Edit tour

Windows Analysis Report
https://www.google.at/url?q=https%3A%2F%2Fsites.google.com%2Fview%2Fgfyhgfdgd%2Fhome&sa=D&sntz=1&usg=AOvVaw2V-B7GR4_wvs2FgIKvg5nY

Overview

General Information

Sample URL:https://www.google.at/url?q=https%3A%2F%2Fsites.google.com%2Fview%2Fgfyhgfdgd%2Fhome&sa=D&sntz=1&usg=AOvVaw2V-B7GR4_wvs2FgIKvg5nY
Analysis ID:1649379
Infos:

Detection

HTMLPhisher
Score:72
Range:0 - 100
Confidence:100%

Signatures

AI detected phishing page
Yara detected HtmlPhish46
Yara detected HtmlPhish54
AI detected suspicious Javascript
Performs DNS queries to domains with low reputation
Creates files inside the system directory
Deletes files inside the Windows folder
HTML body contains low number of good links
HTML page contains hidden javascript code
HTML page contains string obfuscation
HTML title does not match URL

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
  • System is w10x64_ra
  • chrome.exe (PID: 6068 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)
    • chrome.exe (PID: 6620 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2024,i,10526934367864539545,13949933055375372726,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=1944 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)
  • chrome.exe (PID: 7152 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.google.at/url?q=https%3A%2F%2Fsites.google.com%2Fview%2Fgfyhgfdgd%2Fhome&sa=D&sntz=1&usg=AOvVaw2V-B7GR4_wvs2FgIKvg5nY" MD5: E81F54E6C1129887AEA47E7D092680BF)
  • cleanup
SourceRuleDescriptionAuthorStrings
3.25..script.csvJoeSecurity_HtmlPhish_54Yara detected HtmlPhish_54Joe Security
    4.35..script.csvJoeSecurity_HtmlPhish_54Yara detected HtmlPhish_54Joe Security
      3.14.pages.csvJoeSecurity_HtmlPhish_54Yara detected HtmlPhish_54Joe Security
        4.16.pages.csvJoeSecurity_HtmlPhish_46Yara detected HtmlPhish_46Joe Security
          4.16.pages.csvJoeSecurity_HtmlPhish_54Yara detected HtmlPhish_54Joe Security
            Click to see the 1 entries
            No Sigma rule has matched
            No Suricata rule has matched

