Edit tour

Windows Analysis Report
https://sites.google.com/view/familyfocusfederalcreditunion/home

Overview

General Information

Sample URL:	https://sites.google.com/view/familyfocusfederalcreditunion/home
Analysis ID:	561856
Infos:

Detection

HTMLPhisher

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Yara detected HtmlPhish20

Antivirus detection for URL or domain

Classification

Process Tree

System is w10x64

chrome.exe (PID: 6772 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "https://sites.google.com/view/familyfocusfederalcreditunion/home MD5: C139654B5C1438A95B321BB01AD63EF6)

chrome.exe (PID: 7040 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1500,6052585006456171848,1810093256929191656,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1920 /prefetch:8 MD5: C139654B5C1438A95B321BB01AD63EF6)

chrome.exe (PID: 7456 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1500,6052585006456171848,1810093256929191656,131072 --lang=en-US --service-sandbox-type=audio --enable-audio-service-sandbox --mojo-platform-channel-handle=4252 /prefetch:8 MD5: C139654B5C1438A95B321BB01AD63EF6)

chrome.exe (PID: 7488 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1500,6052585006456171848,1810093256929191656,131072 --lang=en-US --service-sandbox-type=video_capture --enable-audio-service-sandbox --mojo-platform-channel-handle=4220 /prefetch:8 MD5: C139654B5C1438A95B321BB01AD63EF6)

cleanup

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic			Jump to behavior

Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.3:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.3:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.3:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.3:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.3:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.182:443 -> 192.168.2.3:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.225:443 -> 192.168.2.3:49816 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.164:443 -> 192.168.2.3:49819 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.3:49902 version: TLS 1.2

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49937 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 443

Source: global traffic	HTTP traffic detected: GET /view/familyfocusfederalcreditunion/home HTTP/1.1Host: sites.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-85.0.4183.121Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/client.js?onload=gapiLoaded HTTP/1.1Host: apis.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://sites.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=L8fFvzSSImKqJLxWn4iQ8XuB6uQhK5D_HxcrcstFO4E-7pNxgn8NRrbCRYUzVUos9R-FYZTpziGEhy_9AtCATfeKAS1_stcIQpnPwTObrX2O8y_H4mhgeBPICYSX_YxvQVGRwnNcLo1LBoHZARIib_gs620avl2obbhSV91NSGg
Source: global traffic	HTTP traffic detected: GET /s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff2 HTTP/1.1Host: fonts.gstatic.comConnection: keep-aliveOrigin: https://sites.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://fonts.googleapis.com/css?family=Google+Sans_old:400,500\|Roboto:300,400,500,700\|Source+Code+Pro:400,700&display=swapAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Wd_wknVICrI7GuuM4qtcie9snyzQVNZlz5S7a_zFU3iPl0IhAU8q0AT1d42cO26VJH1v43FVWNqjcSg_jAE_lxo=w16383 HTTP/1.1Host: lh5.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://sites.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /4baYZrcHmiE7ZKGZJ663qknfJkZmpMlivEutAcwAujKEjiOGeaAyt6SjBmKy6ezrP90V1MjzXW7qsr-3iIdzq_M=w16383 HTTP/1.1Host: lh5.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://sites.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/ptsans/v16/jizfRExUiTo99u79B_mh0O6tLQ.woff2 HTTP/1.1Host: fonts.gstatic.comConnection: keep-aliveOrigin: https://sites.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://fonts.googleapis.com/css?family=PT%20Sans%3A400%2C700%7CMerriweather%3A400%2C700&display=swapAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/ptsans/v16/jizaRExUiTo99u79D0KExQ.woff2 HTTP/1.1Host: fonts.gstatic.comConnection: keep-aliveOrigin: https://sites.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://fonts.googleapis.com/css?family=PT%20Sans%3A400%2C700%7CMerriweather%3A400%2C700&display=swapAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /4baYZrcHmiE7ZKGZJ663qknfJkZmpMlivEutAcwAujKEjiOGeaAyt6SjBmKy6ezrP90V1MjzXW7qsr-3iIdzq_M=w16383 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh5.googleusercontent.com
Source: global traffic	HTTP traffic detected: GET /Wd_wknVICrI7GuuM4qtcie9snyzQVNZlz5S7a_zFU3iPl0IhAU8q0AT1d42cO26VJH1v43FVWNqjcSg_jAE_lxo=w16383 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh5.googleusercontent.com
Source: global traffic	HTTP traffic detected: GET /Wd_wknVICrI7GuuM4qtcie9snyzQVNZlz5S7a_zFU3iPl0IhAU8q0AT1d42cO26VJH1v43FVWNqjcSg_jAE_lxo=w16383 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh5.googleusercontent.comIf-None-Match: "v1"
Source: global traffic	HTTP traffic detected: GET /MXrI3IRfodt8Nim2WSoCFDX0pNnpfit5w-fNMptyaPzYiSWVN_Duz0kGq6hMyIg_Yh4X68o80Dl0P5xg0ntXqi7kaWKLabeZqDRbG7S90qHOJsd-W5BqUj41wpMDdsDG6A=w1280 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh4.googleusercontent.com
Source: global traffic	HTTP traffic detected: GET /IDlwhHCxbd6E8qTLmYz1qoEuA4weX9ToGtcAeBJclSnecrRMrrhPjj81JcYhluDpBaK-wU8poPbo0QzeqDLH6XRQgXkg-CkAaQLXHM6ssO1yIUsM5fvKJiW2yoHWLo4tyA=w1280 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh4.googleusercontent.com
Source: global traffic	HTTP traffic detected: GET /NvVfoDKaFqFbEYmY_0YGEeQhwCvwBGhLxbrHdo0C20j3iuFyJmoRIOu-aLlkWDAW8peDka8D6p5vDV7Kvu8jYnw=w16383 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh6.googleusercontent.com
Source: global traffic	HTTP traffic detected: GET /66XogdyLACCqlQsth4mS_y6PCkflhGbJcwdxwJxyBeBGBRwe5LvVMxJMQHaSBl0EXaX2VC9Ykw4Pde5t1Gfg9QsD84JW5FJvUqwvKTU7n3DMpWctVBX7OUrSSqKR6GpBwg=w1280 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh3.googleusercontent.com
Source: global traffic	HTTP traffic detected: GET /url?q=https%3A%2F%2Fprotective-glistening-people.glitch.me%2Fa.html&sa=D&sntz=1&usg=AFQjCNE3AXCYZpM83juSb429VtosyK-bUg HTTP/1.1Host: www.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=L8fFvzSSImKqJLxWn4iQ8XuB6uQhK5D_HxcrcstFO4E-7pNxgn8NRrbCRYUzVUos9R-FYZTpziGEhy_9AtCATfeKAS1_stcIQpnPwTObrX2O8y_H4mhgeBPICYSX_YxvQVGRwnNcLo1LBoHZARIib_gs620avl2obbhSV91NSGg
Source: global traffic	HTTP traffic detected: GET /NvVfoDKaFqFbEYmY_0YGEeQhwCvwBGhLxbrHdo0C20j3iuFyJmoRIOu-aLlkWDAW8peDka8D6p5vDV7Kvu8jYnw=w16383 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh6.googleusercontent.comIf-None-Match: "v1"
Source: global traffic	HTTP traffic detected: GET /a.html HTTP/1.1Host: protective-glistening-people.glitch.meConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://www.google.com/url?q=https%3A%2F%2Fprotective-glistening-people.glitch.me%2Fa.html&sa=D&sntz=1&usg=AFQjCNE3AXCYZpM83juSb429VtosyK-bUgAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /d7f4f279-e13b-4330-8422-00b2d9211424%2FGlitch-Error-Rainbow-Mug-hires.png?v=1595481653593 HTTP/1.1Host: cdn.glitch.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://protective-glistening-people.glitch.me/a.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /css/3a8e55c6-b1f3-4659-99eb-125ae72bd084.css HTTP/1.1Host: cloud.webtype.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://protective-glistening-people.glitch.me/a.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /css/3a8e55c6-b1f3-4659-99eb-125ae72bd084.css HTTP/1.1Host: cloud.typenetwork.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://protective-glistening-people.glitch.me/a.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /d7f4f279-e13b-4330-8422-00b2d9211424%2FGlitch-Error-Rainbow-Mug-hires.png HTTP/1.1Host: cdn.glitch.meConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://protective-glistening-people.glitch.me/a.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /projects/5027/fontface.css/ HTTP/1.1Host: cloud.typenetwork.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: protective-glistening-people.glitch.meConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://protective-glistening-people.glitch.me/a.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /technologies/cookies HTTP/1.1Host: policies.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://www.google.com/policies/technologies/cookies/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=L8fFvzSSImKqJLxWn4iQ8XuB6uQhK5D_HxcrcstFO4E-7pNxgn8NRrbCRYUzVUos9R-FYZTpziGEhy_9AtCATfeKAS1_stcIQpnPwTObrX2O8y_H4mhgeBPICYSX_YxvQVGRwnNcLo1LBoHZARIib_gs620avl2obbhSV91NSGg
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 27 Jan 2022 22:05:37 GMTContent-Type: text/html; charset=utf-8Content-Length: 1930Connection: closeCache-Control: max-age=0ETag: W/"78a-v/0NQwFUHD+MwdUDXLgAso0Y8f8"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 27 Jan 2022 22:05:38 GMTContent-Type: text/html; charset=utf-8Content-Length: 1930Connection: closeCache-Control: max-age=0ETag: W/"78a-v/0NQwFUHD+MwdUDXLgAso0Y8f8"

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "https://sites.google.com/view/familyfocusfederalcreditunion/home
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1500,6052585006456171848,1810093256929191656,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1920 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1500,6052585006456171848,1810093256929191656,131072 --lang=en-US --service-sandbox-type=audio --enable-audio-service-sandbox --mojo-platform-channel-handle=4252 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1500,6052585006456171848,1810093256929191656,131072 --lang=en-US --service-sandbox-type=video_capture --enable-audio-service-sandbox --mojo-platform-channel-handle=4220 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1500,6052585006456171848,1810093256929191656,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1920 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1500,6052585006456171848,1810093256929191656,131072 --lang=en-US --service-sandbox-type=audio --enable-audio-service-sandbox --mojo-platform-channel-handle=4252 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1500,6052585006456171848,1810093256929191656,131072 --lang=en-US --service-sandbox-type=video_capture --enable-audio-service-sandbox --mojo-platform-channel-handle=4220 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: agree
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: agree

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	3 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	4 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	5 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	3 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud

Source	Detection	Scanner	Label	Link
https://sites.google.com/view/familyfocusfederalcreditunion/home	0%	Virustotal		Browse
https://sites.google.com/view/familyfocusfederalcreditunion/home	0%	Avira URL Cloud	safe
https://sites.google.com/view/familyfocusfederalcreditunion/home	100%	SlashNext	Fake Login Page type: Phishing & Social Engineering

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\Temp\6772_1762258990\_platform_specific\x86_64\pnacl_public_x86_64_ld_nexe	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\6772_1762258990\_platform_specific\x86_64\pnacl_public_x86_64_ld_nexe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\6772_1762258990\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_llc_nexe	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\6772_1762258990\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_llc_nexe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\6772_1762258990\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_sz_nexe	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\6772_1762258990\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_sz_nexe	0%	ReversingLabs

Source: angular.js.2.dr	String found in binary or memory: http://angularjs.org
Source: data_3.4.dr	String found in binary or memory: http://crl.pki.goog/gsr1/gsr1.crl0;
Source: data_3.4.dr	String found in binary or memory: http://crl.pki.goog/gtsr1/gtsr1.crl0W
Source: data_3.4.dr	String found in binary or memory: http://crls.pki.goog/gts1c3/QOvJ0N1sT2A.crl0
Source: data_3.4.dr	String found in binary or memory: http://crls.pki.goog/gts1c3/QqFxbi9M48c.crl0
Source: data_3.4.dr	String found in binary or memory: http://crls.pki.goog/gts1c3/fVJxbV-Ktmk.crl0
Source: data_3.4.dr	String found in binary or memory: http://crls.pki.goog/gts1c3/moVDfISia2k.crl0
Source: data_3.4.dr	String found in binary or memory: http://crls.pki.goog/gts1c3/zdATt0Ex_Fk.crl0
Source: angular.js.2.dr	String found in binary or memory: http://errors.angularjs.org/1.6.4-local
Source: data_1.4.dr, Favicons.2.dr, History.2.dr, Current Session.2.dr	String found in binary or memory: http://google.com/
Source: History.2.dr	String found in binary or memory: http://google.com/Google
Source: History.2.dr	String found in binary or memory: http://google.com/Google/55
Source: pnacl_public_x86_64_pnacl_sz_nexe.2.dr, pnacl_public_x86_64_pnacl_llc_nexe.2.dr	String found in binary or memory: http://llvm.org/):
Source: data_3.4.dr	String found in binary or memory: http://ocsp.pki.goog/gsr10)
Source: data_3.4.dr	String found in binary or memory: http://ocsp.pki.goog/gts1c301
Source: data_3.4.dr	String found in binary or memory: http://ocsp.pki.goog/gtsr100
Source: data_3.4.dr	String found in binary or memory: http://pki.goog/gsr1/gsr1.crt02
Source: data_3.4.dr	String found in binary or memory: http://pki.goog/repo/certs/gts1c3.der0
Source: data_3.4.dr	String found in binary or memory: http://pki.goog/repo/certs/gts1c3.der0M
Source: data_3.4.dr	String found in binary or memory: http://pki.goog/repo/certs/gts1c3.der0c
Source: data_3.4.dr	String found in binary or memory: http://pki.goog/repo/certs/gtsr1.der04
Source: mirroring_hangouts.js.2.dr	String found in binary or memory: http://tools.ietf.org/html/rfc1950
Source: mirroring_hangouts.js.2.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: data_1.4.dr, Favicons.2.dr, History.2.dr, Network Action Predictor.2.dr	String found in binary or memory: http://www.google.com/
Source: data_1.4.dr	String found in binary or memory: http://www.google.com/Content-Type:
Source: History.2.dr	String found in binary or memory: http://www.google.com/Google
Source: History.2.dr	String found in binary or memory: http://www.google.com/Google/55
Source: mirroring_hangouts.js.2.dr	String found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions
Source: mirroring_hangouts.js.2.dr	String found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01
Source: Reporting and NEL.4.dr	String found in binary or memory: https://a.nel.cloudflare.com/report/v3?s=5zFkm%2FnLrdTzQlMfulMVvjMaAOr5aMyswTowNINz8CUMbXwy5qfC%2BF1
Source: Reporting and NEL.4.dr	String found in binary or memory: https://a.nel.cloudflare.com/report/v3?s=evTxnEDZnJh50rwXPIimXn0J4nPbMQ%2BaGVv9%2BkwEF56unvw0%2FXohd
Source: 44cfde47-23ff-49fe-aa35-19697b9947b0.tmp.4.dr, 90959df8-82ae-45e7-8e3b-35dc247353ab.tmp.4.dr, manifest.json3.2.dr	String found in binary or memory: https://accounts.google.com
Source: craw_window.js.2.dr	String found in binary or memory: https://accounts.google.com/MergeSession
Source: data_3.4.dr	String found in binary or memory: https://apis.google.com
Source: Network Action Predictor.2.dr	String found in binary or memory: https://apis.google.com/
Source: data_1.4.dr	String found in binary or memory: https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.fQLVS3SAB_U.O/m=gapi_iframes
Source: data_1.4.dr	String found in binary or memory: https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.J6wwVzZFlys.O/m=client/rt=j/sv=1/d=1/
Source: mirroring_common.js.2.dr	String found in binary or memory: https://apis.google.com/js/client.js
Source: data_1.4.dr	String found in binary or memory: https://apis.google.com/js/client.js?onload=gapiLoaded
Source: data_1.4.dr	String found in binary or memory: https://apis.google.com/js/client.js?onload=gapiLoadedWj

