Edit tour

Windows Analysis Report
https://youtube.ch/new/view/g975fkji44fp3w6chof83b9u/fsn@cbmaterialhandling.com

Overview

General Information

Sample URL:	https://youtube.ch/new/view/g975fkji44fp3w6chof83b9u/fsn@cbmaterialhandling.com
Analysis ID:	1592382
Infos:

Detection

Score:	21
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

AI detected suspicious URL

HTML body with high number of embedded SVGs detected

Stores files to the Windows start menu directory

URL contains potential PII (phishing indication)

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6240 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 6428 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 --field-trial-handle=1940,i,101132052466414308,17538194463015134106,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 1092 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5888 --field-trial-handle=1940,i,101132052466414308,17538194463015134106,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 7256 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5544 --field-trial-handle=1940,i,101132052466414308,17538194463015134106,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 7108 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.ch/new/view/g975fkji44fp3w6chof83b9u/fsn@cbmaterialhandling.com" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

cleanup

HTTP traffic detected: POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 1024sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"Content-Type: application/x-www-form-urlencoded;charset=UTF-8sec-ch-ua-full-version: "117.0.5938.149"sec-ch-ua-platform-version: "10.0.0"X-Goog-AuthUser: 0sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: */*Origin: https://www.youtube.comX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.youtube.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=520=HpSSk1CRnO11THC3KGCqpiLFzokeK1X1XlpCmIbKD8N2bPZ5M5fHHfIpvFH1iLfWhgpCLL9GSgC13GiK7IBsDWs9dvp1s-Tbg3dV1BYvQ7WuGe8EEgrOkKShoI5GC7tV4vNnJeZM-YjiGiSdclxUqsFzeB-gmUtXdcxsXzqPMP8ebRSbC0EWZKV2Z9nMJyWisg

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.57.35
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.57.35
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: youtube.ch
Source: global traffic	DNS traffic detected: DNS query: www.youtube.com
Source: global traffic	DNS traffic detected: DNS query: i.ytimg.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: googleads.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: rr4---sn-4g5ednsr.googlevideo.com
Source: global traffic	DNS traffic detected: DNS query: youtube.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: static.doubleclick.net

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenLast-Modified: Wed, 02 May 2007 10:26:10 GMTContent-Type: text/plainContent-Length: 0Connection: closeAccess-Control-Allow-Origin: https://www.youtube.comAccess-Control-Allow-Credentials: trueTiming-Allow-Origin: https://www.youtube.comAccess-Control-Expose-Headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-MsVary: OriginCross-Origin-Resource-Policy: cross-originX-Content-Type-Options: nosniffDate: Thu, 16 Jan 2025 01:38:25 GMTServer: gvs 1.0
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenLast-Modified: Wed, 02 May 2007 10:26:10 GMTContent-Type: text/plainContent-Length: 0Connection: closeAccess-Control-Allow-Origin: https://www.youtube.comAccess-Control-Allow-Credentials: trueTiming-Allow-Origin: https://www.youtube.comAccess-Control-Expose-Headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-MsVary: OriginCross-Origin-Resource-Policy: cross-originX-Content-Type-Options: nosniffDate: Thu, 16 Jan 2025 01:38:25 GMTServer: gvs 1.0
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenLast-Modified: Wed, 02 May 2007 10:26:10 GMTContent-Type: text/plainContent-Length: 0Connection: closeAccess-Control-Allow-Origin: https://www.youtube.comAccess-Control-Allow-Credentials: trueTiming-Allow-Origin: https://www.youtube.comAccess-Control-Expose-Headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-MsVary: OriginCross-Origin-Resource-Policy: cross-originX-Content-Type-Options: nosniffDate: Thu, 16 Jan 2025 01:38:26 GMTServer: gvs 1.0
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenLast-Modified: Wed, 02 May 2007 10:26:10 GMTContent-Type: text/plainContent-Length: 0Connection: closeAccess-Control-Allow-Origin: https://www.youtube.comAccess-Control-Allow-Credentials: trueTiming-Allow-Origin: https://www.youtube.comAccess-Control-Expose-Headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-MsVary: OriginCross-Origin-Resource-Policy: cross-originX-Content-Type-Options: nosniffDate: Thu, 16 Jan 2025 01:38:26 GMTServer: gvs 1.0
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenLast-Modified: Wed, 02 May 2007 10:26:10 GMTContent-Type: text/plainContent-Length: 0Connection: closeAccess-Control-Allow-Origin: https://www.youtube.comAccess-Control-Allow-Credentials: trueTiming-Allow-Origin: https://www.youtube.comAccess-Control-Expose-Headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-MsVary: OriginCross-Origin-Resource-Policy: cross-originX-Content-Type-Options: nosniffDate: Thu, 16 Jan 2025 01:38:27 GMTServer: gvs 1.0
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenLast-Modified: Wed, 02 May 2007 10:26:10 GMTContent-Type: text/plainContent-Length: 0Connection: closeAccess-Control-Allow-Origin: https://www.youtube.comAccess-Control-Allow-Credentials: trueTiming-Allow-Origin: https://www.youtube.comAccess-Control-Expose-Headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-MsVary: OriginCross-Origin-Resource-Policy: cross-originX-Content-Type-Options: nosniffDate: Thu, 16 Jan 2025 01:38:27 GMTServer: gvs 1.0

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 49691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 --field-trial-handle=1940,i,101132052466414308,17538194463015134106,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.ch/new/view/g975fkji44fp3w6chof83b9u/fsn@cbmaterialhandling.com"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5888 --field-trial-handle=1940,i,101132052466414308,17538194463015134106,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5544 --field-trial-handle=1940,i,101132052466414308,17538194463015134106,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 --field-trial-handle=1940,i,101132052466414308,17538194463015134106,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5888 --field-trial-handle=1940,i,101132052466414308,17538194463015134106,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5544 --field-trial-handle=1940,i,101132052466414308,17538194463015134106,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Extra Window Memory Injection	1 Extra Window Memory Injection	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Name	IP	Active	Malicious	Reputation
youtube-ui.l.google.com	142.250.186.78	true	false	high
googleads.g.doubleclick.net	172.217.16.194	true	false	high
play.google.com	216.58.206.78	true	false	high
i.ytimg.com	142.250.186.86	true	false	high
youtube.ch	142.250.185.206	true	false	unknown
www.google.com	216.58.206.68	true	false	high
rr4.sn-4g5ednsr.googlevideo.com	74.125.110.105	true	false	high
static.doubleclick.net	142.250.186.70	true	false	high
youtube.com	142.250.186.110	true	false	high
rr4---sn-4g5ednsr.googlevideo.com	unknown	unknown	false	high
www.youtube.com	unknown	unknown	false	high

Name	Malicious	Reputation
https://www.google.com/js/th/8IiC491fkZiDnwU-R_SjAMw8X6DEePP7W74TtAWlHNA.js	false	high
https://i.ytimg.com/generate_204	false	high
https://googleads.g.doubleclick.net/pagead/id?slf_rd=1	false	high
https://youtube.com/	false	high
https://static.doubleclick.net/instream/ad_status.js	false	high
https://googleads.g.doubleclick.net/pagead/id	false	high
https://www.google.com/pagead/lvz?evtid=ACd6KtwQIdOyecKjv2TPnD9VKtV5RVSmsFOZKcQ7KrWtERqPm3UWa5qDgjk_qpe0aJvWJTlwZkyjAOzGq-G59x_u_VN20lDA1Q&req_ts=1736991497&pg=MainAppBootstrap%3AUnclassified&az=1&sigh=AB9vU40fCSr6fq_QRiAfZsNYCV1D8CnRUA	false	high
https://www.youtube.com/new/view/g975fkji44fp3w6chof83b9u/fsn@cbmaterialhandling.com?gl=CH	false	high
https://www.youtube.com/new	false	high

