Edit tour

Windows Analysis Report
https://docs.google.com/presentation/d/e/2PACX-1vQ7Dkd_WRbgSfshqD4oLNlUmDxTYPUSUb2tLr0qsjIwZ7fwYeWMIoyLCuLiIiL3T8QaBj2et0IIqqkz/pub?start=false&loop=false&delayms=3000

Overview

General Information

Sample URL:	https://docs.google.com/presentation/d/e/2PACX-1vQ7Dkd_WRbgSfshqD4oLNlUmDxTYPUSUb2tLr0qsjIwZ7fwYeWMIoyLCuLiIiL3T8QaBj2et0IIqqkz/pub?start=false&loop=false&delayms=3000
Analysis ID:	1654640
Infos:

Detection

HTMLPhisher, ReCaptcha Phish

Score:	88
Range:	0 - 100
Confidence:	100%

Signatures

AI detected phishing page

Yara detected HtmlPhish45

Yara detected HtmlPhish54

Yara detected Recaptcha Phish

AI detected landing page (webpage, office document or email)

AI detected suspicious Javascript

Performs DNS queries to domains with low reputation

Phishing site or detected (based on various text indicators)

Creates files inside the system directory

Deletes files inside the Windows folder

HTML body contains low number of good links

HTML page contains string obfuscation

HTML title does not match URL

Classification

Process Tree

System is w10x64

chrome.exe (PID: 4900 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 5996 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1724,i,6665872760245968715,17813975207059206959,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7052 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://docs.google.com/presentation/d/e/2PACX-1vQ7Dkd_WRbgSfshqD4oLNlUmDxTYPUSUb2tLr0qsjIwZ7fwYeWMIoyLCuLiIiL3T8QaBj2et0IIqqkz/pub?start=false&loop=false&delayms=3000" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
dropped/chromecache_107	JoeSecurity_ReCaptchaPhish	Yara detected Recaptcha Phish	Joe Security

HTML

Source	Rule	Description	Author
3.38..script.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
4.48..script.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
2.2.pages.csv	JoeSecurity_ReCaptchaPhish	Yara detected Recaptcha Phish	Joe Security
2.5.pages.csv	JoeSecurity_ReCaptchaPhish	Yara detected Recaptcha Phish	Joe Security
4.14.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
3.12.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
4.13.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
4.16.pages.csv	JoeSecurity_HtmlPhish_45	Yara detected HtmlPhish_45	Joe Security
4.16.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
2.4.pages.csv	JoeSecurity_ReCaptchaPhish	Yara detected Recaptcha Phish	Joe Security
Click to see the 5 entries

Source: https://xofu8.wpym.xyz/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=d3f010eb-0335-4544-92e3-80e46926cd37&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638791917658115408.98d69f9d-eb1e-4f52-a2fd-c0535c45e2c9&state=DctLFoAgCEBRrNNySFERWI75mTZs-zG4b_YCAJzucCF5QFpRMTKSxkrENeltOpttm7geWlg3Z-x5TxyJC4_KKw8L_l7x_Xr8AQ&sso_reload=true

Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is classified as 'wellknown'., The legitimate domain for Microsoft is 'microsoft.com'., The provided URL 'xofu8.wpym.xyz' does not match the legitimate domain for Microsoft., The URL uses a non-standard domain extension '.xyz', which is often used in phishing attempts., The URL contains random characters 'xofu8' and 'wpym', which do not relate to Microsoft and are suspicious., The presence of input fields for 'Email, phone, or Skype' is typical for phishing sites targeting Microsoft accounts. DOM: 4.16.pages.csv

Yara detected HtmlPhish45

Source: Yara match

File source: 4.16.pages.csv, type: HTML

Yara detected HtmlPhish54

Source: Yara match	File source: 3.38..script.csv, type: HTML
Source: Yara match	File source: 4.48..script.csv, type: HTML
Source: Yara match	File source: 4.14.pages.csv, type: HTML
Source: Yara match	File source: 3.12.pages.csv, type: HTML
Source: Yara match	File source: 4.13.pages.csv, type: HTML
Source: Yara match	File source: 4.16.pages.csv, type: HTML

Yara detected Recaptcha Phish

Source: Yara match	File source: 2.2.pages.csv, type: HTML
Source: Yara match	File source: 2.5.pages.csv, type: HTML
Source: Yara match	File source: 2.4.pages.csv, type: HTML
Source: Yara match	File source: dropped/chromecache_107, type: DROPPED

AI detected landing page (webpage, office document or email)

Source: https://docs.google.com/presentation/d/e/2PACX-1vQ7Dkd_WRbgSfshqD4oLNlUmDxTYPUSUb2tLr0qsjIwZ7fwYeWMIoyLCuLiIiL3T8QaBj2et0IIqqkz/pub?start=false&loop=false&delayms=3000&slide=id.p

Joe Sandbox AI: Page contains button: 'Download Files' Source: '1.0.pages.csv'

AI detected suspicious Javascript

Source: 2.24..script.csv

Joe Sandbox AI: Detected suspicious JavaScript with source url: https://meheff.wpym.xyz/nrColMBN... This script exhibits high-risk behavior by using obfuscated code to redirect the user to an unknown domain, which is a common tactic for phishing or malware distribution. The use of the 'window.location.assign' function to redirect the user to a suspicious URL with encoded components is a strong indicator of malicious intent.

