dvla-uk.we-transfer.ir
104.237.252.41  Malicious Activity! Public Scan Open in urlscan Pro

Internal
urlscan.io (IP) urlscan.io (Domain)
Effective Hostname
VirusTotal SecurityTrails crt.sh
Submitted URL
Google Safe Browsing Archive.org
Effective URL Pivot
Google Safe Browsing Archive.org
Effective IP
VirusTotal SecurityTrails Domaintools Censys
Go To Rescan
Add Verdict Report
Submitted URL:
http://dvla-uk.we-transfer.ir/ 6yr old
Effective URL:
https://dvla-uk.we-transfer.ir/start.php?&sessionid=922c068bffff4067537aa840979a890f&securessl=true 6yr old
Submission: On November 05 via automatic, source openphish (November 5th 2020, 2:35:52 am UTC)
Summary HTTP 10 Redirects  Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 10 HTTP transactions. The main IP is 104.237.252.41, located in Wilmington, United States and belongs to DEDICATED-FIBER-COMMUNICATIONS, US. The main domain is dvla-uk.we-transfer.ir. 6yr old
TLS certificate: Issued by Let's Encrypt Authority X3 on October 14th 2020. Valid for: 3mo.
This is the only time dvla-uk.we-transfer.ir was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: UK Government (Government)

Domain & IP information

IP Address AS Autonomous System
2 12 104.237.252.41 104.237.252.41 16628 (DEDICATED...) (DEDICATED-FIBER-COMMUNICATIONS)
10 2
Apex Domain
Subdomains		 Transfer
12 we-transfer.ir 2 redirects
dvla-uk.we-transfer.ir 6yr old
340 KB
10 1
Domain Requested by
12 dvla-uk.we-transfer.ir 2 redirects dvla-uk.we-transfer.ir
10 1

This site contains no links.

Subject Issuer Validity Valid
dvla-uk.we-transfer.ir
Let's Encrypt Authority X3		 2020-10-14 -
2021-01-12		 3mo crt.sh

This page contains 1 frames:

Primary Page: https://dvla-uk.we-transfer.ir/start.php?&sessionid=922c068bffff4067537aa840979a890f&securessl=true
Frame ID: 99903AAD03FDEB9FBEDBE33EFDAB85CE
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://dvla-uk.we-transfer.ir/ HTTP 301
    https://dvla-uk.we-transfer.ir/ HTTP 302
    https://dvla-uk.we-transfer.ir/start.php?&sessionid=922c068bffff4067537aa840979a890f&securessl=true Page URL

Page Statistics

10
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

504 kB
Transfer

933 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://dvla-uk.we-transfer.ir/ HTTP 301
    https://dvla-uk.we-transfer.ir/ HTTP 302
    https://dvla-uk.we-transfer.ir/start.php?&sessionid=922c068bffff4067537aa840979a890f&securessl=true Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions
2 data transactions

Method
Protocol		 Status Resource
Path		 Size
x-fer		 Time
Latency		 Type
MIME-Type		 IP
Location
GET
H3-Q050 		200
 Primary Request start.php Show response
dvla-uk.we-transfer.ir/
Redirect Chain
  • http://dvla-uk.we-transfer.ir/
  • https://dvla-uk.we-transfer.ir/
  • https://dvla-uk.we-transfer.ir/start.php?&sessionid=922c068bffff4067537aa840979a890f&securessl=true
8 KB
3 KB 		538ms
399ms 		Document
text/html		 104.237.252.41
DEDICATED-FIBER-C...
General
Check archive.org
Download Go to
Full URL
https://dvla-uk.we-transfer.ir/start.php?&sessionid=922c068bffff4067537aa840979a890f&securessl=true
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
104.237.252.41 Wilmington, United States, ASN16628 (DEDICATED-FIBER-COMMUNICATIONS, US),
Reverse DNS
Software
/ PHP/5.6.40
Resource Hash
abc2af577266314e453aa4746f616d23270f541362d7ca3a80b98fb11ef8677c

Request headers

:method
GET
:authority
dvla-uk.we-transfer.ir
:scheme
https
:path
/start.php?&sessionid=922c068bffff4067537aa840979a890f&securessl=true
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
PHPSESSID=eo3gm4kldu2m00tnvhrdlgl5f7
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
200
x-powered-by
PHP/5.6.40
expires
Thu, 19 Nov 1981 08:52:00 GMT
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma
no-cache
content-type
text/html; charset=UTF-8
vary
Accept-Encoding
x-turbo-charged-by
LiteSpeed
content-encoding
br
date
Thu, 05 Nov 2020 02:36:15 GMT