Name	IP	Active	Malicious	Reputation
gstaticadssl.l.google.com	142.250.184.227	true	false	high
cdn.glitch.me	52.84.174.111	true	false	high
google.com	142.250.185.206	true	false	high
accounts.google.com	172.217.16.141	true	false	high
plus.l.google.com	142.250.186.110	true	false	high
www-google-analytics.l.google.com	142.250.185.174	true	false	high
stats.l.doubleclick.net	74.125.140.156	true	false	high
cloud.webtype.com	188.114.96.7	true	false	unknown
i.ytimg.com	142.250.186.182	true	false	high
sites.google.com	142.250.74.206	true	false	high
policies.google.com	172.217.16.142	true	false	high
adservice.google.com	142.250.184.226	true	false	high
youtube-ui.l.google.com	142.250.185.78	true	false	high
cdn.glitch.com	52.84.174.66	true	false	high
cs549.wac.deltacdn.net	192.229.233.123	true	false	unknown
play.google.com	142.250.186.78	true	false	high
photos-ugc.l.googleusercontent.com	142.250.185.225	true	false	high
www.google.com	142.250.186.164	true	false	high
clients.l.google.com	142.250.185.78	true	false	high
protective-glistening-people.glitch.me	52.44.125.193	true	false	high
googlehosted.l.googleusercontent.com	142.250.185.65	true	false	high
yt3.ggpht.com	unknown	unknown	false	high
lh6.googleusercontent.com	unknown	unknown	false	high
lh3.googleusercontent.com	unknown	unknown	false	high
stats.g.doubleclick.net	unknown	unknown	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
lh5.googleusercontent.com	unknown	unknown	false	high
clients2.google.com	unknown	unknown	false	high
cloud.typenetwork.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high
lh4.googleusercontent.com	unknown	unknown	false	high
www.youtube-nocookie.com	unknown	unknown	false	high

Name	Malicious	Antivirus Detection	Reputation
https://lh5.googleusercontent.com/Wd_wknVICrI7GuuM4qtcie9snyzQVNZlz5S7a_zFU3iPl0IhAU8q0AT1d42cO26VJH1v43FVWNqjcSg_jAE_lxo=w16383	false		high
https://sites.google.com/view/familyfocusfederalcreditunion/team#h.u12q2quik1io	false		high
https://policies.google.com/technologies/cookies	false		high
https://sites.google.com/view/familyfocusfederalcreditunion/home	false		high
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1	false		high
https://www.google.com/url?q=https%3A%2F%2Fprotective-glistening-people.glitch.me%2Fa.html&sa=D&sntz=1&usg=AFQjCNE3AXCYZpM83juSb429VtosyK-bUg	false		high
https://sites.google.com/view/familyfocusfederalcreditunion/home	false		high
https://apis.google.com/js/client.js?onload=gapiLoaded	false		high
https://lh3.googleusercontent.com/66XogdyLACCqlQsth4mS_y6PCkflhGbJcwdxwJxyBeBGBRwe5LvVMxJMQHaSBl0EXaX2VC9Ykw4Pde5t1Gfg9QsD84JW5FJvUqwvKTU7n3DMpWctVBX7OUrSSqKR6GpBwg=w1280	false		high
https://protective-glistening-people.glitch.me/a.html	false	SlashNext: Fake Login Page type: Phishing & Social Engineering	high
https://cdn.glitch.com/d7f4f279-e13b-4330-8422-00b2d9211424%2FGlitch-Error-Rainbow-Mug-hires.png?v=1595481653593	false		high
https://sites.google.com/view/familyfocusfederalcreditunion/team#h.mc9c3iu9koq0	false		high
https://lh4.googleusercontent.com/IDlwhHCxbd6E8qTLmYz1qoEuA4weX9ToGtcAeBJclSnecrRMrrhPjj81JcYhluDpBaK-wU8poPbo0QzeqDLH6XRQgXkg-CkAaQLXHM6ssO1yIUsM5fvKJiW2yoHWLo4tyA=w1280	false		high
https://cloud.typenetwork.com/css/3a8e55c6-b1f3-4659-99eb-125ae72bd084.css	false		high
https://protective-glistening-people.glitch.me/favicon.ico	false		high

Name	Source	Malicious	Antivirus Detection	Reputation
https://lh4.googleusercontent.com/IDlwhHCxbd6E8qTLmYz1qoEuA4weX9ToGtcAeBJclSnecrRMrrhPjj81JcYhluDpBa	data_1.4.dr	false		high
https://apis.google.com/js/client.js	mirroring_common.js.2.dr	false		high
https://store.typenetwork.com/account/licenses	data_1.4.dr	false		high
http://www.google.com/Google	History.2.dr	false		high
https://sites.google.com/view/familyfocusfederalcreditunion/home2	History Provider Cache.2.dr	false		high
https://csp.withgoogle.com/csp/report-to/apps-sites	data_3.4.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://csp.withgoogle.com/csp/report-to/apps-themes	data_3.4.dr	false	URL Reputation: safe	unknown
https://csp.withgoogle.com/csp/botguard-scscross-origin-resource-policy:cross-origincross-origin-ope	data_3.4.dr	false	URL Reputation: safe	unknown
https://sites.google.com/view/familyfocusfederalcreditunion/team#h.qfch9jlvl9zz	Current Session.2.dr	false		high
http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01	mirroring_hangouts.js.2.dr	false		high
https://cloud.typenetwork.com/	Network Action Predictor.2.dr	false		high
https://preprod-hangouts-googleapis.sandbox.google.com	mirroring_hangouts.js.2.dr	false		high
https://protective-glistening-people.glitch.me/a.htmlCache-Control:	data_2.4.dr	false		high
https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.J6wwVzZFlys.O/m=client/rt=j/sv=1/d=1/	data_1.4.dr	false		high
https://csp.withgoogle.com/csp/botguard-scs	data_3.4.dr	false	URL Reputation: safe	unknown
https://sites.google.com/view/familyfocusfederalcreditunion/historyE	Favicons.2.dr	false		high
http://crls.pki.goog/gts1c3/QOvJ0N1sT2A.crl0	data_3.4.dr	false	URL Reputation: safe	unknown
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.fQLVS3SAB_U.O/m=gapi_iframes	data_1.4.dr	false		high
https://www.youtube-nocookie.com/s/player/8ad9c87a/player_ias.vflset/en_US/base.js	data_1.4.dr	false		high
https://csp.withgoogle.com/csp/report-to/one-google-engl	Reporting and NEL.4.dr	false	Avira URL Cloud: safe	unknown
https://lh5.googleusercontent.com/4baYZrcHmiE7ZKGZJ663qknfJkZmpMlivEutAcwAujKEjiOGeaAyt6SjBmKy6ezrP9	data_1.4.dr	false		high
https://sites.google.com/view/familyfocusfederalcreditunion/team#h.u12q2quik1ioFamily	History.2.dr	false		high
https://www.google.com/client_204?&atyp=i&biw=1280&bih=869&ei=ZBfzYYOGE_SS9u8P5fWQwA8	data_1.4.dr	false		high
https://lh5.googleusercontent.com/Wd_wknVICrI7GuuM4qtcie9snyzQVNZlz5S7a_zFU3iPl0IhAU8q0AT1d42cO26VJH	data_1.4.dr	false		high
https://csp.withgoogle.com/csp/cloudviewcross-origin-resource-policy:cross-origincross-origin-opener	data_3.4.dr	false	URL Reputation: safe	unknown
https://www.google.com/accounts/OAuthLogin?issueuberauth=1	craw_window.js.2.dr	false		high
https://a.nel.cloudflare.com/report/v3?s=5zFkm%2FnLrdTzQlMfulMVvjMaAOr5aMyswTowNINz8CUMbXwy5qfC%2BF1	Reporting and NEL.4.dr	false		high
https://www.google.com/images/branding/googlelogo/1x/googlelogo_color_74x24dp.png	data_1.4.dr	false		high
https://sites.google.com/view/familyfocusfederalcreditunion/historyM	Current Session.2.dr	false		high
https://www.google.com/tools/feedback	feedback_script.js.2.dr	false		high
https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p	craw_window.js.2.dr, craw_background.js.2.dr	false		high
https://sites.google.com/view/familyfocusfederalcreditunion/history#h.a887fllea086W	Favicons.2.dr	false		high
http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions	mirroring_hangouts.js.2.dr	false		high
https://sites.google.com/view/familyfocusfederalcreditunion/history#h.a887fllea086Z$	Current Session.2.dr	false		high
https://sites.google.com/view/familyfocusfederalcreditunion/team#h.u12q2quik1io(Family	Current Session.2.dr	false		high
https://payments.google.com/payments/v4/js/integrator.js	craw_window.js.2.dr, manifest.json.2.dr	false		high
https://www.youtube-nocookie.com/generate_204?yyp_HQ7;	data_1.4.dr	false		high
https://sites.google.com/view/familyfocusfederalcreditunion/team#h.mc9c3iu9koq0T	Favicons.2.dr	false		high
https://pki.goog/repository/0	data_3.4.dr	false	URL Reputation: safe	unknown
https://csp.withgoogle.com/csp/gws-team	data_3.4.dr	false	Avira URL Cloud: safe	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
192.229.233.123	cs549.wac.deltacdn.net	United States	15133	EDGECASTUS	false
142.250.185.78	youtube-ui.l.google.com	United States	15169	GOOGLEUS	false
52.44.125.193	protective-glistening-people.glitch.me	United States	14618	AMAZON-AESUS	false
142.250.185.206	google.com	United States	15169	GOOGLEUS	false
142.250.74.206	sites.google.com	United States	15169	GOOGLEUS	false
52.84.174.111	cdn.glitch.me	United States	16509	AMAZON-02US	false
142.250.185.225	photos-ugc.l.googleusercontent.com	United States	15169	GOOGLEUS	false
142.250.186.110	plus.l.google.com	United States	15169	GOOGLEUS	false
142.250.184.226	adservice.google.com	United States	15169	GOOGLEUS	false
142.250.184.227	gstaticadssl.l.google.com	United States	15169	GOOGLEUS	false
172.217.16.141	accounts.google.com	United States	15169	GOOGLEUS	false
142.250.185.65	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
172.217.16.142	policies.google.com	United States	15169	GOOGLEUS	false
142.250.186.78	play.google.com	United States	15169	GOOGLEUS	false
142.250.186.182	i.ytimg.com	United States	15169	GOOGLEUS	false
74.125.140.156	stats.l.doubleclick.net	United States	15169	GOOGLEUS	false
188.114.96.7	cloud.webtype.com	European Union	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
52.84.174.66	cdn.glitch.com	United States	16509	AMAZON-02US	false
142.250.185.174	www-google-analytics.l.google.com	United States	15169	GOOGLEUS	false
142.250.186.164	www.google.com	United States	15169	GOOGLEUS	false

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	561856
Start date:	27.01.2022
Start time:	23:04:20
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://sites.google.com/view/familyfocusfederalcreditunion/home
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal64.phis.win@54/273@34/23
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI Browse: https://sites.google.com/view/familyfocusfederalcreditunion/history Browse: https://sites.google.com/view/familyfocusfederalcreditunion/team Browse: https://sites.google.com/view/familyfocusfederalcreditunion/faq Browse: https://www.google.com/url?q=https%3A%2F%2Fprotective-glistening-people.glitch.me%2Fa.html&sa=D&sntz=1&usg=AFQjCNE3AXCYZpM83juSb429VtosyK-bUg Browse: https://www.google.com/policies/technologies/cookies/ Browse: https://sites.google.com/view/familyfocusfederalcreditunion/team Browse: https://sites.google.com/view/familyfocusfederalcreditunion/faq Browse: https://sites.google.com/view/familyfocusfederalcreditunion/history#h.afyj9j9g00b0 Browse: https://sites.google.com/view/familyfocusfederalcreditunion/history#h.wz7mar23iqyu Browse: https://sites.google.com/view/familyfocusfederalcreditunion/history#h.a887fllea086 Browse: https://www.google.com/policies/technologies/cookies/ Browse: https://sites.google.com/view/familyfocusfederalcreditunion/history Browse: https://sites.google.com/view/familyfocusfederalcreditunion/faq Browse: https://sites.google.com/view/familyfocusfederalcreditunion/team#h.a4rji4pxv1xr Browse: https://sites.google.com/view/familyfocusfederalcreditunion/team#h.mc9c3iu9koq0 Browse: https://sites.google.com/view/familyfocusfederalcreditunion/team#h.u12q2quik1io Browse: https://sites.google.com/view/familyfocusfederalcreditunion/team#h.qfch9jlvl9zz Browse: http://google.com/

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	451603
Entropy (8bit):	5.009711072558331
Encrypted:	false
SSDEEP:	12288:ZHfRTyGZ6lup8Cfrvq4JBPKh+FBlESBw4p6:NfOCzvRKhGvwJ
MD5:	A78AD14E77147E7DE3647E61964C0335
SHA1:	CECC3DD41F4CEA0192B24300C71E1911BD4FCE45
SHA-256:	0D6803758FF8F87081FAFD62E90F0950DFB2DD7991E9607FE76A8F92D0E893FA
SHA-512:	DDE24D5AD50D68FC91E9E325D31E66EF8F624B6BB3A07D14FFED1104D3AB5F4EF1D7969A5CDE0DFBB19CB31C506F7DE97AF67C2F244F7E7E8E10648EA8321101
Malicious:	false
Reputation:	low
Preview:	BDic.... ....6...."..Z..4g....6.2...{/...3...5....AF 1363.AF nm.AF pt.AF n1.AF p.AF tc.AF SM.AF M.AF S.AF MS.AF MNR.AF GDS.AF MNT.AF MH.AF MR.AF SZMR.AF MJ.AF MT.AF MY.AF MRZ.AF MN.AF MG.AF RM.AF N.AF MV.AF XM.AF DSM.AF SD.AF G.AF R.AF MNX.AF MRS.AF MD.AF MNRB.AF B.AF ZSMR.AF PM.AF SMNGJ.AF SMN.AF ZMR.AF SMGB.AF MZR.AF GM.AF SMR.AF SMDG.AF RMZ.AF ZM.AF MDG.AF MDT.AF SMNXT.AF SDY.AF LSDG.AF LGDS.AF GLDS.AF UY.AF U.AF DSGNX.AF GNDSX.AF DSG.AF Y.AF GS.AF IEMS.AF YP.AF ZGDRS.AF XGNVDS.AF UT.AF GNDS.AF GVDS.AF MYPS.AF XGNDS.AF TPRY.AF MDSG.AF ZGSDR.AF DYSG.AF PMYTNS.AF AGDS.AF DRZGS.AF PY.AF GSPMDY.AF EGVDS.AF SL.AF GNXDS.AF DSBG.AF IM.AF I.AF MDGS.AF SMY.AF DSGN.AF DSLG.AF GMDS.AF MDSBG.AF SGD.AF IY.AF P.AF DSMG.AF BLZGDRS.AF TR.AF AGSD.AF ZGBDRSL.AF PTRY.AF ASDGV.AF ASM.AF ICANGSD.AF ICAM.AF IKY.AF AMS.AF PMYTRS.AF BZGVDRS.AF SDRBZG.AF GVMDS.AF PSM.AF DGLS.AF GNVXDS.AF AGDSL.AF DGS.AF XDSGNV.AF BZGDRS.AF AM.AF AS.AF A.AF LDSG.AF AGVDS.AF SDG.AF LDSMG.AF EDSMG.AF EY.AF DRSMZG.AF PRYT.AF LZ