Source: chromecache_364.1.dr	String found in binary or memory: "&label=videoskipped&ad_mt=[AD_MT]&acvw=[VIEWABILITY]&gv=[GOOGLE_VIEWABILITY]"},{baseUrl:"https://ade.googlesyndication.com/ddm/activity_ext/dc_pubid="+fa+";dc_exteid="+Tb+";met="+fa+";ecn"+fa+"="+fa+";etm1="+fa+";eid1="+Ib+";acvw=[VIEWABILITY];gv=[GOOGLE_VIEWABILITY]?"}],closePings:[{baseUrl:"https://www.youtube.com/pagead/interaction/?ai=C"+B+"____________"+D+"AxAA&sigh="+x+"&cid="+ea+"&label=adclose&ad_mt=[AD_MT]&acvw=[VIEWABILITY]&gv=[GOOGLE_VIEWABILITY]"}],progressPings:[{baseUrl:"https://www.youtube.com/pagead/interaction/?ai=C"+ equals www.youtube.com (Youtube)
Source: chromecache_367.1.dr, chromecache_364.1.dr	String found in binary or memory: "&sig="+zb+"&ad_cpn=[AD_CPN]&id="+ec+"&acvw=[VIEWABILITY]&gv=[GOOGLE_VIEWABILITY]&avm="+fa},{baseUrl:"https://pagead2.googlesyndication.com/activeview_ext?id="+ec+"&avm="+fa+"&dc_pubid="+fa+"&dc_exteid="+Tb+"&acvw=[VIEWABILITY]&gv=[GOOGLE_VIEWABILITY]?"}],abandonPings:[{baseUrl:"https://www.youtube.com/pagead/interaction/?ai=C"+B+"____________"+D+"AxAA&sigh="+Ed+"&cid="+ea+"&label=video_abandon&ad_mt=[AD_MT]&ad_tos=[AD_TOS]&ad_wat=[AD_WAT]&final=[FINAL]&acvw=[VIEWABILITY]&gv=[GOOGLE_VIEWABILITY]"}, equals www.youtube.com (Youtube)
Source: chromecache_364.1.dr	String found in binary or memory: "&uga="+kb+"&vm="+gd},videostatsDelayplayUrl:{baseUrl:"https://s.youtube.com/api/stats/delayplay?cl="+fd+"&docid="+x+"&ei="+S+"&feature="+m+"&fexp="+Uq+"&ns="+ra+"&plid="+O+"&referrer=https%3A%2F%2Fwww.youtube.com%2F&sdetail=p%3A%2F&sourceid="+mf+"&el="+vg+"&len="+vc+"&of="+fb+"&uga="+kb+"&vm="+gd},videostatsWatchtimeUrl:{baseUrl:"https://s.youtube.com/api/stats/watchtime?cl="+fd+"&docid="+x+"&ei="+S+"&feature="+m+"&fexp="+Uq+"&ns="+ra+"&plid="+O+"&referrer=https%3A%2F%2Fwww.youtube.com%2F&sdetail=p%3A%2F&sourceid="+ equals www.youtube.com (Youtube)
Source: chromecache_364.1.dr	String found in binary or memory: "=",adInfoRenderer:{adHoverTextButtonRenderer:{button:{buttonRenderer:{style:"STYLE_UNKNOWN",size:"SIZE_DEFAULT",isDisabled:!1,icon:{iconType:"INFO_OUTLINE"},navigationEndpoint:{clickTrackingParams:Fd,openPopupAction:{popup:{aboutThisAdRenderer:{url:(PI.privateDoNotAccessOrElseTrustedResourceUrlWrappedValue="https://www.youtube.com/aboutthisad?pf=web&source=youtube&reasons=A"+N+"&hl="+ra+"&origin=www.youtube.com&ata_theme="+ih,PI),trackingParams:Eb+"="}},popupType:"DIALOG"}},trackingParams:Eb+"="}}, equals www.youtube.com (Youtube)
Source: chromecache_367.1.dr, chromecache_364.1.dr	String found in binary or memory: "="},trackingParams:Eb+"="}},adLayoutLoggingData:{serializedAdServingDataEntry:ih},skipPings:[{baseUrl:"https://www.youtube.com/pagead/interaction/?ai=C"+B+"____________"+D+"AxAA&sigh="+x+"&cid="+ea+"&label=videoskipped&ad_mt=[AD_MT]&acvw=[VIEWABILITY]&gv=[GOOGLE_VIEWABILITY]"},{baseUrl:"https://ade.googlesyndication.com/ddm/activity_ext/dc_pubid="+fa+";dc_exteid="+Tb+";met="+fa+";ecn"+fa+"="+fa+";etm1="+fa+";eid1="+Ib+";acvw=[VIEWABILITY];gv=[GOOGLE_VIEWABILITY]?"}],layoutId:"1ID7Gdwk2vV7OZ1A"}}, equals www.youtube.com (Youtube)
Source: chromecache_367.1.dr, chromecache_364.1.dr	String found in binary or memory: "="}},hoverText:{runs:[{text:ih}]},trackingParams:Eb+"="}},adVideoId:Ed,impressionPings:[{baseUrl:"https://www.youtube.com/pagead/interaction/?ai=C"+B+"____________"+D+"AxAA&sigh="+x+"&cid="+ea+"&label=video_companion_reshow_tracking"}],adLayoutLoggingData:{serializedAdServingDataEntry:Bl},isContentVideoCompanion:!0,associatedCompositePlayerBytesLayoutId:oe}},adSlotLoggingData:{serializedSlotAdServingDataEntry:ec}}}],adBreakHeartbeatParams:"Q0FBJTNE",frameworkUpdates:{entityBatchUpdate:{mutations:[{entityKey:Cl, equals www.youtube.com (Youtube)
Source: chromecache_484.1.dr	String found in binary or memory: "auth"\|\|D.details.rc!=="429"?D.errorCode==="ump.spsrejectfailure"&&(k="HTML5_SPS_UMP_STATUS_REJECTED"):(k="TOO_MANY_REQUESTS",C="6");this.tx.YG(D.errorCode,D.severity,k,vE(D.details),C)}else this.tx.publish("nonfatalerror",D),V=/^pp/.test(this.videoData.clientPlaybackNonce),this.pp(D.errorCode,D.details),V&&D.errorCode==="manifest.net.connect"&&(D="https://www.youtube.com/generate_204?cpn="+this.videoData.clientPlaybackNonce+"&t="+(0,g.Ws)(),yS(D,"manifest",function(M){O.Z=!0;O.KF("pathprobe",M)}, equals www.youtube.com (Youtube)
Source: chromecache_364.1.dr	String found in binary or memory: "https://www.youtube.com/aboutthisad?pf=web&source=youtube&reasons=A"+N+"&hl="+ra+"&origin=www.youtube.com&ata_theme="+ih,E0),trackingParams:Eb+"="}},popupType:"DIALOG"}},icon:{iconType:"INFO_OUTLINE"},trackingParams:Eb+"="}},hoverText:{runs:[{text:vg}]},trackingParams:Eb+"="}},flyoutCtaRenderer:{flyoutCtaRenderer:{image:{thumbnail:{thumbnails:[{url:"https://yt3.ggpht.com/ytc/"+Ta+"=s176-c-k-c0x00ffffff-no-rj"}]},trackingParams:Eb+"="},headline:{text:dc,isTemplated:!1,trackingParams:Eb+"="},description:{text:Tm, equals www.youtube.com (Youtube)
Source: chromecache_364.1.dr	String found in binary or memory: "https://www.youtube.com/aboutthisad?pf=web&source=youtube&reasons=A"+N+"&hl="+ra+"&origin=www.youtube.com&ata_theme="+ih,zga),trackingParams:Eb+"="}},popupType:"DIALOG"}},trackingParams:Eb+"="}},hoverText:{runs:[{text:lm}]},trackingParams:Eb+"="}},adVideoId:Ed,impressionPings:[{baseUrl:"https://www.youtube.com/pagead/interaction/?ai=C"+B+"____________"+D+"AxAA&sigh="+x+"&cid="+ea+"&label=video_companion_impression_tracking"}],adLayoutLoggingData:{serializedAdServingDataEntry:ec},associatedCompositePlayerBytesLayoutId:oe}}, equals www.youtube.com (Youtube)
Source: chromecache_367.1.dr, chromecache_364.1.dr	String found in binary or memory: $E.prototype.getUrl=function(a,b){return"https://www.gstatic.com/youtube/img/icons/web/"+b.style+"/"+a+"/v"+b.version+"/"+b.size+"px.svg"}; equals www.youtube.com (Youtube)
Source: chromecache_484.1.dr	String found in binary or memory: (g.EF(h,"redirector.googlevideo.com"),V=h.toString()):h.D.match("rr?[1-9].*\\.c\\.youtube\\.com$")?(g.EF(h,"www.youtube.com"),V=h.toString()):(h=VyB(V),CF(h)&&(V=h));h=new g.ak(V);h.set("cmo=pf","1");k&&h.set("cmo=td","a1.googlevideo.com");return h}; equals www.youtube.com (Youtube)
Source: chromecache_484.1.dr	String found in binary or memory: 0?"http":"https";this.qE=k8((O?O.customBaseYoutubeUrl:D.BASE_YT_URL)\|\|"")\|\|k8(this.dU)\|\|this.protocol+"://www.youtube.com/";M=O?O.eventLabel:D.el;V="detailpage";M==="adunit"?V=this.W?"embedded":"detailpage":M==="embedded"\|\|this.L?V=YU(V,M,oP_):M&&(V="embedded");this.ME=V;QVk();M=null;V=O?O.playerStyle:D.ps;C=g.BJ(ZkR,V);!V\|\|C&&!this.L\|\|(M=V);this.playerStyle=M;this.Z=g.BJ(ZkR,this.playerStyle);this.houseBrandUserStatus=O==null?void 0:O.houseBrandUserStatus;this.jT=this.Z&&this.playerStyle!=="play"&& equals www.youtube.com (Youtube)
Source: chromecache_367.1.dr	String found in binary or memory: ;var irc={animationConfig:{autoplay:!0,loop:!0,renderer:"svg",rendererSettings:{viewBoxOnly:!0,className:"ytChatLoadingViewModelLoadingSvg"},name:"YOUCHAT_LOADER",path:"https://www.gstatic.com/youtube/img/lottie/youchat_animations/progress_indicator_comp_v1.json"}},jrc=Pz(function(a){var b=MC();fr(function(){requestAnimationFrame(function(){var c;(c=b.lottieEl)==null\|\|c.addEventListener("DOMLoaded",function(){var d;(d=a.onLottieLoaded)==null\|\|d.call(a)})})}); equals www.youtube.com (Youtube)
Source: chromecache_367.1.dr, chromecache_364.1.dr	String found in binary or memory: B+"____________"+D+"AxAA&sigh="+Ed+"&cid="+ea+"&ad_cpn=[AD_CPN]&lact=[LACT]"},{baseUrl:"https://www.youtube.com/api/stats/ads?ver="+fa+"&ns="+fa+"&event="+fa+"&device="+fa+"&content_v="+x+"&el="+vg+"&ei="+S+"&devicever="+c+"&bti="+Ib+"&format="+be+"&break_type="+fa+"&conn=[CONN]&cpn=[CPN]&lact=[LACT]&m_pos="+fa+"&mt=[MT]&p_h=[P_H]&p_w=[P_W]&rwt=[RWT]&sdkv="+nb+"&slot_pos="+fa+"&slot_len="+fa+"&vis=[VIS]&vol=[VOL]&wt=[WT]&ad_cpn=[AD_CPN]&ad_id="+xf+"&ad_len="+Lc+"&ad_mt=[AD_MT]&ad_sys=YT%3AAdSense-Viral%2CAdSense-Viral&ad_v="+ equals www.youtube.com (Youtube)
Source: chromecache_367.1.dr, chromecache_364.1.dr	String found in binary or memory: B+"____________"+D+"AxAA&sigh="+Ed+"&cid="+ea+"&label=videoskipped&ad_mt=[AD_MT]&acvw=[VIEWABILITY]&gv=[GOOGLE_VIEWABILITY]"},{baseUrl:"https://ade.googlesyndication.com/ddm/activity_ext/dc_pubid="+fa+";dc_exteid="+Tb+";met="+fa+";ecn"+fa+"="+fa+";etm1="+fa+";eid1="+Ib+";acvw=[VIEWABILITY];gv=[GOOGLE_VIEWABILITY]?"}],closePings:[{baseUrl:"https://www.youtube.com/pagead/interaction/?ai=C"+B+"____________"+D+"AxAA&sigh="+Ed+"&cid="+ea+"&label=adclose&ad_mt=[AD_MT]&acvw=[VIEWABILITY]&gv=[GOOGLE_VIEWABILITY]"}], equals www.youtube.com (Youtube)
Source: chromecache_367.1.dr, chromecache_364.1.dr	String found in binary or memory: B+"____________"+D+"AxAA&sigh="+x+"&cid="+ea+"&label=adpause&ad_mt=[AD_MT]&acvw=[VIEWABILITY]&gv=[GOOGLE_VIEWABILITY]"},{baseUrl:"https://ade.googlesyndication.com/ddm/activity_ext/dc_pubid="+fa+";dc_exteid="+Tb+";met="+fa+";ecn"+fa+"="+fa+";etm1="+fa+";eid1="+kb+";acvw=[VIEWABILITY];gv=[GOOGLE_VIEWABILITY]?"}],rewindPings:[{baseUrl:"https://www.youtube.com/pagead/interaction/?ai=C"+B+"____________"+D+"AxAA&sigh="+x+"&cid="+ea+"&label=adrewind&ad_mt=[AD_MT]&acvw=[VIEWABILITY]&gv=[GOOGLE_VIEWABILITY]"}], equals www.youtube.com (Youtube)
Source: chromecache_484.1.dr	String found in binary or memory: D))):this.api.V().S("enable_adb_handling_in_sabr")&&h==="BROWSER_OR_EXTENSION_ERROR"&&!V.Z?(V=V.hostLanguage,D="//support.google.com/youtube/answer/3037019#zippy=%2Cupdate-your-browser-and-check-your-extensions",V&&(D=g.lF(D,{hl:V})),this.PF(MA(this,"BROWSER_OR_EXTENSION_ERROR",D))):this.PF(g.k4(D.errorMessage)):this.PF(MA(this,"HTML5_NO_AVAILABLE_FORMATS_FALLBACK_WITH_LINK_SHORT","//www.youtube.com/supported_browsers")):(D=V.hostLanguage,h="//support.google.com/youtube/?p=player_error1",D&&(h=g.lF(h, equals www.youtube.com (Youtube)
Source: chromecache_367.1.dr, chromecache_364.1.dr	String found in binary or memory: EN.prototype.publish=function(a,b){return this.isDisposed()?!1:this.pubSub_.publish.apply(this.pubSub_,arguments)};var O3b=pa(["https://www.youtube.com/iframe_api"]),FN=function(){this.playerResolver_=pi();this.playerPromise_=this.playerResolver_.promise;this.playerVars_=null;this.playbackEndedCallback_=zg;this.playbackDurationSeconds_=0},P3b=function(a){var b=function(){return window.YT&&typeof window.YT.ready==="function"}; equals www.youtube.com (Youtube)
Source: chromecache_364.1.dr	String found in binary or memory: Ed+"&aqi="+S+"&ad_rmp="+fa+"&sli="+fa}],errorPings:[{baseUrl:"https://www.youtube.com/pagead/interaction/?ai=C"+B+"____________"+D+"AxAA&sigh="+x+"&cid="+ea+"&label=videoplayfailed[ERRORCODE]"}],mutePings:[{baseUrl:"https://www.youtube.com/pagead/interaction/?ai=C"+B+"____________"+D+"AxAA&sigh="+x+"&cid="+ea+"&label=admute&ad_mt=[AD_MT]&acvw=[VIEWABILITY]&gv=[GOOGLE_VIEWABILITY]"},{baseUrl:"https://ade.googlesyndication.com/ddm/activity_ext/dc_pubid="+fa+";dc_exteid="+Tb+";met="+fa+";ecn"+fa+"="+ equals www.youtube.com (Youtube)
Source: chromecache_484.1.dr	String found in binary or memory: O=this.api.V();D=this.api.getVideoData();var h="";O.j\|\|(O=g.i8(O),O.indexOf("www.")===0&&(O=O.substring(4)),h=g.LN(D)?"Watch on YouTube Music":O==="youtube.com"?"Watch on YouTube":g.fF("Watch on $WEBSITE",{WEBSITE:O}));this.updateValue("title",h)}; equals www.youtube.com (Youtube)
Source: chromecache_364.1.dr	String found in binary or memory: O={lottiePlayerProps:{animationConfig:{name:O,path:"https://www.gstatic.com/youtube/img/lottie/animated_like_icon/"+O+".json",loop:!1,autoplay:!1,rendererSettings:{viewBoxOnly:!0,className:"animated-like-icon"}}},totalFrames:S?60:119,lazyLoad:!0};break a;case"NOTIFICATION_BELL":O={lottiePlayerProps:{animationConfig:{name:N?"notification_bell_dark":"notification_bell_light",path:"https://www.gstatic.com/youtube/img/lottie/subscribe_action/subscribe_action_bell_icon_"+(N?"dark":"light")+".json",loop:!1, equals www.youtube.com (Youtube)
Source: chromecache_367.1.dr	String found in binary or memory: Object.assign({},{name:"INCORRECT",path:"https://www.gstatic.com/youtube/img/creator/posts/Lottie_QuizIncorrect_LightTheme_01a.json",renderer:"svg"},N9b,{rendererSettings:{viewBoxOnly:!0,viewBoxSize:"26 26 80 80"}});a.correctnessAnimationProps=[];a.correctnessAnimationRefs=[];return a}; equals www.youtube.com (Youtube)
Source: chromecache_364.1.dr	String found in binary or memory: Tb+"&acvw=[VIEWABILITY]&gv=[GOOGLE_VIEWABILITY]?"}],abandonPings:[{baseUrl:"https://www.youtube.com/pagead/interaction/?ai=C"+B+"____________"+D+"AxAA&sigh="+x+"&cid="+ea+"&label=video_abandon&ad_mt=[AD_MT]&ad_tos=[AD_TOS]&ad_wat=[AD_WAT]&final=[FINAL]&acvw=[VIEWABILITY]&gv=[GOOGLE_VIEWABILITY]"},{baseUrl:"https://ade.googlesyndication.com/ddm/activity_ext/dc_pubid="+fa+";dc_exteid="+Tb+";met="+fa+";ecn"+fa+"="+fa+";etm1="+fa+";eid1="+kb+";acvw=[VIEWABILITY];gv=[GOOGLE_VIEWABILITY]?"}],activeViewFullyViewableAudibleHalfDurationPings:[{baseUrl:"https://www.youtube.com/pcs/activeview?xai="+ equals www.youtube.com (Youtube)
Source: chromecache_364.1.dr	String found in binary or memory: ["NOTIFICATION_BELL",{name:"notification_bell_light",nameDarkTheme:"notification_bell_dark",path:"https://www.gstatic.com/youtube/img/lottie/subscribe_action/subscribe_action_bell_icon_light.json",pathDarkTheme:"https://www.gstatic.com/youtube/img/lottie/subscribe_action/subscribe_action_bell_icon_dark.json",lottiePlayerProps:{animationConfig:{loop:!1,autoplay:!1}},type:"NOTIFICATION_BELL",totalFrames:79,lazyLoad:!1}]]);var Qnb=pa(["https://www.gstatic.com/external_hosted/lottie/lottie_light.js"]),Rnb=Ig(Qnb),eB;function Snb(){return eB?eB:window.lottie?eB=Promise.resolve(window.lottie):eB=new Promise(function(a,b){var c=document.createElement("script");c.addEventListener("load",function(){a(lottie)}); equals www.youtube.com (Youtube)
Source: chromecache_367.1.dr	String found in binary or memory: a.content.firstChild);return LEc=a},{mode:1});var NEc;var l0=function(){var a=K.apply(this,arguments)\|\|this;a.dark=!1;a.headerBackgroundLight="https://www.gstatic.com/youtube/img/labs/early_access_web_background_expanded_ai_2x.jpg";a.headerBackgroundDark="https://www.gstatic.com/youtube/img/labs/early_access_web_background_expanded_ai_2x.jpg";a.actionMap={"yt-dark-mode-toggled-action":"onDarkModeToggledAction"};return a}; equals www.youtube.com (Youtube)
Source: chromecache_367.1.dr	String found in binary or memory: a.content.firstChild);return Qmc=a},{mode:1});var Tmc;var Umc=function(){var a=K.apply(this,arguments)\|\|this;a.rightSquigglyDark="https://www.gstatic.com/youtube/img/handles/handles_squiggle_1_dark_v1.svg";a.rightSquigglyLight="https://www.gstatic.com/youtube/img/handles/handles_squiggle_1_light_v1.svg";a.leftSquigglyDark="https://www.gstatic.com/youtube/img/handles/handles_squiggle_2_dark_v1.svg";a.leftSquigglyLight="https://www.gstatic.com/youtube/img/handles/handles_squiggle_2_light_v1.svg";a.leftSquiggly=a.leftSquigglyLight;a.rightSquiggly=a.rightSquigglyLight; equals www.youtube.com (Youtube)
Source: chromecache_367.1.dr	String found in binary or memory: a.content.firstChild);return Tmc=a},{mode:1});var Vmc;var Wmc=function(){var a=K.apply(this,arguments)\|\|this;a.actionMap={"yt-dark-mode-toggled-action":"onDarkModeToggledAction"};a.image0DarkSquigglyBackground="https://www.gstatic.com/youtube/img/handles/handles_squiggle_4_dark.svg";a.image0LightSquigglyBackground="https://www.gstatic.com/youtube/img/handles/handles_squiggle_4_light.svg";a.image1DarkSquigglyBackground="https://www.gstatic.com/youtube/img/handles/handles_squiggle_6_dark.svg";a.image1LightSquigglyBackground="https://www.gstatic.com/youtube/img/handles/handles_squiggle_6_light.svg"; equals www.youtube.com (Youtube)
Source: chromecache_367.1.dr	String found in binary or memory: a.content.firstChild);return duc=a},{mode:Vz("kevlar_poly_si_batch_j044")?1:2});var fuc;var guc=Xw(Jv("DELETE_FROM_DOWNLOADS",{},"Delete from downloads"));var huc={url:"https://www.gstatic.com/youtube/img/useredu/smart_downloads_optin_banner.svg"}; equals www.youtube.com (Youtube)
Source: chromecache_367.1.dr	String found in binary or memory: a.content.insertBefore(J().content.cloneNode(!0),a.content.firstChild);return K9b=a},{mode:2});var M9b;var N9b={autoplay:!1,loop:!1},O9b={simpleText:""},P9b=function(){var a=K.apply(this,arguments)\|\|this;a.isLoading=!1;a.usesPanelLockup=!1;a.enableRefreshWeb=z("enable_cairo_refresh_web");a.selectedItemIndex=-1;a.baseCorrectLottiePlayerAnimationConfig=Object.assign({},{name:"CORRECT",path:"https://www.gstatic.com/youtube/img/creator/posts/Lottie_QuizCorrect_LightTheme_01a.json",renderer:"svg"},N9b,{rendererSettings:{viewBoxOnly:!0,viewBoxSize:"12 20 80 80"}});a.baseIncorrectLottiePlayerAnimationConfig= equals www.youtube.com (Youtube)
Source: chromecache_367.1.dr	String found in binary or memory: a.content.insertBefore(J().content.cloneNode(!0),a.content.firstChild);return Xmc=a},{mode:1});var Ymc;var jW=function(){var a=K.apply(this,arguments)\|\|this;a.JSC$15616_squigglyBackgroundDark="https://www.gstatic.com/youtube/img/handles/handles_curl_section_illustration_dark_v1.svg";a.JSC$15616_squigglyBackgroundLight="https://www.gstatic.com/youtube/img/handles/handles_curl_section_illustration_light_v1.svg";a.actionMap={"yt-dark-mode-toggled-action":"onDarkModeToggledAction"};a.squigglyBackground=a.JSC$15616_squigglyBackgroundLight;return a}; equals www.youtube.com (Youtube)
Source: chromecache_367.1.dr	String found in binary or memory: a.content.insertBefore(J().content.cloneNode(!0),a.content.firstChild);return Ymc=a},{mode:Vz("kevlar_poly_si_batch_j056")?1:2});var Zmc;var $mc=function(){var a=K.apply(this,arguments)\|\|this;a.JSC$15619_squigglyBackgroundDark="https://www.gstatic.com/youtube/img/handles/handles_squiggle_3_dark.svg";a.JSC$15619_squigglyBackgroundLight="https://www.gstatic.com/youtube/img/handles/handles_squiggle_3_light.svg";a.squigglyBackground=a.JSC$15619_squigglyBackgroundLight;a.actionMap={"yt-dark-mode-toggled-action":"onDarkModeToggledAction"};return a}; equals www.youtube.com (Youtube)
Source: chromecache_367.1.dr	String found in binary or memory: a.image3DarkSquigglyBackground="https://www.gstatic.com/youtube/img/handles/handles_squiggle_5_dark.svg";a.image3LightSquigglyBackground="https://www.gstatic.com/youtube/img/handles/handles_squiggle_5_light_v2.svg";a.image0SquigglyBackground=a.image0LightSquigglyBackground;a.image1SquigglyBackground=a.image1LightSquigglyBackground;a.image3SquigglyBackground=a.image3LightSquigglyBackground;return a}; equals www.youtube.com (Youtube)
Source: chromecache_364.1.dr	String found in binary or memory: aIb.prototype.openToast=function(){var a;(a=this.currentToast)!=null&&a.opened\|\|(this.queue.length?(this.currentToast=this.queue.shift(),this.currentToast.open()):this.currentPersistentToast&&this.currentPersistentToast.open())};var dIb=new El("TOAST_MANAGER_TOKEN");var eIb=new El("IMAGE_ON_LOAD_HANDLER_TOKEN");var fIb=["https://fonts.gstatic.com","https://tv.youtube.com","https://www.gstatic.com","https://www.youtube.com"],gIb=Fj("wil_icon_max_concurrent_fetches",Infinity),oJ=function(a,b,c){var d=this;this.iconSet=a;this.appDirection=b;this.responsePromises={};this.iconCache={};this.queuedResponseResolvers={};this.numFetches=this.counter=0;this.cacheStorageAvailable=!!Na.caches;this.cacheStorageAsync=Promise.resolve(void 0);this.cacheStorageSync=void 0;this.requestAninmationFrameResolver=null;this.renderingMode= equals www.youtube.com (Youtube)
Source: chromecache_367.1.dr, chromecache_364.1.dr	String found in binary or memory: adSlotLoggingData:{serializedSlotAdServingDataEntry:"LigQMVuP3nAx3LwQfSGhgYmqsEWANi"}}},{adPlacementRenderer:{config:{adPlacementConfig:{kind:"AD_PLACEMENT_KIND_MILLISECONDS",adTimeOffset:{offsetStartMilliseconds:"65",offsetEndMilliseconds:"30"},hideCueRangeMarker:!0}},renderer:{adBreakServiceRenderer:{prefetchMilliseconds:"51",getAdBreakUrl:"https://www.youtube.com/get_midroll_info?ei=l3FgBarVGsIphxLPxuRduBc&m_pos=330&token=RLJjkrMhTDF1XyVxobLOmsF6L503baqxgf8zHtyL78tfro_JRoNlfUoKtHWX2jso_GFC-H_ls4xj56iIKpT0KTxmL6pBydJcB_KTnotW1Kxo4HXObZOq6QB1pko2sTXpiLrkJms8CUEhtmyJi4JLbzgqpKLHDEPl661jo3yXCRv0JEFo_M8Kbs-NJqqhNk-CRJ_s8hTmbiMZPaPBDZtVQ-NB0zXsJDIwj2XvPAaTetL-zmXE540lFCFBTmjXZ_xJyO2NATx6lkN7RoJZL2oRwXCH1rZDjXoOvFwjXFWV9JSPwCRzajtfJUVyGROxkM6BX896KoL4rFXfYzJZBZ1QOvbMxJD4laKN5xMb5KPz5Jq54KXXO76NpvMuOlkHb5qf-k2-Z&index=2&cpn=[CPN]&lact=[LACT]&vis=[VIS]&ad_block=[AD_BLOCK]&tsla=[TSLA]&bid=[BISCOTTI_ID]&dt=[DT]&flash=[FLASH]&frm=[FRM]&ca_type=[CA_TYPE]&u_tz=[U_TZ]&u_his=[U_HIS]&u_java=[U_JAVA]&u_h=[U_H]&u_w=[U_W]&u_ah=[U_AH]&u_aw=[U_AW]&u_cd=[U_CD]&u_nplug=[U_NPLUG]&u_nmime=[U_NMIME]&p_w=[P_W]&p_h=[P_H]&c=WEB&cver=2.20231003.02.02&m_pos_ms=330200"}}, equals www.youtube.com (Youtube)
Source: chromecache_367.1.dr, chromecache_364.1.dr	String found in binary or memory: adSlotLoggingData:{serializedSlotAdServingDataEntry:"LigQMVuP3nAx3LwQfSGhgYmqsEWANi"}}},{adPlacementRenderer:{config:{adPlacementConfig:{kind:"AD_PLACEMENT_KIND_START",adTimeOffset:{offsetStartMilliseconds:"330100",offsetEndMilliseconds:"594666"},hideCueRangeMarker:!0}},renderer:{adBreakServiceRenderer:{prefetchMilliseconds:"0",getAdBreakUrl:"https://www.youtube.com/get_midroll_info?ei=l3FgBarVGsIphxLPxuRduBc&m_pos=330&token=RLJjkrMhTDF1XyVxobLOmsF6L503baqxgf8zHtyL78tfro_JRoNlfUoKtHWX2jso_GFC-H_ls4xj56iIKpT0KTxmL6pBydJcB_KTnotW1Kxo4HXObZOq6QB1pko2sTXpiLrkJms8CUEhtmyJi4JLbzgqpKLHDEPl661jo3yXCRv0JEFo_M8Kbs-NJqqhNk-CRJ_s8hTmbiMZPaPBDZtVQ-NB0zXsJDIwj2XvPAaTetL-zmXE540lFCFBTmjXZ_xJyO2NATx6lkN7RoJZL2oRwXCH1rZDjXoOvFwjXFWV9JSPwCRzajtfJUVyGROxkM6BX896KoL4rFXfYzJZBZ1QOvbMxJD4laKN5xMb5KPz5Jq54KXXO76NpvMuOlkHb5qf-k2-Z&index=2&cpn=[CPN]&lact=[LACT]&vis=[VIS]&ad_block=[AD_BLOCK]&tsla=[TSLA]&bid=[BISCOTTI_ID]&dt=[DT]&flash=[FLASH]&frm=[FRM]&ca_type=[CA_TYPE]&u_tz=[U_TZ]&u_his=[U_HIS]&u_java=[U_JAVA]&u_h=[U_H]&u_w=[U_W]&u_ah=[U_AH]&u_aw=[U_AW]&u_cd=[U_CD]&u_nplug=[U_NPLUG]&u_nmime=[U_NMIME]&p_w=[P_W]&p_h=[P_H]&c=WEB&cver=2.20231003.02.02&m_pos_ms=330200"}}, equals www.youtube.com (Youtube)
Source: chromecache_367.1.dr, chromecache_364.1.dr	String found in binary or memory: adSlotLoggingData:{serializedSlotAdServingDataEntry:"by"}}},{adPlacementRenderer:{config:{adPlacementConfig:{kind:"AD_PLACEMENT_KIND_MILLISECONDS",adTimeOffset:{offsetStartMilliseconds:"73",offsetEndMilliseconds:"64"},hideCueRangeMarker:!0}},renderer:{adBreakServiceRenderer:{prefetchMilliseconds:"67",getAdBreakUrl:"https://www.youtube.com/get_midroll_info?ei=l3FgBarVGsIphxLPxuRduBc&m_pos=330&token=RLJjkrMhTDF1XyVxobLOmsF6L503baqxgf8zHtyL78tfro_JRoNlfUoKtHWX2jso_GFC-H_ls4xj56iIKpT0KTxmL6pBydJcB_KTnotW1Kxo4HXObZOq6QB1pko2sTXpiLrkJms8CUEhtmyJi4JLbzgqpKLHDEPl661jo3yXCRv0JEFo_M8Kbs-NJqqhNk-CRJ_s8hTmbiMZPaPBDZtVQ-NB0zXsJDIwj2XvPAaTetL-zmXE540lFCFBTmjXZ_xJyO2NATx6lkN7RoJZL2oRwXCH1rZDjXoOvFwjXFWV9JSPwCRzajtfJUVyGROxkM6BX896KoL4rFXfYzJZBZ1QOvbMxJD4laKN5xMb5KPz5Jq54KXXO76NpvMuOlkHb5qf-k2-Z&index=2&cpn=[CPN]&lact=[LACT]&vis=[VIS]&ad_block=[AD_BLOCK]&tsla=[TSLA]&bid=[BISCOTTI_ID]&dt=[DT]&flash=[FLASH]&frm=[FRM]&ca_type=[CA_TYPE]&u_tz=[U_TZ]&u_his=[U_HIS]&u_java=[U_JAVA]&u_h=[U_H]&u_w=[U_W]&u_ah=[U_AH]&u_aw=[U_AW]&u_cd=[U_CD]&u_nplug=[U_NPLUG]&u_nmime=[U_NMIME]&p_w=[P_W]&p_h=[P_H]&c=WEB&cver=2.20231003.02.02&m_pos_ms=330200"}}, equals www.youtube.com (Youtube)
Source: chromecache_367.1.dr, chromecache_364.1.dr	String found in binary or memory: adSlotLoggingData:{serializedSlotAdServingDataEntry:"cn"}}},{adPlacementRenderer:{config:{adPlacementConfig:{kind:"AD_PLACEMENT_KIND_MILLISECONDS",adTimeOffset:{offsetStartMilliseconds:"59",offsetEndMilliseconds:"8"},hideCueRangeMarker:!0}},renderer:{adBreakServiceRenderer:{prefetchMilliseconds:"26",getAdBreakUrl:"https://www.youtube.com/get_midroll_info?ei=l3FgBarVGsIphxLPxuRduBc&m_pos=330&token=RLJjkrMhTDF1XyVxobLOmsF6L503baqxgf8zHtyL78tfro_JRoNlfUoKtHWX2jso_GFC-H_ls4xj56iIKpT0KTxmL6pBydJcB_KTnotW1Kxo4HXObZOq6QB1pko2sTXpiLrkJms8CUEhtmyJi4JLbzgqpKLHDEPl661jo3yXCRv0JEFo_M8Kbs-NJqqhNk-CRJ_s8hTmbiMZPaPBDZtVQ-NB0zXsJDIwj2XvPAaTetL-zmXE540lFCFBTmjXZ_xJyO2NATx6lkN7RoJZL2oRwXCH1rZDjXoOvFwjXFWV9JSPwCRzajtfJUVyGROxkM6BX896KoL4rFXfYzJZBZ1QOvbMxJD4laKN5xMb5KPz5Jq54KXXO76NpvMuOlkHb5qf-k2-Z&index=2&cpn=[CPN]&lact=[LACT]&vis=[VIS]&ad_block=[AD_BLOCK]&tsla=[TSLA]&bid=[BISCOTTI_ID]&dt=[DT]&flash=[FLASH]&frm=[FRM]&ca_type=[CA_TYPE]&u_tz=[U_TZ]&u_his=[U_HIS]&u_java=[U_JAVA]&u_h=[U_H]&u_w=[U_W]&u_ah=[U_AH]&u_aw=[U_AW]&u_cd=[U_CD]&u_nplug=[U_NPLUG]&u_nmime=[U_NMIME]&p_w=[P_W]&p_h=[P_H]&c=WEB&cver=2.20231003.02.02&m_pos_ms=330200"}}, equals www.youtube.com (Youtube)
Source: chromecache_367.1.dr, chromecache_364.1.dr	String found in binary or memory: adSlotLoggingData:{serializedSlotAdServingDataEntry:"fp"}}},{adPlacementRenderer:{config:{adPlacementConfig:{kind:"AD_PLACEMENT_KIND_MILLISECONDS",adTimeOffset:{offsetStartMilliseconds:"66",offsetEndMilliseconds:"35"},hideCueRangeMarker:!0}},renderer:{adBreakServiceRenderer:{prefetchMilliseconds:"98",getAdBreakUrl:"https://www.youtube.com/get_midroll_info?ei=l3FgBarVGsIphxLPxuRduBc&m_pos=330&token=RLJjkrMhTDF1XyVxobLOmsF6L503baqxgf8zHtyL78tfro_JRoNlfUoKtHWX2jso_GFC-H_ls4xj56iIKpT0KTxmL6pBydJcB_KTnotW1Kxo4HXObZOq6QB1pko2sTXpiLrkJms8CUEhtmyJi4JLbzgqpKLHDEPl661jo3yXCRv0JEFo_M8Kbs-NJqqhNk-CRJ_s8hTmbiMZPaPBDZtVQ-NB0zXsJDIwj2XvPAaTetL-zmXE540lFCFBTmjXZ_xJyO2NATx6lkN7RoJZL2oRwXCH1rZDjXoOvFwjXFWV9JSPwCRzajtfJUVyGROxkM6BX896KoL4rFXfYzJZBZ1QOvbMxJD4laKN5xMb5KPz5Jq54KXXO76NpvMuOlkHb5qf-k2-Z&index=2&cpn=[CPN]&lact=[LACT]&vis=[VIS]&ad_block=[AD_BLOCK]&tsla=[TSLA]&bid=[BISCOTTI_ID]&dt=[DT]&flash=[FLASH]&frm=[FRM]&ca_type=[CA_TYPE]&u_tz=[U_TZ]&u_his=[U_HIS]&u_java=[U_JAVA]&u_h=[U_H]&u_w=[U_W]&u_ah=[U_AH]&u_aw=[U_AW]&u_cd=[U_CD]&u_nplug=[U_NPLUG]&u_nmime=[U_NMIME]&p_w=[P_W]&p_h=[P_H]&c=WEB&cver=2.20231003.02.02&m_pos_ms=330200"}}, equals www.youtube.com (Youtube)
Source: chromecache_367.1.dr, chromecache_364.1.dr	String found in binary or memory: adSlotLoggingData:{serializedSlotAdServingDataEntry:"go"}}},{adPlacementRenderer:{config:{adPlacementConfig:{kind:"AD_PLACEMENT_KIND_MILLISECONDS",adTimeOffset:{offsetStartMilliseconds:"14",offsetEndMilliseconds:"87"},hideCueRangeMarker:!0}},renderer:{adBreakServiceRenderer:{prefetchMilliseconds:"79",getAdBreakUrl:"https://www.youtube.com/get_midroll_info?ei=l3FgBarVGsIphxLPxuRduBc&m_pos=330&token=RLJjkrMhTDF1XyVxobLOmsF6L503baqxgf8zHtyL78tfro_JRoNlfUoKtHWX2jso_GFC-H_ls4xj56iIKpT0KTxmL6pBydJcB_KTnotW1Kxo4HXObZOq6QB1pko2sTXpiLrkJms8CUEhtmyJi4JLbzgqpKLHDEPl661jo3yXCRv0JEFo_M8Kbs-NJqqhNk-CRJ_s8hTmbiMZPaPBDZtVQ-NB0zXsJDIwj2XvPAaTetL-zmXE540lFCFBTmjXZ_xJyO2NATx6lkN7RoJZL2oRwXCH1rZDjXoOvFwjXFWV9JSPwCRzajtfJUVyGROxkM6BX896KoL4rFXfYzJZBZ1QOvbMxJD4laKN5xMb5KPz5Jq54KXXO76NpvMuOlkHb5qf-k2-Z&index=2&cpn=[CPN]&lact=[LACT]&vis=[VIS]&ad_block=[AD_BLOCK]&tsla=[TSLA]&bid=[BISCOTTI_ID]&dt=[DT]&flash=[FLASH]&frm=[FRM]&ca_type=[CA_TYPE]&u_tz=[U_TZ]&u_his=[U_HIS]&u_java=[U_JAVA]&u_h=[U_H]&u_w=[U_W]&u_ah=[U_AH]&u_aw=[U_AW]&u_cd=[U_CD]&u_nplug=[U_NPLUG]&u_nmime=[U_NMIME]&p_w=[P_W]&p_h=[P_H]&c=WEB&cver=2.20231003.02.02&m_pos_ms=330200"}}, equals www.youtube.com (Youtube)
Source: chromecache_367.1.dr, chromecache_364.1.dr	String found in binary or memory: adSlotLoggingData:{serializedSlotAdServingDataEntry:"nh"}}},{adPlacementRenderer:{config:{adPlacementConfig:{kind:"AD_PLACEMENT_KIND_END",adTimeOffset:{offsetStartMilliseconds:"25",offsetEndMilliseconds:"13"},hideCueRangeMarker:!0}},renderer:{adBreakServiceRenderer:{prefetchMilliseconds:"32",getAdBreakUrl:"https://www.youtube.com/get_midroll_info?ei=l3FgBarVGsIphxLPxuRduBc&m_pos=330&token=RLJjkrMhTDF1XyVxobLOmsF6L503baqxgf8zHtyL78tfro_JRoNlfUoKtHWX2jso_GFC-H_ls4xj56iIKpT0KTxmL6pBydJcB_KTnotW1Kxo4HXObZOq6QB1pko2sTXpiLrkJms8CUEhtmyJi4JLbzgqpKLHDEPl661jo3yXCRv0JEFo_M8Kbs-NJqqhNk-CRJ_s8hTmbiMZPaPBDZtVQ-NB0zXsJDIwj2XvPAaTetL-zmXE540lFCFBTmjXZ_xJyO2NATx6lkN7RoJZL2oRwXCH1rZDjXoOvFwjXFWV9JSPwCRzajtfJUVyGROxkM6BX896KoL4rFXfYzJZBZ1QOvbMxJD4laKN5xMb5KPz5Jq54KXXO76NpvMuOlkHb5qf-k2-Z&index=2&cpn=[CPN]&lact=[LACT]&vis=[VIS]&ad_block=[AD_BLOCK]&tsla=[TSLA]&bid=[BISCOTTI_ID]&dt=[DT]&flash=[FLASH]&frm=[FRM]&ca_type=[CA_TYPE]&u_tz=[U_TZ]&u_his=[U_HIS]&u_java=[U_JAVA]&u_h=[U_H]&u_w=[U_W]&u_ah=[U_AH]&u_aw=[U_AW]&u_cd=[U_CD]&u_nplug=[U_NPLUG]&u_nmime=[U_NMIME]&p_w=[P_W]&p_h=[P_H]&c=WEB&cver=2.20231003.02.02&m_pos_ms=330200"}}, equals www.youtube.com (Youtube)

