Edit tour

Windows Analysis Report
https://express.adobe.com/page/vCTYm3h0r9BmZ/

Overview

General Information

Sample URL:	https://express.adobe.com/page/vCTYm3h0r9BmZ/
Analysis ID:	634892
Infos:

Detection

HTMLPhisher

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Phishing site detected (based on favicon image match)

Multi AV Scanner detection for domain / URL

Yara detected HtmlPhish10

Antivirus detection for URL or domain

Phishing site detected (based on logo template match)

Phishing site detected (based on image similarity)

Invalid 'forgot password' link found

HTML body contains low number of good links

No HTML title found

Classification

Process Tree

System is w10x64

chrome.exe (PID: 4688 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "https://express.adobe.com/page/vCTYm3h0r9BmZ/ MD5: C139654B5C1438A95B321BB01AD63EF6)

chrome.exe (PID: 5704 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1536,9034208647699705229,2968724141011212704,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1932 /prefetch:8 MD5: C139654B5C1438A95B321BB01AD63EF6)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author	Strings
57046.2.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8

Source: https://storageapi.fleek.co/84e74610-b8bb-4d6b-b394-8b4c2ffd51df-bucket/loginlg.html	HTTP Parser: Invalid link: Forgot password?
Source: https://storageapi.fleek.co/84e74610-b8bb-4d6b-b394-8b4c2ffd51df-bucket/loginlg.html	HTTP Parser: Invalid link: Forgot password?

Source: https://storageapi.fleek.co/84e74610-b8bb-4d6b-b394-8b4c2ffd51df-bucket/loginlg.html	HTTP Parser: Number of links: 0
Source: https://storageapi.fleek.co/84e74610-b8bb-4d6b-b394-8b4c2ffd51df-bucket/loginlg.html	HTTP Parser: Number of links: 0

Source: https://express.adobe.com/page/vCTYm3h0r9BmZ/	HTTP Parser: HTML title missing
Source: https://express.adobe.com/page/vCTYm3h0r9BmZ/	HTTP Parser: HTML title missing
Source: https://storageapi.fleek.co/84e74610-b8bb-4d6b-b394-8b4c2ffd51df-bucket/loginlg.html	HTTP Parser: HTML title missing
Source: https://storageapi.fleek.co/84e74610-b8bb-4d6b-b394-8b4c2ffd51df-bucket/loginlg.html	HTTP Parser: HTML title missing

Source: https://express.adobe.com/page/vCTYm3h0r9BmZ/	HTTP Parser: No <meta name="author".. found
Source: https://express.adobe.com/page/vCTYm3h0r9BmZ/	HTTP Parser: No <meta name="author".. found
Source: https://storageapi.fleek.co/84e74610-b8bb-4d6b-b394-8b4c2ffd51df-bucket/loginlg.html	HTTP Parser: No <meta name="author".. found
Source: https://storageapi.fleek.co/84e74610-b8bb-4d6b-b394-8b4c2ffd51df-bucket/loginlg.html	HTTP Parser: No <meta name="author".. found

Source: https://express.adobe.com/page/vCTYm3h0r9BmZ/	HTTP Parser: No <meta name="copyright".. found
Source: https://express.adobe.com/page/vCTYm3h0r9BmZ/	HTTP Parser: No <meta name="copyright".. found
Source: https://storageapi.fleek.co/84e74610-b8bb-4d6b-b394-8b4c2ffd51df-bucket/loginlg.html	HTTP Parser: No <meta name="copyright".. found
Source: https://storageapi.fleek.co/84e74610-b8bb-4d6b-b394-8b4c2ffd51df-bucket/loginlg.html	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 192.229.221.185:443 -> 192.168.2.4:49859 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.229.221.185:443 -> 192.168.2.4:49858 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.36.4:443 -> 192.168.2.4:49863 version: TLS 1.2

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-GB&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-85.0.4183.121Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /page/vCTYm3h0r9BmZ/ HTTP/1.1Host: express.adobe.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /runtime/1.22/runtime.gz.css HTTP/1.1Host: page.adobespark-assets.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://express.adobe.com/page/vCTYm3h0r9BmZ/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /runtime/1.22/base-fonts.gz.js HTTP/1.1Host: page.adobespark-assets.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://express.adobe.com/page/vCTYm3h0r9BmZ/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /runtime/1.22/themes/crisp-fonts.gz.js HTTP/1.1Host: page.adobespark-assets.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://express.adobe.com/page/vCTYm3h0r9BmZ/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /runtime/1.22/typekit-load.gz.js HTTP/1.1Host: page.adobespark-assets.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://express.adobe.com/page/vCTYm3h0r9BmZ/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /runtime/1.22/runtime-prod.gz.js HTTP/1.1Host: page.adobespark-assets.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://express.adobe.com/page/vCTYm3h0r9BmZ/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /page/vCTYm3h0r9BmZ/images/65f2db0b-a9a2-4e3f-a3cc-4ceb8b95070a.jpg?asset_id=28473c5e-fccc-48a8-ae56-02056c508df3&img_etag=%2280295e77d4dd928afc99fa38c0fe7bd4%22&size=1024 HTTP/1.1Host: express.adobe.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://express.adobe.com/page/vCTYm3h0r9BmZ/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /experiments/chrome/chrome.js HTTP/1.1Host: page.adobespark-assets.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://express.adobe.com/page/vCTYm3h0r9BmZ/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /runtime/1.22/images/right-arrow.png HTTP/1.1Host: page.adobespark-assets.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://page.adobespark-assets.com/runtime/1.22/runtime.gz.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /runtime/1.22/images/left-arrow.png HTTP/1.1Host: page.adobespark-assets.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://page.adobespark-assets.com/runtime/1.22/runtime.gz.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /runtime/1.22/images/lightbox_close@2x.png HTTP/1.1Host: page.adobespark-assets.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://page.adobespark-assets.com/runtime/1.22/runtime.gz.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /page/vCTYm3h0r9BmZ/images/65f2db0b-a9a2-4e3f-a3cc-4ceb8b95070a.jpg?asset_id=28473c5e-fccc-48a8-ae56-02056c508df3&img_etag=%2280295e77d4dd928afc99fa38c0fe7bd4%22&size=2560 HTTP/1.1Host: express.adobe.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://express.adobe.com/page/vCTYm3h0r9BmZ/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /runtime/1.22/images/favicon.ico HTTP/1.1Host: page.adobespark-assets.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://express.adobe.com/page/vCTYm3h0r9BmZ/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /page/vCTYm3h0r9BmZ/?page-mode=static HTTP/1.1Host: express.adobe.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /runtime/1.22/noscript.gz.css HTTP/1.1Host: page.adobespark-assets.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://express.adobe.com/page/vCTYm3h0r9BmZ/?page-mode=staticAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /84e74610-b8bb-4d6b-b394-8b4c2ffd51df-bucket/loginlg.html HTTP/1.1Host: storageapi.fleek.coConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /axios/dist/axios.min.js HTTP/1.1Host: unpkg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://storageapi.fleek.co/84e74610-b8bb-4d6b-b394-8b4c2ffd51df-bucket/loginlg.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /16.000/Converged_v21033_5plpI1P0_uKjrokWdqCoBw2.css HTTP/1.1Host: logincdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://storageapi.fleek.co/84e74610-b8bb-4d6b-b394-8b4c2ffd51df-bucket/loginlg.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /axios@0.27.2/dist/axios.min.js HTTP/1.1Host: unpkg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://storageapi.fleek.co/84e74610-b8bb-4d6b-b394-8b4c2ffd51df-bucket/loginlg.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1Host: logincdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://storageapi.fleek.co/84e74610-b8bb-4d6b-b394-8b4c2ffd51df-bucket/loginlg.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/ellipsis_635a63d500a92a0b8497cdc58d0f66b1.svg HTTP/1.1Host: logincdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://storageapi.fleek.co/84e74610-b8bb-4d6b-b394-8b4c2ffd51df-bucket/loginlg.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/ellipsis_grey_2b5d393db04a5e6e1f739cb266e65b4c.svg HTTP/1.1Host: logincdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://storageapi.fleek.co/84e74610-b8bb-4d6b-b394-8b4c2ffd51df-bucket/loginlg.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg HTTP/1.1Host: logincdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://storageapi.fleek.co/84e74610-b8bb-4d6b-b394-8b4c2ffd51df-bucket/loginlg.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /ajax/libs/jquery/3.6.0/jquery.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveOrigin: https://storageapi.fleek.coUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /214d89a26f0ac918a09f216a1b0f97b4.png HTTP/1.1Host: i.gyazo.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://storageapi.fleek.co/84e74610-b8bb-4d6b-b394-8b4c2ffd51df-bucket/loginlg.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /16.000.28741.15/images/favicon.ico HTTP/1.1Host: logincdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://storageapi.fleek.co/84e74610-b8bb-4d6b-b394-8b4c2ffd51df-bucket/loginlg.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: logincdn.msauth.net
Source: global traffic	HTTP traffic detected: GET /16.000.28741.15/images/favicon.ico HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: logincdn.msauth.net
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/ellipsis_635a63d500a92a0b8497cdc58d0f66b1.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: logincdn.msauth.net
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/ellipsis_grey_2b5d393db04a5e6e1f739cb266e65b4c.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: logincdn.msauth.net
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: logincdn.msauth.net
Source: global traffic	HTTP traffic detected: GET /214d89a26f0ac918a09f216a1b0f97b4.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: i.gyazo.com
Source: global traffic	HTTP traffic detected: GET /page/vCTYm3h0r9BmZ HTTP/1.1Host: express.adobe.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /page/vCTYm3h0r9BmZ/ HTTP/1.1Host: express.adobe.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8If-None-Match: "2e70d15b413fe7eb1dc360b0c85bf6c7"
Source: global traffic	HTTP traffic detected: GET /axios/dist/axios.min.js HTTP/1.1Host: unpkg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://storageapi.fleek.co/84e74610-b8bb-4d6b-b394-8b4c2ffd51df-bucket/loginlg.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /page/vCTYm3h0r9BmZ/ HTTP/1.1Host: express.adobe.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8If-None-Match: "2e70d15b413fe7eb1dc360b0c85bf6c7"

Source: pnacl_public_x86_64_pnacl_sz_nexe.0.dr, pnacl_public_x86_64_pnacl_llc_nexe.0.dr	String found in binary or memory: http://llvm.org/):
Source: 4db52df8-7db4-4261-ba95-ad167716883e.tmp.1.dr, daee1f78-bfab-4611-844c-74f8f409e3b6.tmp.1.dr	String found in binary or memory: https://accounts.google.com
Source: craw_window.js.0.dr	String found in binary or memory: https://accounts.google.com/MergeSession
Source: 4db52df8-7db4-4261-ba95-ad167716883e.tmp.1.dr	String found in binary or memory: https://ajax.googleapis.com
Source: 4db52df8-7db4-4261-ba95-ad167716883e.tmp.1.dr, daee1f78-bfab-4611-844c-74f8f409e3b6.tmp.1.dr	String found in binary or memory: https://apis.google.com
Source: pnacl_public_x86_64_libpnacl_irt_shim_dummy_a.0.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-clang.git
Source: pnacl_public_x86_64_libpnacl_irt_shim_dummy_a.0.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-llvm.git
Source: 4db52df8-7db4-4261-ba95-ad167716883e.tmp.1.dr, daee1f78-bfab-4611-844c-74f8f409e3b6.tmp.1.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.0.dr, manifest.json.0.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 4db52df8-7db4-4261-ba95-ad167716883e.tmp.1.dr, daee1f78-bfab-4611-844c-74f8f409e3b6.tmp.1.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: pnacl_public_x86_64_ld_nexe.0.dr	String found in binary or memory: https://code.google.com/p/nativeclient/issues/entry
Source: pnacl_public_x86_64_ld_nexe.0.dr	String found in binary or memory: https://code.google.com/p/nativeclient/issues/entry%s:
Source: 4db52df8-7db4-4261-ba95-ad167716883e.tmp.1.dr	String found in binary or memory: https://content-autofill.googleapis.com
Source: 4db52df8-7db4-4261-ba95-ad167716883e.tmp.1.dr, fdbc3643-bbd6-4842-86b0-af1c548700ee.tmp.1.dr, daee1f78-bfab-4611-844c-74f8f409e3b6.tmp.1.dr, b097998c-f8eb-451a-8022-09ef45611805.tmp.1.dr	String found in binary or memory: https://dns.google
Source: 4db52df8-7db4-4261-ba95-ad167716883e.tmp.1.dr, daee1f78-bfab-4611-844c-74f8f409e3b6.tmp.1.dr	String found in binary or memory: https://fonts.googleapis.com
Source: 4db52df8-7db4-4261-ba95-ad167716883e.tmp.1.dr, daee1f78-bfab-4611-844c-74f8f409e3b6.tmp.1.dr	String found in binary or memory: https://fonts.gstatic.com
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
Source: 4db52df8-7db4-4261-ba95-ad167716883e.tmp.1.dr, daee1f78-bfab-4611-844c-74f8f409e3b6.tmp.1.dr	String found in binary or memory: https://ogs.google.com
Source: craw_window.js.0.dr, manifest.json.0.dr	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: 4db52df8-7db4-4261-ba95-ad167716883e.tmp.1.dr, daee1f78-bfab-4611-844c-74f8f409e3b6.tmp.1.dr	String found in binary or memory: https://play.google.com
Source: daee1f78-bfab-4611-844c-74f8f409e3b6.tmp.1.dr	String found in binary or memory: https://r5---sn-h0jeln7l.gvt1.com
Source: 4db52df8-7db4-4261-ba95-ad167716883e.tmp.1.dr, daee1f78-bfab-4611-844c-74f8f409e3b6.tmp.1.dr	String found in binary or memory: https://redirector.gvt1.com
Source: craw_window.js.0.dr, manifest.json.0.dr	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: 4db52df8-7db4-4261-ba95-ad167716883e.tmp.1.dr, daee1f78-bfab-4611-844c-74f8f409e3b6.tmp.1.dr	String found in binary or memory: https://ssl.gstatic.com
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://www-googleapis-staging.sandbox.google.com
Source: 4db52df8-7db4-4261-ba95-ad167716883e.tmp.1.dr, daee1f78-bfab-4611-844c-74f8f409e3b6.tmp.1.dr	String found in binary or memory: https://www.google.com
Source: manifest.json.0.dr	String found in binary or memory: https://www.google.com/
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/accounts/OAuthLogin?issueuberauth=1
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/cleardot.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/dot2.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/x2.gif
Source: craw_background.js.0.dr	String found in binary or memory: https://www.google.com/intl/en-US/chrome/blank.html
Source: 4db52df8-7db4-4261-ba95-ad167716883e.tmp.1.dr, craw_window.js.0.dr, craw_background.js.0.dr, daee1f78-bfab-4611-844c-74f8f409e3b6.tmp.1.dr	String found in binary or memory: https://www.googleapis.com
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: 4db52df8-7db4-4261-ba95-ad167716883e.tmp.1.dr, daee1f78-bfab-4611-844c-74f8f409e3b6.tmp.1.dr	String found in binary or memory: https://www.gstatic.com

