Edit tour

Windows Analysis Report
https://sites.google.com/view/familyfocusfederalcreditunion/home

Overview

General Information

Sample URL:	https://sites.google.com/view/familyfocusfederalcreditunion/home
Analysis ID:	562517
Infos:

Detection

HTMLPhisher

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Yara detected HtmlPhish20

Classification

Process Tree

System is w10x64

chrome.exe (PID: 6528 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "https://sites.google.com/view/familyfocusfederalcreditunion/home MD5: C139654B5C1438A95B321BB01AD63EF6)

chrome.exe (PID: 6812 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1544,2771673230443207147,4710909599047293816,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1904 /prefetch:8 MD5: C139654B5C1438A95B321BB01AD63EF6)

cleanup

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic			Jump to behavior

Source: unknown	HTTPS traffic detected: 172.217.168.33:443 -> 192.168.2.3:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.168.33:443 -> 192.168.2.3:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.168.33:443 -> 192.168.2.3:49800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.168.33:443 -> 192.168.2.3:49923 version: TLS 1.2

Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866

Source: global traffic	HTTP traffic detected: GET /js/client.js?onload=gapiLoaded HTTP/1.1Host: apis.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://sites.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=jJzmD0qxDfgyszoaaI0vPvzimEhgK_WopyNzV6DzocPtwXBPptWxjQn_SAKENcDy-ASNSd0fYvf3soeMJw8HSZLmQRnYw-ArHuTfAPqkDVlm9c_PYJzue4IEIpj7SMlgydW3cYI0Vtz-h6ptYgjgMFWSAWg5xrAS0Cr_XlxFVrk
Source: global traffic	HTTP traffic detected: GET /euiTtl5YpLaigmurPUkZw8LgCI3Cvc6YXnZD-if7GoPGunMGl9cWeVD4qAD8fNhTnkVAzexO_aBGu90P0J3WBAU=w16383 HTTP/1.1Host: lh5.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://sites.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jcNdpc_z8XXwePCU9b1Dmzlc5wIIwnVZ_A3VRv2-vH5dDkajLpPVrtzFbYD2FEZna5RBLFqtXbRNzCHunqsCJSc=w16383 HTTP/1.1Host: lh3.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://sites.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff2 HTTP/1.1Host: fonts.gstatic.comConnection: keep-aliveOrigin: https://sites.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://fonts.googleapis.com/css?family=Google+Sans_old:400,500\|Roboto:300,400,500,700\|Source+Code+Pro:400,700&display=swapAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/ptsans/v16/jizfRExUiTo99u79B_mh0O6tLQ.woff2 HTTP/1.1Host: fonts.gstatic.comConnection: keep-aliveOrigin: https://sites.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://fonts.googleapis.com/css?family=PT%20Sans%3A400%2C700%7CMerriweather%3A400%2C700&display=swapAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/ptsans/v16/jizaRExUiTo99u79D0KExQ.woff2 HTTP/1.1Host: fonts.gstatic.comConnection: keep-aliveOrigin: https://sites.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://fonts.googleapis.com/css?family=PT%20Sans%3A400%2C700%7CMerriweather%3A400%2C700&display=swapAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /euiTtl5YpLaigmurPUkZw8LgCI3Cvc6YXnZD-if7GoPGunMGl9cWeVD4qAD8fNhTnkVAzexO_aBGu90P0J3WBAU=w16383 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh5.googleusercontent.com
Source: global traffic	HTTP traffic detected: GET /jcNdpc_z8XXwePCU9b1Dmzlc5wIIwnVZ_A3VRv2-vH5dDkajLpPVrtzFbYD2FEZna5RBLFqtXbRNzCHunqsCJSc=w16383 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh3.googleusercontent.com
Source: global traffic	HTTP traffic detected: GET /euiTtl5YpLaigmurPUkZw8LgCI3Cvc6YXnZD-if7GoPGunMGl9cWeVD4qAD8fNhTnkVAzexO_aBGu90P0J3WBAU=w16383 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh5.googleusercontent.comIf-None-Match: "v1"
Source: global traffic	HTTP traffic detected: GET /OWFV3if8bOgYNxWNn3QpuYJJ7viTf77P845tA5Yxm7h3879-LBDu3L1FLqdUx9rCYMUOiI-oqythUM1Y-V6e35RgjCWJdkiG1W6jKTNCnj9pXWet2U2T1lfemx3KHB_KhA=w1280 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh6.googleusercontent.com
Source: global traffic	HTTP traffic detected: GET /euiTtl5YpLaigmurPUkZw8LgCI3Cvc6YXnZD-if7GoPGunMGl9cWeVD4qAD8fNhTnkVAzexO_aBGu90P0J3WBAU=w16383 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh5.googleusercontent.comIf-None-Match: "v1"
Source: global traffic	HTTP traffic detected: GET /1P2XEHh66mPOeRHrzS-THzEtpigwiFgbWGDzMMKWeDLaSYzyTEHbCFd1CB699nMhX2Lq2hj9OnuYnG2b1x6ySBtIKCXZ54zlPyuceUztMqNR-D-hnv6Qwb9bKmG8s2HM3Q=w1280 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh6.googleusercontent.com
Source: global traffic	HTTP traffic detected: GET /6dZ4HjYRZx-EBVZEHa5QfgZnOiDJ7JconhTsePeCQ5jbEAhbBV4hFtZNW6ayjr0QzhTNFT6D8PuIR-l03VcaA72TlYRmzv_bWNUxrLB1NDpydUXDwsXxAxpXm_kpd__l-A=w1280 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh6.googleusercontent.com
Source: global traffic	HTTP traffic detected: GET /euiTtl5YpLaigmurPUkZw8LgCI3Cvc6YXnZD-if7GoPGunMGl9cWeVD4qAD8fNhTnkVAzexO_aBGu90P0J3WBAU=w16383 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh5.googleusercontent.comIf-None-Match: "v1"
Source: global traffic	HTTP traffic detected: GET /url?q=https%3A%2F%2Fprotective-glistening-people.glitch.me%2Fa.html&sa=D&sntz=1&usg=AFQjCNE3AXCYZpM83juSb429VtosyK-bUg HTTP/1.1Host: www.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=jJzmD0qxDfgyszoaaI0vPvzimEhgK_WopyNzV6DzocPtwXBPptWxjQn_SAKENcDy-ASNSd0fYvf3soeMJw8HSZLmQRnYw-ArHuTfAPqkDVlm9c_PYJzue4IEIpj7SMlgydW3cYI0Vtz-h6ptYgjgMFWSAWg5xrAS0Cr_XlxFVrk
Source: global traffic	HTTP traffic detected: GET /a.html HTTP/1.1Host: protective-glistening-people.glitch.meConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://www.google.com/url?q=https%3A%2F%2Fprotective-glistening-people.glitch.me%2Fa.html&sa=D&sntz=1&usg=AFQjCNE3AXCYZpM83juSb429VtosyK-bUgAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /css/3a8e55c6-b1f3-4659-99eb-125ae72bd084.css HTTP/1.1Host: cloud.webtype.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://protective-glistening-people.glitch.me/a.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /d7f4f279-e13b-4330-8422-00b2d9211424%2FGlitch-Error-Rainbow-Mug-hires.png?v=1595481653593 HTTP/1.1Host: cdn.glitch.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://protective-glistening-people.glitch.me/a.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /d7f4f279-e13b-4330-8422-00b2d9211424%2FGlitch-Error-Rainbow-Mug-hires.png HTTP/1.1Host: cdn.glitch.meConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://protective-glistening-people.glitch.me/a.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /css/3a8e55c6-b1f3-4659-99eb-125ae72bd084.css HTTP/1.1Host: cloud.typenetwork.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://protective-glistening-people.glitch.me/a.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /projects/5027/fontface.css/ HTTP/1.1Host: cloud.typenetwork.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: protective-glistening-people.glitch.meConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://protective-glistening-people.glitch.me/a.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /kP16MJS18Ayd3NpChe3mU7TpBx9lWrvHykutvAe-LTrCm3VtXOIOTJYTVIu5_E_lRcL-KV9UjhbwnG4qUpwaNis=w16383 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh3.googleusercontent.com
Source: global traffic	HTTP traffic detected: GET /3kQPjt2UiNRArAKcmJBR7bqduwSLlNOjb4DbFBRI_jx2JHAzHxTIb7G8CCNShSeSImaFyrn6NIvQELdyg_iRU4Kak0WhkAZTIv3jFLcUkem251rY5URIuKC_2lY-AEH6Gw=w1280 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh5.googleusercontent.com
Source: global traffic	HTTP traffic detected: GET /kP16MJS18Ayd3NpChe3mU7TpBx9lWrvHykutvAe-LTrCm3VtXOIOTJYTVIu5_E_lRcL-KV9UjhbwnG4qUpwaNis=w16383 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh3.googleusercontent.comIf-None-Match: "v1"
Source: global traffic	HTTP traffic detected: GET /3kQPjt2UiNRArAKcmJBR7bqduwSLlNOjb4DbFBRI_jx2JHAzHxTIb7G8CCNShSeSImaFyrn6NIvQELdyg_iRU4Kak0WhkAZTIv3jFLcUkem251rY5URIuKC_2lY-AEH6Gw=w1280 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh5.googleusercontent.comIf-None-Match: "v1"
Source: global traffic	HTTP traffic detected: GET /kP16MJS18Ayd3NpChe3mU7TpBx9lWrvHykutvAe-LTrCm3VtXOIOTJYTVIu5_E_lRcL-KV9UjhbwnG4qUpwaNis=w16383 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh3.googleusercontent.comIf-None-Match: "v1"
Source: global traffic	HTTP traffic detected: GET /3kQPjt2UiNRArAKcmJBR7bqduwSLlNOjb4DbFBRI_jx2JHAzHxTIb7G8CCNShSeSImaFyrn6NIvQELdyg_iRU4Kak0WhkAZTIv3jFLcUkem251rY5URIuKC_2lY-AEH6Gw=w1280 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh5.googleusercontent.comIf-None-Match: "v1"
Source: global traffic	HTTP traffic detected: GET /2FKQLh684jPJ7R87G9QJZrUgXLt8aqWqMyINTOoPLqDyBkDA_AJIiqQINk1PG2cuY6TDJBC9-hnYzT2oNkPH88c=w16383 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh5.googleusercontent.com
Source: global traffic	HTTP traffic detected: GET /DKe9gP-CgOMjwgv6SyXVB3qpGvhRVu2q_MHFArZj0yzuNzxtlvrYgvsl8p6Kpp4Zqc36Rwv-mIwzbzEW4lML1kj47L3hDdksah8Cqi7VqrzP8-O4cwR0v3VfQHzdR6JbpA=w1280 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh3.googleusercontent.com
Source: global traffic	HTTP traffic detected: GET /SN1igtvc0dEs3NmR7Sat9maIbRAPsgNjamJP6SpFAXn1zJMrGE0vABuVAQqE1Pj1iYx4Pw27j9Ftx48eOD5VNnqB0W5mIl-jjQIdtpw36Rt0A7AqjphTKOLCVf6Jvr_zCw=w1280 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh4.googleusercontent.com
Source: global traffic	HTTP traffic detected: GET /2FKQLh684jPJ7R87G9QJZrUgXLt8aqWqMyINTOoPLqDyBkDA_AJIiqQINk1PG2cuY6TDJBC9-hnYzT2oNkPH88c=w16383 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh5.googleusercontent.comIf-None-Match: "v1"
Source: global traffic	HTTP traffic detected: GET /DKe9gP-CgOMjwgv6SyXVB3qpGvhRVu2q_MHFArZj0yzuNzxtlvrYgvsl8p6Kpp4Zqc36Rwv-mIwzbzEW4lML1kj47L3hDdksah8Cqi7VqrzP8-O4cwR0v3VfQHzdR6JbpA=w1280 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh3.googleusercontent.comIf-None-Match: "v1"
Source: global traffic	HTTP traffic detected: GET /SN1igtvc0dEs3NmR7Sat9maIbRAPsgNjamJP6SpFAXn1zJMrGE0vABuVAQqE1Pj1iYx4Pw27j9Ftx48eOD5VNnqB0W5mIl-jjQIdtpw36Rt0A7AqjphTKOLCVf6Jvr_zCw=w1280 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh4.googleusercontent.comIf-None-Match: "v1"
Source: global traffic	HTTP traffic detected: GET /2FKQLh684jPJ7R87G9QJZrUgXLt8aqWqMyINTOoPLqDyBkDA_AJIiqQINk1PG2cuY6TDJBC9-hnYzT2oNkPH88c=w16383 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh5.googleusercontent.comIf-None-Match: "v1"
Source: global traffic	HTTP traffic detected: GET /DKe9gP-CgOMjwgv6SyXVB3qpGvhRVu2q_MHFArZj0yzuNzxtlvrYgvsl8p6Kpp4Zqc36Rwv-mIwzbzEW4lML1kj47L3hDdksah8Cqi7VqrzP8-O4cwR0v3VfQHzdR6JbpA=w1280 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh3.googleusercontent.comIf-None-Match: "v1"
Source: global traffic	HTTP traffic detected: GET /SN1igtvc0dEs3NmR7Sat9maIbRAPsgNjamJP6SpFAXn1zJMrGE0vABuVAQqE1Pj1iYx4Pw27j9Ftx48eOD5VNnqB0W5mIl-jjQIdtpw36Rt0A7AqjphTKOLCVf6Jvr_zCw=w1280 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh4.googleusercontent.comIf-None-Match: "v1"