Redirect headers

status
302
x-powered-by
PHP/5.6.40
set-cookie
PHPSESSID=eo3gm4kldu2m00tnvhrdlgl5f7; path=/; secure
expires
Thu, 19 Nov 1981 08:52:00 GMT
cache-control
no-cache, no-store, must-revalidate, max-age=0
pragma
no-cache
location
start.php?&sessionid=922c068bffff4067537aa840979a890f&securessl=true
content-type
text/html; charset=UTF-8
x-turbo-charged-by
LiteSpeed
content-length
0
date
Thu, 05 Nov 2020 02:36:14 GMT
alt-svc
quic=":443"; ma=2592000; v="43,46", h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-25=":443"; ma=2592000, h3-27=":443"; ma=2592000
GET
H3-Q050 		200
 govuk-template.css
dvla-uk.we-transfer.ir/step1_files/ 		20 KB
4 KB 		338ms
337ms 		Stylesheet
text/css		 104.237.252.41
DEDICATED-FIBER-C...
General
Check archive.org
Download Go to
Full URL
https://dvla-uk.we-transfer.ir/step1_files/govuk-template.css
Requested by
Host: dvla-uk.we-transfer.ir
URL: https://dvla-uk.we-transfer.ir/start.php?&sessionid=922c068bffff4067537aa840979a890f&securessl=true
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
104.237.252.41 Wilmington, United States, ASN16628 (DEDICATED-FIBER-COMMUNICATIONS, US),
Reverse DNS
Software
/
Resource Hash
13aa82ee00bd9d59269c252d580447fd09dfcc71fbf7e0fe929d598c509bf79e

Request headers

Referer
https://dvla-uk.we-transfer.ir/start.php?&sessionid=922c068bffff4067537aa840979a890f&securessl=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 05 Nov 2020 02:36:15 GMT
content-encoding
br
last-modified
Tue, 26 Mar 2019 23:30:56 GMT
vary
Accept-Encoding
content-type
text/css
status
200
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
accept-ranges
bytes
content-length
4074
expires
Thu, 12 Nov 2020 02:36:09 GMT
GET
H3-Q050 		200
 fonts.css
dvla-uk.we-transfer.ir/step1_files/ 		267 KB
196 KB 		515ms
514ms 		Stylesheet
text/css		 104.237.252.41
DEDICATED-FIBER-C...
General
Check archive.org
Download Go to
Full URL
https://dvla-uk.we-transfer.ir/step1_files/fonts.css
Requested by
Host: dvla-uk.we-transfer.ir
URL: https://dvla-uk.we-transfer.ir/start.php?&sessionid=922c068bffff4067537aa840979a890f&securessl=true
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
104.237.252.41 Wilmington, United States, ASN16628 (DEDICATED-FIBER-COMMUNICATIONS, US),
Reverse DNS
Software
/
Resource Hash
6813a04aa7ebe09726eda5fdd9c4abf1c5f151335adf0ad90474a5fe316e87ed

Request headers

Referer
https://dvla-uk.we-transfer.ir/start.php?&sessionid=922c068bffff4067537aa840979a890f&securessl=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 05 Nov 2020 02:36:15 GMT
content-encoding
br
last-modified
Tue, 26 Mar 2019 23:30:56 GMT
vary
Accept-Encoding
content-type
text/css
status
200
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
accept-ranges
bytes
content-length
201094
expires
Thu, 12 Nov 2020 02:36:09 GMT
GET
H3-Q050 		200
 application.min.css
dvla-uk.we-transfer.ir/step1_files/ 		178 KB
38 KB 		813ms
813ms 		Stylesheet
text/css		 104.237.252.41
DEDICATED-FIBER-C...
General
Check archive.org
Download Go to
Full URL
https://dvla-uk.we-transfer.ir/step1_files/application.min.css
Requested by
Host: dvla-uk.we-transfer.ir
URL: https://dvla-uk.we-transfer.ir/start.php?&sessionid=922c068bffff4067537aa840979a890f&securessl=true
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
104.237.252.41 Wilmington, United States, ASN16628 (DEDICATED-FIBER-COMMUNICATIONS, US),
Reverse DNS
Software
/
Resource Hash
ab3a0f463d776896fd738585a03a21c34f591f138df27815a0eda176fc42bad6

Request headers

Referer
https://dvla-uk.we-transfer.ir/start.php?&sessionid=922c068bffff4067537aa840979a890f&securessl=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 05 Nov 2020 02:36:16 GMT
content-encoding
br
last-modified
Tue, 26 Mar 2019 23:30:56 GMT
vary
Accept-Encoding
content-type
text/css
status
200
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
accept-ranges
bytes
content-length
38570
expires
Thu, 12 Nov 2020 02:36:09 GMT
GET
H3-Q050 		200
 gov.uk_logotype_crown.png
dvla-uk.we-transfer.ir/step1_files/ 		780 B
803 B 		811ms
811ms 		Image
image/png		 104.237.252.41
DEDICATED-FIBER-C...
General
Check archive.org
Download Go to Show image
Full URL
https://dvla-uk.we-transfer.ir/step1_files/gov.uk_logotype_crown.png
Requested by
Host: dvla-uk.we-transfer.ir
URL: https://dvla-uk.we-transfer.ir/start.php?&sessionid=922c068bffff4067537aa840979a890f&securessl=true
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
104.237.252.41 Wilmington, United States, ASN16628 (DEDICATED-FIBER-COMMUNICATIONS, US),
Reverse DNS
Software
/
Resource Hash
14b98db97bbd6cb1f33935d3e0d973fa68ca0c38fb5762b033423ceffe9e16f6

