Edit tour

Windows Analysis Report
https://cyan-bamboo-4lth.squarespace.com/

Overview

General Information

Sample URL:	https://cyan-bamboo-4lth.squarespace.com/
Analysis ID:	602176
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

No HTML title found

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5792 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "https://cyan-bamboo-4lth.squarespace.com/ MD5: C139654B5C1438A95B321BB01AD63EF6)

chrome.exe (PID: 4684 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1588,17004896836549072442,15477467046775337148,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1912 /prefetch:8 MD5: C139654B5C1438A95B321BB01AD63EF6)

cleanup

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: https://cyan-bamboo-4lth.squarespace.com/	HTTP Parser: HTML title missing
Source: https://cyan-bamboo-4lth.squarespace.com/	HTTP Parser: HTML title missing

Source: https://cyan-bamboo-4lth.squarespace.com/	HTTP Parser: No <meta name="author".. found
Source: https://cyan-bamboo-4lth.squarespace.com/	HTTP Parser: No <meta name="author".. found

Source: https://cyan-bamboo-4lth.squarespace.com/	HTTP Parser: No <meta name="copyright".. found
Source: https://cyan-bamboo-4lth.squarespace.com/	HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic			Jump to behavior

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-85.0.4183.121Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: cyan-bamboo-4lth.squarespace.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/versioned-site-css/6243cc896df8031d647f126b/1/5c5a519771c10ba3470d8101/6243cc896df8031d647f1288/1203/site.css HTTP/1.1Host: static1.squarespace.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,/;q=0.1Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://cyan-bamboo-4lth.squarespace.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/vta/5c5a519771c10ba3470d8101/scripts/site-bundle.79e4d49ec1bb265a67e65d6b798a53e4.js HTTP/1.1Host: static1.squarespace.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cyan-bamboo-4lth.squarespace.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/poppins/v19/pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2 HTTP/1.1Host: fonts.gstatic.comConnection: keep-aliveOrigin: https://cyan-bamboo-4lth.squarespace.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://fonts.googleapis.com/css2?family=Poppins:ital,wght@0,300;0,400;0,500;0,700;1,300Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/poppins/v19/pxiByp8kv8JHgFVrLDz8Z1xlFQ.woff2 HTTP/1.1Host: fonts.gstatic.comConnection: keep-aliveOrigin: https://cyan-bamboo-4lth.squarespace.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://fonts.googleapis.com/css2?family=Poppins:ital,wght@0,300;0,400;0,500;0,700;1,300Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/1/performance/settings HTTP/1.1Host: cyan-bamboo-4lth.squarespace.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://cyan-bamboo-4lth.squarespace.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: crumb=BVzlMBSiV2geOTQ5MTNjOTJhZDU4ZTlkYTM5YzY2Mjc4MmYxNTk5
Source: global traffic	HTTP traffic detected: GET /static/vta/5c5a519771c10ba3470d8101/scripts/floating-cart.b7c69926f0fd20087e37.js HTTP/1.1Host: static1.squarespace.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cyan-bamboo-4lth.squarespace.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: cyan-bamboo-4lth.squarespace.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: crumb=BVzlMBSiV2geOTQ5MTNjOTJhZDU4ZTlkYTM5YzY2Mjc4MmYxNTk5; ss_cvr=d16fb2ba-f077-420a-a855-f19e4dac9ea9\|1649081083395\|1649081083395\|1649081083395\|1; ss_cvt=1649081083395If-None-Match: W/"c1649872ce5308e23071a40f6de5c536--gzip"
Source: global traffic	HTTP traffic detected: GET /api/1/performance/settings HTTP/1.1Host: cyan-bamboo-4lth.squarespace.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://cyan-bamboo-4lth.squarespace.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: crumb=BVzlMBSiV2geOTQ5MTNjOTJhZDU4ZTlkYTM5YzY2Mjc4MmYxNTk5; ss_cvr=d16fb2ba-f077-420a-a855-f19e4dac9ea9\|1649081083395\|1649081083395\|1649081083395\|1; ss_cvt=1649081083395
Source: global traffic	HTTP traffic detected: GET /crx/blobs/Acy1k0bLIjHsvnKaKN_oRpVaYYvFs25d7GKYF1WXrT6yizCMksBO0c_ggE0B6tx6HPRHe6q1GOEe3_NcIbSiGG8kXeLMUY0sAKVvC6R89zvKM13s5VqoAMZSmuUgjQL5vlygJuArQghXXE_qTL7NlQ/extension_8520_615_0_5.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: 51e60c39-f2c3-4595-8c1d-067d958b3629.tmp.2.dr, 99254b2e-4a4f-4ba3-addb-25bc3d8e7708.tmp.2.dr	String found in binary or memory: https://accounts.google.com
Source: craw_window.js.0.dr	String found in binary or memory: https://accounts.google.com/MergeSession
Source: 51e60c39-f2c3-4595-8c1d-067d958b3629.tmp.2.dr, 99254b2e-4a4f-4ba3-addb-25bc3d8e7708.tmp.2.dr	String found in binary or memory: https://apis.google.com
Source: 51e60c39-f2c3-4595-8c1d-067d958b3629.tmp.2.dr, 99254b2e-4a4f-4ba3-addb-25bc3d8e7708.tmp.2.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json.0.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 51e60c39-f2c3-4595-8c1d-067d958b3629.tmp.2.dr, 99254b2e-4a4f-4ba3-addb-25bc3d8e7708.tmp.2.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: 51e60c39-f2c3-4595-8c1d-067d958b3629.tmp.2.dr	String found in binary or memory: https://content-autofill.googleapis.com
Source: History Provider Cache.0.dr	String found in binary or memory: https://cyan-bamboo-4lth.squarespace.com/#page2
Source: History Provider Cache.0.dr	String found in binary or memory: https://cyan-bamboo-4lth.squarespace.com/2
Source: 51e60c39-f2c3-4595-8c1d-067d958b3629.tmp.2.dr, a6336a0e-8630-40af-9360-f41c8bbce213.tmp.2.dr, 99254b2e-4a4f-4ba3-addb-25bc3d8e7708.tmp.2.dr	String found in binary or memory: https://dns.google
Source: 51e60c39-f2c3-4595-8c1d-067d958b3629.tmp.2.dr, 99254b2e-4a4f-4ba3-addb-25bc3d8e7708.tmp.2.dr	String found in binary or memory: https://fonts.googleapis.com
Source: 51e60c39-f2c3-4595-8c1d-067d958b3629.tmp.2.dr, 99254b2e-4a4f-4ba3-addb-25bc3d8e7708.tmp.2.dr	String found in binary or memory: https://fonts.gstatic.com
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
Source: 51e60c39-f2c3-4595-8c1d-067d958b3629.tmp.2.dr, 99254b2e-4a4f-4ba3-addb-25bc3d8e7708.tmp.2.dr	String found in binary or memory: https://ogs.google.com
Source: craw_window.js.0.dr, manifest.json.0.dr	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: 51e60c39-f2c3-4595-8c1d-067d958b3629.tmp.2.dr, 99254b2e-4a4f-4ba3-addb-25bc3d8e7708.tmp.2.dr	String found in binary or memory: https://play.google.com
Source: 51e60c39-f2c3-4595-8c1d-067d958b3629.tmp.2.dr	String found in binary or memory: https://r3---sn-4g5lzney.gvt1.com
Source: 51e60c39-f2c3-4595-8c1d-067d958b3629.tmp.2.dr	String found in binary or memory: https://redirector.gvt1.com
Source: craw_window.js.0.dr, manifest.json.0.dr	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: 51e60c39-f2c3-4595-8c1d-067d958b3629.tmp.2.dr, 99254b2e-4a4f-4ba3-addb-25bc3d8e7708.tmp.2.dr	String found in binary or memory: https://ssl.gstatic.com
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://www-googleapis-staging.sandbox.google.com
Source: 51e60c39-f2c3-4595-8c1d-067d958b3629.tmp.2.dr, 99254b2e-4a4f-4ba3-addb-25bc3d8e7708.tmp.2.dr	String found in binary or memory: https://www.google.com
Source: manifest.json.0.dr	String found in binary or memory: https://www.google.com/
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/accounts/OAuthLogin?issueuberauth=1
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/cleardot.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/dot2.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/x2.gif
Source: craw_background.js.0.dr	String found in binary or memory: https://www.google.com/intl/en-US/chrome/blank.html
Source: 51e60c39-f2c3-4595-8c1d-067d958b3629.tmp.2.dr, craw_window.js.0.dr, craw_background.js.0.dr, 99254b2e-4a4f-4ba3-addb-25bc3d8e7708.tmp.2.dr	String found in binary or memory: https://www.googleapis.com
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: 51e60c39-f2c3-4595-8c1d-067d958b3629.tmp.2.dr, 99254b2e-4a4f-4ba3-addb-25bc3d8e7708.tmp.2.dr	String found in binary or memory: https://www.gstatic.com

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "https://cyan-bamboo-4lth.squarespace.com/
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1588,17004896836549072442,15477467046775337148,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1912 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1588,17004896836549072442,15477467046775337148,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1912 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	3 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	3 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	4 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	1 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud

Source	Detection	Scanner	Label	Link
https://cyan-bamboo-4lth.squarespace.com/	0%	Virustotal		Browse
https://cyan-bamboo-4lth.squarespace.com/	0%	Avira URL Cloud	safe
https://cyan-bamboo-4lth.squarespace.com/	100%	SlashNext	Credential Stealing type: Phishing & Social Engineering

Name	IP	Active	Malicious	Reputation
gstaticadssl.l.google.com	216.58.215.227	true	false	high
cyan-bamboo-4lth.squarespace.com	198.185.159.177	true	false	high
accounts.google.com	142.250.203.109	true	false	high
clients.l.google.com	216.58.215.238	true	false	high
prod.squarespace.map.fastly.net	151.101.0.238	true	false	unknown
googlehosted.l.googleusercontent.com	172.217.168.65	true	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
use.typekit.net	unknown	unknown	false	high
clients2.google.com	unknown	unknown	false	high
p.typekit.net	unknown	unknown	false	high
images.squarespace-cdn.com	unknown	unknown	false	unknown
assets.squarespace.com	unknown	unknown	false	high
static1.squarespace.com	unknown	unknown	false	high