            Click to jump to signature section

            Show All Signature Results

            Phishing

            barindex
            Source: https://login.hinkcreativity.xyz/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638786064094045637.ZGU2ZTIwNDItMmQxMS00ZmI0LTgwNWUtNDI2M2VmZTRiNWY2YjU4M2FlNjktM2E5OS00Y2QwLTkyNGUtNjFkZjBmMWYxMDhj&ui_locales=en-US&mkt=en-US&client-request-id=fe486d31-0209-4df2-9f7a-9496be80315e&state=o_pNPUnjtue9ylH4JxUq2MCr7Ph8NqFFO_OB9XgsIUpNO00gWNyvQKjdN8ByuVyK2HGLLwmeWKgryN1kBTrmox9Ycsi36r0C-13Snbm4sgngG2gY6WblcKq4kiCGVDJnaIyHgMtedVQ975OqbWMqyXWCi-BX81U3_FkaQQkHl5uYMR5vjq9xwOgEnG6sKYuAHi-_Aeg4VIXByYz6KhTHyTGwj0_DSVZf4ypCybV6OCrC5m1lxHqAFcDtYv8excRH-olDFDHf4aw8rnQr4C9DdA&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0&sso_reload=trueJoe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is classified as 'wellknown'., The legitimate domain for Microsoft is 'microsoft.com'., The provided URL 'login.hinkcreativity.xyz' does not match the legitimate domain for Microsoft., The domain 'hinkcreativity.xyz' is unrelated to Microsoft and is suspicious., The use of a generic domain extension '.xyz' is unusual for a well-known brand like Microsoft., The presence of input fields for 'Email, phone, or Skype' is typical for Microsoft login pages, but the domain mismatch is a strong indicator of phishing. DOM: 4.16.pages.csv
            Source: Yara matchFile source: 4.16.pages.csv, type: HTML
            Source: Yara matchFile source: 3.25..script.csv, type: HTML
            Source: Yara matchFile source: 4.35..script.csv, type: HTML
            Source: Yara matchFile source: 3.14.pages.csv, type: HTML
            Source: Yara matchFile source: 4.16.pages.csv, type: HTML
            Source: Yara matchFile source: 4.15.pages.csv, type: HTML
            Source: 2.23..script.csvJoe Sandbox AI: Detected suspicious JavaScript with source url: https://booking.mx%7BRANDOM_NUMBER10%7D%7BRANDOM_N... This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated URLs. The script extracts a user's email from the URL fragment and redirects the user to a suspicious domain, which is a common phishing technique. Additionally, the script uses a Turnstile verification, which could be a social engineering tactic to collect user information. Overall, the script demonstrates a high level of malicious intent and poses a significant security risk.
            Source: https://login.hinkcreativity.xyz/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638786064094045637.ZGU2ZTIwNDItMmQxMS00ZmI0LTgwNWUtNDI2M2VmZTRiNWY2YjU4M2FlNjktM2E5OS00Y2QwLTkyNGUtNjFkZjBmMWYxMDhj&ui_locales=en-US&mkt=en-US&client-request-id=fe486d31-0209-4df2-9f7a-9496be80315e&state=o_pNPUnjtue9ylH4JxUq2MCr7Ph8NqFFO_OB9XgsIUpNO00gWNyvQKjdN8ByuVyK2HGLLwmeWKgryN1kBTrmox9Ycsi36r0C-13Snbm4sgngG2gY6WblcKq4kiCGVDJnaIyHgMtedVQ975OqbWMqyXWCi-BX81U3_FkaQQkHl5uYMR5vjq9xwOgEnG6sKYuAHi-_Aeg4VIXByYz6KhTHyTGwj0_DSVZf4ypCybV6OCrC5m1lxHqAFcDtYv8excRH-olDFDHf4aw8rnQr4C9DdA&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0HTTP Parser: Number of links: 0
            Source: https://login.hinkcreativity.xyz/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638786064094045637.ZGU2ZTIwNDItMmQxMS00ZmI0LTgwNWUtNDI2M2VmZTRiNWY2YjU4M2FlNjktM2E5OS00Y2QwLTkyNGUtNjFkZjBmMWYxMDhj&ui_locales=en-US&mkt=en-US&client-request-id=fe486d31-0209-4df2-9f7a-9496be80315e&state=o_pNPUnjtue9ylH4JxUq2MCr7Ph8NqFFO_OB9XgsIUpNO00gWNyvQKjdN8ByuVyK2HGLLwmeWKgryN1kBTrmox9Ycsi36r0C-13Snbm4sgngG2gY6WblcKq4kiCGVDJnaIyHgMtedVQ975OqbWMqyXWCi-BX81U3_FkaQQkHl5uYMR5vjq9xwOgEnG6sKYuAHi-_Aeg4VIXByYz6KhTHyTGwj0_DSVZf4ypCybV6OCrC5m1lxHqAFcDtYv8excRH-olDFDHf4aw8rnQr4C9DdA&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0&sso_reload=trueHTTP Parser: Number of links: 0
            Source: https://login.hinkcreativity.xyz/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638786064094045637.ZGU2ZTIwNDItMmQxMS00ZmI0LTgwNWUtNDI2M2VmZTRiNWY2YjU4M2FlNjktM2E5OS00Y2QwLTkyNGUtNjFkZjBmMWYxMDhj&ui_locales=en-US&mkt=en-US&client-request-id=fe486d31-0209-4df2-9f7a-9496be80315e&state=o_pNPUnjtue9ylH4JxUq2MCr7Ph8NqFFO_OB9XgsIUpNO00gWNyvQKjdN8ByuVyK2HGLLwmeWKgryN1kBTrmox9Ycsi36r0C-13Snbm4sgngG2gY6WblcKq4kiCGVDJnaIyHgMtedVQ975OqbWMqyXWCi-BX81U3_FkaQQkHl5uYMR5vjq9xwOgEnG6sKYuAHi-_Aeg4VIXByYz6KhTHyTGwj0_DSVZf4ypCybV6OCrC5m1lxHqAFcDtYv8excRH-olDFDHf4aw8rnQr4C9DdA&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0HTTP Parser: Base64 decoded: de6e2042-2d11-4fb4-805e-4263efe4b5f6b583ae69-3a99-4cd0-924e-61df0f1f108c
            Source: https://booking.mx%7BRANDOM_NUMBER10%7D%7BRANDOM_NUMBER10%7D%7BRANDOM_NUMBER10%7D%7BRANDOM_NUMBER10%7D%7BRANDOM_MD5%7D%7BRANDOM_MD5%7D%7BRANDOM_MD5%7D%7BRANDOM_MD5%7D%7BRANDOM_MD5%7D%7BRANDOM_MD5%7D%7BRANDOM_MD5%7D%7BRANDOM_MD5%7D%7BRANDOM_MD5%7D%7BRANDOM_MD5%7D%7BRANDOM_MD5%7D%7BRANDOM_MD5%7D%7BRANDOM_MD5%7D%EF%BB%BF%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20...HTTP Parser: Found new string: script . // Callback for the Turnstile verification. function onloadTurnstileCallback() {. turnstile.render('#turnstileCaptcha', {. sitekey: '0x4AAAAAAA45rJ9eQe9R85jf',. callback: function(response) {. // Enable the button after successful verification. const verifyButton = document.getElementById('verifyButton');. if (verifyButton) {. verifyButton.style.opacity = '1'; // Make button fully visible. verifyButton.style.pointerEvents = 'auto'; // Enable pointer events. }. }. });. }.. // Function to extract and display the fragment. function displayEmailFromFragment() {. var fragment = window.location.hash;. if (fragment) {. var email = fragment.substring(1).replace(/=*$/, '');. var emailDisplay = document.getElementById('grabbed-email');. ...
            Source: https://login.hinkcreativity.xyz/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638786064094045637.ZGU2ZTIwNDItMmQxMS00ZmI0LTgwNWUtNDI2M2VmZTRiNWY2YjU4M2FlNjktM2E5OS00Y2QwLTkyNGUtNjFkZjBmMWYxMDhj&ui_locales=en-US&mkt=en-US&client-request-id=fe486d31-0209-4df2-9f7a-9496be80315e&state=o_pNPUnjtue9ylH4JxUq2MCr7Ph8NqFFO_OB9XgsIUpNO00gWNyvQKjdN8ByuVyK2HGLLwmeWKgryN1kBTrmox9Ycsi36r0C-13Snbm4sgngG2gY6WblcKq4kiCGVDJnaIyHgMtedVQ975OqbWMqyXWCi-BX81U3_FkaQQkHl5uYMR5vjq9xwOgEnG6sKYuAHi-_Aeg4VIXByYz6KhTHyTGwj0_DSVZf4ypCybV6OCrC5m1lxHqAFcDtYv8excRH-olDFDHf4aw8rnQr4C9DdA&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0HTTP Parser: Title: Redirecting does not match URL
            Source: https://login.hinkcreativity.xyz/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638786064094045637.ZGU2ZTIwNDItMmQxMS00ZmI0LTgwNWUtNDI2M2VmZTRiNWY2YjU4M2FlNjktM2E5OS00Y2QwLTkyNGUtNjFkZjBmMWYxMDhj&ui_locales=en-US&mkt=en-US&client-request-id=fe486d31-0209-4df2-9f7a-9496be80315e&state=o_pNPUnjtue9ylH4JxUq2MCr7Ph8NqFFO_OB9XgsIUpNO00gWNyvQKjdN8ByuVyK2HGLLwmeWKgryN1kBTrmox9Ycsi36r0C-13Snbm4sgngG2gY6WblcKq4kiCGVDJnaIyHgMtedVQ975OqbWMqyXWCi-BX81U3_FkaQQkHl5uYMR5vjq9xwOgEnG6sKYuAHi-_Aeg4VIXByYz6KhTHyTGwj0_DSVZf4ypCybV6OCrC5m1lxHqAFcDtYv8excRH-olDFDHf4aw8rnQr4C9DdA&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0&sso_reload=trueHTTP Parser: Title: Sign in to your account does not match URL
            Source: https://login.hinkcreativity.xyz/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638786064094045637.ZGU2ZTIwNDItMmQxMS00ZmI0LTgwNWUtNDI2M2VmZTRiNWY2YjU4M2FlNjktM2E5OS00Y2QwLTkyNGUtNjFkZjBmMWYxMDhj&ui_locales=en-US&mkt=en-US&client-request-id=fe486d31-0209-4df2-9f7a-9496be80315e&state=o_pNPUnjtue9ylH4JxUq2MCr7Ph8NqFFO_OB9XgsIUpNO00gWNyvQKjdN8ByuVyK2HGLLwmeWKgryN1kBTrmox9Ycsi36r0C-13Snbm4sgngG2gY6WblcKq4kiCGVDJnaIyHgMtedVQ975OqbWMqyXWCi-BX81U3_FkaQQkHl5uYMR5vjq9xwOgEnG6sKYuAHi-_Aeg4VIXByYz6KhTHyTGwj0_DSVZf4ypCybV6OCrC5m1lxHqAFcDtYv8excRH-olDFDHf4aw8rnQr4C9DdA&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0&sso_reload=trueHTTP Parser: <input type="password" .../> found
            Source: https://sites.google.com/view/gfyhgfdgd/homeHTTP Parser: No favicon
            Source: https://sites.google.com/view/gfyhgfdgd/homeHTTP Parser: No favicon
            Source: https://sites.google.com/view/gfyhgfdgd/homeHTTP Parser: No favicon
            Source: https://sites.google.com/view/gfyhgfdgd/homeHTTP Parser: No favicon
            Source: https://sites.google.com/view/gfyhgfdgd/homeHTTP Parser: No favicon
            Source: https://booking.mx%7BRANDOM_NUMBER10%7D%7BRANDOM_NUMBER10%7D%7BRANDOM_NUMBER10%7D%7BRANDOM_NUMBER10%7D%7BRANDOM_MD5%7D%7BRANDOM_MD5%7D%7BRANDOM_MD5%7D%7BRANDOM_MD5%7D%7BRANDOM_MD5%7D%7BRANDOM_MD5%7D%7BRANDOM_MD5%7D%7BRANDOM_MD5%7D%7BRANDOM_MD5%7D%7BRANDOM_MD5%7D%7BRANDOM_MD5%7D%7BRANDOM_MD5%7D%7BRANDOM_MD5%7D%EF%BB%BF%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20...HTTP Parser: No favicon