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "https://express.adobe.com/page/vCTYm3h0r9BmZ/
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1536,9034208647699705229,2968724141011212704,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1932 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1536,9034208647699705229,2968724141011212704,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1932 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	3 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	4 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	1 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud

Source	Detection	Scanner	Label	Link
https://express.adobe.com/page/vCTYm3h0r9BmZ/	0%	Virustotal		Browse
https://express.adobe.com/page/vCTYm3h0r9BmZ/	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\Temp\4688_1738629425\_platform_specific\x86_64\pnacl_public_x86_64_ld_nexe	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\4688_1738629425\_platform_specific\x86_64\pnacl_public_x86_64_ld_nexe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\4688_1738629425\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_llc_nexe	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\4688_1738629425\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_llc_nexe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\4688_1738629425\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_sz_nexe	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\4688_1738629425\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_sz_nexe	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
https://storageapi.fleek.co/84e74610-b8bb-4d6b-b394-8b4c2ffd51df-bucket/loginlg.html	100%	SlashNext	Credential Stealing type: Phishing & Social Engineering
https://dns.google	0%	URL Reputation	safe
https://page.adobespark-assets.com/runtime/1.22/themes/crisp-fonts.gz.js	0%	URL Reputation	safe
https://storageapi.fleek.co/84e74610-b8bb-4d6b-b394-8b4c2ffd51df-bucket/loginlg.html	13%	Virustotal		Browse
https://page.adobespark-assets.com/runtime/1.22/images/lightbox_close@2x.png	0%	Virustotal		Browse
https://page.adobespark-assets.com/runtime/1.22/images/lightbox_close@2x.png	0%	Avira URL Cloud	safe
https://page.adobespark-assets.com/runtime/1.22/images/left-arrow.png	0%	Virustotal		Browse
https://page.adobespark-assets.com/runtime/1.22/images/left-arrow.png	0%	Avira URL Cloud	safe
https://page.adobespark-assets.com/runtime/1.22/typekit-load.gz.js	0%	URL Reputation	safe
https://page.adobespark-assets.com/runtime/1.22/base-fonts.gz.js	0%	URL Reputation	safe
https://page.adobespark-assets.com/runtime/1.22/images/favicon.ico	0%	URL Reputation	safe
https://page.adobespark-assets.com/runtime/1.22/images/right-arrow.png	0%	Virustotal		Browse
https://page.adobespark-assets.com/runtime/1.22/images/right-arrow.png	0%	Avira URL Cloud	safe
https://page.adobespark-assets.com/runtime/1.22/runtime-prod.gz.js	0%	URL Reputation	safe
https://page.adobespark-assets.com/runtime/1.22/runtime.gz.css	0%	URL Reputation	safe
https://page.adobespark-assets.com/runtime/1.22/noscript.gz.css	0%	URL Reputation	safe

Name	IP	Active	Malicious	Reputation
accounts.google.com	142.250.203.109	true	false	high
cdnjs.cloudflare.com	104.17.25.14	true	false	high
i.gyazo.com	104.18.36.4	true	false	high
express-prod.adobeprojectm.com	65.9.95.52	true	false	unknown
storageapi.fleek.co	104.18.7.145	true	false	unknown
cs1227.wpc.alphacdn.net	192.229.221.185	true	false	unknown
clients.l.google.com	216.58.215.238	true	false	high
unpkg.com	104.16.122.175	true	false	high
page.adobespark-assets.com	65.9.95.101	true	false	unknown
use.typekit.net	unknown	unknown	false	high
clients2.google.com	unknown	unknown	false	high
p.typekit.net	unknown	unknown	false	high

Name	Malicious	Antivirus Detection	Reputation
https://page.adobespark-assets.com/runtime/1.22/themes/crisp-fonts.gz.js	false	URL Reputation: safe	unknown
https://i.gyazo.com/214d89a26f0ac918a09f216a1b0f97b4.png	false		high
https://storageapi.fleek.co/84e74610-b8bb-4d6b-b394-8b4c2ffd51df-bucket/loginlg.html	true	13%, Virustotal, Browse SlashNext: Credential Stealing type: Phishing & Social Engineering	unknown
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false		high
https://page.adobespark-assets.com/runtime/1.22/images/lightbox_close@2x.png	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://page.adobespark-assets.com/runtime/1.22/images/left-arrow.png	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://page.adobespark-assets.com/runtime/1.22/typekit-load.gz.js	false	URL Reputation: safe	unknown
https://page.adobespark-assets.com/runtime/1.22/base-fonts.gz.js	false	URL Reputation: safe	unknown
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-GB&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1	false		high
https://page.adobespark-assets.com/runtime/1.22/images/favicon.ico	false	URL Reputation: safe	unknown
https://page.adobespark-assets.com/runtime/1.22/images/right-arrow.png	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js	false		high
https://unpkg.com/axios/dist/axios.min.js	false		high
https://page.adobespark-assets.com/runtime/1.22/runtime-prod.gz.js	false	URL Reputation: safe	unknown
https://storageapi.fleek.co/84e74610-b8bb-4d6b-b394-8b4c2ffd51df-bucket/loginlg.html	true	13%, Virustotal, Browse SlashNext: Credential Stealing type: Phishing & Social Engineering	unknown
https://page.adobespark-assets.com/runtime/1.22/runtime.gz.css	false	URL Reputation: safe	unknown
https://unpkg.com/axios@0.27.2/dist/axios.min.js	false		high
https://page.adobespark-assets.com/runtime/1.22/noscript.gz.css	false	URL Reputation: safe	unknown

Name	Source	Malicious	Antivirus Detection	Reputation
https://dns.google	4db52df8-7db4-4261-ba95-ad167716883e.tmp.1.dr, fdbc3643-bbd6-4842-86b0-af1c548700ee.tmp.1.dr, daee1f78-bfab-4611-844c-74f8f409e3b6.tmp.1.dr, b097998c-f8eb-451a-8022-09ef45611805.tmp.1.dr	false	URL Reputation: safe	unknown
https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p	craw_window.js.0.dr, craw_background.js.0.dr	false		high
https://www.google.com/intl/en-US/chrome/blank.html	craw_background.js.0.dr	false		high
https://ogs.google.com	4db52df8-7db4-4261-ba95-ad167716883e.tmp.1.dr, daee1f78-bfab-4611-844c-74f8f409e3b6.tmp.1.dr	false		high
https://www.google.com/images/cleardot.gif	craw_window.js.0.dr	false		high
https://play.google.com	4db52df8-7db4-4261-ba95-ad167716883e.tmp.1.dr, daee1f78-bfab-4611-844c-74f8f409e3b6.tmp.1.dr	false		high
https://payments.google.com/payments/v4/js/integrator.js	craw_window.js.0.dr, manifest.json.0.dr	false		high
https://chromium.googlesource.com/a/native_client/pnacl-llvm.git	pnacl_public_x86_64_libpnacl_irt_shim_dummy_a.0.dr	false		high
https://sandbox.google.com/payments/v4/js/integrator.js	craw_window.js.0.dr, manifest.json.0.dr	false		high
https://www.google.com/images/x2.gif	craw_window.js.0.dr	false		high
https://accounts.google.com/MergeSession	craw_window.js.0.dr	false		high
http://llvm.org/):	pnacl_public_x86_64_pnacl_sz_nexe.0.dr, pnacl_public_x86_64_pnacl_llc_nexe.0.dr	false		high
https://www.google.com	4db52df8-7db4-4261-ba95-ad167716883e.tmp.1.dr, daee1f78-bfab-4611-844c-74f8f409e3b6.tmp.1.dr	false		high
https://www.google.com/images/dot2.gif	craw_window.js.0.dr	false		high
https://code.google.com/p/nativeclient/issues/entry%s:	pnacl_public_x86_64_ld_nexe.0.dr	false		high
https://code.google.com/p/nativeclient/issues/entry	pnacl_public_x86_64_ld_nexe.0.dr	false		high
https://accounts.google.com	4db52df8-7db4-4261-ba95-ad167716883e.tmp.1.dr, daee1f78-bfab-4611-844c-74f8f409e3b6.tmp.1.dr	false		high
https://clients2.googleusercontent.com	4db52df8-7db4-4261-ba95-ad167716883e.tmp.1.dr, daee1f78-bfab-4611-844c-74f8f409e3b6.tmp.1.dr	false		high
https://apis.google.com	4db52df8-7db4-4261-ba95-ad167716883e.tmp.1.dr, daee1f78-bfab-4611-844c-74f8f409e3b6.tmp.1.dr	false		high
https://www.google.com/accounts/OAuthLogin?issueuberauth=1	craw_window.js.0.dr	false		high
https://www.google.com/	manifest.json.0.dr	false		high
https://www-googleapis-staging.sandbox.google.com	craw_window.js.0.dr, craw_background.js.0.dr	false		high
https://chromium.googlesource.com/a/native_client/pnacl-clang.git	pnacl_public_x86_64_libpnacl_irt_shim_dummy_a.0.dr	false		high
https://clients2.google.com	4db52df8-7db4-4261-ba95-ad167716883e.tmp.1.dr, daee1f78-bfab-4611-844c-74f8f409e3b6.tmp.1.dr	false		high
https://clients2.google.com/service/update2/crx	manifest.json0.0.dr, manifest.json.0.dr	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
65.9.95.101	page.adobespark-assets.com	United States	16509	AMAZON-02US	false
104.16.122.175	unpkg.com	United States	13335	CLOUDFLARENETUS	false
216.58.215.238	clients.l.google.com	United States	15169	GOOGLEUS	false
104.18.7.145	storageapi.fleek.co	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
192.229.221.185	cs1227.wpc.alphacdn.net	United States	15133	EDGECASTUS	false
65.9.95.52	express-prod.adobeprojectm.com	United States	16509	AMAZON-02US	false
104.17.25.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
142.250.203.109	accounts.google.com	United States	15169	GOOGLEUS	false
104.18.36.4	i.gyazo.com	United States	13335	CLOUDFLARENETUS	false

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	634892
Start date and time: 27/05/202201:26:55	2022-05-27 01:26:55 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://express.adobe.com/page/vCTYm3h0r9BmZ/
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal80.phis.win@30/115@11/12
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI Browse: https://express.adobe.com/page/vCTYm3h0r9BmZ/?page-mode=static Browse: https://storageapi.fleek.co/84e74610-b8bb-4d6b-b394-8b4c2ffd51df-bucket/loginlg.html Browse: https://express.adobe.com/page/vCTYm3h0r9BmZ Browse: https://storageapi.fleek.co/84e74610-b8bb-4d6b-b394-8b4c2ffd51df-bucket/loginlg.html Browse: https://express.adobe.com/page/vCTYm3h0r9BmZ

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	207001
Entropy (8bit):	6.072789093860432
Encrypted:	false
SSDEEP:	6144:lT7cFfKzNM+gc+VLb8eA5wc5saqfIlUOoSiuRE:lvlG9c+VLIJ515roj
MD5:	C43CC48B93391E09BE4323EA2C123FDC
SHA1:	2E6148F0A8EEA8919C7BFE590AE4534D5BE99533
SHA-256:	3BD20CEB4CB27110E5FFBB8E287BD059A0F45F04AD1847D0589F00BCD6C2F7B8
SHA-512:	D15B350F57D525DD862D24422A671EC83C689FE7947C9E85FFC848069779C492528C43D224BA555546BEED145335DDB4DE02D43FCE5A77E50205E6F78DBC59CF
Malicious:	false
Reputation:	low
Preview:	{"browser":{"last_redirect_origin":"","shortcut_migration_version":"85.0.4183.121"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en-GB"},"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.653607678682286e+12,"network":1.65360768e+12,"ticks":109640591.0,"uncertainty":4547684.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABaHlwIoHYlQKZwuwW8V0yxAAAAAAIAAAAAABBmAAAAAQAAIAAAAOT4j8Zm9U1zXX6oEUpPqIYBIjSlOiLGeiMKiIFJZDroAAAAAA6AAAAAAgAAIAAAAFW1OavBhyV7qwszPZbindD+KU2Osh5O7HSmDPpFnuCDMAAAAGEkmqbufgFUSmOzx4cW7Aup7spqps4DvqbPrwRgUGqSpRZvQkbO+yVH56WF9zMTt0AAAAAyRwtYxjf7/AqYrFr0JZ6kbTiUt0/2PKkCw7ntLtbN2qrad7I3MeL4iNGDFgqRlhWgsb/6w0gJzQxAfL6rdzxi"},"password_manager":{"os_password_blank":true,"os_password_last_changed":"13291206129141208"},"plugins":{"metadata":{"adobe-flash-player":{"di

