Edit tour

Windows Analysis Report
http://geo2.ggpht.com

Overview

General Information

Sample URL:	http://geo2.ggpht.com
Analysis ID:	620423
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Found iframes

Deletes files inside the Windows folder

No HTML title found

Unusual large HTML page

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5976 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "http://geo2.ggpht.com MD5: C139654B5C1438A95B321BB01AD63EF6)

chrome.exe (PID: 992 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1604,18348223934860051263,10739790217536943622,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1912 /prefetch:8 MD5: C139654B5C1438A95B321BB01AD63EF6)

chrome.exe (PID: 6456 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1604,18348223934860051263,10739790217536943622,131072 --lang=en-US --service-sandbox-type=audio --enable-audio-service-sandbox --mojo-platform-channel-handle=2272 /prefetch:8 MD5: C139654B5C1438A95B321BB01AD63EF6)

chrome.exe (PID: 3424 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1604,18348223934860051263,10739790217536943622,131072 --lang=en-US --service-sandbox-type=video_capture --enable-audio-service-sandbox --mojo-platform-channel-handle=2148 /prefetch:8 MD5: C139654B5C1438A95B321BB01AD63EF6)

cleanup

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: https://accounts.google.com/signin/v2/identifier?ec=hpp_signin_001&flowName=GlifWebSignIn&flowEntry=ServiceLogin	HTTP Parser: Iframe src: https://accounts.youtube.com/accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=767994514&timestamp=1651713783351
Source: https://accounts.google.com/signin/v2/identifier?ec=hpp_signin_001&flowName=GlifWebSignIn&flowEntry=ServiceLogin	HTTP Parser: Iframe src: /_/bscframe

Source: https://accounts.google.com/signin/v2/identifier?ec=hpp_signin_001&flowName=GlifWebSignIn&flowEntry=ServiceLogin	HTTP Parser: HTML title missing
Source: https://store.google.com/DE?utm_source=hp_header&utm_medium=google_ooo&utm_campaign=GS100042&hl=de-DE	HTTP Parser: HTML title missing

Source: https://accounts.google.com/signin/v2/identifier?ec=hpp_signin_001&flowName=GlifWebSignIn&flowEntry=ServiceLogin	HTTP Parser: Total size: 1957788
Source: https://store.google.com/DE?utm_source=hp_header&utm_medium=google_ooo&utm_campaign=GS100042&hl=de-DE	HTTP Parser: Total size: 2252417

Source: https://accounts.google.com/signin/v2/identifier?ec=hpp_signin_001&flowName=GlifWebSignIn&flowEntry=ServiceLogin	HTTP Parser: No <meta name="author".. found
Source: https://store.google.com/DE?utm_source=hp_header&utm_medium=google_ooo&utm_campaign=GS100042&hl=de-DE	HTTP Parser: No <meta name="author".. found

Source: https://accounts.google.com/signin/v2/identifier?ec=hpp_signin_001&flowName=GlifWebSignIn&flowEntry=ServiceLogin	HTTP Parser: No <meta name="copyright".. found
Source: https://store.google.com/DE?utm_source=hp_header&utm_medium=google_ooo&utm_campaign=GS100042&hl=de-DE	HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic			Jump to behavior

Source: unknown	HTTPS traffic detected: 142.250.203.100:443 -> 192.168.2.3:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.215.227:443 -> 192.168.2.3:49795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.239.32.29:443 -> 192.168.2.3:49861 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.239.32.29:443 -> 192.168.2.3:49860 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.168.65:443 -> 192.168.2.3:49863 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.168.65:443 -> 192.168.2.3:49862 version: TLS 1.2

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49937 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-85.0.4183.121Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /crx/blobs/Acy1k0bLIjHsvnKaKN_oRpVaYYvFs25d7GKYF1WXrT6yizCMksBO0c_ggE0B6tx6HPRHe6q1GOEe3_NcIbSiGG8kXeLMUY0sAKVvC6R89zvKM13s5VqoAMZSmuUgjQL5vlygJuArQghXXE_qTL7NlQ/extension_8520_615_0_5.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?gws_rd=ssl HTTP/1.1Host: www.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/i/productlogos/googleg/v6/24px.svg HTTP/1.1Host: fonts.gstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /widget/callout?prid=19028915&pgid=19027681&puid=c10163da9b8db4c1&cce=1&dc=1&origin=https%3A%2F%2Fwww.google.com&cn=callout&pid=1&spid=538&hl=de HTTP/1.1Host: ogs.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AakniGMImmQv79-fKjA-lVqwQxIAL1NKC73TcpduY2lnE0dxnIdCMDmWOg; __Secure-ENID=4.SE=DWFrRndZy_opF24K-h7v0ecJcu-1P-5UoQrZrVm3WYo-2Wf31tLHsCRDKaEFK8iHvR4LROYUx21tWqtqzgDw134oGsVIcZt7TscY6fCGbGHbjZtTNvaxoSyNePyk0hc2NU9MVSgjzkIw2gs3BxC1950w1ZbXNAOCfrx2czHZoQc; CONSENT=PENDING+273
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.Yozr9QYVVr4.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo8ePFN_mLj5L9BxNRnarRImlQEt0w/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AakniGMImmQv79-fKjA-lVqwQxIAL1NKC73TcpduY2lnE0dxnIdCMDmWOg; __Secure-ENID=4.SE=DWFrRndZy_opF24K-h7v0ecJcu-1P-5UoQrZrVm3WYo-2Wf31tLHsCRDKaEFK8iHvR4LROYUx21tWqtqzgDw134oGsVIcZt7TscY6fCGbGHbjZtTNvaxoSyNePyk0hc2NU9MVSgjzkIw2gs3BxC1950w1ZbXNAOCfrx2czHZoQc; CONSENT=PENDING+273
Source: global traffic	HTTP traffic detected: GET /images/hpp/gsa_super_g-64.gif HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: www.google.com
Source: global traffic	HTTP traffic detected: GET /images/branding/googlelogo/2x/googlelogo_color_272x92dp.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: www.google.com
Source: global traffic	HTTP traffic detected: GET /images/searchbox/desktop_searchbox_sprites318_hr.webp HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: www.google.com
Source: global traffic	HTTP traffic detected: GET /s/i/productlogos/googleg/v6/24px.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: fonts.gstatic.com
Source: global traffic	HTTP traffic detected: GET /accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=767994514&timestamp=1651713783351 HTTP/1.1Host: accounts.youtube.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://accounts.google.com/ServiceLogin?ec=hpp_signin_001Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: www.google.com
Source: global traffic	HTTP traffic detected: GET /?fg=1&utm_source=google-DE&utm_medium=referral&utm_campaign=hp-header HTTP/1.1Host: about.googleConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /gtm.js?id=GTM-WQZB4J HTTP/1.1Host: www.googletagmanager.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://about.google/?fg=1&utm_source=google-DE&utm_medium=referral&utm_campaign=hp-headerAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/v2/latest/?tags=ai,alphabet,arts-culture,company-announcements,data-centers-and-infrastructure,design,developers,entrepreneurs,families,google-in-africa,google-in-asia,google-in-europe,google-ews-initiative,next-billion-users,research HTTP/1.1Host: www.blog.googleConnection: keep-aliveAccept: application/json, text/plain, /User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Origin: https://about.googleSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://about.google/?fg=1&utm_source=google-DE&utm_medium=referral&utm_campaign=hp-headerAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /analytics.js HTTP/1.1Host: www.google-analytics.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://about.google/?fg=1&utm_source=google-DE&utm_medium=referral&utm_campaign=hp-headerAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/img/close.png?cache=5628868 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: about.google
Source: global traffic	HTTP traffic detected: GET /assets/img/menu.png?cache=38c6aed HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: about.google
Source: global traffic	HTTP traffic detected: GET /0rwm9kM-LD7pKPIx7DKwsFqP8Urq7Md8JVKJ-4uSejDi5Dx8CPEakfuOV3fMhARwmIVWhKKM6OijJZEXszQf-XZgNv1w8Vn8Ktl-g4nk6VIWK8Y1Gw=w1440-l80-sg-rj-c0xffffff HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh3.googleusercontent.com
Source: global traffic	HTTP traffic detected: GET /T5KZvn2Ysp1MCbpRnhBXP7flqx7MCzqhwO3vy82aysHnOfJ2vwiE4Sl3XEK2F9sgNeU__J-t6yRjNkFrQUvZHLpigkKsdIAq3oYWmAbv56-eqTe0diw=w1440-l80-sg-rj-c0xffffff HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh3.googleusercontent.com
Source: global traffic	HTTP traffic detected: GET /assets/img/keyboard-arrow-up-999.svg?cache=911336e HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: about.google
Source: global traffic	HTTP traffic detected: GET /assets/img/blog-fallback-3.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: about.google
Source: global traffic	HTTP traffic detected: GET /DE?utm_source=hp_header&utm_medium=google_ooo&utm_campaign=GS100042&hl=de-DE HTTP/1.1Host: store.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AakniGMImmQv79-fKjA-lVqwQxIAL1NKC73TcpduY2lnE0dxnIdCMDmWOg; __Secure-ENID=4.SE=DWFrRndZy_opF24K-h7v0ecJcu-1P-5UoQrZrVm3WYo-2Wf31tLHsCRDKaEFK8iHvR4LROYUx21tWqtqzgDw134oGsVIcZt7TscY6fCGbGHbjZtTNvaxoSyNePyk0hc2NU9MVSgjzkIw2gs3BxC1950w1ZbXNAOCfrx2czHZoQc; CONSENT=PENDING+273; OGPC=19027681-1:; NID=511=cogYyPvhqkmjOrdU7FGb5jYawuwtQJXGjACgk9gfRS3cpd6dd9moTDGZqZnYtrsQaWSWXADPs6Zr-58t1SIZuIWkRmQ60SUWMMGMiZi4HmuHfgCwWiK4NW5oFiBvYjQ9AdPi4c3Zz7djHIyRtrx-6RVwXSU7wpm0urL9My8NYDE
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: geo2.ggpht.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/errors/robot.png HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Referer: http://geo2.ggpht.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/branding/googlelogo/1x/googlelogo_color_150x54dp.png HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Referer: http://geo2.ggpht.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: geo2.ggpht.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Referer: http://geo2.ggpht.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/branding/googlelogo/1x/googlelogo_color_150x54dp.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: www.google.com
Source: global traffic	HTTP traffic detected: GET /images/errors/robot.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: www.google.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 04 May 2022 16:22:35 GMTContent-Type: text/html; charset=UTF-8Server: Alleycat Server 1.0Content-Length: 1561X-XSS-Protection: 0X-Frame-Options: SAMEORIGINServer-Timing: gfet4t7; dur=77Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 04 May 2022 16:22:35 GMTContent-Type: text/html; charset=UTF-8Server: Alleycat Server 1.0Content-Length: 1572X-XSS-Protection: 0X-Frame-Options: SAMEORIGINServer-Timing: gfet4t7; dur=13Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67