Name	Malicious	Reputation
https://cyan-bamboo-4lth.squarespace.com/api/census/form-render	false	high
https://cyan-bamboo-4lth.squarespace.com/api/1/performance/records	false	high
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1	false	high
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false	high
https://cyan-bamboo-4lth.squarespace.com/	false	high
https://cyan-bamboo-4lth.squarespace.com/api/1/performance/settings	false	high
https://static1.squarespace.com/static/versioned-site-css/6243cc896df8031d647f126b/1/5c5a519771c10ba3470d8101/6243cc896df8031d647f1288/1203/site.css	false	high
https://cyan-bamboo-4lth.squarespace.com/api/census/RecordHit	false	high
https://clients2.googleusercontent.com/crx/blobs/Acy1k0bLIjHsvnKaKN_oRpVaYYvFs25d7GKYF1WXrT6yizCMksBO0c_ggE0B6tx6HPRHe6q1GOEe3_NcIbSiGG8kXeLMUY0sAKVvC6R89zvKM13s5VqoAMZSmuUgjQL5vlygJuArQghXXE_qTL7NlQ/extension_8520_615_0_5.crx	false	high
https://cyan-bamboo-4lth.squarespace.com/	false	high
https://static1.squarespace.com/static/vta/5c5a519771c10ba3470d8101/scripts/site-bundle.79e4d49ec1bb265a67e65d6b798a53e4.js	false	high
https://static1.squarespace.com/static/vta/5c5a519771c10ba3470d8101/scripts/floating-cart.b7c69926f0fd20087e37.js	false	high

IP	Domain	Country	ASN	ASN Name	Malicious
216.58.215.238	clients.l.google.com	United States	15169	GOOGLEUS	false
216.58.215.227	gstaticadssl.l.google.com	United States	15169	GOOGLEUS	false
151.101.0.238	prod.squarespace.map.fastly.net	United States	54113	FASTLYUS	false
198.185.159.177	cyan-bamboo-4lth.squarespace.com	United States	53831	SQUARESPACEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.217.168.65	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
142.250.203.109	accounts.google.com	United States	15169	GOOGLEUS	false

IP
192.168.2.1
127.0.0.1

Name	Source	Malicious	Antivirus Detection	Reputation
https://dns.google	51e60c39-f2c3-4595-8c1d-067d958b3629.tmp.2.dr, a6336a0e-8630-40af-9360-f41c8bbce213.tmp.2.dr, 99254b2e-4a4f-4ba3-addb-25bc3d8e7708.tmp.2.dr	false	URL Reputation: safe	unknown
https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p	craw_window.js.0.dr, craw_background.js.0.dr	false		high
https://www.google.com/intl/en-US/chrome/blank.html	craw_background.js.0.dr	false		high
https://ogs.google.com	51e60c39-f2c3-4595-8c1d-067d958b3629.tmp.2.dr, 99254b2e-4a4f-4ba3-addb-25bc3d8e7708.tmp.2.dr	false		high
https://www.google.com/images/cleardot.gif	craw_window.js.0.dr	false		high
https://play.google.com	51e60c39-f2c3-4595-8c1d-067d958b3629.tmp.2.dr, 99254b2e-4a4f-4ba3-addb-25bc3d8e7708.tmp.2.dr	false		high
https://payments.google.com/payments/v4/js/integrator.js	craw_window.js.0.dr, manifest.json.0.dr	false		high
https://sandbox.google.com/payments/v4/js/integrator.js	craw_window.js.0.dr, manifest.json.0.dr	false		high
https://www.google.com/images/x2.gif	craw_window.js.0.dr	false		high
https://accounts.google.com/MergeSession	craw_window.js.0.dr	false		high
https://www.google.com	51e60c39-f2c3-4595-8c1d-067d958b3629.tmp.2.dr, 99254b2e-4a4f-4ba3-addb-25bc3d8e7708.tmp.2.dr	false		high
https://www.google.com/images/dot2.gif	craw_window.js.0.dr	false		high
https://cyan-bamboo-4lth.squarespace.com/2	History Provider Cache.0.dr	false		high
https://accounts.google.com	51e60c39-f2c3-4595-8c1d-067d958b3629.tmp.2.dr, 99254b2e-4a4f-4ba3-addb-25bc3d8e7708.tmp.2.dr	false		high
https://clients2.googleusercontent.com	51e60c39-f2c3-4595-8c1d-067d958b3629.tmp.2.dr, 99254b2e-4a4f-4ba3-addb-25bc3d8e7708.tmp.2.dr	false		high
https://apis.google.com	51e60c39-f2c3-4595-8c1d-067d958b3629.tmp.2.dr, 99254b2e-4a4f-4ba3-addb-25bc3d8e7708.tmp.2.dr	false		high
https://cyan-bamboo-4lth.squarespace.com/#page2	History Provider Cache.0.dr	false		high
https://www.google.com/accounts/OAuthLogin?issueuberauth=1	craw_window.js.0.dr	false		high
https://www.google.com/	manifest.json.0.dr	false		high
https://www-googleapis-staging.sandbox.google.com	craw_window.js.0.dr, craw_background.js.0.dr	false		high
https://clients2.google.com	51e60c39-f2c3-4595-8c1d-067d958b3629.tmp.2.dr, 99254b2e-4a4f-4ba3-addb-25bc3d8e7708.tmp.2.dr	false		high
https://clients2.google.com/service/update2/crx	manifest.json.0.dr	false		high

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	602176
Start date and time:	2022-04-04 05:03:37 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 4m 9s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://cyan-bamboo-4lth.squarespace.com/
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.win@26/91@11/9
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI Browse: https://cyan-bamboo-4lth.squarespace.com/#page

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	451603
Entropy (8bit):	5.009711072558331
Encrypted:	false
SSDEEP:	12288:ZHfRTyGZ6lup8Cfrvq4JBPKh+FBlESBw4p6:NfOCzvRKhGvwJ
MD5:	A78AD14E77147E7DE3647E61964C0335
SHA1:	CECC3DD41F4CEA0192B24300C71E1911BD4FCE45
SHA-256:	0D6803758FF8F87081FAFD62E90F0950DFB2DD7991E9607FE76A8F92D0E893FA
SHA-512:	DDE24D5AD50D68FC91E9E325D31E66EF8F624B6BB3A07D14FFED1104D3AB5F4EF1D7969A5CDE0DFBB19CB31C506F7DE97AF67C2F244F7E7E8E10648EA8321101
Malicious:	false
Reputation:	low
Preview:	BDic.... ....6...."..Z..4g....6.2...{/...3...5....AF 1363.AF nm.AF pt.AF n1.AF p.AF tc.AF SM.AF M.AF S.AF MS.AF MNR.AF GDS.AF MNT.AF MH.AF MR.AF SZMR.AF MJ.AF MT.AF MY.AF MRZ.AF MN.AF MG.AF RM.AF N.AF MV.AF XM.AF DSM.AF SD.AF G.AF R.AF MNX.AF MRS.AF MD.AF MNRB.AF B.AF ZSMR.AF PM.AF SMNGJ.AF SMN.AF ZMR.AF SMGB.AF MZR.AF GM.AF SMR.AF SMDG.AF RMZ.AF ZM.AF MDG.AF MDT.AF SMNXT.AF SDY.AF LSDG.AF LGDS.AF GLDS.AF UY.AF U.AF DSGNX.AF GNDSX.AF DSG.AF Y.AF GS.AF IEMS.AF YP.AF ZGDRS.AF XGNVDS.AF UT.AF GNDS.AF GVDS.AF MYPS.AF XGNDS.AF TPRY.AF MDSG.AF ZGSDR.AF DYSG.AF PMYTNS.AF AGDS.AF DRZGS.AF PY.AF GSPMDY.AF EGVDS.AF SL.AF GNXDS.AF DSBG.AF IM.AF I.AF MDGS.AF SMY.AF DSGN.AF DSLG.AF GMDS.AF MDSBG.AF SGD.AF IY.AF P.AF DSMG.AF BLZGDRS.AF TR.AF AGSD.AF ZGBDRSL.AF PTRY.AF ASDGV.AF ASM.AF ICANGSD.AF ICAM.AF IKY.AF AMS.AF PMYTRS.AF BZGVDRS.AF SDRBZG.AF GVMDS.AF PSM.AF DGLS.AF GNVXDS.AF AGDSL.AF DGS.AF XDSGNV.AF BZGDRS.AF AM.AF AS.AF A.AF LDSG.AF AGVDS.AF SDG.AF LDSMG.AF EDSMG.AF EY.AF DRSMZG.AF PRYT.AF LZ

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Apr 4, 2022 07:04:41.251843929 CEST	192.168.2.3	8.8.8.8	0xb34a	Standard query (0)	clients2.google.com	A (IP address)	IN (0x0001)
Apr 4, 2022 07:04:41.252090931 CEST	192.168.2.3	8.8.8.8	0xc2b5	Standard query (0)	accounts.google.com	A (IP address)	IN (0x0001)
Apr 4, 2022 07:04:41.256094933 CEST	192.168.2.3	8.8.8.8	0xc130	Standard query (0)	cyan-bamboo-4lth.squarespace.com	A (IP address)	IN (0x0001)
Apr 4, 2022 07:04:41.858855009 CEST	192.168.2.3	8.8.8.8	0x3993	Standard query (0)	images.squarespace-cdn.com	A (IP address)	IN (0x0001)
Apr 4, 2022 07:04:41.868555069 CEST	192.168.2.3	8.8.8.8	0x5ad1	Standard query (0)	use.typekit.net	A (IP address)	IN (0x0001)
Apr 4, 2022 07:04:41.943233013 CEST	192.168.2.3	8.8.8.8	0xac67	Standard query (0)	static1.squarespace.com	A (IP address)	IN (0x0001)
Apr 4, 2022 07:04:42.065325022 CEST	192.168.2.3	8.8.8.8	0xefe0	Standard query (0)	assets.squarespace.com	A (IP address)	IN (0x0001)
Apr 4, 2022 07:04:43.647144079 CEST	192.168.2.3	8.8.8.8	0x70d0	Standard query (0)	p.typekit.net	A (IP address)	IN (0x0001)
Apr 4, 2022 07:04:44.488580942 CEST	192.168.2.3	8.8.8.8	0x7fac	Standard query (0)	assets.squarespace.com	A (IP address)	IN (0x0001)
Apr 4, 2022 07:04:56.630237103 CEST	192.168.2.3	8.8.8.8	0x5d70	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)
Apr 4, 2022 07:05:57.579845905 CEST	192.168.2.3	8.8.8.8	0x7cec	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Apr 4, 2022 07:04:41.268208027 CEST	8.8.8.8	192.168.2.3	0xb34a	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 07:04:41.268208027 CEST	8.8.8.8	192.168.2.3	0xb34a	No error (0)	clients.l.google.com		216.58.215.238	A (IP address)	IN (0x0001)
Apr 4, 2022 07:04:41.276338100 CEST	8.8.8.8	192.168.2.3	0xc130	No error (0)	cyan-bamboo-4lth.squarespace.com		198.185.159.177	A (IP address)	IN (0x0001)
Apr 4, 2022 07:04:41.276338100 CEST	8.8.8.8	192.168.2.3	0xc130	No error (0)	cyan-bamboo-4lth.squarespace.com		198.185.159.176	A (IP address)	IN (0x0001)
Apr 4, 2022 07:04:41.276338100 CEST	8.8.8.8	192.168.2.3	0xc130	No error (0)	cyan-bamboo-4lth.squarespace.com		198.49.23.176	A (IP address)	IN (0x0001)
Apr 4, 2022 07:04:41.276338100 CEST	8.8.8.8	192.168.2.3	0xc130	No error (0)	cyan-bamboo-4lth.squarespace.com		198.49.23.177	A (IP address)	IN (0x0001)
Apr 4, 2022 07:04:41.278676033 CEST	8.8.8.8	192.168.2.3	0xc2b5	No error (0)	accounts.google.com		142.250.203.109	A (IP address)	IN (0x0001)
Apr 4, 2022 07:04:41.888328075 CEST	8.8.8.8	192.168.2.3	0x5ad1	No error (0)	use.typekit.net	use-stls.adobe.com.edgesuite.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 07:04:41.890348911 CEST	8.8.8.8	192.168.2.3	0x3993	No error (0)	images.squarespace-cdn.com	images.squarespace-cdn.com.edgesuite.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 07:04:41.959897995 CEST	8.8.8.8	192.168.2.3	0xac67	No error (0)	static1.squarespace.com	prod.squarespace.map.fastly.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 07:04:41.959897995 CEST	8.8.8.8	192.168.2.3	0xac67	No error (0)	prod.squarespace.map.fastly.net		151.101.0.238	A (IP address)	IN (0x0001)
Apr 4, 2022 07:04:41.959897995 CEST	8.8.8.8	192.168.2.3	0xac67	No error (0)	prod.squarespace.map.fastly.net		151.101.64.238	A (IP address)	IN (0x0001)
Apr 4, 2022 07:04:41.959897995 CEST	8.8.8.8	192.168.2.3	0xac67	No error (0)	prod.squarespace.map.fastly.net		151.101.128.238	A (IP address)	IN (0x0001)
Apr 4, 2022 07:04:41.959897995 CEST	8.8.8.8	192.168.2.3	0xac67	No error (0)	prod.squarespace.map.fastly.net		151.101.192.238	A (IP address)	IN (0x0001)
Apr 4, 2022 07:04:42.065197945 CEST	8.8.8.8	192.168.2.3	0x432a	No error (0)	gstaticadssl.l.google.com		216.58.215.227	A (IP address)	IN (0x0001)
Apr 4, 2022 07:04:42.094229937 CEST	8.8.8.8	192.168.2.3	0xefe0	No error (0)	assets.squarespace.com	static3.squarespace.com-1.edgekey.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 07:04:43.667287111 CEST	8.8.8.8	192.168.2.3	0x70d0	No error (0)	p.typekit.net	p.typekit.net-stls-v3.edgesuite.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 07:04:44.507800102 CEST	8.8.8.8	192.168.2.3	0x7fac	No error (0)	assets.squarespace.com	static3.squarespace.com-1.edgekey.net		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 07:04:56.656995058 CEST	8.8.8.8	192.168.2.3	0x5d70	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 07:04:56.656995058 CEST	8.8.8.8	192.168.2.3	0x5d70	No error (0)	googlehosted.l.googleusercontent.com		172.217.168.65	A (IP address)	IN (0x0001)
Apr 4, 2022 07:05:57.596128941 CEST	8.8.8.8	192.168.2.3	0x7cec	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)
Apr 4, 2022 07:05:57.596128941 CEST	8.8.8.8	192.168.2.3	0x7cec	No error (0)	googlehosted.l.googleusercontent.com		172.217.168.65	A (IP address)	IN (0x0001)