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 27, 2022 01:28:00.051428080 CEST	60758	53	192.168.2.4	8.8.8.8
May 27, 2022 01:28:00.053200960 CEST	60647	53	192.168.2.4	8.8.8.8
May 27, 2022 01:28:00.070842028 CEST	53	60758	8.8.8.8	192.168.2.4
May 27, 2022 01:28:00.080401897 CEST	53	60647	8.8.8.8	192.168.2.4
May 27, 2022 01:28:01.338707924 CEST	60381	53	192.168.2.4	8.8.8.8
May 27, 2022 01:28:01.359915972 CEST	53	60381	8.8.8.8	192.168.2.4
May 27, 2022 01:28:01.924745083 CEST	56509	53	192.168.2.4	8.8.8.8
May 27, 2022 01:28:03.164434910 CEST	54069	53	192.168.2.4	8.8.8.8
May 27, 2022 01:28:03.778862953 CEST	57595	443	192.168.2.4	216.58.215.238
May 27, 2022 01:28:03.809703112 CEST	443	57595	216.58.215.238	192.168.2.4
May 27, 2022 01:28:03.888901949 CEST	57595	443	192.168.2.4	216.58.215.238
May 27, 2022 01:28:03.918557882 CEST	443	57595	216.58.215.238	192.168.2.4
May 27, 2022 01:28:03.918596029 CEST	443	57595	216.58.215.238	192.168.2.4
May 27, 2022 01:28:03.918622017 CEST	443	57595	216.58.215.238	192.168.2.4
May 27, 2022 01:28:03.918644905 CEST	443	57595	216.58.215.238	192.168.2.4
May 27, 2022 01:28:03.919042110 CEST	57595	443	192.168.2.4	216.58.215.238
May 27, 2022 01:28:03.920449018 CEST	57595	443	192.168.2.4	216.58.215.238
May 27, 2022 01:28:04.005908012 CEST	57595	443	192.168.2.4	216.58.215.238
May 27, 2022 01:28:04.006472111 CEST	57595	443	192.168.2.4	216.58.215.238
May 27, 2022 01:28:04.048441887 CEST	443	57595	216.58.215.238	192.168.2.4
May 27, 2022 01:28:04.048737049 CEST	443	57595	216.58.215.238	192.168.2.4
May 27, 2022 01:28:04.050188065 CEST	57595	443	192.168.2.4	216.58.215.238
May 27, 2022 01:28:04.065578938 CEST	443	57595	216.58.215.238	192.168.2.4
May 27, 2022 01:28:04.065627098 CEST	443	57595	216.58.215.238	192.168.2.4
May 27, 2022 01:28:04.065658092 CEST	443	57595	216.58.215.238	192.168.2.4
May 27, 2022 01:28:04.066641092 CEST	57595	443	192.168.2.4	216.58.215.238
May 27, 2022 01:28:04.092634916 CEST	57595	443	192.168.2.4	216.58.215.238
May 27, 2022 01:28:04.947304964 CEST	61361	53	192.168.2.4	8.8.8.8
May 27, 2022 01:28:04.970518112 CEST	53	61361	8.8.8.8	192.168.2.4
May 27, 2022 01:28:17.653830051 CEST	60612	53	192.168.2.4	8.8.8.8
May 27, 2022 01:28:17.674510956 CEST	53	60612	8.8.8.8	192.168.2.4
May 27, 2022 01:28:18.703705072 CEST	56437	53	192.168.2.4	8.8.8.8
May 27, 2022 01:28:18.726577044 CEST	53	56437	8.8.8.8	192.168.2.4
May 27, 2022 01:28:19.117575884 CEST	53989	53	192.168.2.4	8.8.8.8
May 27, 2022 01:28:19.143646002 CEST	53	53989	8.8.8.8	192.168.2.4
May 27, 2022 01:28:19.148886919 CEST	63431	53	192.168.2.4	8.8.8.8
May 27, 2022 01:28:19.172595978 CEST	53	63431	8.8.8.8	192.168.2.4
May 27, 2022 01:28:26.509171963 CEST	50800	53	192.168.2.4	8.8.8.8
May 27, 2022 01:28:26.531532049 CEST	53	50800	8.8.8.8	192.168.2.4

Timestamp	kBytes transferred	Direction	Data
2022-05-26 23:28:00 UTC	0	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-GB&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfm X-Goog-Update-Updater: chromecrx-85.0.4183.121 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2022-05-26 23:28:00 UTC	1	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-fWmq1xMV1j7OFKtsf2uRDw' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 26 May 2022 23:28:00 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 5624 X-Daystart: 59280 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-05-26 23:28:00 UTC	2	IN	Data Raw: 33 36 64 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 35 36 32 34 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 35 39 32 38 30 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 36d<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="5624" elapsed_seconds="59280"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2022-05-26 23:28:00 UTC	3	IN	Data Raw: 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 2e 63 72 78 22 20 66 70 3d 22 31 2e 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 61 70 Data Ascii: mhkkegccagdldgiimedpiccmgmieda.crx" fp="1.81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app><ap
2022-05-26 23:28:00 UTC	3	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-05-26 23:28:00 UTC	0	OUT	GET /page/vCTYm3h0r9BmZ/ HTTP/1.1 Host: express.adobe.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2022-05-26 23:28:01 UTC	5	IN	HTTP/1.1 200 OK Content-Type: text/html Transfer-Encoding: chunked Connection: close Server: openresty Date: Thu, 26 May 2022 23:28:01 GMT x-request-id: Nsqhza4dTynsQmOubHTnfTCa032ESvIC Content-MD5: LnDRW0E/5+sdw2CwyFv2xw== ETag: "2e70d15b413fe7eb1dc360b0c85bf6c7" Cache-Control: no-cache, no-transform Accept-Ranges: bytes access-control-allow-origin: * access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS access-control-expose-headers: Location, X-Request-Id cross-origin-resource-policy: cross-origin Strict-Transport-Security: max-age=31536000; includeSubDomains Vary: Accept-Encoding X-Cache: Miss from cloudfront Via: 1.1 7df0d6b4ce8f8b155434dd5d830b76be.cloudfront.net (CloudFront) X-Amz-Cf-Pop: PRG50-C1 X-Amz-Cf-Id: OpwwzHrh7tgvPjVALPrT5eke5CIRVcjrQtIh-yHlhCkD3orO8IPDPA==
2022-05-26 23:28:01 UTC	6	IN	Data Raw: 36 61 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 41 4c 4c 20 44 4f 43 55 4d 45 4e 54 20 46 49 4c 45 53 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 79 65 73 22 20 6e 61 6d 65 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 66 75 6c 6c 73 63 72 65 65 6e 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 79 65 73 22 20 6e 61 6d 65 3d 22 61 70 70 6c 65 2d 6d 6f 62 69 6c 65 2d 77 65 62 2d 61 70 70 2d 63 61 70 61 62 6c 65 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 62 6c 61 63 6b 2d Data Ascii: 6a4<!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>ALL DOCUMENT FILES</title> <meta content="yes" name="apple-touch-fullscreen" /> <meta content="yes" name="apple-mobile-web-app-capable" /> <meta content="black-
2022-05-26 23:28:01 UTC	7	IN	Data Raw: 32 64 32 34 0d 0a 2f 2f 70 61 67 65 2e 61 64 6f 62 65 73 70 61 72 6b 2d 61 73 73 65 74 73 2e 63 6f 6d 2f 72 75 6e 74 69 6d 65 2f 31 2e 32 32 2f 74 79 70 65 6b 69 74 2d 6c 6f 61 64 2e 67 7a 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 61 67 65 2e 61 64 6f 62 65 73 70 61 72 6b 2d 61 73 73 65 74 73 2e 63 6f 6d 2f 72 75 6e 74 69 6d 65 2f 31 2e 32 32 2f 72 75 6e 74 69 6d 65 2e 67 7a 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 2f 2a 20 63 75 73 74 6f 6d 2d 74 68 65 6d 65 20 62 61 73 65 20 2a 2f 0a 0a 20 20 20 20 20 20 2e 63 72 69 73 70 2d 74 68 65 6d 65 20 2e Data Ascii: 2d24//page.adobespark-assets.com/runtime/1.22/typekit-load.gz.js"></script> <link href="https://page.adobespark-assets.com/runtime/1.22/runtime.gz.css" type="text/css" rel="stylesheet"> <style> /* custom-theme base */ .crisp-theme .
2022-05-26 23:28:01 UTC	18	IN	Data Raw: 31 30 66 32 0d 0a 0a 20 20 70 61 64 64 69 6e 67 2d 74 6f 70 3a 20 2e 32 35 65 6d 3b 0a 20 20 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 20 2e 32 35 65 6d 3b 0a 20 20 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 31 65 6d 3b 0a 20 20 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 20 31 65 6d 3b 0a 7d 0a 2e 63 72 69 73 70 2d 74 68 65 6d 65 20 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 20 62 6c 6f 63 6b 71 75 6f 74 65 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 22 3b 0a 20 20 64 69 73 70 6c 61 79 3a 20 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 0a 20 20 7a 2d 69 6e 64 65 78 3a 20 2d 31 3b 0a 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 74 6f 70 3a 20 30 70 78 3b 0a 20 20 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a Data Ascii: 10f2 padding-top: .25em; padding-bottom: .25em; padding-left: 1em; padding-right: 1em;}.crisp-theme .content-container blockquote:before { content: ""; display: inline-block; z-index: -1; position: absolute; top: 0px; right: auto;
2022-05-26 23:28:01 UTC	23	IN	Data Raw: 31 30 61 31 0d 0a 3a 20 72 67 62 61 28 30 2c 30 2c 30 2c 31 29 3b 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 72 67 62 61 28 32 35 35 2c 32 35 35 2c 32 35 35 2c 30 2e 38 29 3b 0a 20 20 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 20 20 2d 6d 6f 7a 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 20 20 2d 6f 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 20 20 2d 6d 73 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 20 20 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 7d 0a 0a 2e 63 72 69 73 70 2d 74 68 65 6d 65 20 2e 66 75 6c 6c 73 63 72 65 65 6e 2d 70 68 6f 74 6f 2d 73 65 63 74 69 Data Ascii: 10a1: rgba(0,0,0,1); background-color: rgba(255,255,255,0.8); -webkit-box-sizing: border-box; -moz-box-sizing: border-box; -o-box-sizing: border-box; -ms-box-sizing: border-box; box-sizing: border-box;}.crisp-theme .fullscreen-photo-secti
2022-05-26 23:28:01 UTC	29	IN	Data Raw: 32 37 39 32 0d 0a 35 30 30 72 65 6d 3b 0a 7d 0a 2e 63 72 69 73 70 2d 74 68 65 6d 65 20 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 20 68 33 20 2b 20 75 6c 7b 0a 20 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 32 2e 35 30 30 72 65 6d 3b 0a 7d 0a 2e 63 72 69 73 70 2d 74 68 65 6d 65 20 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 20 68 34 20 2b 20 75 6c 7b 0a 20 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 32 2e 35 30 30 72 65 6d 3b 0a 7d 0a 2e 63 72 69 73 70 2d 74 68 65 6d 65 20 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 20 62 6c 6f 63 6b 71 75 6f 74 65 20 2b 20 75 6c 7b 0a 20 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 32 2e 35 30 30 72 65 6d 3b 0a 7d 0a 2e 63 72 69 73 70 2d 74 68 65 6d 65 20 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 Data Ascii: 2792500rem;}.crisp-theme .content-container h3 + ul{ margin-top: 2.500rem;}.crisp-theme .content-container h4 + ul{ margin-top: 2.500rem;}.crisp-theme .content-container blockquote + ul{ margin-top: 2.500rem;}.crisp-theme .content-containe
2022-05-26 23:28:01 UTC	39	IN	Data Raw: 33 38 61 38 0d 0a 20 20 7d 0a 20 20 2e 63 72 69 73 70 2d 74 68 65 6d 65 20 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 20 2e 6c 69 6e 6b 2d 62 75 74 74 6f 6e 2d 77 72 61 70 70 65 72 20 2b 20 2e 6c 69 6e 6b 2d 62 75 74 74 6f 6e 2d 77 72 61 70 70 65 72 7b 0a 20 20 20 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 31 2e 32 35 30 72 65 6d 3b 0a 20 20 7d 0a 20 20 2e 63 72 69 73 70 2d 74 68 65 6d 65 20 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 20 64 69 76 2e 69 6d 61 67 65 20 2b 20 2e 6c 69 6e 6b 2d 62 75 74 74 6f 6e 2d 77 72 61 70 70 65 72 7b 0a 20 20 20 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 31 2e 32 35 30 72 65 6d 3b 0a 20 20 7d 0a 20 20 2e 63 72 69 73 70 2d 74 68 65 6d 65 20 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 20 64 69 76 2e Data Ascii: 38a8 } .crisp-theme .content-container .link-button-wrapper + .link-button-wrapper{ margin-top: 1.250rem; } .crisp-theme .content-container div.image + .link-button-wrapper{ margin-top: 1.250rem; } .crisp-theme .content-container div.
2022-05-26 23:28:01 UTC	53	IN	Data Raw: 31 35 63 34 0d 0a 2d 63 65 6e 74 65 72 2c 0a 20 20 20 20 20 20 2e 63 72 69 73 70 2d 74 68 65 6d 65 20 68 33 2e 74 65 78 74 2d 63 65 6e 74 65 72 2c 0a 20 20 20 20 20 20 2e 63 72 69 73 70 2d 74 68 65 6d 65 20 68 34 2e 74 65 78 74 2d 63 65 6e 74 65 72 2c 0a 20 20 20 20 20 20 2e 63 72 69 73 70 2d 74 68 65 6d 65 20 2e 63 61 70 74 69 6f 6e 2e 74 65 78 74 2d 63 65 6e 74 65 72 2c 0a 20 20 20 20 20 20 2e 63 72 69 73 70 2d 74 68 65 6d 65 20 2e 67 72 69 64 2d 63 61 70 74 69 6f 6e 2e 74 65 78 74 2d 63 65 6e 74 65 72 20 7b 0a 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 2e 63 72 69 73 70 2d 74 68 65 6d 65 20 70 2e 74 65 78 74 2d 72 69 67 68 74 2c 0a 20 20 20 20 20 20 2e 63 72 69 73 70 Data Ascii: 15c4-center, .crisp-theme h3.text-center, .crisp-theme h4.text-center, .crisp-theme .caption.text-center, .crisp-theme .grid-caption.text-center { text-align: center; } .crisp-theme p.text-right, .crisp
2022-05-26 23:28:01 UTC	58	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-05-26 23:28:02 UTC	367	OUT	GET /runtime/1.22/images/right-arrow.png HTTP/1.1 Host: page.adobespark-assets.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://page.adobespark-assets.com/runtime/1.22/runtime.gz.css Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2022-05-26 23:28:03 UTC	394	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 1079 Connection: close Date: Thu, 26 May 2022 21:02:03 GMT Last-Modified: Thu, 07 Apr 2022 16:13:05 GMT ETag: "0521a80da93dacc1cd2104b8c3828421" Cache-Control: max-age=86400 x-amz-version-id: tEgUNSTKBsFcSH98vcqrkUcI25fOK3e. Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 d33f640b9793fb0553cc6dbe55988068.cloudfront.net (CloudFront) X-Amz-Cf-Pop: PRG50-C1 X-Amz-Cf-Id: FDt7oXMBvWQJO5RglEjoDyaP8B3ntFtsCoE8WhxRcwaZvGWAm4Srbw== Age: 8760
2022-05-26 23:28:03 UTC	395	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 25 00 00 00 26 08 06 00 00 00 43 0a 52 ad 00 00 00 04 73 42 49 54 08 08 08 08 7c 08 64 88 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b 12 01 d2 dd 7e fc 00 00 00 16 74 45 58 74 43 72 65 61 74 69 6f 6e 20 54 69 6d 65 00 30 35 2f 30 32 2f 31 33 66 fe 60 b7 00 00 00 1c 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 46 69 72 65 77 6f 72 6b 73 20 43 53 36 e8 bc b2 8c 00 00 03 8f 49 44 41 54 58 85 ed 98 cf 6f 1b 45 14 80 bf f1 da 8e 83 ed d4 4d 2b c1 21 2a 48 e4 84 94 90 38 5c 8a d4 6b 2e f4 c6 21 11 12 8a 65 d9 7b e4 0f a0 12 07 04 ed bd b9 11 45 68 6f 0e 45 d0 6b 72 45 a2 9c bc 52 72 0d 9c 8b 04 51 1c 27 c4 ea 3a 19 0e fb 46 de da 3b b5 b3 76 95 22 f1 a4 d1 2a 3b 9e 37 df be 5f f3 26 4a 6b cd Data Ascii: PNGIHDR%&CRsBIT\|dpHYs~tEXtCreation Time05/02/13f`tEXtSoftwareAdobe Fireworks CS6IDATXoEM+!H8\k.!e{EhoEkrERrQ':F;v";7_&Jk