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jan 27, 2022 23:05:18.525162935 CET	192.168.2.3	8.8.8.8	0xc8f0	Standard query (0)	sites.google.com	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:18.539720058 CET	192.168.2.3	8.8.8.8	0x3a0b	Standard query (0)	clients2.google.com	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:18.547585964 CET	192.168.2.3	8.8.8.8	0x6b0d	Standard query (0)	accounts.google.com	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:19.774435997 CET	192.168.2.3	8.8.8.8	0x26a3	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:20.046860933 CET	192.168.2.3	8.8.8.8	0xd85a	Standard query (0)	lh5.googleusercontent.com	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:22.237567902 CET	192.168.2.3	8.8.8.8	0xaf1b	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:22.576430082 CET	192.168.2.3	8.8.8.8	0x24ff	Standard query (0)	lh5.googleusercontent.com	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:28.671042919 CET	192.168.2.3	8.8.8.8	0x99c6	Standard query (0)	lh4.googleusercontent.com	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:30.830749989 CET	192.168.2.3	8.8.8.8	0x60b5	Standard query (0)	lh4.googleusercontent.com	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:32.784698963 CET	192.168.2.3	8.8.8.8	0x6ef	Standard query (0)	lh6.googleusercontent.com	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:32.788996935 CET	192.168.2.3	8.8.8.8	0xedda	Standard query (0)	lh3.googleusercontent.com	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:34.905216932 CET	192.168.2.3	8.8.8.8	0x7b92	Standard query (0)	lh6.googleusercontent.com	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:34.911550045 CET	192.168.2.3	8.8.8.8	0xbc4	Standard query (0)	lh3.googleusercontent.com	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:36.889919043 CET	192.168.2.3	8.8.8.8	0xc5f8	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:37.137257099 CET	192.168.2.3	8.8.8.8	0x4ed1	Standard query (0)	protective-glistening-people.glitch.me	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:37.818761110 CET	192.168.2.3	8.8.8.8	0xf9a8	Standard query (0)	cdn.glitch.com	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:37.819951057 CET	192.168.2.3	8.8.8.8	0xf65	Standard query (0)	cloud.webtype.com	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:37.941420078 CET	192.168.2.3	8.8.8.8	0xcf88	Standard query (0)	cloud.typenetwork.com	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:37.979705095 CET	192.168.2.3	8.8.8.8	0x1778	Standard query (0)	cdn.glitch.me	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:39.037656069 CET	192.168.2.3	8.8.8.8	0x132f	Standard query (0)	policies.google.com	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:39.208916903 CET	192.168.2.3	8.8.8.8	0x6a4d	Standard query (0)	cdn.glitch.com	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:39.373151064 CET	192.168.2.3	8.8.8.8	0xa367	Standard query (0)	cdn.glitch.me	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:39.421106100 CET	192.168.2.3	8.8.8.8	0x1b59	Standard query (0)	www.youtube-nocookie.com	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:41.685117960 CET	192.168.2.3	8.8.8.8	0xb32a	Standard query (0)	yt3.ggpht.com	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:41.771039963 CET	192.168.2.3	8.8.8.8	0xa35d	Standard query (0)	i.ytimg.com	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:42.208379030 CET	192.168.2.3	8.8.8.8	0xe90d	Standard query (0)	stats.g.doubleclick.net	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:42.271816015 CET	192.168.2.3	8.8.8.8	0x49fb	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:43.200795889 CET	192.168.2.3	8.8.8.8	0xc9b0	Standard query (0)	yt3.ggpht.com	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:43.206741095 CET	192.168.2.3	8.8.8.8	0xc41c	Standard query (0)	i.ytimg.com	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:43.685029984 CET	192.168.2.3	8.8.8.8	0x47d6	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Jan 27, 2022 23:06:20.268687963 CET	192.168.2.3	8.8.8.8	0x1aa1	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)
Jan 27, 2022 23:06:20.270426989 CET	192.168.2.3	8.8.8.8	0x1a87	Standard query (0)	sites.google.com	A (IP address)	IN (0x0001)
Jan 27, 2022 23:06:28.153889894 CET	192.168.2.3	8.8.8.8	0x3d19	Standard query (0)	google.com	A (IP address)	IN (0x0001)
Jan 27, 2022 23:06:29.223170996 CET	192.168.2.3	8.8.8.8	0x6b8e	Standard query (0)	adservice.google.com	A (IP address)	IN (0x0001)

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jan 27, 2022 23:05:18.552829027 CET	8.8.8.8	192.168.2.3	0xc8f0	No error (0)	sites.google.com		142.250.74.206	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:18.566222906 CET	8.8.8.8	192.168.2.3	0x3a0b	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)
Jan 27, 2022 23:05:18.566222906 CET	8.8.8.8	192.168.2.3	0x3a0b	No error (0)	clients.l.google.com		142.250.185.78	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:18.574968100 CET	8.8.8.8	192.168.2.3	0x6b0d	No error (0)	accounts.google.com		172.217.16.141	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:19.801783085 CET	8.8.8.8	192.168.2.3	0x26a3	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)
Jan 27, 2022 23:05:19.801783085 CET	8.8.8.8	192.168.2.3	0x26a3	No error (0)	plus.l.google.com		142.250.186.110	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:19.927108049 CET	8.8.8.8	192.168.2.3	0x77f4	No error (0)	gstaticadssl.l.google.com		142.250.184.227	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:20.087584019 CET	8.8.8.8	192.168.2.3	0xd85a	No error (0)	lh5.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)
Jan 27, 2022 23:05:20.087584019 CET	8.8.8.8	192.168.2.3	0xd85a	No error (0)	googlehosted.l.googleusercontent.com		142.250.185.65	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:22.265641928 CET	8.8.8.8	192.168.2.3	0xaf1b	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)
Jan 27, 2022 23:05:22.265641928 CET	8.8.8.8	192.168.2.3	0xaf1b	No error (0)	googlehosted.l.googleusercontent.com		142.250.185.65	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:22.603916883 CET	8.8.8.8	192.168.2.3	0x24ff	No error (0)	lh5.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)
Jan 27, 2022 23:05:22.603916883 CET	8.8.8.8	192.168.2.3	0x24ff	No error (0)	googlehosted.l.googleusercontent.com		142.250.185.65	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:28.699619055 CET	8.8.8.8	192.168.2.3	0x99c6	No error (0)	lh4.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)
Jan 27, 2022 23:05:28.699619055 CET	8.8.8.8	192.168.2.3	0x99c6	No error (0)	googlehosted.l.googleusercontent.com		142.250.185.65	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:30.858391047 CET	8.8.8.8	192.168.2.3	0x60b5	No error (0)	lh4.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)
Jan 27, 2022 23:05:30.858391047 CET	8.8.8.8	192.168.2.3	0x60b5	No error (0)	googlehosted.l.googleusercontent.com		142.250.185.65	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:32.802171946 CET	8.8.8.8	192.168.2.3	0x6ef	No error (0)	lh6.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)
Jan 27, 2022 23:05:32.802171946 CET	8.8.8.8	192.168.2.3	0x6ef	No error (0)	googlehosted.l.googleusercontent.com		142.250.185.65	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:32.808403015 CET	8.8.8.8	192.168.2.3	0xedda	No error (0)	lh3.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)
Jan 27, 2022 23:05:32.808403015 CET	8.8.8.8	192.168.2.3	0xedda	No error (0)	googlehosted.l.googleusercontent.com		142.250.185.65	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:34.931117058 CET	8.8.8.8	192.168.2.3	0xbc4	No error (0)	lh3.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)
Jan 27, 2022 23:05:34.931117058 CET	8.8.8.8	192.168.2.3	0xbc4	No error (0)	googlehosted.l.googleusercontent.com		142.250.185.65	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:34.932667971 CET	8.8.8.8	192.168.2.3	0x7b92	No error (0)	lh6.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)
Jan 27, 2022 23:05:34.932667971 CET	8.8.8.8	192.168.2.3	0x7b92	No error (0)	googlehosted.l.googleusercontent.com		142.250.185.65	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:36.909606934 CET	8.8.8.8	192.168.2.3	0xc5f8	No error (0)	www.google.com		142.250.186.164	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:37.164736986 CET	8.8.8.8	192.168.2.3	0x4ed1	No error (0)	protective-glistening-people.glitch.me		52.44.125.193	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:37.164736986 CET	8.8.8.8	192.168.2.3	0x4ed1	No error (0)	protective-glistening-people.glitch.me		3.234.98.145	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:37.164736986 CET	8.8.8.8	192.168.2.3	0x4ed1	No error (0)	protective-glistening-people.glitch.me		3.90.93.100	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:37.164736986 CET	8.8.8.8	192.168.2.3	0x4ed1	No error (0)	protective-glistening-people.glitch.me		18.209.2.231	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:37.164736986 CET	8.8.8.8	192.168.2.3	0x4ed1	No error (0)	protective-glistening-people.glitch.me		3.86.152.72	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:37.164736986 CET	8.8.8.8	192.168.2.3	0x4ed1	No error (0)	protective-glistening-people.glitch.me		52.71.118.120	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:37.164736986 CET	8.8.8.8	192.168.2.3	0x4ed1	No error (0)	protective-glistening-people.glitch.me		52.73.90.113	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:37.164736986 CET	8.8.8.8	192.168.2.3	0x4ed1	No error (0)	protective-glistening-people.glitch.me		34.203.4.215	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:37.839534998 CET	8.8.8.8	192.168.2.3	0xf9a8	No error (0)	cdn.glitch.com		52.84.174.66	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:37.839534998 CET	8.8.8.8	192.168.2.3	0xf9a8	No error (0)	cdn.glitch.com		52.84.174.28	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:37.839534998 CET	8.8.8.8	192.168.2.3	0xf9a8	No error (0)	cdn.glitch.com		52.84.174.73	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:37.839534998 CET	8.8.8.8	192.168.2.3	0xf9a8	No error (0)	cdn.glitch.com		52.84.174.112	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:37.841566086 CET	8.8.8.8	192.168.2.3	0xf65	No error (0)	cloud.webtype.com		188.114.96.7	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:37.841566086 CET	8.8.8.8	192.168.2.3	0xf65	No error (0)	cloud.webtype.com		188.114.97.7	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:37.966960907 CET	8.8.8.8	192.168.2.3	0xcf88	No error (0)	cloud.typenetwork.com	cs549.wac.deltacdn.net		CNAME (Canonical name)	IN (0x0001)
Jan 27, 2022 23:05:37.966960907 CET	8.8.8.8	192.168.2.3	0xcf88	No error (0)	cs549.wac.deltacdn.net		192.229.233.123	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:38.012650013 CET	8.8.8.8	192.168.2.3	0x1778	No error (0)	cdn.glitch.me		52.84.174.111	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:38.012650013 CET	8.8.8.8	192.168.2.3	0x1778	No error (0)	cdn.glitch.me		52.84.174.114	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:38.012650013 CET	8.8.8.8	192.168.2.3	0x1778	No error (0)	cdn.glitch.me		52.84.174.3	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:38.012650013 CET	8.8.8.8	192.168.2.3	0x1778	No error (0)	cdn.glitch.me		52.84.174.108	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:39.065207005 CET	8.8.8.8	192.168.2.3	0x132f	No error (0)	policies.google.com		172.217.16.142	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:39.231813908 CET	8.8.8.8	192.168.2.3	0x6a4d	No error (0)	cdn.glitch.com		52.84.174.112	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:39.231813908 CET	8.8.8.8	192.168.2.3	0x6a4d	No error (0)	cdn.glitch.com		52.84.174.66	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:39.231813908 CET	8.8.8.8	192.168.2.3	0x6a4d	No error (0)	cdn.glitch.com		52.84.174.28	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:39.231813908 CET	8.8.8.8	192.168.2.3	0x6a4d	No error (0)	cdn.glitch.com		52.84.174.73	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:39.408440113 CET	8.8.8.8	192.168.2.3	0xa367	No error (0)	cdn.glitch.me		52.84.174.108	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:39.408440113 CET	8.8.8.8	192.168.2.3	0xa367	No error (0)	cdn.glitch.me		52.84.174.111	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:39.408440113 CET	8.8.8.8	192.168.2.3	0xa367	No error (0)	cdn.glitch.me		52.84.174.114	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:39.408440113 CET	8.8.8.8	192.168.2.3	0xa367	No error (0)	cdn.glitch.me		52.84.174.3	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:39.446827888 CET	8.8.8.8	192.168.2.3	0x1b59	No error (0)	www.youtube-nocookie.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)
Jan 27, 2022 23:05:39.446827888 CET	8.8.8.8	192.168.2.3	0x1b59	No error (0)	youtube-ui.l.google.com		142.250.185.78	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:39.446827888 CET	8.8.8.8	192.168.2.3	0x1b59	No error (0)	youtube-ui.l.google.com		142.250.185.110	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:39.446827888 CET	8.8.8.8	192.168.2.3	0x1b59	No error (0)	youtube-ui.l.google.com		142.250.185.142	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:39.446827888 CET	8.8.8.8	192.168.2.3	0x1b59	No error (0)	youtube-ui.l.google.com		142.250.185.174	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:39.446827888 CET	8.8.8.8	192.168.2.3	0x1b59	No error (0)	youtube-ui.l.google.com		142.250.185.206	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:39.446827888 CET	8.8.8.8	192.168.2.3	0x1b59	No error (0)	youtube-ui.l.google.com		142.250.185.238	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:39.446827888 CET	8.8.8.8	192.168.2.3	0x1b59	No error (0)	youtube-ui.l.google.com		142.250.184.238	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:39.446827888 CET	8.8.8.8	192.168.2.3	0x1b59	No error (0)	youtube-ui.l.google.com		142.250.181.238	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:39.446827888 CET	8.8.8.8	192.168.2.3	0x1b59	No error (0)	youtube-ui.l.google.com		172.217.16.142	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:39.446827888 CET	8.8.8.8	192.168.2.3	0x1b59	No error (0)	youtube-ui.l.google.com		216.58.212.174	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:39.446827888 CET	8.8.8.8	192.168.2.3	0x1b59	No error (0)	youtube-ui.l.google.com		142.250.74.206	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:39.446827888 CET	8.8.8.8	192.168.2.3	0x1b59	No error (0)	youtube-ui.l.google.com		142.250.186.46	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:39.446827888 CET	8.8.8.8	192.168.2.3	0x1b59	No error (0)	youtube-ui.l.google.com		142.250.186.78	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:39.446827888 CET	8.8.8.8	192.168.2.3	0x1b59	No error (0)	youtube-ui.l.google.com		142.250.186.110	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:39.446827888 CET	8.8.8.8	192.168.2.3	0x1b59	No error (0)	youtube-ui.l.google.com		142.250.186.142	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:39.446827888 CET	8.8.8.8	192.168.2.3	0x1b59	No error (0)	youtube-ui.l.google.com		142.250.186.174	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:41.712445021 CET	8.8.8.8	192.168.2.3	0xb32a	No error (0)	yt3.ggpht.com	photos-ugc.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)
Jan 27, 2022 23:05:41.712445021 CET	8.8.8.8	192.168.2.3	0xb32a	No error (0)	photos-ugc.l.googleusercontent.com		142.250.185.225	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:41.796716928 CET	8.8.8.8	192.168.2.3	0xa35d	No error (0)	i.ytimg.com		142.250.186.182	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:41.796716928 CET	8.8.8.8	192.168.2.3	0xa35d	No error (0)	i.ytimg.com		172.217.18.118	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:41.796716928 CET	8.8.8.8	192.168.2.3	0xa35d	No error (0)	i.ytimg.com		142.250.184.214	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:41.796716928 CET	8.8.8.8	192.168.2.3	0xa35d	No error (0)	i.ytimg.com		172.217.23.118	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:41.796716928 CET	8.8.8.8	192.168.2.3	0xa35d	No error (0)	i.ytimg.com		216.58.212.150	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:41.796716928 CET	8.8.8.8	192.168.2.3	0xa35d	No error (0)	i.ytimg.com		142.250.185.86	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:41.796716928 CET	8.8.8.8	192.168.2.3	0xa35d	No error (0)	i.ytimg.com		142.250.185.118	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:41.796716928 CET	8.8.8.8	192.168.2.3	0xa35d	No error (0)	i.ytimg.com		142.250.185.150	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:41.796716928 CET	8.8.8.8	192.168.2.3	0xa35d	No error (0)	i.ytimg.com		142.250.185.182	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:41.796716928 CET	8.8.8.8	192.168.2.3	0xa35d	No error (0)	i.ytimg.com		142.250.185.214	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:41.796716928 CET	8.8.8.8	192.168.2.3	0xa35d	No error (0)	i.ytimg.com		142.250.185.246	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:41.796716928 CET	8.8.8.8	192.168.2.3	0xa35d	No error (0)	i.ytimg.com		142.250.184.246	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:41.796716928 CET	8.8.8.8	192.168.2.3	0xa35d	No error (0)	i.ytimg.com		142.250.181.246	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:41.796716928 CET	8.8.8.8	192.168.2.3	0xa35d	No error (0)	i.ytimg.com		172.217.16.150	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:41.796716928 CET	8.8.8.8	192.168.2.3	0xa35d	No error (0)	i.ytimg.com		216.58.212.182	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:41.796716928 CET	8.8.8.8	192.168.2.3	0xa35d	No error (0)	i.ytimg.com		142.250.74.214	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:41.882484913 CET	8.8.8.8	192.168.2.3	0x4fad	No error (0)	www-google-analytics.l.google.com		142.250.185.174	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:42.228471041 CET	8.8.8.8	192.168.2.3	0xe90d	No error (0)	stats.g.doubleclick.net	stats.l.doubleclick.net		CNAME (Canonical name)	IN (0x0001)
Jan 27, 2022 23:05:42.228471041 CET	8.8.8.8	192.168.2.3	0xe90d	No error (0)	stats.l.doubleclick.net		74.125.140.156	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:42.228471041 CET	8.8.8.8	192.168.2.3	0xe90d	No error (0)	stats.l.doubleclick.net		74.125.140.154	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:42.228471041 CET	8.8.8.8	192.168.2.3	0xe90d	No error (0)	stats.l.doubleclick.net		74.125.140.157	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:42.228471041 CET	8.8.8.8	192.168.2.3	0xe90d	No error (0)	stats.l.doubleclick.net		74.125.140.155	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:42.290287971 CET	8.8.8.8	192.168.2.3	0x49fb	No error (0)	play.google.com		142.250.186.78	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:43.226022005 CET	8.8.8.8	192.168.2.3	0xc41c	No error (0)	i.ytimg.com		142.250.186.182	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:43.226022005 CET	8.8.8.8	192.168.2.3	0xc41c	No error (0)	i.ytimg.com		172.217.18.118	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:43.226022005 CET	8.8.8.8	192.168.2.3	0xc41c	No error (0)	i.ytimg.com		142.250.184.214	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:43.226022005 CET	8.8.8.8	192.168.2.3	0xc41c	No error (0)	i.ytimg.com		172.217.23.118	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:43.226022005 CET	8.8.8.8	192.168.2.3	0xc41c	No error (0)	i.ytimg.com		216.58.212.150	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:43.226022005 CET	8.8.8.8	192.168.2.3	0xc41c	No error (0)	i.ytimg.com		142.250.185.86	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:43.226022005 CET	8.8.8.8	192.168.2.3	0xc41c	No error (0)	i.ytimg.com		142.250.185.118	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:43.226022005 CET	8.8.8.8	192.168.2.3	0xc41c	No error (0)	i.ytimg.com		142.250.185.150	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:43.226022005 CET	8.8.8.8	192.168.2.3	0xc41c	No error (0)	i.ytimg.com		142.250.185.182	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:43.226022005 CET	8.8.8.8	192.168.2.3	0xc41c	No error (0)	i.ytimg.com		142.250.185.214	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:43.226022005 CET	8.8.8.8	192.168.2.3	0xc41c	No error (0)	i.ytimg.com		142.250.185.246	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:43.226022005 CET	8.8.8.8	192.168.2.3	0xc41c	No error (0)	i.ytimg.com		142.250.184.246	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:43.226022005 CET	8.8.8.8	192.168.2.3	0xc41c	No error (0)	i.ytimg.com		142.250.181.246	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:43.226022005 CET	8.8.8.8	192.168.2.3	0xc41c	No error (0)	i.ytimg.com		172.217.16.150	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:43.226022005 CET	8.8.8.8	192.168.2.3	0xc41c	No error (0)	i.ytimg.com		216.58.212.182	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:43.226022005 CET	8.8.8.8	192.168.2.3	0xc41c	No error (0)	i.ytimg.com		142.250.74.214	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:43.228336096 CET	8.8.8.8	192.168.2.3	0xc9b0	No error (0)	yt3.ggpht.com	photos-ugc.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)
Jan 27, 2022 23:05:43.228336096 CET	8.8.8.8	192.168.2.3	0xc9b0	No error (0)	photos-ugc.l.googleusercontent.com		142.250.185.225	A (IP address)	IN (0x0001)
Jan 27, 2022 23:05:43.704056025 CET	8.8.8.8	192.168.2.3	0x47d6	No error (0)	www.google.com		142.250.186.164	A (IP address)	IN (0x0001)
Jan 27, 2022 23:06:20.285995960 CET	8.8.8.8	192.168.2.3	0x1aa1	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)
Jan 27, 2022 23:06:20.285995960 CET	8.8.8.8	192.168.2.3	0x1aa1	No error (0)	plus.l.google.com		142.250.186.110	A (IP address)	IN (0x0001)
Jan 27, 2022 23:06:20.297566891 CET	8.8.8.8	192.168.2.3	0x1a87	No error (0)	sites.google.com		142.250.74.206	A (IP address)	IN (0x0001)
Jan 27, 2022 23:06:20.320029974 CET	8.8.8.8	192.168.2.3	0x22e4	No error (0)	gstaticadssl.l.google.com		142.250.184.227	A (IP address)	IN (0x0001)
Jan 27, 2022 23:06:28.172182083 CET	8.8.8.8	192.168.2.3	0x3d19	No error (0)	google.com		142.250.185.206	A (IP address)	IN (0x0001)
Jan 27, 2022 23:06:29.251025915 CET	8.8.8.8	192.168.2.3	0x6b8e	No error (0)	adservice.google.com		142.250.184.226	A (IP address)	IN (0x0001)