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 28 Jan 2022 22:58:32 GMTContent-Type: text/html; charset=utf-8Content-Length: 1930Connection: closeCache-Control: max-age=0ETag: W/"78a-v/0NQwFUHD+MwdUDXLgAso0Y8f8"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 28 Jan 2022 22:58:33 GMTContent-Type: text/html; charset=utf-8Content-Length: 1930Connection: closeCache-Control: max-age=0ETag: W/"78a-v/0NQwFUHD+MwdUDXLgAso0Y8f8"

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "https://sites.google.com/view/familyfocusfederalcreditunion/home
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1544,2771673230443207147,4710909599047293816,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1904 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1544,2771673230443207147,4710909599047293816,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1904 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	3 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	4 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	5 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	3 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud

Source	Detection	Scanner	Label	Link
https://sites.google.com/view/familyfocusfederalcreditunion/home	0%	Virustotal		Browse
https://sites.google.com/view/familyfocusfederalcreditunion/home	0%	Avira URL Cloud	safe
https://sites.google.com/view/familyfocusfederalcreditunion/home	100%	SlashNext	Fake Login Page type: Phishing & Social Engineering

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\Temp\6528_539590190\_platform_specific\x86_64\pnacl_public_x86_64_ld_nexe	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\6528_539590190\_platform_specific\x86_64\pnacl_public_x86_64_ld_nexe	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\6528_539590190\_platform_specific\x86_64\pnacl_public_x86_64_ld_nexe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\6528_539590190\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_llc_nexe	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\6528_539590190\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_llc_nexe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\6528_539590190\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_sz_nexe	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\6528_539590190\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_sz_nexe	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
https://csp.withgoogle.com/csp/report-to/apps-sites	0%	Virustotal		Browse
https://csp.withgoogle.com/csp/report-to/apps-sites	0%	Avira URL Cloud	safe
https://csp.withgoogle.com/csp/report-to/apps-themes	0%	URL Reputation	safe
https://dns.google	0%	URL Reputation	safe
https://csp.withgoogle.com/csp/report-to/apps-sites_	0%	Avira URL Cloud	safe
https://www.google.com;	0%	Avira URL Cloud	safe
https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access	0%	URL Reputation	safe
https://csp.withgoogle.com/csp/apps-themesCross-Origin-Resource-Policy:	0%	URL Reputation	safe

Source: angular.js.1.dr	String found in binary or memory: http://angularjs.org
Source: angular.js.1.dr	String found in binary or memory: http://errors.angularjs.org/1.6.4-local
Source: pnacl_public_x86_64_pnacl_sz_nexe.1.dr, pnacl_public_x86_64_pnacl_llc_nexe.1.dr	String found in binary or memory: http://llvm.org/):
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: http://tools.ietf.org/html/rfc1950
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01
Source: Reporting and NEL.3.dr	String found in binary or memory: https://a.nel.cloudflare.com/report/v3?s=VVzCTbZ534VFiHcUterGGfCVxj2%2BLvW5V7MIWkOAY3VntMEA1DpCXEyuZ
Source: Reporting and NEL.3.dr	String found in binary or memory: https://a.nel.cloudflare.com/report/v3?s=gDjOEtS4Yz5CINpxSUga41PtL3UIRsdFrO1b%2F57nDCVlxWXanvpe9O1jg
Source: 72f6fcb1-f00f-44eb-887e-700edd68e9d0.tmp.3.dr, manifest.json0.1.dr, 66a3cd96-f9b7-466c-bf82-b0ebcfa77a53.tmp.3.dr, 9ae9854f-5d5c-4542-861e-89c50107d4cf.tmp.3.dr	String found in binary or memory: https://accounts.google.com
Source: craw_window.js.1.dr	String found in binary or memory: https://accounts.google.com/MergeSession
Source: 72f6fcb1-f00f-44eb-887e-700edd68e9d0.tmp.3.dr, manifest.json0.1.dr, 66a3cd96-f9b7-466c-bf82-b0ebcfa77a53.tmp.3.dr, 9ae9854f-5d5c-4542-861e-89c50107d4cf.tmp.3.dr	String found in binary or memory: https://apis.google.com
Source: Network Action Predictor.1.dr	String found in binary or memory: https://apis.google.com/
Source: data_1.3.dr	String found in binary or memory: https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.J6wwVzZFlys.O/m=client/rt=j/sv=1/d=1/
Source: mirroring_common.js.1.dr	String found in binary or memory: https://apis.google.com/js/client.js
Source: data_1.3.dr	String found in binary or memory: https://apis.google.com/js/client.js?onload=gapiLoaded
Source: data_1.3.dr	String found in binary or memory: https://apis.google.com/js/client.js?onload=gapiLoadedWj
Source: mirroring_common.js.1.dr	String found in binary or memory: https://castedumessaging-pa.googleapis.com/v1
Source: data_1.3.dr	String found in binary or memory: https://cdn.glitch.com/d7f4f279-e13b-4330-8422-00b2d9211424%2FGlitch-Error-Rainbow-Mug-hires.png?v=1
Source: data_2.3.dr, data_1.3.dr	String found in binary or memory: https://cdn.glitch.me/d7f4f279-e13b-4330-8422-00b2d9211424%2FGlitch-Error-Rainbow-Mug-hires.png
Source: data_2.3.dr	String found in binary or memory: https://cdn.glitch.me/d7f4f279-e13b-4330-8422-00b2d9211424%2FGlitch-Error-Rainbow-Mug-hires.pngServe
Source: data_1.3.dr	String found in binary or memory: https://cdn.glitch.me/d7f4f279-e13b-4330-8422-00b2d9211424%2FGlitch-Error-Rainbow-Mug-hires.pngr
Source: pnacl_public_x86_64_libcrt_platform_a.1.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-clang.git
Source: pnacl_public_x86_64_libcrt_platform_a.1.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-llvm.git
Source: 72f6fcb1-f00f-44eb-887e-700edd68e9d0.tmp.3.dr, 66a3cd96-f9b7-466c-bf82-b0ebcfa77a53.tmp.3.dr, 9ae9854f-5d5c-4542-861e-89c50107d4cf.tmp.3.dr	String found in binary or memory: https://clients2.google.com
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: https://clients2.google.com/cr/report
Source: manifest.json0.1.dr, manifest.json.1.dr, manifest.json1.1.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 72f6fcb1-f00f-44eb-887e-700edd68e9d0.tmp.3.dr, 66a3cd96-f9b7-466c-bf82-b0ebcfa77a53.tmp.3.dr, 9ae9854f-5d5c-4542-861e-89c50107d4cf.tmp.3.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: https://clients6.google.com
Source: Network Action Predictor.1.dr	String found in binary or memory: https://cloud.typenetwork.com/
Source: data_2.3.dr, data_1.3.dr	String found in binary or memory: https://cloud.typenetwork.com/css/3a8e55c6-b1f3-4659-99eb-125ae72bd084.css
Source: data_2.3.dr	String found in binary or memory: https://cloud.typenetwork.com/css/3a8e55c6-b1f3-4659-99eb-125ae72bd084.cssReport-To:
Source: data_1.3.dr	String found in binary or memory: https://cloud.typenetwork.com/projects/5027/fontface.css/
Source: data_1.3.dr	String found in binary or memory: https://cloud.typenetwork.com/projects/5027/fontface.css//
Source: data_2.3.dr, data_1.3.dr	String found in binary or memory: https://cloud.webtype.com/css/3a8e55c6-b1f3-4659-99eb-125ae72bd084.css
Source: data_1.3.dr	String found in binary or memory: https://cloud.webtype.com/css/3a8e55c6-b1f3-4659-99eb-125ae72bd084.css??
Source: pnacl_public_x86_64_ld_nexe.1.dr	String found in binary or memory: https://code.google.com/p/nativeclient/issues/entry
Source: pnacl_public_x86_64_ld_nexe.1.dr	String found in binary or memory: https://code.google.com/p/nativeclient/issues/entry%s:
Source: 72f6fcb1-f00f-44eb-887e-700edd68e9d0.tmp.3.dr, 66a3cd96-f9b7-466c-bf82-b0ebcfa77a53.tmp.3.dr	String found in binary or memory: https://content-autofill.googleapis.com
Source: data_1.3.dr	String found in binary or memory: https://content-autofill.googleapis.com/v1/pages/Chc2LjEuMTcxNS4xNDQyL2VuIChHR0xMKRIUCUMm1IiBWOoFEgk

Name	IP	Active	Malicious	Reputation
gstaticadssl.l.google.com	216.58.215.227	true	false	high
cdn.glitch.me	143.204.215.64	true	false	high
cdn.glitch.com	99.86.3.30	true	false	high
cs549.wac.deltacdn.net	192.229.233.123	true	false	unknown
accounts.google.com	142.250.203.109	true	false	high
plus.l.google.com	172.217.168.46	true	false	high
cloud.webtype.com	188.114.96.7	true	false	unknown
sites.google.com	142.250.203.110	true	false	high
www.google.com	142.250.203.100	true	false	high
clients.l.google.com	142.250.203.110	true	false	high
protective-glistening-people.glitch.me	23.23.235.119	true	false	high
googlehosted.l.googleusercontent.com	172.217.168.33	true	false	high
lh6.googleusercontent.com	unknown	unknown	false	high
lh3.googleusercontent.com	unknown	unknown	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
lh5.googleusercontent.com	unknown	unknown	false	high
clients2.google.com	unknown	unknown	false	high
cloud.typenetwork.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high
lh4.googleusercontent.com	unknown	unknown	false	high

Name	Malicious	Reputation
https://lh3.googleusercontent.com/kP16MJS18Ayd3NpChe3mU7TpBx9lWrvHykutvAe-LTrCm3VtXOIOTJYTVIu5_E_lRcL-KV9UjhbwnG4qUpwaNis=w16383	false	high
https://sites.google.com/view/familyfocusfederalcreditunion/faq	false	high
https://sites.google.com/view/familyfocusfederalcreditunion/team#h.u12q2quik1io	false	high
https://sites.google.com/view/familyfocusfederalcreditunion/team#h.a4rji4pxv1xr	false	high
https://cloud.typenetwork.com/projects/5027/fontface.css/	false	high
https://cdn.glitch.me/d7f4f279-e13b-4330-8422-00b2d9211424%2FGlitch-Error-Rainbow-Mug-hires.png	false	high
https://sites.google.com/view/familyfocusfederalcreditunion/home	false	high
https://sites.google.com/view/familyfocusfederalcreditunion/history#h.wz7mar23iqyu	false	high
https://protective-glistening-people.glitch.me/a.html	false	high
https://lh3.googleusercontent.com/jcNdpc_z8XXwePCU9b1Dmzlc5wIIwnVZ_A3VRv2-vH5dDkajLpPVrtzFbYD2FEZna5RBLFqtXbRNzCHunqsCJSc=w16383	false	high
https://www.google.com/url?q=https%3A%2F%2Fprotective-glistening-people.glitch.me%2Fa.html&sa=D&sntz=1&usg=AFQjCNE3AXCYZpM83juSb429VtosyK-bUg	false	high
https://lh6.googleusercontent.com/1P2XEHh66mPOeRHrzS-THzEtpigwiFgbWGDzMMKWeDLaSYzyTEHbCFd1CB699nMhX2Lq2hj9OnuYnG2b1x6ySBtIKCXZ54zlPyuceUztMqNR-D-hnv6Qwb9bKmG8s2HM3Q=w1280	false	high
https://sites.google.com/view/familyfocusfederalcreditunion/history#h.afyj9j9g00b0	false	high
https://lh5.googleusercontent.com/2FKQLh684jPJ7R87G9QJZrUgXLt8aqWqMyINTOoPLqDyBkDA_AJIiqQINk1PG2cuY6TDJBC9-hnYzT2oNkPH88c=w16383	false	high
https://apis.google.com/js/client.js?onload=gapiLoaded	false	high
https://sites.google.com/view/familyfocusfederalcreditunion/team	false	high