            Source: https://booking.mx%7BRANDOM_NUMBER10%7D%7BRANDOM_NUMBER10%7D%7BRANDOM_NUMBER10%7D%7BRANDOM_NUMBER10%7D%7BRANDOM_MD5%7D%7BRANDOM_MD5%7D%7BRANDOM_MD5%7D%7BRANDOM_MD5%7D%7BRANDOM_MD5%7D%7BRANDOM_MD5%7D%7BRANDOM_MD5%7D%7BRANDOM_MD5%7D%7BRANDOM_MD5%7D%7BRANDOM_MD5%7D%7BRANDOM_MD5%7D%7BRANDOM_MD5%7D%7BRANDOM_MD5%7D%EF%BB%BF%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20...HTTP Parser: No favicon
            Source: https://booking.mx%7BRANDOM_NUMBER10%7D%7BRANDOM_NUMBER10%7D%7BRANDOM_NUMBER10%7D%7BRANDOM_NUMBER10%7D%7BRANDOM_MD5%7D%7BRANDOM_MD5%7D%7BRANDOM_MD5%7D%7BRANDOM_MD5%7D%7BRANDOM_MD5%7D%7BRANDOM_MD5%7D%7BRANDOM_MD5%7D%7BRANDOM_MD5%7D%7BRANDOM_MD5%7D%7BRANDOM_MD5%7D%7BRANDOM_MD5%7D%7BRANDOM_MD5%7D%7BRANDOM_MD5%7D%EF%BB%BF%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20...HTTP Parser: No favicon
            Source: https://login.hinkcreativity.xyz/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638786064094045637.ZGU2ZTIwNDItMmQxMS00ZmI0LTgwNWUtNDI2M2VmZTRiNWY2YjU4M2FlNjktM2E5OS00Y2QwLTkyNGUtNjFkZjBmMWYxMDhj&ui_locales=en-US&mkt=en-US&client-request-id=fe486d31-0209-4df2-9f7a-9496be80315e&state=o_pNPUnjtue9ylH4JxUq2MCr7Ph8NqFFO_OB9XgsIUpNO00gWNyvQKjdN8ByuVyK2HGLLwmeWKgryN1kBTrmox9Ycsi36r0C-13Snbm4sgngG2gY6WblcKq4kiCGVDJnaIyHgMtedVQ975OqbWMqyXWCi-BX81U3_FkaQQkHl5uYMR5vjq9xwOgEnG6sKYuAHi-_Aeg4VIXByYz6KhTHyTGwj0_DSVZf4ypCybV6OCrC5m1lxHqAFcDtYv8excRH-olDFDHf4aw8rnQr4C9DdA&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0HTTP Parser: No favicon
            Source: https://login.hinkcreativity.xyz/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638786064094045637.ZGU2ZTIwNDItMmQxMS00ZmI0LTgwNWUtNDI2M2VmZTRiNWY2YjU4M2FlNjktM2E5OS00Y2QwLTkyNGUtNjFkZjBmMWYxMDhj&ui_locales=en-US&mkt=en-US&client-request-id=fe486d31-0209-4df2-9f7a-9496be80315e&state=o_pNPUnjtue9ylH4JxUq2MCr7Ph8NqFFO_OB9XgsIUpNO00gWNyvQKjdN8ByuVyK2HGLLwmeWKgryN1kBTrmox9Ycsi36r0C-13Snbm4sgngG2gY6WblcKq4kiCGVDJnaIyHgMtedVQ975OqbWMqyXWCi-BX81U3_FkaQQkHl5uYMR5vjq9xwOgEnG6sKYuAHi-_Aeg4VIXByYz6KhTHyTGwj0_DSVZf4ypCybV6OCrC5m1lxHqAFcDtYv8excRH-olDFDHf4aw8rnQr4C9DdA&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0HTTP Parser: No <meta name="author".. found
            Source: https://login.hinkcreativity.xyz/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638786064094045637.ZGU2ZTIwNDItMmQxMS00ZmI0LTgwNWUtNDI2M2VmZTRiNWY2YjU4M2FlNjktM2E5OS00Y2QwLTkyNGUtNjFkZjBmMWYxMDhj&ui_locales=en-US&mkt=en-US&client-request-id=fe486d31-0209-4df2-9f7a-9496be80315e&state=o_pNPUnjtue9ylH4JxUq2MCr7Ph8NqFFO_OB9XgsIUpNO00gWNyvQKjdN8ByuVyK2HGLLwmeWKgryN1kBTrmox9Ycsi36r0C-13Snbm4sgngG2gY6WblcKq4kiCGVDJnaIyHgMtedVQ975OqbWMqyXWCi-BX81U3_FkaQQkHl5uYMR5vjq9xwOgEnG6sKYuAHi-_Aeg4VIXByYz6KhTHyTGwj0_DSVZf4ypCybV6OCrC5m1lxHqAFcDtYv8excRH-olDFDHf4aw8rnQr4C9DdA&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0&sso_reload=trueHTTP Parser: No <meta name="author".. found
            Source: https://login.hinkcreativity.xyz/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638786064094045637.ZGU2ZTIwNDItMmQxMS00ZmI0LTgwNWUtNDI2M2VmZTRiNWY2YjU4M2FlNjktM2E5OS00Y2QwLTkyNGUtNjFkZjBmMWYxMDhj&ui_locales=en-US&mkt=en-US&client-request-id=fe486d31-0209-4df2-9f7a-9496be80315e&state=o_pNPUnjtue9ylH4JxUq2MCr7Ph8NqFFO_OB9XgsIUpNO00gWNyvQKjdN8ByuVyK2HGLLwmeWKgryN1kBTrmox9Ycsi36r0C-13Snbm4sgngG2gY6WblcKq4kiCGVDJnaIyHgMtedVQ975OqbWMqyXWCi-BX81U3_FkaQQkHl5uYMR5vjq9xwOgEnG6sKYuAHi-_Aeg4VIXByYz6KhTHyTGwj0_DSVZf4ypCybV6OCrC5m1lxHqAFcDtYv8excRH-olDFDHf4aw8rnQr4C9DdA&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0&sso_reload=trueHTTP Parser: No <meta name="author".. found
            Source: https://login.hinkcreativity.xyz/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638786064094045637.ZGU2ZTIwNDItMmQxMS00ZmI0LTgwNWUtNDI2M2VmZTRiNWY2YjU4M2FlNjktM2E5OS00Y2QwLTkyNGUtNjFkZjBmMWYxMDhj&ui_locales=en-US&mkt=en-US&client-request-id=fe486d31-0209-4df2-9f7a-9496be80315e&state=o_pNPUnjtue9ylH4JxUq2MCr7Ph8NqFFO_OB9XgsIUpNO00gWNyvQKjdN8ByuVyK2HGLLwmeWKgryN1kBTrmox9Ycsi36r0C-13Snbm4sgngG2gY6WblcKq4kiCGVDJnaIyHgMtedVQ975OqbWMqyXWCi-BX81U3_FkaQQkHl5uYMR5vjq9xwOgEnG6sKYuAHi-_Aeg4VIXByYz6KhTHyTGwj0_DSVZf4ypCybV6OCrC5m1lxHqAFcDtYv8excRH-olDFDHf4aw8rnQr4C9DdA&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0HTTP Parser: No <meta name="copyright".. found
            Source: https://login.hinkcreativity.xyz/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638786064094045637.ZGU2ZTIwNDItMmQxMS00ZmI0LTgwNWUtNDI2M2VmZTRiNWY2YjU4M2FlNjktM2E5OS00Y2QwLTkyNGUtNjFkZjBmMWYxMDhj&ui_locales=en-US&mkt=en-US&client-request-id=fe486d31-0209-4df2-9f7a-9496be80315e&state=o_pNPUnjtue9ylH4JxUq2MCr7Ph8NqFFO_OB9XgsIUpNO00gWNyvQKjdN8ByuVyK2HGLLwmeWKgryN1kBTrmox9Ycsi36r0C-13Snbm4sgngG2gY6WblcKq4kiCGVDJnaIyHgMtedVQ975OqbWMqyXWCi-BX81U3_FkaQQkHl5uYMR5vjq9xwOgEnG6sKYuAHi-_Aeg4VIXByYz6KhTHyTGwj0_DSVZf4ypCybV6OCrC5m1lxHqAFcDtYv8excRH-olDFDHf4aw8rnQr4C9DdA&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0&sso_reload=trueHTTP Parser: No <meta name="copyright".. found
            Source: https://login.hinkcreativity.xyz/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638786064094045637.ZGU2ZTIwNDItMmQxMS00ZmI0LTgwNWUtNDI2M2VmZTRiNWY2YjU4M2FlNjktM2E5OS00Y2QwLTkyNGUtNjFkZjBmMWYxMDhj&ui_locales=en-US&mkt=en-US&client-request-id=fe486d31-0209-4df2-9f7a-9496be80315e&state=o_pNPUnjtue9ylH4JxUq2MCr7Ph8NqFFO_OB9XgsIUpNO00gWNyvQKjdN8ByuVyK2HGLLwmeWKgryN1kBTrmox9Ycsi36r0C-13Snbm4sgngG2gY6WblcKq4kiCGVDJnaIyHgMtedVQ975OqbWMqyXWCi-BX81U3_FkaQQkHl5uYMR5vjq9xwOgEnG6sKYuAHi-_Aeg4VIXByYz6KhTHyTGwj0_DSVZf4ypCybV6OCrC5m1lxHqAFcDtYv8excRH-olDFDHf4aw8rnQr4C9DdA&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0&sso_reload=trueHTTP Parser: No <meta name="copyright".. found
            Source: unknownHTTPS traffic detected: 142.250.80.99:443 -> 192.168.2.16:49703 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 142.250.80.99:443 -> 192.168.2.16:49704 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 142.250.80.99:443 -> 192.168.2.16:49705 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 142.250.176.209:443 -> 192.168.2.16:49714 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 142.250.65.174:443 -> 192.168.2.16:49719 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 142.251.41.1:443 -> 192.168.2.16:49723 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 142.251.41.1:443 -> 192.168.2.16:49723 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 142.251.41.1:443 -> 192.168.2.16:49729 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 142.250.81.238:443 -> 192.168.2.16:49731 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 142.250.81.238:443 -> 192.168.2.16:49733 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 142.250.65.206:443 -> 192.168.2.16:49737 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 142.250.81.238:443 -> 192.168.2.16:49738 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 142.250.64.68:443 -> 192.168.2.16:49739 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 142.250.65.174:443 -> 192.168.2.16:49741 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 142.251.41.1:443 -> 192.168.2.16:49745 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 142.250.81.238:443 -> 192.168.2.16:49750 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.17.25.14:443 -> 192.168.2.16:49752 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.18.94.41:443 -> 192.168.2.16:49753 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.124.96:443 -> 192.168.2.16:49755 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 84.200.17.120:443 -> 192.168.2.16:49757 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 84.200.17.120:443 -> 192.168.2.16:49758 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.18.94.41:443 -> 192.168.2.16:49760 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.17.25.14:443 -> 192.168.2.16:49759 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.18.94.41:443 -> 192.168.2.16:49762 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.18.94.41:443 -> 192.168.2.16:49765 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 84.200.17.120:443 -> 192.168.2.16:49777 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 84.200.17.120:443 -> 192.168.2.16:49778 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 84.200.17.120:443 -> 192.168.2.16:49780 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 84.200.17.120:443 -> 192.168.2.16:49782 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 84.200.17.120:443 -> 192.168.2.16:49787 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 84.200.17.120:443 -> 192.168.2.16:49786 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 84.200.17.120:443 -> 192.168.2.16:49785 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 84.200.17.120:443 -> 192.168.2.16:49793 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 84.200.17.120:443 -> 192.168.2.16:49804 version: TLS 1.2
            Source: chrome.exeMemory has grown: Private usage: 15MB later: 39MB