Request headers

Referer
https://dvla-uk.we-transfer.ir/start.php?&sessionid=922c068bffff4067537aa840979a890f&securessl=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 05 Nov 2020 02:36:16 GMT
last-modified
Tue, 26 Mar 2019 23:30:56 GMT
content-type
image/png
status
200
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
accept-ranges
bytes
content-length
780
expires
Thu, 12 Nov 2020 02:36:09 GMT
GET
H3-Q050 		200
 open-government-licence_2x.png
dvla-uk.we-transfer.ir/step1_files/ 		504 B
557 B 		810ms
810ms 		Image
image/png		 104.237.252.41
DEDICATED-FIBER-C...
General
Check archive.org
Download Go to Show image
Full URL
https://dvla-uk.we-transfer.ir/step1_files/open-government-licence_2x.png
Requested by
Host: dvla-uk.we-transfer.ir
URL: https://dvla-uk.we-transfer.ir/start.php?&sessionid=922c068bffff4067537aa840979a890f&securessl=true
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
104.237.252.41 Wilmington, United States, ASN16628 (DEDICATED-FIBER-COMMUNICATIONS, US),
Reverse DNS
Software
/
Resource Hash
2dcbca9026a39b5e4cc536b2f842bd173148b018c7ce369a5930558f4de0e23b

Request headers

Referer
https://dvla-uk.we-transfer.ir/start.php?&sessionid=922c068bffff4067537aa840979a890f&securessl=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 05 Nov 2020 02:36:16 GMT
last-modified
Tue, 26 Mar 2019 23:30:56 GMT
content-type
image/png
status
200
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
accept-ranges
bytes
content-length
504
expires
Thu, 12 Nov 2020 02:36:09 GMT
GET
H3-Q050 		200
 application.min.js Show response
dvla-uk.we-transfer.ir/step1_files/ 		288 KB
91 KB 		811ms
810ms 		Script
application/javascript		 104.237.252.41
DEDICATED-FIBER-C...
General
Check archive.org
Download Go to
Full URL
https://dvla-uk.we-transfer.ir/step1_files/application.min.js
Requested by
Host: dvla-uk.we-transfer.ir
URL: https://dvla-uk.we-transfer.ir/start.php?&sessionid=922c068bffff4067537aa840979a890f&securessl=true
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
104.237.252.41 Wilmington, United States, ASN16628 (DEDICATED-FIBER-COMMUNICATIONS, US),
Reverse DNS
Software
/
Resource Hash
b1ba9b0ff9669b7ffd38f4c96d42441573db020edcd45d46f4468d76f1ccf40f

Request headers

Referer
https://dvla-uk.we-transfer.ir/start.php?&sessionid=922c068bffff4067537aa840979a890f&securessl=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 05 Nov 2020 02:36:16 GMT
content-encoding
br
last-modified
Tue, 26 Mar 2019 23:30:56 GMT
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
accept-ranges
bytes
content-length
93503
expires
Thu, 12 Nov 2020 02:36:09 GMT
GET
H3-Q050 		200
 govuk-template-print.css
dvla-uk.we-transfer.ir/step1_files/ 		1 KB
587 B 		811ms
811ms 		Stylesheet
text/css		 104.237.252.41
DEDICATED-FIBER-C...
General
Check archive.org
Download Go to
Full URL
https://dvla-uk.we-transfer.ir/step1_files/govuk-template-print.css
Requested by
Host: dvla-uk.we-transfer.ir
URL: https://dvla-uk.we-transfer.ir/start.php?&sessionid=922c068bffff4067537aa840979a890f&securessl=true
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
104.237.252.41 Wilmington, United States, ASN16628 (DEDICATED-FIBER-COMMUNICATIONS, US),
Reverse DNS
Software
/
Resource Hash
5bb990686d6668df3f9d5208b10fa83d2f5d55820b442be13542a3dfbd3e361a