Name	Source	Malicious	Antivirus Detection	Reputation
https://apis.google.com/js/client.js	mirroring_common.js.1.dr	false		high
https://store.typenetwork.com/account/licenses	data_1.3.dr	false		high
https://sites.google.com/view/familyfocusfederalcreditunion/history5A	Current Session.1.dr	false		high
https://crash.corp.google.com/samples?reportid=&q=	common.js.1.dr, mirroring_cast_streaming.js.1.dr	false		high
https://lh3.googleusercontent.com/DKe9gP-CgOMjwgv6SyXVB3qpGvhRVu2q_MHFArZj0yzuNzxtlvrYgvsl8p6Kpp4Zqc	data_1.3.dr	false		high
https://sites.google.com/view/familyfocusfederalcreditunion/home2	History Provider Cache.1.dr	false		high
https://csp.withgoogle.com/csp/report-to/apps-sites	Reporting and NEL.3.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://csp.withgoogle.com/csp/report-to/apps-themes	data_2.3.dr, Reporting and NEL.3.dr	false	URL Reputation: safe	unknown
http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01	mirroring_hangouts.js.1.dr	false		high
https://cloud.typenetwork.com/	Network Action Predictor.1.dr	false		high
https://preprod-hangouts-googleapis.sandbox.google.com	mirroring_hangouts.js.1.dr	false		high
https://protective-glistening-people.glitch.me/a.htmlCache-Control:	data_2.3.dr	false		high
https://www.google.com	Current Session.1.dr	false		high
https://sites.google.com/view/familyfocusfederalcreditunion/faq	Current Session.1.dr	false		high
https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.J6wwVzZFlys.O/m=client/rt=j/sv=1/d=1/	data_1.3.dr	false		high
https://sites.google.com/view/familyfocusfederalcreditunion/historyE	Favicons.1.dr	false		high
https://hangouts.google.com/hangouts/_/logpref	mirroring_hangouts.js.1.dr	false		high
https://protective-glistening-people.glitch.me/a.htmlOops	History.1.dr	false		high
https://sites.google.com/view/familyfocusfederalcreditunion/team#h.u12q2quik1ioFamily	History.1.dr	false		high
https://sites.google.com/view/familyfocusfederalcreditunion/faq;v	Current Session.1.dr	false		high
https://creativecommons.org/publicdomain/zero/1.0/.	mirroring_hangouts.js.1.dr	false		high
https://cdn.glitch.me/d7f4f279-e13b-4330-8422-00b2d9211424%2FGlitch-Error-Rainbow-Mug-hires.pngServe	data_2.3.dr	false		high
https://sites.google.com/view/familyfocusfederalcreditunion/homeFamily	History.1.dr	false		high
https://www.google.com/accounts/OAuthLogin?issueuberauth=1	craw_window.js.1.dr	false		high
https://github.com/madler/zlib/blob/master/zlib.h	mirroring_hangouts.js.1.dr	false		high
https://lh3.googleusercontent.com/jcNdpc_z8XXwePCU9b1Dmzlc5wIIwnVZ_A3VRv2-vH5dDkajLpPVrtzFbYD2FEZna5	data_1.3.dr	false		high
https://sites.google.com/view/familyfocusfederalcreditunion/team#h.mc9c3iu9koq0(Family	Current Session.1.dr	false		high
https://www.google.com/tools/feedback	feedback_script.js.1.dr	false		high
https://dns.google	72f6fcb1-f00f-44eb-887e-700edd68e9d0.tmp.3.dr, 66a3cd96-f9b7-466c-bf82-b0ebcfa77a53.tmp.3.dr, f0565c04-9df4-45fe-b210-71227fd2dc84.tmp.3.dr, 9ae9854f-5d5c-4542-861e-89c50107d4cf.tmp.3.dr, 0bb5f89a-220c-441c-9075-d243f19331b2.tmp.3.dr	false	URL Reputation: safe	unknown
https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p	craw_background.js.1.dr, craw_window.js.1.dr	false		high
https://sites.google.com/view/familyfocusfederalcreditunion/history#h.a887fllea086W	Favicons.1.dr	false		high
https://support.google.com/chromecast/troubleshooter/2995236	messages.json83.1.dr, feedback.html.1.dr, messages.json80.1.dr, messages.json72.1.dr, messages.json73.1.dr, messages.json77.1.dr, messages.json34.1.dr, messages.json17.1.dr, messages.json29.1.dr, messages.json3.1.dr, messages.json74.1.dr, messages.json60.1.dr, messages.json75.1.dr, messages.json85.1.dr, messages.json4.1.dr, messages.json87.1.dr, messages.json86.1.dr, messages.json44.1.dr, messages.json76.1.dr, messages.json69.1.dr, messages.json18.1.dr	false		high
http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions	mirroring_hangouts.js.1.dr	false		high
https://csp.withgoogle.com/csp/report-to/apps-sites_	Reporting and NEL.3.dr	false	Avira URL Cloud: safe	unknown
https://sites.google.com/view/familyfocusfederalcreditunion/history#h.a887fllea086_	Current Session.1.dr	false		high
https://sites.google.com/view/familyfocusfederalcreditunion/team#h.u12q2quik1io(Family	Current Session.1.dr	false		high
https://payments.google.com/payments/v4/js/integrator.js	manifest.json.1.dr, craw_window.js.1.dr	false		high
https://sites.google.com/view/familyfocusfederalcreditunion/history#h.afyj9j9g00b0	Current Session.1.dr	false		high
https://sites.google.com/view/familyfocusfederalcreditunion/team#h.a4rji4pxv1xr(Family	Current Session.1.dr	false		high
https://lh3.googleusercontent.com	72f6fcb1-f00f-44eb-887e-700edd68e9d0.tmp.3.dr	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
192.229.233.123	cs549.wac.deltacdn.net	United States	15133	EDGECASTUS	false
216.58.215.227	gstaticadssl.l.google.com	United States	15169	GOOGLEUS	false
142.250.203.100	www.google.com	United States	15169	GOOGLEUS	false
172.217.168.46	plus.l.google.com	United States	15169	GOOGLEUS	false
188.114.96.7	cloud.webtype.com	European Union	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
99.86.3.30	cdn.glitch.com	United States	16509	AMAZON-02US	false
172.217.168.33	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
23.23.235.119	protective-glistening-people.glitch.me	United States	14618	AMAZON-AESUS	false
142.250.203.109	accounts.google.com	United States	15169	GOOGLEUS	false
143.204.215.64	cdn.glitch.me	United States	16509	AMAZON-02US	false

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	562517
Start date:	28.01.2022
Start time:	23:57:16
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://sites.google.com/view/familyfocusfederalcreditunion/home
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal56.phis.win@46/272@23/13
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI Browse: https://sites.google.com/view/familyfocusfederalcreditunion/history Browse: https://sites.google.com/view/familyfocusfederalcreditunion/team Browse: https://sites.google.com/view/familyfocusfederalcreditunion/faq Browse: https://www.google.com/url?q=https%3A%2F%2Fprotective-glistening-people.glitch.me%2Fa.html&sa=D&sntz=1&usg=AFQjCNE3AXCYZpM83juSb429VtosyK-bUg Browse: https://sites.google.com/view/familyfocusfederalcreditunion/team Browse: https://sites.google.com/view/familyfocusfederalcreditunion/faq Browse: https://sites.google.com/view/familyfocusfederalcreditunion/history#h.afyj9j9g00b0 Browse: https://sites.google.com/view/familyfocusfederalcreditunion/history#h.wz7mar23iqyu Browse: https://sites.google.com/view/familyfocusfederalcreditunion/history#h.a887fllea086 Browse: https://sites.google.com/view/familyfocusfederalcreditunion/history Browse: https://sites.google.com/view/familyfocusfederalcreditunion/faq Browse: https://sites.google.com/view/familyfocusfederalcreditunion/team#h.a4rji4pxv1xr Browse: https://sites.google.com/view/familyfocusfederalcreditunion/team#h.mc9c3iu9koq0 Browse: https://sites.google.com/view/familyfocusfederalcreditunion/team#h.u12q2quik1io

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	451603
Entropy (8bit):	5.009711072558331
Encrypted:	false
SSDEEP:	12288:ZHfRTyGZ6lup8Cfrvq4JBPKh+FBlESBw4p6:NfOCzvRKhGvwJ
MD5:	A78AD14E77147E7DE3647E61964C0335
SHA1:	CECC3DD41F4CEA0192B24300C71E1911BD4FCE45
SHA-256:	0D6803758FF8F87081FAFD62E90F0950DFB2DD7991E9607FE76A8F92D0E893FA
SHA-512:	DDE24D5AD50D68FC91E9E325D31E66EF8F624B6BB3A07D14FFED1104D3AB5F4EF1D7969A5CDE0DFBB19CB31C506F7DE97AF67C2F244F7E7E8E10648EA8321101
Malicious:	false
Reputation:	low
Preview:	BDic.... ....6...."..Z..4g....6.2...{/...3...5....AF 1363.AF nm.AF pt.AF n1.AF p.AF tc.AF SM.AF M.AF S.AF MS.AF MNR.AF GDS.AF MNT.AF MH.AF MR.AF SZMR.AF MJ.AF MT.AF MY.AF MRZ.AF MN.AF MG.AF RM.AF N.AF MV.AF XM.AF DSM.AF SD.AF G.AF R.AF MNX.AF MRS.AF MD.AF MNRB.AF B.AF ZSMR.AF PM.AF SMNGJ.AF SMN.AF ZMR.AF SMGB.AF MZR.AF GM.AF SMR.AF SMDG.AF RMZ.AF ZM.AF MDG.AF MDT.AF SMNXT.AF SDY.AF LSDG.AF LGDS.AF GLDS.AF UY.AF U.AF DSGNX.AF GNDSX.AF DSG.AF Y.AF GS.AF IEMS.AF YP.AF ZGDRS.AF XGNVDS.AF UT.AF GNDS.AF GVDS.AF MYPS.AF XGNDS.AF TPRY.AF MDSG.AF ZGSDR.AF DYSG.AF PMYTNS.AF AGDS.AF DRZGS.AF PY.AF GSPMDY.AF EGVDS.AF SL.AF GNXDS.AF DSBG.AF IM.AF I.AF MDGS.AF SMY.AF DSGN.AF DSLG.AF GMDS.AF MDSBG.AF SGD.AF IY.AF P.AF DSMG.AF BLZGDRS.AF TR.AF AGSD.AF ZGBDRSL.AF PTRY.AF ASDGV.AF ASM.AF ICANGSD.AF ICAM.AF IKY.AF AMS.AF PMYTRS.AF BZGVDRS.AF SDRBZG.AF GVMDS.AF PSM.AF DGLS.AF GNVXDS.AF AGDSL.AF DGS.AF XDSGNV.AF BZGDRS.AF AM.AF AS.AF A.AF LDSG.AF AGVDS.AF SDG.AF LDSMG.AF EDSMG.AF EY.AF DRSMZG.AF PRYT.AF LZ