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://express.adobe.com/page/vCTYm3h0r9BmZ/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

HTML

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Google\Chrome\User Data\069be934-712e-44cf-8ced-a6c17b2dec9e.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\1ffc1065-fee4-4d41-b14a-d5ca02915ac3.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\2cca4a96-ebc5-49fd-ae2c-40461fcb669f.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\37c7bdaf-74f9-4662-b279-6727742cfb72.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\45c713ed-ef41-486d-95ff-76e96d661224.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\7265c617-06b5-4016-b2ba-1798974f906e.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\87e6bd9f-6c1c-4d2b-91b5-63bf6ba15136.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\9d7915cf-bc6c-4295-aa28-ec0f4c504ca2.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\1294a89c-8528-4d26-94a5-08d1c5a4f1a5.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\174e825f-462d-4734-938e-4b41026fd945.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\1a42f81e-3257-4ab8-afbd-a0cf8e300491.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\2526132c-5ecf-4b64-8ebb-120a676e41ca.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\4db52df8-7db4-4261-ba95-ad167716883e.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\58d3c721-0179-4fa6-b9c0-f0a61c91f6a0.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\66c6ea69-0810-472b-8c17-e0fb0041c4a4.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata\computed_hashes.json

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\000003.log

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG.old (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Provider Cache

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network Persistent State (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\GPUCache\data_1

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Network Persistent State (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\b097998c-f8eb-451a-8022-09ef45611805.tmp

Windows Analysis Report
https://express.adobe.com/page/vCTYm3h0r9BmZ/

Timestamp	kBytes transferred	Direction	Data
2022-05-26 23:28:02 UTC	368	OUT	GET /runtime/1.22/images/left-arrow.png HTTP/1.1 Host: page.adobespark-assets.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://page.adobespark-assets.com/runtime/1.22/runtime.gz.css Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2022-05-26 23:28:03 UTC	421	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 1058 Connection: close Date: Thu, 26 May 2022 23:28:04 GMT Last-Modified: Thu, 07 Apr 2022 16:13:05 GMT ETag: "5ce00c645964cf02667d083a32cec874" Cache-Control: max-age=86400 x-amz-version-id: EN8Z7haU9UD3AveGLrcn6Zuba0r9UciD Accept-Ranges: bytes Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 a198ea04052d45eb515f27260bc6c05c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: PRG50-C1 X-Amz-Cf-Id: sIT4-as6Dvq45e4XdUUeZzZdklDj1RQ4CdYHCdvJkOChljk7zKPmwg==
2022-05-26 23:28:03 UTC	422	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 25 00 00 00 26 08 06 00 00 00 43 0a 52 ad 00 00 00 04 73 42 49 54 08 08 08 08 7c 08 64 88 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b 12 01 d2 dd 7e fc 00 00 00 16 74 45 58 74 43 72 65 61 74 69 6f 6e 20 54 69 6d 65 00 30 35 2f 30 32 2f 31 33 66 fe 60 b7 00 00 00 1c 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 46 69 72 65 77 6f 72 6b 73 20 43 53 36 e8 bc b2 8c 00 00 03 7a 49 44 41 54 58 85 ed 98 4f 6b 13 41 14 c0 7f 53 13 4d 49 13 35 0a 2a 88 1e da 93 b5 48 c5 83 17 f1 16 44 3c 88 07 d3 5b aa ed e6 e8 07 f0 22 82 fa 21 1a 2c 0d 82 84 da 2f d0 82 17 29 1e a5 87 1c eb 59 45 25 31 da 1a 4d b2 e3 61 de c6 6d 3a 1b b3 9b 48 2b f8 e0 b1 1b e6 df 6f df bc f7 e6 4d 94 d6 9a fd 26 23 7b 0d 60 93 Data Ascii: PNGIHDR%&CRsBIT\|dpHYs~tEXtCreation Time05/02/13f`tEXtSoftwareAdobe Fireworks CS6zIDATXOkASMI5*HD<["!,/)YE%1Mam:H+oM&#{`

Timestamp	kBytes transferred	Direction	Data
2022-05-26 23:28:02 UTC	369	OUT	GET /runtime/1.22/images/lightbox_close@2x.png HTTP/1.1 Host: page.adobespark-assets.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://page.adobespark-assets.com/runtime/1.22/runtime.gz.css Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2022-05-26 23:28:03 UTC	423	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 1453 Connection: close Date: Thu, 26 May 2022 23:28:04 GMT Last-Modified: Thu, 07 Apr 2022 16:13:05 GMT ETag: "13198d9e24e4047b757e69f32897b19d" Cache-Control: max-age=86400 x-amz-version-id: kFRavswkLyZq2.orLBS8_02O57mn5u8M Accept-Ranges: bytes Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 017ac0aeeb057314a9b1c06f8b97ba34.cloudfront.net (CloudFront) X-Amz-Cf-Pop: PRG50-C1 X-Amz-Cf-Id: GjHqUi1OBHw91ySNZusWr9sHG84Yyi5pQRT998ukZNQmEbmn8-4Pqg==
2022-05-26 23:28:03 UTC	423	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 78 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 32 31 20 37 39 2e 31 35 35 37 37 32 2c 20 32 30 31 34 2f 30 31 2f 31 33 2d 31 39 3a 34 34 3a 30 30 20 20 Data Ascii: PNGIHDR((mtEXtSoftwareAdobe ImageReadyqe<xiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.155772, 2014/01/13-19:44:00

Timestamp	kBytes transferred	Direction	Data
2022-05-26 23:28:04 UTC	425	OUT	GET /runtime/1.22/images/favicon.ico HTTP/1.1 Host: page.adobespark-assets.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://express.adobe.com/page/vCTYm3h0r9BmZ/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2022-05-26 23:28:04 UTC	426	IN	HTTP/1.1 200 OK Content-Type: image/vnd.microsoft.icon Content-Length: 4286 Connection: close Last-Modified: Thu, 07 Apr 2022 16:13:05 GMT x-amz-version-id: o33G6_96a8.oX1qDyYJ_RANZ.hCBH8Qm Accept-Ranges: bytes Server: AmazonS3 Date: Thu, 26 May 2022 19:03:00 GMT Cache-Control: max-age=86400 ETag: "26a3ad5f1a16d4ec36c4bcde9c212639" X-Cache: Hit from cloudfront Via: 1.1 6fc3cae9692b6db972e4990be9921fae.cloudfront.net (CloudFront) X-Amz-Cf-Pop: PRG50-C1 X-Amz-Cf-Id: _MSwHUz0GBEI3ozPLj5AXwvSFlLhFNatd6_bu-atbFr8qIurtElb2g== Age: 15905
2022-05-26 23:28:04 UTC	426	IN	Data Raw: 00 00 01 00 01 00 20 20 00 00 01 00 20 00 a8 10 00 00 16 00 00 00 28 00 00 00 20 00 00 00 40 00 00 00 01 00 20 00 00 00 00 00 00 10 00 00 12 0b 00 00 12 0b 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 3f 3f 3f 02 3f 3f 3f 03 3f 3f 3f 03 3f 3f 3f 03 3f 3f 3f 03 3f 3f 3f 03 3f 3f 3f 03 3f 3f 3f 03 3f 3f 3f 03 3f 3f 3f 03 3f 3f 3f 03 3f 3f 3f 03 3f 3f 3f 03 3f 3f 3f 03 3f 3f 3f 03 3f 3f 3f 03 3f 3f 3f 03 3f 3f 3f 03 3f 3f 3f 03 4f 4f 4f 01 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 6f 6f 6f 01 00 00 00 08 00 00 00 19 00 00 00 2a 00 00 00 32 00 00 00 33 00 00 00 33 00 00 00 33 00 00 00 33 00 00 00 33 00 00 00 33 00 00 00 33 00 00 00 33 00 Data Ascii: ( @ ?????????????????????????????????????????????????????????OOOooo*233333333
2022-05-26 23:28:04 UTC	428	IN	Data Raw: 00 ff 1d 0b 00 ff 1d 0b 00 ff 1d 0b 00 ff 00 00 00 22 7f 7f 7f 01 66 66 66 02 00 00 00 33 1d 0b 00 ff 1d 0b 00 ff 1d 0b 00 ff 1d 0b 00 ff 2b 13 05 ff ef 7b 5f ff f9 80 61 ff f2 7b 66 ff bc 60 46 ff 70 36 2f ff 29 12 05 ff 90 78 0f ff bf ba 21 ff a7 bc 2c ff 85 bb 2e ff 42 51 16 ff 21 17 04 ff 23 24 0c ff 2d 73 42 ff 35 cd 96 ff 2e e0 b6 ff 28 de d5 ff 1e 51 45 ff 1d 0b 00 ff 1d 0b 00 ff 1d 0b 00 ff 1d 0b 00 ff 1d 0b 00 ff 00 00 00 22 7f 7f 7f 01 66 66 66 02 00 00 00 33 1d 0b 00 ff 1d 0b 00 ff 1d 0b 00 ff 1d 0b 00 ff a9 53 49 ff fb 7f 69 ff f3 75 7a ff 6b 32 2d ff 1d 0b 00 ff 1d 0b 00 ff 9f 6e 12 ff dd a9 26 ff ba ae 32 ff 89 92 32 ff 25 15 05 ff 1d 0b 00 ff 1d 0b 00 ff 1d 0b 00 ff 1d 0b 00 ff 22 2f 1f ff 2a c9 c5 ff 29 db d4 ff 1f d1 e5 ff 1d 18 10 ff 1d Data Ascii: "fff3+{_a{f`Fp6/)x!,.BQ!#$-sB5.(QE"fff3SIiuzk2-n&22%"/*)