Timestamp	kBytes transferred	Direction	Data
2022-04-04 05:04:41 UTC	0	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfm X-Goog-Update-Updater: chromecrx-85.0.4183.121 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-04 05:04:41 UTC	1	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-6hUvlCCmE9Isuf0Zf3Bq/Q' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 04 Apr 2022 05:04:41 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 5571 X-Daystart: 79481 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-04-04 05:04:41 UTC	2	IN	Data Raw: 35 31 65 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 35 35 37 31 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 37 39 34 38 31 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 51e<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="5571" elapsed_seconds="79481"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2022-04-04 05:04:41 UTC	3	IN	Data Raw: 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 2e 63 72 78 22 20 66 70 3d 22 31 2e 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 61 70 Data Ascii: mhkkegccagdldgiimedpiccmgmieda.crx" fp="1.81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app><ap
2022-04-04 05:04:41 UTC	3	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-04-04 05:04:41 UTC	0	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-04 05:04:41 UTC	1	OUT	Data Raw: 20 Data Ascii:
2022-04-04 05:04:41 UTC	3	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 04 Apr 2022 05:04:41 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Content-Security-Policy: script-src 'report-sample' 'nonce-pxTLpKiulQMpyfYyJOJ9fQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'nonce-pxTLpKiulQMpyfYyJOJ9fQ' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Report-To: {"group":"IdentityListAccountsHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/IdentityListAccountsHttp/external"}]} Cross-Origin-Opener-Policy: same-origin; report-to="IdentityListAccountsHttp" Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site,Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-04-04 05:04:41 UTC	5	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2022-04-04 05:04:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-04-04 05:04:43 UTC	1144	OUT	POST /api/census/form-render HTTP/1.1 Host: cyan-bamboo-4lth.squarespace.com Connection: keep-alive Content-Length: 253 Accept: application/json, text/plain, / X-CSRF-Token: BVzlMBSiV2geOTQ5MTNjOTJhZDU4ZTlkYTM5YzY2Mjc4MmYxNTk5 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Content-Type: application/json;charset=UTF-8 Origin: https://cyan-bamboo-4lth.squarespace.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://cyan-bamboo-4lth.squarespace.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: crumb=BVzlMBSiV2geOTQ5MTNjOTJhZDU4ZTlkYTM5YzY2Mjc4MmYxNTk5; ss_cvr=d16fb2ba-f077-420a-a855-f19e4dac9ea9\|1649081083395\|1649081083395\|1649081083395\|1; ss_cvt=1649081083395
2022-04-04 05:04:43 UTC	1145	OUT	Data Raw: 7b 22 66 6f 72 6d 49 64 22 3a 22 36 32 34 33 63 64 65 37 36 39 35 65 64 31 32 30 65 34 31 62 39 31 32 39 22 2c 22 76 69 73 69 74 6f 72 43 6f 6f 6b 69 65 22 3a 22 64 31 36 66 62 32 62 61 2d 66 30 37 37 2d 34 32 30 61 2d 61 38 35 35 2d 66 31 39 65 34 64 61 63 39 65 61 39 7c 31 36 34 39 30 38 31 30 38 33 33 39 35 7c 31 36 34 39 30 38 31 30 38 33 33 39 35 7c 31 36 34 39 30 38 31 30 38 33 33 39 35 7c 31 22 2c 22 70 61 67 65 50 65 72 6d 69 73 73 69 6f 6e 54 79 70 65 56 61 6c 75 65 22 3a 31 2c 22 70 61 67 65 54 69 74 6c 65 22 3a 22 4f 57 41 22 2c 22 70 61 67 65 49 64 22 3a 22 36 32 34 33 63 64 33 32 32 30 66 63 34 30 31 37 61 33 64 30 64 32 63 31 22 2c 22 63 6f 6e 74 65 6e 74 53 6f 75 72 63 65 22 3a 22 63 22 2c 22 70 61 67 65 50 61 74 68 22 3a 22 2f 22 7d Data Ascii: {"formId":"6243cde7695ed120e41b9129","visitorCookie":"d16fb2ba-f077-420a-a855-f19e4dac9ea9\|1649081083395\|1649081083395\|1649081083395\|1","pagePermissionTypeValue":1,"pageTitle":"OWA","pageId":"6243cd3220fc4017a3d0d2c1","contentSource":"c","pagePath":"/"}
2022-04-04 05:04:44 UTC	1145	IN	HTTP/1.1 200 OK Cache-Control: no-cache, no-store, must-revalidate Content-Type: application/json;charset=utf-8 Date: Mon, 04 Apr 2022 05:04:44 GMT Server: Squarespace Strict-Transport-Security: max-age=43200 X-Content-Type-Options: nosniff X-Contextid: wUYQTg9B/cXSjQPP5 Content-Length: 17 Connection: close
2022-04-04 05:04:44 UTC	1145	IN	Data Raw: 7b 22 73 75 63 63 65 73 73 22 3a 20 74 72 75 65 7d Data Ascii: {"success": true}

Timestamp	kBytes transferred	Direction	Data
2022-04-04 05:04:49 UTC	1145	OUT	GET / HTTP/1.1 Host: cyan-bamboo-4lth.squarespace.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: crumb=BVzlMBSiV2geOTQ5MTNjOTJhZDU4ZTlkYTM5YzY2Mjc4MmYxNTk5; ss_cvr=d16fb2ba-f077-420a-a855-f19e4dac9ea9\|1649081083395\|1649081083395\|1649081083395\|1; ss_cvt=1649081083395 If-None-Match: W/"c1649872ce5308e23071a40f6de5c536--gzip"
2022-04-04 05:04:50 UTC	1148	IN	HTTP/1.1 304 Not Modified Age: 323842 Content-Encoding: gzip Date: Thu, 31 Mar 2022 11:07:27 GMT Etag: W/"c1649872ce5308e23071a40f6de5c536--gzip" Expires: Thu, 01 Jan 1970 00:00:00 GMT Server: Squarespace Strict-Transport-Security: max-age=43200 Vary: Accept-Encoding X-Content-Type-Options: nosniff X-Contextid: 84PsfNhU/8wGbaLYj X-Frame-Options: SAMEORIGIN Connection: close

Timestamp	kBytes transferred	Direction	Data
2022-04-04 05:04:49 UTC	1146	OUT	POST /api/1/performance/records HTTP/1.1 Host: cyan-bamboo-4lth.squarespace.com Connection: keep-alive Content-Length: 822 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://cyan-bamboo-4lth.squarespace.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://cyan-bamboo-4lth.squarespace.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: crumb=BVzlMBSiV2geOTQ5MTNjOTJhZDU4ZTlkYTM5YzY2Mjc4MmYxNTk5; ss_cvr=d16fb2ba-f077-420a-a855-f19e4dac9ea9\|1649081083395\|1649081083395\|1649081083395\|1; ss_cvt=1649081083395
2022-04-04 05:04:49 UTC	1147	OUT	Data Raw: 5b 7b 22 61 22 3a 22 76 37 5f 31 2d 75 73 65 72 2d 73 69 74 65 73 22 2c 22 64 22 3a 7b 22 63 74 78 22 3a 7b 22 69 6e 46 72 61 6d 65 22 3a 30 2c 22 74 65 6d 70 6c 61 74 65 49 64 22 3a 22 35 63 35 61 35 31 39 37 37 31 63 31 30 62 61 33 34 37 30 64 38 31 30 31 22 2c 22 69 6d 70 65 72 73 6f 6e 61 74 65 64 53 65 73 73 69 6f 6e 22 3a 30 2c 22 70 61 67 65 54 79 70 65 22 3a 22 32 22 2c 22 61 75 74 68 65 6e 74 69 63 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 63 79 61 6e 2d 62 61 6d 62 6f 6f 2d 34 6c 74 68 2e 73 71 75 61 72 65 73 70 61 63 65 2e 63 6f 6d 22 2c 22 63 6c 6f 6e 65 61 62 6c 65 22 3a 30 2c 22 64 65 76 65 6c 6f 70 65 72 4d 6f 64 65 22 3a 30 2c 22 69 73 48 73 74 73 45 6e 61 62 6c 65 64 22 3a 31 2c 22 6c 61 6e 67 75 61 67 65 22 3a 22 65 6e 2d 55 53 22 2c 22 Data Ascii: [{"a":"v7_1-user-sites","d":{"ctx":{"inFrame":0,"templateId":"5c5a519771c10ba3470d8101","impersonatedSession":0,"pageType":"2","authenticUrl":"https://cyan-bamboo-4lth.squarespace.com","cloneable":0,"developerMode":0,"isHstsEnabled":1,"language":"en-US","
2022-04-04 05:04:50 UTC	1148	IN	HTTP/1.1 200 OK Content-Length: 0 Date: Mon, 04 Apr 2022 05:04:50 GMT Server: Squarespace Vary: Accept-Encoding, User-Agent X-Contextid: RwlMFraZ/LikXalyS Connection: close