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jan 28, 2022 23:58:10.893445015 CET	192.168.2.3	8.8.8.8	0xeee0	Standard query (0)	sites.google.com	A (IP address)	IN (0x0001)
Jan 28, 2022 23:58:10.898071051 CET	192.168.2.3	8.8.8.8	0xde84	Standard query (0)	clients2.google.com	A (IP address)	IN (0x0001)
Jan 28, 2022 23:58:10.901813984 CET	192.168.2.3	8.8.8.8	0xc196	Standard query (0)	accounts.google.com	A (IP address)	IN (0x0001)
Jan 28, 2022 23:58:11.698554039 CET	192.168.2.3	8.8.8.8	0x77df	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)
Jan 28, 2022 23:58:11.987616062 CET	192.168.2.3	8.8.8.8	0x8855	Standard query (0)	lh5.googleusercontent.com	A (IP address)	IN (0x0001)
Jan 28, 2022 23:58:12.027307034 CET	192.168.2.3	8.8.8.8	0xc44d	Standard query (0)	lh3.googleusercontent.com	A (IP address)	IN (0x0001)
Jan 28, 2022 23:58:15.233537912 CET	192.168.2.3	8.8.8.8	0xd999	Standard query (0)	lh5.googleusercontent.com	A (IP address)	IN (0x0001)
Jan 28, 2022 23:58:15.286088943 CET	192.168.2.3	8.8.8.8	0xbaaf	Standard query (0)	lh3.googleusercontent.com	A (IP address)	IN (0x0001)
Jan 28, 2022 23:58:17.367067099 CET	192.168.2.3	8.8.8.8	0x6758	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)
Jan 28, 2022 23:58:21.456700087 CET	192.168.2.3	8.8.8.8	0x5a69	Standard query (0)	lh6.googleusercontent.com	A (IP address)	IN (0x0001)
Jan 28, 2022 23:58:25.132940054 CET	192.168.2.3	8.8.8.8	0x775d	Standard query (0)	lh6.googleusercontent.com	A (IP address)	IN (0x0001)
Jan 28, 2022 23:58:31.298986912 CET	192.168.2.3	8.8.8.8	0x4fae	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Jan 28, 2022 23:58:31.860135078 CET	192.168.2.3	8.8.8.8	0xb855	Standard query (0)	protective-glistening-people.glitch.me	A (IP address)	IN (0x0001)
Jan 28, 2022 23:58:32.856645107 CET	192.168.2.3	8.8.8.8	0x25c6	Standard query (0)	cdn.glitch.com	A (IP address)	IN (0x0001)
Jan 28, 2022 23:58:32.856704950 CET	192.168.2.3	8.8.8.8	0xb011	Standard query (0)	cloud.webtype.com	A (IP address)	IN (0x0001)
Jan 28, 2022 23:58:33.093566895 CET	192.168.2.3	8.8.8.8	0xf034	Standard query (0)	cloud.typenetwork.com	A (IP address)	IN (0x0001)
Jan 28, 2022 23:58:33.100244045 CET	192.168.2.3	8.8.8.8	0x8e9d	Standard query (0)	cdn.glitch.me	A (IP address)	IN (0x0001)
Jan 28, 2022 23:58:34.312412977 CET	192.168.2.3	8.8.8.8	0xfb10	Standard query (0)	cdn.glitch.com	A (IP address)	IN (0x0001)
Jan 28, 2022 23:58:34.426024914 CET	192.168.2.3	8.8.8.8	0x3c3e	Standard query (0)	cdn.glitch.me	A (IP address)	IN (0x0001)
Jan 28, 2022 23:59:11.692863941 CET	192.168.2.3	8.8.8.8	0xb51a	Standard query (0)	sites.google.com	A (IP address)	IN (0x0001)
Jan 28, 2022 23:59:12.016277075 CET	192.168.2.3	8.8.8.8	0xad5d	Standard query (0)	lh4.googleusercontent.com	A (IP address)	IN (0x0001)
Jan 28, 2022 23:59:13.826853037 CET	192.168.2.3	8.8.8.8	0x6f2c	Standard query (0)	lh4.googleusercontent.com	A (IP address)	IN (0x0001)
Jan 28, 2022 23:59:14.052962065 CET	192.168.2.3	8.8.8.8	0xfea1	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jan 28, 2022 23:58:10.920737982 CET	8.8.8.8	192.168.2.3	0xeee0	No error (0)	sites.google.com		142.250.203.110	A (IP address)	IN (0x0001)
Jan 28, 2022 23:58:10.925137997 CET	8.8.8.8	192.168.2.3	0xde84	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)
Jan 28, 2022 23:58:10.925137997 CET	8.8.8.8	192.168.2.3	0xde84	No error (0)	clients.l.google.com		142.250.203.110	A (IP address)	IN (0x0001)
Jan 28, 2022 23:58:10.928273916 CET	8.8.8.8	192.168.2.3	0xc196	No error (0)	accounts.google.com		142.250.203.109	A (IP address)	IN (0x0001)
Jan 28, 2022 23:58:11.725358009 CET	8.8.8.8	192.168.2.3	0x77df	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)
Jan 28, 2022 23:58:11.725358009 CET	8.8.8.8	192.168.2.3	0x77df	No error (0)	plus.l.google.com		172.217.168.46	A (IP address)	IN (0x0001)
Jan 28, 2022 23:58:11.884643078 CET	8.8.8.8	192.168.2.3	0x90bc	No error (0)	gstaticadssl.l.google.com		216.58.215.227	A (IP address)	IN (0x0001)
Jan 28, 2022 23:58:12.026920080 CET	8.8.8.8	192.168.2.3	0x8855	No error (0)	lh5.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)
Jan 28, 2022 23:58:12.026920080 CET	8.8.8.8	192.168.2.3	0x8855	No error (0)	googlehosted.l.googleusercontent.com		172.217.168.33	A (IP address)	IN (0x0001)
Jan 28, 2022 23:58:12.066551924 CET	8.8.8.8	192.168.2.3	0xc44d	No error (0)	lh3.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)
Jan 28, 2022 23:58:12.066551924 CET	8.8.8.8	192.168.2.3	0xc44d	No error (0)	googlehosted.l.googleusercontent.com		172.217.168.33	A (IP address)	IN (0x0001)
Jan 28, 2022 23:58:15.258737087 CET	8.8.8.8	192.168.2.3	0xd999	No error (0)	lh5.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)
Jan 28, 2022 23:58:15.258737087 CET	8.8.8.8	192.168.2.3	0xd999	No error (0)	googlehosted.l.googleusercontent.com		172.217.168.33	A (IP address)	IN (0x0001)
Jan 28, 2022 23:58:15.311266899 CET	8.8.8.8	192.168.2.3	0xbaaf	No error (0)	lh3.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)
Jan 28, 2022 23:58:15.311266899 CET	8.8.8.8	192.168.2.3	0xbaaf	No error (0)	googlehosted.l.googleusercontent.com		172.217.168.33	A (IP address)	IN (0x0001)
Jan 28, 2022 23:58:17.406759977 CET	8.8.8.8	192.168.2.3	0x6758	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)
Jan 28, 2022 23:58:17.406759977 CET	8.8.8.8	192.168.2.3	0x6758	No error (0)	googlehosted.l.googleusercontent.com		172.217.168.33	A (IP address)	IN (0x0001)
Jan 28, 2022 23:58:21.483701944 CET	8.8.8.8	192.168.2.3	0x5a69	No error (0)	lh6.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)
Jan 28, 2022 23:58:21.483701944 CET	8.8.8.8	192.168.2.3	0x5a69	No error (0)	googlehosted.l.googleusercontent.com		172.217.168.33	A (IP address)	IN (0x0001)
Jan 28, 2022 23:58:25.172384024 CET	8.8.8.8	192.168.2.3	0x775d	No error (0)	lh6.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)
Jan 28, 2022 23:58:25.172384024 CET	8.8.8.8	192.168.2.3	0x775d	No error (0)	googlehosted.l.googleusercontent.com		172.217.168.33	A (IP address)	IN (0x0001)
Jan 28, 2022 23:58:31.316028118 CET	8.8.8.8	192.168.2.3	0x4fae	No error (0)	www.google.com		142.250.203.100	A (IP address)	IN (0x0001)
Jan 28, 2022 23:58:31.880858898 CET	8.8.8.8	192.168.2.3	0xb855	No error (0)	protective-glistening-people.glitch.me		23.23.235.119	A (IP address)	IN (0x0001)
Jan 28, 2022 23:58:31.880858898 CET	8.8.8.8	192.168.2.3	0xb855	No error (0)	protective-glistening-people.glitch.me		52.44.125.193	A (IP address)	IN (0x0001)
Jan 28, 2022 23:58:31.880858898 CET	8.8.8.8	192.168.2.3	0xb855	No error (0)	protective-glistening-people.glitch.me		3.234.98.145	A (IP address)	IN (0x0001)
Jan 28, 2022 23:58:31.880858898 CET	8.8.8.8	192.168.2.3	0xb855	No error (0)	protective-glistening-people.glitch.me		52.71.118.120	A (IP address)	IN (0x0001)
Jan 28, 2022 23:58:31.880858898 CET	8.8.8.8	192.168.2.3	0xb855	No error (0)	protective-glistening-people.glitch.me		52.1.190.243	A (IP address)	IN (0x0001)
Jan 28, 2022 23:58:31.880858898 CET	8.8.8.8	192.168.2.3	0xb855	No error (0)	protective-glistening-people.glitch.me		3.90.93.100	A (IP address)	IN (0x0001)
Jan 28, 2022 23:58:31.880858898 CET	8.8.8.8	192.168.2.3	0xb855	No error (0)	protective-glistening-people.glitch.me		34.203.4.215	A (IP address)	IN (0x0001)
Jan 28, 2022 23:58:31.880858898 CET	8.8.8.8	192.168.2.3	0xb855	No error (0)	protective-glistening-people.glitch.me		52.73.90.113	A (IP address)	IN (0x0001)
Jan 28, 2022 23:58:32.878477097 CET	8.8.8.8	192.168.2.3	0xb011	No error (0)	cloud.webtype.com		188.114.96.7	A (IP address)	IN (0x0001)
Jan 28, 2022 23:58:32.878477097 CET	8.8.8.8	192.168.2.3	0xb011	No error (0)	cloud.webtype.com		188.114.97.7	A (IP address)	IN (0x0001)
Jan 28, 2022 23:58:32.895853996 CET	8.8.8.8	192.168.2.3	0x25c6	No error (0)	cdn.glitch.com		99.86.3.30	A (IP address)	IN (0x0001)
Jan 28, 2022 23:58:32.895853996 CET	8.8.8.8	192.168.2.3	0x25c6	No error (0)	cdn.glitch.com		99.86.3.3	A (IP address)	IN (0x0001)
Jan 28, 2022 23:58:32.895853996 CET	8.8.8.8	192.168.2.3	0x25c6	No error (0)	cdn.glitch.com		99.86.3.71	A (IP address)	IN (0x0001)
Jan 28, 2022 23:58:32.895853996 CET	8.8.8.8	192.168.2.3	0x25c6	No error (0)	cdn.glitch.com		99.86.3.22	A (IP address)	IN (0x0001)
Jan 28, 2022 23:58:33.122436047 CET	8.8.8.8	192.168.2.3	0x8e9d	No error (0)	cdn.glitch.me		143.204.215.64	A (IP address)	IN (0x0001)
Jan 28, 2022 23:58:33.122436047 CET	8.8.8.8	192.168.2.3	0x8e9d	No error (0)	cdn.glitch.me		143.204.215.79	A (IP address)	IN (0x0001)
Jan 28, 2022 23:58:33.122436047 CET	8.8.8.8	192.168.2.3	0x8e9d	No error (0)	cdn.glitch.me		143.204.215.20	A (IP address)	IN (0x0001)
Jan 28, 2022 23:58:33.122436047 CET	8.8.8.8	192.168.2.3	0x8e9d	No error (0)	cdn.glitch.me		143.204.215.14	A (IP address)	IN (0x0001)
Jan 28, 2022 23:58:33.124860048 CET	8.8.8.8	192.168.2.3	0xf034	No error (0)	cloud.typenetwork.com	cs549.wac.deltacdn.net		CNAME (Canonical name)	IN (0x0001)
Jan 28, 2022 23:58:33.124860048 CET	8.8.8.8	192.168.2.3	0xf034	No error (0)	cs549.wac.deltacdn.net		192.229.233.123	A (IP address)	IN (0x0001)
Jan 28, 2022 23:58:34.334079981 CET	8.8.8.8	192.168.2.3	0xfb10	No error (0)	cdn.glitch.com		99.86.3.22	A (IP address)	IN (0x0001)
Jan 28, 2022 23:58:34.334079981 CET	8.8.8.8	192.168.2.3	0xfb10	No error (0)	cdn.glitch.com		99.86.3.3	A (IP address)	IN (0x0001)
Jan 28, 2022 23:58:34.334079981 CET	8.8.8.8	192.168.2.3	0xfb10	No error (0)	cdn.glitch.com		99.86.3.71	A (IP address)	IN (0x0001)
Jan 28, 2022 23:58:34.334079981 CET	8.8.8.8	192.168.2.3	0xfb10	No error (0)	cdn.glitch.com		99.86.3.30	A (IP address)	IN (0x0001)
Jan 28, 2022 23:58:34.449328899 CET	8.8.8.8	192.168.2.3	0x3c3e	No error (0)	cdn.glitch.me		143.204.215.79	A (IP address)	IN (0x0001)
Jan 28, 2022 23:58:34.449328899 CET	8.8.8.8	192.168.2.3	0x3c3e	No error (0)	cdn.glitch.me		143.204.215.64	A (IP address)	IN (0x0001)
Jan 28, 2022 23:58:34.449328899 CET	8.8.8.8	192.168.2.3	0x3c3e	No error (0)	cdn.glitch.me		143.204.215.14	A (IP address)	IN (0x0001)
Jan 28, 2022 23:58:34.449328899 CET	8.8.8.8	192.168.2.3	0x3c3e	No error (0)	cdn.glitch.me		143.204.215.20	A (IP address)	IN (0x0001)
Jan 28, 2022 23:59:11.719955921 CET	8.8.8.8	192.168.2.3	0xb51a	No error (0)	sites.google.com		142.250.203.110	A (IP address)	IN (0x0001)
Jan 28, 2022 23:59:11.982733011 CET	8.8.8.8	192.168.2.3	0x92fe	No error (0)	gstaticadssl.l.google.com		216.58.215.227	A (IP address)	IN (0x0001)
Jan 28, 2022 23:59:12.041351080 CET	8.8.8.8	192.168.2.3	0xad5d	No error (0)	lh4.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)
Jan 28, 2022 23:59:12.041351080 CET	8.8.8.8	192.168.2.3	0xad5d	No error (0)	googlehosted.l.googleusercontent.com		172.217.168.33	A (IP address)	IN (0x0001)
Jan 28, 2022 23:59:13.843605995 CET	8.8.8.8	192.168.2.3	0x6f2c	No error (0)	lh4.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)
Jan 28, 2022 23:59:13.843605995 CET	8.8.8.8	192.168.2.3	0x6f2c	No error (0)	googlehosted.l.googleusercontent.com		172.217.168.33	A (IP address)	IN (0x0001)
Jan 28, 2022 23:59:14.071569920 CET	8.8.8.8	192.168.2.3	0xfea1	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)
Jan 28, 2022 23:59:14.071569920 CET	8.8.8.8	192.168.2.3	0xfea1	No error (0)	plus.l.google.com		172.217.168.46	A (IP address)	IN (0x0001)