Source: chromecache_367.1.dr, chromecache_364.1.dr	String found in binary or memory: http://hammerjs.github.io/
Source: chromecache_367.1.dr	String found in binary or memory: http://i1.ytimg.com/vi/
Source: chromecache_367.1.dr, chromecache_364.1.dr	String found in binary or memory: http://mathiasbynens.be/
Source: chromecache_367.1.dr, chromecache_364.1.dr	String found in binary or memory: http://mths.be/fromcodepoint
Source: chromecache_364.1.dr	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chromecache_364.1.dr	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chromecache_364.1.dr	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chromecache_364.1.dr	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chromecache_441.1.dr, chromecache_367.1.dr, chromecache_484.1.dr, chromecache_364.1.dr	String found in binary or memory: http://tools.ietf.org/html/rfc1950
Source: chromecache_364.1.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: chromecache_367.1.dr, chromecache_364.1.dr	String found in binary or memory: http://www.broofa.com
Source: chromecache_367.1.dr	String found in binary or memory: http://www.d-project.com/
Source: chromecache_367.1.dr	String found in binary or memory: http://www.denso-wave.com/qrcode/faqpatent-e.html
Source: chromecache_441.1.dr	String found in binary or memory: http://www.google.com/support/websearch/bin/answer.py?hl=
Source: chromecache_367.1.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php
Source: chromecache_367.1.dr, chromecache_364.1.dr	String found in binary or memory: http://www.youtube.com/
Source: chromecache_364.1.dr	String found in binary or memory: http://www.youtube.com/video/
Source: chromecache_484.1.dr	String found in binary or memory: http://www.youtube.com/videoplayback
Source: chromecache_484.1.dr	String found in binary or memory: http://youtube.com/drm/2012/10/10
Source: chromecache_484.1.dr	String found in binary or memory: http://youtube.com/streaming/metadata/segment/102015
Source: chromecache_484.1.dr	String found in binary or memory: http://youtube.com/streaming/otf/durations/112015
Source: chromecache_484.1.dr	String found in binary or memory: http://youtube.com/yt/2012/10/10
Source: chromecache_367.1.dr, chromecache_364.1.dr	String found in binary or memory: https://accounts.google.com/AddSession
Source: chromecache_367.1.dr, chromecache_364.1.dr	String found in binary or memory: https://accounts.google.com/ServiceLogin
Source: chromecache_367.1.dr, chromecache_364.1.dr	String found in binary or memory: https://accounts.youtube.com/RotateCookiesPage?origin=https://www.youtube.com&yt_pid=
Source: chromecache_364.1.dr	String found in binary or memory: https://ad.doubleclick.net/ddm/trackclk/N444803.2428500DBMSITEID/B30029229.368252041;dc_trk_aid=
Source: chromecache_367.1.dr, chromecache_364.1.dr	String found in binary or memory: https://ad.doubleclick.net/ddm/trackimp/N1957659.127733GOOGLE-YOUTUBE/B29940965.366940103;dc_trk_aid
Source: chromecache_367.1.dr, chromecache_364.1.dr	String found in binary or memory: https://ad.doubleclick.net/ddm/trackimp/N444803.2428500DBMSITEID/B30029229.368252041;dc_trk_aid=
Source: chromecache_364.1.dr	String found in binary or memory: https://ade.googlesyndication.com/ddm/activity_ext/dc_pubid=
Source: chromecache_484.1.dr	String found in binary or memory: https://admin.youtube.com
Source: chromecache_349.1.dr, chromecache_276.1.dr	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/spf/2.4.0/LICENSE
Source: chromecache_367.1.dr, chromecache_484.1.dr, chromecache_364.1.dr	String found in binary or memory: https://angular.dev/license
Source: chromecache_367.1.dr, chromecache_364.1.dr	String found in binary or memory: https://angular.io/license
Source: chromecache_367.1.dr, chromecache_364.1.dr	String found in binary or memory: https://apis.google.com
Source: chromecache_367.1.dr, chromecache_364.1.dr	String found in binary or memory: https://apis.google.com/js/api.js
Source: chromecache_367.1.dr, chromecache_364.1.dr	String found in binary or memory: https://clients2.google.com/gr/gr_sync.js
Source: chromecache_484.1.dr	String found in binary or memory: https://docs.google.com/get_video_info
Source: chromecache_367.1.dr, chromecache_364.1.dr	String found in binary or memory: https://docs.google.com/picker
Source: chromecache_367.1.dr	String found in binary or memory: https://embeddedassistant-clients6.youtube.com/google.assistant.embedded.v1.EmbeddedAssistant/YTAssi
Source: chromecache_367.1.dr	String found in binary or memory: https://embeddedassistant-frontend-clients6.youtube.com/google.assistant.embedded.v1.EmbeddedAssista