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://cyan-bamboo-4lth.squarespace.com/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic

C:\Users\user\AppData\Local\Google\Chrome\User Data\0cca7997-f8e0-4616-8f7a-57c847adc226.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\4639afa5-c2da-48f4-b84e-03d4bfb6a143.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\6375e331-c4bb-4834-ba2d-e9c34f92e9c9.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\90c552fe-2b46-4274-b8f6-6374ed40871f.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\3aac2375-cf74-49ce-ad1b-4f09ef8ee0cb.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\429bb331-6535-4af9-859a-21c174b30560.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\4bae1989-8730-415a-96d2-a77fd915b8c9.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\51e60c39-f2c3-4595-8c1d-067d958b3629.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\8182a052-f3e9-43b5-a4da-de2af2d4fa86.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\986a1bac-5cbd-40c6-9e60-476178e52a49.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\99254b2e-4a4f-4ba3-addb-25bc3d8e7708.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata\computed_hashes.json

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\000003.log

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG.old (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Provider Cache

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network Persistent State (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\GPUCache\data_1

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Network Persistent State (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\a6336a0e-8630-40af-9360-f41c8bbce213.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\b200e30d-9d92-426a-9b99-c8c630bc17d5.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000004.dbtmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\CURRENT (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Last Browser

C:\Users\user\AppData\Local\Google\Chrome\User Data\Last Version

Windows Analysis Report
https://cyan-bamboo-4lth.squarespace.com/

Timestamp	kBytes transferred	Direction	Data
2022-04-04 05:04:51 UTC	1148	OUT	GET /api/1/performance/settings HTTP/1.1 Host: cyan-bamboo-4lth.squarespace.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://cyan-bamboo-4lth.squarespace.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: crumb=BVzlMBSiV2geOTQ5MTNjOTJhZDU4ZTlkYTM5YzY2Mjc4MmYxNTk5; ss_cvr=d16fb2ba-f077-420a-a855-f19e4dac9ea9\|1649081083395\|1649081083395\|1649081083395\|1; ss_cvt=1649081083395
2022-04-04 05:04:51 UTC	1152	IN	HTTP/1.1 200 OK Content-Length: 238 Content-Type: application/json Date: Mon, 04 Apr 2022 05:04:51 GMT Server: Squarespace Vary: Accept-Encoding, User-Agent X-Contextid: 2ESbUqeP/LTIuHpEK Connection: close
2022-04-04 05:04:51 UTC	1152	IN	Data Raw: 7b 22 69 73 43 6f 6e 66 69 67 75 72 61 74 69 6f 6e 4c 6f 61 64 65 64 22 3a 74 72 75 65 2c 22 65 78 70 65 72 69 6d 65 6e 74 43 6f 6e 74 65 78 74 4c 69 73 74 22 3a 5b 7b 22 6e 61 6d 65 22 3a 22 72 75 6d 22 2c 22 65 78 70 65 72 69 6d 65 6e 74 54 79 70 65 22 3a 22 46 45 41 54 55 52 45 5f 54 4f 47 47 4c 45 22 2c 22 73 65 67 6d 65 6e 74 4e 61 6d 65 22 3a 22 64 65 66 61 75 6c 74 22 2c 22 76 61 72 69 61 6e 74 22 3a 22 74 72 75 65 22 2c 22 63 6f 6e 74 61 69 6e 73 45 72 72 6f 72 22 3a 66 61 6c 73 65 2c 22 73 74 61 74 75 73 22 3a 22 41 43 54 49 56 45 22 7d 5d 2c 22 70 61 67 65 4c 6f 61 64 49 64 22 3a 22 34 35 62 34 30 30 65 62 2d 37 61 64 31 2d 34 65 61 36 2d 62 66 62 39 2d 64 64 35 62 37 30 33 31 33 31 63 32 22 7d Data Ascii: {"isConfigurationLoaded":true,"experimentContextList":[{"name":"rum","experimentType":"FEATURE_TOGGLE","segmentName":"default","variant":"true","containsError":false,"status":"ACTIVE"}],"pageLoadId":"45b400eb-7ad1-4ea6-bfb9-dd5b703131c2"}

Timestamp	kBytes transferred	Direction	Data
2022-04-04 05:04:51 UTC	1149	OUT	POST /api/census/RecordHit HTTP/1.1 Host: cyan-bamboo-4lth.squarespace.com Connection: keep-alive Content-Length: 828 Accept: application/json, text/plain, / X-CSRF-Token: BVzlMBSiV2geOTQ5MTNjOTJhZDU4ZTlkYTM5YzY2Mjc4MmYxNTk5 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Origin: https://cyan-bamboo-4lth.squarespace.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://cyan-bamboo-4lth.squarespace.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: crumb=BVzlMBSiV2geOTQ5MTNjOTJhZDU4ZTlkYTM5YzY2Mjc4MmYxNTk5; ss_cvr=d16fb2ba-f077-420a-a855-f19e4dac9ea9\|1649081083395\|1649081083395\|1649081083395\|1; ss_cvt=1649081083395
2022-04-04 05:04:51 UTC	1150	OUT	Data Raw: 65 76 65 6e 74 3d 31 26 64 61 74 61 3d 25 37 42 25 32 32 6c 6f 63 61 6c 53 74 6f 72 61 67 65 53 75 70 70 6f 72 74 65 64 25 32 32 25 33 41 74 72 75 65 25 32 43 25 32 32 71 75 65 72 79 53 74 72 69 6e 67 25 32 32 25 33 41 25 32 32 25 32 32 25 32 43 25 32 32 72 65 66 65 72 72 65 72 25 32 32 25 33 41 25 32 32 25 32 32 25 32 43 25 32 32 77 65 62 73 69 74 65 49 64 25 32 32 25 33 41 25 32 32 36 32 34 33 63 63 38 39 36 64 66 38 30 33 31 64 36 34 37 66 31 32 36 62 25 32 32 25 32 43 25 32 32 74 65 6d 70 6c 61 74 65 49 64 25 32 32 25 33 41 25 32 32 35 63 35 61 35 31 39 37 37 31 63 31 30 62 61 33 34 37 30 64 38 31 30 31 25 32 32 25 32 43 25 32 32 77 65 62 73 69 74 65 5f 6c 6f 63 61 6c 65 25 32 32 25 33 41 25 32 32 65 6e 2d 55 53 25 32 32 25 32 43 25 32 32 75 73 65 72 Data Ascii: event=1&data=%7B%22localStorageSupported%22%3Atrue%2C%22queryString%22%3A%22%22%2C%22referrer%22%3A%22%22%2C%22websiteId%22%3A%226243cc896df8031d647f126b%22%2C%22templateId%22%3A%225c5a519771c10ba3470d8101%22%2C%22website_locale%22%3A%22en-US%22%2C%22user
2022-04-04 05:04:51 UTC	1152	IN	HTTP/1.1 200 OK Cache-Control: no-cache, no-store, must-revalidate Content-Type: application/json;charset=utf-8 Date: Mon, 04 Apr 2022 05:04:51 GMT Server: Squarespace Strict-Transport-Security: max-age=43200 X-Content-Type-Options: nosniff X-Contextid: ePi1azhp/7FL0mFZG Content-Length: 17 Connection: close
2022-04-04 05:04:51 UTC	1152	IN	Data Raw: 7b 22 73 75 63 63 65 73 73 22 3a 20 74 72 75 65 7d Data Ascii: {"success": true}

Timestamp	kBytes transferred	Direction	Data
2022-04-04 05:04:51 UTC	1151	OUT	POST /api/census/form-render HTTP/1.1 Host: cyan-bamboo-4lth.squarespace.com Connection: keep-alive Content-Length: 253 Accept: application/json, text/plain, / X-CSRF-Token: BVzlMBSiV2geOTQ5MTNjOTJhZDU4ZTlkYTM5YzY2Mjc4MmYxNTk5 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Content-Type: application/json;charset=UTF-8 Origin: https://cyan-bamboo-4lth.squarespace.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://cyan-bamboo-4lth.squarespace.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: crumb=BVzlMBSiV2geOTQ5MTNjOTJhZDU4ZTlkYTM5YzY2Mjc4MmYxNTk5; ss_cvr=d16fb2ba-f077-420a-a855-f19e4dac9ea9\|1649081083395\|1649081083395\|1649081083395\|1; ss_cvt=1649081083395
2022-04-04 05:04:51 UTC	1151	OUT	Data Raw: 7b 22 66 6f 72 6d 49 64 22 3a 22 36 32 34 33 63 64 65 37 36 39 35 65 64 31 32 30 65 34 31 62 39 31 32 39 22 2c 22 76 69 73 69 74 6f 72 43 6f 6f 6b 69 65 22 3a 22 64 31 36 66 62 32 62 61 2d 66 30 37 37 2d 34 32 30 61 2d 61 38 35 35 2d 66 31 39 65 34 64 61 63 39 65 61 39 7c 31 36 34 39 30 38 31 30 38 33 33 39 35 7c 31 36 34 39 30 38 31 30 38 33 33 39 35 7c 31 36 34 39 30 38 31 30 38 33 33 39 35 7c 31 22 2c 22 70 61 67 65 50 65 72 6d 69 73 73 69 6f 6e 54 79 70 65 56 61 6c 75 65 22 3a 31 2c 22 70 61 67 65 54 69 74 6c 65 22 3a 22 4f 57 41 22 2c 22 70 61 67 65 49 64 22 3a 22 36 32 34 33 63 64 33 32 32 30 66 63 34 30 31 37 61 33 64 30 64 32 63 31 22 2c 22 63 6f 6e 74 65 6e 74 53 6f 75 72 63 65 22 3a 22 63 22 2c 22 70 61 67 65 50 61 74 68 22 3a 22 2f 22 7d Data Ascii: {"formId":"6243cde7695ed120e41b9129","visitorCookie":"d16fb2ba-f077-420a-a855-f19e4dac9ea9\|1649081083395\|1649081083395\|1649081083395\|1","pagePermissionTypeValue":1,"pageTitle":"OWA","pageId":"6243cd3220fc4017a3d0d2c1","contentSource":"c","pagePath":"/"}
2022-04-04 05:04:51 UTC	1152	IN	HTTP/1.1 200 OK Cache-Control: no-cache, no-store, must-revalidate Content-Type: application/json;charset=utf-8 Date: Mon, 04 Apr 2022 05:04:51 GMT Server: Squarespace Strict-Transport-Security: max-age=43200 X-Content-Type-Options: nosniff X-Contextid: yn7LZCPQ/5CXIxQD9 Content-Length: 17 Connection: close
2022-04-04 05:04:51 UTC	1153	IN	Data Raw: 7b 22 73 75 63 63 65 73 73 22 3a 20 74 72 75 65 7d Data Ascii: {"success": true}