Timestamp	kBytes transferred	Direction	Data
2022-01-28 22:58:11 UTC	0	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-01-28 22:58:11 UTC	0	OUT	Data Raw: 20 Data Ascii:
2022-01-28 22:58:11 UTC	0	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 28 Jan 2022 22:58:11 GMT Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-+DPOmqhDqwJmhnBLQbYXqA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'nonce-+DPOmqhDqwJmhnBLQbYXqA' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site,Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-01-28 22:58:11 UTC	1	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2022-01-28 22:58:11 UTC	1	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-01-28 22:58:11 UTC	1	OUT	GET /js/client.js?onload=gapiLoaded HTTP/1.1 Host: apis.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://sites.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=jJzmD0qxDfgyszoaaI0vPvzimEhgK_WopyNzV6DzocPtwXBPptWxjQn_SAKENcDy-ASNSd0fYvf3soeMJw8HSZLmQRnYw-ArHuTfAPqkDVlm9c_PYJzue4IEIpj7SMlgydW3cYI0Vtz-h6ptYgjgMFWSAWg5xrAS0Cr_XlxFVrk
2022-01-28 22:58:11 UTC	2	IN	HTTP/1.1 200 OK Content-Type: application/javascript; charset=utf-8 x-ua-compatible: IE=edge, chrome=1 Timing-Allow-Origin: * Access-Control-Allow-Origin: * Expires: Fri, 28 Jan 2022 22:58:11 GMT Date: Fri, 28 Jan 2022 22:58:11 GMT Cache-Control: private, max-age=1800, stale-while-revalidate=1800 Content-Security-Policy: script-src 'report-sample' 'nonce-lXrS+ETlGDKcKg30UOatbQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin Strict-Transport-Security: max-age=31536000 Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-01-28 22:58:11 UTC	3	IN	Data Raw: 33 32 62 64 0d 0a 76 61 72 20 67 61 70 69 3d 77 69 6e 64 6f 77 2e 67 61 70 69 3d 77 69 6e 64 6f 77 2e 67 61 70 69 7c 7c 7b 7d 3b 67 61 70 69 2e 5f 62 73 3d 6e 65 77 20 44 61 74 65 28 29 2e 67 65 74 54 69 6d 65 28 29 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 2f 2a 0a 0a 20 43 6f 70 79 72 69 67 68 74 20 54 68 65 20 43 6c 6f 73 75 72 65 20 4c 69 62 72 61 72 79 20 41 75 74 68 6f 72 73 2e 0a 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 0a 2a 2f 0a 76 61 72 20 67 3d 74 68 69 73 7c 7c 73 65 6c 66 2c 68 3d 22 63 6c 6f 73 75 72 65 5f 75 69 64 5f 22 2b 28 31 45 39 2a 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 3e 3e 3e 30 29 2c 61 61 3d 30 2c 6e 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 7d Data Ascii: 32bdvar gapi=window.gapi=window.gapi\|\|{};gapi._bs=new Date().getTime();(function(){/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0/var g=this\|\|self,h="closure_uid_"+(1E9Math.random()>>>0),aa=0,n=function(a){return a}
2022-01-28 22:58:11 UTC	3	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 72 2e 4f 42 4a 45 43 54 5f 43 52 45 41 54 45 5f 54 45 53 54 5f 4f 56 45 52 52 49 44 45 20 26 26 2a 2f 0a 76 61 72 20 71 3d 77 69 6e 64 6f 77 2c 74 3d 64 6f 63 75 6d 65 6e 74 2c 62 61 3d 71 2e 6c 6f 63 61 74 69 6f 6e 2c 63 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 64 61 3d 2f 5c 5b 6e 61 74 69 76 65 20 63 6f 64 65 5c 5d 2f 2c 79 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 72 65 74 75 72 6e 20 61 5b 62 5d 3d 61 5b 62 5d 7c 7c 63 7d 2c 65 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 61 2e 73 6f 72 74 28 29 3b 66 6f 72 28 76 61 72 20 62 3d 5b 5d 2c 63 3d 76 6f 69 64 20 30 2c 64 3d 30 3b 64 3c 61 2e 6c 65 6e 67 74 68 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 61 5b 64 5d 3b 65 21 3d 63 26 26 62 2e 70 75 73 68 28 65 29 3b 63 Data Ascii: gapi.loader.OBJECT_CREATE_TEST_OVERRIDE &&*/var q=window,t=document,ba=q.location,ca=function(){},da=/\[native code\]/,y=function(a,b,c){return a[b]=a[b]\|\|c},ea=function(a){a=a.sort();for(var b=[],c=void 0,d=0;d<a.length;d++){var e=a[d];e!=c&&b.push(e);c
2022-01-28 22:58:11 UTC	4	IN	Data Raw: 5d 2c 52 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 42 61 64 20 68 69 6e 74 22 2b 28 61 3f 22 3a 20 22 2b 61 3a 22 22 29 29 3b 7d 3b 50 2e 70 75 73 68 28 5b 22 6a 73 6c 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 66 6f 72 28 76 61 72 20 62 20 69 6e 20 61 29 69 66 28 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 63 3f 44 5b 62 5d 3d 79 28 44 2c 62 2c 5b 5d 29 2e 63 6f 6e 63 61 74 28 63 29 3a 79 28 44 2c 62 2c 63 29 7d 69 66 28 62 3d 61 2e 75 29 61 3d 79 28 44 2c 22 75 73 22 2c 5b 5d 29 2c 61 2e 70 75 73 68 28 62 29 2c 28 62 3d 2f 5e 68 74 74 70 73 3a 28 2e 2a Data Ascii: ],R=function(a){throw Error("Bad hint"+(a?": "+a:""));};P.push(["jsl",function(a){for(var b in a)if(Object.prototype.hasOwnProperty.call(a,b)){var c=a[b];"object"==typeof c?D[b]=y(D,b,[]).concat(c):y(D,b,c)}if(b=a.u)a=y(D,"us",[]),a.push(b),(b=/^https:(.*
2022-01-28 22:58:11 UTC	6	IN	Data Raw: 2c 0a 22 2c 22 29 2e 72 65 70 6c 61 63 65 28 2f 25 32 46 2f 67 2c 22 2f 22 29 2c 22 2f 6b 3d 22 2c 65 28 61 2e 76 65 72 73 69 6f 6e 29 2c 22 2f 6d 3d 22 2c 65 28 62 29 2c 64 3f 22 2f 65 78 6d 3d 22 2b 65 28 64 29 3a 22 22 2c 22 2f 72 74 3d 6a 2f 73 76 3d 31 2f 64 3d 31 2f 65 64 3d 31 22 2c 61 2e 67 3f 22 2f 61 6d 3d 22 2b 65 28 61 2e 67 29 3a 22 22 2c 61 2e 69 3f 22 2f 72 73 3d 22 2b 65 28 61 2e 69 29 3a 22 22 2c 61 2e 6a 3f 22 2f 74 3d 22 2b 65 28 61 2e 6a 29 3a 22 22 2c 22 2f 63 62 3d 22 2c 65 28 63 29 5d 2e 6a 6f 69 6e 28 22 22 29 7d 2c 72 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 22 2f 22 21 3d 3d 61 2e 63 68 61 72 41 74 28 30 29 26 26 52 28 22 72 65 6c 61 74 69 76 65 20 70 61 74 68 22 29 3b 66 6f 72 28 76 61 72 20 62 3d 61 2e 73 75 62 73 74 72 69 6e Data Ascii: ,",").replace(/%2F/g,"/"),"/k=",e(a.version),"/m=",e(b),d?"/exm="+e(d):"","/rt=j/sv=1/d=1/ed=1",a.g?"/am="+e(a.g):"",a.i?"/rs="+e(a.i):"",a.j?"/t="+e(a.j):"","/cb=",e(c)].join("")},ra=function(a){"/"!==a.charAt(0)&&R("relative path");for(var b=a.substrin
2022-01-28 22:58:11 UTC	7	IN	Data Raw: 22 29 2c 57 3d 2f 5e 5b 2d 2b 5f 30 2d 39 5c 2f 41 2d 5a 61 2d 7a 5d 2b 3d 7b 30 2c 32 7d 24 2f 2c 58 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 66 6f 72 28 76 61 72 20 63 3d 5b 5d 2c 64 3d 30 3b 64 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 64 29 7b 76 61 72 20 65 3d 61 5b 64 5d 2c 66 3b 69 66 28 66 3d 65 29 7b 61 3a 7b 66 6f 72 28 66 3d 30 3b 66 3c 62 2e 6c 65 6e 67 74 68 3b 66 2b 2b 29 69 66 28 62 5b 66 5d 3d 3d 3d 65 29 62 72 65 61 6b 20 61 3b 66 3d 2d 31 7d 66 3d 30 3e 66 7d 66 26 26 63 2e 70 75 73 68 28 65 29 7d 72 65 74 75 72 6e 20 63 7d 2c 75 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3d 44 2e 6e 6f 6e 63 65 3b 72 65 74 75 72 6e 20 76 6f 69 64 20 30 21 3d 3d 61 3f 61 26 26 61 3d 3d 3d 53 74 72 69 6e 67 28 61 29 26 26 61 2e 6d 61 74 63 68 28 Data Ascii: "),W=/^[-+_0-9\/A-Za-z]+={0,2}$/,X=function(a,b){for(var c=[],d=0;d<a.length;++d){var e=a[d],f;if(f=e){a:{for(f=0;f<b.length;f++)if(b[f]===e)break a;f=-1}f=0>f}f&&c.push(e)}return c},ua=function(){var a=D.nonce;return void 0!==a?a&&a===String(a)&&a.match(
2022-01-28 22:58:11 UTC	8	IN	Data Raw: 20 66 3d 6e 75 6c 6c 3b 66 3d 62 2e 73 68 69 66 74 28 29 3b 29 7b 76 61 72 20 6b 3d 66 2e 73 70 6c 69 74 28 22 2e 22 29 3b 6b 3d 65 5b 66 5d 7c 7c 65 5b 6b 5b 31 5d 26 26 22 6e 73 3a 22 2b 6b 5b 30 5d 7c 7c 22 22 5d 7c 7c 64 3b 76 61 72 20 6c 3d 61 2e 6c 65 6e 67 74 68 26 26 61 5b 61 2e 6c 65 6e 67 74 68 2d 31 5d 7c 7c 6e 75 6c 6c 2c 6d 3d 6c 3b 6c 26 26 6c 2e 68 69 6e 74 3d 3d 6b 7c 7c 28 6d 3d 7b 68 69 6e 74 3a 6b 2c 66 65 61 74 75 72 65 73 3a 5b 5d 7d 2c 61 2e 70 75 73 68 28 6d 29 29 3b 6d 2e 66 65 61 74 75 72 65 73 2e 70 75 73 68 28 66 29 7d 76 61 72 20 70 3d 61 2e 6c 65 6e 67 74 68 3b 0a 69 66 28 31 3c 70 29 7b 76 61 72 20 75 3d 63 2e 63 61 6c 6c 62 61 63 6b 3b 75 26 26 28 63 2e 63 61 6c 6c 62 61 63 6b 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 30 3d 3d 2d Data Ascii: f=null;f=b.shift();){var k=f.split(".");k=e[f]\|\|e[k[1]&&"ns:"+k[0]\|\|""]\|\|d;var l=a.length&&a[a.length-1]\|\|null,m=l;l&&l.hint==k\|\|(m={hint:k,features:[]},a.push(m));m.features.push(f)}var p=a.length;if(1<p){var u=c.callback;u&&(c.callback=function(){0==-
2022-01-28 22:58:11 UTC	9	IN	Data Raw: 28 61 29 7d 65 6c 73 65 20 76 5b 77 5d 28 63 61 29 7d 65 6c 73 65 20 66 61 28 72 29 26 26 64 26 26 64 28 29 7d 2c 43 61 3b 76 61 72 20 44 61 3d 6e 75 6c 6c 2c 5a 3d 67 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 69 66 28 5a 26 26 5a 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 29 74 72 79 7b 44 61 3d 5a 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 28 22 67 61 70 69 23 67 61 70 69 22 2c 7b 63 72 65 61 74 65 48 54 4d 4c 3a 6e 2c 63 72 65 61 74 65 53 63 72 69 70 74 3a 6e 2c 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 3a 6e 7d 29 7d 63 61 74 63 68 28 61 29 7b 67 2e 63 6f 6e 73 6f 6c 65 26 26 67 2e 63 6f 6e 73 6f 6c 65 2e 65 72 72 6f 72 28 61 2e 6d 65 73 73 61 67 65 29 7d 43 61 3d 44 61 3b 76 61 72 20 59 3d 43 61 3b 76 61 72 20 79 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 Data Ascii: (a)}else v[w](ca)}else fa(r)&&d&&d()},Ca;var Da=null,Z=g.trustedTypes;if(Z&&Z.createPolicy)try{Da=Z.createPolicy("gapi#gapi",{createHTML:n,createScript:n,createScriptURL:n})}catch(a){g.console&&g.console.error(a.message)}Ca=Da;var Y=Ca;var ya=function(a,b
2022-01-28 22:58:11 UTC	11	IN	Data Raw: 73 22 3a 66 61 6c 73 65 7d 2c 22 73 69 67 6e 49 6e 44 65 70 72 65 63 61 74 69 6f 6e 22 3a 7b 22 72 61 74 65 22 3a 30 2e 30 7d 2c 22 69 6e 63 6c 75 64 65 5f 67 72 61 6e 74 65 64 5f 73 63 6f 70 65 73 22 3a 74 72 75 65 2c 22 6c 6c 61 6e 67 22 3a 22 65 6e 22 2c 22 69 66 72 61 6d 65 73 22 3a 7b 22 79 6f 75 74 75 62 65 22 3a 7b 22 70 61 72 61 6d 73 22 3a 7b 22 6c 6f 63 61 74 69 6f 6e 22 3a 5b 22 73 65 61 72 63 68 22 2c 22 68 61 73 68 22 5d 7d 2c 22 75 72 6c 22 3a 22 3a 73 6f 63 69 61 6c 68 6f 73 74 3a 2f 3a 73 65 73 73 69 6f 6e 5f 70 72 65 66 69 78 3a 5f 2f 77 69 64 67 65 74 2f 72 65 6e 64 65 72 2f 79 6f 75 74 75 62 65 3f 75 73 65 67 61 70 69 5c 75 30 30 33 64 31 22 2c 22 6d 65 74 68 6f 64 73 22 3a 5b 22 73 63 72 6f 6c 6c 22 2c 22 6f 70 65 6e 77 69 6e 64 6f 77 Data Ascii: s":false},"signInDeprecation":{"rate":0.0},"include_granted_scopes":true,"llang":"en","iframes":{"youtube":{"params":{"location":["search","hash"]},"url":":socialhost:/:session_prefix:_/widget/render/youtube?usegapi\u003d1","methods":["scroll","openwindow
2022-01-28 22:58:11 UTC	12	IN	Data Raw: 3a 73 65 73 73 69 6f 6e 5f 70 72 65 66 69 78 3a 75 69 2f 77 69 64 67 65 74 76 69 65 77 3f 75 73 65 67 61 70 69 5c 75 30 30 33 64 31 22 7d 2c 22 73 75 72 76 65 79 6f 70 74 69 6e 22 3a 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 68 6f 70 70 69 6e 67 2f 63 75 73 74 6f 6d 65 72 72 65 76 69 65 77 73 2f 6f 70 74 69 6e 3f 75 73 65 67 61 70 69 5c 75 30 30 33 64 31 22 7d 2c 22 3a 73 6f 63 69 61 6c 68 6f 73 74 3a 22 3a 22 68 74 74 70 73 3a 2f 2f 61 70 69 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 2c 22 73 68 6f 72 74 6c 69 73 74 73 22 3a 7b 22 75 72 6c 22 3a 22 22 7d 2c 22 68 61 6e 67 6f 75 74 22 3a 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 74 61 6c 6b 67 61 64 67 65 74 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 3a 73 Data Ascii: :session_prefix:ui/widgetview?usegapi\u003d1"},"surveyoptin":{"url":"https://www.google.com/shopping/customerreviews/optin?usegapi\u003d1"},":socialhost:":"https://apis.google.com","shortlists":{"url":""},"hangout":{"url":"https://talkgadget.google.com/:s
2022-01-28 22:58:11 UTC	13	IN	Data Raw: 73 65 67 61 70 69 5c 75 30 30 33 64 31 22 7d 2c 22 76 69 73 69 62 69 6c 69 74 79 22 3a 7b 22 70 61 72 61 6d 73 22 3a 7b 22 75 72 6c 22 3a 22 22 7d 2c 22 75 72 6c 22 3a 22 3a 73 6f 63 69 61 6c 68 6f 73 74 3a 2f 3a 73 65 73 73 69 6f 6e 5f 70 72 65 66 69 78 3a 5f 2f 77 69 64 67 65 74 2f 72 65 6e 64 65 72 2f 76 69 73 69 62 69 6c 69 74 79 3f 75 73 65 67 61 70 69 5c 75 30 30 33 64 31 22 7d 2c 22 61 75 74 6f 63 6f 6d 70 6c 65 74 65 22 3a 7b 22 70 61 72 61 6d 73 22 3a 7b 22 75 72 6c 22 3a 22 22 7d 2c 22 75 72 6c 22 3a 22 3a 73 6f 63 69 61 6c 68 6f 73 74 3a 2f 3a 73 65 73 73 69 6f 6e 5f 70 72 65 66 69 78 3a 5f 2f 77 69 64 67 65 74 2f 72 65 6e 64 65 72 2f 61 75 74 6f 63 6f 6d 70 6c 65 74 65 22 7d 2c 22 61 64 64 69 74 6e 6f 77 22 3a 7b 22 75 72 6c 22 3a 22 68 74 74 Data Ascii: segapi\u003d1"},"visibility":{"params":{"url":""},"url":":socialhost:/:session_prefix:_/widget/render/visibility?usegapi\u003d1"},"autocomplete":{"params":{"url":""},"url":":socialhost:/:session_prefix:_/widget/render/autocomplete"},"additnow":{"url":"htt
2022-01-28 22:58:11 UTC	15	IN	Data Raw: 6c 75 73 62 75 74 74 6f 6e 63 6f 6e 66 69 67 75 72 61 74 6f 72 3f 75 73 65 67 61 70 69 5c 75 30 30 33 64 31 22 7d 2c 22 7a 6f 6f 6d 61 62 6c 65 69 6d 61 67 65 22 3a 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 73 73 6c 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 6d 69 63 72 6f 73 63 6f 70 65 2f 65 6d 62 65 64 2f 22 7d 2c 22 61 70 70 66 69 6e 64 65 72 22 3a 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 6f 72 6b 73 70 61 63 65 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 3a 73 65 73 73 69 6f 6e 5f 70 72 65 66 69 78 3a 6d 61 72 6b 65 74 70 6c 61 63 65 2f 61 70 70 66 69 6e 64 65 72 3f 75 73 65 67 61 70 69 5c 75 30 30 33 64 31 22 7d 2c 22 73 61 76 65 74 6f 77 61 6c 6c 65 74 22 3a 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 70 61 79 2e 67 6f 6f 67 6c 65 2e 63 6f Data Ascii: lusbuttonconfigurator?usegapi\u003d1"},"zoomableimage":{"url":"https://ssl.gstatic.com/microscope/embed/"},"appfinder":{"url":"https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi\u003d1"},"savetowallet":{"url":"https://pay.google.co
2022-01-28 22:58:11 UTC	15	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-01-28 22:58:28 UTC	2250	OUT	GET /euiTtl5YpLaigmurPUkZw8LgCI3Cvc6YXnZD-if7GoPGunMGl9cWeVD4qAD8fNhTnkVAzexO_aBGu90P0J3WBAU=w16383 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36 Host: lh5.googleusercontent.com If-None-Match: "v1"
2022-01-28 22:58:28 UTC	2251	IN	HTTP/1.1 304 Not Modified Date: Fri, 28 Jan 2022 22:58:12 GMT Expires: Sat, 29 Jan 2022 22:58:12 GMT ETag: "v1" Cache-Control: public, max-age=86400, no-transform Vary: origin Age: 16 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close