Source: 10d30902-0e95-433a-a6d7-285b186e183b.tmp.1.dr, manifest.json0.0.dr	String found in binary or memory: https://accounts.google.com
Source: craw_window.js.0.dr	String found in binary or memory: https://accounts.google.com/MergeSession
Source: 10d30902-0e95-433a-a6d7-285b186e183b.tmp.1.dr, manifest.json0.0.dr	String found in binary or memory: https://apis.google.com
Source: 10d30902-0e95-433a-a6d7-285b186e183b.tmp.1.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.0.dr, manifest.json.0.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 10d30902-0e95-433a-a6d7-285b186e183b.tmp.1.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: manifest.json0.0.dr	String found in binary or memory: https://content.googleapis.com
Source: 8a3876d9-4167-4f7c-b014-3adc4ef0f4c0.tmp.1.dr, 10d30902-0e95-433a-a6d7-285b186e183b.tmp.1.dr, cf82239b-2040-4c00-a6a7-87c049c0f4eb.tmp.1.dr	String found in binary or memory: https://dns.google
Source: manifest.json0.0.dr	String found in binary or memory: https://feedback.googleusercontent.com
Source: 10d30902-0e95-433a-a6d7-285b186e183b.tmp.1.dr	String found in binary or memory: https://fonts.googleapis.com
Source: manifest.json0.0.dr	String found in binary or memory: https://fonts.googleapis.com;
Source: 10d30902-0e95-433a-a6d7-285b186e183b.tmp.1.dr	String found in binary or memory: https://fonts.gstatic.com
Source: manifest.json0.0.dr	String found in binary or memory: https://fonts.gstatic.com;
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
Source: manifest.json0.0.dr	String found in binary or memory: https://hangouts.google.com/
Source: 10d30902-0e95-433a-a6d7-285b186e183b.tmp.1.dr	String found in binary or memory: https://ogs.google.com
Source: craw_window.js.0.dr, manifest.json.0.dr	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: 10d30902-0e95-433a-a6d7-285b186e183b.tmp.1.dr	String found in binary or memory: https://play.google.com
Source: craw_window.js.0.dr, manifest.json.0.dr	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: 10d30902-0e95-433a-a6d7-285b186e183b.tmp.1.dr	String found in binary or memory: https://ssl.gstatic.com
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://www-googleapis-staging.sandbox.google.com
Source: 10d30902-0e95-433a-a6d7-285b186e183b.tmp.1.dr, manifest.json0.0.dr	String found in binary or memory: https://www.google.com
Source: manifest.json.0.dr	String found in binary or memory: https://www.google.com/
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/accounts/OAuthLogin?issueuberauth=1
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/cleardot.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/dot2.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/x2.gif
Source: craw_background.js.0.dr	String found in binary or memory: https://www.google.com/intl/en-US/chrome/blank.html
Source: manifest.json0.0.dr	String found in binary or memory: https://www.google.com;
Source: craw_window.js.0.dr, craw_background.js.0.dr, 10d30902-0e95-433a-a6d7-285b186e183b.tmp.1.dr	String found in binary or memory: https://www.googleapis.com
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/calendar.readonly
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/cast-edu-messaging
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/clouddevices
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/hangouts
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/hangouts.readonly
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/meetings
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.peopleapi.readwrite

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
1 Drive-by Compromise	Windows Management Instrumentation	Path Interception	1 Process Injection	3 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	4 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	5 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	3 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud

Source	Detection	Scanner	Label	Link
http://geo2.ggpht.com	0%	Virustotal		Browse
http://geo2.ggpht.com	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label
https://about.google/assets/img/close.png?cache=5628868	0%	URL Reputation	safe
https://about.google/assets/img/menu.png?cache=38c6aed	0%	URL Reputation	safe
https://dns.google	0%	URL Reputation	safe
https://about.google/assets/img/keyboard-arrow-up-999.svg?cache=911336e	0%	URL Reputation	safe
https://www.google.com;	0%	Avira URL Cloud	safe
https://csp.withgoogle.com/csp/uxe-owners-acl/about_google	0%	URL Reputation	safe
https://about.google/assets/img/blog-fallback-3.svg	0%	URL Reputation	safe

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "http://geo2.ggpht.com
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1604,18348223934860051263,10739790217536943622,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1912 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1604,18348223934860051263,10739790217536943622,131072 --lang=en-US --service-sandbox-type=audio --enable-audio-service-sandbox --mojo-platform-channel-handle=2272 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1604,18348223934860051263,10739790217536943622,131072 --lang=en-US --service-sandbox-type=video_capture --enable-audio-service-sandbox --mojo-platform-channel-handle=2148 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1604,18348223934860051263,10739790217536943622,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1912 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1604,18348223934860051263,10739790217536943622,131072 --lang=en-US --service-sandbox-type=audio --enable-audio-service-sandbox --mojo-platform-channel-handle=2272 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1604,18348223934860051263,10739790217536943622,131072 --lang=en-US --service-sandbox-type=audio --enable-audio-service-sandbox --mojo-platform-channel-handle=2272 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1604,18348223934860051263,10739790217536943622,131072 --lang=en-US --service-sandbox-type=video_capture --enable-audio-service-sandbox --mojo-platform-channel-handle=2148 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Name	IP	Active	Malicious	Reputation
gstaticadssl.l.google.com	216.58.215.227	true	false	high
www.google.de	172.217.168.3	true	false	high
csp.withgoogle.com	172.217.168.17	true	false	unknown
accounts.google.com	142.250.203.109	true	false	high
plus.l.google.com	172.217.168.78	true	false	high
www-google-analytics.l.google.com	216.58.215.238	true	false	high
stats.l.doubleclick.net	74.125.143.155	true	false	high
www-googletagmanager.l.google.com	172.217.168.8	true	false	high
mail.google.com	172.217.168.5	true	false	high
store.google.com	216.58.215.238	true	false	high
about.google	216.239.32.29	true	false	unknown
youtube-ui.l.google.com	172.217.168.14	true	false	high
www3.l.google.com	172.217.168.78	true	false	high
play.google.com	142.250.203.110	true	false	high
googleads.g.doubleclick.net	216.58.215.226	true	false	high
ghs-svc-https-sni.ghs-ssl.googlehosted.com	142.250.203.115	true	false	unknown
www.google.com	142.250.203.100	true	false	high
clients.l.google.com	216.58.215.238	true	false	high
geo2.ggpht.com	172.217.168.65	true	false	high
googlehosted.l.googleusercontent.com	172.217.168.65	true	false	high
www.blog.google	unknown	unknown	false	high
ogs.google.com	unknown	unknown	false	high
lh3.googleusercontent.com	unknown	unknown	false	high
stats.g.doubleclick.net	unknown	unknown	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
clients2.google.com	unknown	unknown	false	high
accounts.youtube.com	unknown	unknown	false	high
www.youtube.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high

Name	Malicious	Antivirus Detection	Reputation
http://geo2.ggpht.com/	false		high
http://geo2.ggpht.com/favicon.ico	false		high
https://www.google.com/?gws_rd=ssl	false		high
https://store.google.com/DE?utm_source=hp_header&utm_medium=google_ooo&utm_campaign=GS100042&hl=de-DE	false		high
https://ogs.google.com/widget/callout?prid=19028915&pgid=19027681&puid=c10163da9b8db4c1&cce=1&dc=1&origin=https%3A%2F%2Fwww.google.com&cn=callout&pid=1&spid=538&hl=de	false		high
https://about.google/?fg=1&utm_source=google-DE&utm_medium=referral&utm_campaign=hp-header	false		unknown
https://www.google.com/images/hpp/gsa_super_g-64.gif	false		high
https://clients2.googleusercontent.com/crx/blobs/Acy1k0bLIjHsvnKaKN_oRpVaYYvFs25d7GKYF1WXrT6yizCMksBO0c_ggE0B6tx6HPRHe6q1GOEe3_NcIbSiGG8kXeLMUY0sAKVvC6R89zvKM13s5VqoAMZSmuUgjQL5vlygJuArQghXXE_qTL7NlQ/extension_8520_615_0_5.crx	false		high
https://about.google/assets/img/close.png?cache=5628868	false	URL Reputation: safe	unknown
https://about.google/assets/img/menu.png?cache=38c6aed	false	URL Reputation: safe	unknown
http://geo2.ggpht.com/	false		high
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-69658807-1&cid=1824703873.1651713796&jid=88979746&gjid=1992516074&_gid=382045814.1651713796&_u=YEBAAAAAAAAAAC~&z=96984045	false		high
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.Yozr9QYVVr4.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo8ePFN_mLj5L9BxNRnarRImlQEt0w/cb=gapi.loaded_0	false		high
https://store.google.com/DE?utm_source=hp_header&utm_medium=google_ooo&utm_campaign=GS100042&hl=de-DE	false		high
https://accounts.youtube.com/accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=767994514&timestamp=1651713783351	false		high
https://about.google/assets/img/keyboard-arrow-up-999.svg?cache=911336e	false	URL Reputation: safe	unknown
https://www.google.com/?gws_rd=ssl	false		high
https://about.google/?fg=1&utm_source=google-DE&utm_medium=referral&utm_campaign=hp-header	false		unknown
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1	false		high
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false		high
http://www.google.com/images/errors/robot.png	false		high
https://www.google.com/favicon.ico	false		high
https://ogs.google.com/widget/callout?prid=19028915&pgid=19027681&puid=c10163da9b8db4c1&cce=1&dc=1&origin=https%3A%2F%2Fwww.google.com&cn=callout&pid=1&spid=538&hl=de	false		high
https://www.google.com/images/branding/googlelogo/2x/googlelogo_color_272x92dp.png	false		high
https://accounts.google.com/signin/v2/identifier?ec=hpp_signin_001&flowName=GlifWebSignIn&flowEntry=ServiceLogin	false		high
https://www.blog.google/api/v2/latest/?tags=ai,alphabet,arts-culture,company-announcements,data-centers-and-infrastructure,design,developers,entrepreneurs,families,google-in-africa,google-in-asia,google-in-europe,google-ews-initiative,next-billion-users,research	false		high
https://www.google.com/images/searchbox/desktop_searchbox_sprites318_hr.webp	false		high
http://www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png	false		high
https://csp.withgoogle.com/csp/uxe-owners-acl/about_google	false	URL Reputation: safe	unknown
https://lh3.googleusercontent.com/0rwm9kM-LD7pKPIx7DKwsFqP8Urq7Md8JVKJ-4uSejDi5Dx8CPEakfuOV3fMhARwmIVWhKKM6OijJZEXszQf-XZgNv1w8Vn8Ktl-g4nk6VIWK8Y1Gw=w1440-l80-sg-rj-c0xffffff	false		high
https://www.google.com/intl/de/gmail/about/#	false		high
https://about.google/assets/img/blog-fallback-3.svg	false	URL Reputation: safe	unknown
http://www.google.com/	false		high