Timestamp	kBytes transferred	Direction	Data
2022-05-26 23:28:07 UTC	691	OUT	GET /page/vCTYm3h0r9BmZ/?page-mode=static HTTP/1.1 Host: express.adobe.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2022-05-26 23:28:07 UTC	692	IN	HTTP/1.1 200 OK Content-Type: text/html Transfer-Encoding: chunked Connection: close Server: openresty Date: Thu, 26 May 2022 23:28:07 GMT x-request-id: aftopFKUcbb9rMErvJpGbskoUDsNVF2M Content-MD5: LnDRW0E/5+sdw2CwyFv2xw== ETag: "2e70d15b413fe7eb1dc360b0c85bf6c7" Cache-Control: no-cache, no-transform Accept-Ranges: bytes cross-origin-resource-policy: cross-origin access-control-allow-origin: * access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS access-control-expose-headers: Location, X-Request-Id Strict-Transport-Security: max-age=31536000; includeSubDomains Vary: Accept-Encoding X-Cache: Miss from cloudfront Via: 1.1 0803e66d64c794aaadfd4a88601bc68e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: PRG50-C1 X-Amz-Cf-Id: X_LClurcOwjdjugPMhRQFIunlIHCMJCO3eJwazDI95K8CZvAVoR1FQ==
2022-05-26 23:28:07 UTC	692	IN	Data Raw: 35 61 32 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 41 4c 4c 20 44 4f 43 55 4d 45 4e 54 20 46 49 4c 45 53 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 79 65 73 22 20 6e 61 6d 65 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 66 75 6c 6c 73 63 72 65 65 6e 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 79 65 73 22 20 6e 61 6d 65 3d 22 61 70 70 6c 65 2d 6d 6f 62 69 6c 65 2d 77 65 62 2d 61 70 70 2d 63 61 70 61 62 6c 65 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 62 6c 61 63 6b 2d Data Ascii: 5a2<!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>ALL DOCUMENT FILES</title> <meta content="yes" name="apple-touch-fullscreen" /> <meta content="yes" name="apple-mobile-web-app-capable" /> <meta content="black-
2022-05-26 23:28:07 UTC	694	IN	Data Raw: 35 63 63 34 0d 0a 3d 22 66 62 3a 61 70 70 5f 69 64 22 20 63 6f 6e 74 65 6e 74 3d 22 39 31 39 30 33 39 33 36 31 34 36 34 34 37 33 22 3e 0a 0a 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 70 61 67 65 2e 61 64 6f 62 65 73 70 61 72 6b 2d 61 73 73 65 74 73 2e 63 6f 6d 2f 72 75 6e 74 69 6d 65 2f 31 2e 32 32 2f 62 61 73 65 2d 66 6f 6e 74 73 2e 67 7a 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 70 61 67 65 2e 61 64 6f 62 65 73 70 61 72 6b 2d 61 73 73 65 74 73 2e 63 6f 6d 2f 72 75 6e 74 69 6d 65 2f 31 2e 32 32 2f 74 68 65 6d 65 73 2f 63 72 69 73 70 2d 66 6f 6e 74 73 2e 67 7a 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 Data Ascii: 5cc4="fb:app_id" content="919039361464473"> <script src="https://page.adobespark-assets.com/runtime/1.22/base-fonts.gz.js"></script> <script src="https://page.adobespark-assets.com/runtime/1.22/themes/crisp-fonts.gz.js"></script> <script sr
2022-05-26 23:28:07 UTC	710	IN	Data Raw: 2e 66 75 6c 6c 73 63 72 65 65 6e 2d 70 68 6f 74 6f 2d 73 65 63 74 69 6f 6e 20 2e 70 75 6c 6c 2d 71 75 6f 74 65 20 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 63 6f 6c 6f 72 3a 20 72 67 62 61 28 30 2c 30 2c 30 2c 31 29 3b 0a 7d 0a 0a 40 6d 65 64 69 61 20 28 20 6d 61 78 2d 77 69 64 74 68 3a 20 37 36 37 70 78 20 29 20 7b 0a 20 20 2e 63 72 69 73 70 2d 74 68 65 6d 65 20 2e 66 75 6c 6c 73 63 72 65 65 6e 2d 70 68 6f 74 6f 2d 73 65 63 74 69 6f 6e 20 2e 70 75 6c 6c 2d 71 75 6f 74 65 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 39 70 78 3b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 34 38 70 78 20 31 36 70 78 3b 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 20 31 32 70 78 3b 0a 20 20 7d 0a 7d 0a 0a 0a 2f 2a 20 77 69 6e 64 6f 77 20 73 65 63 Data Ascii: .fullscreen-photo-section .pull-quote .content-container { color: rgba(0,0,0,1);}@media ( max-width: 767px ) { .crisp-theme .fullscreen-photo-section .pull-quote { font-size: 19px; margin: 48px 16px; padding: 12px; }}/* window sec
2022-05-26 23:28:07 UTC	717	IN	Data Raw: 62 34 61 0d 0a 6d 3b 0a 7d 0a 2e 63 72 69 73 70 2d 74 68 65 6d 65 20 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 20 6f 6c 20 2b 20 64 69 76 2e 69 6d 61 67 65 7b 0a 20 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 32 2e 35 30 30 72 65 6d 3b 0a 7d 0a 2e 63 72 69 73 70 2d 74 68 65 6d 65 20 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 20 75 6c 20 2b 20 64 69 76 2e 69 6d 61 67 65 7b 0a 20 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 32 2e 35 30 30 72 65 6d 3b 0a 7d 0a 2e 63 72 69 73 70 2d 74 68 65 6d 65 20 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 20 68 33 20 2b 20 64 69 76 2e 69 6d 61 67 65 7b 0a 20 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 32 2e 35 30 30 72 65 6d 3b 0a 7d 0a 2e 63 72 69 73 70 2d 74 68 65 6d 65 20 2e 63 6f 6e 74 65 6e 74 2d 63 Data Ascii: b4am;}.crisp-theme .content-container ol + div.image{ margin-top: 2.500rem;}.crisp-theme .content-container ul + div.image{ margin-top: 2.500rem;}.crisp-theme .content-container h3 + div.image{ margin-top: 2.500rem;}.crisp-theme .content-c
2022-05-26 23:28:07 UTC	720	IN	Data Raw: 32 31 65 38 0d 0a 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 20 68 33 20 2b 20 6f 6c 7b 0a 20 20 20 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 31 2e 32 35 30 72 65 6d 3b 0a 20 20 7d 0a 20 20 2e 63 72 69 73 70 2d 74 68 65 6d 65 20 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 20 68 34 20 2b 20 6f 6c 7b 0a 20 20 20 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 31 2e 32 35 30 72 65 6d 3b 0a 20 20 7d 0a 20 20 2e 63 72 69 73 70 2d 74 68 65 6d 65 20 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 20 62 6c 6f 63 6b 71 75 6f 74 65 20 2b 20 6f 6c 7b 0a 20 20 20 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 31 2e 32 35 30 72 65 6d 3b 0a 20 20 7d 0a 20 20 2e 63 72 69 73 70 2d 74 68 65 6d 65 20 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 20 2e 6c 69 6e 6b 2d 62 75 Data Ascii: 21e8ent-container h3 + ol{ margin-top: 1.250rem; } .crisp-theme .content-container h4 + ol{ margin-top: 1.250rem; } .crisp-theme .content-container blockquote + ol{ margin-top: 1.250rem; } .crisp-theme .content-container .link-bu
2022-05-26 23:28:07 UTC	728	IN	Data Raw: 31 63 34 38 0d 0a 67 62 61 28 31 37 2c 32 36 2c 31 31 2c 30 2e 35 29 3b 0a 7d 0a 0a 2e 63 72 69 73 70 2d 74 68 65 6d 65 20 2e 73 65 63 74 69 6f 6e 2e 61 75 74 68 6f 72 2d 73 65 63 74 69 6f 6e 20 2e 61 70 70 72 65 63 69 61 74 65 2d 62 75 74 74 6f 6e 3a 62 65 66 6f 72 65 20 7b 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 27 64 61 74 61 3a 69 6d 61 67 65 2f 73 76 67 2b 78 6d 6c 3b 62 61 73 65 36 34 2c 50 48 4e 32 5a 79 42 34 62 57 78 75 63 7a 30 69 61 48 52 30 63 44 6f 76 4c 33 64 33 64 79 35 33 4d 79 35 76 63 6d 63 76 4d 6a 41 77 4d 43 39 7a 64 6d 63 69 49 48 64 70 5a 48 52 6f 50 53 49 7a 4d 69 49 67 61 47 56 70 5a 32 68 30 50 53 49 7a 4d 69 49 67 64 6d 6c 6c 64 30 4a 76 65 44 30 69 4d 43 41 77 49 44 4d 79 49 44 4d 79 49 6a 34 Data Ascii: 1c48gba(17,26,11,0.5);}.crisp-theme .section.author-section .appreciate-button:before { background-image: url('data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIzMiIgaGVpZ2h0PSIzMiIgdmlld0JveD0iMCAwIDMyIDMyIj4
2022-05-26 23:28:07 UTC	735	IN	Data Raw: 62 35 30 0d 0a 28 30 2e 32 35 30 2c 20 30 2e 34 36 30 2c 20 30 2e 34 35 30 2c 20 30 2e 39 34 30 29 3b 0a 0a 20 20 6f 70 61 63 69 74 79 3a 20 31 3b 0a 0a 20 20 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 33 64 28 30 2c 30 2c 30 29 3b 0a 20 20 2d 6d 6f 7a 2d 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 33 64 28 30 2c 30 2c 30 29 3b 0a 20 20 2d 6f 2d 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 33 64 28 30 2c 30 2c 30 29 3b 0a 20 20 2d 6d 73 2d 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 33 64 28 30 2c 30 2c 30 29 3b 0a 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 33 64 28 30 2c 30 2c 30 29 3b 0a 7d 0a 0a 2e 63 72 69 73 70 2d 74 68 65 6d 65 20 2e 63 61 Data Ascii: b50(0.250, 0.460, 0.450, 0.940); opacity: 1; -webkit-transform: translate3d(0,0,0); -moz-transform: translate3d(0,0,0); -o-transform: translate3d(0,0,0); -ms-transform: translate3d(0,0,0); transform: translate3d(0,0,0);}.crisp-theme .ca
2022-05-26 23:28:07 UTC	738	IN	Data Raw: 62 35 30 0d 0a 72 69 67 68 74 3b 0a 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 2e 63 72 69 73 70 2d 74 68 65 6d 65 20 2e 63 61 70 74 69 6f 6e 2d 72 69 67 68 74 20 2e 70 75 6c 6c 2d 71 75 6f 74 65 20 7b 0a 20 20 20 20 20 20 20 20 72 69 67 68 74 3a 20 33 25 3b 0a 20 20 20 20 20 20 20 20 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 32 72 65 6d 3b 0a 20 20 20 20 20 20 7d 0a 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0a 20 20 20 20 3c 6e 6f 73 63 72 69 70 74 20 69 64 3d 22 6e 6f 73 63 72 69 70 74 2d 73 74 61 74 69 63 2d 6c 61 79 6f 75 74 22 20 64 61 74 61 2d 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 61 67 65 2e 61 64 6f 62 65 73 70 61 Data Ascii: b50right; } .crisp-theme .caption-right .pull-quote { right: 3%; left: auto; margin-left: 0; margin-right: 2rem; } </style> <noscript id="noscript-static-layout" data-href="https://page.adobespa
2022-05-26 23:28:07 UTC	741	IN	Data Raw: 38 64 39 0d 0a 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6c 69 6e 6b 2d 62 75 74 74 6f 6e 2d 77 72 61 70 70 65 72 20 6c 69 6e 6b 2d 63 65 6e 74 65 72 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 63 6c 61 73 73 3d 22 6c 69 6e 6b 2d 62 75 74 74 6f 6e 20 22 20 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 6f 72 61 67 65 61 70 69 2e 66 6c 65 65 6b 2e 63 6f 2f 38 34 65 37 34 36 31 30 2d 62 38 62 62 2d 34 64 36 62 2d 62 33 39 34 2d 38 62 34 63 32 66 66 64 35 31 64 66 2d 62 75 63 6b 65 74 2f 6c 6f 67 69 6e 6c 67 2e 68 74 6d 6c 22 20 72 65 6c 3d 22 6e 6f 66 6f 6c 6c 6f 77 20 6e 6f 72 65 66 65 72 72 65 72 22 3e Data Ascii: 8d9tent-container"> <div class="link-button-wrapper link-center"> <a class="link-button " href="https://storageapi.fleek.co/84e74610-b8bb-4d6b-b394-8b4c2ffd51df-bucket/loginlg.html" rel="nofollow noreferrer">
2022-05-26 23:28:07 UTC	743	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-05-26 23:28:08 UTC	743	OUT	GET /runtime/1.22/noscript.gz.css HTTP/1.1 Host: page.adobespark-assets.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://express.adobe.com/page/vCTYm3h0r9BmZ/?page-mode=static Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2022-05-26 23:28:09 UTC	744	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 1627 Connection: close Date: Thu, 26 May 2022 23:28:10 GMT Last-Modified: Thu, 07 Apr 2022 16:13:08 GMT ETag: "d27f6ae510ecff458377a64b4bc6b537" Cache-Control: max-age=86400 Content-Encoding: gzip x-amz-version-id: lZnY7tu68c2.F.xML6jTRE.wfnBlAy5Q Accept-Ranges: bytes Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 c76f57c516237f120f723cde4dab446e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: PRG50-C1 X-Amz-Cf-Id: tZx5BHPOYRT9Vae5MGBCv5MHRMtV5FxU9cTFdrcUCFr2opE0btRayw==
2022-05-26 23:28:09 UTC	744	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 03 d5 59 db 72 db 36 10 fd 15 76 32 9e 89 5b 83 95 9d 3a 75 c9 97 fc 0a 48 42 22 62 92 e0 80 90 64 9b a3 7f ef e2 0e f0 22 4b 4e 66 9a 3e 58 96 71 59 2c 76 cf ee 9e 85 53 cc 05 2d 1b 72 97 f6 fb a2 a1 25 16 94 75 e8 40 c9 91 f0 bb 74 20 a5 fc fb 2e 3d f6 68 38 d2 9e a0 1e 77 a4 41 3b ce f6 fd c8 0e 84 6f 1b 76 cc 0e 74 a0 45 43 7e a3 6d cf b8 c0 9d 38 7d 6a f6 25 46 43 df e0 a1 1e 2b 2a bf bc 66 1d eb c8 69 51 94 16 eb 16 16 0d 2b 9f bd b4 7c fd a0 5c 1d 4d 1b 2a 5e e7 5a e4 e8 48 8a 67 2a 90 e0 b8 1b b6 8c b7 4a 85 40 30 6a d9 db 99 59 76 66 ae 1d d6 27 d7 ce 3b 59 83 8e 67 d5 ee d9 40 a5 d9 33 4e 1a f0 c7 21 30 6c 2e 58 9f e1 bd 60 c1 25 38 dd d5 62 3a 58 30 21 58 3b 1d 6d c8 76 b6 b2 c5 2f a8 26 4a 86 74 50 20 b8 60 2f 68 a0 Data Ascii: Yr6v2[:uHB"bd"KNf>XqY,vS-r%u@t .=h8wA;ovtEC~m8}j%FC+fiQ+\|\M^ZHg*J@0jYvf';Yg@3N!0l.X`%8b:X0!X;mv/&JtP `/h