Timestamp	kBytes transferred	Direction	Data
2022-01-27 22:05:19 UTC	0	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfm X-Goog-Update-Updater: chromecrx-85.0.4183.121 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-01-27 22:05:19 UTC	1	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-P5KZC4NF9kBUYOZCC1PxIw' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 27 Jan 2022 22:05:19 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 5505 X-Daystart: 50719 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-01-27 22:05:19 UTC	2	IN	Data Raw: 35 31 65 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 35 35 30 35 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 35 30 37 31 39 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 51e<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="5505" elapsed_seconds="50719"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2022-01-27 22:05:19 UTC	3	IN	Data Raw: 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 2e 63 72 78 22 20 66 70 3d 22 31 2e 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 61 70 Data Ascii: mhkkegccagdldgiimedpiccmgmieda.crx" fp="1.81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app><ap
2022-01-27 22:05:19 UTC	4	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-01-27 22:05:22 UTC	1151	OUT	GET /Wd_wknVICrI7GuuM4qtcie9snyzQVNZlz5S7a_zFU3iPl0IhAU8q0AT1d42cO26VJH1v43FVWNqjcSg_jAE_lxo=w16383 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36 Host: lh5.googleusercontent.com
2022-01-27 22:05:22 UTC	1160	IN	HTTP/1.1 200 OK Access-Control-Expose-Headers: Content-Length Content-Disposition: inline;filename="Untitled.png" Vary: Origin Access-Control-Allow-Origin: * Timing-Allow-Origin: * X-Content-Type-Options: nosniff Server: fife Content-Length: 2338 X-XSS-Protection: 0 Date: Thu, 27 Jan 2022 22:05:20 GMT Expires: Fri, 28 Jan 2022 22:05:20 GMT Cache-Control: public, max-age=86400, no-transform ETag: "v1" Content-Type: image/png Age: 2 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2022-01-27 22:05:22 UTC	1161	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 c0 00 00 00 c0 08 04 00 00 00 f8 d5 a4 8c 00 00 00 02 73 42 49 54 08 08 55 ec 46 04 00 00 08 db 49 44 41 54 78 9c ed 9d 6b 70 5d 55 15 c7 7f 49 93 02 0d 34 ad 7d a4 a4 92 34 69 53 6a 12 3b ad 69 9b 32 d3 66 e8 8b 82 20 a3 60 ed 38 54 11 11 66 a0 32 7e 41 a7 0c 8c 02 23 3a e3 63 d0 11 d4 0e 8c 28 e3 88 43 14 44 0b 23 96 d2 29 55 8a 82 95 5a 0a 15 8a 94 96 47 91 b6 b4 f6 11 9a 34 39 7e 48 52 13 ee eb e4 9e b5 f7 da f7 66 fd f6 97 3c ee 5d 6b af ff 3a 77 ef 7d f7 d9 7b 1f 30 0c c3 30 0c c3 30 0c c3 30 0c c3 30 0c c3 30 0c c3 30 0c c3 30 0c c3 30 0c c3 30 0c c3 30 0c c3 30 0c a3 d0 29 d1 ae 40 c1 50 c5 0c aa 99 c4 68 4a 28 a7 86 c9 94 52 c7 44 ce 48 66 b6 4c a6 76 45 47 09 93 99 46 03 b5 8c 67 3c 55 34 Data Ascii: PNGIHDRsBITUFIDATxkp]UI4}4iSj;i2f `8Tf2~A#:c(CD#)UZG49~HRf<]k:w}{000000000000)@PhJ(RDHfLvEGFg<U4
2022-01-27 22:05:22 UTC	1162	IN	Data Raw: d8 54 54 f2 c3 2b 32 66 7c 74 c2 25 ac e5 1a 0f 7e fc 22 32 06 f2 91 80 12 7e ce e7 9d 7b f1 8f 50 17 ec be 09 5a 5b 94 f2 c3 4e 19 33 ae 13 70 5b 11 36 3e bd bc a4 5d 81 38 5c ad 3e 54 74 57 24 d6 56 e3 76 18 7a 29 0f 7b ff a2 e7 8b 63 9c 29 63 c8 9d 40 0b 68 2f 5a f9 e1 9f 52 86 5c 49 34 8e df 31 d2 91 ed 10 d8 21 65 c8 4d 02 4a 68 67 9c 13 cb a1 f0 a2 94 21 37 09 58 c3 22 27 76 c3 41 6c 0c e4 a2 13 9e cb 33 45 dc fa f7 52 c3 5e 19 43 f2 09 38 8d 97 a9 11 b7 1a 16 87 e4 76 df c8 5f a9 b7 14 bd fc f0 bc 9c 29 e9 04 9c c3 57 85 2d 86 88 d8 20 54 3e 01 6b 03 5a bd ef 8e 60 13 70 09 17 89 da 0b 15 91 05 29 bd c8 76 c2 db 69 16 b5 17 26 5d 54 d0 25 65 4c f2 13 b0 7c 58 c8 0f 3b e4 e4 97 4d c0 d7 04 6d 25 61 2f db 9d da 17 6c 80 24 13 d0 cc 62 31 5b f9 73 8c Data Ascii: TT+2f\|t%~"2~{PZ[N3p[6>]8\>TtW$Vvz){c)c@h/ZR\I41!eMJhg!7X"'vAl3ER^C8v_)W- T>kZ`p)vi&]T%eL\|X;Mm%a/l$b1[s
2022-01-27 22:05:22 UTC	1163	IN	Data Raw: 17 e0 e6 c3 ca 53 b3 fa 5d 31 ce 59 bb 50 55 fe e3 c5 79 ea f5 8d 7d e1 fd 22 c6 6b 53 7b 0d 9f 25 c8 93 10 25 b8 8b 88 78 3b cc df 52 94 ff 2b ce 75 50 a3 84 47 62 6d ef 99 a3 28 ff b7 9d ab a0 ca 48 66 c4 78 d5 d0 ee 28 4b 96 02 bb f3 eb 0a f7 27 9e a7 2f b7 6a 07 1e 06 65 2a ab 40 d3 1d 86 30 4c 69 53 90 ff 28 97 6a 87 dd 8b fb 67 ca e7 e6 7c ef 1e 5f 63 b9 d0 de b6 a2 c0 77 0f f0 58 c8 fb de fd 53 ea 75 1b 6a c7 a0 b3 47 0d a0 d9 a3 fc cf 7b 38 62 70 88 e8 1f c5 eb eb 2c ce 2e ee 60 0e bb 3c 79 8b 8d 7e 27 ec 27 01 1b b8 96 7f 7b f1 54 70 3c e7 bc e1 79 ad 10 b6 9a ea f1 7b a7 e2 6f e3 4a 95 43 5e 0b 8a 46 ee 71 f0 5d b8 9b 75 2c d3 0e ad 70 98 c8 6a d6 8b ad 8b db c9 9a 42 b9 c1 ee f7 e1 23 b9 18 cd 27 59 44 1b f5 79 be ff 08 7f 61 13 4f f2 37 d1 5a Data Ascii: S]1YPUy}"kS{%%x;R+uPGbm(Hfx(K'/je*@0LiS(jg\|_cwXSujG{8bp,.`<y~''{Tp<y{oJC^Fq]u,pjB#'YDyaO7Z

Timestamp	kBytes transferred	Direction	Data
2022-01-27 22:05:30 UTC	2124	OUT	GET /Wd_wknVICrI7GuuM4qtcie9snyzQVNZlz5S7a_zFU3iPl0IhAU8q0AT1d42cO26VJH1v43FVWNqjcSg_jAE_lxo=w16383 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36 Host: lh5.googleusercontent.com If-None-Match: "v1"
2022-01-27 22:05:30 UTC	2124	IN	HTTP/1.1 304 Not Modified Date: Thu, 27 Jan 2022 22:05:20 GMT Expires: Fri, 28 Jan 2022 22:05:20 GMT ETag: "v1" Cache-Control: public, max-age=86400, no-transform Vary: origin Age: 10 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close