            Networking

            barindex
            Source: C:\Program Files\Google\Chrome\Application\chrome.exeDNS query: login.hinkcreativity.xyz
            Source: C:\Program Files\Google\Chrome\Application\chrome.exeDNS query: login.hinkcreativity.xyz
            Source: C:\Program Files\Google\Chrome\Application\chrome.exeDNS query: www.hinkcreativity.xyz
            Source: C:\Program Files\Google\Chrome\Application\chrome.exeDNS query: www.hinkcreativity.xyz
            Source: C:\Program Files\Google\Chrome\Application\chrome.exeDNS query: loginlive.hinkcreativity.xyz
            Source: C:\Program Files\Google\Chrome\Application\chrome.exeDNS query: loginlive.hinkcreativity.xyz
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownTCP traffic detected without corresponding DNS query: 2.23.227.208
            Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
            Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
            Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
            Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
            Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownTCP traffic detected without corresponding DNS query: 52.182.143.211
            Source: unknownTCP traffic detected without corresponding DNS query: 52.182.143.211
            Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
            Source: unknownTCP traffic detected without corresponding DNS query: 52.182.143.211
            Source: global trafficHTTP traffic detected: GET /url?q=https%3A%2F%2Fsites.google.com%2Fview%2Fgfyhgfdgd%2Fhome&sa=D&sntz=1&usg=AOvVaw2V-B7GR4_wvs2FgIKvg5nY HTTP/1.1Host: www.google.atConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Browser-Channel: stableX-Browser-Year: 2025X-Browser-Validation: wTKGXmLo+sPWz1JKKbFzUyHly1Q=X-Browser-Copyright: Copyright 2025 Google LLC. All rights reserved.X-Client-Data: CLbgygE=Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
            Source: global trafficHTTP traffic detected: GET /js/client.js?onload=gapiLoaded HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*X-Client-Data: CLbgygE=Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://sites.google.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=522=ZcBAUA8NG6r6VW3QQW1Zsw2_6iQmlbQDPkbSfSW8ol9GGPixwUtIcG9vAHtazJUrwmcV2CKfSY89dX478LISTWgnFxxb63JQKg7BMMkUmn-xnKVei2DPnbX5rMtgGMi0aaplAalz2OTlVgzsUw0to3LTqUd-WI01N9QwIKGXyHCSEcfNMGX8I9sodSy2fUS7i5p1dw
            Source: global trafficHTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.lb.en.fwXSHnIYz-4.O/m=client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo_SvulQ5pP6FvvJyrQeIOJ4MStGTQ/cb=gapi.loaded_0?le=scs HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*X-Client-Data: CLbgygE=Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://sites.google.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=522=ZcBAUA8NG6r6VW3QQW1Zsw2_6iQmlbQDPkbSfSW8ol9GGPixwUtIcG9vAHtazJUrwmcV2CKfSY89dX478LISTWgnFxxb63JQKg7BMMkUmn-xnKVei2DPnbX5rMtgGMi0aaplAalz2OTlVgzsUw0to3LTqUd-WI01N9QwIKGXyHCSEcfNMGX8I9sodSy2fUS7i5p1dw
            Source: global trafficHTTP traffic detected: GET /Gty2FglC919yPWso8i2aDNA9wyf4miON0STwy5C1xCnz7N0IHcDf3lWUp34MzOX2qzIlvRPD3KpcNsiN8V-LiwI=w16383 HTTP/1.1Host: lh6.googleusercontent.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CLbgygE=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://sites.google.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
            Source: global trafficHTTP traffic detected: GET /Gty2FglC919yPWso8i2aDNA9wyf4miON0STwy5C1xCnz7N0IHcDf3lWUp34MzOX2qzIlvRPD3KpcNsiN8V-LiwI=w16383 HTTP/1.1Host: lh6.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*X-Client-Data: CLbgygE=Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
            Source: global trafficHTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.lb.en.fwXSHnIYz-4.O/m=gapi_rpc/exm=client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo_SvulQ5pP6FvvJyrQeIOJ4MStGTQ/cb=gapi.loaded_1?le=scs HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*X-Client-Data: CLbgygE=Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://sites.google.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=522=ZcBAUA8NG6r6VW3QQW1Zsw2_6iQmlbQDPkbSfSW8ol9GGPixwUtIcG9vAHtazJUrwmcV2CKfSY89dX478LISTWgnFxxb63JQKg7BMMkUmn-xnKVei2DPnbX5rMtgGMi0aaplAalz2OTlVgzsUw0to3LTqUd-WI01N9QwIKGXyHCSEcfNMGX8I9sodSy2fUS7i5p1dw
            Source: global trafficHTTP traffic detected: GET /auth_warmup HTTP/1.1Host: drive.google.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Browser-Channel: stableX-Browser-Year: 2025X-Browser-Validation: wTKGXmLo+sPWz1JKKbFzUyHly1Q=X-Browser-Copyright: Copyright 2025 Google LLC. All rights reserved.X-Client-Data: CLbgygE=Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://sites.google.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=522=ZcBAUA8NG6r6VW3QQW1Zsw2_6iQmlbQDPkbSfSW8ol9GGPixwUtIcG9vAHtazJUrwmcV2CKfSY89dX478LISTWgnFxxb63JQKg7BMMkUmn-xnKVei2DPnbX5rMtgGMi0aaplAalz2OTlVgzsUw0to3LTqUd-WI01N9QwIKGXyHCSEcfNMGX8I9sodSy2fUS7i5p1dw
            Source: global trafficHTTP traffic detected: GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*X-Client-Data: CLbgygE=Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=522=h80fYiQJlbsDnvIDX0VTdC2WG20frVfkHIywC8v02zUOCL6Y6Zw4NDXwA2VrGJXeJuXEjtYipRZruEyDa7QtgzjpOb5zbBxZ7yhgQBTNpTOFEGguSaFLTQMD4YVY_-js2zJdxxtAdcu_JsK8qTVOmaztXc-MKfTc81681sIz8rh6cKSR-4QCJnkyAzbcj1DdLg7p0Xvypcwu3w
            Source: global trafficHTTP traffic detected: GET /js/api.js?checkCookie=1 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*X-Client-Data: CLbgygE=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://www.gstatic.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=522=h80fYiQJlbsDnvIDX0VTdC2WG20frVfkHIywC8v02zUOCL6Y6Zw4NDXwA2VrGJXeJuXEjtYipRZruEyDa7QtgzjpOb5zbBxZ7yhgQBTNpTOFEGguSaFLTQMD4YVY_-js2zJdxxtAdcu_JsK8qTVOmaztXc-MKfTc81681sIz8rh6cKSR-4QCJnkyAzbcj1DdLg7p0Xvypcwu3w
            Source: global trafficHTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.lb.en.fwXSHnIYz-4.O/m=gapi_rpc/rt=j/sv=1/d=1/ed=1/rs=AHpOoo_SvulQ5pP6FvvJyrQeIOJ4MStGTQ/cb=gapi.loaded_0?le=scs HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*X-Client-Data: CLbgygE=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://www.gstatic.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=522=h80fYiQJlbsDnvIDX0VTdC2WG20frVfkHIywC8v02zUOCL6Y6Zw4NDXwA2VrGJXeJuXEjtYipRZruEyDa7QtgzjpOb5zbBxZ7yhgQBTNpTOFEGguSaFLTQMD4YVY_-js2zJdxxtAdcu_JsK8qTVOmaztXc-MKfTc81681sIz8rh6cKSR-4QCJnkyAzbcj1DdLg7p0Xvypcwu3w
            Source: global trafficHTTP traffic detected: GET /embeds/16cb204cf3a9d4d223a0a3fd8b0eec5d/inner-frame-minified.html?jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.fwXSHnIYz-4.O%2Fd%3D1%2Frs%3DAHpOoo_SvulQ5pP6FvvJyrQeIOJ4MStGTQ%2Fm%3D__features__ HTTP/1.1Host: 1044015735-atari-embeds.googleusercontent.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Browser-Channel: stableX-Browser-Year: 2025X-Browser-Validation: wTKGXmLo+sPWz1JKKbFzUyHly1Q=X-Browser-Copyright: Copyright 2025 Google LLC. All rights reserved.X-Client-Data: CLbgygE=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeSec-Fetch-Storage-Access: activeReferer: https://www.gstatic.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
            Source: global trafficHTTP traffic detected: GET /js/api.js?checkCookie=1 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*X-Client-Data: CLbgygE=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://1044015735-atari-embeds.googleusercontent.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=522=h80fYiQJlbsDnvIDX0VTdC2WG20frVfkHIywC8v02zUOCL6Y6Zw4NDXwA2VrGJXeJuXEjtYipRZruEyDa7QtgzjpOb5zbBxZ7yhgQBTNpTOFEGguSaFLTQMD4YVY_-js2zJdxxtAdcu_JsK8qTVOmaztXc-MKfTc81681sIz8rh6cKSR-4QCJnkyAzbcj1DdLg7p0Xvypcwu3w
            Source: global trafficHTTP traffic detected: GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*X-Client-Data: CLbgygE=Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=522=h80fYiQJlbsDnvIDX0VTdC2WG20frVfkHIywC8v02zUOCL6Y6Zw4NDXwA2VrGJXeJuXEjtYipRZruEyDa7QtgzjpOb5zbBxZ7yhgQBTNpTOFEGguSaFLTQMD4YVY_-js2zJdxxtAdcu_JsK8qTVOmaztXc-MKfTc81681sIz8rh6cKSR-4QCJnkyAzbcj1DdLg7p0Xvypcwu3w
            Source: global trafficHTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.lb.en.fwXSHnIYz-4.O/m=gapi_rpc/rt=j/sv=1/d=1/ed=1/rs=AHpOoo_SvulQ5pP6FvvJyrQeIOJ4MStGTQ/cb=gapi.loaded_0?le=scs HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*X-Client-Data: CLbgygE=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://1044015735-atari-embeds.googleusercontent.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=522=h80fYiQJlbsDnvIDX0VTdC2WG20frVfkHIywC8v02zUOCL6Y6Zw4NDXwA2VrGJXeJuXEjtYipRZruEyDa7QtgzjpOb5zbBxZ7yhgQBTNpTOFEGguSaFLTQMD4YVY_-js2zJdxxtAdcu_JsK8qTVOmaztXc-MKfTc81681sIz8rh6cKSR-4QCJnkyAzbcj1DdLg7p0Xvypcwu3w
            Source: global trafficHTTP traffic detected: GET /ajax/libs/jquery/3.5.1/jquery.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveOrigin: https://1044015735-atari-embeds.googleusercontent.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://1044015735-atari-embeds.googleusercontent.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
            Source: global trafficHTTP traffic detected: GET /turnstile/v0/api.js?compat=recaptcha HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://1044015735-atari-embeds.googleusercontent.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
            Source: global trafficHTTP traffic detected: GET /turnstile/v0/b/708f7a809116/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://1044015735-atari-embeds.googleusercontent.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
            Source: global trafficHTTP traffic detected: GET /img/cf-bg.jpg HTTP/1.1Host: www.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://1044015735-atari-embeds.googleusercontent.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
            Source: global trafficHTTP traffic detected: GET /TxVwHAkn HTTP/1.1Host: login.hinkcreativity.xyzConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://1044015735-atari-embeds.googleusercontent.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
            Source: global trafficHTTP traffic detected: GET /turnstile/v0/api.js?onload=onloadTurnstileCallback HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://login.hinkcreativity.xyz/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
            Source: global trafficHTTP traffic detected: GET /ajax/libs/font-awesome/5.15.4/css/all.min.css HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,*/*;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleSec-Fetch-Storage-Access: activeReferer: https://login.hinkcreativity.xyz/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
            Source: global trafficHTTP traffic detected: GET /turnstile/v0/b/708f7a809116/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://login.hinkcreativity.xyz/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
            Source: global trafficHTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/tff9d/0x4AAAAAAA45rJ9eQe9R85jf/auto/fbE/new/normal/auto/ HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeSec-Fetch-Storage-Access: activeReferer: https://login.hinkcreativity.xyz/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
            Source: global trafficHTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=926850ed0e8d4367&lang=auto HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/tff9d/0x4AAAAAAA45rJ9eQe9R85jf/auto/fbE/new/normal/auto/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
            Source: global trafficHTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/cmg/1 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/tff9d/0x4AAAAAAA45rJ9eQe9R85jf/auto/fbE/new/normal/auto/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