Timestamp	kBytes transferred	Direction	Data
2022-05-26 23:28:18 UTC	776	OUT	GET /axios/dist/axios.min.js HTTP/1.1 Host: unpkg.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://storageapi.fleek.co/84e74610-b8bb-4d6b-b394-8b4c2ffd51df-bucket/loginlg.html Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2022-05-26 23:28:18 UTC	777	IN	HTTP/1.1 302 Found Date: Thu, 26 May 2022 23:28:18 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close access-control-allow-origin: * cache-control: public, s-maxage=600, max-age=60 location: /axios@0.27.2/dist/axios.min.js vary: Accept via: 1.1 fly.io fly-request-id: 01G41ATC9WN2RP685MC2KA85XV-fra CF-Cache-Status: HIT Age: 328 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 711a49558e0d5c38-FRA
2022-05-26 23:28:18 UTC	777	IN	Data Raw: 33 35 0d 0a 46 6f 75 6e 64 2e 20 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 2f 61 78 69 6f 73 40 30 2e 32 37 2e 32 2f 64 69 73 74 2f 61 78 69 6f 73 2e 6d 69 6e 2e 6a 73 0d 0a Data Ascii: 35Found. Redirecting to /axios@0.27.2/dist/axios.min.js
2022-05-26 23:28:18 UTC	777	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-05-26 23:28:18 UTC	777	OUT	GET /16.000/Converged_v21033_5plpI1P0_uKjrokWdqCoBw2.css HTTP/1.1 Host: logincdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://storageapi.fleek.co/84e74610-b8bb-4d6b-b394-8b4c2ffd51df-bucket/loginlg.html Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2022-05-26 23:28:18 UTC	778	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 27124685 Cache-Control: public, max-age=31536000 Content-MD5: VBwBzy3TblLMnS1j3l8rDQ== Content-Type: text/css Date: Thu, 26 May 2022 23:28:18 GMT Etag: 0x8D82558CBC4E5D5 Last-Modified: Sat, 11 Jul 2020 05:10:57 GMT Server: ECAcc (frc/8F1A) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 1ddb8b43-e01e-007a-43a5-7ac91c000000 x-ms-version: 2009-09-19 Content-Length: 105369 Connection: close
2022-05-26 23:28:18 UTC	779	IN	Data Raw: 2f 2a 21 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 20 2a 2f 0a 2f 2a 21 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 53 54 41 52 54 20 4f 46 20 54 48 49 52 44 20 50 41 52 54 59 20 4e 4f 54 49 43 45 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 0a 54 68 69 73 20 66 69 6c 65 20 69 73 20 62 61 73 65 64 20 6f 6e 20 6f 72 20 69 6e 63 6f 72 70 6f 72 61 74 65 73 20 6d 61 74 65 72 69 61 6c 20 66 72 6f 6d 20 74 68 65 20 70 72 6f 6a 65 63 74 73 20 6c 69 73 74 65 64 Data Ascii: /! Copyright (C) Microsoft Corporation. All rights reserved. //*!------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------This file is based on or incorporates material from the projects listed
2022-05-26 23:28:18 UTC	794	IN	Data Raw: 2c 2e 63 6f 6c 2d 6d 64 2d 31 30 2c 2e 63 6f 6c 2d 6c 67 2d 31 30 2c 2e 63 6f 6c 2d 78 73 2d 31 31 2c 2e 63 6f 6c 2d 73 6d 2d 31 31 2c 2e 63 6f 6c 2d 6d 64 2d 31 31 2c 2e 63 6f 6c 2d 6c 67 2d 31 31 2c 2e 63 6f 6c 2d 78 73 2d 31 32 2c 2e 63 6f 6c 2d 73 6d 2d 31 32 2c 2e 63 6f 6c 2d 6d 64 2d 31 32 2c 2e 63 6f 6c 2d 6c 67 2d 31 32 2c 2e 63 6f 6c 2d 78 73 2d 31 33 2c 2e 63 6f 6c 2d 73 6d 2d 31 33 2c 2e 63 6f 6c 2d 6d 64 2d 31 33 2c 2e 63 6f 6c 2d 6c 67 2d 31 33 2c 2e 63 6f 6c 2d 78 73 2d 31 34 2c 2e 63 6f 6c 2d 73 6d 2d 31 34 2c 2e 63 6f 6c 2d 6d 64 2d 31 34 2c 2e 63 6f 6c 2d 6c 67 2d 31 34 2c 2e 63 6f 6c 2d 78 73 2d 31 35 2c 2e 63 6f 6c 2d 73 6d 2d 31 35 2c 2e 63 6f 6c 2d 6d 64 2d 31 35 2c 2e 63 6f 6c 2d 6c 67 2d 31 35 2c 2e 63 6f 6c 2d 78 73 2d 31 36 2c 2e Data Ascii: ,.col-md-10,.col-lg-10,.col-xs-11,.col-sm-11,.col-md-11,.col-lg-11,.col-xs-12,.col-sm-12,.col-md-12,.col-lg-12,.col-xs-13,.col-sm-13,.col-md-13,.col-lg-13,.col-xs-14,.col-sm-14,.col-md-14,.col-lg-14,.col-xs-15,.col-sm-15,.col-md-15,.col-lg-15,.col-xs-16,.
2022-05-26 23:28:18 UTC	810	IN	Data Raw: 36 2e 36 36 36 36 37 25 7d 2e 63 6f 6c 2d 78 6c 2d 6f 66 66 73 65 74 2d 35 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 32 30 2e 38 33 33 33 33 25 7d 2e 63 6f 6c 2d 78 6c 2d 6f 66 66 73 65 74 2d 36 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 32 35 25 7d 2e 63 6f 6c 2d 78 6c 2d 6f 66 66 73 65 74 2d 37 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 32 39 2e 31 36 36 36 37 25 7d 2e 63 6f 6c 2d 78 6c 2d 6f 66 66 73 65 74 2d 38 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 33 33 2e 33 33 33 33 33 25 7d 2e 63 6f 6c 2d 78 6c 2d 6f 66 66 73 65 74 2d 39 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 33 37 2e 35 25 7d 2e 63 6f 6c 2d 78 6c 2d 6f 66 66 73 65 74 2d 31 30 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 34 31 2e 36 36 36 36 37 25 7d 2e 63 6f 6c 2d 78 6c 2d 6f 66 66 73 65 74 2d 31 31 7b 6d 61 72 Data Ascii: 6.66667%}.col-xl-offset-5{margin-left:20.83333%}.col-xl-offset-6{margin-left:25%}.col-xl-offset-7{margin-left:29.16667%}.col-xl-offset-8{margin-left:33.33333%}.col-xl-offset-9{margin-left:37.5%}.col-xl-offset-10{margin-left:41.66667%}.col-xl-offset-11{mar
2022-05-26 23:28:18 UTC	826	IN	Data Raw: 6c 65 7b 77 69 64 74 68 3a 31 30 30 25 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 7d 2e 74 61 62 6c 65 3e 74 68 65 61 64 3e 74 72 3e 74 68 2c 2e 74 61 62 6c 65 3e 74 68 65 61 64 3e 74 72 3e 74 64 2c 2e 74 61 62 6c 65 3e 74 62 6f 64 79 3e 74 72 3e 74 68 2c 2e 74 61 62 6c 65 3e 74 62 6f 64 79 3e 74 72 3e 74 64 2c 2e 74 61 62 6c 65 3e 74 66 6f 6f 74 3e 74 72 3e 74 68 2c 2e 74 61 62 6c 65 3e 74 66 6f 6f 74 3e 74 72 3e 74 64 7b 70 61 64 64 69 6e 67 3a 31 36 70 78 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 74 6f 70 7d 2e 74 61 62 6c 65 3e 74 68 65 61 64 3e 74 72 3e 74 68 7b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 62 6f 74 74 6f 6d 7d 2e 74 61 62 6c 65 3e 63 61 70 74 69 6f 6e 2b 74 68 65 61 64 3e 74 72 3a 66 69 72 73 74 2d 63 68 69 6c 64 3e 74 68 2c Data Ascii: le{width:100%;max-width:100%}.table>thead>tr>th,.table>thead>tr>td,.table>tbody>tr>th,.table>tbody>tr>td,.table>tfoot>tr>th,.table>tfoot>tr>td{padding:16px;vertical-align:top}.table>thead>tr>th{vertical-align:bottom}.table>caption+thead>tr:first-child>th,
2022-05-26 23:28:18 UTC	842	IN	Data Raw: 6c 28 22 53 65 67 6f 65 20 55 49 20 42 6f 6c 64 22 29 7d 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 53 65 67 6f 65 20 55 49 20 57 65 62 66 6f 6e 74 22 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 69 74 61 6c 69 63 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 3b 73 72 63 3a 6c 6f 63 61 6c 28 22 53 65 67 6f 65 20 55 49 20 49 74 61 6c 69 63 22 29 7d 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 53 65 67 6f 65 20 55 49 20 57 65 62 66 6f 6e 74 22 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 69 74 61 6c 69 63 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 37 30 30 3b 73 72 63 3a 6c 6f 63 61 6c 28 22 53 65 67 6f 65 20 55 49 20 42 6f 6c 64 20 49 74 61 6c 69 63 22 29 7d 2e 63 6f 6e 74 61 69 6e 65 72 2c 2e 63 6f 6e 74 61 69 6e 65 72 Data Ascii: l("Segoe UI Bold")}@font-face{font-family:"Segoe UI Webfont";font-style:italic;font-weight:400;src:local("Segoe UI Italic")}@font-face{font-family:"Segoe UI Webfont";font-style:italic;font-weight:700;src:local("Segoe UI Bold Italic")}.container,.container
2022-05-26 23:28:19 UTC	858	IN	Data Raw: 22 5d 3a 61 63 74 69 76 65 2c 2e 62 74 6e 2e 62 74 6e 2d 70 72 69 6d 61 72 79 2d 61 63 74 69 76 65 2c 2e 62 74 6e 2e 62 74 6e 2d 70 72 69 6d 61 72 79 3a 61 63 74 69 76 65 2c 62 75 74 74 6f 6e 2e 62 74 6e 2d 70 72 69 6d 61 72 79 3a 61 63 74 69 76 65 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 5d 2e 62 74 6e 2d 70 72 69 6d 61 72 79 3a 61 63 74 69 76 65 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 73 75 62 6d 69 74 22 5d 2e 62 74 6e 2d 70 72 69 6d 61 72 79 3a 61 63 74 69 76 65 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 72 65 73 65 74 22 5d 2e 62 74 6e 2d 70 72 69 6d 61 72 79 3a 61 63 74 69 76 65 7b 6f 75 74 6c 69 6e 65 3a 6e 6f 6e 65 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 2d 6d 73 2d 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c Data Ascii: "]:active,.btn.btn-primary-active,.btn.btn-primary:active,button.btn-primary:active,input[type="button"].btn-primary:active,input[type="submit"].btn-primary:active,input[type="reset"].btn-primary:active{outline:none;text-decoration:none;-ms-transform:scal
2022-05-26 23:28:19 UTC	874	IN	Data Raw: 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 30 70 78 7d 2e 73 65 63 74 69 6f 6e 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 30 7d 2e 72 61 64 69 6f 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 32 30 70 78 7d 64 69 76 5b 72 6f 6c 65 3d 72 61 64 69 6f 67 72 6f 75 70 5d 3e 64 69 76 5b 63 6c 61 73 73 3d 22 72 61 64 69 6f 22 5d 3a 66 69 72 73 74 2d 63 68 69 6c 64 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 7d 2e 66 6f 72 6d 2d 67 72 6f 75 70 2d 74 6f 70 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 36 70 78 7d 64 69 76 5b 72 6f 6c 65 3d 6c 69 73 74 69 74 65 6d 5d 2c 2e 6c 69 73 74 2d 69 74 65 6d 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 32 30 70 78 3b 64 69 73 70 6c 61 79 3a 6c 69 73 74 2d 69 74 65 6d 3b 6c 69 73 74 2d 73 74 79 6c Data Ascii: line-height:20px}.section{margin-bottom:0}.radio{margin-top:20px;margin-bottom:20px}div[role=radiogroup]>div[class="radio"]:first-child{margin-top:0}.form-group-top{margin-top:16px}div[role=listitem],.list-item{margin-left:20px;display:list-item;list-styl