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.google.com/images/cleardot.gif	craw_window.js.0.dr	false		high
https://play.google.com	10d30902-0e95-433a-a6d7-285b186e183b.tmp.1.dr	false		high
https://sandbox.google.com/payments/v4/js/integrator.js	craw_window.js.0.dr, manifest.json.0.dr	false		high
https://accounts.google.com/MergeSession	craw_window.js.0.dr	false		high
https://www.google.com	10d30902-0e95-433a-a6d7-285b186e183b.tmp.1.dr, manifest.json0.0.dr	false		high
https://accounts.google.com	10d30902-0e95-433a-a6d7-285b186e183b.tmp.1.dr, manifest.json0.0.dr	false		high
https://apis.google.com	10d30902-0e95-433a-a6d7-285b186e183b.tmp.1.dr, manifest.json0.0.dr	false		high
https://www.google.com/accounts/OAuthLogin?issueuberauth=1	craw_window.js.0.dr	false		high
https://www-googleapis-staging.sandbox.google.com	craw_window.js.0.dr, craw_background.js.0.dr	false		high
https://clients2.google.com	10d30902-0e95-433a-a6d7-285b186e183b.tmp.1.dr	false		high
https://dns.google	8a3876d9-4167-4f7c-b014-3adc4ef0f4c0.tmp.1.dr, 10d30902-0e95-433a-a6d7-285b186e183b.tmp.1.dr, cf82239b-2040-4c00-a6a7-87c049c0f4eb.tmp.1.dr	false	URL Reputation: safe	unknown
https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p	craw_window.js.0.dr, craw_background.js.0.dr	false		high
https://www.google.com/intl/en-US/chrome/blank.html	craw_background.js.0.dr	false		high
https://ogs.google.com	10d30902-0e95-433a-a6d7-285b186e183b.tmp.1.dr	false		high
https://payments.google.com/payments/v4/js/integrator.js	craw_window.js.0.dr, manifest.json.0.dr	false		high
https://www.google.com;	manifest.json0.0.dr	false	Avira URL Cloud: safe	low
https://hangouts.google.com/	manifest.json0.0.dr	false		high
https://www.google.com/images/x2.gif	craw_window.js.0.dr	false		high
https://www.google.com/images/dot2.gif	craw_window.js.0.dr	false		high
https://clients2.googleusercontent.com	10d30902-0e95-433a-a6d7-285b186e183b.tmp.1.dr	false		high
https://www.google.com/	manifest.json.0.dr	false		high
https://feedback.googleusercontent.com	manifest.json0.0.dr	false		high
https://clients2.google.com/service/update2/crx	manifest.json0.0.dr, manifest.json.0.dr	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.203.115	ghs-svc-https-sni.ghs-ssl.googlehosted.com	United States	15169	GOOGLEUS	false
216.58.215.238	www-google-analytics.l.google.com	United States	15169	GOOGLEUS	false
172.217.168.8	www-googletagmanager.l.google.com	United States	15169	GOOGLEUS	false
172.217.168.3	www.google.de	United States	15169	GOOGLEUS	false
172.217.168.5	mail.google.com	United States	15169	GOOGLEUS	false
172.217.168.65	geo2.ggpht.com	United States	15169	GOOGLEUS	false
142.250.203.109	accounts.google.com	United States	15169	GOOGLEUS	false
216.239.32.29	about.google	United States	15169	GOOGLEUS	false
216.58.215.226	googleads.g.doubleclick.net	United States	15169	GOOGLEUS	false
216.58.215.227	gstaticadssl.l.google.com	United States	15169	GOOGLEUS	false
142.250.203.100	www.google.com	United States	15169	GOOGLEUS	false
74.125.143.155	stats.l.doubleclick.net	United States	15169	GOOGLEUS	false
172.217.168.78	plus.l.google.com	United States	15169	GOOGLEUS	false
172.217.168.14	youtube-ui.l.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.217.168.17	csp.withgoogle.com	United States	15169	GOOGLEUS	false

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	620423
Start date and time: 04/05/202218:21:25	2022-05-04 18:21:25 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 4m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://geo2.ggpht.com
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean2.win@40/136@24/19
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI Browse: http://www.google.com/ Browse: https://www.google.com/url?q=https://accounts.google.com/signin/v2/identifier%3Fec%3Dhpp_signin_001&source=hpp&id=19028915&ct=7&usg=AOvVaw0vzncMxTXoSw2mJNT4ZyvY Browse: https://about.google/?fg=1&utm_source=google-DE&utm_medium=referral&utm_campaign=hp-header Browse: https://store.google.com/DE?utm_source=hp_header&utm_medium=google_ooo&utm_campaign=GS100042&hl=de-DE Browse: https://mail.google.com/mail/&ogbl

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	451603
Entropy (8bit):	5.009711072558331
Encrypted:	false
SSDEEP:	12288:ZHfRTyGZ6lup8Cfrvq4JBPKh+FBlESBw4p6:NfOCzvRKhGvwJ
MD5:	A78AD14E77147E7DE3647E61964C0335
SHA1:	CECC3DD41F4CEA0192B24300C71E1911BD4FCE45
SHA-256:	0D6803758FF8F87081FAFD62E90F0950DFB2DD7991E9607FE76A8F92D0E893FA
SHA-512:	DDE24D5AD50D68FC91E9E325D31E66EF8F624B6BB3A07D14FFED1104D3AB5F4EF1D7969A5CDE0DFBB19CB31C506F7DE97AF67C2F244F7E7E8E10648EA8321101
Malicious:	false
Reputation:	low
Preview:	BDic.... ....6...."..Z..4g....6.2...{/...3...5....AF 1363.AF nm.AF pt.AF n1.AF p.AF tc.AF SM.AF M.AF S.AF MS.AF MNR.AF GDS.AF MNT.AF MH.AF MR.AF SZMR.AF MJ.AF MT.AF MY.AF MRZ.AF MN.AF MG.AF RM.AF N.AF MV.AF XM.AF DSM.AF SD.AF G.AF R.AF MNX.AF MRS.AF MD.AF MNRB.AF B.AF ZSMR.AF PM.AF SMNGJ.AF SMN.AF ZMR.AF SMGB.AF MZR.AF GM.AF SMR.AF SMDG.AF RMZ.AF ZM.AF MDG.AF MDT.AF SMNXT.AF SDY.AF LSDG.AF LGDS.AF GLDS.AF UY.AF U.AF DSGNX.AF GNDSX.AF DSG.AF Y.AF GS.AF IEMS.AF YP.AF ZGDRS.AF XGNVDS.AF UT.AF GNDS.AF GVDS.AF MYPS.AF XGNDS.AF TPRY.AF MDSG.AF ZGSDR.AF DYSG.AF PMYTNS.AF AGDS.AF DRZGS.AF PY.AF GSPMDY.AF EGVDS.AF SL.AF GNXDS.AF DSBG.AF IM.AF I.AF MDGS.AF SMY.AF DSGN.AF DSLG.AF GMDS.AF MDSBG.AF SGD.AF IY.AF P.AF DSMG.AF BLZGDRS.AF TR.AF AGSD.AF ZGBDRSL.AF PTRY.AF ASDGV.AF ASM.AF ICANGSD.AF ICAM.AF IKY.AF AMS.AF PMYTRS.AF BZGVDRS.AF SDRBZG.AF GVMDS.AF PSM.AF DGLS.AF GNVXDS.AF AGDSL.AF DGS.AF XDSGNV.AF BZGDRS.AF AM.AF AS.AF A.AF LDSG.AF AGVDS.AF SDG.AF LDSMG.AF EDSMG.AF EY.AF DRSMZG.AF PRYT.AF LZ

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
May 4, 2022 18:22:34.994347095 CEST	192.168.2.3	8.8.8.8	0x93b7	Standard query (0)	geo2.ggpht.com	A (IP address)	IN (0x0001)
May 4, 2022 18:22:34.998348951 CEST	192.168.2.3	8.8.8.8	0xef09	Standard query (0)	clients2.google.com	A (IP address)	IN (0x0001)
May 4, 2022 18:22:35.005903959 CEST	192.168.2.3	8.8.8.8	0x48c7	Standard query (0)	accounts.google.com	A (IP address)	IN (0x0001)
May 4, 2022 18:22:35.502437115 CEST	192.168.2.3	8.8.8.8	0x3c91	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
May 4, 2022 18:22:36.853046894 CEST	192.168.2.3	8.8.8.8	0x552	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
May 4, 2022 18:22:38.716633081 CEST	192.168.2.3	8.8.8.8	0xf921	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)
May 4, 2022 18:22:49.426737070 CEST	192.168.2.3	8.8.8.8	0xecc2	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)
May 4, 2022 18:22:49.452652931 CEST	192.168.2.3	8.8.8.8	0x4104	Standard query (0)	ogs.google.com	A (IP address)	IN (0x0001)
May 4, 2022 18:22:50.739368916 CEST	192.168.2.3	8.8.8.8	0x46a6	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)
May 4, 2022 18:23:03.605652094 CEST	192.168.2.3	8.8.8.8	0xa8b5	Standard query (0)	accounts.youtube.com	A (IP address)	IN (0x0001)
May 4, 2022 18:23:14.746840000 CEST	192.168.2.3	8.8.8.8	0x8ebf	Standard query (0)	about.google	A (IP address)	IN (0x0001)
May 4, 2022 18:23:15.031282902 CEST	192.168.2.3	8.8.8.8	0xcf4c	Standard query (0)	csp.withgoogle.com	A (IP address)	IN (0x0001)
May 4, 2022 18:23:16.348602057 CEST	192.168.2.3	8.8.8.8	0x2c1c	Standard query (0)	lh3.googleusercontent.com	A (IP address)	IN (0x0001)
May 4, 2022 18:23:16.350933075 CEST	192.168.2.3	8.8.8.8	0x6386	Standard query (0)	www.blog.google	A (IP address)	IN (0x0001)
May 4, 2022 18:23:16.833755970 CEST	192.168.2.3	8.8.8.8	0x9c55	Standard query (0)	stats.g.doubleclick.net	A (IP address)	IN (0x0001)
May 4, 2022 18:23:17.693464994 CEST	192.168.2.3	8.8.8.8	0x5b89	Standard query (0)	about.google	A (IP address)	IN (0x0001)
May 4, 2022 18:23:17.712831020 CEST	192.168.2.3	8.8.8.8	0xabad	Standard query (0)	lh3.googleusercontent.com	A (IP address)	IN (0x0001)
May 4, 2022 18:23:18.763222933 CEST	192.168.2.3	8.8.8.8	0x996f	Standard query (0)	store.google.com	A (IP address)	IN (0x0001)
May 4, 2022 18:23:30.898859024 CEST	192.168.2.3	8.8.8.8	0xe95e	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)
May 4, 2022 18:23:31.761394024 CEST	192.168.2.3	8.8.8.8	0x821a	Standard query (0)	www.google.de	A (IP address)	IN (0x0001)
May 4, 2022 18:23:31.849565029 CEST	192.168.2.3	8.8.8.8	0xcc6f	Standard query (0)	googleads.g.doubleclick.net	A (IP address)	IN (0x0001)
May 4, 2022 18:23:38.496099949 CEST	192.168.2.3	8.8.8.8	0xd1c	Standard query (0)	mail.google.com	A (IP address)	IN (0x0001)
May 4, 2022 18:23:40.569104910 CEST	192.168.2.3	8.8.8.8	0x3a11	Standard query (0)	accounts.google.com	A (IP address)	IN (0x0001)
May 4, 2022 18:24:17.310688019 CEST	192.168.2.3	8.8.8.8	0xd3c5	Standard query (0)	stats.g.doubleclick.net	A (IP address)	IN (0x0001)