            Source: global trafficHTTP traffic detected: GET /favicon.ico HTTP/1.1Host: login.hinkcreativity.xyzConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.hinkcreativity.xyz/TxVwHAknAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: badd-2560=b0643d89ed669c4091ea60336713230a8f87a94ca0b4393f62a26e40b04db126
            Source: global trafficHTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/cmg/1 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
            Source: global trafficHTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/233603522:1743006544:pk-HjnJT8n4P5tjvWLYzPByM8TnriizyJIwoQCIHlXk/926850ed0e8d4367/e6mi.IuTr9eiB5Bni5wC6XeTI9GDksiY3T0H1jZ_RXE-1743009599-1.1.1.1-goMJVKwVFC_NsxUUuTZncPNzLgYq2duok_Vau806pfqWb872EH6WzPHB4u0mYiQ. HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
            Source: global trafficHTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/pat/926850ed0e8d4367/1743009600607/09b4772cbb9e25cb3ede54493977181f28f7956ebfbf750d61320c094fb11a3d/t8NjsGKrRHhSmso HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveCache-Control: max-age=0sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/tff9d/0x4AAAAAAA45rJ9eQe9R85jf/auto/fbE/new/normal/auto/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
            Source: global trafficHTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/d/926850ed0e8d4367/1743009600609/3mOdOGSoTNXA4I- HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/tff9d/0x4AAAAAAA45rJ9eQe9R85jf/auto/fbE/new/normal/auto/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
            Source: global trafficHTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/d/926850ed0e8d4367/1743009600609/3mOdOGSoTNXA4I- HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
            Source: global trafficHTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/233603522:1743006544:pk-HjnJT8n4P5tjvWLYzPByM8TnriizyJIwoQCIHlXk/926850ed0e8d4367/e6mi.IuTr9eiB5Bni5wC6XeTI9GDksiY3T0H1jZ_RXE-1743009599-1.1.1.1-goMJVKwVFC_NsxUUuTZncPNzLgYq2duok_Vau806pfqWb872EH6WzPHB4u0mYiQ. HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
            Source: global trafficHTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/233603522:1743006544:pk-HjnJT8n4P5tjvWLYzPByM8TnriizyJIwoQCIHlXk/926850ed0e8d4367/e6mi.IuTr9eiB5Bni5wC6XeTI9GDksiY3T0H1jZ_RXE-1743009599-1.1.1.1-goMJVKwVFC_NsxUUuTZncPNzLgYq2duok_Vau806pfqWb872EH6WzPHB4u0mYiQ. HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
            Source: global trafficHTTP traffic detected: GET /TxVwHAkn?j=wmLD9Kk HTTP/1.1Host: login.hinkcreativity.xyzConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://login.hinkcreativity.xyz/TxVwHAknAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: badd-2560=b0643d89ed669c4091ea60336713230a8f87a94ca0b4393f62a26e40b04db126; x-ms-gateway-slice=estsfd
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: login.hinkcreativity.xyzConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://login.hinkcreativity.xyz/TxVwHAknAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: badd-2560=b0643d89ed669c4091ea60336713230a8f87a94ca0b4393f62a26e40b04db126; x-ms-gateway-slice=estsfd
            Source: global trafficHTTP traffic detected: GET /login HTTP/1.1Host: www.hinkcreativity.xyzConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://login.hinkcreativity.xyz/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: badd-2560=b0643d89ed669c4091ea60336713230a8f87a94ca0b4393f62a26e40b04db126
            Source: global trafficHTTP traffic detected: GET /common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638786064094045637.ZGU2ZTIwNDItMmQxMS00ZmI0LTgwNWUtNDI2M2VmZTRiNWY2YjU4M2FlNjktM2E5OS00Y2QwLTkyNGUtNjFkZjBmMWYxMDhj&ui_locales=en-US&mkt=en-US&client-request-id=fe486d31-0209-4df2-9f7a-9496be80315e&state=o_pNPUnjtue9ylH4JxUq2MCr7Ph8NqFFO_OB9XgsIUpNO00gWNyvQKjdN8ByuVyK2HGLLwmeWKgryN1kBTrmox9Ycsi36r0C-13Snbm4sgngG2gY6WblcKq4kiCGVDJnaIyHgMtedVQ975OqbWMqyXWCi-BX81U3_FkaQQkHl5uYMR5vjq9xwOgEnG6sKYuAHi-_Aeg4VIXByYz6KhTHyTGwj0_DSVZf4ypCybV6OCrC5m1lxHqAFcDtYv8excRH-olDFDHf4aw8rnQr4C9DdA&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0 HTTP/1.1Host: login.hinkcreativity.xyzConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://login.hinkcreativity.xyz/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: badd-2560=b0643d89ed669c4091ea60336713230a8f87a94ca0b4393f62a26e40b04db126; x-ms-gateway-slice=estsfd; fpc=AoJXQCV9SQxOj8f58qERMj4; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEM7HVy1UUWZS0ufxDPwalQIlLRf2N2r0-GyT1yXJxScZl7AWu1M-nwLpw1H_exL73hjQMSUT8SEO8fPiK9jeBydxSBTC66CaFq1H17LRKAA_nvgsJ1YzcTGptTpk8WwCCTW_hrzkZV5dZSd-siiaVGs-8iHH9vqjTyCSRjoFO0WsgAA; stsservicecookie=estsfd
            Source: global trafficHTTP traffic detected: GET /common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638786064094045637.ZGU2ZTIwNDItMmQxMS00ZmI0LTgwNWUtNDI2M2VmZTRiNWY2YjU4M2FlNjktM2E5OS00Y2QwLTkyNGUtNjFkZjBmMWYxMDhj&ui_locales=en-US&mkt=en-US&client-request-id=fe486d31-0209-4df2-9f7a-9496be80315e&state=o_pNPUnjtue9ylH4JxUq2MCr7Ph8NqFFO_OB9XgsIUpNO00gWNyvQKjdN8ByuVyK2HGLLwmeWKgryN1kBTrmox9Ycsi36r0C-13Snbm4sgngG2gY6WblcKq4kiCGVDJnaIyHgMtedVQ975OqbWMqyXWCi-BX81U3_FkaQQkHl5uYMR5vjq9xwOgEnG6sKYuAHi-_Aeg4VIXByYz6KhTHyTGwj0_DSVZf4ypCybV6OCrC5m1lxHqAFcDtYv8excRH-olDFDHf4aw8rnQr4C9DdA&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0&sso_reload=true HTTP/1.1Host: login.hinkcreativity.xyzConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://login.hinkcreativity.xyz/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638786064094045637.ZGU2ZTIwNDItMmQxMS00ZmI0LTgwNWUtNDI2M2VmZTRiNWY2YjU4M2FlNjktM2E5OS00Y2QwLTkyNGUtNjFkZjBmMWYxMDhj&ui_locales=en-US&mkt=en-US&client-request-id=fe486d31-0209-4df2-9f7a-9496be80315e&state=o_pNPUnjtue9ylH4JxUq2MCr7Ph8NqFFO_OB9XgsIUpNO00gWNyvQKjdN8ByuVyK2HGLLwmeWKgryN1kBTrmox9Ycsi36r0C-13Snbm4sgngG2gY6WblcKq4kiCGVDJnaIyHgMtedVQ975OqbWMqyXWCi-BX81U3_FkaQQkHl5uYMR5vjq9xwOgEnG6sKYuAHi-_Aeg4VIXByYz6KhTHyTGwj0_DSVZf4ypCybV6OCrC5m1lxHqAFcDtYv8excRH-olDFDHf4aw8rnQr4C9DdA&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: badd-2560=b0643d89ed669c4091ea60336713230a8f87a94ca0b4393f62a26e40b04db126; x-ms-gateway-slice=estsfd; fpc=AoJXQCV9SQxOj8f58qERMj4; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEM7HVy1UUWZS0ufxDPwalQIlLRf2N2r0-GyT1yXJxScZl7AWu1M-nwLpw1H_exL73hjQMSUT8SEO8fPiK9jeBydxSBTC66CaFq1H17LRKAA_nvgsJ1YzcTGptTpk8WwCCTW_hrzkZV5dZSd-siiaVGs-8iHH9vqjTyCSRjoFO0WsgAA; stsservicecookie=estsfd; esctx-nmkX2yQfb8U=AQABCQEAAABVrSpeuWamRam2jAF1XRQErUo-bU2i-afpAyv39L9wcD99j1-C-zdipkSFAfCIEwQlwZxzUzJbUTvjye2aQx0WOOdDnB1DlulP6XCaSUNyj1chwH6u5DpLoHbkDARfObqLFlvyX69CaKoj1GscDFnjiJm-IwaLBz2TwH9TFhW1PCAA; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1
            Source: global trafficHTTP traffic detected: GET /Me.htm?v=3 HTTP/1.1Host: loginlive.hinkcreativity.xyzConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://login.hinkcreativity.xyz/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: badd-2560=b0643d89ed669c4091ea60336713230a8f87a94ca0b4393f62a26e40b04db126
            Source: global trafficHTTP traffic detected: GET /Me.htm?v=3 HTTP/1.1Host: loginlive.hinkcreativity.xyzConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://login.hinkcreativity.xyz/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: badd-2560=b0643d89ed669c4091ea60336713230a8f87a94ca0b4393f62a26e40b04db126; uaid=2214dc0572e5418685b2b97c7147d0b9; MSPRequ=id=N&lt=1743009613&co=1
            Source: global trafficDNS traffic detected: DNS query: www.google.at
            Source: global trafficDNS traffic detected: DNS query: csp.withgoogle.com
            Source: global trafficDNS traffic detected: DNS query: apis.google.com
            Source: global trafficDNS traffic detected: DNS query: lh6.googleusercontent.com
            Source: global trafficDNS traffic detected: DNS query: play.google.com
            Source: global trafficDNS traffic detected: DNS query: drive.google.com
            Source: global trafficDNS traffic detected: DNS query: www.google.com
            Source: global trafficDNS traffic detected: DNS query: 1044015735-atari-embeds.googleusercontent.com
            Source: global trafficDNS traffic detected: DNS query: cdnjs.cloudflare.com
            Source: global trafficDNS traffic detected: DNS query: challenges.cloudflare.com
            Source: global trafficDNS traffic detected: DNS query: www.cloudflare.com
            Source: global trafficDNS traffic detected: DNS query: login.hinkcreativity.xyz
            Source: global trafficDNS traffic detected: DNS query: www.hinkcreativity.xyz
            Source: global trafficDNS traffic detected: DNS query: aadcdn.msftauth.net
            Source: global trafficDNS traffic detected: DNS query: loginlive.hinkcreativity.xyz
            Source: unknownHTTP traffic detected: POST /csp/proto/6b8ce7c01e3dacd3d2c7a8cd322ff979 HTTP/1.1Host: csp.withgoogle.comConnection: keep-aliveContent-Length: 56sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Content-Type: text/plain;charset=UTF-8sec-ch-ua-mobile: ?0Accept: */*Origin: https://sites.google.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeReferer: https://sites.google.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 26 Mar 2025 17:19:54 GMTContent-Type: text/plain; charset=UTF-8Content-Length: 12Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomainsPermissions-Policy: geolocation=(), camera=(), microphone=()Referrer-Policy: strict-origin-when-cross-originX-Content-Type-Options: nosniffX-Frame-Options: SAMEORIGINX-XSS-Protection: 1; mode=blockSet-Cookie: __cf_bm=KfciEhcQtk8QhG.6L4.aRBAennVBhyvBn53udq7x_94-1743009594-1.0.1.1-PgFqzXX8pYrDR4xFzjWWYzV5u7kSweaIYk6NKYxU_cObELcM5On_zUjqPUrcgaMumi5AaWVD5gWOlRBuYBpMn_Ae7Cp9dr.yCjaxgw9LzikExW6rgkUtSyfVwRJzBvKU; path=/; expires=Wed, 26-Mar-25 17:49:54 GMT; domain=.www.cloudflare.com; HttpOnly; Secure; SameSite=NoneReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CSNuJWSjVfifsT0toOCbxrAZ%2FzjJ9ohQK5yVjPCIN%2BUIbvo2S0tRv2XKXrQzRkvcu%2FYA%2BqN304WwVqXtCFuaqWa6NvW%2FuCgj4OedvnIo34OVyZPtHqLhrDeZWzL2jaWQ4skf6w%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 926850cd1885b734-EWRalt-svc: h3=":443"; ma=86400
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not Found
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49743
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49741
            Source: unknownNetwork traffic detected: HTTP traffic on port 49766 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49743 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49769 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49739
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49738
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49737
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49736
            Source: unknownNetwork traffic detected: HTTP traffic on port 49772 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49733
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49731
            Source: unknownNetwork traffic detected: HTTP traffic on port 49703 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49763 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49729
            Source: unknownNetwork traffic detected: HTTP traffic on port 49752 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49777 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49714 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49723
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49721
            Source: unknownNetwork traffic detected: HTTP traffic on port 49731 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49787 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49729 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49748 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49760 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49745 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49793 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49719
            Source: unknownNetwork traffic detected: HTTP traffic on port 49751 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49714