Timestamp	kBytes transferred	Direction	Data
2022-05-26 23:28:00 UTC	1	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2022-05-26 23:28:00 UTC	1	OUT	Data Raw: 20 Data Ascii:
2022-05-26 23:28:00 UTC	3	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 26 May 2022 23:28:00 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-2z2LxfsBMCfKbzIBR7gYLQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'nonce-2z2LxfsBMCfKbzIBR7gYLQ' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-05-26 23:28:00 UTC	5	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2022-05-26 23:28:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-05-26 23:28:19 UTC	882	OUT	GET /axios@0.27.2/dist/axios.min.js HTTP/1.1 Host: unpkg.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://storageapi.fleek.co/84e74610-b8bb-4d6b-b394-8b4c2ffd51df-bucket/loginlg.html Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2022-05-26 23:28:19 UTC	882	IN	HTTP/1.1 200 OK Date: Thu, 26 May 2022 23:28:19 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close access-control-allow-origin: * cache-control: public, max-age=31536000 last-modified: Sat, 26 Oct 1985 08:15:00 GMT etag: W/"511b-FCNxITHKHBRxCXquG/QTMqrMtJE" via: 1.1 fly.io fly-request-id: 01G1N7P0FGMM85DKPAH61P55Y6-fra CF-Cache-Status: HIT Age: 2553902 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 711a4956feea9c00-FRA
2022-05-26 23:28:19 UTC	883	IN	Data Raw: 31 36 31 39 0d 0a 2f 2a 20 61 78 69 6f 73 20 76 30 2e 32 37 2e 32 20 7c 20 28 63 29 20 32 30 32 32 20 62 79 20 4d 61 74 74 20 5a 61 62 72 69 73 6b 69 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 74 28 29 3a 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 3f 64 65 66 69 6e 65 28 5b 5d 2c 74 29 3a 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 3f 65 78 70 6f 72 74 73 2e 61 78 69 6f 73 3d 74 28 29 3a 65 2e 61 78 69 6f 73 3d 74 28 29 7d 28 74 68 69 73 2c 28 66 75 6e Data Ascii: 1619/* axios v0.27.2 \| (c) 2022 by Matt Zabriskie */!function(e,t){"object"==typeof exports&&"object"==typeof module?module.exports=t():"function"==typeof define&&define.amd?define([],t):"object"==typeof exports?exports.axios=t():e.axios=t()}(this,(fun
2022-05-26 23:28:19 UTC	883	IN	Data Raw: 21 30 7d 29 7d 2c 6e 2e 74 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 31 26 74 26 26 28 65 3d 6e 28 65 29 29 2c 38 26 74 29 72 65 74 75 72 6e 20 65 3b 69 66 28 34 26 74 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 26 26 65 26 26 65 2e 5f 5f 65 73 4d 6f 64 75 6c 65 29 72 65 74 75 72 6e 20 65 3b 76 61 72 20 72 3d 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 28 6e 75 6c 6c 29 3b 69 66 28 6e 2e 72 28 72 29 2c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 72 2c 22 64 65 66 61 75 6c 74 22 2c 7b 65 6e 75 6d 65 72 61 62 6c 65 3a 21 30 2c 76 61 6c 75 65 3a 65 7d 29 2c 32 26 74 26 26 22 73 74 72 69 6e 67 22 21 3d 74 79 70 65 6f 66 20 65 29 66 6f 72 28 76 61 72 20 6f 20 69 6e 20 65 29 6e 2e 64 28 72 2c 6f 2c 66 75 6e 63 74 69 Data Ascii: !0})},n.t=function(e,t){if(1&t&&(e=n(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var r=Object.create(null);if(n.r(r),Object.defineProperty(r,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var o in e)n.d(r,o,functi
2022-05-26 23:28:19 UTC	885	IN	Data Raw: 26 4f 62 6a 65 63 74 2e 67 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 28 55 69 6e 74 38 41 72 72 61 79 29 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 62 26 26 65 20 69 6e 73 74 61 6e 63 65 6f 66 20 62 7d 29 3b 65 2e 65 78 70 6f 72 74 73 3d 7b 69 73 41 72 72 61 79 3a 75 2c 69 73 41 72 72 61 79 42 75 66 66 65 72 3a 66 2c 69 73 42 75 66 66 65 72 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 21 3d 3d 65 26 26 21 63 28 65 29 26 26 6e 75 6c 6c 21 3d 3d 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 26 26 21 63 28 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 29 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 2e 69 73 42 75 66 66 65 72 26 26 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 2e 69 Data Ascii: &Object.getPrototypeOf(Uint8Array),function(e){return b&&e instanceof b});e.exports={isArray:u,isArrayBuffer:f,isBuffer:function(e){return null!==e&&!c(e)&&null!==e.constructor&&!c(e.constructor)&&"function"==typeof e.constructor.isBuffer&&e.constructor.i
2022-05-26 23:28:19 UTC	886	IN	Data Raw: 3a 65 2e 72 65 70 6c 61 63 65 28 2f 5e 5c 73 2b 7c 5c 73 2b 24 2f 67 2c 22 22 29 7d 2c 73 74 72 69 70 42 4f 4d 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 36 35 32 37 39 3d 3d 3d 65 2e 63 68 61 72 43 6f 64 65 41 74 28 30 29 26 26 28 65 3d 65 2e 73 6c 69 63 65 28 31 29 29 2c 65 7d 2c 69 6e 68 65 72 69 74 73 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 29 7b 65 2e 70 72 6f 74 6f 74 79 70 65 3d 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 28 74 2e 70 72 6f 74 6f 74 79 70 65 2c 72 29 2c 65 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 65 2c 6e 26 26 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 28 65 2e 70 72 6f 74 6f 74 79 70 65 2c 6e 29 7d 2c 74 6f 46 6c 61 74 4f 62 6a 65 63 74 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 Data Ascii: :e.replace(/^\s+\|\s+$/g,"")},stripBOM:function(e){return 65279===e.charCodeAt(0)&&(e=e.slice(1)),e},inherits:function(e,t,n,r){e.prototype=Object.create(t.prototype,r),e.prototype.constructor=e,n&&Object.assign(e.prototype,n)},toFlatObject:function(e,t,n)
2022-05-26 23:28:19 UTC	887	IN	Data Raw: 44 4f 55 54 22 2c 22 45 52 52 5f 4e 45 54 57 4f 52 4b 22 2c 22 45 52 52 5f 46 52 5f 54 4f 4f 5f 4d 41 4e 59 5f 52 45 44 49 52 45 43 54 53 22 2c 22 45 52 52 5f 44 45 50 52 45 43 41 54 45 44 22 2c 22 45 52 52 5f 42 41 44 5f 52 45 53 50 4f 4e 53 45 22 2c 22 45 52 52 5f 42 41 44 5f 52 45 51 55 45 53 54 22 2c 22 45 52 52 5f 43 41 4e 43 45 4c 45 44 22 5d 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 73 5b 65 5d 3d 7b 76 61 6c 75 65 3a 65 7d 7d 29 29 2c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 69 65 73 28 6f 2c 73 29 2c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 69 2c 22 69 73 41 78 69 6f 73 45 72 72 6f 72 22 2c 7b 76 61 6c 75 65 3a 21 30 7d 29 2c 6f 2e 66 72 6f 6d 3d 66 75 6e 63 74 69 6f 6e 28 65 2c Data Ascii: DOUT","ERR_NETWORK","ERR_FR_TOO_MANY_REDIRECTS","ERR_DEPRECATED","ERR_BAD_RESPONSE","ERR_BAD_REQUEST","ERR_CANCELED"].forEach((function(e){s[e]={value:e}})),Object.defineProperties(o,s),Object.defineProperty(i,"isAxiosError",{value:!0}),o.from=function(e,
2022-05-26 23:28:19 UTC	888	IN	Data Raw: 33 62 30 32 0d 0a 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 58 4d 4c 48 74 74 70 52 65 71 75 65 73 74 7c 7c 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 70 72 6f 63 65 73 73 26 26 22 5b 6f 62 6a 65 63 74 20 70 72 6f 63 65 73 73 5d 22 3d 3d 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 74 6f 53 74 72 69 6e 67 2e 63 61 6c 6c 28 70 72 6f 63 65 73 73 29 29 26 26 28 66 3d 6e 28 38 29 29 2c 66 29 2c 74 72 61 6e 73 66 6f 72 6d 52 65 71 75 65 73 74 3a 5b 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 6f 28 74 2c 22 41 63 63 65 70 74 22 29 2c 6f 28 74 2c 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 29 2c 72 2e 69 73 46 6f 72 6d 44 61 74 61 28 65 29 7c 7c 72 2e 69 73 41 72 72 61 79 42 75 66 66 65 72 28 65 29 7c 7c 72 2e Data Ascii: 3b02("undefined"!=typeof XMLHttpRequest\|\|"undefined"!=typeof process&&"[object process]"===Object.prototype.toString.call(process))&&(f=n(8)),f),transformRequest:[function(e,t){if(o(t,"Accept"),o(t,"Content-Type"),r.isFormData(e)\|\|r.isArrayBuffer(e)\|\|r.
2022-05-26 23:28:19 UTC	890	IN	Data Raw: 70 74 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 2c 20 74 65 78 74 2f 70 6c 61 69 6e 2c 20 2a 2f 2a 22 7d 7d 7d 3b 72 2e 66 6f 72 45 61 63 68 28 5b 22 64 65 6c 65 74 65 22 2c 22 67 65 74 22 2c 22 68 65 61 64 22 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 6c 2e 68 65 61 64 65 72 73 5b 65 5d 3d 7b 7d 7d 29 29 2c 72 2e 66 6f 72 45 61 63 68 28 5b 22 70 6f 73 74 22 2c 22 70 75 74 22 2c 22 70 61 74 63 68 22 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 6c 2e 68 65 61 64 65 72 73 5b 65 5d 3d 72 2e 6d 65 72 67 65 28 75 29 7d 29 29 2c 65 2e 65 78 70 6f 72 74 73 3d 6c 7d 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 66 Data Ascii: pt:"application/json, text/plain, /"}}};r.forEach(["delete","get","head"],(function(e){l.headers[e]={}})),r.forEach(["post","put","patch"],(function(e){l.headers[e]=r.merge(u)})),e.exports=l},function(e,t,n){"use strict";e.exports=function(e,t){return f
2022-05-26 23:28:19 UTC	891	IN	Data Raw: 6c 61 69 6e 4f 62 6a 65 63 74 28 69 29 7c 7c 72 2e 69 73 41 72 72 61 79 28 69 29 29 7b 69 66 28 2d 31 21 3d 3d 6e 2e 69 6e 64 65 78 4f 66 28 69 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 43 69 72 63 75 6c 61 72 20 72 65 66 65 72 65 6e 63 65 20 64 65 74 65 63 74 65 64 20 69 6e 20 22 2b 73 29 3b 6e 2e 70 75 73 68 28 69 29 2c 72 2e 66 6f 72 45 61 63 68 28 69 2c 28 66 75 6e 63 74 69 6f 6e 28 6e 2c 69 29 7b 69 66 28 21 72 2e 69 73 55 6e 64 65 66 69 6e 65 64 28 6e 29 29 7b 76 61 72 20 61 2c 75 3d 73 3f 73 2b 22 2e 22 2b 69 3a 69 3b 69 66 28 6e 26 26 21 73 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6e 29 69 66 28 72 2e 65 6e 64 73 57 69 74 68 28 69 2c 22 7b 7d 22 29 29 6e 3d 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 6e 29 3b 65 6c 73 65 20 69 Data Ascii: lainObject(i)\|\|r.isArray(i)){if(-1!==n.indexOf(i))throw Error("Circular reference detected in "+s);n.push(i),r.forEach(i,(function(n,i){if(!r.isUndefined(n)){var a,u=s?s+"."+i:i;if(n&&!s&&"object"==typeof n)if(r.endsWith(i,"{}"))n=JSON.stringify(n);else i