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
May 4, 2022 18:22:35.016825914 CEST	8.8.8.8	192.168.2.3	0xef09	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)
May 4, 2022 18:22:35.016825914 CEST	8.8.8.8	192.168.2.3	0xef09	No error (0)	clients.l.google.com		216.58.215.238	A (IP address)	IN (0x0001)
May 4, 2022 18:22:35.018759012 CEST	8.8.8.8	192.168.2.3	0x93b7	No error (0)	geo2.ggpht.com		172.217.168.65	A (IP address)	IN (0x0001)
May 4, 2022 18:22:35.021553993 CEST	8.8.8.8	192.168.2.3	0x48c7	No error (0)	accounts.google.com		142.250.203.109	A (IP address)	IN (0x0001)
May 4, 2022 18:22:35.520999908 CEST	8.8.8.8	192.168.2.3	0x3c91	No error (0)	www.google.com		142.250.203.100	A (IP address)	IN (0x0001)
May 4, 2022 18:22:36.869366884 CEST	8.8.8.8	192.168.2.3	0x552	No error (0)	www.google.com		142.250.203.100	A (IP address)	IN (0x0001)
May 4, 2022 18:22:38.735100985 CEST	8.8.8.8	192.168.2.3	0xf921	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)
May 4, 2022 18:22:38.735100985 CEST	8.8.8.8	192.168.2.3	0xf921	No error (0)	googlehosted.l.googleusercontent.com		172.217.168.65	A (IP address)	IN (0x0001)
May 4, 2022 18:22:48.930265903 CEST	8.8.8.8	192.168.2.3	0xf8a	No error (0)	gstaticadssl.l.google.com		216.58.215.227	A (IP address)	IN (0x0001)
May 4, 2022 18:22:49.453392029 CEST	8.8.8.8	192.168.2.3	0xecc2	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)
May 4, 2022 18:22:49.453392029 CEST	8.8.8.8	192.168.2.3	0xecc2	No error (0)	plus.l.google.com		172.217.168.78	A (IP address)	IN (0x0001)
May 4, 2022 18:22:49.479324102 CEST	8.8.8.8	192.168.2.3	0x4104	No error (0)	ogs.google.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)
May 4, 2022 18:22:49.479324102 CEST	8.8.8.8	192.168.2.3	0x4104	No error (0)	www3.l.google.com		172.217.168.78	A (IP address)	IN (0x0001)
May 4, 2022 18:22:50.757970095 CEST	8.8.8.8	192.168.2.3	0x46a6	No error (0)	play.google.com		142.250.203.110	A (IP address)	IN (0x0001)
May 4, 2022 18:22:53.375107050 CEST	8.8.8.8	192.168.2.3	0x93b4	No error (0)	gstaticadssl.l.google.com		216.58.215.227	A (IP address)	IN (0x0001)
May 4, 2022 18:23:03.630583048 CEST	8.8.8.8	192.168.2.3	0xa8b5	No error (0)	accounts.youtube.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)
May 4, 2022 18:23:03.630583048 CEST	8.8.8.8	192.168.2.3	0xa8b5	No error (0)	www3.l.google.com		172.217.168.78	A (IP address)	IN (0x0001)
May 4, 2022 18:23:14.763369083 CEST	8.8.8.8	192.168.2.3	0x8ebf	No error (0)	about.google		216.239.32.29	A (IP address)	IN (0x0001)
May 4, 2022 18:23:15.055738926 CEST	8.8.8.8	192.168.2.3	0xcf4c	No error (0)	csp.withgoogle.com		172.217.168.17	A (IP address)	IN (0x0001)
May 4, 2022 18:23:15.469516039 CEST	8.8.8.8	192.168.2.3	0x7f69	No error (0)	www-googletagmanager.l.google.com		172.217.168.8	A (IP address)	IN (0x0001)
May 4, 2022 18:23:16.376652956 CEST	8.8.8.8	192.168.2.3	0x2c1c	No error (0)	lh3.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)
May 4, 2022 18:23:16.376652956 CEST	8.8.8.8	192.168.2.3	0x2c1c	No error (0)	googlehosted.l.googleusercontent.com		172.217.168.65	A (IP address)	IN (0x0001)
May 4, 2022 18:23:16.378099918 CEST	8.8.8.8	192.168.2.3	0x6386	No error (0)	www.blog.google	ghs-svc-https-sni.ghs-ssl.googlehosted.com		CNAME (Canonical name)	IN (0x0001)
May 4, 2022 18:23:16.378099918 CEST	8.8.8.8	192.168.2.3	0x6386	No error (0)	ghs-svc-https-sni.ghs-ssl.googlehosted.com		142.250.203.115	A (IP address)	IN (0x0001)
May 4, 2022 18:23:16.411149025 CEST	8.8.8.8	192.168.2.3	0x15eb	No error (0)	www-google-analytics.l.google.com		216.58.215.238	A (IP address)	IN (0x0001)
May 4, 2022 18:23:16.860960960 CEST	8.8.8.8	192.168.2.3	0x9c55	No error (0)	stats.g.doubleclick.net	stats.l.doubleclick.net		CNAME (Canonical name)	IN (0x0001)
May 4, 2022 18:23:16.860960960 CEST	8.8.8.8	192.168.2.3	0x9c55	No error (0)	stats.l.doubleclick.net		74.125.143.155	A (IP address)	IN (0x0001)
May 4, 2022 18:23:16.860960960 CEST	8.8.8.8	192.168.2.3	0x9c55	No error (0)	stats.l.doubleclick.net		74.125.143.154	A (IP address)	IN (0x0001)
May 4, 2022 18:23:16.860960960 CEST	8.8.8.8	192.168.2.3	0x9c55	No error (0)	stats.l.doubleclick.net		74.125.143.157	A (IP address)	IN (0x0001)
May 4, 2022 18:23:16.860960960 CEST	8.8.8.8	192.168.2.3	0x9c55	No error (0)	stats.l.doubleclick.net		74.125.143.156	A (IP address)	IN (0x0001)
May 4, 2022 18:23:17.712039948 CEST	8.8.8.8	192.168.2.3	0x5b89	No error (0)	about.google		216.239.32.29	A (IP address)	IN (0x0001)
May 4, 2022 18:23:17.739566088 CEST	8.8.8.8	192.168.2.3	0xabad	No error (0)	lh3.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)
May 4, 2022 18:23:17.739566088 CEST	8.8.8.8	192.168.2.3	0xabad	No error (0)	googlehosted.l.googleusercontent.com		172.217.168.65	A (IP address)	IN (0x0001)
May 4, 2022 18:23:18.803006887 CEST	8.8.8.8	192.168.2.3	0x996f	No error (0)	store.google.com		216.58.215.238	A (IP address)	IN (0x0001)
May 4, 2022 18:23:30.925729036 CEST	8.8.8.8	192.168.2.3	0xe95e	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)
May 4, 2022 18:23:30.925729036 CEST	8.8.8.8	192.168.2.3	0xe95e	No error (0)	youtube-ui.l.google.com		172.217.168.14	A (IP address)	IN (0x0001)
May 4, 2022 18:23:30.925729036 CEST	8.8.8.8	192.168.2.3	0xe95e	No error (0)	youtube-ui.l.google.com		172.217.168.78	A (IP address)	IN (0x0001)
May 4, 2022 18:23:30.925729036 CEST	8.8.8.8	192.168.2.3	0xe95e	No error (0)	youtube-ui.l.google.com		142.250.203.110	A (IP address)	IN (0x0001)
May 4, 2022 18:23:30.925729036 CEST	8.8.8.8	192.168.2.3	0xe95e	No error (0)	youtube-ui.l.google.com		216.58.215.238	A (IP address)	IN (0x0001)
May 4, 2022 18:23:31.788218021 CEST	8.8.8.8	192.168.2.3	0x821a	No error (0)	www.google.de		172.217.168.3	A (IP address)	IN (0x0001)
May 4, 2022 18:23:31.888714075 CEST	8.8.8.8	192.168.2.3	0xcc6f	No error (0)	googleads.g.doubleclick.net		216.58.215.226	A (IP address)	IN (0x0001)
May 4, 2022 18:23:38.522591114 CEST	8.8.8.8	192.168.2.3	0xd1c	No error (0)	mail.google.com		172.217.168.5	A (IP address)	IN (0x0001)
May 4, 2022 18:23:40.608726025 CEST	8.8.8.8	192.168.2.3	0x3a11	No error (0)	accounts.google.com		142.250.203.109	A (IP address)	IN (0x0001)
May 4, 2022 18:24:17.337384939 CEST	8.8.8.8	192.168.2.3	0xd3c5	No error (0)	stats.g.doubleclick.net	stats.l.doubleclick.net		CNAME (Canonical name)	IN (0x0001)
May 4, 2022 18:24:17.337384939 CEST	8.8.8.8	192.168.2.3	0xd3c5	No error (0)	stats.l.doubleclick.net		74.125.128.157	A (IP address)	IN (0x0001)
May 4, 2022 18:24:17.337384939 CEST	8.8.8.8	192.168.2.3	0xd3c5	No error (0)	stats.l.doubleclick.net		74.125.128.156	A (IP address)	IN (0x0001)
May 4, 2022 18:24:17.337384939 CEST	8.8.8.8	192.168.2.3	0xd3c5	No error (0)	stats.l.doubleclick.net		74.125.128.154	A (IP address)	IN (0x0001)
May 4, 2022 18:24:17.337384939 CEST	8.8.8.8	192.168.2.3	0xd3c5	No error (0)	stats.l.doubleclick.net		74.125.128.155	A (IP address)	IN (0x0001)

Timestamp	kBytes transferred	Direction	Data
2022-05-04 16:22:35 UTC	0	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-05-04 16:22:35 UTC	0	OUT	Data Raw: 20 Data Ascii:
2022-05-04 16:22:35 UTC	3	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 04 May 2022 16:22:35 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-YvINYPNKkIZTontUO+jVVA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'nonce-YvINYPNKkIZTontUO+jVVA' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site,Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-05-04 16:22:35 UTC	5	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2022-05-04 16:22:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://geo2.ggpht.com