Timestamp	kBytes transferred	Direction	Data
2022-01-27 22:05:34 UTC	2302	OUT	GET /NvVfoDKaFqFbEYmY_0YGEeQhwCvwBGhLxbrHdo0C20j3iuFyJmoRIOu-aLlkWDAW8peDka8D6p5vDV7Kvu8jYnw=w16383 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36 Host: lh6.googleusercontent.com
2022-01-27 22:05:35 UTC	2322	IN	HTTP/1.1 200 OK Access-Control-Expose-Headers: Content-Length Content-Disposition: inline;filename="Untitled.png" Vary: Origin Access-Control-Allow-Origin: * Timing-Allow-Origin: * X-Content-Type-Options: nosniff Server: fife Content-Length: 2338 X-XSS-Protection: 0 Date: Thu, 27 Jan 2022 22:05:33 GMT Expires: Fri, 28 Jan 2022 22:05:33 GMT Cache-Control: public, max-age=86400, no-transform ETag: "v1" Content-Type: image/png Age: 2 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2022-01-27 22:05:35 UTC	2322	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 c0 00 00 00 c0 08 04 00 00 00 f8 d5 a4 8c 00 00 00 02 73 42 49 54 08 08 55 ec 46 04 00 00 08 db 49 44 41 54 78 9c ed 9d 6b 70 5d 55 15 c7 7f 49 93 02 0d 34 ad 7d a4 a4 92 34 69 53 6a 12 3b ad 69 9b 32 d3 66 e8 8b 82 20 a3 60 ed 38 54 11 11 66 a0 32 7e 41 a7 0c 8c 02 23 3a e3 63 d0 11 d4 0e 8c 28 e3 88 43 14 44 0b 23 96 d2 29 55 8a 82 95 5a 0a 15 8a 94 96 47 91 b6 b4 f6 11 9a 34 39 7e 48 52 13 ee eb e4 9e b5 f7 da f7 66 fd f6 97 3c ee 5d 6b af ff 3a 77 ef 7d f7 d9 7b 1f 30 0c c3 30 0c c3 30 0c c3 30 0c c3 30 0c c3 30 0c c3 30 0c c3 30 0c c3 30 0c c3 30 0c c3 30 0c c3 30 0c a3 d0 29 d1 ae 40 c1 50 c5 0c aa 99 c4 68 4a 28 a7 86 c9 94 52 c7 44 ce 48 66 b6 4c a6 76 45 47 09 93 99 46 03 b5 8c 67 3c 55 34 Data Ascii: PNGIHDRsBITUFIDATxkp]UI4}4iSj;i2f `8Tf2~A#:c(CD#)UZG49~HRf<]k:w}{000000000000)@PhJ(RDHfLvEGFg<U4
2022-01-27 22:05:35 UTC	2323	IN	Data Raw: d8 54 54 f2 c3 2b 32 66 7c 74 c2 25 ac e5 1a 0f 7e fc 22 32 06 f2 91 80 12 7e ce e7 9d 7b f1 8f 50 17 ec be 09 5a 5b 94 f2 c3 4e 19 33 ae 13 70 5b 11 36 3e bd bc a4 5d 81 38 5c ad 3e 54 74 57 24 d6 56 e3 76 18 7a 29 0f 7b ff a2 e7 8b 63 9c 29 63 c8 9d 40 0b 68 2f 5a f9 e1 9f 52 86 5c 49 34 8e df 31 d2 91 ed 10 d8 21 65 c8 4d 02 4a 68 67 9c 13 cb a1 f0 a2 94 21 37 09 58 c3 22 27 76 c3 41 6c 0c e4 a2 13 9e cb 33 45 dc fa f7 52 c3 5e 19 43 f2 09 38 8d 97 a9 11 b7 1a 16 87 e4 76 df c8 5f a9 b7 14 bd fc f0 bc 9c 29 e9 04 9c c3 57 85 2d 86 88 d8 20 54 3e 01 6b 03 5a bd ef 8e 60 13 70 09 17 89 da 0b 15 91 05 29 bd c8 76 c2 db 69 16 b5 17 26 5d 54 d0 25 65 4c f2 13 b0 7c 58 c8 0f 3b e4 e4 97 4d c0 d7 04 6d 25 61 2f db 9d da 17 6c 80 24 13 d0 cc 62 31 5b f9 73 8c Data Ascii: TT+2f\|t%~"2~{PZ[N3p[6>]8\>TtW$Vvz){c)c@h/ZR\I41!eMJhg!7X"'vAl3ER^C8v_)W- T>kZ`p)vi&]T%eL\|X;Mm%a/l$b1[s
2022-01-27 22:05:35 UTC	2327	IN	Data Raw: 17 e0 e6 c3 ca 53 b3 fa 5d 31 ce 59 bb 50 55 fe e3 c5 79 ea f5 8d 7d e1 fd 22 c6 6b 53 7b 0d 9f 25 c8 93 10 25 b8 8b 88 78 3b cc df 52 94 ff 2b ce 75 50 a3 84 47 62 6d ef 99 a3 28 ff b7 9d ab a0 ca 48 66 c4 78 d5 d0 ee 28 4b 96 02 bb f3 eb 0a f7 27 9e a7 2f b7 6a 07 1e 06 65 2a ab 40 d3 1d 86 30 4c 69 53 90 ff 28 97 6a 87 dd 8b fb 67 ca e7 e6 7c ef 1e 5f 63 b9 d0 de b6 a2 c0 77 0f f0 58 c8 fb de fd 53 ea 75 1b 6a c7 a0 b3 47 0d a0 d9 a3 fc cf 7b 38 62 70 88 e8 1f c5 eb eb 2c ce 2e ee 60 0e bb 3c 79 8b 8d 7e 27 ec 27 01 1b b8 96 7f 7b f1 54 70 3c e7 bc e1 79 ad 10 b6 9a ea f1 7b a7 e2 6f e3 4a 95 43 5e 0b 8a 46 ee 71 f0 5d b8 9b 75 2c d3 0e ad 70 98 c8 6a d6 8b ad 8b db c9 9a 42 b9 c1 ee f7 e1 23 b9 18 cd 27 59 44 1b f5 79 be ff 08 7f 61 13 4f f2 37 d1 5a Data Ascii: S]1YPUy}"kS{%%x;R+uPGbm(Hfx(K'/je*@0LiS(jg\|_cwXSujG{8bp,.`<y~''{Tp<y{oJC^Fq]u,pjB#'YDyaO7Z

Timestamp	kBytes transferred	Direction	Data
2022-01-27 22:05:36 UTC	2583	OUT	GET /url?q=https%3A%2F%2Fprotective-glistening-people.glitch.me%2Fa.html&sa=D&sntz=1&usg=AFQjCNE3AXCYZpM83juSb429VtosyK-bUg HTTP/1.1 Host: www.google.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=L8fFvzSSImKqJLxWn4iQ8XuB6uQhK5D_HxcrcstFO4E-7pNxgn8NRrbCRYUzVUos9R-FYZTpziGEhy_9AtCATfeKAS1_stcIQpnPwTObrX2O8y_H4mhgeBPICYSX_YxvQVGRwnNcLo1LBoHZARIib_gs620avl2obbhSV91NSGg
2022-01-27 22:05:37 UTC	2584	IN	HTTP/1.1 200 OK Location: https://protective-glistening-people.glitch.me/a.html Cache-Control: private Content-Type: text/html; charset=UTF-8 Strict-Transport-Security: max-age=31536000 BFCache-Opt-In: unload Date: Thu, 27 Jan 2022 22:05:37 GMT Server: gws Content-Length: 415 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2022-01-27 22:05:37 UTC	2584	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 52 65 64 69 72 65 63 74 69 6e 67 3c 2f 54 49 54 4c 45 3e 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 31 3b 20 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 70 72 6f 74 65 63 74 69 76 65 2d 67 6c 69 73 74 65 6e 69 6e 67 2d 70 65 6f 70 6c 65 2e 67 6c 69 74 63 68 2e 6d 65 2f 61 2e 68 74 6d 6c 22 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 6f 6e 4c 6f 61 64 3d 22 6c 6f 63 61 74 69 6f 6e 2e 72 65 70 6c 61 63 65 28 27 68 74 74 70 73 3a 2f 2f 70 Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>Redirecting</TITLE><META HTTP-EQUIV="refresh" content="1; url=https://protective-glistening-people.glitch.me/a.html"></HEAD><BODY onLoad="location.replace('https://p

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://sites.google.com/view/familyfocusfederalcreditunion/home

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Sigma Overview

Jbx Signature Overview

AV Detection

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic

C:\Users\user\AppData\Local\Google\Chrome\User Data\05be726d-6a47-42e2-8224-4bfe1c4f2f76.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\1bd3dabd-6b1b-4a4b-8ef2-ddbd1575ffc7.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\3f346c48-f02a-49ab-9c22-2b0acd9681b0.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\551bd7ed-5630-4483-b6f5-4b9a7c49e379.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\625907d6-264a-4a8d-82cd-ae323da1e420.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\71b052e8-b7a1-445a-bcdc-d8eebadd6a94.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\02000c01-74dd-47b8-a7fd-9cf7074d0dd8.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\08291b87-dab7-4043-89f1-9d798e562227.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\44cfde47-23ff-49fe-aa35-19697b9947b0.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\55acccee-6ac4-460f-ae01-7830845dae7b.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\59b555c0-aade-4b26-8162-425eb6c4555f.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\6317b9af-e6a7-45b4-a105-2410f218ef3e.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\652436cf-ce44-4340-b1bd-8c5cfdbd3d53.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\7d1fc313-6fde-4914-b0ca-7c4935bcfa1e.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\883c0718-fe86-43f2-9dcc-9ae4fd999744.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\90959df8-82ae-45e7-8e3b-35dc247353ab.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase\LOG

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase\LOG.old (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG.old (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache\data_0

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache\data_1

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache\data_2

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache\data_3

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Current Session

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Current Tabs

Windows Analysis Report
https://sites.google.com/view/familyfocusfederalcreditunion/home

Timestamp	kBytes transferred	Direction	Data
2022-01-27 22:05:37 UTC	2585	OUT	GET /NvVfoDKaFqFbEYmY_0YGEeQhwCvwBGhLxbrHdo0C20j3iuFyJmoRIOu-aLlkWDAW8peDka8D6p5vDV7Kvu8jYnw=w16383 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36 Host: lh6.googleusercontent.com If-None-Match: "v1"
2022-01-27 22:05:37 UTC	2585	IN	HTTP/1.1 304 Not Modified Date: Thu, 27 Jan 2022 22:05:33 GMT Expires: Fri, 28 Jan 2022 22:05:33 GMT ETag: "v1" Cache-Control: public, max-age=86400, no-transform Vary: origin Age: 4 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close

Timestamp	kBytes transferred	Direction	Data
2022-01-27 22:05:37 UTC	2585	OUT	GET /a.html HTTP/1.1 Host: protective-glistening-people.glitch.me Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://www.google.com/url?q=https%3A%2F%2Fprotective-glistening-people.glitch.me%2Fa.html&sa=D&sntz=1&usg=AFQjCNE3AXCYZpM83juSb429VtosyK-bUg Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-01-27 22:05:37 UTC	2586	IN	HTTP/1.1 403 Forbidden Date: Thu, 27 Jan 2022 22:05:37 GMT Content-Type: text/html; charset=utf-8 Content-Length: 1930 Connection: close Cache-Control: max-age=0 ETag: W/"78a-v/0NQwFUHD+MwdUDXLgAso0Y8f8"
2022-01-27 22:05:37 UTC	2586	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4f 6f 70 73 21 20 54 68 69 73 20 70 72 6f 6a 65 63 74 20 69 73 6e 27 74 20 72 75 6e 6e 69 6e 67 2e 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 6c 6f Data Ascii: <!DOCTYPE html><html lang="en"> <head> <meta charset="utf-8"> <title>Oops! This project isn't running.</title> <meta name="viewport" content="initial-scale=1, width=device-width"> <link rel="stylesheet" type="text/css" href="https://clo

Timestamp	kBytes transferred	Direction	Data
2022-01-27 22:05:37 UTC	2588	OUT	GET /d7f4f279-e13b-4330-8422-00b2d9211424%2FGlitch-Error-Rainbow-Mug-hires.png?v=1595481653593 HTTP/1.1 Host: cdn.glitch.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://protective-glistening-people.glitch.me/a.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-01-27 22:05:37 UTC	2590	IN	HTTP/1.1 301 Moved Permanently Content-Length: 0 Connection: close Date: Thu, 27 Jan 2022 12:22:22 GMT Location: https://cdn.glitch.me/d7f4f279-e13b-4330-8422-00b2d9211424%2FGlitch-Error-Rainbow-Mug-hires.png Server: AmazonS3 Vary: Origin X-Cache: Hit from cloudfront Via: 1.1 98856bd09231d01c667222ebf203b580.cloudfront.net (CloudFront) X-Amz-Cf-Pop: CDG50-P1 X-Amz-Cf-Id: WBcxQisBUftqyemQQqyKMSO_Wm2FOuhCqR3TX4lyqh7bsnzX0ht4VQ== Age: 34996

Timestamp	kBytes transferred	Direction	Data
2022-01-27 22:05:19 UTC	1	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-01-27 22:05:19 UTC	1	OUT	Data Raw: 20 Data Ascii:
2022-01-27 22:05:19 UTC	4	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 27 Jan 2022 22:05:19 GMT Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-iZEnhmAaLRfNnM/XTHSLYQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'nonce-iZEnhmAaLRfNnM/XTHSLYQ' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site,Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-01-27 22:05:19 UTC	5	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2022-01-27 22:05:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-01-27 22:05:37 UTC	2589	OUT	GET /css/3a8e55c6-b1f3-4659-99eb-125ae72bd084.css HTTP/1.1 Host: cloud.webtype.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://protective-glistening-people.glitch.me/a.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-01-27 22:05:37 UTC	2589	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 27 Jan 2022 22:05:37 GMT Transfer-Encoding: chunked Connection: close Cache-Control: max-age=3600 Expires: Thu, 27 Jan 2022 23:05:37 GMT Location: https://cloud.typenetwork.com/css/3a8e55c6-b1f3-4659-99eb-125ae72bd084.css Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=evTxnEDZnJh50rwXPIimXn0J4nPbMQ%2BaGVv9%2BkwEF56unvw0%2FXohdWNCDoWKdzK4va3Gfiy5hz920BMyIAIpq%2FHYshAbm1TJLD7OXd4mAq%2BzyTznhrXyrfEAVZHq0ypV4X1Itw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6d454897ff866963-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2022-01-27 22:05:37 UTC	2590	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-01-27 22:05:38 UTC	2590	OUT	GET /css/3a8e55c6-b1f3-4659-99eb-125ae72bd084.css HTTP/1.1 Host: cloud.typenetwork.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://protective-glistening-people.glitch.me/a.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-01-27 22:05:38 UTC	2591	IN	HTTP/1.1 301 Moved Permanently Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 16377 Cache-Control: max-age=220752000 CF-Cache-Status: HIT CF-RAY: 6d454007ea3a90f2-FRA Content-Type: text/html; charset=utf-8 Date: Thu, 27 Jan 2022 22:05:38 GMT Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Expires: Thu, 25 Jan 2029 22:05:38 GMT Last-Modified: Thu, 27 Jan 2022 21:59:47 GMT Location: ../projects/5027/fontface.css/ NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Referrer-Policy: same-origin Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OwEqEBAZpW9L%2BDJcKo77PHdfQBfVkN5TBAb8YNY4roKhRaW1pWbfT5S%2FhTwNPc%2BdSo0vFbugLjsTjK%2B0GySUtqeuZLK%2B5599vlBy%2BhcEQX1Udu4GhacGBXcDT6vJDXDIngMaE7k%3D"}],"group":"cf-nel","max_age":604800} Server: ECS (frb/6731) X-Cache: 301-HIT X-Content-Type-Options: nosniff X-Frame-Options: DENY Content-Length: 0 Connection: close