Timestamp	kBytes transferred	Direction	Data
2022-04-04 05:04:56 UTC	1153	OUT	GET /crx/blobs/Acy1k0bLIjHsvnKaKN_oRpVaYYvFs25d7GKYF1WXrT6yizCMksBO0c_ggE0B6tx6HPRHe6q1GOEe3_NcIbSiGG8kXeLMUY0sAKVvC6R89zvKM13s5VqoAMZSmuUgjQL5vlygJuArQghXXE_qTL7NlQ/extension_8520_615_0_5.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-04 05:04:56 UTC	1153	IN	HTTP/1.1 200 OK X-GUploader-UploadID: ADPycdtTqZcy2yuEWtxewrj7lcH2oN8owc0hcMtnXBXcE0aSs_mLqshc5cFDBeF0nNiliFMMFg2mHI9ykQGdvwIYkIUCBEY6_NjL Content-Disposition: attachment; filename="extension_8520_615_0_5.crx" Cross-Origin-Resource-Policy: same-site Accept-Ranges: bytes X-Goog-Hash: crc32c=DxAZGA== Content-Length: 768843 Server: UploadServer Date: Sun, 03 Apr 2022 21:05:59 GMT Expires: Mon, 03 Apr 2023 21:05:59 GMT Cache-Control: public, max-age=31536000 Age: 28737 Last-Modified: Wed, 05 Aug 2020 01:15:29 GMT ETag: 730d2491_a246e948_e80d9c94_d8b3f142_86eb8dd2 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2022-04-04 05:04:56 UTC	1154	IN	Data Raw: 43 72 32 34 03 00 00 00 18 04 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 8f fb bf 5c 37 63 94 3c b0 ee 01 c4 b5 a6 9a b1 9f 46 74 6f 16 38 a0 32 27 35 dd f0 71 6b 0e dc f6 25 cb b2 ed ea fb 32 d5 af 1e 03 43 03 46 f0 a7 39 db 23 96 1d 65 e5 78 51 f0 84 b0 0e 12 ac 0e 5b dc c9 d6 4c 7c 00 d5 b8 1b 88 33 3e 2f da eb aa f7 1a 75 c2 ae 3a 54 de 37 8f 10 d2 28 e6 84 79 4d 15 b4 f3 bd 3f 56 d3 3c 3f 18 ab fc 2e 05 c0 1e 08 31 b6 61 d0 fd 9f 4f 3f 64 0d 17 93 bc ad 41 c7 48 be 00 27 a8 4d 70 42 92 05 54 a6 6d b8 de 56 6e 20 49 70 ee 10 3e 6b d2 7c 31 bd 1b 6e a4 3c 46 62 9f 08 66 93 f9 2a 51 31 a8 db b5 9d b9 0f 73 e8 a0 09 32 01 e9 7b 2a 8a 36 a0 cf 17 b0 50 70 9d a2 f9 a4 6f 62 4d Data Ascii: Cr240"0H0\7c<Fto82'5qk%2CF9#exQ[L\|3>/u:T7(yM?V<?.1aO?dAH'MpBTmVn Ip>k\|1n<FbfQ1s2{*6PpobM
2022-04-04 05:04:56 UTC	1155	IN	Data Raw: 59 ae 40 3b f4 9e 6a bc a6 ca cb a3 80 eb 8b 1c a8 07 a9 3d 61 65 c8 c2 d3 30 c2 ff f6 cc 90 8b f9 14 44 55 b1 1f a8 1a 6e 1c 91 f5 6e 12 3b ff 49 70 72 cc a2 1f 51 db 15 1c 81 3a 10 b6 e5 20 3c e2 ad 87 0f d5 1e 80 61 09 59 dc 93 f3 83 96 97 87 7b 65 69 9e cd 12 a8 02 0a a2 01 30 81 9f 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 81 8d 00 30 81 89 02 81 81 00 cd 4d 62 68 3d 9f 5b 4f 7d b2 2b 1b ae 55 af 4b 48 46 28 6e 33 e8 5c 22 d7 dd d8 2c 67 d7 63 0e b5 8a 36 29 13 10 28 dd 45 ed ff 00 55 db fa ff 23 92 69 ad 61 03 e7 3a 04 98 9f 4e 89 fd 0a 1d 0e 50 88 1b a9 78 ef 4f a0 90 ea 28 6d 43 3b 7c eb 35 01 53 ac 7b 6d ea 61 45 78 8d bb 91 5b 7f 98 66 50 af 69 60 85 79 cc c2 35 b1 88 52 02 84 8b 90 76 7f 24 1a cf 2e b4 00 bd 6c 2d 6d ee b5 02 03 01 00 01 Data Ascii: Y@;j=ae0DUnn;IprQ: <aY{ei00*H0Mbh=[O}+UKHF(n3\",gc6)(EU#ia:NPxO(mC;\|5S{maEx[fPi`y5Rv$.l-m
2022-04-04 05:04:56 UTC	1156	IN	Data Raw: 39 f8 f6 ad c7 4a cb 2f 1f 77 0d f5 97 97 c5 5f 2f ee 4b 21 c4 5f 5e de 7e 29 ae 9a 3f 8a c1 c7 9b f2 f2 e7 8b 83 8f 77 77 5f 6e 7f 7a f9 f2 f6 fe cb 97 eb 9b bb 17 1f 6a 3b be 58 5f ff fa 72 bd d5 ec cb e2 ea f6 df e5 cd 4b 08 bb 2a 89 5f 1c 0c ee 8a 9b 0f e5 1d 8c 5f ae 3e 17 57 ff bc 38 68 04 57 0f 19 ac 3f 17 b7 b7 70 f1 a6 fc d7 fd a7 9b 72 f3 3c ce 08 06 5e 7d 78 7e fb f1 fa df 70 f1 7f ee ae bf bc b8 bd bf bc fc b4 fe 04 8b 3b 2e cb cd aa 58 57 a2 6a 15 40 46 b0 99 55 06 9e 99 69 25 32 27 d9 60 40 0f c3 54 2a 57 e8 61 24 24 d0 59 30 1d a0 d3 c5 2c ef b6 1e 00 31 f7 64 d3 b3 96 91 0f 99 4e 45 d3 31 4b 63 4d 47 0d f6 3b ea d5 06 08 c9 60 85 f7 ca 04 25 25 9f d1 eb e0 30 31 ee e2 c8 60 5c 26 20 9b 40 82 ca bc 08 da b0 e5 57 6c c7 37 d9 13 d3 66 94 a2 Data Ascii: 9J/w_/K!_^~)?ww_nzj;X_rK__>W8hW?pr<^}x~p;.XWj@FUi%2'`@TWa$$Y0,1dNE1KcMG;`%%01`\& @Wl7f
2022-04-04 05:04:56 UTC	1157	IN	Data Raw: a1 d8 5d 60 c4 24 86 5a 22 50 76 a3 9d 09 c2 58 61 80 31 5b de 09 1f d7 40 b6 42 55 3d 6c 6f 80 83 85 4c 08 e3 be 83 df 3c 6c 95 58 00 2b 52 42 5c b4 a3 e9 e8 90 f5 00 4c fc b4 1c 95 ad 07 ab 8d 6f 6f 8d 54 81 3a aa a3 88 45 b7 9f db fc b8 cd 34 1c a4 2f c8 d3 56 ad 05 64 e8 c5 c2 1d 97 6b ff e8 92 ca 4d fa c0 82 a0 9b cd 2a c5 b6 b8 32 0a bc d8 f0 a7 fd f9 1d 53 75 85 47 b6 62 5b 97 15 31 5f ec 34 e8 4b 82 df 3b dd f5 26 a3 7f 47 af 7c 4f 33 bc 69 98 32 ae b8 bf d7 fd c4 f6 f6 dd cd f5 fd ea 73 79 fb f1 fa fa 0e db dc 56 69 d7 74 4c 2d f0 51 c0 2e ca 67 19 00 85 20 ac 64 d1 02 96 dd 08 6b 75 1c 99 59 5b 6d c2 d8 10 64 d5 21 60 db 48 3b c1 17 9b 72 85 d9 7a 55 d3 94 b3 da 5b 88 6f ed 83 75 3a 28 eb d8 8e 03 44 7d 1d 23 9d 94 a5 77 f7 49 08 6d 8c f6 c4 ac Data Ascii: ]`$Z"PvXa1[@BU=loL<lX+RB\LooT:E4/VdkM*2SuGb[1_4K;&G\|O3i2syVitL-Q.g dkuY[md!`H;rzU[ou:(D}#wIm
2022-04-04 05:04:56 UTC	1158	IN	Data Raw: 26 33 12 a8 5f c5 66 cd c3 99 c5 91 4d 0d 49 77 54 3b 27 68 d1 9c 97 d4 bf 7b 33 52 9b 72 ba 09 24 e6 1f 9c a8 95 56 1a 6f 24 00 7c 40 f9 19 f8 30 37 d3 e6 d4 62 1c 03 d3 94 36 68 11 94 87 e9 3b b5 67 77 22 7d 31 81 0d 1f 30 71 80 3c ec a4 b4 42 54 d1 c3 35 69 38 22 ec 33 e1 aa 6d 2e 51 6d bb 18 e0 59 66 cf 0b 0c 0f 70 d9 d8 d4 a2 fb 54 a1 a3 e3 76 9c 26 87 3b e2 9e 47 db bf 69 0a 4c a8 7a 35 e0 b4 32 78 98 5f f0 c0 fe bf 7b 6e 0d 7a 41 c1 15 1a 87 ac ed aa c2 65 ab 73 76 7b 28 59 ef 09 08 94 0f 15 ea ed f9 b8 9e b5 26 fe 56 14 e4 a7 82 b2 0f 86 9d 94 7e 3c 9c a1 0a eb 03 a7 f1 38 22 a2 f5 35 e6 21 34 3d a9 cb cd 69 05 ec 3e 56 a7 a1 33 e1 bd f6 0a a2 05 c2 86 ed a8 fd 8e 3b 8d 4f df ce 8d 00 86 c8 e0 4e 48 3d 79 a7 f6 2c 3f 1a 0d 97 d3 c9 62 9e 4f 97 c3 Data Ascii: &3_fMIwT;'h{3Rr$Vo$\|@07b6h;gw"}10q<BT5i8"3m.QmYfpTv&;GiLz52x_{nzAesv{(Y&V~<8"5!4=i>V3;ONH=y,?bO