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic

C:\Users\user\AppData\Local\Google\Chrome\User Data\0968a5b6-0dc1-4e62-b09c-1c66698a3c0f.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\683fd448-746d-4739-969d-4f20d67d4829.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\6948aceb-1f11-45ec-90c7-c9dead1d9c56.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\6c424c26-61a6-4501-a534-57f572e14c0f.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\70bf07d3-73a4-4d2f-86f2-c6460a5b3ad7.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\00bf2f2b-bdd1-4546-a85f-873c3c5f7a27.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\10d30902-0e95-433a-a6d7-285b186e183b.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\36e3f35e-adc5-4583-beeb-8bc9181e05b8.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\3f07e468-d766-4091-b0b3-ee1951c5fc35.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\4a856419-2d62-4886-9964-6d77b7d31d5e.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\4cb192d1-bf9b-4c4c-a000-1a367c396ca4.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\5c4ce0ef-6b1c-4fc2-9e88-8bc7e822bfd1.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\5c72b697-7e97-4a9e-8f9d-b77884e10790.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\63ab17d6-c52a-4ae7-bf2e-85a6da0dacb0.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\6c0d992b-42d4-45af-a893-776fa94cc22f.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata\computed_hashes.json

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\000003.log

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG.old (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network Persistent State (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\GPUCache\data_1

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Network Persistent State (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\cf82239b-2040-4c00-a6a7-87c049c0f4eb.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\8a3876d9-4167-4f7c-b014-3adc4ef0f4c0.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1

Windows Analysis Report
http://geo2.ggpht.com

Timestamp	kBytes transferred	Direction	Data
2022-05-04 16:22:35 UTC	0	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfm X-Goog-Update-Updater: chromecrx-85.0.4183.121 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-05-04 16:22:35 UTC	1	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-d5vCZZJB55zZZgKDn/k3hQ' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 04 May 2022 16:22:35 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 5602 X-Daystart: 33755 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-05-04 16:22:35 UTC	2	IN	Data Raw: 35 31 66 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 35 36 30 32 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 33 33 37 35 35 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 51f<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="5602" elapsed_seconds="33755"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2022-05-04 16:22:35 UTC	2	IN	Data Raw: 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 2e 63 72 78 22 20 66 70 3d 22 31 2e 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 61 Data Ascii: mmhkkegccagdldgiimedpiccmgmieda.crx" fp="1.81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app><a
2022-05-04 16:22:35 UTC	3	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-05-04 16:22:53 UTC	1126	OUT	GET /s/i/productlogos/googleg/v6/24px.svg HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36 Host: fonts.gstatic.com
2022-05-04 16:22:53 UTC	1126	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="apps-themes" Report-To: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} Content-Length: 742 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Tue, 03 May 2022 08:00:54 GMT Expires: Wed, 03 May 2023 08:00:54 GMT Cache-Control: public, max-age=31536000 Last-Modified: Wed, 20 Apr 2022 17:17:30 GMT Content-Type: image/svg+xml Age: 116519 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2022-05-04 16:22:53 UTC	1127	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 68 65 69 67 68 74 3d 22 32 34 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 32 34 20 32 34 22 20 77 69 64 74 68 3d 22 32 34 22 3e 3c 70 61 74 68 20 64 3d 22 4d 32 32 2e 35 36 20 31 32 2e 32 35 63 30 2d 2e 37 38 2d 2e 30 37 2d 31 2e 35 33 2d 2e 32 2d 32 2e 32 35 48 31 32 76 34 2e 32 36 68 35 2e 39 32 63 2d 2e 32 36 20 31 2e 33 37 2d 31 2e 30 34 20 32 2e 35 33 2d 32 2e 32 31 20 33 2e 33 31 76 32 2e 37 37 68 33 2e 35 37 63 32 2e 30 38 2d 31 2e 39 32 20 33 2e 32 38 2d 34 2e 37 34 20 33 2e 32 38 2d 38 2e 30 39 7a 22 20 66 69 6c 6c 3d 22 23 34 32 38 35 46 34 22 2f 3e 3c 70 61 74 68 20 64 3d 22 4d 31 32 20 32 33 63 32 2e 39 37 20 30 20 35 2e 34 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M22.56 12.25c0-.78-.07-1.53-.2-2.25H12v4.26h5.92c-.26 1.37-1.04 2.53-2.21 3.31v2.77h3.57c2.08-1.92 3.28-4.74 3.28-8.09z" fill="#4285F4"/><path d="M12 23c2.97 0 5.4
2022-05-04 16:22:53 UTC	1127	IN	Data Raw: 32 30 2e 35 33 20 37 2e 37 20 32 33 20 31 32 20 32 33 7a 22 20 66 69 6c 6c 3d 22 23 33 34 41 38 35 33 22 2f 3e 3c 70 61 74 68 20 64 3d 22 4d 35 2e 38 34 20 31 34 2e 30 39 63 2d 2e 32 32 2d 2e 36 36 2d 2e 33 35 2d 31 2e 33 36 2d 2e 33 35 2d 32 2e 30 39 73 2e 31 33 2d 31 2e 34 33 2e 33 35 2d 32 2e 30 39 56 37 2e 30 37 48 32 2e 31 38 43 31 2e 34 33 20 38 2e 35 35 20 31 20 31 30 2e 32 32 20 31 20 31 32 73 2e 34 33 20 33 2e 34 35 20 31 2e 31 38 20 34 2e 39 33 6c 32 2e 38 35 2d 32 2e 32 32 2e 38 31 2d 2e 36 32 7a 22 20 66 69 6c 6c 3d 22 23 46 42 42 43 30 35 22 2f 3e 3c 70 61 74 68 20 64 3d 22 4d 31 32 20 35 2e 33 38 63 31 2e 36 32 20 30 20 33 2e 30 36 2e 35 36 20 34 2e 32 31 20 31 2e 36 34 6c 33 2e 31 35 2d 33 2e 31 35 43 31 37 2e 34 35 20 32 2e 30 39 20 31 34 Data Ascii: 20.53 7.7 23 12 23z" fill="#34A853"/><path d="M5.84 14.09c-.22-.66-.35-1.36-.35-2.09s.13-1.43.35-2.09V7.07H2.18C1.43 8.55 1 10.22 1 12s.43 3.45 1.18 4.93l2.85-2.22.81-.62z" fill="#FBBC05"/><path d="M12 5.38c1.62 0 3.06.56 4.21 1.64l3.15-3.15C17.45 2.09 14

Timestamp	kBytes transferred	Direction	Data
2022-05-04 16:23:10 UTC	1163	OUT	GET /favicon.ico HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36 Host: www.google.com
2022-05-04 16:23:10 UTC	1163	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 5430 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Sat, 30 Apr 2022 11:24:44 GMT Expires: Sun, 08 May 2022 11:24:44 GMT Cache-Control: public, max-age=691200 Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT Content-Type: image/x-icon Age: 363506 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2022-05-04 16:23:10 UTC	1164	IN	Data Raw: 00 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 30 fd fd fd 96 fd fd fd d8 fd fd fd f9 fd fd fd f9 fd fd fd d7 fd fd fd 94 fe fe fe 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd 99 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 95 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd c1 ff ff ff ff fa fd f9 ff b4 d9 a7 ff 76 ba 5d ff 58 ab 3a ff 58 aa 3a ff 72 b8 59 ff ac d5 9d ff f8 fb f6 ff ff Data Ascii: h& ( 0.v]X:X:rY
2022-05-04 16:23:10 UTC	1164	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff f8 ae 82 ff f4 85 42 ff f8 b5 8d ff ff ff ff ff fd fd fd d7 fd fd fd fa ff ff ff ff 0a bd fb ff 05 bc fb ff b5 eb fe ff ff ff ff ff ff ff ff ff ff ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f7 a6 75 ff ff ff ff ff fd fd fd f9 fd fd fd fa ff ff ff ff 0b be fb ff 05 bc fb ff b6 ec fe ff ff ff ff ff ff ff ff ff ff ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f7 aa 7b ff ff ff ff ff fd fd fd f9 fd fd fd db ff ff ff ff 35 c9 fc ff 0a b2 f9 ff 6b a4 f6 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d8 fd fd fd 99 ff ff ff ff 92 cf fb ff 37 52 ec ff 38 46 Data Ascii: BBBBBBuBBBBB{5k7R8F
2022-05-04 16:23:10 UTC	1166	IN	Data Raw: ff 63 b0 46 ff 7d bd 65 ff a5 d2 95 ff de ee d8 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd e8 fe fe fe 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 24 fd fd fd ea ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff eb f5 e7 ff 8f c6 7b ff 54 a9 36 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 7e be 67 ff dd ee d7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd e8 ff ff ff 22 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd d3 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff c4 e1 b9 ff 5c ac 3e ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 Data Ascii: cF}e/${T6S4S4S4S4S4S4S4S4S4~g"\>S4S4S4S4S4S4S
2022-05-04 16:23:10 UTC	1167	IN	Data Raw: ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff fa c8 aa ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd ea fd fd fd fa ff ff ff ff ff ff ff ff ff ff ff ff 07 bd fb ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 7d dc fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f9 c1 9f ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd f9 fd fd fd fa ff ff ff ff ff ff ff ff ff ff ff ff 07 bd fb ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 7d dc fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 Data Ascii: BBBB}BBBBBBBBBBB}BBBBBB
2022-05-04 16:23:10 UTC	1168	IN	Data Raw: ff fd fd fd 8a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 0b fd fd fd d5 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff b5 ba f7 ff 3e 4b eb ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 3f 4c eb ff ba bf f8 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d2 fe fe fe 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 26 fd fd fd eb ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff e5 e7 fc ff 78 81 f1 ff 36 44 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 36 44 ea ff 76 7f f1 ff e5 e7 fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd ea fe fe Data Ascii: >K5C5C5C5C5C5C5C5C5C5C5C5C?L&x6D5C5C5C5C5C5C5C5C6Dv