Request headers

Referer
https://dvla-uk.we-transfer.ir/start.php?&sessionid=922c068bffff4067537aa840979a890f&securessl=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 05 Nov 2020 02:36:16 GMT
content-encoding
br
last-modified
Tue, 26 Mar 2019 23:30:56 GMT
vary
Accept-Encoding
content-type
text/css
status
200
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
accept-ranges
bytes
content-length
562
expires
Thu, 12 Nov 2020 02:36:09 GMT
GET
H2 		200
 hmrc_crest_18px.png
dvla-uk.we-transfer.ir/step1_files/ 		2 KB
2 KB 		235ms
234ms 		Image
image/png		 104.237.252.41
DEDICATED-FIBER-C...
General
Check archive.org
Download Go to Show image
Full URL
https://dvla-uk.we-transfer.ir/step1_files/hmrc_crest_18px.png
Requested by
Host: dvla-uk.we-transfer.ir
URL: https://dvla-uk.we-transfer.ir/step1_files/application.min.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.237.252.41 Wilmington, United States, ASN16628 (DEDICATED-FIBER-COMMUNICATIONS, US),
Reverse DNS
Software
/
Resource Hash
c208f82493fb15f9261ba474cf6615ddc22e51984177095c4d12d2ad39647ca9

Request headers

Referer
https://dvla-uk.we-transfer.ir/step1_files/application.min.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 05 Nov 2020 02:36:17 GMT
last-modified
Tue, 26 Mar 2019 23:30:56 GMT
content-type
image/png
status
200
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
accept-ranges
bytes
content-length
1637
expires
Thu, 12 Nov 2020 02:36:11 GMT
GET
H2 		200
 govuk-crest.png
dvla-uk.we-transfer.ir/step1_files/ 		4 KB
4 KB 		234ms
234ms 		Image
image/png		 104.237.252.41
DEDICATED-FIBER-C...
General
Check archive.org
Download Go to Show image
Full URL
https://dvla-uk.we-transfer.ir/step1_files/govuk-crest.png
Requested by
Host: dvla-uk.we-transfer.ir
URL: https://dvla-uk.we-transfer.ir/step1_files/govuk-template.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.237.252.41 Wilmington, United States, ASN16628 (DEDICATED-FIBER-COMMUNICATIONS, US),
Reverse DNS
Software
/
Resource Hash
bb9e22aff7881b895c2ceb41d9340804451c474b883f09fe1b4026e76456f44b

Request headers

Referer
https://dvla-uk.we-transfer.ir/step1_files/govuk-template.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 05 Nov 2020 02:36:17 GMT
last-modified
Tue, 26 Mar 2019 23:30:56 GMT
content-type
image/png
status
200
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
accept-ranges
bytes
content-length
3584
expires
Thu, 12 Nov 2020 02:36:11 GMT
GET
DATA 		200
OK 		truncated
/ 		94 KB
94 KB 		Font
application/font-woff
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
048b93884a1b51d20f2a3140541d450cb6b82c6c2cf69128ea1d09fdd9699f30

Request headers

Origin
https://dvla-uk.we-transfer.ir
Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
application/font-woff
GET
DATA 		200
OK 		truncated
/ 		71 KB
71 KB 		Font
application/font-woff
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
01c73d5dd84423dd2fc30aabd1de09a86b36b6de9e2e240d954c09cbb1d97aba

Request headers

Origin
https://dvla-uk.we-transfer.ir
Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
application/font-woff

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: UK Government (Government)

12 JavaScript Window variables

These are the non-standard variables defined on the window object. These include var declarations and global functions and can be helpful in identifying possible client-side frameworks and code.

function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes function| $ function| jQuery object| jQuery112303327765933526452 object| GOVUK object| _gaq object| JSON3 function| Mdtpdf function| onYouTubeIframeAPIReady

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path Expires Name / Value
.we-transfer.ir/ 1969-12-31
23:59:59 		Name: mdtpdf
Value: eyJ2ZXJzaW9uIjoxLCJ1c2VyQWdlbnQiOiJNb3ppbGxhLzUuMCAoTWFjaW50b3NoOyBJbnRlbCBNYWMgT1MgWCAxMF8xNF81KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvODMuMC40MTAzLjYxIFNhZmFyaS81MzcuMzYiLCJsYW5ndWFnZSI6ImVuLVVTIiwiY29sb3JEZXB0aCI6MjQsInJlc29sdXRpb24iOiIxMjAweDE2MDAiLCJ0aW1lem9uZSI6LTYwLCJjbGllbnRTaWRlVGltZXN0YW1wIjoxNjA0NTQzNzcxMDg4LCJzZXNzaW9uU3RvcmFnZSI6dHJ1ZSwibG9jYWxTdG9yYWdlIjp0cnVlLCJpbmRleGVkREIiOnRydWUsInBsYXRmb3JtIjoiTGludXggeDg2XzY0IiwiZG9Ob3RUcmFjayI6ZmFsc2UsIm51bWJlck9mUGx1Z2lucyI6MCwicGx1Z2lucyI6W119