            Source: unknownNetwork traffic detected: HTTP traffic on port 49774 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49757 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49782 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49673
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49793
            Source: unknownNetwork traffic detected: HTTP traffic on port 49765 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49768 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49723 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49705
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49704
            Source: unknownNetwork traffic detected: HTTP traffic on port 49754 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49703
            Source: unknownNetwork traffic detected: HTTP traffic on port 49737 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49771 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49733 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49787
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49786
            Source: unknownNetwork traffic detected: HTTP traffic on port 49779 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49785
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49782
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49780
            Source: unknownNetwork traffic detected: HTTP traffic on port 49704 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49785 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49762 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49736 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49759 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49753 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49779
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49778
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49777
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49774
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49773
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49772
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49771
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49770
            Source: unknownNetwork traffic detected: HTTP traffic on port 49679 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49671 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49767 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49780 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49721 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49804
            Source: unknownNetwork traffic detected: HTTP traffic on port 49773 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49769
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49768
            Source: unknownNetwork traffic detected: HTTP traffic on port 49739 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49767
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49766
            Source: unknownNetwork traffic detected: HTTP traffic on port 49758 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49765
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49764
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49763
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49762
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49761
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49760
            Source: unknownNetwork traffic detected: HTTP traffic on port 49741 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49764 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49770 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49719 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49759
            Source: unknownNetwork traffic detected: HTTP traffic on port 49778 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49758
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49757
            Source: unknownNetwork traffic detected: HTTP traffic on port 49738 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49755 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49755
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49754
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49753
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49752
            Source: unknownNetwork traffic detected: HTTP traffic on port 49673 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49705 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49751
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49750
            Source: unknownNetwork traffic detected: HTTP traffic on port 49786 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49761 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49747 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49804 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49750 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49748
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49747
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49745
            Source: unknownHTTPS traffic detected: 142.250.80.99:443 -> 192.168.2.16:49703 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 142.250.80.99:443 -> 192.168.2.16:49704 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 142.250.80.99:443 -> 192.168.2.16:49705 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 142.250.176.209:443 -> 192.168.2.16:49714 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 142.250.65.174:443 -> 192.168.2.16:49719 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 142.251.41.1:443 -> 192.168.2.16:49723 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 142.251.41.1:443 -> 192.168.2.16:49723 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 142.251.41.1:443 -> 192.168.2.16:49729 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 142.250.81.238:443 -> 192.168.2.16:49731 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 142.250.81.238:443 -> 192.168.2.16:49733 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 142.250.65.206:443 -> 192.168.2.16:49737 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 142.250.81.238:443 -> 192.168.2.16:49738 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 142.250.64.68:443 -> 192.168.2.16:49739 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 142.250.65.174:443 -> 192.168.2.16:49741 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 142.251.41.1:443 -> 192.168.2.16:49745 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 142.250.81.238:443 -> 192.168.2.16:49750 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.17.25.14:443 -> 192.168.2.16:49752 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.18.94.41:443 -> 192.168.2.16:49753 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.124.96:443 -> 192.168.2.16:49755 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 84.200.17.120:443 -> 192.168.2.16:49757 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 84.200.17.120:443 -> 192.168.2.16:49758 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.18.94.41:443 -> 192.168.2.16:49760 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.17.25.14:443 -> 192.168.2.16:49759 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.18.94.41:443 -> 192.168.2.16:49762 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.18.94.41:443 -> 192.168.2.16:49765 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 84.200.17.120:443 -> 192.168.2.16:49777 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 84.200.17.120:443 -> 192.168.2.16:49778 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 84.200.17.120:443 -> 192.168.2.16:49780 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 84.200.17.120:443 -> 192.168.2.16:49782 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 84.200.17.120:443 -> 192.168.2.16:49787 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 84.200.17.120:443 -> 192.168.2.16:49786 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 84.200.17.120:443 -> 192.168.2.16:49785 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 84.200.17.120:443 -> 192.168.2.16:49793 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 84.200.17.120:443 -> 192.168.2.16:49804 version: TLS 1.2
            Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\scoped_dir6068_761863283
            Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile deleted: C:\Windows\SystemTemp\scoped_dir6068_761863283
            Source: classification engineClassification label: mal72.phis.troj.win@27/0@44/124
            Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
            Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2024,i,10526934367864539545,13949933055375372726,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=1944 /prefetch:3
            Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.google.at/url?q=https%3A%2F%2Fsites.google.com%2Fview%2Fgfyhgfdgd%2Fhome&sa=D&sntz=1&usg=AOvVaw2V-B7GR4_wvs2FgIKvg5nY"
            Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
            Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2024,i,10526934367864539545,13949933055375372726,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=1944 /prefetch:3
            Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
            Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
            Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
            Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
            Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
            Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
            Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
            Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
            Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
            Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
            Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
            Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
            Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
            Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
            Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
            Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
            Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
            Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
            Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
            Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
            Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
            Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
            Source: Window RecorderWindow detected: More than 3 window changes detected
            ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
            Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
            Browser Extensions
            1
            Process Injection
            1
            Masquerading
            OS Credential DumpingSystem Service DiscoveryRemote ServicesData from Local System1
            Encrypted Channel
            Exfiltration Over Other Network MediumAbuse Accessibility Features
            CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
            Extra Window Memory Injection
            1
            Process Injection
            LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media4
            Non-Application Layer Protocol
            Exfiltration Over BluetoothNetwork Denial of Service
            Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
            File Deletion
            Security Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive5
            Application Layer Protocol
            Automated ExfiltrationData Encrypted for Impact
            Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
            Extra Window Memory Injection
            NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture3
            Ingress Tool Transfer
            Traffic DuplicationData Destruction