Timestamp	kBytes transferred	Direction	Data
2022-05-04 16:23:15 UTC	1257	OUT	POST /csp/uxe-owners-acl/about_google HTTP/1.1 Host: csp.withgoogle.com Connection: keep-alive Content-Length: 592 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Content-Type: application/csp-report Accept: / Origin: https://about.google Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: report Referer: https://about.google/?fg=1&utm_source=google-DE&utm_medium=referral&utm_campaign=hp-header Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-05-04 16:23:15 UTC	1257	OUT	Data Raw: 7b 22 63 73 70 2d 72 65 70 6f 72 74 22 3a 7b 22 64 6f 63 75 6d 65 6e 74 2d 75 72 69 22 3a 22 68 74 74 70 73 3a 2f 2f 61 62 6f 75 74 2e 67 6f 6f 67 6c 65 2f 3f 66 67 3d 31 26 75 74 6d 5f 73 6f 75 72 63 65 3d 67 6f 6f 67 6c 65 2d 44 45 26 75 74 6d 5f 6d 65 64 69 75 6d 3d 72 65 66 65 72 72 61 6c 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 68 70 2d 68 65 61 64 65 72 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 76 69 6f 6c 61 74 65 64 2d 64 69 72 65 63 74 69 76 65 22 3a 22 72 65 71 75 69 72 65 2d 74 72 75 73 74 65 64 2d 74 79 70 65 73 2d 66 6f 72 22 2c 22 65 66 66 65 63 74 69 76 65 2d 64 69 72 65 63 74 69 76 65 22 3a 22 72 65 71 75 69 72 65 2d 74 72 75 73 74 65 64 2d 74 79 70 65 73 2d 66 6f 72 22 2c 22 6f 72 69 67 69 6e 61 6c 2d 70 6f 6c 69 63 79 22 3a 22 Data Ascii: {"csp-report":{"document-uri":"https://about.google/?fg=1&utm_source=google-DE&utm_medium=referral&utm_campaign=hp-header","referrer":"","violated-directive":"require-trusted-types-for","effective-directive":"require-trusted-types-for","original-policy":"
2022-05-04 16:23:15 UTC	1258	IN	HTTP/1.1 204 No Content Content-Type: text/html; charset=utf-8 Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 04 May 2022 16:23:15 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /csp/_/CspCollectorHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-FvADo6362r9vPBIdHJC33Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /csp/_/CspCollectorHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'nonce-FvADo6362r9vPBIdHJC33Q' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /csp/_/CspCollectorHttp/cspreport Cross-Origin-Resource-Policy: cross-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-platform=, ch-ua-platform-version=* Report-To: {"group":"CspCollectorHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/CspCollectorHttp/external"}]} Cross-Origin-Opener-Policy: same-origin; report-to="CspCollectorHttp" Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close