Name	Source	Malicious	Reputation
https://www.google.com/get/videoqualityreport/	chromecache_364.1.dr	false	high
https://redux.js.org/tutorials/fundamentals/part-4-store#creating-a-store-with-enhancers	chromecache_367.1.dr, chromecache_484.1.dr, chromecache_364.1.dr	false	high
https://s.youtube.com/api/stats/delayplay?cl=	chromecache_367.1.dr, chromecache_364.1.dr	false	high
http://www.broofa.com	chromecache_367.1.dr, chromecache_364.1.dr	false	high
https://s.youtube.com/api/stats/atr?docid=	chromecache_367.1.dr, chromecache_364.1.dr	false	high
http://www.youtube.com/video/	chromecache_364.1.dr	false	high
https://support.google.com/youtube/answer/9706180	chromecache_367.1.dr	false	high
https://support.google.com	chromecache_367.1.dr, chromecache_364.1.dr	false	high
https://www.youtube.com/embed/	chromecache_367.1.dr, chromecache_364.1.dr	false	high
http://youtube.com/streaming/otf/durations/112015	chromecache_484.1.dr	false	high
http://polymer.github.io/AUTHORS.txt	chromecache_364.1.dr	false	high
https://www.youtube.com	chromecache_364.1.dr	false	high
https://www.google.com	chromecache_367.1.dr, chromecache_364.1.dr	false	high
https://www.youtube.com/iframe_api	chromecache_367.1.dr, chromecache_364.1.dr	false	high
http://www.denso-wave.com/qrcode/faqpatent-e.html	chromecache_367.1.dr	false	high
https://www.google.com/get/videoqualityreport/?v=	chromecache_364.1.dr	false	high
https://www.youtube.com/api/timedtext?v=	chromecache_364.1.dr	false	high
http://www.opensource.org/licenses/mit-license.php	chromecache_367.1.dr	false	high
https://admin.youtube.com	chromecache_484.1.dr	false	high
https://www.youtube.com/api/drm/fps?ek=	chromecache_484.1.dr	false	high
https://redux.js.org/tutorials/fundamentals/part-4-store#middleware	chromecache_367.1.dr, chromecache_484.1.dr, chromecache_364.1.dr	false	high
https://s.youtube.com	chromecache_367.1.dr, chromecache_364.1.dr	false	high
https://i.ytimg.com/an/	chromecache_367.1.dr, chromecache_364.1.dr	false	high
https://www.youtube.com/api/stats/ads?ver=	chromecache_364.1.dr	false	high
https://yt3.ggpht.com/ytc/	chromecache_364.1.dr	false	high
https://github.com/madler/zlib/blob/master/zlib.h	chromecache_441.1.dr, chromecache_367.1.dr, chromecache_484.1.dr, chromecache_364.1.dr	false	high
https://yurt.corp.google.com	chromecache_484.1.dr	false	high
https://myaccount-autopush.corp.google.com	chromecache_367.1.dr	false	high
https://viacon.corp.google.com	chromecache_484.1.dr	false	high
https://www.google.com/tools/feedback	chromecache_367.1.dr, chromecache_364.1.dr	false	high
https://www.youtube.com/youtubei/v1/player?key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8&prettyPrint=f	chromecache_367.1.dr, chromecache_364.1.dr	false	high
https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p	chromecache_367.1.dr, chromecache_364.1.dr	false	high
https://www.youtube.com/pagead/interaction/?ai=C	chromecache_364.1.dr	false	high
https://ad.doubleclick.net/ddm/trackimp/N1957659.127733GOOGLE-YOUTUBE/B29940965.366940103;dc_trk_aid	chromecache_367.1.dr, chromecache_364.1.dr	false	high
https://www.youtube.com/generate_204?cpn=	chromecache_484.1.dr	false	high
https://www.google.com/recaptcha/api.js?trustedtypes=true	chromecache_367.1.dr	false	high
https://apis.google.com/js/api.js	chromecache_367.1.dr, chromecache_364.1.dr	false	high
http://polymer.github.io/PATENTS.txt	chromecache_364.1.dr	false	high
https://s.youtube.com/api/stats/qoe?cl=	chromecache_367.1.dr, chromecache_364.1.dr	false	high
https://docs.google.com/picker	chromecache_367.1.dr, chromecache_364.1.dr	false	high