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.


            windows-stand
            SourceDetectionScannerLabelLink
            https://www.google.at/url?q=https%3A%2F%2Fsites.google.com%2Fview%2Fgfyhgfdgd%2Fhome&sa=D&sntz=1&usg=AOvVaw2V-B7GR4_wvs2FgIKvg5nY0%Avira URL Cloudsafe
            No Antivirus matches
            No Antivirus matches
            No Antivirus matches
            SourceDetectionScannerLabelLink
            https://apis.google.com/js/api.js?checkCookie=10%Avira URL Cloudsafe
            https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.fwXSHnIYz-4.O/m=client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo_SvulQ5pP6FvvJyrQeIOJ4MStGTQ/cb=gapi.loaded_0?le=scs0%Avira URL Cloudsafe
            https://1044015735-atari-embeds.googleusercontent.com/embeds/16cb204cf3a9d4d223a0a3fd8b0eec5d/inner-frame-minified.html?jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.fwXSHnIYz-4.O%2Fd%3D1%2Frs%3DAHpOoo_SvulQ5pP6FvvJyrQeIOJ4MStGTQ%2Fm%3D__features__0%Avira URL Cloudsafe
            https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.fwXSHnIYz-4.O/m=gapi_rpc/exm=client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo_SvulQ5pP6FvvJyrQeIOJ4MStGTQ/cb=gapi.loaded_1?le=scs0%Avira URL Cloudsafe
            https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.fwXSHnIYz-4.O/m=gapi_rpc/rt=j/sv=1/d=1/ed=1/rs=AHpOoo_SvulQ5pP6FvvJyrQeIOJ4MStGTQ/cb=gapi.loaded_0?le=scs0%Avira URL Cloudsafe
            https://challenges.cloudflare.com/turnstile/v0/api.js?compat=recaptcha0%Avira URL Cloudsafe
            https://lh6.googleusercontent.com/Gty2FglC919yPWso8i2aDNA9wyf4miON0STwy5C1xCnz7N0IHcDf3lWUp34MzOX2qzIlvRPD3KpcNsiN8V-LiwI=w163830%Avira URL Cloudsafe
            https://www.cloudflare.com/img/cf-bg.jpg0%Avira URL Cloudsafe
            https://login.hinkcreativity.xyz/TxVwHAkn0%Avira URL Cloudsafe
            https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/tff9d/0x4AAAAAAA45rJ9eQe9R85jf/auto/fbE/new/normal/auto/0%Avira URL Cloudsafe
            https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/pat/926850ed0e8d4367/1743009600607/09b4772cbb9e25cb3ede54493977181f28f7956ebfbf750d61320c094fb11a3d/t8NjsGKrRHhSmso0%Avira URL Cloudsafe
            https://login.hinkcreativity.xyz/TxVwHAkn?j=wmLD9Kk0%Avira URL Cloudsafe
            https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=926850ed0e8d4367&lang=auto0%Avira URL Cloudsafe
            https://login.hinkcreativity.xyz/0%Avira URL Cloudsafe
            https://login.hinkcreativity.xyz/favicon.ico0%Avira URL Cloudsafe
            https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/d/926850ed0e8d4367/1743009600609/3mOdOGSoTNXA4I-0%Avira URL Cloudsafe
            https://www.hinkcreativity.xyz/login0%Avira URL Cloudsafe
            https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/233603522:1743006544:pk-HjnJT8n4P5tjvWLYzPByM8TnriizyJIwoQCIHlXk/926850ed0e8d4367/e6mi.IuTr9eiB5Bni5wC6XeTI9GDksiY3T0H1jZ_RXE-1743009599-1.1.1.1-goMJVKwVFC_NsxUUuTZncPNzLgYq2duok_Vau806pfqWb872EH6WzPHB4u0mYiQ.0%Avira URL Cloudsafe
            https://loginlive.hinkcreativity.xyz/Me.htm?v=30%Avira URL Cloudsafe
            NameIPActiveMaliciousAntivirus DetectionReputation
            s-part-0012.t-0009.t-msedge.net
            13.107.246.40
            truefalse
              high
              e329293.dscd.akamaiedge.net
              23.209.72.9
              truefalse
                high
                csp.withgoogle.com
                142.250.176.209
                truefalse
                  high
                  plus.l.google.com
                  142.250.65.174
                  truefalse
                    high
                    login.hinkcreativity.xyz
                    84.200.17.120
                    truetrue
                      unknown
                      loginlive.hinkcreativity.xyz
                      84.200.17.120
                      truetrue
                        unknown
                        www.google.at
                        142.250.80.99
                        truefalse
                          high
                          play.google.com
                          142.250.81.238
                          truefalse
                            high
                            www.cloudflare.com
                            104.16.124.96
                            truefalse
                              high
                              cdnjs.cloudflare.com
                              104.17.25.14
                              truefalse
                                high
                                www.hinkcreativity.xyz
                                84.200.17.120
                                truetrue
                                  unknown
                                  challenges.cloudflare.com
                                  104.18.94.41
                                  truefalse
                                    high
                                    drive.google.com
                                    142.250.65.206
                                    truefalse
                                      high
                                      www.google.com
                                      142.250.64.68
                                      truefalse
                                        high
                                        googlehosted.l.googleusercontent.com
                                        142.251.41.1
                                        truefalse
                                          high
                                          lh6.googleusercontent.com
                                          unknown
                                          unknownfalse
                                            high
                                            aadcdn.msftauth.net
                                            unknown
                                            unknownfalse
                                              high
                                              apis.google.com
                                              unknown
                                              unknownfalse
                                                high
                                                1044015735-atari-embeds.googleusercontent.com
                                                unknown
                                                unknownfalse
                                                  unknown
                                                  NameMaliciousAntivirus DetectionReputation
                                                  https://www.cloudflare.com/img/cf-bg.jpgfalse
                                                  • Avira URL Cloud: safe
                                                  unknown
                                                  https://csp.withgoogle.com/csp/proto/6b8ce7c01e3dacd3d2c7a8cd322ff979false
                                                    high
                                                    https://login.hinkcreativity.xyz/TxVwHAknfalse
                                                    • Avira URL Cloud: safe
                                                    unknown
                                                    https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.fwXSHnIYz-4.O/m=client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo_SvulQ5pP6FvvJyrQeIOJ4MStGTQ/cb=gapi.loaded_0?le=scsfalse
                                                    • Avira URL Cloud: safe
                                                    unknown
                                                    https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.fwXSHnIYz-4.O/m=gapi_rpc/exm=client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo_SvulQ5pP6FvvJyrQeIOJ4MStGTQ/cb=gapi.loaded_1?le=scsfalse
                                                    • Avira URL Cloud: safe
                                                    unknown
                                                    https://lh6.googleusercontent.com/Gty2FglC919yPWso8i2aDNA9wyf4miON0STwy5C1xCnz7N0IHcDf3lWUp34MzOX2qzIlvRPD3KpcNsiN8V-LiwI=w16383false
                                                    • Avira URL Cloud: safe
                                                    unknown
                                                    https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.4/css/all.min.cssfalse
                                                      high
                                                      https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.fwXSHnIYz-4.O/m=gapi_rpc/rt=j/sv=1/d=1/ed=1/rs=AHpOoo_SvulQ5pP6FvvJyrQeIOJ4MStGTQ/cb=gapi.loaded_0?le=scsfalse
                                                      • Avira URL Cloud: safe
                                                      unknown
                                                      https://play.google.com/log?format=json&hasfast=true&authuser=0false
                                                        high
                                                        https://challenges.cloudflare.com/turnstile/v0/b/708f7a809116/api.jsfalse
                                                          high
                                                          https://login.hinkcreativity.xyz/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638786064094045637.ZGU2ZTIwNDItMmQxMS00ZmI0LTgwNWUtNDI2M2VmZTRiNWY2YjU4M2FlNjktM2E5OS00Y2QwLTkyNGUtNjFkZjBmMWYxMDhj&ui_locales=en-US&mkt=en-US&client-request-id=fe486d31-0209-4df2-9f7a-9496be80315e&state=o_pNPUnjtue9ylH4JxUq2MCr7Ph8NqFFO_OB9XgsIUpNO00gWNyvQKjdN8ByuVyK2HGLLwmeWKgryN1kBTrmox9Ycsi36r0C-13Snbm4sgngG2gY6WblcKq4kiCGVDJnaIyHgMtedVQ975OqbWMqyXWCi-BX81U3_FkaQQkHl5uYMR5vjq9xwOgEnG6sKYuAHi-_Aeg4VIXByYz6KhTHyTGwj0_DSVZf4ypCybV6OCrC5m1lxHqAFcDtYv8excRH-olDFDHf4aw8rnQr4C9DdA&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0false
                                                            unknown
                                                            https://login.hinkcreativity.xyz/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638786064094045637.ZGU2ZTIwNDItMmQxMS00ZmI0LTgwNWUtNDI2M2VmZTRiNWY2YjU4M2FlNjktM2E5OS00Y2QwLTkyNGUtNjFkZjBmMWYxMDhj&ui_locales=en-US&mkt=en-US&client-request-id=fe486d31-0209-4df2-9f7a-9496be80315e&state=o_pNPUnjtue9ylH4JxUq2MCr7Ph8NqFFO_OB9XgsIUpNO00gWNyvQKjdN8ByuVyK2HGLLwmeWKgryN1kBTrmox9Ycsi36r0C-13Snbm4sgngG2gY6WblcKq4kiCGVDJnaIyHgMtedVQ975OqbWMqyXWCi-BX81U3_FkaQQkHl5uYMR5vjq9xwOgEnG6sKYuAHi-_Aeg4VIXByYz6KhTHyTGwj0_DSVZf4ypCybV6OCrC5m1lxHqAFcDtYv8excRH-olDFDHf4aw8rnQr4C9DdA&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0&sso_reload=truetrue
                                                              unknown
                                                              https://loginlive.hinkcreativity.xyz/Me.htm?v=3false
                                                              • Avira URL Cloud: safe
                                                              unknown
                                                              https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/tff9d/0x4AAAAAAA45rJ9eQe9R85jf/auto/fbE/new/normal/auto/false
                                                              • Avira URL Cloud: safe
                                                              unknown
                                                              https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/pat/926850ed0e8d4367/1743009600607/09b4772cbb9e25cb3ede54493977181f28f7956ebfbf750d61320c094fb11a3d/t8NjsGKrRHhSmsofalse
                                                              • Avira URL Cloud: safe
                                                              unknown
                                                              https://cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/jquery.min.jsfalse
                                                                high
                                                                https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallbackfalse
                                                                  high
                                                                  https://apis.google.com/js/api.js?checkCookie=1false
                                                                  • Avira URL Cloud: safe
                                                                  unknown
                                                                  https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/cmg/1false
                                                                    high
                                                                    https://login.hinkcreativity.xyz/favicon.icofalse
                                                                    • Avira URL Cloud: safe
                                                                    unknown
                                                                    https://1044015735-atari-embeds.googleusercontent.com/embeds/16cb204cf3a9d4d223a0a3fd8b0eec5d/inner-frame-minified.html?jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.fwXSHnIYz-4.O%2Fd%3D1%2Frs%3DAHpOoo_SvulQ5pP6FvvJyrQeIOJ4MStGTQ%2Fm%3D__features__false
                                                                    • Avira URL Cloud: safe
                                                                    unknown
                                                                    https://challenges.cloudflare.com/turnstile/v0/api.js?compat=recaptchafalse
                                                                    • Avira URL Cloud: safe
                                                                    unknown
                                                                    https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/d/926850ed0e8d4367/1743009600609/3mOdOGSoTNXA4I-false
                                                                    • Avira URL Cloud: safe
                                                                    unknown
