnrtiQ=w1280 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh6.googleusercontent.com
Source: global traffic	HTTP traffic detected: GET /url?q=https%3A%2F%2Faliyahaliyahs-amyloses-knackwursts.s3.us-west-002.backblazeb2.com%2Findex.html&sa=D&sntz=1&usg=AFQjCNH8kz413y_EqiRKG7k161Kyek6ENg HTTP/1.1Host: www.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=lfQ0_q8fbEEy0qkVL9niB4tHhiAEcCx_mVCgNmU2ku2zdQlzl3Bv7PNHwhsq4JRqTsJklumpTwqEj9SMNi_8TZA_j3smagUMllPq0Gy7XqUwNBPrsa3MXTxIeQ-3l8TAlHq8_bFby6pcXuh5zlhKAZp_R8q3_aWgLL3oGIHvImQ
Source: global traffic	HTTP traffic detected: GET /index.html HTTP/1.1Host: aliyahaliyahs-amyloses-knackwursts.s3.us-west-002.backblazeb2.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://www.google.com/url?q=https%3A%2F%2Faliyahaliyahs-amyloses-knackwursts.s3.us-west-002.backblazeb2.com%2Findex.html&sa=D&sntz=1&usg=AFQjCNH8kz413y_EqiRKG7k161Kyek6ENgAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Sign-In-PDF-CLOUD_files/font-awesome.css HTTP/1.1Host: aliyahaliyahs-amyloses-knackwursts.s3.us-west-002.backblazeb2.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://aliyahaliyahs-amyloses-knackwursts.s3.us-west-002.backblazeb2.com/index.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /qLcPmYb.jpg HTTP/1.1Host: i.imgur.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://aliyahaliyahs-amyloses-knackwursts.s3.us-west-002.backblazeb2.com/index.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /technologies/cookies HTTP/1.1Host: policies.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://www.google.com/policies/technologies/cookies/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=lfQ0_q8fbEEy0qkVL9niB4tHhiAEcCx_mVCgNmU2ku2zdQlzl3Bv7PNHwhsq4JRqTsJklumpTwqEj9SMNi_8TZA_j3smagUMllPq0Gy7XqUwNBPrsa3MXTxIeQ-3l8TAlHq8_bFby6pcXuh5zlhKAZp_R8q3_aWgLL3oGIHvImQ; CONSENT=PENDING+590
Source: global traffic	HTTP traffic detected: GET /index.html HTTP/1.1Host: aliyahaliyahs-amyloses-knackwursts.s3.us-west-002.backblazeb2.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://aliyahaliyahs-amyloses-knackwursts.s3.us-west-002.backblazeb2.com/index.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "311f6dae6a6d91781cad1ac99efe347e"If-Modified-Since: Fri, 05 Nov 2021 13:12:57 GMT
Source: global traffic	HTTP traffic detected: GET /embed/TBR-xtJVq7E?rel=0&showinfo=0&theme=light&version=3&hl=en&cc_lang_pref=en&cc_load_policy=1 HTTP/1.1Host: www.youtube-nocookie.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://policies.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /analytics.js HTTP/1.1Host: www.google-analytics.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://policies.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ytc/AKedOLQhCqLTkEGQeSzNuaSndU18yVP8hqtaW-zJ4-ylRlw=s68-c-k-c0x00ffffff-no-rj HTTP/1.1Host: yt3.ggpht.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.youtube-nocookie.com/embed/TBR-xtJVq7E?rel=0&showinfo=0&theme=light&version=3&hl=en&cc_lang_pref=en&cc_load_policy=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /vi_webp/TBR-xtJVq7E/sddefault.webp HTTP/1.1Host: i.ytimg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.youtube-nocookie.com/embed/TBR-xtJVq7E?rel=0&showinfo=0&theme=light&version=3&hl=en&cc_lang_pref=en&cc_load_policy=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psRgWXnZTmhW9E7AVDP3VkPMAnJXhhbS3pdXLLpZndwTn8Tolu3eZlxTjziM3BVemGFmnNFHxwVZ4NkDKFfesb8=w16383 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh5.googleusercontent.com
Source: global traffic	HTTP traffic detected: GET /_8UJS2ieeqKvOtI79D8dcdWLSCe55nQLsuG3iai1SusUET5edLpPmFUnQMVCZY8ApSsH1voUWA-1MTua9Vlu7xK4aiaLyuSXv-gRKMKOLKVOG6LfYQoZh4LykbwwhcyIWA=w1280 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh3.googleusercontent.com
Source: global traffic	HTTP traffic detected: GET /psRgWXnZTmhW9E7AVDP3VkPMAnJXhhbS3pdXLLpZndwTn8Tolu3eZlxTjziM3BVemGFmnNFHxwVZ4NkDKFfesb8=w16383 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh5.googleusercontent.comIf-None-Match: "v1"
Source: global traffic	HTTP traffic detected: GET /_8UJS2ieeqKvOtI79D8dcdWLSCe55nQLsuG3iai1SusUET5edLpPmFUnQMVCZY8ApSsH1voUWA-1MTua9Vlu7xK4aiaLyuSXv-gRKMKOLKVOG6LfYQoZh4LykbwwhcyIWA=w1280 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh3.googleusercontent.comIf-None-Match: "v1"
Source: global traffic	HTTP traffic detected: GET /psRgWXnZTmhW9E7AVDP3VkPMAnJXhhbS3pdXLLpZndwTn8Tolu3eZlxTjziM3BVemGFmnNFHxwVZ4NkDKFfesb8=w16383 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh5.googleusercontent.comIf-None-Match: "v1"
Source: global traffic	HTTP traffic detected: GET /_8UJS2ieeqKvOtI79D8dcdWLSCe55nQLsuG3iai1SusUET5edLpPmFUnQMVCZY8ApSsH1voUWA-1MTua9Vlu7xK4aiaLyuSXv-gRKMKOLKVOG6LfYQoZh4LykbwwhcyIWA=w1280 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh3.googleusercontent.comIf-None-Match: "v1"
Source: global traffic	HTTP traffic detected: GET /Z_7UHB9pK7hYkmoZO7HMOP_arIZYyi-zPcKD_7ij49f5QuoYj4UlT9U-yky8vBg4kOLV5fw0t5z8BYtxR63Pqjc=w16383 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh5.googleusercontent.com
Source: global traffic	HTTP traffic detected: GET /YyCnndu4qV2D9cKfELPcky4GZPXiBI1N80uV4xL6beLRKC_5hgiv8yvmjbrG--n6Xx6nx2AG-WlMC4nXHH8QM-fQS7iyXEwNaa8UXOZoT9C6vY3BBxJDbB6kp5BYxxIcQw=w1280 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh5.googleusercontent.com
Source: global traffic	HTTP traffic detected: GET /DKGMAakCDInSD5m0XDWz3B08SHp3WYCQyvX8-1B_EJTKEwHv10MIzkv4_TGE46SlJCICp30CZ0E2GRz5AQmCM8Yc1Cywqre5CgYXE1MGp22xC0lZoHYGIimfpg0a1XFXEw=w1280 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh6.googleusercontent.com
Source: global traffic	HTTP traffic detected: GET /Z_7UHB9pK7hYkmoZO7HMOP_arIZYyi-zPcKD_7ij49f5QuoYj4UlT9U-yky8vBg4kOLV5fw0t5z8BYtxR63Pqjc=w16383 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh5.googleusercontent.comIf-None-Match: "v1"
Source: global traffic	HTTP traffic detected: GET /YyCnndu4qV2D9cKfELPcky4GZPXiBI1N80uV4xL6beLRKC_5hgiv8yvmjbrG--n6Xx6nx2AG-WlMC4nXHH8QM-fQS7iyXEwNaa8UXOZoT9C6vY3BBxJDbB6kp5BYxxIcQw=w1280 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh5.googleusercontent.comIf-None-Match: "v1"
Source: global traffic	HTTP traffic detected: GET /DKGMAakCDInSD5m0XDWz3B08SHp3WYCQyvX8-1B_EJTKEwHv10MIzkv4_TGE46SlJCICp30CZ0E2GRz5AQmCM8Yc1Cywqre5CgYXE1MGp22xC0lZoHYGIimfpg0a1XFXEw=w1280 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh6.googleusercontent.comIf-None-Match: "v1"