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.185.206	youtube.ch	United States	15169	GOOGLEUS	false
216.58.206.78	play.google.com	United States	15169	GOOGLEUS	false
142.250.186.110	youtube.com	United States	15169	GOOGLEUS	false
142.250.186.70	static.doubleclick.net	United States	15169	GOOGLEUS	false
74.125.110.105	rr4.sn-4g5ednsr.googlevideo.com	United States	15169	GOOGLEUS	false
142.250.184.228	unknown	United States	15169	GOOGLEUS	false
142.250.185.66	unknown	United States	15169	GOOGLEUS	false
216.58.206.68	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.186.164	unknown	United States	15169	GOOGLEUS	false
172.217.16.194	googleads.g.doubleclick.net	United States	15169	GOOGLEUS	false
142.250.186.166	unknown	United States	15169	GOOGLEUS	false
142.250.186.86	i.ytimg.com	United States	15169	GOOGLEUS	false

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1592382
Start date and time:	2025-01-16 02:37:34 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 21s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://youtube.ch/new/view/g975fkji44fp3w6chof83b9u/fsn@cbmaterialhandling.com
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	SUS
Classification:	sus21.win@22/425@30/14
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Input	Output
URL: https://youtube.ch Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": true, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": true, "third_party_hosting": true, "reasoning": "This appears to be an attempt to spoof YouTube. The legitimate YouTube domain uses .com, not .ch (Switzerland). While .ch is a valid TLD, it's suspicious when used with a major brand like YouTube that primarily uses .com" }
URL: https://youtube.ch
URL: https://www.gstatic.com/cv/js/sender/v1/cast_sende... Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "The provided JavaScript snippet appears to be a legitimate script that loads the Google Cast SDK for Chrome. It checks the user's browser version, loads the necessary scripts from trusted Google domains, and handles the availability of the Cast API. The script does not exhibit any high-risk behaviors, such as dynamic code execution, data exfiltration, or obfuscation. The script's purpose is to enable Google Cast functionality, which is a common and expected behavior for Chrome users. Overall, this script poses a low risk and is likely part of a legitimate application or extension." }
(function(){/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ 'use strict';var l=function(){var a=h,b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}},m=this\|\|self,n=/^[\w+/_-]+[=]{0,2}$/,p=null,q=function(a){return(a=a.querySelector&&a.querySelector("script[nonce]"))&&(a=a.nonce\|\|a.getAttribute("nonce"))&&n.test(a)?a:""},r=function(a,b){function e(){}e.prototype=b.prototype;a.i=b.prototype;a.prototype=new e;a.prototype.constructor=a;a.h=function(c,g,k){for(var f=Array(arguments.length-2),d=2;d<arguments.length;d++)f[d-2]=arguments[d]; return b.prototype[g].apply(c,f)}},t=function(a){return a};function u(a){if(Error.captureStackTrace)Error.captureStackTrace(this,u);else{var b=Error().stack;b&&(this.stack=b)}a&&(this.message=String(a))}r(u,Error);u.prototype.name="CustomError";var v=function(a,b){a=a.split("%s");for(var e="",c=a.length-1,g=0;g<c;g++)e+=a[g]+(g<b.length?b[g]:"%s");u.call(this,e+a[c])};r(v,u);v.prototype.name="AssertionError";var w=function(a,b){throw new v("Failure"+(a?": "+a:""),Array.prototype.slice.call(arguments,1));};var x;var A=function(a,b){this.g=b===z?a:""};A.prototype.toString=function(){return this.g+""};var z={};var B=function(){var a=window.navigator.userAgent.match(/Chrome\/([0-9]+)/);return a?parseInt(a[1],10):0},C=function(a){return!!document.currentScript&&(-1!=document.currentScript.src.indexOf("?"+a)\|\|-1!=document.currentScript.src.indexOf("&"+a))},D=function(){return"function"==typeof window.__onGCastApiAvailable?window.__onGCastApiAvailable:null},F=function(a){a.length?E(a.shift(),function(){F(a)}):G()},H=function(a){return"chrome-extension://"+a+"/cast_sender.js"},E=function(a,b,e){var c=document.createElement("script"); c.onerror=b;e&&(c.onload=e);if(void 0===x)if(b=null,(e=m.trustedTypes)&&e.createPolicy){try{b=e.createPolicy("goog#html",{createHTML:t,createScript:t,createScriptURL:t})}catch(y){m.console&&m.console.error(y.message)}x=b}else x=b;a=(b=x)?b.createScriptURL(a):a;a=new A(a,z);a:{try{var g=c&&c.ownerDocument,k=g&&(g.defaultView\|\|g.parentWindow);k=k\|\|m;if(k.Element&&k.Location){var f=k;break a}}catch(y){}f=null}if(f&&"undefined"!=typeof f.HTMLScriptElement&&(!c\|\|!(c instanceof f.HTMLScriptElement)&&(c instanceof f.Location\|\|c instanceof f.Element))){f=typeof c;if("object"==f&&null!=c\|\|"function"==f)try{var d=c.constructor.displayName\|\|c.constructor.name\|\|Object.prototype.toString.call(c)}catch(y){d="<object could not be stringified>"}else d=void 0===c?"undefined":null===c?"null":typeof c;w("Argument is not a %s (or a non-Element, non-Location mock); got: %s","HTMLScriptElement",d)}a instanceof A&&a.constructor===A?d=a.g:(d=typeof a,w("expected object of type TrustedResourceUrl, got '"+a+"' of type "+("object"!= d?d:a?Array.isArray(a)?"array":d:"null")),d="type_error:TrustedResourceUrl");c.src=d;(d=c.ownerDocument&&c.ownerDocument.defaultView)&&d!=m?d=q(d.document):(null===p&&(p=q(m.document)),d=p);d&&c.setAttribute("nonce",d);(document.head\|\|document.documentElement).appendChild(c)},I=function(){var a=B(),b=[];if(1<a){var e=a-1;b.push("//www.gstatic.com/eureka/clank/"+a+"/cast_sender.js");b.push("//www.gstatic.com/eureka/clank/"+e+"/cast_sender.js")}return b},G=function(){var a=D();a&&a(!1,"No cast extension found")}, K=function(){if(J){var a=2,b=D(),e=function(){a--;0==a&&b&&b(!0)};window.__onGCastApiAvailable=e;E("//www.gstatic.com/cast/sdk/libs/sender/1.0/cast_framework.js",G,e)}},J=C("loadCastFramework")\|\|C("loadCastApplicationFramework"),L=["pkedcjkdefgpdelpbcmbmeomcjbeemfm","enhhojjnijigcajfphajepfemndkmdlo"];if(0<=window.navigator.userAgent.indexOf("Android")&&0<=window.navigator.userAgent.indexOf("Chrome/")&&window.navigator.presentation){if(60<=B()){K();var M=I();M.push("//www.gstatic.com/eureka/clank/cast_sender.js");F(M)}}else if(!window.chrome\|\|!window.navigator.presentation\|\|0<=window.navigator.userAgent.indexOf("Edge"))G();else if(89<=B()){K();var N=I(),O=N.push,P=O.apply,h=L.map(H),Q;if(h instanceof Array)Q=h;e
URL: https://www.youtube.com/new Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Sign in to try new features", "prominent_button_name": "Sign in", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://www.youtube.com/new Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Sign in to try new features", "prominent_button_name": "Sign in", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://www.youtube.com/new Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: https://www.youtube.com/new Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Sign in to try new features", "prominent_button_name": "Sign in", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://www.youtube.com/new Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: https://www.youtube.com/new Model: Joe Sandbox AI	{ "brands": [ "YouTube" ] }
	{ "brands": [ "YouTube" ] }

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Jan 16 00:38:14 2025, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.995512147538542
Encrypted:	false
SSDEEP:	48:8HsdDTM79PA8HUidAKZdA1JehwiZUklqehly+3:8HgOPE+y
MD5:	879EB141B370E5D6D464EDF8732D0262
SHA1:	F5F3D58B9218192A2A1DC822CEA67EF823E8EBBD
SHA-256:	758AB2D632F15C0B9C463E56DB345FF416ECD8DE98D312A34BA452F7BCEE4ACD
SHA-512:	0EC59F4B28B823F158B785FDDC50480A4B2AD0BAB282C583B27BA6567ABE5DAA1F827B044410EA3721BE94CB7A81FF84622A10CCC5A2D712CDF72CA25BF33AC6
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....M.O.g......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I0Z......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V0Z......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V0Z......M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V0Z.............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V0Z.............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........3{U\|.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 16, 2025 02:38:13.842633009 CET	53	56909	1.1.1.1	192.168.2.17
Jan 16, 2025 02:38:13.950526953 CET	53	64654	1.1.1.1	192.168.2.17
Jan 16, 2025 02:38:14.687093973 CET	53792	53	192.168.2.17	1.1.1.1
Jan 16, 2025 02:38:14.687222958 CET	52318	53	192.168.2.17	1.1.1.1
Jan 16, 2025 02:38:14.695880890 CET	53	52318	1.1.1.1	192.168.2.17
Jan 16, 2025 02:38:14.722014904 CET	53	53792	1.1.1.1	192.168.2.17
Jan 16, 2025 02:38:14.916502953 CET	53	64702	1.1.1.1	192.168.2.17
Jan 16, 2025 02:38:15.732148886 CET	59279	53	192.168.2.17	1.1.1.1
Jan 16, 2025 02:38:15.732476950 CET	50217	53	192.168.2.17	1.1.1.1
Jan 16, 2025 02:38:15.738830090 CET	53	59279	1.1.1.1	192.168.2.17
Jan 16, 2025 02:38:15.739769936 CET	53	50217	1.1.1.1	192.168.2.17
Jan 16, 2025 02:38:16.814292908 CET	52872	53	192.168.2.17	1.1.1.1
Jan 16, 2025 02:38:16.814538002 CET	58665	53	192.168.2.17	1.1.1.1
Jan 16, 2025 02:38:16.821238995 CET	53	52872	1.1.1.1	192.168.2.17
Jan 16, 2025 02:38:16.821270943 CET	53	58665	1.1.1.1	192.168.2.17
Jan 16, 2025 02:38:17.288075924 CET	53	51736	1.1.1.1	192.168.2.17
Jan 16, 2025 02:38:18.438754082 CET	57683	53	192.168.2.17	1.1.1.1
Jan 16, 2025 02:38:18.439059973 CET	51199	53	192.168.2.17	1.1.1.1
Jan 16, 2025 02:38:18.445599079 CET	53	57683	1.1.1.1	192.168.2.17
Jan 16, 2025 02:38:18.445733070 CET	53	51199	1.1.1.1	192.168.2.17
Jan 16, 2025 02:38:18.588241100 CET	51018	53	192.168.2.17	1.1.1.1
Jan 16, 2025 02:38:18.588447094 CET	60506	53	192.168.2.17	1.1.1.1
Jan 16, 2025 02:38:18.595047951 CET	53	51018	1.1.1.1	192.168.2.17
Jan 16, 2025 02:38:18.595630884 CET	53	60506	1.1.1.1	192.168.2.17
Jan 16, 2025 02:38:20.009444952 CET	53	60463	1.1.1.1	192.168.2.17
Jan 16, 2025 02:38:24.507672071 CET	61589	53	192.168.2.17	1.1.1.1
Jan 16, 2025 02:38:24.507826090 CET	55985	53	192.168.2.17	1.1.1.1
Jan 16, 2025 02:38:24.515330076 CET	53	61589	1.1.1.1	192.168.2.17
Jan 16, 2025 02:38:24.515719891 CET	53	55985	1.1.1.1	192.168.2.17
Jan 16, 2025 02:38:24.777934074 CET	61474	53	192.168.2.17	1.1.1.1
Jan 16, 2025 02:38:24.778059006 CET	62623	53	192.168.2.17	1.1.1.1
Jan 16, 2025 02:38:24.784970045 CET	53	61474	1.1.1.1	192.168.2.17
Jan 16, 2025 02:38:24.785188913 CET	53	62623	1.1.1.1	192.168.2.17
Jan 16, 2025 02:38:24.793663025 CET	53	63274	1.1.1.1	192.168.2.17
Jan 16, 2025 02:38:24.821556091 CET	54717	53	192.168.2.17	1.1.1.1
Jan 16, 2025 02:38:24.821881056 CET	49931	53	192.168.2.17	1.1.1.1
Jan 16, 2025 02:38:24.828166962 CET	53	54717	1.1.1.1	192.168.2.17
Jan 16, 2025 02:38:24.828799963 CET	53	49931	1.1.1.1	192.168.2.17
Jan 16, 2025 02:38:24.954087019 CET	53	54060	1.1.1.1	192.168.2.17
Jan 16, 2025 02:38:25.894465923 CET	53	55159	1.1.1.1	192.168.2.17
Jan 16, 2025 02:38:26.363758087 CET	50190	53	192.168.2.17	1.1.1.1
Jan 16, 2025 02:38:26.363945961 CET	54715	53	192.168.2.17	1.1.1.1
Jan 16, 2025 02:38:26.371757030 CET	53	50190	1.1.1.1	192.168.2.17
Jan 16, 2025 02:38:26.372140884 CET	53	54715	1.1.1.1	192.168.2.17
Jan 16, 2025 02:38:26.446038008 CET	55720	53	192.168.2.17	1.1.1.1
Jan 16, 2025 02:38:26.446141958 CET	53689	53	192.168.2.17	1.1.1.1
Jan 16, 2025 02:38:26.452615976 CET	53	53689	1.1.1.1	192.168.2.17
Jan 16, 2025 02:38:26.452673912 CET	53	55720	1.1.1.1	192.168.2.17
Jan 16, 2025 02:38:27.496699095 CET	55078	53	192.168.2.17	1.1.1.1
Jan 16, 2025 02:38:27.496835947 CET	50719	53	192.168.2.17	1.1.1.1
Jan 16, 2025 02:38:27.532970905 CET	53	55078	1.1.1.1	192.168.2.17
Jan 16, 2025 02:38:27.533000946 CET	53	50719	1.1.1.1	192.168.2.17
Jan 16, 2025 02:38:27.685956955 CET	53441	53	192.168.2.17	1.1.1.1
Jan 16, 2025 02:38:27.686110973 CET	57073	53	192.168.2.17	1.1.1.1
Jan 16, 2025 02:38:27.692483902 CET	53	53441	1.1.1.1	192.168.2.17
Jan 16, 2025 02:38:27.693023920 CET	53	57073	1.1.1.1	192.168.2.17
Jan 16, 2025 02:38:29.715394974 CET	57325	53	192.168.2.17	1.1.1.1
Jan 16, 2025 02:38:29.715521097 CET	61853	53	192.168.2.17	1.1.1.1
Jan 16, 2025 02:38:29.722358942 CET	53	57325	1.1.1.1	192.168.2.17
Jan 16, 2025 02:38:29.722423077 CET	53	61853	1.1.1.1	192.168.2.17
Jan 16, 2025 02:38:31.776904106 CET	53	59182	1.1.1.1	192.168.2.17
Jan 16, 2025 02:38:31.963896990 CET	53	62050	1.1.1.1	192.168.2.17
Jan 16, 2025 02:38:33.879682064 CET	53	59475	1.1.1.1	192.168.2.17
Jan 16, 2025 02:38:38.563272953 CET	56291	53	192.168.2.17	1.1.1.1
Jan 16, 2025 02:38:38.563441992 CET	52222	53	192.168.2.17	1.1.1.1
Jan 16, 2025 02:38:38.569937944 CET	53	56291	1.1.1.1	192.168.2.17
Jan 16, 2025 02:38:38.571918964 CET	53	52222	1.1.1.1	192.168.2.17
Jan 16, 2025 02:38:39.498676062 CET	57307	53	192.168.2.17	1.1.1.1
Jan 16, 2025 02:38:39.498949051 CET	65119	53	192.168.2.17	1.1.1.1
Jan 16, 2025 02:38:39.505696058 CET	53	57307	1.1.1.1	192.168.2.17
Jan 16, 2025 02:38:39.506127119 CET	53	65119	1.1.1.1	192.168.2.17
Jan 16, 2025 02:38:50.662817001 CET	53	52578	1.1.1.1	192.168.2.17
Jan 16, 2025 02:39:13.114264965 CET	53	55659	1.1.1.1	192.168.2.17
Jan 16, 2025 02:39:13.819097042 CET	53	54037	1.1.1.1	192.168.2.17