Timestamp	kBytes transferred	Direction	Data
2022-04-04 05:04:42 UTC	1121	OUT	GET /s/poppins/v19/pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2 HTTP/1.1 Host: fonts.gstatic.com Connection: keep-alive Origin: https://cyan-bamboo-4lth.squarespace.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://fonts.googleapis.com/css2?family=Poppins:ital,wght@0,300;0,400;0,500;0,700;1,300 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-04 05:04:42 UTC	1122	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="apps-themes" Report-To: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} Timing-Allow-Origin: * Content-Length: 7748 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed, 30 Mar 2022 19:42:13 GMT Expires: Thu, 30 Mar 2023 19:42:13 GMT Cache-Control: public, max-age=31536000 Age: 379349 Last-Modified: Wed, 26 Jan 2022 19:15:31 GMT Content-Type: font/woff2 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2022-04-04 05:04:42 UTC	1123	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 00 1e 44 00 0c 00 00 00 00 3f 70 00 00 1d f1 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1b 1e 1c 2e 06 60 00 81 54 0a e7 30 d2 04 0b 83 36 00 01 36 02 24 03 86 68 04 20 05 83 48 07 84 0b 1b 38 32 45 46 ee 17 a9 05 13 45 a9 a2 04 c1 ff 97 04 0d 8e b0 f0 57 b0 89 11 62 88 88 b0 08 d5 62 bb fb 6c af df f8 51 63 2f 02 bd 0a 03 b4 47 34 13 5d 52 63 9a f7 43 ff cc c5 39 4a 00 ae f2 05 3e 57 96 1d 41 ec aa 23 18 b2 7e 84 24 b3 2d d1 f3 fb f1 9b b3 e7 7d 05 92 88 87 ae 96 c8 24 2d 91 a4 d5 b3 84 08 a1 d1 08 c5 42 31 8f fc 3b 3c bf cd ff a3 3d d7 46 4f 99 01 06 20 52 92 c2 25 aa b5 c1 00 ae 8a 39 d4 45 b5 73 d5 ff 4d 36 e7 6b fb 2d 5f e4 5e fc 3f 17 f5 aa dd 5f b2 b9 1c 6c 49 db 19 35 39 59 07 66 7c aa 18 26 Data Ascii: wOF2D?p.`T066$h H82EFEWbblQc/G4]RcC9J>WA#~$-}$-B1;<=FO R%9EsM6k-_^?_lI59Yf\|&
2022-04-04 05:04:42 UTC	1123	IN	Data Raw: 97 19 95 a1 8e eb ab be de 97 41 fa 2b af 6c 2f 6a d1 eb 03 eb d0 b0 04 96 8f 64 07 00 ab ab 72 29 59 3e d4 01 56 de 00 40 45 5c 51 9d 6b 83 45 9d a2 28 a9 8b 8e a1 36 a8 dd 79 66 11 29 73 dd df 4f ff 1b 7a d7 b6 b4 c2 8e 12 86 03 f0 bc af f9 0c 15 60 51 a6 4c 61 27 4e c9 74 20 56 24 c0 18 20 74 22 1a 5a 44 62 ea d5 9a 00 1e 12 05 55 10 41 8d d2 ce a7 b6 d6 af a2 80 dc 8f 09 70 7e 98 54 57 e0 4b 02 ed b3 be b0 cd 79 8b ce 5e 16 28 c1 3b c0 8e d5 91 e9 4b cf 54 4f de b4 6c 03 f0 00 20 7b 73 03 b0 4d 24 20 80 06 ac 12 21 8c 89 91 ea 61 87 c4 5e c9 79 80 15 82 fe 5f a5 a5 cd 48 c6 f3 65 1e 6c 4b 44 a4 23 b2 10 39 08 24 82 86 e0 21 26 16 31 39 f1 39 49 c8 f1 52 2d c2 d1 62 cd 89 09 88 54 44 26 93 fa a7 6a 0d e3 e1 78 6f 6c 1b 5b 0a af cd 7e f3 b2 21 ff 71 d5 Data Ascii: A+l/jdr)Y>V@E\QkE(6yf)sOz`QLa'Nt V$ t"ZDbUAp~TWKy^(;KTOl {sM$ !a^y_HelKD#9$!&199IR-bTD&jxol[~!q
2022-04-04 05:04:42 UTC	1125	IN	Data Raw: dc 74 b9 9e 6b 56 9d b5 dc 2c 40 74 85 36 4e e9 5f cd 3f d4 6f a3 e5 cc 73 15 a2 2c 2d 42 79 09 45 b7 38 76 ed 9a 85 99 77 52 c6 7e 0c 70 79 3f d2 58 83 49 d6 6b f3 71 70 09 b2 81 3b 0b 4b 33 24 65 cb d7 ac 92 5e 10 4b 8b 7d 40 0f 9e b0 5c 27 36 0a 3a 7c 48 83 07 a5 52 66 7b 73 8b 70 28 bf 5c f4 0b 1d 22 a2 54 46 88 2e a5 51 5d 1d 2f 8c 36 3a 26 00 67 ae 2a 97 f9 42 e4 c0 6a b2 db 2d e1 ed d0 9c 1a 58 4b f1 78 10 dd 08 c2 37 d1 a5 dd 48 4f 31 4c f0 e1 3a 92 55 57 db 6a 81 1c 92 92 b8 d9 62 19 b9 6d 26 4a 42 b0 e5 60 f0 c8 66 89 b1 17 f6 70 12 ac 03 fc 3f 6d 4c d7 d8 e3 d8 2d 91 e3 c6 ed 65 55 e6 71 63 4e 51 5d 1c 1e bd 67 07 21 1b f6 96 3a b7 54 50 4c 16 90 34 48 79 a4 bc c1 7a dd 14 97 d3 43 1b 9a 1f 76 e3 0f 1b 06 dd 4c 9a 73 ca 90 bd ad 27 f7 fc 38 0c Data Ascii: tkV,@t6N_?os,-ByE8vwR~py?XIkqp;K3$e^K}@\'6:\|HRf{sp(\"TF.Q]/6:&g*Bj-XKx7HO1L:UWjbm&JB`fp?mL-eUqcNQ]g!:TPL4HyzCvLs'8
2022-04-04 05:04:42 UTC	1126	IN	Data Raw: 59 dd 44 49 e3 fa e6 c8 ba 66 a2 98 c3 62 42 1c 92 c0 44 b3 a5 3b 32 54 40 47 a0 e0 3e a7 52 3e 37 7b 01 66 8f 41 f9 df f5 9f d8 ab ec 7b 7d 7b 23 df 7f e1 7a 09 16 07 94 13 52 4d 7e 89 ae 5e 88 6e 62 4a 28 b0 0f d2 34 ad 68 98 67 f2 5e 94 92 a9 42 81 5e 28 12 ca 04 a5 1c dc b3 c6 13 d7 c1 75 fb 21 a2 52 de 11 b6 e1 40 55 09 8d 53 4d a1 34 48 05 e4 a6 86 72 59 5d ab 05 7b a2 a7 39 bc 1a 6e 98 a3 70 5f 3b af 13 f1 f9 0a 95 90 25 92 43 3c 81 8a 0f e6 f4 25 f5 b5 a4 b6 c2 15 ff 03 8a cb 3e 32 c9 dc 40 54 c8 1b 89 24 33 99 42 d1 3d 5e 09 39 d8 10 54 d5 46 92 4a 5b 49 8a cb 58 c8 de 1a 77 9b 4f 67 32 ca fb 96 8a 17 95 53 a9 62 16 7e 74 42 c3 66 52 95 02 3e 4f 21 a4 30 54 10 07 7c b4 03 22 50 84 90 77 8d df 90 47 80 dc 44 46 bd b4 b9 6f b9 7f 2d fc c6 cd fe a2 Data Ascii: YDIfbBD;2T@G>R>7{fA{}{#zRM~^nbJ(4hg^B^(u!R@USM4HrY]{9np_;%C<%>2@T$3B=^9TFJ[IXwOg2Sb~tBfR>O!0T\|"PwGDFo-
2022-04-04 05:04:42 UTC	1127	IN	Data Raw: a4 f3 75 5a 95 6d bc 92 c8 f2 86 6a c3 76 83 de fa 9f 4f 07 f8 64 49 25 89 e2 96 f2 fd 44 89 58 c1 66 4b 14 12 22 3c 03 cf be 67 ca 27 81 1a ef fe b5 ae 32 11 0a 46 5d 2b f8 2b b5 4a 24 a7 bb 50 b9 d3 d9 3b 60 90 17 3f 1b bf ff 83 97 af e0 19 f8 e2 c4 8f 87 c1 c8 c3 c1 c3 98 01 78 18 57 4b a2 39 d2 58 dd 0b 14 cc ba a2 cf 2f e5 d4 95 bd d1 ef a6 31 c1 40 c9 6f 4c 2a 2f 8a 0c 66 e0 45 ec 32 81 b0 4f af 13 f7 f7 f2 95 4a c6 fa ca e9 74 d2 fe e5 02 65 71 a5 ac b0 44 cb 60 60 34 d2 42 34 5a 52 58 ac 61 98 2d 2e 3e f8 e2 9f 2a 02 4b 14 10 70 7b 0b e0 bb ca aa c0 3f 32 c0 18 58 ad 58 7d 82 c8 fe 14 d8 95 84 e3 aa 16 4c 8b e1 78 0d 01 12 b6 9e 3e 4d 9f 00 0d 96 1a 58 c2 e5 71 75 39 30 0a 56 81 fb b1 b5 58 ba 6a 71 20 e7 0e 16 c7 5b 92 7d e1 a7 7b f2 6c 0a 44 46 Data Ascii: uZmjvOdI%DXfK"<g'2F]++J$P;`?xWK9X/1@oL/fE2OJteqD``4B4ZRXa-.>Kp{?2XX}Lx>MXqu90VXjq [}{lDF
2022-04-04 05:04:42 UTC	1128	IN	Data Raw: 5a 30 1f 5d 9f 31 76 8b 5d b3 df 59 db e9 2e 00 a7 87 4e 74 b6 e8 c4 5c 66 f2 e5 6e 79 e1 4c 87 b3 7f 5d 47 67 ff da 4e ff ed ab ee ab 77 fc e0 b7 75 7b ba 86 12 c9 de 3d 3b 77 8a 44 3b b1 87 79 ea ee 3d 60 bb ec 30 a6 4b 70 78 cc c3 6c ce 7d f7 b0 b5 aa e1 08 36 20 b6 65 a6 17 9b d8 64 b5 86 30 5c 8d ef 7b 9d fd 29 5f d9 d1 6c 8d f7 6d c3 71 b0 07 e0 90 9d e5 b0 cd f0 75 ff a6 de c7 cf 55 eb 6c 59 d9 6b 28 f8 22 08 48 9b ba 03 3d e2 3a 1c 51 8e 21 e2 38 db ab 05 f3 e3 cf 7f 2c 49 e5 aa 98 92 06 8b c3 ea 73 46 1b 5a d3 7f c4 e8 a1 a5 b5 38 75 ba a8 bc 34 97 cb 99 fd 3c ad f0 65 99 90 01 41 b9 30 1e 40 fd d1 94 90 a3 94 2b c8 c9 2f 13 14 7e d8 93 2a 0d ba 6c 0c 37 3e 56 5b a9 4d ad c6 33 0e 11 d0 0d 3d 55 69 87 d0 a0 70 2a 0e 39 0b 98 d2 36 1e d4 25 6f cb Data Ascii: Z0]1v]Y.Nt\fnyL]GgNwu{=;wD;y=`0Kpxl}6 ed0\{)_lmquUlYk("H=:Q!8,IsFZ8u4<eA0@+/~l7>V[M3=Uip96%o
2022-04-04 05:04:42 UTC	1130	IN	Data Raw: 0d 6c 7a 49 b2 1c 2a 4e 41 82 d9 17 be 9b dc 6f 70 85 83 48 b5 ca 8e 06 9d 51 f0 25 5d c1 14 06 04 b9 21 27 01 d2 8e 02 f9 19 23 cd 3c a0 08 c2 47 ef 96 56 ac 4a 84 4e a7 87 46 82 0d 43 b8 af c2 a2 9c a0 85 25 01 75 44 62 43 cb bf 31 a8 5c 25 c9 90 84 7e 22 21 3b e1 63 b7 30 58 f8 7a 64 67 6e 3b 5e 33 fa b2 59 5e 67 09 7a 2d 2e 27 e5 b3 22 8d 89 71 40 ee 68 c9 a4 f2 e8 3a 1c 7e 86 cd ff ff 53 84 29 38 2d 34 61 9d 29 41 48 75 10 0f 56 9f 26 26 c3 54 ab cc cc dc 04 61 8b 6b aa b8 fa 45 5c 04 e2 ea 33 e8 44 82 60 f1 b8 b1 dc 92 42 79 29 30 c8 55 9c ac 56 94 bc 0d 30 13 d1 fd e5 28 2c 8a b8 4e 82 ad 49 d9 f5 0c 26 eb e4 b3 b7 20 51 00 5f cb c5 d5 39 99 b9 ad be 74 32 ca 20 de 4f e2 b2 99 34 01 b9 7e 45 ac 14 71 ee 4b ac 11 33 89 f8 9c 95 93 37 b9 eb b1 a5 46 Data Ascii: lzI*NAopHQ%]!'#<GVJNFC%uDbC1\%~"!;c0Xzdgn;^3Y^gz-.'"q@h:~S)8-4a)AHuV&&TakE\3D`By)0UV0(,NI& Q_9t2 O4~EqK37F