Timestamp	kBytes transferred	Direction	Data
2022-01-28 22:58:31 UTC	2529	OUT	GET /euiTtl5YpLaigmurPUkZw8LgCI3Cvc6YXnZD-if7GoPGunMGl9cWeVD4qAD8fNhTnkVAzexO_aBGu90P0J3WBAU=w16383 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36 Host: lh5.googleusercontent.com If-None-Match: "v1"
2022-01-28 22:58:31 UTC	2529	IN	HTTP/1.1 304 Not Modified Date: Fri, 28 Jan 2022 22:58:12 GMT Expires: Sat, 29 Jan 2022 22:58:12 GMT ETag: "v1" Cache-Control: public, max-age=86400, no-transform Vary: origin Age: 19 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close

Timestamp	kBytes transferred	Direction	Data
2022-01-28 22:58:31 UTC	2529	OUT	GET /url?q=https%3A%2F%2Fprotective-glistening-people.glitch.me%2Fa.html&sa=D&sntz=1&usg=AFQjCNE3AXCYZpM83juSb429VtosyK-bUg HTTP/1.1 Host: www.google.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=jJzmD0qxDfgyszoaaI0vPvzimEhgK_WopyNzV6DzocPtwXBPptWxjQn_SAKENcDy-ASNSd0fYvf3soeMJw8HSZLmQRnYw-ArHuTfAPqkDVlm9c_PYJzue4IEIpj7SMlgydW3cYI0Vtz-h6ptYgjgMFWSAWg5xrAS0Cr_XlxFVrk
2022-01-28 22:58:31 UTC	2530	IN	HTTP/1.1 200 OK Location: https://protective-glistening-people.glitch.me/a.html Cache-Control: private Content-Type: text/html; charset=UTF-8 Strict-Transport-Security: max-age=31536000 BFCache-Opt-In: unload Date: Fri, 28 Jan 2022 22:58:31 GMT Server: gws Content-Length: 415 X-XSS-Protection: 0 Set-Cookie: CONSENT=PENDING+710; expires=Sun, 28-Jan-2024 22:58:31 GMT; path=/; domain=.google.com; Secure P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Expires: Fri, 28 Jan 2022 22:58:31 GMT Connection: close
2022-01-28 22:58:31 UTC	2531	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 52 65 64 69 72 65 63 74 69 6e 67 3c 2f 54 49 54 4c 45 3e 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 31 3b 20 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 70 72 6f 74 65 63 74 69 76 65 2d 67 6c 69 73 74 65 6e 69 6e 67 2d 70 65 6f 70 6c 65 2e 67 6c 69 74 63 68 2e 6d 65 2f 61 2e 68 74 6d 6c 22 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 6f 6e 4c 6f 61 64 3d 22 6c 6f 63 61 74 69 6f 6e 2e 72 65 70 6c 61 63 65 28 27 68 74 74 70 73 3a 2f 2f 70 Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>Redirecting</TITLE><META HTTP-EQUIV="refresh" content="1; url=https://protective-glistening-people.glitch.me/a.html"></HEAD><BODY onLoad="location.replace('https://p