Timestamp	Bytes transferred	Direction	Data
2025-01-16 01:38:15 UTC	878	OUT	GET /new/view/g975fkji44fp3w6chof83b9u/fsn@cbmaterialhandling.com HTTP/1.1 Host: youtube.ch Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-16 01:38:15 UTC	1374	IN	HTTP/1.1 301 Moved Permanently Content-Type: application/binary X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 16 Jan 2025 01:38:15 GMT Location: https://www.youtube.com/new/view/g975fkji44fp3w6chof83b9u/fsn@cbmaterialhandling.com?gl=CH X-Frame-Options: SAMEORIGIN Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Report-To: {"group":"youtube_reporting_fallback","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_reporting_fallback"}]} Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube_reporting_fallback" Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2025-01-16 01:38:17 UTC	979	OUT	GET /generate_204 HTTP/1.1 Host: i.ytimg.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.149" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.youtube.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-16 01:38:17 UTC	203	IN	HTTP/1.1 204 No Content Content-Length: 0 Cross-Origin-Resource-Policy: cross-origin Date: Thu, 16 Jan 2025 01:38:17 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2025-01-16 01:38:25 UTC	1022	OUT	GET /pagead/id HTTP/1.1 Host: googleads.g.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.149" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.youtube.com X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.youtube.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-16 01:38:25 UTC	766	IN	HTTP/1.1 302 Found P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Location: https://googleads.g.doubleclick.net/pagead/id?slf_rd=1 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://www.youtube.com Date: Thu, 16 Jan 2025 01:38:25 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2025-01-16 01:38:25 UTC	1947	OUT	GET /videoplayback?expire=5943855052&ei=JaYa-6zqWTDKxW_0vJxbDGj&ip=37.85.20.37&id=o-AFpUhtajUUTDjKGbOcctaANpoHKhJfbmNxODnUPiRrglR&itag=18&source=youtube&requiressl=yes&mh=X6&mm=209%2C49524%2C50253&mn=NXIW1%2Cochfn%2C6sQXz&ms=NXIW1%2Cochfn%2C6sQXz&mv=5&mvi=1&pl=30&ctier=L&initcwndbps=2019756&siu=1&spc=jlYybwU1CSyDd-VUUucWPgpryq8jzOw1-UmUMSuAyqRb&vprv=1&svpuc=1&mime=video%2Fmp4&ns=4tHGjq6I33kIAbJ8V4IHNcoa&cnr=30&ratebypass=yes&dur=91494198&lmt=0423660780982064&mt=5943855052&fvip=3&c=WEB&txp=2019756&n=kisiJQOqv3mpY-5j&sparams=expire%2Cei%2Cip%2Cid%2Citag%2Csource%2Crequiressl%2Csiu%2Cspc%2Cvprv%2Csvpuc%2Cmime%2Cns%2Ccnr%2Cratebypass%2Cdur%2Clmt&sig=9YVCDgl6bJgsJOR80oTUZ4VltivMCEp-aFu6cSarkw0jkEr76VDDBPzJK2-koAIOH69W4eev1vyU2TQXFjns2Ia2LF3ujOiuCJbnObmH77qf&lsparams=mh%2Cmm%2Cmn%2Cms%2Cmv%2Cmvi%2Cpl%2Cinitcwndbps&lsig=9YVCDgl6bJgsJOR80oTUZ4VltivMCEp-aFu6cSarkw0jkEr76VDDBPzJK2-koAIOH69W4eev1vyU2TQXFjns2Ia2LF3ujOiuCJbnObmH77qf HTTP/1.1 Host: rr4---sn-4g5ednsr.googlevideo.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.149" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.youtube.com X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.youtube.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-16 01:38:25 UTC	785	IN	HTTP/1.1 403 Forbidden Last-Modified: Wed, 02 May 2007 10:26:10 GMT Content-Type: text/plain Content-Length: 0 Connection: close Access-Control-Allow-Origin: https://www.youtube.com Access-Control-Allow-Credentials: true Timing-Allow-Origin: https://www.youtube.com Access-Control-Expose-Headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms Vary: Origin Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff Date: Thu, 16 Jan 2025 01:38:25 GMT Server: gvs 1.0

Timestamp	Bytes transferred	Direction	Data
2025-01-16 01:38:25 UTC	1939	OUT	GET /videoplayback?expire=5943855052&ei=JaYa-6zqWTDKxW_0vJxbDGj&ip=37.85.20.37&id=o-AFpUhtajUUTDjKGbOcctaANpoHKhJfbmNxODnUPiRrglR&itag=18&source=youtube&requiressl=yes&mh=X6&mm=209%2C49524%2C50253&mn=NXIW1%2Cochfn%2C6sQXz&ms=NXIW1%2Cochfn%2C6sQXz&mv=5&mvi=1&pl=30&initcwndbps=2019756&siu=1&spc=jlYybwU1CSyDd-VUUucWPgpryq8jzOw1-UmUMSuAyqRb&vprv=1&svpuc=1&mime=video%2Fmp4&ns=4tHGjq6I33kIAbJ8V4IHNcoa&cnr=30&ratebypass=yes&dur=91494198&lmt=0423660780982064&mt=5943855052&fvip=3&c=WEB&txp=2019756&n=kisiJQOqv3mpY-5j&sparams=expire%2Cei%2Cip%2Cid%2Citag%2Csource%2Crequiressl%2Csiu%2Cspc%2Cvprv%2Csvpuc%2Cmime%2Cns%2Ccnr%2Cratebypass%2Cdur%2Clmt&sig=9YVCDgl6bJgsJOR80oTUZ4VltivMCEp-aFu6cSarkw0jkEr76VDDBPzJK2-koAIOH69W4eev1vyU2TQXFjns2Ia2LF3ujOiuCJbnObmH77qf&lsparams=mh%2Cmm%2Cmn%2Cms%2Cmv%2Cmvi%2Cpl%2Cinitcwndbps&lsig=9YVCDgl6bJgsJOR80oTUZ4VltivMCEp-aFu6cSarkw0jkEr76VDDBPzJK2-koAIOH69W4eev1vyU2TQXFjns2Ia2LF3ujOiuCJbnObmH77qf HTTP/1.1 Host: rr4---sn-4g5ednsr.googlevideo.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.149" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.youtube.com X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.youtube.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-16 01:38:25 UTC	785	IN	HTTP/1.1 403 Forbidden Last-Modified: Wed, 02 May 2007 10:26:10 GMT Content-Type: text/plain Content-Length: 0 Connection: close Access-Control-Allow-Origin: https://www.youtube.com Access-Control-Allow-Credentials: true Timing-Allow-Origin: https://www.youtube.com Access-Control-Expose-Headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms Vary: Origin Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff Date: Thu, 16 Jan 2025 01:38:25 GMT Server: gvs 1.0

Timestamp	Bytes transferred	Direction	Data
2025-01-16 01:38:25 UTC	1039	OUT	GET / HTTP/1.1 Host: youtube.com Connection: keep-alive Pragma: no-cache Cache-Control: no-cache sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.149" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.youtube.com X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.youtube.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-16 01:38:25 UTC	1724	IN	HTTP/1.1 301 Moved Permanently Content-Type: application/binary X-Content-Type-Options: nosniff Expires: Thu, 16 Jan 2025 01:38:25 GMT Date: Thu, 16 Jan 2025 01:38:25 GMT Cache-Control: private, max-age=31536000 Location: https://www.youtube.com/ Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Frame-Options: SAMEORIGIN Access-Control-Allow-Origin: https://www.youtube.com Access-Control-Allow-Credentials: true Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script' Origin-Trial: AmhMBR6zCLzDDxpW+HfpP67BqwIknWnyMOXOQGfzYswFmJe+fgaI6XZgAzcxOrzNtP7hEDsOo1jdjFnVr2IdxQ4AAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTc1ODA2NzE5OSwiaXNTdWJkb21haW4iOnRydWV9 Report-To: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]} Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="youtube_main" Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://youtube.ch/new/view/g975fkji44fp3w6chof83b9u/fsn@cbmaterialhandling.com

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Software Vulnerabilities

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 266

Chrome Cache Entry: 267

Chrome Cache Entry: 268

Chrome Cache Entry: 269

Chrome Cache Entry: 270

Chrome Cache Entry: 271

Chrome Cache Entry: 272

Chrome Cache Entry: 273

Chrome Cache Entry: 274

Chrome Cache Entry: 275

Chrome Cache Entry: 276

Chrome Cache Entry: 277

Chrome Cache Entry: 278

Chrome Cache Entry: 279

Chrome Cache Entry: 280

Chrome Cache Entry: 281

Chrome Cache Entry: 282

Chrome Cache Entry: 283

Chrome Cache Entry: 284

Chrome Cache Entry: 285

Chrome Cache Entry: 286

Windows Analysis Report
https://youtube.ch/new/view/g975fkji44fp3w6chof83b9u/fsn@cbmaterialhandling.com