Timestamp	kBytes transferred	Direction	Data
2022-04-04 05:04:42 UTC	1131	OUT	GET /s/poppins/v19/pxiByp8kv8JHgFVrLDz8Z1xlFQ.woff2 HTTP/1.1 Host: fonts.gstatic.com Connection: keep-alive Origin: https://cyan-bamboo-4lth.squarespace.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://fonts.googleapis.com/css2?family=Poppins:ital,wght@0,300;0,400;0,500;0,700;1,300 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-04 05:04:42 UTC	1131	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="apps-themes" Report-To: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} Timing-Allow-Origin: * Content-Length: 7840 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed, 30 Mar 2022 19:40:05 GMT Expires: Thu, 30 Mar 2023 19:40:05 GMT Cache-Control: public, max-age=31536000 Age: 379477 Last-Modified: Wed, 26 Jan 2022 19:11:22 GMT Content-Type: font/woff2 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2022-04-04 05:04:42 UTC	1132	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 00 1e a0 00 0c 00 00 00 00 3f c0 00 00 1e 4d 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1b 1e 1c 2e 06 60 00 81 54 0a e8 04 d2 68 0b 83 36 00 01 36 02 24 03 86 68 04 20 05 83 42 07 84 0b 1b 96 32 45 46 86 8d 03 00 d1 64 2b 11 55 9b f7 b2 ff 0f 09 74 8c 1d cc 0d ad 82 0d c6 46 e3 68 21 e4 04 cb 8d ef 39 65 1a 0a 27 c4 d0 5c 57 66 5b f3 f1 b3 66 65 42 04 0a 1b dc 86 b0 01 74 f2 dc 9b ff 56 33 1d 64 1a 9f 3f 42 93 53 ec 44 d4 1a 64 cf ec 3d 83 62 4b 42 12 cb d7 08 f2 cb bf 8e 8d 70 a9 08 47 a0 62 49 01 7a 00 d8 8d b1 35 c1 3c 99 27 b1 44 94 55 2c 44 92 ad 33 f0 12 be 86 bd 5e ff e1 f9 6d f6 8c 5c 5a 35 11 1d a2 12 2d f0 a1 7f c0 87 4f a6 0a 98 03 ab 56 a5 6b 6f ba a8 ba 94 ed 2a dd 65 ac 2f 22 b6 f3 ff Data Ascii: wOF2?M.`Th66$h B2EFd+UtFh!9e'\Wf[feBtV3d?BSDd=bKBpGbIz5<'DU,D3^m\Z5-OVko*e/"
2022-04-04 05:04:42 UTC	1132	IN	Data Raw: b9 25 20 15 f5 df eb 2c 5b e9 b4 9a 93 0f a1 83 84 2b 9c 7e bd 81 5a 93 0a 3b a0 f2 aa af 27 c9 fa 5f f2 d7 c9 b2 bd 36 2f 81 6f 1c 2d cc 9c c3 92 42 b6 aa 00 70 77 29 59 0e 2a 04 58 11 56 54 34 a9 c2 45 53 a7 4c 9d a2 2c 53 c5 d4 74 3a 27 e9 74 a7 95 9a 92 8e 65 78 3c e1 18 5b 8e bd 1f 95 94 a8 e8 f1 80 41 6c 36 ab d9 61 bf f5 cd 85 13 23 84 93 8a 51 cd 5f 9f a1 00 6b 95 95 4a 38 7d 56 6f 03 e9 02 80 39 01 98 4d 7a 68 92 26 16 de 8e 0c 70 24 b7 61 1a 61 e9 a5 bc fb 65 5c 0e 4d 0a e8 33 75 01 2e 1d a7 e5 2a 4e b0 89 b6 12 ad 02 0f fa c2 15 d4 08 9e 06 0e ec 48 2e fe ff b0 f0 d2 d9 de 7d 02 9e 45 87 e9 81 5e 05 ec 63 64 cb 8c 29 b6 4b 82 47 3d 99 27 ed 10 2e 3c 01 6c f0 f6 7f c6 b1 f2 53 ea 8b fd b8 9f ee cb 25 15 93 16 90 c8 24 0a 49 4c 82 49 cf af 0e 90 Data Ascii: % ,[+~Z;'_6/o-Bpw)YXVT4ESL,St:'tex<[Al6a#Q_kJ8}Vo9Mzh&p$aae\M3u.NH.}E^cd)KG='.<lS%$ILI
2022-04-04 05:04:42 UTC	1134	IN	Data Raw: 5b 83 d9 14 d0 d6 5e e4 2c d8 75 92 a3 51 39 13 d9 f2 0e 62 e6 75 f1 4d f7 bb f5 f4 4b f4 0d fb d3 61 75 cc aa 44 14 5b 53 bb ed 6e d9 a7 31 b0 43 d5 20 9d e3 1d 76 d1 27 c0 f4 f4 7e 82 ca 62 94 38 2b 74 c6 9e cd d6 be fd 6f b3 3f 9d 91 4d ea d4 58 a8 c3 92 cb a2 6b 29 60 1b 5a 93 94 bc 31 0d c9 7d 03 b9 c2 67 bd 89 f0 f6 18 b3 79 07 8e f3 81 85 6f 50 2c 5c 23 ae b0 a4 6f 4e b6 3e 2a 8f fc 16 3e a7 ea 87 0f 75 00 af 2f 3e 72 7e 5e 37 b6 d1 50 0c 12 a3 17 17 3c 90 6a 16 0f b4 69 0c 34 5b 73 ec e1 73 33 03 6f eb 75 b2 e6 a5 2e 78 6c 87 84 0b 8a 5c ef 14 ca 73 5f 4c c3 fd 52 9f 3b 48 70 16 18 cf d7 9e 0d 9e dd 94 18 f8 b6 7d 7b 0f 58 f8 77 fd 3b 59 2a bd 7b de ed 34 dc a5 1f 29 a3 b8 85 40 e2 12 ad c5 aa 94 9b ac 70 88 57 e8 c1 f2 73 af d4 71 b1 fc e0 56 e5 Data Ascii: [^,uQ9buMKauD[Sn1C v'~b8+to?MXk)`Z1}gyoP,\#oN>>u/>r~^7P<ji4[ss3ou.xl\s_LR;Hp}{Xw;Y{4)@pWsqV
2022-04-04 05:04:42 UTC	1135	IN	Data Raw: 0a 3a c7 1a 20 1c 3d 8b a2 ad 6b 16 65 84 e0 74 95 df 42 e8 4d 46 d9 ce 4f f2 a1 82 99 35 62 1d 8a c2 2e 74 19 0c 2a 4e f1 3b be b6 de e9 90 76 9c 46 4e 27 be 35 b6 9d 06 92 b7 c6 c0 ca 20 4d 68 69 51 d1 db a5 28 af 6b 91 d2 dc b2 ac 7d 8e 07 99 ad f4 63 88 d3 d5 6c b7 ba 7d 36 b1 93 4f a8 36 5d 00 2f 1e 58 d1 d4 b8 23 e9 2c d4 05 6b db 46 96 77 ab 38 ed ad 72 c3 64 d7 b5 f3 3d 0f 1a a2 ad 19 56 e5 f3 4b ac 0b 79 7a a1 39 d8 e1 23 bc 7e b3 d3 dd 68 05 df 4f e6 4f 62 45 5b b6 4a de 05 9b d6 29 ec 52 81 c0 d6 c6 c2 71 42 14 2d 90 28 9c 6f ab e7 13 41 44 21 0b f4 70 f5 7a 20 58 0a 64 8d f6 11 d9 b7 dc 18 41 b8 51 b5 cc ab d5 e9 5c af ec af 6b 2d af f7 93 26 64 76 d8 43 16 0c 6f c6 2d e0 e4 12 02 81 03 9e 89 a4 53 94 76 19 d2 b6 74 49 97 9a db d1 26 25 36 77 Data Ascii: : =ketBMFO5b.t*N;vFN'5 MhiQ(k}cl}6O6]/X#,kFw8rd=VKyz9#~hOObE[J)RqB-(oAD!pz XdAQ\k-&dvCo-SvtI&%6w
2022-04-04 05:04:42 UTC	1136	IN	Data Raw: 65 60 45 4d 37 b6 76 10 65 e9 14 bd bd 32 bc 6d 3c 34 df 8e 14 86 d5 5a be 95 c6 74 4a d6 ed e8 92 c3 b0 c1 76 8a 3e 78 5f 9a 57 7c 5b 5d 13 57 d8 4e 28 10 a1 db e5 27 8c fe 50 63 2d 7a 0f 2d df 1a e6 cb 81 7f fd 67 f9 f9 9f e6 e5 7d 9a 9f ff 59 1e b9 99 8c 92 41 d3 a3 dc ba 3d a0 c4 ca 4c 95 52 a6 62 4b 28 d5 f3 ab 0f a2 60 f0 d6 6f bf 7f f8 e0 1e fd e4 d7 a6 c4 79 c9 59 60 f2 ee 3d f4 1e e0 1e a6 0d 0d f5 a6 7e 18 bb 1f 27 bc 91 46 ea 85 d3 3d 4c 94 8c 06 26 82 3c 08 6b 57 17 28 f3 14 ed 30 0c 2e d5 8d 92 6a b2 a0 fb 07 e7 df d6 c8 93 81 9f 67 8f c0 e8 52 bb 1d 5b 3a 0a 13 c4 e2 eb 0a 1b b6 6c 49 a3 cf cb 12 36 69 34 f5 4d 6a 09 04 60 05 48 b0 07 25 70 fe 96 99 b8 2c e0 bb 4a 74 6b a6 46 90 2a 64 68 d2 fa 03 70 49 a6 eb 71 60 08 ad 42 47 06 7a 2c ed 0b Data Ascii: e`EM7ve2m<4ZtJv>x_W\|[]WN('Pc-z-g}YA=LRbK(`oyY`=~'F=L&<kW(0.jgR[:lI6i4Mj`H%p,JtkF*dhpIq`BGz,
2022-04-04 05:04:42 UTC	1137	IN	Data Raw: 1d 8b 6f ec e3 60 22 ec 4a e5 e1 3f b5 bf 71 da 9e 18 7e 62 04 78 27 04 d8 fc 4a 6f 8b 47 e3 29 9e de a4 88 5d 8c 3e 5a 69 1f 8a ab d0 b2 3c 3b ae f5 84 0e 4a 58 7d 2a 97 be 1c 87 3f 25 30 6f 55 7a 86 30 63 76 b5 30 7a 3c 3b 78 8c 98 8c 4f 09 17 1d 3b fc f3 21 f0 a9 20 8e bd 46 64 ef f6 45 cd 69 b2 43 20 5e d7 ed be c4 49 9f 6d 7f a4 25 12 3e 11 38 13 f8 6e f3 4d 49 50 19 94 bd b9 75 d5 1d 8e 8f ef dc b3 6d 2c 65 26 38 93 32 06 66 0e 1c ed f1 67 f9 36 8e 1c fd f4 c8 91 c3 87 3f 3b fc d1 63 60 cc 76 81 b1 44 1b 56 b6 53 f6 50 5f 54 69 24 81 96 f3 f4 2d eb e9 68 bc 25 a8 eb 5d a9 61 fd 19 b9 8f c4 8b 0a 4b 95 03 b2 45 a6 82 1f 31 16 c1 dc a4 b8 73 d2 14 7a 15 99 dc 3c dc e6 d4 66 03 0e 6f 3d ba a9 fc f3 a1 dc d8 d3 b3 48 e9 af 65 61 34 e6 67 47 3f 3a 98 53 Data Ascii: o`"J?q~bx'JoG)]>Zi<;JX}*?%0oUz0cv0z<;xO;! FdEiC ^Im%>8nMIPum,e&82fg6?;c`vDVSP_Ti$-h%]aKE1sz<fo=Hea4gG?:S
2022-04-04 05:04:42 UTC	1139	IN	Data Raw: 01 58 b2 f2 83 bf bb 45 e9 3c c9 6f e9 49 e3 4b 80 8f 9f 5f 1c 00 3e db 29 78 ed fe 2f f7 67 32 cb 97 32 c0 2a 74 63 24 e1 6d 54 6b 6d 92 22 fc bd 06 1a de 65 f9 d3 fc 86 6c b6 c6 fb bf 83 2b e9 3a 83 a6 b2 76 92 be af ae 6f a8 f6 d0 ac 2f 47 05 f0 71 a3 e6 3d 50 b7 d0 3a 37 ff 6a 9a aa 47 d5 e4 09 8c b6 52 a6 4a 79 25 b8 d5 e2 34 82 dc 36 9a f6 d3 34 4f 71 bb 88 db 0d f1 84 1a 77 cd cf 5f b0 1e 65 cd 77 0c 05 70 60 7c 43 d7 8d 48 b5 33 8d 24 a3 3e cb 94 3f 23 f3 7d 6a cc ad 32 27 62 3e 1f fb d5 c2 0a 19 1f 83 30 f0 54 cf 83 e4 6a 84 07 36 8f d1 3d e0 4a 08 9b ae da 49 44 1f 52 38 e2 8a ab 55 a3 b7 cf ef 1c dd 74 1a ac 57 04 77 1c 68 00 a5 87 39 92 2c df 23 58 b1 64 6a 04 08 4c 6c 20 88 fc c2 18 de f6 64 85 6f e6 e7 b9 05 09 cc 03 90 32 5d d9 07 2c 42 da Data Ascii: XE<oIK_>)x/g22*tc$mTkm"el+:vo/Gq=P:7jGRJy%464Oqw_ewp`\|CH3$>?#}j2'b>0Tj6=JIDR8UtWwh9,#XdjLl do2],B