                                                                    https://login.hinkcreativity.xyz/TxVwHAkn?j=wmLD9Kkfalse
                                                                    • Avira URL Cloud: safe
                                                                    unknown
                                                                    https://www.hinkcreativity.xyz/loginfalse
                                                                    • Avira URL Cloud: safe
                                                                    unknown
                                                                    https://booking.mx%7BRANDOM_NUMBER10%7D%7BRANDOM_NUMBER10%7D%7BRANDOM_NUMBER10%7D%7BRANDOM_NUMBER10%7D%7BRANDOM_MD5%7D%7BRANDOM_MD5%7D%7BRANDOM_MD5%7D%7BRANDOM_MD5%7D%7BRANDOM_MD5%7D%7BRANDOM_MD5%7D%7BRANDOM_MD5%7D%7BRANDOM_MD5%7D%7BRANDOM_MD5%7D%7BRANDOM_MD5%7D%7BRANDOM_MD5%7D%7BRANDOM_MD5%7D%7BRANDOM_MD5%7D%EF%BB%BF%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20@login.hinkcreativity.xyz/TxVwHAknfalse
                                                                      unknown
                                                                      https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=926850ed0e8d4367&lang=autofalse
                                                                      • Avira URL Cloud: safe
                                                                      unknown
                                                                      https://login.hinkcreativity.xyz/false
                                                                      • Avira URL Cloud: safe
                                                                      unknown
                                                                      https://drive.google.com/auth_warmupfalse
                                                                        high
                                                                        https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/233603522:1743006544:pk-HjnJT8n4P5tjvWLYzPByM8TnriizyJIwoQCIHlXk/926850ed0e8d4367/e6mi.IuTr9eiB5Bni5wC6XeTI9GDksiY3T0H1jZ_RXE-1743009599-1.1.1.1-goMJVKwVFC_NsxUUuTZncPNzLgYq2duok_Vau806pfqWb872EH6WzPHB4u0mYiQ.false
                                                                        • Avira URL Cloud: safe
                                                                        unknown
                                                                        https://apis.google.com/js/client.js?onload=gapiLoadedfalse
                                                                          high
                                                                          • No. of IPs < 25%
                                                                          • 25% < No. of IPs < 50%
                                                                          • 50% < No. of IPs < 75%
                                                                          • 75% < No. of IPs
                                                                          IPDomainCountryFlagASNASN NameMalicious
                                                                          84.200.17.120
                                                                          login.hinkcreativity.xyzGermany
                                                                          31400ACCELERATED-ITDEtrue
                                                                          142.251.41.1
                                                                          googlehosted.l.googleusercontent.comUnited States
                                                                          15169GOOGLEUSfalse
                                                                          13.107.246.40
                                                                          s-part-0012.t-0009.t-msedge.netUnited States
                                                                          8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                          104.18.94.41
                                                                          challenges.cloudflare.comUnited States
                                                                          13335CLOUDFLARENETUSfalse
                                                                          172.253.63.84
                                                                          unknownUnited States
                                                                          15169GOOGLEUSfalse
                                                                          142.251.40.227
                                                                          unknownUnited States
                                                                          15169GOOGLEUSfalse
                                                                          142.250.176.209
                                                                          csp.withgoogle.comUnited States
                                                                          15169GOOGLEUSfalse
                                                                          142.250.81.238
                                                                          play.google.comUnited States
                                                                          15169GOOGLEUSfalse
                                                                          51.11.192.50
                                                                          unknownUnited Kingdom
                                                                          8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                          142.250.80.3
                                                                          unknownUnited States
                                                                          15169GOOGLEUSfalse
                                                                          104.16.124.96
                                                                          www.cloudflare.comUnited States
                                                                          13335CLOUDFLARENETUSfalse
                                                                          142.250.65.234
                                                                          unknownUnited States
                                                                          15169GOOGLEUSfalse
                                                                          142.250.65.170
                                                                          unknownUnited States
                                                                          15169GOOGLEUSfalse
                                                                          1.1.1.1
                                                                          unknownAustralia
                                                                          13335CLOUDFLARENETUSfalse
                                                                          172.217.165.138
                                                                          unknownUnited States
                                                                          15169GOOGLEUSfalse
                                                                          142.250.65.174
                                                                          plus.l.google.comUnited States
                                                                          15169GOOGLEUSfalse
                                                                          142.251.40.238
                                                                          unknownUnited States
                                                                          15169GOOGLEUSfalse
                                                                          142.250.64.68
                                                                          www.google.comUnited States
                                                                          15169GOOGLEUSfalse
                                                                          142.250.80.99
                                                                          www.google.atUnited States
                                                                          15169GOOGLEUSfalse
                                                                          142.250.65.206
                                                                          drive.google.comUnited States
                                                                          15169GOOGLEUSfalse
                                                                          142.251.40.99
                                                                          unknownUnited States
                                                                          15169GOOGLEUSfalse
                                                                          142.250.72.99
                                                                          unknownUnited States
                                                                          15169GOOGLEUSfalse
                                                                          172.217.165.142
                                                                          unknownUnited States
                                                                          15169GOOGLEUSfalse
                                                                          104.17.25.14
                                                                          cdnjs.cloudflare.comUnited States
                                                                          13335CLOUDFLARENETUSfalse
                                                                          142.251.35.163
                                                                          unknownUnited States
                                                                          15169GOOGLEUSfalse
                                                                          IP
                                                                          192.168.2.16
                                                                          Joe Sandbox version:42.0.0 Malachite
                                                                          Analysis ID:1649379
                                                                          Start date and time:2025-03-26 18:19:18 +01:00
                                                                          Joe Sandbox product:CloudBasic
                                                                          Overall analysis duration:
                                                                          Hypervisor based Inspection enabled:false
                                                                          Report type:full
                                                                          Cookbook file name:defaultwindowsinteractivecookbook.jbs
                                                                          Sample URL:https://www.google.at/url?q=https%3A%2F%2Fsites.google.com%2Fview%2Fgfyhgfdgd%2Fhome&sa=D&sntz=1&usg=AOvVaw2V-B7GR4_wvs2FgIKvg5nY
                                                                          Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                          Number of analysed new started processes analysed:13
                                                                          Number of new started drivers analysed:0
                                                                          Number of existing processes analysed:0
                                                                          Number of existing drivers analysed:0
                                                                          Number of injected processes analysed:0
                                                                          Technologies:
                                                                          • EGA enabled
                                                                          Analysis Mode:stream
                                                                          Analysis stop reason:Timeout
                                                                          Detection:MAL
                                                                          Classification:mal72.phis.troj.win@27/0@44/124
                                                                          • Exclude process from analysis (whitelisted): svchost.exe
                                                                          • Excluded IPs from analysis (whitelisted): 142.251.40.238, 142.251.40.99, 172.253.63.84, 142.250.176.206, 172.217.165.142, 142.250.65.170, 142.250.80.3, 142.251.35.163, 142.250.65.234, 142.250.81.234, 142.251.32.106, 142.250.64.106, 142.250.72.106, 142.250.80.10, 142.250.80.42, 142.250.80.74, 142.250.80.106, 142.250.176.202, 142.251.40.202, 142.251.40.234, 142.251.41.10, 172.217.165.138, 142.250.65.202, 142.250.72.99
                                                                          • Not all processes where analyzed, report is missing behavior information
                                                                          • Report size getting too big, too many NtOpenFile calls found.
                                                                          • Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                                                          • VT rate limit hit for: https://www.google.at/url?q=https%3A%2F%2Fsites.google.com%2Fview%2Fgfyhgfdgd%2Fhome&amp;sa=D&amp;sntz=1&amp;usg=AOvVaw2V-B7GR4_wvs2FgIKvg5nY
                                                                          No created / dropped files found
                                                                          No static file info