Timestamp	Bytes transferred	Direction	Data
2025-01-16 01:38:26 UTC	1031	OUT	GET /pagead/id?slf_rd=1 HTTP/1.1 Host: googleads.g.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.149" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.youtube.com X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.youtube.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-16 01:38:26 UTC	808	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://www.youtube.com Content-Type: application/json; charset=UTF-8 Date: Thu, 16 Jan 2025 01:38:26 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="f.txt" Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-01-16 01:38:26 UTC	106	IN	Data Raw: 36 34 0d 0a 29 5d 7d 27 0a 0a 7b 22 69 64 22 3a 22 41 4e 79 50 78 4b 6f 32 6c 73 37 73 45 5a 5a 6a 47 43 46 64 34 6c 52 38 35 42 46 56 48 79 6a 55 30 45 54 33 47 62 46 78 4b 59 46 74 51 34 59 73 30 33 56 35 5a 51 6f 37 76 38 71 45 59 54 4f 6e 58 56 78 58 36 4c 59 52 57 55 62 61 22 2c 22 74 79 70 65 22 3a 34 7d 0d 0a Data Ascii: 64)]}'{"id":"ANyPxKo2ls7sEZZjGCFd4lR85BFVHyjU0ET3GbFxKYFtQ4Ys03V5ZQo7v8qEYTOnXVxX6LYRWUba","type":4}
2025-01-16 01:38:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-01-16 01:38:27 UTC	466	OUT	GET /pagead/id?slf_rd=1 HTTP/1.1 Host: googleads.g.doubleclick.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCLnKzQEIitPNAQjB1M0BCLrYzQEY9snNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-16 01:38:27 UTC	754	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Content-Type: application/json; charset=UTF-8 Date: Thu, 16 Jan 2025 01:38:27 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="f.txt" Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-01-16 01:38:27 UTC	106	IN	Data Raw: 36 34 0d 0a 29 5d 7d 27 0a 0a 7b 22 69 64 22 3a 22 41 4e 79 50 78 4b 72 52 69 34 6f 32 68 62 73 69 41 72 4c 6b 36 33 41 75 51 46 58 52 30 35 31 4e 6a 44 49 7a 54 6f 55 67 48 4e 79 53 4c 57 4a 32 35 49 4f 4d 74 58 44 47 31 58 31 46 79 73 71 67 54 59 49 70 73 62 6d 6e 47 45 46 32 22 2c 22 74 79 70 65 22 3a 34 7d 0d 0a Data Ascii: 64)]}'{"id":"ANyPxKrRi4o2hbsiArLk63AuQFXR051NjDIzToUgHNySLWJ25IOMtXDG1X1FysqgTYIpsbmnGEF2","type":4}
2025-01-16 01:38:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-01-16 01:38:27 UTC	1023	OUT	GET /js/th/8IiC491fkZiDnwU-R_SjAMw8X6DEePP7W74TtAWlHNA.js HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.149" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.youtube.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-16 01:38:27 UTC	812	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="botguard-scs" Report-To: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]} Content-Length: 55114 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Tue, 14 Jan 2025 12:43:09 GMT Expires: Wed, 14 Jan 2026 12:43:09 GMT Cache-Control: public, max-age=31536000 Last-Modified: Mon, 30 Dec 2024 11:30:00 GMT Content-Type: text/javascript Vary: Accept-Encoding Age: 132918 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-01-16 01:38:27 UTC	578	IN	Data Raw: 2f 2f 23 20 73 6f 75 72 63 65 4d 61 70 70 69 6e 67 55 52 4c 3d 64 61 74 61 3a 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3b 62 61 73 65 36 34 2c 65 79 4a 32 5a 58 4a 7a 61 57 39 75 49 6a 6f 67 4d 79 77 69 63 32 39 31 63 6d 4e 6c 63 79 49 36 57 79 49 69 58 53 77 69 63 32 39 31 63 6d 4e 6c 63 30 4e 76 62 6e 52 6c 62 6e 51 69 4f 6c 73 69 49 43 4a 64 4c 43 4a 75 59 57 31 6c 63 79 49 36 57 79 4a 6a 62 47 39 7a 64 58 4a 6c 52 48 6c 75 59 57 31 70 59 30 4a 31 64 48 52 76 62 69 4a 64 4c 43 4a 74 59 58 42 77 61 57 35 6e 63 79 49 36 49 6b 46 42 51 55 45 37 51 55 46 42 51 54 74 42 51 55 46 42 4f 30 46 42 51 55 45 37 51 55 46 42 51 54 74 42 51 55 46 42 4f 30 46 42 51 55 45 69 66 51 3d 3d 0a 28 66 75 6e 63 74 69 6f 6e 28 Data Ascii: //# sourceMappingURL=data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjogMywic291cmNlcyI6WyIiXSwic291cmNlc0NvbnRlbnQiOlsiICJdLCJuYW1lcyI6WyJjbG9zdXJlRHluYW1pY0J1dHRvbiJdLCJtYXBwaW5ncyI6IkFBQUE7QUFBQTtBQUFBO0FBQUE7QUFBQTtBQUFBO0FBQUEifQ==(function(
2025-01-16 01:38:27 UTC	1390	IN	Data Raw: 72 65 61 74 65 50 6f 6c 69 63 79 3f 38 36 3a 61 3a 6e 3d 3d 37 35 3f 28 55 3d 42 2e 74 72 75 73 74 65 64 54 79 70 65 73 2c 49 3d 58 2c 6e 3d 38 32 29 3a 6e 3d 3d 36 36 26 26 28 6e 3d 42 2e 63 6f 6e 73 6f 6c 65 3f 63 3a 36 34 29 7d 7d 7d 63 61 74 63 68 28 79 29 7b 69 66 28 53 3d 3d 39 32 29 74 68 72 6f 77 20 79 3b 53 3d 3d 6c 26 26 28 77 3d 79 2c 6e 3d 6c 29 7d 7d 2c 78 3d 66 75 6e 63 74 69 6f 6e 28 71 29 7b 72 65 74 75 72 6e 20 50 2e 63 61 6c 6c 28 74 68 69 73 2c 71 29 7d 3b 28 30 2c 65 76 61 6c 29 28 66 75 6e 63 74 69 6f 6e 28 71 2c 6c 29 7b 72 65 74 75 72 6e 28 6c 3d 74 28 39 31 2c 36 33 2c 38 38 2c 33 39 2c 22 65 72 72 6f 72 22 2c 22 61 64 22 2c 6e 75 6c 6c 29 29 26 26 71 2e 65 76 61 6c 28 6c 2e 63 72 65 61 74 65 53 63 72 69 70 74 28 22 31 22 29 29 3d Data Ascii: reatePolicy?86:a:n==75?(U=B.trustedTypes,I=X,n=82):n==66&&(n=B.console?c:64)}}}catch(y){if(S==92)throw y;S==l&&(w=y,n=l)}},x=function(q){return P.call(this,q)};(0,eval)(function(q,l){return(l=t(91,63,88,39,"error","ad",null))&&q.eval(l.createScript("1"))=
2025-01-16 01:38:27 UTC	1390	IN	Data Raw: 73 65 20 69 66 28 79 3d 3d 36 39 29 79 3d 53 26 26 53 2e 6f 6e 63 65 3f 32 30 3a 36 33 3b 65 6c 73 65 20 69 66 28 79 3d 3d 31 39 29 79 3d 55 3c 50 2e 6c 65 6e 67 74 68 3f 34 35 3a 38 35 3b 65 6c 73 65 7b 69 66 28 79 3d 3d 38 35 29 72 65 74 75 72 6e 20 46 3b 79 3d 3d 37 33 3f 28 49 3d 24 4b 28 34 34 2c 39 2c 49 29 2c 77 26 26 77 5b 71 4a 5d 3f 77 2e 6f 2e 61 64 64 28 53 74 72 69 6e 67 28 50 29 2c 49 2c 61 2c 4c 28 53 2c 32 35 2c 6e 75 6c 6c 29 3f 21 21 53 2e 63 61 70 74 75 72 65 3a 21 21 53 2c 42 29 3a 53 57 28 6e 75 6c 6c 2c 31 38 2c 66 61 6c 73 65 2c 53 2c 42 2c 61 2c 50 2c 77 2c 49 29 2c 79 3d 38 35 29 3a 79 3d 3d 36 33 3f 79 3d 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 50 29 3f 37 35 3a 37 33 3a 79 3d 3d 37 35 3f 28 55 3d 30 2c 79 3d 38 37 29 3a 79 3d Data Ascii: se if(y==69)y=S&&S.once?20:63;else if(y==19)y=U<P.length?45:85;else{if(y==85)return F;y==73?(I=$K(44,9,I),w&&w[qJ]?w.o.add(String(P),I,a,L(S,25,null)?!!S.capture:!!S,B):SW(null,18,false,S,B,a,P,w,I),y=85):y==63?y=Array.isArray(P)?75:73:y==75?(U=0,y=87):y=
2025-01-16 01:38:27 UTC	1390	IN	Data Raw: 3d 35 34 29 63 3d 50 26 26 42 2e 75 3f 39 36 3a 32 33 3b 65 6c 73 65 7b 69 66 28 63 3d 3d 32 32 29 72 65 74 75 72 6e 20 78 3b 69 66 28 63 3d 3d 39 35 29 7b 69 66 28 28 50 2e 4b 3d 28 28 50 2e 73 2b 3d 28 46 3d 28 77 3d 28 62 3d 28 61 7c 7c 50 2e 7a 43 2b 2b 2c 50 2e 42 42 29 3e 30 26 26 50 2e 41 49 26 26 50 2e 55 66 26 26 50 2e 52 76 3c 3d 31 26 26 21 50 2e 4e 26 26 21 50 2e 75 26 26 28 21 61 7c 7c 50 2e 49 4c 2d 71 3e 31 29 26 26 64 6f 63 75 6d 65 6e 74 2e 68 69 64 64 65 6e 3d 3d 30 2c 28 49 3d 50 2e 7a 43 3d 3d 34 29 7c 7c 62 29 3f 50 2e 67 28 29 3a 50 2e 56 5a 2c 77 2d 50 2e 56 5a 29 2c 46 3e 3e 31 34 3e 30 29 2c 50 2e 41 29 26 26 28 50 2e 41 3d 28 79 3d 50 2e 41 2c 55 3d 28 50 2e 73 2b 31 3e 3e 32 29 2a 28 46 3c 3c 32 29 2c 32 2a 28 7e 79 26 55 29 2b Data Ascii: =54)c=P&&B.u?96:23;else{if(c==22)return x;if(c==95){if((P.K=((P.s+=(F=(w=(b=(a\|\|P.zC++,P.BB)>0&&P.AI&&P.Uf&&P.Rv<=1&&!P.N&&!P.u&&(!a\|\|P.IL-q>1)&&document.hidden==0,(I=P.zC==4)\|\|b)?P.g():P.VZ,w-P.VZ),F>>14>0),P.A)&&(P.A=(y=P.A,U=(P.s+1>>2)(F<<2),2(~y&U)+
2025-01-16 01:38:27 UTC	1390	IN	Data Raw: 66 6f 72 28 55 3d 37 35 3b 55 21 3d 38 35 3b 29 69 66 28 55 3d 3d 36 30 29 74 79 70 65 6f 66 20 61 2e 63 6c 61 73 73 4e 61 6d 65 3d 3d 22 73 74 72 69 6e 67 22 3f 61 2e 63 6c 61 73 73 4e 61 6d 65 3d 53 3a 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 26 26 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 6e 2c 53 29 2c 55 3d 31 38 3b 65 6c 73 65 20 69 66 28 55 3d 3d 38 31 29 50 3d 6e 65 77 20 4e 4a 28 61 2c 74 68 69 73 29 2c 49 3d 6e 2e 76 42 7c 7c 6e 2e 73 72 63 2c 42 3d 6e 2e 6c 69 73 74 65 6e 65 72 2c 6e 2e 61 76 26 26 53 57 28 30 2c 33 2c 6e 75 6c 6c 2c 6e 29 2c 53 3d 42 2e 63 61 6c 6c 28 49 2c 50 29 2c 55 3d 37 34 3b 65 6c 73 65 20 69 66 28 55 3d 3d 37 34 29 77 3d 53 2c 55 3d 33 36 3b 65 6c 73 65 7b 69 66 28 55 3d 3d 31 38 29 72 65 74 75 72 6e 20 77 3b 55 3d Data Ascii: for(U=75;U!=85;)if(U==60)typeof a.className=="string"?a.className=S:a.setAttribute&&a.setAttribute(n,S),U=18;else if(U==81)P=new NJ(a,this),I=n.vB\|\|n.src,B=n.listener,n.av&&SW(0,3,null,n),S=B.call(I,P),U=74;else if(U==74)w=S,U=36;else{if(U==18)return w;U=
2025-01-16 01:38:27 UTC	1390	IN	Data Raw: 6e 20 50 26 26 50 5b 42 5d 3d 3d 3d 53 29 7b 77 3d 42 3b 62 72 65 61 6b 20 61 7d 77 3d 2d 31 7d 49 3d 31 34 7d 65 6c 73 65 20 49 3d 3d 35 38 26 26 28 49 3d 28 61 2b 34 5e 37 29 3e 3d 61 26 26 28 61 2b 34 5e 31 30 29 3c 61 3f 31 31 3a 39 32 29 7d 7d 2c 41 44 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6e 2c 61 2c 71 2c 53 2c 50 2c 42 2c 49 2c 77 2c 55 2c 79 29 7b 66 6f 72 28 79 3d 34 32 3b 79 21 3d 31 32 3b 29 69 66 28 79 3d 3d 39 32 29 55 3d 77 2c 79 3d 32 32 3b 65 6c 73 65 20 69 66 28 79 3d 3d 33 33 29 53 2b 3d 50 2c 49 3d 49 3c 3c 50 7c 71 5b 61 5d 2c 79 3d 39 31 3b 65 6c 73 65 20 69 66 28 79 3d 3d 34 35 29 79 3d 49 3d 3d 22 6d 6f 75 73 65 6f 75 74 22 3f 33 36 3a 6c 3b 65 6c 73 65 20 69 66 28 79 3d 3d 38 39 29 79 3d 32 33 3b 65 6c 73 65 20 69 66 28 79 3d 3d 34 Data Ascii: n P&&P[B]===S){w=B;break a}w=-1}I=14}else I==58&&(I=(a+4^7)>=a&&(a+4^10)<a?11:92)}},AD=function(l,n,a,q,S,P,B,I,w,U,y){for(y=42;y!=12;)if(y==92)U=w,y=22;else if(y==33)S+=P,I=I<<P\|q[a],y=91;else if(y==45)y=I=="mouseout"?36:l;else if(y==89)y=23;else if(y==4
2025-01-16 01:38:27 UTC	1390	IN	Data Raw: 74 68 69 73 2e 70 6f 69 6e 74 65 72 54 79 70 65 3d 22 22 2c 74 68 69 73 2e 74 69 6d 65 53 74 61 6d 70 3d 30 2c 74 68 69 73 2e 4b 4b 3d 6e 75 6c 6c 2c 79 3d 37 36 3b 65 6c 73 65 20 69 66 28 79 3d 3d 38 32 29 53 2d 3d 38 2c 77 2e 70 75 73 68 28 49 3e 3e 53 26 32 35 35 29 2c 79 3d 32 36 3b 65 6c 73 65 20 69 66 28 79 3d 3d 32 37 29 79 3d 42 2b 33 3e 3e 32 3c 42 26 26 42 2d 39 3c 3c 31 3e 3d 42 3f 31 37 3a 32 32 3b 65 6c 73 65 20 69 66 28 79 3d 3d 32 36 29 79 3d 39 37 3b 65 6c 73 65 20 69 66 28 79 3d 3d 31 37 29 53 3d 61 3d 30 2c 77 3d 5b 5d 2c 79 3d 38 39 3b 65 6c 73 65 20 69 66 28 79 3d 3d 33 36 29 61 3d 71 2e 74 6f 45 6c 65 6d 65 6e 74 2c 79 3d 6c 3b 65 6c 73 65 20 69 66 28 79 3d 3d 39 37 29 79 3d 53 3e 37 3f 38 32 3a 32 35 3b 65 6c 73 65 20 69 66 28 79 3d Data Ascii: this.pointerType="",this.timeStamp=0,this.KK=null,y=76;else if(y==82)S-=8,w.push(I>>S&255),y=26;else if(y==27)y=B+3>>2<B&&B-9<<1>=B?17:22;else if(y==26)y=97;else if(y==17)S=a=0,w=[],y=89;else if(y==36)a=q.toElement,y=l;else if(y==97)y=S>7?82:25;else if(y=
2025-01-16 01:38:27 UTC	1390	IN	Data Raw: 74 79 70 65 2e 66 6f 72 45 61 63 68 2e 63 61 6c 6c 28 71 2c 66 75 6e 63 74 69 6f 6e 28 46 29 7b 74 44 28 22 5f 22 2c 30 2c 39 2c 22 20 22 2c 22 63 6c 61 73 73 22 2c 22 22 2c 46 2c 6e 29 7d 29 3a 58 6c 28 74 72 75 65 2c 22 63 6c 61 73 73 22 2c 6e 2c 35 2c 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 66 69 6c 74 65 72 2e 63 61 6c 6c 28 75 28 22 22 2c 37 32 2c 6e 29 2c 66 75 6e 63 74 69 6f 6e 28 46 29 7b 72 65 74 75 72 6e 21 4c 28 46 2c 33 2c 30 2c 71 29 7d 29 2e 6a 6f 69 6e 28 22 20 22 29 29 2c 79 3d 30 3b 65 6c 73 65 20 69 66 28 79 3d 3d 30 29 79 3d 61 2d 31 3c 31 38 26 26 61 3c 3c 31 3e 3d 31 35 3f 6c 3a 31 39 3b 65 6c 73 65 20 69 66 28 79 3d 3d 37 30 29 79 3d 28 61 3c 3c 32 26 38 29 3c 36 26 26 61 2b 31 3e 3d 32 34 3f 31 37 3a 36 34 3b 65 6c 73 65 20 Data Ascii: type.forEach.call(q,function(F){tD("_",0,9," ","class","",F,n)}):Xl(true,"class",n,5,Array.prototype.filter.call(u("",72,n),function(F){return!L(F,3,0,q)}).join(" ")),y=0;else if(y==0)y=a-1<18&&a<<1>=15?l:19;else if(y==70)y=(a<<2&8)<6&&a+1>=24?17:64;else
2025-01-16 01:38:27 UTC	1390	IN	Data Raw: 49 29 2c 78 3d 39 34 29 3a 78 3d 3d 32 37 3f 78 3d 49 26 26 49 5b 71 4a 5d 3f 36 33 3a 38 35 3a 78 3d 3d 37 33 3f 28 63 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 61 3d 76 6f 69 64 20 30 2c 71 3d 4a 44 28 6c 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 4e 29 7b 66 6f 72 28 4e 3d 36 39 3b 4e 21 3d 36 31 3b 29 4e 3d 3d 39 35 3f 28 6e 26 26 6f 69 28 6e 29 2c 61 3d 74 2c 63 28 29 2c 63 3d 76 6f 69 64 20 30 2c 4e 3d 36 31 29 3a 4e 3d 3d 36 39 26 26 28 4e 3d 63 3f 39 35 3a 36 31 29 7d 2c 21 21 6e 29 2c 42 3d 71 5b 31 5d 2c 50 3d 71 5b 30 5d 2c 62 3d 7b 68 6f 74 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 4e 2c 45 2c 48 2c 70 2c 41 2c 44 29 7b 66 6f 72 28 41 3d 36 38 3b 41 21 3d 34 36 3b 29 69 66 28 41 3d 3d 37 29 41 3d 4e 3f 31 33 3a 32 39 3b 65 6c 73 65 20 69 66 28 41 3d 3d 32 Data Ascii: I),x=94):x==27?x=I&&I[qJ]?63:85:x==73?(c=function(){},a=void 0,q=JD(l,function(t,N){for(N=69;N!=61;)N==95?(n&&oi(n),a=t,c(),c=void 0,N=61):N==69&&(N=c?95:61)},!!n),B=q[1],P=q[0],b={hot:function(t,N,E,H,p,A,D){for(A=68;A!=46;)if(A==7)A=N?13:29;else if(A==2
2025-01-16 01:38:27 UTC	1390	IN	Data Raw: 55 2c 79 2c 46 2c 62 2c 78 29 7b 66 6f 72 28 62 3d 33 39 3b 62 21 3d 34 36 3b 29 69 66 28 62 3d 3d 33 31 29 62 3d 28 71 26 39 31 29 3d 3d 71 3f 38 39 3a 34 32 3b 65 6c 73 65 20 69 66 28 62 3d 3d 38 39 29 65 28 6c 2c 6e 2c 61 29 2c 61 5b 76 43 5d 3d 32 37 39 36 2c 62 3d 34 32 3b 65 6c 73 65 20 69 66 28 62 3d 3d 32 31 29 53 3d 48 43 28 35 36 2c 30 2c 31 32 2c 6c 2c 61 2c 6e 29 2c 28 50 3d 53 3e 3d 30 29 26 26 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 73 70 6c 69 63 65 2e 63 61 6c 6c 28 6e 2c 53 2c 6c 29 2c 78 3d 50 2c 62 3d 34 3b 65 6c 73 65 20 69 66 28 62 3d 3d 32 36 29 7b 69 66 28 77 3d 6e 2e 6f 2e 58 5b 53 74 72 69 6e 67 28 50 29 5d 29 7b 66 6f 72 28 49 3d 28 77 3d 77 2e 63 6f 6e 63 61 74 28 29 2c 46 3d 6c 2c 30 29 3b 49 3c 77 2e 6c 65 6e 67 74 68 Data Ascii: U,y,F,b,x){for(b=39;b!=46;)if(b==31)b=(q&91)==q?89:42;else if(b==89)e(l,n,a),a[vC]=2796,b=42;else if(b==21)S=HC(56,0,12,l,a,n),(P=S>=0)&&Array.prototype.splice.call(n,S,l),x=P,b=4;else if(b==26){if(w=n.o.X[String(P)]){for(I=(w=w.concat(),F=l,0);I<w.length