Timestamp	kBytes transferred	Direction	Data
2022-04-04 05:04:43 UTC	1140	OUT	GET /api/1/performance/settings HTTP/1.1 Host: cyan-bamboo-4lth.squarespace.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://cyan-bamboo-4lth.squarespace.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: crumb=BVzlMBSiV2geOTQ5MTNjOTJhZDU4ZTlkYTM5YzY2Mjc4MmYxNTk5
2022-04-04 05:04:43 UTC	1142	IN	HTTP/1.1 200 OK Content-Length: 238 Content-Type: application/json Date: Mon, 04 Apr 2022 05:04:43 GMT Server: Squarespace Vary: Accept-Encoding, User-Agent X-Contextid: ht2fC9EM/ciWjCtHy Connection: close
2022-04-04 05:04:43 UTC	1142	IN	Data Raw: 7b 22 69 73 43 6f 6e 66 69 67 75 72 61 74 69 6f 6e 4c 6f 61 64 65 64 22 3a 74 72 75 65 2c 22 65 78 70 65 72 69 6d 65 6e 74 43 6f 6e 74 65 78 74 4c 69 73 74 22 3a 5b 7b 22 6e 61 6d 65 22 3a 22 72 75 6d 22 2c 22 65 78 70 65 72 69 6d 65 6e 74 54 79 70 65 22 3a 22 46 45 41 54 55 52 45 5f 54 4f 47 47 4c 45 22 2c 22 73 65 67 6d 65 6e 74 4e 61 6d 65 22 3a 22 64 65 66 61 75 6c 74 22 2c 22 76 61 72 69 61 6e 74 22 3a 22 74 72 75 65 22 2c 22 63 6f 6e 74 61 69 6e 73 45 72 72 6f 72 22 3a 66 61 6c 73 65 2c 22 73 74 61 74 75 73 22 3a 22 41 43 54 49 56 45 22 7d 5d 2c 22 70 61 67 65 4c 6f 61 64 49 64 22 3a 22 36 61 61 33 36 64 64 32 2d 63 35 39 61 2d 34 38 61 33 2d 61 36 36 33 2d 65 37 61 30 35 33 31 38 32 61 39 33 22 7d Data Ascii: {"isConfigurationLoaded":true,"experimentContextList":[{"name":"rum","experimentType":"FEATURE_TOGGLE","segmentName":"default","variant":"true","containsError":false,"status":"ACTIVE"}],"pageLoadId":"6aa36dd2-c59a-48a3-a663-e7a053182a93"}

Timestamp	kBytes transferred	Direction	Data
2022-04-04 05:04:43 UTC	1140	OUT	GET /static/vta/5c5a519771c10ba3470d8101/scripts/floating-cart.b7c69926f0fd20087e37.js HTTP/1.1 Host: static1.squarespace.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://cyan-bamboo-4lth.squarespace.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-04 05:04:43 UTC	1141	IN	HTTP/1.1 200 OK Connection: close Content-Length: 496 Cache-Control: public, max-age=94608000 Content-Type: application/javascript; charset=UTF-8 Pragma: cache Server: Squarespace Timing-Allow-Origin: * X-Content-Type-Options: nosniff X-Contextid: Ka7CUAau/N6VZwtCX Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Date: Mon, 04 Apr 2022 05:04:43 GMT Age: 218066 X-Served-By: cache-dfw18666-DFW, cache-mxp6963-MXP X-Cache: HIT, HIT X-Cache-Hits: 1, 1 X-Timer: S1649048683.315681,VS0,VE0 Vary: Accept-Encoding Tracepoint: Fastly
2022-04-04 05:04:43 UTC	1141	IN	Data Raw: 28 77 69 6e 64 6f 77 2e 77 70 4a 73 6f 6e 70 54 65 6d 70 6c 61 74 65 53 65 63 74 69 6f 6e 73 3d 77 69 6e 64 6f 77 2e 77 70 4a 73 6f 6e 70 54 65 6d 70 6c 61 74 65 53 65 63 74 69 6f 6e 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 31 38 5d 2c 7b 31 30 31 33 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 74 2c 65 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 65 2e 72 28 74 29 3b 76 61 72 20 69 3d 65 28 38 29 3b 65 28 30 29 2c 74 2e 64 65 66 61 75 6c 74 3d 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6e 65 77 20 50 72 6f 6d 69 73 65 28 28 66 75 6e 63 74 69 6f 6e 28 6e 2c 74 29 7b 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 6c 6f 61 64 22 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 6e 28 29 7d 29 29 7d 29 29 2e 74 68 65 6e 28 28 66 75 6e 63 74 69 6f 6e 28 29 Data Ascii: (window.wpJsonpTemplateSections=window.wpJsonpTemplateSections\|\|[]).push([[18],{1013:function(n,t,e){"use strict";e.r(t);var i=e(8);e(0),t.default=function(n){new Promise((function(n,t){window.addEventListener("load",(function(){n()}))})).then((function()

Target ID:	0
Start time:	07:04:37
Start date:	04/04/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "https://cyan-bamboo-4lth.squarespace.com/
Imagebase:	0x7ff7f6290000
File size:	2150896 bytes
MD5 hash:	C139654B5C1438A95B321BB01AD63EF6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Target ID:	2
Start time:	07:04:38
Start date:	04/04/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1588,17004896836549072442,15477467046775337148,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1912 /prefetch:8
Imagebase:	0x7ff7f6290000
File size:	2150896 bytes
MD5 hash:	C139654B5C1438A95B321BB01AD63EF6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low