Timestamp	kBytes transferred	Direction	Data
2022-01-27 22:05:38 UTC	2592	OUT	GET /d7f4f279-e13b-4330-8422-00b2d9211424%2FGlitch-Error-Rainbow-Mug-hires.png HTTP/1.1 Host: cdn.glitch.me Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://protective-glistening-people.glitch.me/a.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-01-27 22:05:38 UTC	2593	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 170377 Connection: close Date: Mon, 24 Jan 2022 13:29:06 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, HEAD, POST Access-Control-Max-Age: 86400 Cache-Control: max-age=31536000 Last-Modified: Thu, 23 Jul 2020 05:20:52 GMT ETag: "a002b1fa4cf220520bebb230b1b68a80" Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 3ef764497246fd6dbe77cf02e99dc95e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: CDG50-P1 X-Amz-Cf-Id: Oj4nbZ6hc2WwbqfjxFJf_7GYuQnfpcq9n8H64rfDz0HromBBNPHctg== Age: 290193
2022-01-27 22:05:38 UTC	2593	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 08 10 00 00 04 df 08 02 00 00 00 3e a3 01 01 00 00 00 09 70 48 59 73 00 00 2c 4a 00 00 2c 4a 01 77 7a 74 4d 00 00 20 00 49 44 41 54 78 9c ec dd 0f 70 9c f5 99 27 f8 9f c1 36 b2 64 c7 92 91 64 24 3c 12 96 27 31 12 63 c2 58 de 99 10 b0 61 0f 3c 03 53 70 31 10 cf 6c dd c6 84 bd 2b fe ec ee 15 f1 52 35 9b cd 2c b9 73 2a 6c 52 bb 55 93 81 dc d6 16 90 ab db 04 67 f7 f6 86 3f 49 0e 76 f0 0c e6 36 08 3c 61 76 24 86 e0 b1 84 c3 b8 4d 2b 46 8a 25 c7 2d c7 b6 a4 c8 76 7c f5 ba 35 52 77 ab 25 cb b6 ba d5 7f 3e 9f 52 b9 a4 56 5b 7a fb f7 36 a6 fb fd fe 9e e7 59 70 f6 ec d9 00 00 00 00 00 00 94 b7 cb ca 7d 01 00 00 00 00 00 00 81 01 00 00 00 00 00 94 bd 20 30 00 00 00 00 00 00 82 c0 00 00 00 00 00 00 08 02 03 00 00 Data Ascii: PNGIHDR>pHYs,J,JwztM IDATxp'6dd$<'1cXa<Sp1l+R5,s*lRUg?Iv6<av$M+F%-v\|5Rw%>RV[z6Yp} 0
2022-01-27 22:05:38 UTC	2609	IN	Data Raw: 30 83 0c c9 d8 e0 db 7f d1 17 1f c8 f1 85 ed f9 d3 5c 5f b1 fd 9e e6 07 36 37 56 2f cd 53 df fc c1 44 f4 76 2b 0f c3 8d f7 f6 1f 78 7f b0 77 6a 0f a2 96 15 8d eb 57 ad cd f5 9c 80 19 a2 82 fa a5 35 d7 d6 37 e5 a1 b2 a1 94 f0 ab 7d 23 00 00 20 00 49 44 41 54 c8 09 00 66 e3 f1 bf fb ad 7f 7d e0 1f 84 10 7a 97 1c 5f bb e9 b9 59 fe 2d c9 01 17 a7 b6 3a 2a 35 b8 94 21 01 73 22 6f 6f 28 b2 8e 34 b8 f7 b6 a8 4d 13 00 02 03 00 e6 4c c6 86 a0 ca 8a f0 d4 17 0b ae 25 e8 b7 5f eb db b1 f3 40 09 c7 06 cb ab 16 6e bf a7 69 fb 96 e6 5c c7 06 2f ee 8e 0a c6 73 5d 58 70 f8 44 e2 ed f8 df 9e 1c cb fc 35 f5 4b 6b da 57 ad ad 59 92 db de cd 27 c7 46 7e 14 df 37 5d 54 90 9f 79 09 25 43 4e 00 70 41 fe f4 6f 7e ef ee 81 d5 c9 bf 71 d5 6d ff e7 b1 85 17 36 01 5e 72 c0 45 d8 b8 Data Ascii: 0\_67V/SDv+xwjW57}# IDATf}z_Y-:*5!s"oo(4ML%_@ni\/s]XpD5KkWY'F~7]Ty%CNpAo~qm6^rE
2022-01-27 22:05:38 UTC	2625	IN	Data Raw: 63 d9 8d d1 c7 d9 3c 15 7e 40 51 8a 73 eb 8b 73 eb ad 36 e5 db c7 be 72 ab 3e 45 e9 6d cb d3 db 96 5b d5 dd 9d f9 2d 18 6f c0 3d 1e c9 c8 89 9d ef 62 a4 41 24 d1 4d 7e 58 94 19 ec 79 fc a6 01 c8 ef 1c 27 b9 5a a2 d3 46 79 55 00 10 19 08 0c 00 00 62 85 cb 4d 5e de 1f d1 b4 e0 cb ca ab 5f 4a 9e d8 98 f6 cb 2e 5d ab 2b 31 a6 be d9 16 38 b4 c0 ef 59 63 c1 af 5a d6 85 6a 55 21 51 65 b1 6d 3b da c0 d0 f9 c6 84 f0 77 f4 0b 1e 0d 7d 3f 87 98 a5 32 66 e4 55 97 ce b2 09 51 2a 19 2e ca ad df 5e f1 5e 38 da 68 00 00 2c 90 cf fe 45 1f 90 21 25 ae e5 54 aa a4 be dd 3b 7e eb 72 4b 3f 3e 75 df 8d b6 48 c9 33 7c 8e 29 43 65 a2 fe 15 b8 54 56 83 d8 80 7b 2e 6c aa b6 a7 f6 61 a4 41 c4 bc 7e 90 ea f6 c3 96 01 c2 52 09 95 19 4c dd 6d f6 72 25 f9 d9 73 44 95 14 e5 85 01 40 04 Data Ascii: c<~@Qss6r>Em[-o=bA$M~Xy'ZFyUbM^_J.]+18YcZjU!Qem;w}?2fUQ*.^^8h,E!%T;~rK?>uH3\|)CeTV{.laA~RLmr%sD@
2022-01-27 22:05:38 UTC	2625	IN	Data Raw: 51 25 f5 5b 6d 2a c7 a0 7c fa e7 8a 46 c4 19 6d da ac 9a 35 82 71 81 3d b5 cf 2b 1c 8f e4 0a 21 ac e8 91 06 6a 7d 96 60 3c e6 4a 81 a3 e2 4c 03 29 c8 26 8a 04 76 ac 56 91 40 fd 57 a7 9f 78 e8 19 23 7a 03 b9 a7 80 88 b0 f7 18 80 eb f0 7f 39 00 40 4c 78 f1 0d 6a dc 56 c4 3c b5 e4 ca 3d f2 9b 5e 6c 58 dc dc 00 00 20 00 49 44 41 54 ee c6 4e 79 81 47 3c 7a 62 e7 3b 0b 1f 5a 20 1f 13 1f 38 ff 50 d9 40 7a 88 d6 15 02 8e d1 b1 6d 47 1b 98 3b df b8 64 50 f0 8c 05 6d 88 42 22 b3 51 97 57 5d 2a 75 dc f2 e5 ac 3a ad eb c1 b5 47 ca 8b 4e b1 eb bc 00 20 06 f9 ec cb e8 93 f6 59 67 6e d9 0f b4 f2 a2 53 e5 45 a7 9a 0d 39 1f 9f be af 4e ff 57 d3 af 8a 68 24 2e b7 ba 74 55 cd 9a f6 d2 0b 6d 25 0d 98 8a cc 19 f6 d4 be 0f 9f f9 c3 86 b7 b6 2a 7a 51 85 13 76 2e 37 b5 67 9f 45 Data Ascii: Q%[m\|Fm5q=+!j}`<JL)&vV@Wx#z9@LxjV<=^lX IDATNyG<zb;Z 8P@zmG;dPmB"QW]u:GN YgnSE9NWh$.tUm%*zQv.7gE
2022-01-27 22:05:38 UTC	2630	IN	Data Raw: c2 a5 b2 9a 21 b9 b3 e4 f0 c6 58 bf 10 e1 61 b2 90 97 f7 93 bd 4f b3 60 a9 9a 34 b2 6b 33 a9 3c 3c f1 b0 cf 4e f6 1f 22 bb 77 44 79 55 00 b0 10 08 0c 00 00 d8 aa aa 8e bc 73 3c 42 6b df 94 74 6d 6a 5a 30 ec 15 fc a6 3b 0b 69 41 30 de 6c da b8 d3 9c 13 81 05 cf ae 71 c0 f9 c4 49 7d 43 3f 43 7b 04 f3 37 38 04 df e8 25 32 26 0e 54 60 20 95 31 23 af ba f4 56 7b fa 74 cb 5b b7 57 bc a7 d3 b6 c4 f8 55 02 80 58 e3 eb 5c eb 6b df 34 e7 93 f6 c4 7b 3f fb 36 7f d3 3f e2 fb 25 32 a4 12 d7 f6 8a f7 ca 8b 4e bd 7d ec 2b d5 f5 6b 03 8e 29 1a 89 cb ad 2e cd 6c d4 5d 2a ab e9 cc 6f e6 ea 45 e0 12 fa 69 42 66 10 26 cd 1d d4 5d f8 5d 9b 59 b0 d4 07 d6 12 bd 81 9a be 40 ab ae a7 c6 30 94 17 45 7b 59 00 30 5f 5c ee 23 01 00 c0 61 46 cb e4 26 8e 70 5b 2b b7 7e 35 c5 e8 3f c8 Data Ascii: !XaO`4k3<<N"wDyUs<BktmjZ0;iA0lqI}C?C{78%2&T` 1#V{t[WUX\k4{?6?%2N}+k).l]*oEiBf&]]Y@0E{Y0_\#aF&p[+~5?
2022-01-27 22:05:38 UTC	2646	IN	Data Raw: 30 28 c4 74 52 a6 58 c3 c9 75 5f e2 e8 11 14 b4 83 8e 03 20 2d 70 e1 db 89 98 66 5e 5a 19 21 36 0c 99 94 c1 10 1b 20 84 a6 39 e2 1e 57 a7 96 cc 89 d0 5e 27 1a 8c bd 13 f8 8e 00 63 b3 f3 6b 9a a3 b7 ed cb 6c e9 92 b8 62 83 f2 aa c5 ff f3 c9 bf 56 d5 cd 1b 73 5c c1 ca 42 2a 2a c8 49 e7 de 93 01 fc 00 02 03 c0 3d 82 10 94 3f 93 0a 03 12 e5 63 9c db ed 07 06 34 65 e2 f0 ea 60 6d 07 35 20 d4 8b ae 43 51 5a b9 02 21 02 e6 21 fb 1d 64 06 be 61 8a 33 48 4c 91 d2 ee 31 0a 22 c1 cd 68 3b d0 a2 1c aa f9 0f 3b c9 a3 a9 e5 7d ae 17 4c 96 97 44 00 c0 72 10 18 00 00 c0 44 95 57 a1 8a 6a 8c cf d6 13 09 cd 29 42 f7 0d df 3f b7 a5 9b 1d cc b7 73 59 2b bb 5a 10 71 cd f5 f0 40 4f d2 69 4b 0c e3 7b 71 c1 d4 23 28 ed 74 4e da 99 1c d7 c3 e0 19 74 3c 66 5a 50 94 5b b9 e5 87 ff Data Ascii: 0(tRXu_ -pf^Z!6 9W^'cklbVs\B**I=?c4e`m5 CQZ!!da3HL1"h;;}LDrDWj)B?sY+Zq@OiK{q#(tNt<fZP[
2022-01-27 22:05:38 UTC	2662	IN	Data Raw: da ad c8 48 7c 7d 9e 97 76 2b 2f 98 9f 6a 10 5a f8 d9 d1 5b 98 81 af 8f 7c ef 55 d9 34 86 28 ce 41 9e 6c 48 b5 76 52 ba 38 f3 95 6d e5 43 fb 6e fb b7 ef ac bc e5 7a 9a 3f 82 0c 61 78 ec d2 ab 6f fa 97 3e 74 e8 d6 7f 68 45 c3 01 00 98 80 ad 54 83 e8 e3 b4 0a 56 37 0a b7 ef 21 41 c9 85 43 c3 26 b6 6f 00 34 b4 ed 3e d9 7b 0f 61 c3 c4 99 f2 dd fb ef 37 e7 d9 d2 c0 39 78 45 18 58 e9 89 15 ce 7e 17 b3 6f 68 06 14 af da e2 b5 0d 09 7d 06 2a a3 12 63 80 a9 44 00 da 42 c1 00 c0 ea 62 93 88 f8 2b e9 c7 86 c2 68 1e 91 b4 60 70 60 90 da 35 90 cb 3e 21 3d 32 bb f6 82 70 c6 45 8a 7b 55 96 7d 1c 1b 3f ca e7 8e 32 dd 05 a3 9a e5 87 57 73 c3 d9 e2 77 e3 1c e3 0f a2 bd 20 39 7c 88 9b 6e c9 cf 94 3e 7b eb bd 6a e4 1c ea 27 cc a0 b1 45 18 43 14 8c ab b3 7a 97 92 57 ff 51 b8 Data Ascii: H\|}v+/jZ[\|U4(AlHvR8mCnz?axo>thETV7!AC&o4>{a79xEX~oh}*cDBb+h`p`5>!=2pE{U}?2Wsw 9\|n>{j'ECzWQ
2022-01-27 22:05:38 UTC	2678	IN	Data Raw: ad 43 18 4c 64 e8 6d 0d 25 85 b2 5f 97 be 73 1e 6f d9 49 2d 17 a4 2e c5 c9 da 43 0b 2d 70 d2 49 19 2a 08 3a cf a3 df 42 b8 cf e0 d5 c1 32 00 0c 0a ef 8c 01 2c ca 56 6a 8b 1c 9b ed dd 7c 92 63 8b 52 87 56 41 51 d8 31 a1 93 95 68 4b 11 59 e6 b2 64 87 01 1f e2 fc 7d 4b c4 87 2e 27 71 e7 69 ba a0 a4 b5 7e 22 7b 26 e2 8e e7 61 db 7d e4 7b af c6 1a 35 76 ef 17 ca 45 46 49 b0 48 5d fc 30 a2 bb 5c 9f 1b f4 5c fc 13 dc 40 38 c3 1f 12 36 dd 9f 9d e0 f8 a9 74 61 4f 68 da e4 92 e9 fa 87 c7 31 c6 a5 4d d2 0a 66 48 e3 2f 2c 3c 7b 86 f5 0c a2 84 b6 44 5a 5b 6d a5 41 72 79 9a dc 8e e3 59 af dc 3a ac db 3b 86 f1 da fa ed af 7f 8a a0 15 00 6a b6 ae 1a d3 ed 8b b9 e5 cf c6 db fa ed c1 f1 cb 83 16 76 ec 21 15 ff 68 e0 a4 a5 8a 32 21 8f 41 d4 d1 bd c2 52 05 83 e9 77 c8 03 c1 Data Ascii: CLdm%_soI-.C-pI*:B2,Vj\|cRVAQ1hKYd}K.'qi~"{&a}{5vEFIH]0\\@86taOh1MfH/,<{DZ[mAryY:;jv!h2!ARw
2022-01-27 22:05:38 UTC	2694	IN	Data Raw: 4e bf 16 67 8f da 32 46 1d f3 47 d8 e5 db fa a2 6b 30 c9 3b 98 e4 ee 4f 16 02 49 e2 fe e6 a4 8f 2d cc 1c a3 d7 35 a9 63 f6 ec 51 6b c6 98 2d 63 cc ec bf 07 fa 27 31 bd c7 8a 67 56 44 5c 46 e6 f1 1d ff 38 1c 48 95 36 71 94 1a b0 e8 38 02 b6 3c 7a a6 fa c0 7a b2 ff b0 ec 24 56 3c 8f ad df 47 de 72 92 07 ee 52 ed 6c dc 9a 4b cb 0c 5e 7d 33 f4 c8 9a ff d8 b8 f7 91 7f 8f fc 53 93 ae 3f 33 0c 0f dd 43 e7 3a 74 84 bd 90 0a 3f 3f de 11 ca d3 16 35 83 ad 0f 62 d9 2b d0 3a 10 0c 80 11 c0 47 6d 38 eb 56 87 ba f8 9b 4e c6 40 30 b0 2f 0c cd 16 c5 23 92 48 3c 63 83 60 90 3a 34 b9 24 d0 97 32 f4 ad 65 8d 3b fe 67 4d f4 4f e5 c9 18 d0 5d d7 31 8b 90 33 20 2d a2 f1 74 2c d2 c8 a8 e2 4d 99 5c 30 68 d1 95 60 20 76 a8 48 9f 3c 84 90 c6 63 e4 a3 e5 7a da 05 30 15 ec c7 7e 46 Data Ascii: Ng2FGk0;OI-5cQk-c'1gVD\F8H6q8<zz$V<GrRlK^}3S?3C:t??5b+:Gm8VN@0/#H<c`:4$2e;gMO]13 -t,M\0h` vH<cz0~F
2022-01-27 22:05:38 UTC	2694	IN	Data Raw: de 3b c9 f1 33 21 4d c8 72 99 5f fe e6 47 4e 7c ec bf 23 fc 48 aa df b0 df 8c ba 53 0b 44 78 0b f9 fe 83 4a cd 60 db 2e fa 20 82 b5 81 96 41 24 11 d0 2b 71 9a b3 36 0c ec 57 a9 d7 17 03 d7 5b 02 be cc d0 5c 2d 62 73 17 4d fa 78 7d d1 29 cf 4c 72 c3 1f bf 46 c7 6a 01 21 c4 57 20 f3 53 9b 24 95 48 51 63 10 93 d2 f2 44 52 53 29 8b 2f 23 84 9e 0d 23 98 c8 00 b0 5f 22 26 cf 23 a2 53 d5 7e 34 1e 6b 02 f4 1e 1b 03 77 7f f2 f6 e6 cc 07 0f e6 3c 73 6c de 6b ad e9 9e 81 e4 e2 c2 f3 55 ab 8e 6c 58 f3 87 47 eb 7e b5 75 d3 93 05 f9 97 c4 65 04 ad cb 4f 75 15 b7 f9 16 84 4e 0f 84 11 ce d9 99 ba a3 39 f3 1b 6f e6 6c 6f ce ec 1a d4 e2 b5 ad 10 e0 1a da d2 be 7b 24 fb d1 37 73 5e 70 f1 ce ce d4 40 52 30 b7 48 28 b9 a5 fb da ea 4b 2b 6b cf af ac 3d 3f e9 0f fa c7 f7 ee 05 Data Ascii: ;3!Mr_GN\|#HSDxJ`. A$+q6W[\-bsMx})LrFj!W S$HQcDRS)/##_"&#S~4kw<slkUlXG~ueOuN9olo{$7s^p@R0H(K+k=?
2022-01-27 22:05:38 UTC	2710	IN	Data Raw: 8c 12 e9 e1 a0 c9 b7 ee d9 f1 ea 64 1d 8a 1c 4e fa 7e 17 4d 8a 00 00 d2 93 3e 8f 86 6a ad a2 2f 9b 8b 8a dc 9d c1 0e 30 d0 e7 79 18 b9 57 3b 6f c4 dd 2f 77 df 93 4b e8 21 44 48 9f 87 f2 02 80 04 e1 96 17 b0 1b c9 85 60 ef 8d fa 46 6b c4 db 27 35 35 d9 7b e9 a0 63 95 92 56 03 ec d9 4e 0e ff 90 ae ef 47 b5 fb 4a 5b 42 f7 e3 be fe 02 fd f6 ca 09 bf 7e 1d 4e 3a 39 8f 3b fd 11 20 4e 08 0c 80 4f 16 5b 50 b8 8d aa 28 e0 4b 95 9e 26 f0 e8 b4 18 56 f1 65 ad 08 8f 2a b9 fc 2d 05 d8 ed 1b 49 2f 49 e1 26 5e d2 6a fa 5c a6 6b 7b fd 85 ef ec dc fa 26 a3 18 9c f8 af ec 7e 96 ed 2f d1 5e 9c 96 b8 7b 71 02 88 c7 0c 77 98 17 3c 00 f8 69 e6 8e 32 f2 b1 14 1b 63 e0 9f 0b c5 b6 eb 61 43 11 fb 67 73 92 7d 5c fc 63 1f 1a 00 24 40 6b 7b e0 3e 04 da c3 74 ad 93 8c 45 39 9d 5d a5 Data Ascii: dN~M>j/0yW;o/wK!DH`Fk'55{cVNGJ[B~N:9; NO[P(K&Ve*-I/I&^j\k{&~/^{qw<i2caCgs}\c$@k{>tE9]
2022-01-27 22:05:38 UTC	2726	IN	Data Raw: 7e 37 f0 80 97 fc ff ec dd 09 74 5b f7 7d 27 fa ff dd 00 dc 8b 9d 00 48 90 a2 48 8a 94 2c 8a da 4c 59 91 1d cb 52 9c 78 49 dc 89 eb c4 76 5e d3 8e d3 ce b4 4d 93 79 cd 6b fa fa 7a 3a a7 6d e6 d5 33 cd 34 4d d3 49 5e da 34 4d e2 da c9 89 93 c6 69 e2 c4 5b e3 a5 72 c7 b6 2c 47 96 ad c5 d6 42 51 0b 25 82 14 09 62 21 f6 7b 81 bb be 73 05 9a 80 40 80 22 08 80 b8 cb ef 73 74 7c 48 1a 04 ef 02 82 c0 fd fd 7f bf 6f 3f 9c 7e 00 74 00 0a 06 00 00 b0 4a 01 2f fa d4 47 e1 e0 ad 5e 0b 6b 06 39 5c ad 16 b0 f0 37 0e 00 00 8c cc 6d 25 06 dc 6b 17 8a 03 00 00 2b c4 0a 58 a8 6c 24 51 34 81 3e ff 65 34 39 0b 87 0f 98 54 79 c1 ec c6 cd f0 28 00 40 07 e0 62 0a 00 00 ac de fe 9b d0 4d 23 70 fc 56 af 45 35 03 e9 5f fc ca 65 b8 84 04 00 00 06 07 ed 05 00 00 6d 2a 0f 30 28 62 f3 Data Ascii: ~7t[}'HH,LYRxIv^Mykz:m34MI^4Mi[r,GBQ%b!{s@"st\|Ho?~tJ/G^k9\7m%k+Xl$Q4>e49Ty(@bM#pVE5_em*0(b
2022-01-27 22:05:38 UTC	2742	IN	Data Raw: 42 e7 ee c4 3d 46 ee d8 5e f0 d7 91 5d e3 85 85 9a 01 8d 4b 7f 33 74 bc de 19 2c d7 85 59 ac 54 67 70 cd 86 b4 34 85 94 88 8b 09 1d a7 97 87 0a cc 63 b3 43 e5 a3 f9 af 9e 5f f1 0f fc ef 0e 5b e1 49 69 39 21 c1 f9 4f f3 23 53 bc a3 fc 36 eb ad ec 6f 77 5f ec b3 d6 59 4e c3 71 2a 10 c4 ed 8e 15 dc 74 95 56 f8 40 7d 3a d6 fb 4c 7c 5d f1 e3 51 47 e2 93 9d 93 da 9f 52 55 be cd 8b fc 83 d9 2d 77 cf 42 ab 01 30 03 47 9e ba 63 ac a7 e9 c1 06 3c 29 1f d9 10 39 df 05 f1 36 a6 13 bb e8 38 f9 5c e9 49 f5 8f 7e 47 bc 69 a3 31 df e3 1b b3 60 50 91 5e 30 fa c0 94 a7 17 5a 47 f5 0d 0a 06 50 2d 00 40 bf 06 3b 7a 6e e9 df 0a 27 d0 c0 04 49 3c 70 fe 6d a8 19 34 c2 4b 3b ef dc b4 bb 56 51 4d 90 c4 5f 9c 3d 9c e3 39 bd ec 0e 58 f4 b5 9e f8 1f 06 52 66 38 1e 93 c8 f7 67 f8 83 Data Ascii: B=F^]K3t,YTgp4cC_[Ii9!O#S6ow_YNq*tV@}:L\|]QGRU-wB0Gc<)968\I~Gi1`P^0ZGP-@;zn'I<pm4K;VQM_=9XRf8g
2022-01-27 22:05:38 UTC	2742	IN	Data Raw: ed ff 69 cc 3e 5a 63 8e 24 2a 4f 2f e8 5a 5f 58 7f 73 b4 cd 1b 04 1a 66 f2 91 44 50 2d 00 40 bf a0 5a 60 06 04 8e 0f 78 83 b3 e9 b8 3a 5d 07 ac 4a 5e e4 f3 02 df eb e9 ac fa cd 04 8e 77 39 bd a1 44 18 a6 3f e9 cb 4e 9a ff 5e 9f 59 5e 87 7b 10 c7 22 eb 05 ac ab f8 69 98 a7 19 42 1a a2 9b 7f 31 4e e6 58 25 cf 11 76 87 5e c6 13 61 24 45 38 dd 8a c0 2b 82 5e 9f 21 87 99 f4 30 93 39 cb b9 16 93 2a 10 42 17 b0 ae b7 b1 0d 9b 94 39 0f 82 5a 66 75 14 92 76 a2 a9 7e 14 7f 17 eb 13 50 69 68 c3 a9 9c 67 9c 73 8d 3a 13 75 8d 27 52 04 5e ce 66 30 ab ad e9 79 1e 8a 28 88 b1 c8 4a 6e e9 26 85 e7 e7 7b 16 3f 15 15 bc b8 2f 9b 99 0c 43 68 77 fa 96 9b 14 6e f7 44 58 99 9c c8 97 ba 34 64 09 8b 9c 73 e5 d3 94 b7 97 c5 49 18 b1 05 0c 2e e4 cb e6 ac 42 df 7c 73 1a 95 5e da 7a Data Ascii: i>Zc$O/Z_XsfDP-@Z`x:]J^w9D?N^Y^{"iB1NX%v^a$E8+^!09B9Zfuv~Pihgs:u'R^f0y(Jn&{?/ChwnDX4dsI.B\|s^z
2022-01-27 22:05:38 UTC	2758	IN	Data Raw: 00 00 00 00 00 00 00 c0 55 82 01 f3 e1 83 8e fc 9f 1a b0 19 51 8e 11 c7 f4 3f b6 4f b4 35 17 9e 9e 38 66 1b 1e 30 e2 b5 07 00 00 00 00 00 00 00 08 21 0e 1f 74 c4 a2 85 ee 43 57 9a 11 19 71 5d 8c 18 18 08 21 be fc 94 50 5f ef ef bf e0 08 06 0c ba 14 00 00 00 00 00 00 00 60 64 47 5f b5 8f 5c 2c 0c aa b9 f7 bd c9 3d db 0d ba 5d 6c d0 d3 ae f7 89 cf ef 2f 3c cd 0d 33 a8 e4 01 01 00 00 00 00 00 00 00 ca 6e c5 e8 82 c6 c6 d4 e7 3f 6c dc 86 34 c6 bd ad be b7 5b dc b3 ab f0 74 7a 42 52 f7 a8 02 00 00 00 00 00 00 00 e8 db d4 f2 6d 61 9b 3d f3 a5 8f 49 46 be e6 86 ee c3 f3 85 fd cb 86 19 9c 3e 69 3d 7d c2 5a c9 03 02 00 00 00 00 00 00 00 94 45 2c 6a 3a 7c d0 ae 1e 5d f0 89 7f 97 69 6f 36 f4 e2 1b bd 71 ff 8a 61 06 87 0f 39 a6 26 0c 9d 20 01 00 00 00 00 00 00 80 11 Data Ascii: UQ?O58f0!tCWq]!P_`dG_\,=]l/<3n?l4[tzBRma=IF>i=}ZE,j:\|]io6qa9&