2022-05-26 23:28:19 UTC	892	IN	Data Raw: 6f 6e 6c 6f 61 64 65 6e 64 22 69 6e 20 45 3f 45 2e 6f 6e 6c 6f 61 64 65 6e 64 3d 77 3a 45 2e 6f 6e 72 65 61 64 79 73 74 61 74 65 63 68 61 6e 67 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 45 26 26 34 3d 3d 3d 45 2e 72 65 61 64 79 53 74 61 74 65 26 26 28 30 21 3d 3d 45 2e 73 74 61 74 75 73 7c 7c 45 2e 72 65 73 70 6f 6e 73 65 55 52 4c 26 26 30 3d 3d 3d 45 2e 72 65 73 70 6f 6e 73 65 55 52 4c 2e 69 6e 64 65 78 4f 66 28 22 66 69 6c 65 3a 22 29 29 26 26 73 65 74 54 69 6d 65 6f 75 74 28 77 29 7d 2c 45 2e 6f 6e 61 62 6f 72 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 45 26 26 28 6e 28 6e 65 77 20 6c 28 22 52 65 71 75 65 73 74 20 61 62 6f 72 74 65 64 22 2c 6c 2e 45 43 4f 4e 4e 41 42 4f 52 54 45 44 2c 65 2c 45 29 29 2c 45 3d 6e 75 6c 6c 29 7d 2c 45 2e 6f 6e 65 72 72 6f 72 3d Data Ascii: onloadend"in E?E.onloadend=w:E.onreadystatechange=function(){E&&4===E.readyState&&(0!==E.status\|\|E.responseURL&&0===E.responseURL.indexOf("file:"))&&setTimeout(w)},E.onabort=function(){E&&(n(new l("Request aborted",l.ECONNABORTED,e,E)),E=null)},E.onerror=
2022-05-26 23:28:19 UTC	894	IN	Data Raw: 64 28 78 29 3b 53 26 26 2d 31 3d 3d 3d 5b 22 68 74 74 70 22 2c 22 68 74 74 70 73 22 2c 22 66 69 6c 65 22 5d 2e 69 6e 64 65 78 4f 66 28 53 29 3f 6e 28 6e 65 77 20 6c 28 22 55 6e 73 75 70 70 6f 72 74 65 64 20 70 72 6f 74 6f 63 6f 6c 20 22 2b 53 2b 22 3a 22 2c 6c 2e 45 52 52 5f 42 41 44 5f 52 45 51 55 45 53 54 2c 65 29 29 3a 45 2e 73 65 6e 64 28 6d 29 7d 29 29 7d 7d 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 3d 6e 28 32 32 29 2c 6f 3d 6e 28 32 33 29 3b 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 65 26 26 21 72 28 74 29 3f 6f 28 65 2c 74 29 3a 74 7d 7d 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 65 2e 65 Data Ascii: d(x);S&&-1===["http","https","file"].indexOf(S)?n(new l("Unsupported protocol "+S+":",l.ERR_BAD_REQUEST,e)):E.send(m)}))}},function(e,t,n){"use strict";var r=n(22),o=n(23);e.exports=function(e,t){return e&&!r(t)?o(e,t):t}},function(e,t,n){"use strict";e.e
2022-05-26 23:28:19 UTC	895	IN	Data Raw: 29 7d 29 29 2c 6e 7d 7d 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 65 2e 65 78 70 6f 72 74 73 3d 7b 76 65 72 73 69 6f 6e 3a 22 30 2e 32 37 2e 32 22 7d 7d 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 65 2e 65 78 70 6f 72 74 73 3d 6e 28 31 34 29 7d 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 3d 6e 28 30 29 2c 6f 3d 6e 28 34 29 2c 69 3d 6e 28 31 35 29 2c 73 3d 6e 28 31 31 29 3b 76 61 72 20 61 3d 66 75 6e 63 74 69 6f 6e 20 65 28 74 29 7b 76 61 72 20 6e 3d 6e 65 77 20 69 28 74 29 2c 61 3d 6f 28 69 2e 70 72 6f 74 6f 74 79 70 65 2e 72 65 71 75 65 73 74 2c 6e 29 3b 72 65 74 75 72 6e 20 72 2e 65 78 74 65 6e 64 28 61 2c 69 2e 70 72 6f 74 6f 74 79 70 65 2c 6e 29 2c 72 2e 65 78 74 65 6e 64 28 61 2c Data Ascii: )})),n}},function(e,t){e.exports={version:"0.27.2"}},function(e,t,n){e.exports=n(14)},function(e,t,n){"use strict";var r=n(0),o=n(4),i=n(15),s=n(11);var a=function e(t){var n=new i(t),a=o(i.prototype.request,n);return r.extend(a,i.prototype,n),r.extend(a,
2022-05-26 23:28:19 UTC	896	IN	Data Raw: 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 75 2e 70 75 73 68 28 65 2e 66 75 6c 66 69 6c 6c 65 64 2c 65 2e 72 65 6a 65 63 74 65 64 29 7d 29 29 2c 21 6f 29 7b 76 61 72 20 6c 3d 5b 73 2c 76 6f 69 64 20 30 5d 3b 66 6f 72 28 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 75 6e 73 68 69 66 74 2e 61 70 70 6c 79 28 6c 2c 72 29 2c 6c 3d 6c 2e 63 6f 6e 63 61 74 28 75 29 2c 69 3d 50 72 6f 6d 69 73 65 2e 72 65 73 6f 6c 76 65 28 74 29 3b 6c 2e 6c 65 6e 67 74 68 3b 29 69 3d 69 2e 74 68 65 6e 28 6c 2e 73 68 69 66 74 28 29 2c 6c 2e 73 68 69 66 74 28 29 29 3b 72 65 74 75 72 6e 20 69 7d 66 6f 72 28 76 61 72 20 70 3d 74 3b 72 2e 6c 65 6e 67 74 68 3b 29 7b 76 61 72 20 64 3d 72 2e 73 68 69 66 74 28 29 2c 68 3d 72 2e 73 68 69 66 74 28 29 3b 74 72 79 7b 70 3d Data Ascii: orEach((function(e){u.push(e.fulfilled,e.rejected)})),!o){var l=[s,void 0];for(Array.prototype.unshift.apply(l,r),l=l.concat(u),i=Promise.resolve(t);l.length;)i=i.then(l.shift(),l.shift());return i}for(var p=t;r.length;){var d=r.shift(),h=r.shift();try{p=
2022-05-26 23:28:19 UTC	898	IN	Data Raw: 29 2c 73 3d 6e 28 33 29 2c 61 3d 6e 28 32 29 3b 66 75 6e 63 74 69 6f 6e 20 75 28 65 29 7b 69 66 28 65 2e 63 61 6e 63 65 6c 54 6f 6b 65 6e 26 26 65 2e 63 61 6e 63 65 6c 54 6f 6b 65 6e 2e 74 68 72 6f 77 49 66 52 65 71 75 65 73 74 65 64 28 29 2c 65 2e 73 69 67 6e 61 6c 26 26 65 2e 73 69 67 6e 61 6c 2e 61 62 6f 72 74 65 64 29 74 68 72 6f 77 20 6e 65 77 20 61 7d 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 75 28 65 29 2c 65 2e 68 65 61 64 65 72 73 3d 65 2e 68 65 61 64 65 72 73 7c 7c 7b 7d 2c 65 2e 64 61 74 61 3d 6f 2e 63 61 6c 6c 28 65 2c 65 2e 64 61 74 61 2c 65 2e 68 65 61 64 65 72 73 2c 65 2e 74 72 61 6e 73 66 6f 72 6d 52 65 71 75 65 73 74 29 2c 65 2e 68 65 61 64 65 72 73 3d 72 2e 6d 65 72 67 65 28 65 2e 68 65 61 64 Data Ascii: ),s=n(3),a=n(2);function u(e){if(e.cancelToken&&e.cancelToken.throwIfRequested(),e.signal&&e.signal.aborted)throw new a}e.exports=function(e){return u(e),e.headers=e.headers\|\|{},e.data=o.call(e,e.data,e.headers,e.transformRequest),e.headers=r.merge(e.head
2022-05-26 23:28:19 UTC	899	IN	Data Raw: 22 2b 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 74 29 29 2c 72 2e 69 73 4e 75 6d 62 65 72 28 6e 29 26 26 61 2e 70 75 73 68 28 22 65 78 70 69 72 65 73 3d 22 2b 6e 65 77 20 44 61 74 65 28 6e 29 2e 74 6f 47 4d 54 53 74 72 69 6e 67 28 29 29 2c 72 2e 69 73 53 74 72 69 6e 67 28 6f 29 26 26 61 2e 70 75 73 68 28 22 70 61 74 68 3d 22 2b 6f 29 2c 72 2e 69 73 53 74 72 69 6e 67 28 69 29 26 26 61 2e 70 75 73 68 28 22 64 6f 6d 61 69 6e 3d 22 2b 69 29 2c 21 30 3d 3d 3d 73 26 26 61 2e 70 75 73 68 28 22 73 65 63 75 72 65 22 29 2c 64 6f 63 75 6d 65 6e 74 2e 63 6f 6f 6b 69 65 3d 61 2e 6a 6f 69 6e 28 22 3b 20 22 29 7d 2c 72 65 61 64 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 64 6f 63 75 6d 65 6e 74 2e 63 6f 6f 6b 69 65 2e 6d 61 74 63 68 28 6e 65 Data Ascii: "+encodeURIComponent(t)),r.isNumber(n)&&a.push("expires="+new Date(n).toGMTString()),r.isString(o)&&a.push("path="+o),r.isString(i)&&a.push("domain="+i),!0===s&&a.push("secure"),document.cookie=a.join("; ")},read:function(e){var t=document.cookie.match(ne
2022-05-26 23:28:19 UTC	900	IN	Data Raw: 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 61 22 29 3b 66 75 6e 63 74 69 6f 6e 20 6f 28 65 29 7b 76 61 72 20 72 3d 65 3b 72 65 74 75 72 6e 20 74 26 26 28 6e 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 68 72 65 66 22 2c 72 29 2c 72 3d 6e 2e 68 72 65 66 29 2c 6e 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 68 72 65 66 22 2c 72 29 2c 7b 68 72 65 66 3a 6e 2e 68 72 65 66 2c 70 72 6f 74 6f 63 6f 6c 3a 6e 2e 70 72 6f 74 6f 63 6f 6c 3f 6e 2e 70 72 6f 74 6f 63 6f 6c 2e 72 65 70 6c 61 63 65 28 2f 3a 24 2f 2c 22 22 29 3a 22 22 2c 68 6f 73 74 3a 6e 2e 68 6f 73 74 2c 73 65 61 72 63 68 3a 6e 2e 73 65 61 72 63 68 3f 6e 2e 73 65 61 72 63 68 2e 72 65 70 6c 61 63 65 28 2f 5e 5c 3f 2f 2c 22 22 29 3a 22 22 2c 68 61 73 68 3a 6e 2e 68 61 73 68 3f 6e 2e 68 61 73 68 2e 72 65 Data Ascii: createElement("a");function o(e){var r=e;return t&&(n.setAttribute("href",r),r=n.href),n.setAttribute("href",r),{href:n.href,protocol:n.protocol?n.protocol.replace(/:$/,""):"",host:n.host,search:n.search?n.search.replace(/^\?/,""):"",hash:n.hash?n.hash.re
2022-05-26 23:28:19 UTC	902	IN	Data Raw: 74 2e 6b 65 79 73 28 65 29 2c 69 3d 72 2e 6c 65 6e 67 74 68 3b 69 2d 2d 20 3e 30 3b 29 7b 76 61 72 20 73 3d 72 5b 69 5d 2c 61 3d 74 5b 73 5d 3b 69 66 28 61 29 7b 76 61 72 20 75 3d 65 5b 73 5d 2c 63 3d 76 6f 69 64 20 30 3d 3d 3d 75 7c 7c 61 28 75 2c 73 2c 65 29 3b 69 66 28 21 30 21 3d 3d 63 29 74 68 72 6f 77 20 6e 65 77 20 6f 28 22 6f 70 74 69 6f 6e 20 22 2b 73 2b 22 20 6d 75 73 74 20 62 65 20 22 2b 63 2c 6f 2e 45 52 52 5f 42 41 44 5f 4f 50 54 49 4f 4e 5f 56 41 4c 55 45 29 7d 65 6c 73 65 20 69 66 28 21 30 21 3d 3d 6e 29 74 68 72 6f 77 20 6e 65 77 20 6f 28 22 55 6e 6b 6e 6f 77 6e 20 6f 70 74 69 6f 6e 20 22 2b 73 2c 6f 2e 45 52 52 5f 42 41 44 5f 4f 50 54 49 4f 4e 29 7d 7d 2c 76 61 6c 69 64 61 74 6f 72 73 3a 69 7d 7d 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c Data Ascii: t.keys(e),i=r.length;i-- >0;){var s=r[i],a=t[s];if(a){var u=e[s],c=void 0===u\|\|a(u,s,e);if(!0!==c)throw new o("option "+s+" must be "+c,o.ERR_BAD_OPTION_VALUE)}else if(!0!==n)throw new o("Unknown option "+s,o.ERR_BAD_OPTION)}},validators:i}},function(e,t,
2022-05-26 23:28:19 UTC	903	IN	Data Raw: 41 78 69 6f 73 45 72 72 6f 72 7d 7d 5d 29 7d 29 29 3b 0a 2f 2f 23 20 73 6f 75 72 63 65 4d 61 70 70 69 6e 67 55 52 4c 3d 61 78 69 6f 73 2e 6d 69 6e 2e 6d 61 70 0d 0a Data Ascii: AxiosError}}])}));//# sourceMappingURL=axios.min.map
2022-05-26 23:28:19 UTC	903	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-05-26 23:28:19 UTC	903	OUT	GET /shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1 Host: logincdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://storageapi.fleek.co/84e74610-b8bb-4d6b-b394-8b4c2ffd51df-bucket/loginlg.html Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2022-05-26 23:28:19 UTC	905	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding Age: 30377813 Cache-Control: public, max-age=31536000 Content-MD5: nzaLxFgP7ZB3dfMcaybWzw== Content-Type: image/svg+xml Date: Thu, 26 May 2022 23:28:19 GMT Etag: 0x8D79ED29CF0C29A Last-Modified: Wed, 22 Jan 2020 00:32:50 GMT Server: ECAcc (frc/8E9E) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: ae00a5ef-301e-0050-690f-5d9d0f000000 x-ms-version: 2009-09-19 Content-Length: 3651 Connection: close
2022-05-26 23:28:19 UTC	906	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 31 30 38 22 20 68 65 69 67 68 74 3d 22 32 34 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 30 38 20 32 34 22 3e 3c 74 69 74 6c 65 3e 61 73 73 65 74 73 3c 2f 74 69 74 6c 65 3e 3c 70 61 74 68 20 64 3d 22 4d 34 34 2e 38 33 36 2c 34 2e 36 56 31 38 2e 34 68 2d 32 2e 34 56 37 2e 35 38 33 48 34 32 2e 34 4c 33 38 2e 31 31 39 2c 31 38 2e 34 48 33 36 2e 35 33 31 4c 33 32 2e 31 34 32 2c 37 2e 35 38 33 68 2d 2e 30 32 39 56 31 38 2e 34 48 32 39 2e 39 56 34 2e 36 68 33 2e 34 33 36 4c 33 37 2e 33 2c 31 34 2e 38 33 68 2e 30 35 38 4c 34 31 2e 35 34 35 2c 34 2e 36 5a 6d 32 2c 31 2e 30 34 39 61 31 2e 32 36 38 2c 31 2e 32 36 38 2c 30 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="108" height="24" viewBox="0 0 108 24"><title>assets</title><path d="M44.836,4.6V18.4h-2.4V7.583H42.4L38.119,18.4H36.531L32.142,7.583h-.029V18.4H29.9V4.6h3.436L37.3,14.83h.058L41.545,4.6Zm2,1.049a1.268,1.268,0