Timestamp	Bytes transferred	Direction	Data
2025-01-16 01:38:27 UTC	1244	OUT	GET /pagead/lvz?evtid=ACd6KtwQIdOyecKjv2TPnD9VKtV5RVSmsFOZKcQ7KrWtERqPm3UWa5qDgjk_qpe0aJvWJTlwZkyjAOzGq-G59x_u_VN20lDA1Q&req_ts=1736991497&pg=MainAppBootstrap%3AUnclassified&az=1&sigh=AB9vU40fCSr6fq_QRiAfZsNYCV1D8CnRUA HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.149" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.youtube.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-16 01:38:27 UTC	914	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Content-Type: image/gif Date: Thu, 16 Jan 2025 01:38:27 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Set-Cookie: NID=520=HpSSk1CRnO11THC3KGCqpiLFzokeK1X1XlpCmIbKD8N2bPZ5M5fHHfIpvFH1iLfWhgpCLL9GSgC13GiK7IBsDWs9dvp1s-Tbg3dV1BYvQ7WuGe8EEgrOkKShoI5GC7tV4vNnJeZM-YjiGiSdclxUqsFzeB-gmUtXdcxsXzqPMP8ebRSbC0EWZKV2Z9nMJyWisg; expires=Fri, 18-Jul-2025 01:38:27 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-01-16 01:38:27 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Timestamp	Bytes transferred	Direction	Data
2025-01-16 01:38:28 UTC	860	OUT	GET /pagead/lvz?evtid=ACd6KtwQIdOyecKjv2TPnD9VKtV5RVSmsFOZKcQ7KrWtERqPm3UWa5qDgjk_qpe0aJvWJTlwZkyjAOzGq-G59x_u_VN20lDA1Q&req_ts=1736991497&pg=MainAppBootstrap%3AUnclassified&az=1&sigh=AB9vU40fCSr6fq_QRiAfZsNYCV1D8CnRUA HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCLnKzQEIitPNAQjB1M0BCLrYzQEY9snNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=520=HpSSk1CRnO11THC3KGCqpiLFzokeK1X1XlpCmIbKD8N2bPZ5M5fHHfIpvFH1iLfWhgpCLL9GSgC13GiK7IBsDWs9dvp1s-Tbg3dV1BYvQ7WuGe8EEgrOkKShoI5GC7tV4vNnJeZM-YjiGiSdclxUqsFzeB-gmUtXdcxsXzqPMP8ebRSbC0EWZKV2Z9nMJyWisg
2025-01-16 01:38:28 UTC	529	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Content-Type: image/gif Date: Thu, 16 Jan 2025 01:38:28 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-01-16 01:38:28 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Timestamp	Bytes transferred	Direction	Data
2025-01-16 01:38:28 UTC	542	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://www.youtube.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Sec-Fetch-Dest: empty Referer: https://www.youtube.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-16 01:38:28 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://www.youtube.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Thu, 16 Jan 2025 01:38:28 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2025-01-16 01:38:29 UTC	1358	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 1024 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.149" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.youtube.com X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.youtube.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=520=HpSSk1CRnO11THC3KGCqpiLFzokeK1X1XlpCmIbKD8N2bPZ5M5fHHfIpvFH1iLfWhgpCLL9GSgC13GiK7IBsDWs9dvp1s-Tbg3dV1BYvQ7WuGe8EEgrOkKShoI5GC7tV4vNnJeZM-YjiGiSdclxUqsFzeB-gmUtXdcxsXzqPMP8ebRSbC0EWZKV2Z9nMJyWisg
2025-01-16 01:38:29 UTC	1024	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 22 34 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 34 39 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 32 38 2c 5b 5b 22 31 37 33 36 39 39 31 35 30 36 32 34 35 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,"41",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.149"],[1,0,0,0,0]]],1828,[["1736991506245",null,null,null
2025-01-16 01:38:29 UTC	952	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://www.youtube.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=520=SEZv9aV5e6rbnPSwUO1YMFj_chYq4tT9ZP9__rv-bkaqdkUDDx5RQ0gOZEb7Pt1oKOnbIRiU3oQVt08twu9MibPM0viD31lExl8KbqCPjy4SFEjuU6RYuCaEhCCyNWqfxzszwG0dfzkjgmoyv677PWi8AegkcyV6lUNbUycyeUF7MlTCVkmq9v7-cti98mao7ePc33Id_A; expires=Fri, 18-Jul-2025 01:38:29 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Thu, 16 Jan 2025 01:38:29 GMT Server: Playlog X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Thu, 16 Jan 2025 01:38:29 GMT Cache-Control: private Connection: close Transfer-Encoding: chunked
2025-01-16 01:38:29 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2025-01-16 01:38:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-01-16 01:38:29 UTC	1357	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 466 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.149" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.youtube.com X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.youtube.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=520=HpSSk1CRnO11THC3KGCqpiLFzokeK1X1XlpCmIbKD8N2bPZ5M5fHHfIpvFH1iLfWhgpCLL9GSgC13GiK7IBsDWs9dvp1s-Tbg3dV1BYvQ7WuGe8EEgrOkKShoI5GC7tV4vNnJeZM-YjiGiSdclxUqsFzeB-gmUtXdcxsXzqPMP8ebRSbC0EWZKV2Z9nMJyWisg
2025-01-16 01:38:29 UTC	466	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 22 34 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 34 39 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 32 38 2c 5b 5b 22 31 37 33 36 39 39 31 35 30 36 32 34 37 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,"41",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.149"],[1,0,0,0,0]]],1828,[["1736991506247",null,null,null
2025-01-16 01:38:29 UTC	952	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://www.youtube.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=520=fQ75EV4Yz07jYUrOrWUiadD0ErQ1hU2dWZiIAl_LQCI6kP6bPb1HitvVBY4HGBnMoKsAgVvmYi8zGW1b10IVxTAn8munuIRFglGVxp-qEOOlco1levDaFsiF5I40YhC_VIxAtbcAn0hjVrnkEk8VmdHdWJJ90ww5CFWqgYuTojTdDgLrPxrQh0pQ6-4f-5erdou3ZrZ8bg; expires=Fri, 18-Jul-2025 01:38:29 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Thu, 16 Jan 2025 01:38:29 GMT Server: Playlog X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Thu, 16 Jan 2025 01:38:29 GMT Cache-Control: private Connection: close Transfer-Encoding: chunked
2025-01-16 01:38:29 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2025-01-16 01:38:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-01-16 01:38:34 UTC	572	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: content-encoding,content-type,x-goog-authuser Origin: https://www.youtube.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Sec-Fetch-Dest: empty Referer: https://www.youtube.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-16 01:38:34 UTC	546	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://www.youtube.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,content-encoding,content-type,x-goog-authuser,origin Content-Type: text/plain; charset=UTF-8 Date: Thu, 16 Jan 2025 01:38:34 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2025-01-16 01:38:34 UTC	1365	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 770 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.149" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.youtube.com X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.youtube.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=520=SEZv9aV5e6rbnPSwUO1YMFj_chYq4tT9ZP9__rv-bkaqdkUDDx5RQ0gOZEb7Pt1oKOnbIRiU3oQVt08twu9MibPM0viD31lExl8KbqCPjy4SFEjuU6RYuCaEhCCyNWqfxzszwG0dfzkjgmoyv677PWi8AegkcyV6lUNbUycyeUF7MlTCVkmq9v7-cti98mao7ePc33Id_A
2025-01-16 01:38:34 UTC	770	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 22 34 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 34 39 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 32 38 2c 5b 5b 22 31 37 33 36 39 39 31 35 31 32 34 39 31 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,"41",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.149"],[1,0,0,0,0]]],1828,[["1736991512491",null,null,null
2025-01-16 01:38:34 UTC	495	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://www.youtube.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Thu, 16 Jan 2025 01:38:34 GMT Server: Playlog X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-01-16 01:38:34 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2025-01-16 01:38:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0