Timestamp	kBytes transferred	Direction	Data
2022-01-27 22:05:38 UTC	2592	OUT	GET /projects/5027/fontface.css/ HTTP/1.1 Host: cloud.typenetwork.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-01-27 22:05:38 UTC	2628	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Age: 598548 Allow: GET, HEAD, OPTIONS Cache-Control: max-age=10800 CF-Cache-Status: DYNAMIC CF-RAY: 6d0c33a09f5f7057-FRA Content-Type: text/css; charset=utf-8 Date: Thu, 27 Jan 2022 22:05:38 GMT Etag: "5da7900fc89b38f6c990ca91e9dad0b1+ident" Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Expires: Fri, 28 Jan 2022 01:05:38 GMT Last-Modified: Thu, 20 Jan 2022 23:39:44 GMT NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5zFkm%2FnLrdTzQlMfulMVvjMaAOr5aMyswTowNINz8CUMbXwy5qfC%2BF1B0nVfkbQRi1SqdKMnSZrsogAUi2dz6hPzD70B2gP%2FBjOJQ8rF3nwuze4eTaoiCE66UlEJlIfV15IUGPI%3D"}],"group":"cf-nel","max_age":604800} Server: ECS (frb/6760) Vary: Accept-Encoding X-Cache: HIT X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Length: 896 Connection: close
2022-01-27 22:05:38 UTC	2629	IN	Data Raw: 2f 2a 20 54 68 69 73 20 43 53 53 20 72 65 73 6f 75 72 63 65 20 69 6e 63 6f 72 70 6f 72 61 74 65 73 20 6c 69 6e 6b 73 20 74 6f 20 66 6f 6e 74 20 73 6f 66 74 77 61 72 65 20 77 68 69 63 68 20 69 73 20 74 68 65 0a 20 20 20 76 61 6c 75 61 62 6c 65 20 63 6f 70 79 72 69 67 68 74 65 64 20 70 72 6f 70 65 72 74 79 20 6f 66 20 54 79 70 65 20 4e 65 74 77 6f 72 6b 2c 20 49 6e 63 2e 20 61 6e 64 2f 6f 72 20 74 68 65 69 72 0a 20 20 20 73 75 70 70 6c 69 65 72 73 2e 20 59 6f 75 20 6d 61 79 20 6e 6f 74 20 61 74 74 65 6d 70 74 20 74 6f 20 63 6f 70 79 2c 20 69 6e 73 74 61 6c 6c 2c 20 72 65 64 69 73 74 72 69 62 75 74 65 2c 0a 20 20 20 63 6f 6e 76 65 72 74 2c 20 6d 6f 64 69 66 79 20 6f 72 20 72 65 76 65 72 73 65 20 65 6e 67 69 6e 65 65 72 20 74 68 69 73 20 66 6f 6e 74 20 73 6f Data Ascii: /* This CSS resource incorporates links to font software which is the valuable copyrighted property of Type Network, Inc. and/or their suppliers. You may not attempt to copy, install, redistribute, convert, modify or reverse engineer this font so

Timestamp	kBytes transferred	Direction	Data
2022-01-27 22:05:38 UTC	2762	OUT	GET /favicon.ico HTTP/1.1 Host: protective-glistening-people.glitch.me Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://protective-glistening-people.glitch.me/a.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-01-27 22:05:38 UTC	2762	IN	HTTP/1.1 403 Forbidden Date: Thu, 27 Jan 2022 22:05:38 GMT Content-Type: text/html; charset=utf-8 Content-Length: 1930 Connection: close Cache-Control: max-age=0 ETag: W/"78a-v/0NQwFUHD+MwdUDXLgAso0Y8f8"
2022-01-27 22:05:38 UTC	2762	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4f 6f 70 73 21 20 54 68 69 73 20 70 72 6f 6a 65 63 74 20 69 73 6e 27 74 20 72 75 6e 6e 69 6e 67 2e 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 6c 6f Data Ascii: <!DOCTYPE html><html lang="en"> <head> <meta charset="utf-8"> <title>Oops! This project isn't running.</title> <meta name="viewport" content="initial-scale=1, width=device-width"> <link rel="stylesheet" type="text/css" href="https://clo