Timestamp	kBytes transferred	Direction	Data
2022-05-04 16:23:16 UTC	1573	OUT	GET /api/v2/latest/?tags=ai,alphabet,arts-culture,company-announcements,data-centers-and-infrastructure,design,developers,entrepreneurs,families,google-in-africa,google-in-asia,google-in-europe,google-ews-initiative,next-billion-users,research HTTP/1.1 Host: www.blog.google Connection: keep-alive Accept: application/json, text/plain, / User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Origin: https://about.google Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://about.google/?fg=1&utm_source=google-DE&utm_medium=referral&utm_campaign=hp-header Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-05-04 16:23:16 UTC	1623	IN	HTTP/1.1 200 OK Content-Type: application/json Vary: Accept-Encoding content-security-policy: media-src 'self' .gstatic.com storage.googleapis.com .googlevideo.com; default-src 'self' .gstatic.com storage.googleapis.com; object-src 'none'; frame-src 'self' www.google.com .youtube.com youtube.com accounts.google.com plus.google.com .doubleclick.net apis.google.com optimize.google.com .google.com .cdn.ampproject.org; base-uri 'none'; connect-src 'self' plus.google.com www.google-analytics.com apis.google.com cdn.ampproject.org .google.com storage.googleapis.com https://services.google.com/fb/submissions/thekeywordtest/ https://services.google.com/fb/submissions/0a65d7733e1f11ea9701614fc033d30c/ .gstatic.com gstatic.com .cdn.ampproject.org .doubleclick.net; img-src data: blob:; script-src 'self' 'unsafe-inline' 'unsafe-eval' .googleanalytics.com .google-analytics.com ajax.googleapis.com .youtube.com youtube.com optimize.google.com https://s.ytimg.com .googletagmanager.com apis.google.com storage.googleapis.com .googleapis.com .google.com cdn.ampproject.org 'sha256-786mZQPkATV3kJd7q8ZuwoTH4U3/0WniBdyVOgZQpv4=' 'sha256-Xyk5Ei/Yh7DuZgaxNfbPswkpmMKHk5Jy18vkxjfPMj0=' 'sha256-hdPneczWRi+c9LQVo+PzNzlNr9TacChC0CW0fiDBHkI=' 'sha256-DE/j4w1a1HDIXysWgFTrJCJK6JWEcHqScfyMr9zq9R4=' 'sha256-Ehy9lGqrTi8OqqWxX1HN6hKJT7iwwYMFJ+HLjpEobO0=' 'sha256-s/yvuH0ZHyO+7N8dM5CshPem4K1PknDExYN18xHq0LI=' 'sha256-MWQdkIAX5J//suH1t5P3PFFwFUiphY0PxD6VVzbBehQ=' 'sha256-587vJAV9t9k86IMQixmyKa7lbPaDhkGzrJsdngtoiAA=' 'sha256-kYDvl4o9O3XKKtgQW4BZzZZ44BDD2lwJj6eNJ8HyqWg=' 'sha256-1lOrojGb+aoV56bZpsODLpb+j+HHbONNEpX/YqVtiUU=' 'sha256-sAsQphoZozaLVFpcda3bvT5euqcGL4MqVnizAR+Xla4=' .googleapis.com .gstatic.com gstatic.com googleadservices.com .googleadservices.com; font-src 'self' themes.googleusercontent.com .gstatic.com https://fonts.gstatic.com storage.googleapis.com fonts.googleapis.com .cdn.ampproject.org; style-src 'self' 'unsafe-inline' fonts.googleapis.com .gstatic.com storage.googleapis.com *.google.com cdn.ampproject.org content-language: en-us Access-Control-Allow-Origin: https://about.google Vary: Origin X-Cloud-Trace-Context: 2ca82e2eed2c10b52bae47f33337cf59 Date: Wed, 04 May 2022 16:23:16 GMT Server: Google Frontend Content-Length: 11738 Connection: close
2022-05-04 16:23:16 UTC	1626	IN	Data Raw: 7b 22 6d 65 74 61 22 3a 7b 22 74 6f 74 61 6c 5f 63 6f 75 6e 74 22 3a 31 34 37 39 7d 2c 22 6e 65 78 74 5f 70 61 67 65 22 3a 22 2f 61 70 69 2f 76 32 2f 6c 61 74 65 73 74 3f 70 61 67 69 6e 61 74 65 3d 31 32 26 74 61 67 73 3d 61 69 25 32 43 61 6c 70 68 61 62 65 74 25 32 43 61 72 74 73 2d 63 75 6c 74 75 72 65 25 32 43 63 6f 6d 70 61 6e 79 2d 61 6e 6e 6f 75 6e 63 65 6d 65 6e 74 73 25 32 43 64 61 74 61 2d 63 65 6e 74 65 72 73 2d 61 6e 64 2d 69 6e 66 72 61 73 74 72 75 63 74 75 72 65 25 32 43 64 65 73 69 67 6e 25 32 43 64 65 76 65 6c 6f 70 65 72 73 25 32 43 65 6e 74 72 65 70 72 65 6e 65 75 72 73 25 32 43 66 61 6d 69 6c 69 65 73 25 32 43 67 6f 6f 67 6c 65 2d 69 6e 2d 61 66 72 69 63 61 25 32 43 67 6f 6f 67 6c 65 2d 69 6e 2d 61 73 69 61 25 32 43 67 6f 6f 67 6c 65 2d Data Ascii: {"meta":{"total_count":1479},"next_page":"/api/v2/latest?paginate=12&tags=ai%2Calphabet%2Carts-culture%2Ccompany-announcements%2Cdata-centers-and-infrastructure%2Cdesign%2Cdevelopers%2Centrepreneurs%2Cfamilies%2Cgoogle-in-africa%2Cgoogle-in-asia%2Cgoogle-
2022-05-04 16:23:16 UTC	1627	IN	Data Raw: 65 20 77 61 72 20 69 6e 20 55 6b 72 61 69 6e 65 22 7d 2c 7b 22 70 75 62 6c 69 73 68 65 64 22 3a 22 32 30 32 32 2d 30 34 2d 33 30 54 30 37 3a 30 30 3a 30 30 5a 22 2c 22 66 75 6c 6c 5f 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 62 6c 6f 67 2e 67 6f 6f 67 6c 65 2f 61 72 6f 75 6e 64 2d 74 68 65 2d 67 6c 6f 62 65 2f 67 6f 6f 67 6c 65 2d 61 73 69 61 2f 63 6f 75 6e 74 65 72 2d 65 78 74 72 65 6d 69 73 6d 2d 73 69 6e 67 61 70 6f 72 65 2f 22 2c 22 68 65 72 6f 22 3a 22 68 74 74 70 73 3a 2f 2f 73 74 6f 72 61 67 65 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 67 77 65 62 2d 75 6e 69 62 6c 6f 67 2d 70 75 62 6c 69 73 68 2d 70 72 6f 64 2f 69 6d 61 67 65 73 2f 4d 61 69 6e 5f 42 65 6e 5f 4b 69 6e 67 5f 43 6f 75 6e 74 72 79 5f 4d 61 6e 61 67 69 6e 67 5f 44 69 72 65 63 74 Data Ascii: e war in Ukraine"},{"published":"2022-04-30T07:00:00Z","full_url":"https://blog.google/around-the-globe/google-asia/counter-extremism-singapore/","hero":"https://storage.googleapis.com/gweb-uniblog-publish-prod/images/Main_Ben_King_Country_Managing_Direct
2022-05-04 16:23:16 UTC	1628	IN	Data Raw: 69 6e 61 6e 63 69 61 6c 20 6c 69 74 65 72 61 63 79 20 69 6e 20 20 53 6f 75 74 68 20 41 66 72 69 63 61 2e 22 2c 22 73 69 74 65 73 70 61 63 65 5f 72 65 6e 64 65 72 22 3a 22 22 2c 22 65 79 65 62 72 6f 77 22 3a 22 3c 74 69 6d 65 20 63 6c 61 73 73 3d 5c 22 75 6e 69 2d 74 69 6d 65 73 69 6e 63 65 5c 22 20 64 61 74 65 74 69 6d 65 3d 5c 22 32 30 32 32 2d 30 34 2d 32 38 20 31 38 3a 30 30 3a 30 30 2b 30 30 3a 30 30 5c 22 3e 41 70 72 20 32 38 3c 2f 74 69 6d 65 3e 20 2f 20 47 6f 6f 67 6c 65 20 69 6e 20 41 66 72 69 63 61 22 2c 22 74 61 67 22 3a 22 67 6f 6f 67 6c 65 2d 69 6e 2d 61 66 72 69 63 61 22 2c 22 74 61 67 5f 65 79 65 62 72 6f 77 22 3a 22 68 74 74 70 73 3a 2f 2f 62 6c 6f 67 2e 67 6f 6f 67 6c 65 2f 74 6f 70 69 63 73 2f 67 6f 6f 67 6c 65 2d 61 66 72 69 63 61 2f 22 Data Ascii: inancial literacy in South Africa.","sitespace_render":"","eyebrow":"<time class=\"uni-timesince\" datetime=\"2022-04-28 18:00:00+00:00\">Apr 28</time> / Google in Africa","tag":"google-in-africa","tag_eyebrow":"https://blog.google/topics/google-africa/"
2022-05-04 16:23:16 UTC	1630	IN	Data Raw: 32 32 2d 30 34 2d 32 38 20 31 33 3a 30 30 3a 30 30 2b 30 30 3a 30 30 5c 22 3e 41 70 72 20 32 38 3c 2f 74 69 6d 65 3e 22 2c 22 68 65 61 64 6c 69 6e 65 22 3a 22 57 6f 6d 65 6e 20 54 65 63 68 6d 61 6b 65 72 73 20 65 78 70 61 6e 64 73 20 6f 6e 6c 69 6e 65 20 73 61 66 65 74 79 20 65 64 75 63 61 74 69 6f 6e 22 7d 2c 7b 22 70 75 62 6c 69 73 68 65 64 22 3a 22 32 30 32 32 2d 30 34 2d 32 38 54 30 38 3a 30 30 3a 30 30 5a 22 2c 22 66 75 6c 6c 5f 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 62 6c 6f 67 2e 67 6f 6f 67 6c 65 2f 61 72 6f 75 6e 64 2d 74 68 65 2d 67 6c 6f 62 65 2f 67 6f 6f 67 6c 65 2d 65 75 72 6f 70 65 2f 75 6e 69 74 65 64 2d 6b 69 6e 67 64 6f 6d 2f 67 69 72 6c 67 75 69 64 69 6e 67 2d 61 6e 64 2d 67 6f 6f 67 6c 65 2d 74 65 63 68 6e 6f 6c 6f 67 79 2d 69 73 2d Data Ascii: 22-04-28 13:00:00+00:00\">Apr 28</time>","headline":"Women Techmakers expands online safety education"},{"published":"2022-04-28T08:00:00Z","full_url":"https://blog.google/around-the-globe/google-europe/united-kingdom/girlguiding-and-google-technology-is-
2022-05-04 16:23:16 UTC	1631	IN	Data Raw: 6f 64 2f 69 6d 61 67 65 73 2f 70 65 78 65 6c 73 2d 69 62 61 64 61 68 2d 6d 69 6d 70 69 2d 34 36 33 33 38 34 32 2e 6d 61 78 2d 33 30 30 78 33 30 30 2e 6a 70 67 22 2c 22 74 61 67 5f 6e 61 6d 65 22 3a 22 47 6f 6f 67 6c 65 20 69 6e 20 41 73 69 61 22 2c 22 70 61 67 65 5f 69 64 22 3a 35 36 34 37 37 2c 22 63 61 74 65 67 6f 72 79 22 3a 22 61 72 74 69 63 6c 65 22 2c 22 73 69 74 65 73 70 61 63 65 22 3a 22 22 2c 22 6d 61 69 6e 5f 68 65 72 6f 5f 69 6d 61 67 65 22 3a 6e 75 6c 6c 2c 22 73 75 6d 6d 61 72 79 22 3a 22 41 73 20 64 65 6d 61 6e 64 20 66 6f 72 20 74 72 61 76 65 6c 20 72 65 62 6f 75 6e 64 73 20 69 6e 20 53 6f 75 74 68 65 61 73 74 20 41 73 69 61 2c 20 47 6f 6f 67 6c 65 20 53 65 61 72 63 68 20 74 72 65 6e 64 73 20 73 68 6f 77 20 74 68 61 74 20 74 68 65 20 70 61 Data Ascii: od/images/pexels-ibadah-mimpi-4633842.max-300x300.jpg","tag_name":"Google in Asia","page_id":56477,"category":"article","sitespace":"","main_hero_image":null,"summary":"As demand for travel rebounds in Southeast Asia, Google Search trends show that the pa
2022-05-04 16:23:16 UTC	1632	IN	Data Raw: 62 6c 6f 67 2e 67 6f 6f 67 6c 65 2f 6f 75 74 72 65 61 63 68 2d 69 6e 69 74 69 61 74 69 76 65 73 2f 65 6e 74 72 65 70 72 65 6e 65 75 72 73 2f 22 2c 22 75 72 6c 22 3a 22 2f 6f 75 74 72 65 61 63 68 2d 69 6e 69 74 69 61 74 69 76 65 73 2f 65 6e 74 72 65 70 72 65 6e 65 75 72 73 2f 6d 65 65 74 2d 31 31 2d 73 74 61 72 74 75 70 73 2d 77 6f 72 6b 69 6e 67 2d 74 6f 2d 63 6f 6d 62 61 74 2d 63 6c 69 6d 61 74 65 2d 63 68 61 6e 67 65 2f 22 2c 22 70 75 62 6c 69 73 68 65 64 5f 6e 6f 64 65 22 3a 22 3c 74 69 6d 65 20 63 6c 61 73 73 3d 5c 22 75 6e 69 2d 74 69 6d 65 73 69 6e 63 65 5c 22 20 64 61 74 65 74 69 6d 65 3d 5c 22 32 30 32 32 2d 30 34 2d 32 32 20 32 32 3a 32 38 3a 30 30 2b 30 30 3a 30 30 5c 22 3e 41 70 72 20 32 32 3c 2f 74 69 6d 65 3e 22 2c 22 68 65 61 64 6c 69 6e 65 Data Ascii: blog.google/outreach-initiatives/entrepreneurs/","url":"/outreach-initiatives/entrepreneurs/meet-11-startups-working-to-combat-climate-change/","published_node":"<time class=\"uni-timesince\" datetime=\"2022-04-22 22:28:00+00:00\">Apr 22</time>","headline
2022-05-04 16:23:16 UTC	1634	IN	Data Raw: 6f 6d 2f 67 77 65 62 2d 75 6e 69 62 6c 6f 67 2d 70 75 62 6c 69 73 68 2d 70 72 6f 64 2f 69 6d 61 67 65 73 2f 48 45 41 44 45 52 5f 48 41 44 41 53 2e 6d 61 78 2d 33 30 30 78 33 30 30 2e 6a 70 67 22 2c 22 74 61 67 5f 6e 61 6d 65 22 3a 22 53 65 61 72 63 68 22 2c 22 70 61 67 65 5f 69 64 22 3a 35 36 34 31 34 2c 22 63 61 74 65 67 6f 72 79 22 3a 22 61 72 74 69 63 6c 65 22 2c 22 73 69 74 65 73 70 61 63 65 22 3a 22 22 2c 22 6d 61 69 6e 5f 68 65 72 6f 5f 69 6d 61 67 65 22 3a 6e 75 6c 6c 2c 22 73 75 6d 6d 61 72 79 22 3a 22 48 61 64 61 73 20 4a 61 63 6f 62 69 20 69 73 20 61 20 73 6f 66 74 77 61 72 65 20 65 6e 67 69 6e 65 65 72 20 77 6f 72 6b 69 6e 67 20 69 6e 20 53 65 61 72 63 68 20 6f 6e 20 47 6f 6f 67 6c 65 20 54 72 65 6e 64 73 2e 22 2c 22 73 69 74 65 73 70 61 63 65 Data Ascii: om/gweb-uniblog-publish-prod/images/HEADER_HADAS.max-300x300.jpg","tag_name":"Search","page_id":56414,"category":"article","sitespace":"","main_hero_image":null,"summary":"Hadas Jacobi is a software engineer working in Search on Google Trends.","sitespace
2022-05-04 16:23:16 UTC	1635	IN	Data Raw: 72 65 61 63 68 2d 69 6e 69 74 69 61 74 69 76 65 73 2f 65 6e 74 72 65 70 72 65 6e 65 75 72 73 2f 6d 69 61 6d 69 2d 74 65 63 68 2d 68 75 62 2f 22 2c 22 70 75 62 6c 69 73 68 65 64 5f 6e 6f 64 65 22 3a 22 3c 74 69 6d 65 20 63 6c 61 73 73 3d 5c 22 75 6e 69 2d 74 69 6d 65 73 69 6e 63 65 5c 22 20 64 61 74 65 74 69 6d 65 3d 5c 22 32 30 32 32 2d 30 34 2d 32 30 20 30 34 3a 30 30 3a 30 30 2b 30 30 3a 30 30 5c 22 3e 41 70 72 20 32 30 3c 2f 74 69 6d 65 3e 22 2c 22 68 65 61 64 6c 69 6e 65 22 3a 22 54 72 61 6e 73 66 6f 72 6d 69 6e 67 20 4d 69 61 6d 69 20 69 6e 74 6f 20 74 68 65 20 74 65 63 68 20 68 75 62 20 6f 66 20 74 68 65 20 41 6d 65 72 69 63 61 73 22 7d 2c 7b 22 70 75 62 6c 69 73 68 65 64 22 3a 22 32 30 32 32 2d 30 34 2d 31 38 54 30 32 3a 30 30 3a 30 30 5a 22 2c 22 Data Ascii: reach-initiatives/entrepreneurs/miami-tech-hub/","published_node":"<time class=\"uni-timesince\" datetime=\"2022-04-20 04:00:00+00:00\">Apr 20</time>","headline":"Transforming Miami into the tech hub of the Americas"},{"published":"2022-04-18T02:00:00Z","
2022-05-04 16:23:16 UTC	1636	IN	Data Raw: 65 61 72 63 68 22 2c 22 70 61 67 65 5f 69 64 22 3a 35 36 33 33 31 2c 22 63 61 74 65 67 6f 72 79 22 3a 22 61 72 74 69 63 6c 65 22 2c 22 73 69 74 65 73 70 61 63 65 22 3a 22 22 2c 22 6d 61 69 6e 5f 68 65 72 6f 5f 69 6d 61 67 65 22 3a 6e 75 6c 6c 2c 22 73 75 6d 6d 61 72 79 22 3a 22 46 6f 72 20 57 6f 72 6c 64 20 51 75 61 6e 74 75 6d 20 44 61 79 2c 20 74 68 65 20 47 6f 6f 67 6c 65 20 51 75 61 6e 74 75 6d 20 41 49 20 74 65 61 6d 20 69 73 20 69 6e 74 72 6f 64 75 63 69 6e 67 20 70 65 6f 70 6c 65 20 74 6f 20 74 68 65 20 77 6f 72 6c 64 20 6f 66 20 71 75 61 6e 74 75 6d 20 63 6f 6d 70 75 74 69 6e 67 20 62 79 20 74 65 61 6d 69 6e 67 20 75 70 20 77 69 74 68 20 44 6f 75 62 6c 65 73 70 65 61 6b 20 2e 2e 2e 22 2c 22 73 69 74 65 73 70 61 63 65 5f 72 65 6e 64 65 72 22 3a 22 Data Ascii: earch","page_id":56331,"category":"article","sitespace":"","main_hero_image":null,"summary":"For World Quantum Day, the Google Quantum AI team is introducing people to the world of quantum computing by teaming up with Doublespeak ...","sitespace_render":"