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://sites.google.com/view/familyfocusfederalcreditunion/home

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Sigma Overview

Jbx Signature Overview

AV Detection

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic

C:\Users\user\AppData\Local\Google\Chrome\User Data\11ff09ac-056c-430d-8288-e9e92e305686.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\1307d5b2-0e1e-4238-a2f3-f1384dbcb578.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\39522bc7-048e-434e-923b-22ec680410f6.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\4c446f1f-32b6-4067-be6b-a0a5a7f91f3a.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\501ab157-e117-4f8b-bdd8-4daef4c8162e.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\579c81eb-afe3-4c71-971e-f6bbf6ef9fa8.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\65a72ca2-7a3c-4779-bf88-a0bb91768872.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\912315ca-ddee-4984-b61e-a00b9e98c4d2.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\95daa17c-65ee-46d8-8efa-40617912201d.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\18a0d323-daa0-451c-9a20-bd8d186e1c29.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\28e41dcd-2b8b-480c-a9d2-5d9de5481d39.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\46da34e0-4db8-484a-aabc-cdd5ebd659ff.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\493b6be8-2012-42aa-ac33-3cb09a8d7058.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\496f024f-dfeb-47b0-8288-41469bd7def4.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\66a3cd96-f9b7-466c-bf82-b0ebcfa77a53.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\72f6fcb1-f00f-44eb-887e-700edd68e9d0.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\78746359-a596-484c-b31d-c11ce478eba7.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\7e6f1281-ef75-4b09-9050-42a49a38ee47.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\85eb2c04-b3d2-411c-8072-eda738d89773.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\87aeb489-bc4a-48ee-8863-0d1cb69b3c73.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\8cd6fa24-9b29-4a08-a2e0-37d33f392fd3.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\9512c54c-cd06-49fa-81d4-b82936e6eef6.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\984bd38e-cbe3-4900-a001-e4c76ee7e85c.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\9ae9854f-5d5c-4542-861e-89c50107d4cf.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase\LOG

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase\LOG.oldp (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG

Windows Analysis Report
https://sites.google.com/view/familyfocusfederalcreditunion/home

Timestamp	kBytes transferred	Direction	Data
2022-01-28 22:58:32 UTC	2531	OUT	GET /a.html HTTP/1.1 Host: protective-glistening-people.glitch.me Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://www.google.com/url?q=https%3A%2F%2Fprotective-glistening-people.glitch.me%2Fa.html&sa=D&sntz=1&usg=AFQjCNE3AXCYZpM83juSb429VtosyK-bUg Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-01-28 22:58:32 UTC	2532	IN	HTTP/1.1 403 Forbidden Date: Fri, 28 Jan 2022 22:58:32 GMT Content-Type: text/html; charset=utf-8 Content-Length: 1930 Connection: close Cache-Control: max-age=0 ETag: W/"78a-v/0NQwFUHD+MwdUDXLgAso0Y8f8"
2022-01-28 22:58:32 UTC	2532	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4f 6f 70 73 21 20 54 68 69 73 20 70 72 6f 6a 65 63 74 20 69 73 6e 27 74 20 72 75 6e 6e 69 6e 67 2e 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 6c 6f Data Ascii: <!DOCTYPE html><html lang="en"> <head> <meta charset="utf-8"> <title>Oops! This project isn't running.</title> <meta name="viewport" content="initial-scale=1, width=device-width"> <link rel="stylesheet" type="text/css" href="https://clo

Timestamp	kBytes transferred	Direction	Data
2022-01-28 22:58:32 UTC	2534	OUT	GET /css/3a8e55c6-b1f3-4659-99eb-125ae72bd084.css HTTP/1.1 Host: cloud.webtype.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://protective-glistening-people.glitch.me/a.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-01-28 22:58:32 UTC	2534	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 28 Jan 2022 22:58:32 GMT Transfer-Encoding: chunked Connection: close Cache-Control: max-age=3600 Expires: Fri, 28 Jan 2022 23:58:32 GMT Location: https://cloud.typenetwork.com/css/3a8e55c6-b1f3-4659-99eb-125ae72bd084.css Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VVzCTbZ534VFiHcUterGGfCVxj2%2BLvW5V7MIWkOAY3VntMEA1DpCXEyuZf4ASdf%2FgG%2B7wQPG19%2Bq74KrF12RcYVrMJHICUYe2rWdBFmLwSnPh7DvYAsyuDBhQNJ26qjMJbCjSQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6d4dd37be9cd5b3e-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2022-01-28 22:58:32 UTC	2535	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-01-28 22:58:33 UTC	2535	OUT	GET /d7f4f279-e13b-4330-8422-00b2d9211424%2FGlitch-Error-Rainbow-Mug-hires.png?v=1595481653593 HTTP/1.1 Host: cdn.glitch.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://protective-glistening-people.glitch.me/a.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-01-28 22:58:33 UTC	2536	IN	HTTP/1.1 301 Moved Permanently Content-Length: 0 Connection: close Date: Fri, 28 Jan 2022 12:23:54 GMT Location: https://cdn.glitch.me/d7f4f279-e13b-4330-8422-00b2d9211424%2FGlitch-Error-Rainbow-Mug-hires.png Server: AmazonS3 Vary: Origin X-Cache: Hit from cloudfront Via: 1.1 62dc260e32d7b9197a4511447f6a264a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA6-C1 X-Amz-Cf-Id: CDiqd2soELKo6fExRdDQeJPwR1UtlRa_DYc7sD1Um4Ew8w9hekovBw== Age: 38080

Timestamp	kBytes transferred	Direction	Data
2022-01-28 22:58:12 UTC	15	OUT	GET /euiTtl5YpLaigmurPUkZw8LgCI3Cvc6YXnZD-if7GoPGunMGl9cWeVD4qAD8fNhTnkVAzexO_aBGu90P0J3WBAU=w16383 HTTP/1.1 Host: lh5.googleusercontent.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://sites.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-01-28 22:58:12 UTC	126	IN	HTTP/1.1 200 OK Access-Control-Expose-Headers: Content-Length ETag: "v1" Expires: Sat, 29 Jan 2022 22:58:12 GMT Cache-Control: public, max-age=86400, no-transform Content-Disposition: inline;filename="Untitled.png" Content-Type: image/png Vary: Origin Access-Control-Allow-Origin: * Timing-Allow-Origin: * X-Content-Type-Options: nosniff Date: Fri, 28 Jan 2022 22:58:12 GMT Server: fife Content-Length: 2338 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2022-01-28 22:58:12 UTC	127	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 c0 00 00 00 c0 08 04 00 00 00 f8 d5 a4 8c 00 00 00 02 73 42 49 54 08 08 55 ec 46 04 00 00 08 db 49 44 41 54 78 9c ed 9d 6b 70 5d 55 15 c7 7f 49 93 02 0d 34 ad 7d a4 a4 92 34 69 53 6a 12 3b ad 69 9b 32 d3 66 e8 8b 82 20 a3 60 ed 38 54 11 11 66 a0 32 7e 41 a7 0c 8c 02 23 3a e3 63 d0 11 d4 0e 8c 28 e3 88 43 14 44 0b 23 96 d2 29 55 8a 82 95 5a 0a 15 8a 94 96 47 91 b6 b4 f6 11 9a 34 39 7e 48 52 13 ee eb e4 9e b5 f7 da f7 66 fd f6 97 3c ee 5d 6b af ff 3a 77 ef 7d f7 d9 7b 1f 30 0c c3 30 0c c3 30 0c c3 30 0c c3 30 0c c3 30 0c c3 30 0c c3 30 0c c3 30 0c c3 30 0c c3 30 0c c3 30 0c a3 d0 29 d1 ae 40 c1 50 c5 0c aa 99 c4 68 4a 28 a7 86 c9 94 52 c7 44 ce 48 66 b6 4c a6 76 45 47 09 93 99 46 03 b5 8c 67 3c 55 34 Data Ascii: PNGIHDRsBITUFIDATxkp]UI4}4iSj;i2f `8Tf2~A#:c(CD#)UZG49~HRf<]k:w}{000000000000)@PhJ(RDHfLvEGFg<U4
2022-01-28 22:58:12 UTC	128	IN	Data Raw: 7c 74 c2 25 ac e5 1a 0f 7e fc 22 32 06 f2 91 80 12 7e ce e7 9d 7b f1 8f 50 17 ec be 09 5a 5b 94 f2 c3 4e 19 33 ae 13 70 5b 11 36 3e bd bc a4 5d 81 38 5c ad 3e 54 74 57 24 d6 56 e3 76 18 7a 29 0f 7b ff a2 e7 8b 63 9c 29 63 c8 9d 40 0b 68 2f 5a f9 e1 9f 52 86 5c 49 34 8e df 31 d2 91 ed 10 d8 21 65 c8 4d 02 4a 68 67 9c 13 cb a1 f0 a2 94 21 37 09 58 c3 22 27 76 c3 41 6c 0c e4 a2 13 9e cb 33 45 dc fa f7 52 c3 5e 19 43 f2 09 38 8d 97 a9 11 b7 1a 16 87 e4 76 df c8 5f a9 b7 14 bd fc f0 bc 9c 29 e9 04 9c c3 57 85 2d 86 88 d8 20 54 3e 01 6b 03 5a bd ef 8e 60 13 70 09 17 89 da 0b 15 91 05 29 bd c8 76 c2 db 69 16 b5 17 26 5d 54 d0 25 65 4c f2 13 b0 7c 58 c8 0f 3b e4 e4 97 4d c0 d7 04 6d 25 61 2f db 9d da 17 6c 80 24 13 d0 cc 62 31 5b f9 73 8c db d9 c2 47 9d fa 10 4d Data Ascii: \|t%~"2~{PZ[N3p[6>]8\>TtW$Vvz){c)c@h/ZR\I41!eMJhg!7X"'vAl3ER^C8v_)W- T>kZ`p)vi&]T%eL\|X;Mm%a/l$b1[sGM
2022-01-28 22:58:12 UTC	129	IN	Data Raw: 5d 31 ce 59 bb 50 55 fe e3 c5 79 ea f5 8d 7d e1 fd 22 c6 6b 53 7b 0d 9f 25 c8 93 10 25 b8 8b 88 78 3b cc df 52 94 ff 2b ce 75 50 a3 84 47 62 6d ef 99 a3 28 ff b7 9d ab a0 ca 48 66 c4 78 d5 d0 ee 28 4b 96 02 bb f3 eb 0a f7 27 9e a7 2f b7 6a 07 1e 06 65 2a ab 40 d3 1d 86 30 4c 69 53 90 ff 28 97 6a 87 dd 8b fb 67 ca e7 e6 7c ef 1e 5f 63 b9 d0 de b6 a2 c0 77 0f f0 58 c8 fb de fd 53 ea 75 1b 6a c7 a0 b3 47 0d a0 d9 a3 fc cf 7b 38 62 70 88 e8 1f c5 eb eb 2c ce 2e ee 60 0e bb 3c 79 8b 8d 7e 27 ec 27 01 1b b8 96 7f 7b f1 54 70 3c e7 bc e1 79 ad 10 b6 9a ea f1 7b a7 e2 6f e3 4a 95 43 5e 0b 8a 46 ee 71 f0 5d b8 9b 75 2c d3 0e ad 70 98 c8 6a d6 8b ad 8b db c9 9a 42 b9 c1 ee f7 e1 23 b9 18 cd 27 59 44 1b f5 79 be ff 08 7f 61 13 4f f2 37 d1 5a 39 25 ac 04 f4 33 99 36 Data Ascii: ]1YPUy}"kS{%%x;R+uPGbm(Hfx(K'/je*@0LiS(jg\|_cwXSujG{8bp,.`<y~''{Tp<y{oJC^Fq]u,pjB#'YDyaO7Z9%36

Timestamp	kBytes transferred	Direction	Data
2022-01-28 22:58:33 UTC	2537	OUT	GET /css/3a8e55c6-b1f3-4659-99eb-125ae72bd084.css HTTP/1.1 Host: cloud.typenetwork.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://protective-glistening-people.glitch.me/a.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-01-28 22:58:33 UTC	2537	IN	HTTP/1.1 301 Moved Permanently Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 13841 Cache-Control: max-age=220752000 CF-Cache-Status: HIT CF-RAY: 6d4dcc0e280a9199-FRA Content-Type: text/html; charset=utf-8 Date: Fri, 28 Jan 2022 22:58:33 GMT Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Expires: Fri, 26 Jan 2029 22:58:33 GMT Last-Modified: Fri, 28 Jan 2022 22:53:28 GMT location: ../projects/5027/fontface.css/ NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} referrer-policy: same-origin Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Vrlnaky5UWF2I95YV9rjbvYFnw4rrDcKDWpotJZ4o2deCZO%2BQeZTqe3RS3hMtsClVLMRRCg5LZIk8iCzoMChB2NE6qkIFJrK1%2B22zF12TmhGUfd51jMMQokcL8aDKGXJCZe3IDM%3D"}],"group":"cf-nel","max_age":604800} Server: ECS (frb/6731) X-Cache: 301-HIT x-content-type-options: nosniff x-frame-options: DENY Content-Length: 0 Connection: close