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 142.250.185.225:443 -> 192.168.2.5:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.225:443 -> 192.168.2.5:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.225:443 -> 192.168.2.5:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.225:443 -> 192.168.2.5:49742 version: TLS 1.2

System Summary:

Spawns processes

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "https://sites.google.com/view/greenberg-ramon-alonso-urbano/home
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1532,8088689805176024612,11020352485293425692,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1928 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1532,8088689805176024612,11020352485293425692,131072 --lang=en-US --service-sandbox-type=audio --enable-audio-service-sandbox --mojo-platform-channel-handle=4904 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1532,8088689805176024612,11020352485293425692,131072 --lang=en-US --service-sandbox-type=video_capture --enable-audio-service-sandbox --mojo-platform-channel-handle=4892 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1532,8088689805176024612,11020352485293425692,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1928 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1532,8088689805176024612,11020352485293425692,131072 --lang=en-US --service-sandbox-type=audio --enable-audio-service-sandbox --mojo-platform-channel-handle=4904 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1532,8088689805176024612,11020352485293425692,131072 --lang=en-US --service-sandbox-type=video_capture --enable-audio-service-sandbox --mojo-platform-channel-handle=4892 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior

Found detection on Joe Sandbox Cloud Basic with higher score

Source: https://sites.google.com/view/greenberg-ramon-alonso-urbano/home

Joe Sandbox Cloud Basic: Detection: clean Score: 0

Perma Link

Creates files inside the program directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\Chrome\Application\Dictionaries

Jump to behavior

Creates files inside the user directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-6185BF11-CA0.pma

Jump to behavior

Creates temporary files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Temp\ce017151-2dda-4553-bd95-b9e752fbc62b.tmp

Jump to behavior

Classification label

Source: classification engine

Classification label: mal72.phis.win@55/278@24/18

Found GUI installer (many successful clicks)

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: agree
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: agree
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: agree

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Creates a directory in C:\Program Files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic			Jump to behavior

Persistence and Installation Behavior:

Creates license or readme file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Temp\3232_1092924051\LICENSE.txt

Jump to behavior