Timestamp	kBytes transferred	Direction	Data
2022-05-04 16:23:16 UTC	1637	OUT	POST /j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-69658807-1&cid=1824703873.1651713796&jid=88979746&gjid=1992516074&_gid=382045814.1651713796&_u=YEBAAAAAAAAAAC~&z=96984045 HTTP/1.1 Host: stats.g.doubleclick.net Connection: keep-alive Content-Length: 0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Content-Type: text/plain Accept: / Origin: https://about.google Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://about.google/?fg=1&utm_source=google-DE&utm_medium=referral&utm_campaign=hp-header Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-05-04 16:23:17 UTC	1638	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://about.google Strict-Transport-Security: max-age=10886400; includeSubDomains; preload Date: Wed, 04 May 2022 16:23:17 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Last-Modified: Sun, 17 May 1998 03:00:00 GMT Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Content-Type: text/plain Cross-Origin-Resource-Policy: cross-origin Server: Golfe2 Content-Length: 1 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2022-05-04 16:23:17 UTC	1638	IN	Data Raw: 31 Data Ascii: 1

Timestamp	kBytes transferred	Direction	Data
2022-05-04 16:23:17 UTC	1638	OUT	GET /assets/img/close.png?cache=5628868 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36 Host: about.google
2022-05-04 16:23:17 UTC	1639	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Type: image/png Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/uxe-owners-acl/about_google Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="uxe-owners-acl/about_google" Report-To: {"group":"uxe-owners-acl/about_google","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/uxe-owners-acl/about_google"}]} Content-Length: 415 Date: Wed, 04 May 2022 16:23:17 GMT Expires: Wed, 04 May 2022 16:23:17 GMT Cache-Control: private, max-age=86400 Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2022-05-04 16:23:17 UTC	1640	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 30 00 00 00 30 08 06 00 00 00 57 02 f9 87 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 01 41 49 44 41 54 78 da ec 98 d1 0d 82 30 10 86 2b b7 80 cf 3c 39 42 13 26 60 13 9c cc ae e0 04 4c 40 c2 16 bc 3a 82 c5 d4 84 90 46 7b ed 7f 45 93 fb 13 42 44 e0 be 4f 5a 38 31 46 a3 d1 68 34 1a cd 71 39 71 76 ee ba ee ec 57 a3 5f e6 69 9a ae 48 10 7f ee 9b 5f 59 bf f4 fe dc 0f b8 c0 06 de 86 4d 0e 25 11 e0 87 f0 71 e6 48 34 8c 3a 5b f8 35 43 28 8c 84 37 a1 c6 98 7a 3c 47 60 8e 6c 2b 92 88 c0 7f aa 15 0d a5 ee b8 2c cb bd 6d db cb ee 2a bc 7e b1 75 fb fa 3d 08 9e 35 34 89 53 14 25 81 82 67 0b 20 24 90 f0 59 02 25 12 68 f8 6c 81 1c 09 09 f8 22 Data Ascii: PNGIHDR00WtEXtSoftwareAdobe ImageReadyqe<AIDATx0+<9B&`L@:F{EBDOZ81Fh4q9qvW_iH_YM%qH4:[5C(7z<G`l+,m*~u=54S%g $Y%hl"
2022-05-04 16:23:17 UTC	1641	IN	Data Raw: 78 b4 04 a7 95 b0 e8 de 26 1c eb 12 6b 15 0b f4 bb d7 1d 90 c6 2c 22 31 87 5a f8 ff 03 bf f8 6a 51 a3 d1 68 34 1a cd 91 79 0a 30 00 03 2c 0f 09 96 77 0b e5 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: x&k,"1ZjQh4y0,wIENDB`

Timestamp	kBytes transferred	Direction	Data
2022-05-04 16:23:17 UTC	1639	OUT	GET /assets/img/menu.png?cache=38c6aed HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36 Host: about.google
2022-05-04 16:23:17 UTC	1641	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Type: image/png Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/uxe-owners-acl/about_google Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="uxe-owners-acl/about_google" Report-To: {"group":"uxe-owners-acl/about_google","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/uxe-owners-acl/about_google"}]} Content-Length: 200 Date: Wed, 04 May 2022 16:23:17 GMT Expires: Wed, 04 May 2022 16:23:17 GMT Cache-Control: private, max-age=86400 Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2022-05-04 16:23:17 UTC	1642	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 30 00 00 00 30 08 06 00 00 00 57 02 f9 87 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 00 6a 49 44 41 54 78 da ec d9 c1 11 80 20 0c 04 40 e2 d8 74 2a 48 d9 d1 06 fc 0a e8 de 97 d7 8e 81 63 24 ba 7b ec 9c 63 6c 1e 00 00 00 00 00 00 80 99 39 9f 16 32 73 a9 4b 52 55 85 11 02 78 73 0f dc 09 5f 00 00 00 60 ea 29 b4 da ef 0a 4d 0c a0 89 8d 10 00 80 26 d6 c4 46 e8 6b 80 f0 46 06 00 00 00 00 00 00 f0 63 c0 25 c0 00 b6 f9 0c 65 ed 19 6e 6e 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDR00WtEXtSoftwareAdobe ImageReadyqe<jIDATx @t*Hc${cl92sKRUxs_`)M&FkFc%ennIENDB`

Timestamp	kBytes transferred	Direction	Data
2022-05-04 16:23:17 UTC	1791	OUT	GET /assets/img/keyboard-arrow-up-999.svg?cache=911336e HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36 Host: about.google
2022-05-04 16:23:17 UTC	1841	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding Content-Type: image/svg+xml Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/uxe-owners-acl/about_google Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="uxe-owners-acl/about_google" Report-To: {"group":"uxe-owners-acl/about_google","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/uxe-owners-acl/about_google"}]} Content-Length: 163 Date: Wed, 04 May 2022 16:23:17 GMT Expires: Wed, 04 May 2022 16:23:17 GMT Cache-Control: private, max-age=86400 Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2022-05-04 16:23:17 UTC	1842	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 32 34 22 20 68 65 69 67 68 74 3d 22 32 34 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 32 34 20 32 34 22 20 66 69 6c 6c 3d 22 23 39 39 39 39 39 39 22 3e 3c 70 61 74 68 20 64 3d 22 4d 37 2e 34 31 20 31 35 2e 34 31 4c 31 32 20 31 30 2e 38 33 6c 34 2e 35 39 20 34 2e 35 38 4c 31 38 20 31 34 6c 2d 36 2d 36 2d 36 20 36 7a 22 2f 3e 3c 2f 73 76 67 3e 0a Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="#999999"><path d="M7.41 15.41L12 10.83l4.59 4.58L18 14l-6-6-6 6z"/></svg>

Timestamp	kBytes transferred	Direction	Data
2022-05-04 16:22:49 UTC	942	OUT	GET /s/i/productlogos/googleg/v6/24px.svg HTTP/1.1 Host: fonts.gstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-05-04 16:22:49 UTC	943	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="apps-themes" Report-To: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} Content-Length: 742 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Tue, 03 May 2022 08:00:54 GMT Expires: Wed, 03 May 2023 08:00:54 GMT Cache-Control: public, max-age=31536000 Last-Modified: Wed, 20 Apr 2022 17:17:30 GMT Content-Type: image/svg+xml Age: 116515 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2022-05-04 16:22:49 UTC	943	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 68 65 69 67 68 74 3d 22 32 34 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 32 34 20 32 34 22 20 77 69 64 74 68 3d 22 32 34 22 3e 3c 70 61 74 68 20 64 3d 22 4d 32 32 2e 35 36 20 31 32 2e 32 35 63 30 2d 2e 37 38 2d 2e 30 37 2d 31 2e 35 33 2d 2e 32 2d 32 2e 32 35 48 31 32 76 34 2e 32 36 68 35 2e 39 32 63 2d 2e 32 36 20 31 2e 33 37 2d 31 2e 30 34 20 32 2e 35 33 2d 32 2e 32 31 20 33 2e 33 31 76 32 2e 37 37 68 33 2e 35 37 63 32 2e 30 38 2d 31 2e 39 32 20 33 2e 32 38 2d 34 2e 37 34 20 33 2e 32 38 2d 38 2e 30 39 7a 22 20 66 69 6c 6c 3d 22 23 34 32 38 35 46 34 22 2f 3e 3c 70 61 74 68 20 64 3d 22 4d 31 32 20 32 33 63 32 2e 39 37 20 30 20 35 2e 34 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M22.56 12.25c0-.78-.07-1.53-.2-2.25H12v4.26h5.92c-.26 1.37-1.04 2.53-2.21 3.31v2.77h3.57c2.08-1.92 3.28-4.74 3.28-8.09z" fill="#4285F4"/><path d="M12 23c2.97 0 5.4
2022-05-04 16:22:49 UTC	944	IN	Data Raw: 32 30 2e 35 33 20 37 2e 37 20 32 33 20 31 32 20 32 33 7a 22 20 66 69 6c 6c 3d 22 23 33 34 41 38 35 33 22 2f 3e 3c 70 61 74 68 20 64 3d 22 4d 35 2e 38 34 20 31 34 2e 30 39 63 2d 2e 32 32 2d 2e 36 36 2d 2e 33 35 2d 31 2e 33 36 2d 2e 33 35 2d 32 2e 30 39 73 2e 31 33 2d 31 2e 34 33 2e 33 35 2d 32 2e 30 39 56 37 2e 30 37 48 32 2e 31 38 43 31 2e 34 33 20 38 2e 35 35 20 31 20 31 30 2e 32 32 20 31 20 31 32 73 2e 34 33 20 33 2e 34 35 20 31 2e 31 38 20 34 2e 39 33 6c 32 2e 38 35 2d 32 2e 32 32 2e 38 31 2d 2e 36 32 7a 22 20 66 69 6c 6c 3d 22 23 46 42 42 43 30 35 22 2f 3e 3c 70 61 74 68 20 64 3d 22 4d 31 32 20 35 2e 33 38 63 31 2e 36 32 20 30 20 33 2e 30 36 2e 35 36 20 34 2e 32 31 20 31 2e 36 34 6c 33 2e 31 35 2d 33 2e 31 35 43 31 37 2e 34 35 20 32 2e 30 39 20 31 34 Data Ascii: 20.53 7.7 23 12 23z" fill="#34A853"/><path d="M5.84 14.09c-.22-.66-.35-1.36-.35-2.09s.13-1.43.35-2.09V7.07H2.18C1.43 8.55 1 10.22 1 12s.43 3.45 1.18 4.93l2.85-2.22.81-.62z" fill="#FBBC05"/><path d="M12 5.38c1.62 0 3.06.56 4.21 1.64l3.15-3.15C17.45 2.09 14