Timestamp	kBytes transferred	Direction	Data
2022-01-28 22:58:33 UTC	2705	OUT	GET /projects/5027/fontface.css/ HTTP/1.1 Host: cloud.typenetwork.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-01-28 22:58:33 UTC	2705	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Age: 83294 Allow: GET, HEAD, OPTIONS Cache-Control: max-age=10800 CF-Cache-Status: DYNAMIC CF-RAY: 6d45e1f31cc86937-FRA Content-Type: text/css; charset=utf-8 Date: Fri, 28 Jan 2022 22:58:33 GMT Etag: "5da7900fc89b38f6c990ca91e9dad0b1+ident" Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Expires: Sat, 29 Jan 2022 01:58:33 GMT Last-Modified: Thu, 27 Jan 2022 23:32:08 GMT NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gDjOEtS4Yz5CINpxSUga41PtL3UIRsdFrO1b%2F57nDCVlxWXanvpe9O1jglmAJYOXgijnwQq3U%2BFuQr5eRZh7JbH1XwXZrRvUfm2b9EI6u7yognxMF6Qk4veBOYeMHJC32rHJK%2F8%3D"}],"group":"cf-nel","max_age":604800} Server: ECS (frb/6760) Vary: Accept-Encoding X-Cache: HIT X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Length: 896 Connection: close
2022-01-28 22:58:33 UTC	2706	IN	Data Raw: 2f 2a 20 54 68 69 73 20 43 53 53 20 72 65 73 6f 75 72 63 65 20 69 6e 63 6f 72 70 6f 72 61 74 65 73 20 6c 69 6e 6b 73 20 74 6f 20 66 6f 6e 74 20 73 6f 66 74 77 61 72 65 20 77 68 69 63 68 20 69 73 20 74 68 65 0a 20 20 20 76 61 6c 75 61 62 6c 65 20 63 6f 70 79 72 69 67 68 74 65 64 20 70 72 6f 70 65 72 74 79 20 6f 66 20 54 79 70 65 20 4e 65 74 77 6f 72 6b 2c 20 49 6e 63 2e 20 61 6e 64 2f 6f 72 20 74 68 65 69 72 0a 20 20 20 73 75 70 70 6c 69 65 72 73 2e 20 59 6f 75 20 6d 61 79 20 6e 6f 74 20 61 74 74 65 6d 70 74 20 74 6f 20 63 6f 70 79 2c 20 69 6e 73 74 61 6c 6c 2c 20 72 65 64 69 73 74 72 69 62 75 74 65 2c 0a 20 20 20 63 6f 6e 76 65 72 74 2c 20 6d 6f 64 69 66 79 20 6f 72 20 72 65 76 65 72 73 65 20 65 6e 67 69 6e 65 65 72 20 74 68 69 73 20 66 6f 6e 74 20 73 6f Data Ascii: /* This CSS resource incorporates links to font software which is the valuable copyrighted property of Type Network, Inc. and/or their suppliers. You may not attempt to copy, install, redistribute, convert, modify or reverse engineer this font so

Timestamp	kBytes transferred	Direction	Data
2022-01-28 22:58:33 UTC	2707	OUT	GET /favicon.ico HTTP/1.1 Host: protective-glistening-people.glitch.me Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://protective-glistening-people.glitch.me/a.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-01-28 22:58:33 UTC	2708	IN	HTTP/1.1 403 Forbidden Date: Fri, 28 Jan 2022 22:58:33 GMT Content-Type: text/html; charset=utf-8 Content-Length: 1930 Connection: close Cache-Control: max-age=0 ETag: W/"78a-v/0NQwFUHD+MwdUDXLgAso0Y8f8"
2022-01-28 22:58:33 UTC	2708	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4f 6f 70 73 21 20 54 68 69 73 20 70 72 6f 6a 65 63 74 20 69 73 6e 27 74 20 72 75 6e 6e 69 6e 67 2e 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 6c 6f Data Ascii: <!DOCTYPE html><html lang="en"> <head> <meta charset="utf-8"> <title>Oops! This project isn't running.</title> <meta name="viewport" content="initial-scale=1, width=device-width"> <link rel="stylesheet" type="text/css" href="https://clo

Timestamp	kBytes transferred	Direction	Data
2022-01-28 22:58:50 UTC	2710	OUT	GET /kP16MJS18Ayd3NpChe3mU7TpBx9lWrvHykutvAe-LTrCm3VtXOIOTJYTVIu5_E_lRcL-KV9UjhbwnG4qUpwaNis=w16383 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36 Host: lh3.googleusercontent.com
2022-01-28 22:58:50 UTC	2710	IN	HTTP/1.1 200 OK Access-Control-Expose-Headers: Content-Length Content-Disposition: inline;filename="Untitled.png" Vary: Origin Access-Control-Allow-Origin: * Timing-Allow-Origin: * X-Content-Type-Options: nosniff Server: fife Content-Length: 2338 X-XSS-Protection: 0 Date: Fri, 28 Jan 2022 22:58:42 GMT Expires: Sat, 29 Jan 2022 22:58:42 GMT Cache-Control: public, max-age=86400, no-transform ETag: "v1" Content-Type: image/png Age: 8 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2022-01-28 22:58:50 UTC	2711	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 c0 00 00 00 c0 08 04 00 00 00 f8 d5 a4 8c 00 00 00 02 73 42 49 54 08 08 55 ec 46 04 00 00 08 db 49 44 41 54 78 9c ed 9d 6b 70 5d 55 15 c7 7f 49 93 02 0d 34 ad 7d a4 a4 92 34 69 53 6a 12 3b ad 69 9b 32 d3 66 e8 8b 82 20 a3 60 ed 38 54 11 11 66 a0 32 7e 41 a7 0c 8c 02 23 3a e3 63 d0 11 d4 0e 8c 28 e3 88 43 14 44 0b 23 96 d2 29 55 8a 82 95 5a 0a 15 8a 94 96 47 91 b6 b4 f6 11 9a 34 39 7e 48 52 13 ee eb e4 9e b5 f7 da f7 66 fd f6 97 3c ee 5d 6b af ff 3a 77 ef 7d f7 d9 7b 1f 30 0c c3 30 0c c3 30 0c c3 30 0c c3 30 0c c3 30 0c c3 30 0c c3 30 0c c3 30 0c c3 30 0c c3 30 0c c3 30 0c a3 d0 29 d1 ae 40 c1 50 c5 0c aa 99 c4 68 4a 28 a7 86 c9 94 52 c7 44 ce 48 66 b6 4c a6 76 45 47 09 93 99 46 03 b5 8c 67 3c 55 34 Data Ascii: PNGIHDRsBITUFIDATxkp]UI4}4iSj;i2f `8Tf2~A#:c(CD#)UZG49~HRf<]k:w}{000000000000)@PhJ(RDHfLvEGFg<U4
2022-01-28 22:58:50 UTC	2712	IN	Data Raw: d8 54 54 f2 c3 2b 32 66 7c 74 c2 25 ac e5 1a 0f 7e fc 22 32 06 f2 91 80 12 7e ce e7 9d 7b f1 8f 50 17 ec be 09 5a 5b 94 f2 c3 4e 19 33 ae 13 70 5b 11 36 3e bd bc a4 5d 81 38 5c ad 3e 54 74 57 24 d6 56 e3 76 18 7a 29 0f 7b ff a2 e7 8b 63 9c 29 63 c8 9d 40 0b 68 2f 5a f9 e1 9f 52 86 5c 49 34 8e df 31 d2 91 ed 10 d8 21 65 c8 4d 02 4a 68 67 9c 13 cb a1 f0 a2 94 21 37 09 58 c3 22 27 76 c3 41 6c 0c e4 a2 13 9e cb 33 45 dc fa f7 52 c3 5e 19 43 f2 09 38 8d 97 a9 11 b7 1a 16 87 e4 76 df c8 5f a9 b7 14 bd fc f0 bc 9c 29 e9 04 9c c3 57 85 2d 86 88 d8 20 54 3e 01 6b 03 5a bd ef 8e 60 13 70 09 17 89 da 0b 15 91 05 29 bd c8 76 c2 db 69 16 b5 17 26 5d 54 d0 25 65 4c f2 13 b0 7c 58 c8 0f 3b e4 e4 97 4d c0 d7 04 6d 25 61 2f db 9d da 17 6c 80 24 13 d0 cc 62 31 5b f9 73 8c Data Ascii: TT+2f\|t%~"2~{PZ[N3p[6>]8\>TtW$Vvz){c)c@h/ZR\I41!eMJhg!7X"'vAl3ER^C8v_)W- T>kZ`p)vi&]T%eL\|X;Mm%a/l$b1[s
2022-01-28 22:58:50 UTC	2713	IN	Data Raw: 17 e0 e6 c3 ca 53 b3 fa 5d 31 ce 59 bb 50 55 fe e3 c5 79 ea f5 8d 7d e1 fd 22 c6 6b 53 7b 0d 9f 25 c8 93 10 25 b8 8b 88 78 3b cc df 52 94 ff 2b ce 75 50 a3 84 47 62 6d ef 99 a3 28 ff b7 9d ab a0 ca 48 66 c4 78 d5 d0 ee 28 4b 96 02 bb f3 eb 0a f7 27 9e a7 2f b7 6a 07 1e 06 65 2a ab 40 d3 1d 86 30 4c 69 53 90 ff 28 97 6a 87 dd 8b fb 67 ca e7 e6 7c ef 1e 5f 63 b9 d0 de b6 a2 c0 77 0f f0 58 c8 fb de fd 53 ea 75 1b 6a c7 a0 b3 47 0d a0 d9 a3 fc cf 7b 38 62 70 88 e8 1f c5 eb eb 2c ce 2e ee 60 0e bb 3c 79 8b 8d 7e 27 ec 27 01 1b b8 96 7f 7b f1 54 70 3c e7 bc e1 79 ad 10 b6 9a ea f1 7b a7 e2 6f e3 4a 95 43 5e 0b 8a 46 ee 71 f0 5d b8 9b 75 2c d3 0e ad 70 98 c8 6a d6 8b ad 8b db c9 9a 42 b9 c1 ee f7 e1 23 b9 18 cd 27 59 44 1b f5 79 be ff 08 7f 61 13 4f f2 37 d1 5a Data Ascii: S]1YPUy}"kS{%%x;R+uPGbm(Hfx(K'/je*@0LiS(jg\|_cwXSujG{8bp,.`<y~''{Tp<y{oJC^Fq]u,pjB#'YDyaO7Z

Timestamp	kBytes transferred	Direction	Data
2022-01-28 22:58:54 UTC	2890	OUT	GET /kP16MJS18Ayd3NpChe3mU7TpBx9lWrvHykutvAe-LTrCm3VtXOIOTJYTVIu5_E_lRcL-KV9UjhbwnG4qUpwaNis=w16383 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36 Host: lh3.googleusercontent.com If-None-Match: "v1"
2022-01-28 22:58:54 UTC	2891	IN	HTTP/1.1 304 Not Modified Date: Fri, 28 Jan 2022 22:58:42 GMT Expires: Sat, 29 Jan 2022 22:58:42 GMT ETag: "v1" Cache-Control: public, max-age=86400, no-transform Vary: origin Age: 12 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close

Timestamp	kBytes transferred	Direction	Data
2022-01-28 22:58:54 UTC	2890	OUT	GET /3kQPjt2UiNRArAKcmJBR7bqduwSLlNOjb4DbFBRI_jx2JHAzHxTIb7G8CCNShSeSImaFyrn6NIvQELdyg_iRU4Kak0WhkAZTIv3jFLcUkem251rY5URIuKC_2lY-AEH6Gw=w1280 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36 Host: lh5.googleusercontent.com If-None-Match: "v1"
2022-01-28 22:58:54 UTC	2891	IN	HTTP/1.1 304 Not Modified Date: Fri, 28 Jan 2022 22:58:49 GMT Expires: Sat, 29 Jan 2022 22:58:49 GMT ETag: "v1" Cache-Control: public, max-age=86400, no-transform Vary: origin Age: 5 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close