Timestamp	kBytes transferred	Direction	Data
2022-01-27 22:05:19 UTC	53	OUT	GET /js/client.js?onload=gapiLoaded HTTP/1.1 Host: apis.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://sites.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=L8fFvzSSImKqJLxWn4iQ8XuB6uQhK5D_HxcrcstFO4E-7pNxgn8NRrbCRYUzVUos9R-FYZTpziGEhy_9AtCATfeKAS1_stcIQpnPwTObrX2O8y_H4mhgeBPICYSX_YxvQVGRwnNcLo1LBoHZARIib_gs620avl2obbhSV91NSGg
2022-01-27 22:05:19 UTC	54	IN	HTTP/1.1 200 OK Content-Type: application/javascript; charset=utf-8 x-ua-compatible: IE=edge, chrome=1 Timing-Allow-Origin: * Access-Control-Allow-Origin: * Expires: Thu, 27 Jan 2022 22:05:19 GMT Date: Thu, 27 Jan 2022 22:05:19 GMT Cache-Control: private, max-age=1800, stale-while-revalidate=1800 Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-f+1nGE9XVSmMKjpbcFGjeg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport Strict-Transport-Security: max-age=31536000 Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-01-27 22:05:19 UTC	55	IN	Data Raw: 33 32 62 64 0d 0a 76 61 72 20 67 61 70 69 3d 77 69 6e 64 6f 77 2e 67 61 70 69 3d 77 69 6e 64 6f 77 2e 67 61 70 69 7c 7c 7b 7d 3b 67 61 70 69 2e 5f 62 73 3d 6e 65 77 20 44 61 74 65 28 29 2e 67 65 74 54 69 6d 65 28 29 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 2f 2a 0a 0a 20 43 6f 70 79 72 69 67 68 74 20 54 68 65 20 43 6c 6f 73 75 72 65 20 4c 69 62 72 61 72 79 20 41 75 74 68 6f 72 73 2e 0a 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 0a 2a 2f 0a 76 61 72 20 67 3d 74 68 69 73 7c 7c 73 65 6c 66 2c 68 3d 22 63 6c 6f 73 75 72 65 5f 75 69 64 5f 22 2b 28 31 45 39 2a 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 3e 3e 3e 30 29 2c 61 61 3d 30 2c 6e 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 7d Data Ascii: 32bdvar gapi=window.gapi=window.gapi\|\|{};gapi._bs=new Date().getTime();(function(){/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0/var g=this\|\|self,h="closure_uid_"+(1E9Math.random()>>>0),aa=0,n=function(a){return a}
2022-01-27 22:05:19 UTC	55	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 72 2e 4f 42 4a 45 43 54 5f 43 52 45 41 54 45 5f 54 45 53 54 5f 4f 56 45 52 52 49 44 45 20 26 26 2a 2f 0a 76 61 72 20 71 3d 77 69 6e 64 6f 77 2c 74 3d 64 6f 63 75 6d 65 6e 74 2c 62 61 3d 71 2e 6c 6f 63 61 74 69 6f 6e 2c 63 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 64 61 3d 2f 5c 5b 6e 61 74 69 76 65 20 63 6f 64 65 5c 5d 2f 2c 79 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 72 65 74 75 72 6e 20 61 5b 62 5d 3d 61 5b 62 5d 7c 7c 63 7d 2c 65 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 61 2e 73 6f 72 74 28 29 3b 66 6f 72 28 76 61 72 20 62 3d 5b 5d 2c 63 3d 76 6f 69 64 20 30 2c 64 3d 30 3b 64 3c 61 2e 6c 65 6e 67 74 68 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 61 5b 64 5d 3b 65 21 3d 63 26 26 62 2e 70 75 73 68 28 65 29 3b 63 Data Ascii: gapi.loader.OBJECT_CREATE_TEST_OVERRIDE &&*/var q=window,t=document,ba=q.location,ca=function(){},da=/\[native code\]/,y=function(a,b,c){return a[b]=a[b]\|\|c},ea=function(a){a=a.sort();for(var b=[],c=void 0,d=0;d<a.length;d++){var e=a[d];e!=c&&b.push(e);c
2022-01-27 22:05:19 UTC	56	IN	Data Raw: 5d 2c 52 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 42 61 64 20 68 69 6e 74 22 2b 28 61 3f 22 3a 20 22 2b 61 3a 22 22 29 29 3b 7d 3b 50 2e 70 75 73 68 28 5b 22 6a 73 6c 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 66 6f 72 28 76 61 72 20 62 20 69 6e 20 61 29 69 66 28 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 63 3f 44 5b 62 5d 3d 79 28 44 2c 62 2c 5b 5d 29 2e 63 6f 6e 63 61 74 28 63 29 3a 79 28 44 2c 62 2c 63 29 7d 69 66 28 62 3d 61 2e 75 29 61 3d 79 28 44 2c 22 75 73 22 2c 5b 5d 29 2c 61 2e 70 75 73 68 28 62 29 2c 28 62 3d 2f 5e 68 74 74 70 73 3a 28 2e 2a Data Ascii: ],R=function(a){throw Error("Bad hint"+(a?": "+a:""));};P.push(["jsl",function(a){for(var b in a)if(Object.prototype.hasOwnProperty.call(a,b)){var c=a[b];"object"==typeof c?D[b]=y(D,b,[]).concat(c):y(D,b,c)}if(b=a.u)a=y(D,"us",[]),a.push(b),(b=/^https:(.*
2022-01-27 22:05:19 UTC	58	IN	Data Raw: 2c 0a 22 2c 22 29 2e 72 65 70 6c 61 63 65 28 2f 25 32 46 2f 67 2c 22 2f 22 29 2c 22 2f 6b 3d 22 2c 65 28 61 2e 76 65 72 73 69 6f 6e 29 2c 22 2f 6d 3d 22 2c 65 28 62 29 2c 64 3f 22 2f 65 78 6d 3d 22 2b 65 28 64 29 3a 22 22 2c 22 2f 72 74 3d 6a 2f 73 76 3d 31 2f 64 3d 31 2f 65 64 3d 31 22 2c 61 2e 67 3f 22 2f 61 6d 3d 22 2b 65 28 61 2e 67 29 3a 22 22 2c 61 2e 69 3f 22 2f 72 73 3d 22 2b 65 28 61 2e 69 29 3a 22 22 2c 61 2e 6a 3f 22 2f 74 3d 22 2b 65 28 61 2e 6a 29 3a 22 22 2c 22 2f 63 62 3d 22 2c 65 28 63 29 5d 2e 6a 6f 69 6e 28 22 22 29 7d 2c 72 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 22 2f 22 21 3d 3d 61 2e 63 68 61 72 41 74 28 30 29 26 26 52 28 22 72 65 6c 61 74 69 76 65 20 70 61 74 68 22 29 3b 66 6f 72 28 76 61 72 20 62 3d 61 2e 73 75 62 73 74 72 69 6e Data Ascii: ,",").replace(/%2F/g,"/"),"/k=",e(a.version),"/m=",e(b),d?"/exm="+e(d):"","/rt=j/sv=1/d=1/ed=1",a.g?"/am="+e(a.g):"",a.i?"/rs="+e(a.i):"",a.j?"/t="+e(a.j):"","/cb=",e(c)].join("")},ra=function(a){"/"!==a.charAt(0)&&R("relative path");for(var b=a.substrin
2022-01-27 22:05:19 UTC	59	IN	Data Raw: 22 29 2c 57 3d 2f 5e 5b 2d 2b 5f 30 2d 39 5c 2f 41 2d 5a 61 2d 7a 5d 2b 3d 7b 30 2c 32 7d 24 2f 2c 58 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 66 6f 72 28 76 61 72 20 63 3d 5b 5d 2c 64 3d 30 3b 64 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 64 29 7b 76 61 72 20 65 3d 61 5b 64 5d 2c 66 3b 69 66 28 66 3d 65 29 7b 61 3a 7b 66 6f 72 28 66 3d 30 3b 66 3c 62 2e 6c 65 6e 67 74 68 3b 66 2b 2b 29 69 66 28 62 5b 66 5d 3d 3d 3d 65 29 62 72 65 61 6b 20 61 3b 66 3d 2d 31 7d 66 3d 30 3e 66 7d 66 26 26 63 2e 70 75 73 68 28 65 29 7d 72 65 74 75 72 6e 20 63 7d 2c 75 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3d 44 2e 6e 6f 6e 63 65 3b 72 65 74 75 72 6e 20 76 6f 69 64 20 30 21 3d 3d 61 3f 61 26 26 61 3d 3d 3d 53 74 72 69 6e 67 28 61 29 26 26 61 2e 6d 61 74 63 68 28 Data Ascii: "),W=/^[-+_0-9\/A-Za-z]+={0,2}$/,X=function(a,b){for(var c=[],d=0;d<a.length;++d){var e=a[d],f;if(f=e){a:{for(f=0;f<b.length;f++)if(b[f]===e)break a;f=-1}f=0>f}f&&c.push(e)}return c},ua=function(){var a=D.nonce;return void 0!==a?a&&a===String(a)&&a.match(
2022-01-27 22:05:19 UTC	60	IN	Data Raw: 20 66 3d 6e 75 6c 6c 3b 66 3d 62 2e 73 68 69 66 74 28 29 3b 29 7b 76 61 72 20 6b 3d 66 2e 73 70 6c 69 74 28 22 2e 22 29 3b 6b 3d 65 5b 66 5d 7c 7c 65 5b 6b 5b 31 5d 26 26 22 6e 73 3a 22 2b 6b 5b 30 5d 7c 7c 22 22 5d 7c 7c 64 3b 76 61 72 20 6c 3d 61 2e 6c 65 6e 67 74 68 26 26 61 5b 61 2e 6c 65 6e 67 74 68 2d 31 5d 7c 7c 6e 75 6c 6c 2c 6d 3d 6c 3b 6c 26 26 6c 2e 68 69 6e 74 3d 3d 6b 7c 7c 28 6d 3d 7b 68 69 6e 74 3a 6b 2c 66 65 61 74 75 72 65 73 3a 5b 5d 7d 2c 61 2e 70 75 73 68 28 6d 29 29 3b 6d 2e 66 65 61 74 75 72 65 73 2e 70 75 73 68 28 66 29 7d 76 61 72 20 70 3d 61 2e 6c 65 6e 67 74 68 3b 0a 69 66 28 31 3c 70 29 7b 76 61 72 20 75 3d 63 2e 63 61 6c 6c 62 61 63 6b 3b 75 26 26 28 63 2e 63 61 6c 6c 62 61 63 6b 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 30 3d 3d 2d Data Ascii: f=null;f=b.shift();){var k=f.split(".");k=e[f]\|\|e[k[1]&&"ns:"+k[0]\|\|""]\|\|d;var l=a.length&&a[a.length-1]\|\|null,m=l;l&&l.hint==k\|\|(m={hint:k,features:[]},a.push(m));m.features.push(f)}var p=a.length;if(1<p){var u=c.callback;u&&(c.callback=function(){0==-
2022-01-27 22:05:19 UTC	62	IN	Data Raw: 28 61 29 7d 65 6c 73 65 20 76 5b 77 5d 28 63 61 29 7d 65 6c 73 65 20 66 61 28 72 29 26 26 64 26 26 64 28 29 7d 2c 43 61 3b 76 61 72 20 44 61 3d 6e 75 6c 6c 2c 5a 3d 67 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 69 66 28 5a 26 26 5a 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 29 74 72 79 7b 44 61 3d 5a 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 28 22 67 61 70 69 23 67 61 70 69 22 2c 7b 63 72 65 61 74 65 48 54 4d 4c 3a 6e 2c 63 72 65 61 74 65 53 63 72 69 70 74 3a 6e 2c 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 3a 6e 7d 29 7d 63 61 74 63 68 28 61 29 7b 67 2e 63 6f 6e 73 6f 6c 65 26 26 67 2e 63 6f 6e 73 6f 6c 65 2e 65 72 72 6f 72 28 61 2e 6d 65 73 73 61 67 65 29 7d 43 61 3d 44 61 3b 76 61 72 20 59 3d 43 61 3b 76 61 72 20 79 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 Data Ascii: (a)}else v[w](ca)}else fa(r)&&d&&d()},Ca;var Da=null,Z=g.trustedTypes;if(Z&&Z.createPolicy)try{Da=Z.createPolicy("gapi#gapi",{createHTML:n,createScript:n,createScriptURL:n})}catch(a){g.console&&g.console.error(a.message)}Ca=Da;var Y=Ca;var ya=function(a,b
2022-01-27 22:05:19 UTC	63	IN	Data Raw: 73 22 3a 66 61 6c 73 65 7d 2c 22 73 69 67 6e 49 6e 44 65 70 72 65 63 61 74 69 6f 6e 22 3a 7b 22 72 61 74 65 22 3a 30 2e 30 7d 2c 22 69 6e 63 6c 75 64 65 5f 67 72 61 6e 74 65 64 5f 73 63 6f 70 65 73 22 3a 74 72 75 65 2c 22 6c 6c 61 6e 67 22 3a 22 65 6e 22 2c 22 69 66 72 61 6d 65 73 22 3a 7b 22 79 6f 75 74 75 62 65 22 3a 7b 22 70 61 72 61 6d 73 22 3a 7b 22 6c 6f 63 61 74 69 6f 6e 22 3a 5b 22 73 65 61 72 63 68 22 2c 22 68 61 73 68 22 5d 7d 2c 22 75 72 6c 22 3a 22 3a 73 6f 63 69 61 6c 68 6f 73 74 3a 2f 3a 73 65 73 73 69 6f 6e 5f 70 72 65 66 69 78 3a 5f 2f 77 69 64 67 65 74 2f 72 65 6e 64 65 72 2f 79 6f 75 74 75 62 65 3f 75 73 65 67 61 70 69 5c 75 30 30 33 64 31 22 2c 22 6d 65 74 68 6f 64 73 22 3a 5b 22 73 63 72 6f 6c 6c 22 2c 22 6f 70 65 6e 77 69 6e 64 6f 77 Data Ascii: s":false},"signInDeprecation":{"rate":0.0},"include_granted_scopes":true,"llang":"en","iframes":{"youtube":{"params":{"location":["search","hash"]},"url":":socialhost:/:session_prefix:_/widget/render/youtube?usegapi\u003d1","methods":["scroll","openwindow
2022-01-27 22:05:19 UTC	64	IN	Data Raw: 3a 73 65 73 73 69 6f 6e 5f 70 72 65 66 69 78 3a 75 69 2f 77 69 64 67 65 74 76 69 65 77 3f 75 73 65 67 61 70 69 5c 75 30 30 33 64 31 22 7d 2c 22 73 75 72 76 65 79 6f 70 74 69 6e 22 3a 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 68 6f 70 70 69 6e 67 2f 63 75 73 74 6f 6d 65 72 72 65 76 69 65 77 73 2f 6f 70 74 69 6e 3f 75 73 65 67 61 70 69 5c 75 30 30 33 64 31 22 7d 2c 22 3a 73 6f 63 69 61 6c 68 6f 73 74 3a 22 3a 22 68 74 74 70 73 3a 2f 2f 61 70 69 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 2c 22 73 68 6f 72 74 6c 69 73 74 73 22 3a 7b 22 75 72 6c 22 3a 22 22 7d 2c 22 68 61 6e 67 6f 75 74 22 3a 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 74 61 6c 6b 67 61 64 67 65 74 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 3a 73 Data Ascii: :session_prefix:ui/widgetview?usegapi\u003d1"},"surveyoptin":{"url":"https://www.google.com/shopping/customerreviews/optin?usegapi\u003d1"},":socialhost:":"https://apis.google.com","shortlists":{"url":""},"hangout":{"url":"https://talkgadget.google.com/:s
2022-01-27 22:05:19 UTC	65	IN	Data Raw: 73 65 67 61 70 69 5c 75 30 30 33 64 31 22 7d 2c 22 76 69 73 69 62 69 6c 69 74 79 22 3a 7b 22 70 61 72 61 6d 73 22 3a 7b 22 75 72 6c 22 3a 22 22 7d 2c 22 75 72 6c 22 3a 22 3a 73 6f 63 69 61 6c 68 6f 73 74 3a 2f 3a 73 65 73 73 69 6f 6e 5f 70 72 65 66 69 78 3a 5f 2f 77 69 64 67 65 74 2f 72 65 6e 64 65 72 2f 76 69 73 69 62 69 6c 69 74 79 3f 75 73 65 67 61 70 69 5c 75 30 30 33 64 31 22 7d 2c 22 61 75 74 6f 63 6f 6d 70 6c 65 74 65 22 3a 7b 22 70 61 72 61 6d 73 22 3a 7b 22 75 72 6c 22 3a 22 22 7d 2c 22 75 72 6c 22 3a 22 3a 73 6f 63 69 61 6c 68 6f 73 74 3a 2f 3a 73 65 73 73 69 6f 6e 5f 70 72 65 66 69 78 3a 5f 2f 77 69 64 67 65 74 2f 72 65 6e 64 65 72 2f 61 75 74 6f 63 6f 6d 70 6c 65 74 65 22 7d 2c 22 61 64 64 69 74 6e 6f 77 22 3a 7b 22 75 72 6c 22 3a 22 68 74 74 Data Ascii: segapi\u003d1"},"visibility":{"params":{"url":""},"url":":socialhost:/:session_prefix:_/widget/render/visibility?usegapi\u003d1"},"autocomplete":{"params":{"url":""},"url":":socialhost:/:session_prefix:_/widget/render/autocomplete"},"additnow":{"url":"htt
2022-01-27 22:05:19 UTC	67	IN	Data Raw: 6c 75 73 62 75 74 74 6f 6e 63 6f 6e 66 69 67 75 72 61 74 6f 72 3f 75 73 65 67 61 70 69 5c 75 30 30 33 64 31 22 7d 2c 22 7a 6f 6f 6d 61 62 6c 65 69 6d 61 67 65 22 3a 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 73 73 6c 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 6d 69 63 72 6f 73 63 6f 70 65 2f 65 6d 62 65 64 2f 22 7d 2c 22 61 70 70 66 69 6e 64 65 72 22 3a 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 6f 72 6b 73 70 61 63 65 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 3a 73 65 73 73 69 6f 6e 5f 70 72 65 66 69 78 3a 6d 61 72 6b 65 74 70 6c 61 63 65 2f 61 70 70 66 69 6e 64 65 72 3f 75 73 65 67 61 70 69 5c 75 30 30 33 64 31 22 7d 2c 22 73 61 76 65 74 6f 77 61 6c 6c 65 74 22 3a 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 70 61 79 2e 67 6f 6f 67 6c 65 2e 63 6f Data Ascii: lusbuttonconfigurator?usegapi\u003d1"},"zoomableimage":{"url":"https://ssl.gstatic.com/microscope/embed/"},"appfinder":{"url":"https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi\u003d1"},"savetowallet":{"url":"https://pay.google.co
2022-01-27 22:05:19 UTC	68	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0