Phishing site or detected (based on various text indicators)

Source: Chrome DOM: 2.5

OCR Text: Outlook is lagging you out. We need to verify your identity. Please re-lagin to your account Verifying... CLOUDFLARE Performance & security by Microsoft

HTTP Parser: Number of links: 0

Source: https://meheff.wpym.xyz/nrColMBN

HTTP Parser: Found new string: script ...var verifyCallback_CF = function (response) {. console.log("verified");. window.location.assign('htt' + 'p' + 's:/' + '/' + 'me' + 'h' + 'ef' + 'f.w' + 'py' + 'm' + '.xy' + 'z/n' + 'r' + 'Col' + 'MBN' + '?k' + '=' + 'NXL' + 'G' + '8A0');. };.....

HTTP Parser: Title: Sign in to Outlook does not match URL

Source: https://xofu8.wpym.xyz/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=d3f010eb-0335-4544-92e3-80e46926cd37&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638791917658115408.98d69f9d-eb1e-4f52-a2fd-c0535c45e2c9&state=DctLFoAgCEBRrNNySFERWI75mTZs-zG4b_YCAJzucCF5QFpRMTKSxkrENeltOpttm7geWlg3Z-x5TxyJC4_KKw8L_l7x_Xr8AQ&sso_reload=true	HTTP Parser: Iframe src: https://mejeff.wpym.xyz/owa/prefetch.aspx
Source: https://xofu8.wpym.xyz/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=d3f010eb-0335-4544-92e3-80e46926cd37&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638791917658115408.98d69f9d-eb1e-4f52-a2fd-c0535c45e2c9&state=DctLFoAgCEBRrNNySFERWI75mTZs-zG4b_YCAJzucCF5QFpRMTKSxkrENeltOpttm7geWlg3Z-x5TxyJC4_KKw8L_l7x_Xr8AQ&sso_reload=true	HTTP Parser: Iframe src: https://mejeff.wpym.xyz/owa/prefetch.aspx

HTTP Parser: <input type="password" .../> found

Source: https://meheff.wpym.xyz/nrColMBN	HTTP Parser: No favicon
Source: https://meheff.wpym.xyz/nrColMBN	HTTP Parser: No favicon
Source: https://meheff.wpym.xyz/nrColMBN	HTTP Parser: No favicon
Source: https://meheff.wpym.xyz/nrColMBN	HTTP Parser: No favicon
Source: https://meheff.wpym.xyz/nrColMBN	HTTP Parser: No favicon
Source: https://xofu8.wpym.xyz/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=d3f010eb-0335-4544-92e3-80e46926cd37&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638791917658115408.98d69f9d-eb1e-4f52-a2fd-c0535c45e2c9&state=DctLFoAgCEBRrNNySFERWI75mTZs-zG4b_YCAJzucCF5QFpRMTKSxkrENeltOpttm7geWlg3Z-x5TxyJC4_KKw8L_l7x_Xr8AQ	HTTP Parser: No favicon

Source: https://xofu8.wpym.xyz/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=d3f010eb-0335-4544-92e3-80e46926cd37&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638791917658115408.98d69f9d-eb1e-4f52-a2fd-c0535c45e2c9&state=DctLFoAgCEBRrNNySFERWI75mTZs-zG4b_YCAJzucCF5QFpRMTKSxkrENeltOpttm7geWlg3Z-x5TxyJC4_KKw8L_l7x_Xr8AQ&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://xofu8.wpym.xyz/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=d3f010eb-0335-4544-92e3-80e46926cd37&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638791917658115408.98d69f9d-eb1e-4f52-a2fd-c0535c45e2c9&state=DctLFoAgCEBRrNNySFERWI75mTZs-zG4b_YCAJzucCF5QFpRMTKSxkrENeltOpttm7geWlg3Z-x5TxyJC4_KKw8L_l7x_Xr8AQ&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://xofu8.wpym.xyz/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=d3f010eb-0335-4544-92e3-80e46926cd37&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638791917658115408.98d69f9d-eb1e-4f52-a2fd-c0535c45e2c9&state=DctLFoAgCEBRrNNySFERWI75mTZs-zG4b_YCAJzucCF5QFpRMTKSxkrENeltOpttm7geWlg3Z-x5TxyJC4_KKw8L_l7x_Xr8AQ&sso_reload=true	HTTP Parser: No <meta name="author".. found

Source: https://xofu8.wpym.xyz/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=d3f010eb-0335-4544-92e3-80e46926cd37&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638791917658115408.98d69f9d-eb1e-4f52-a2fd-c0535c45e2c9&state=DctLFoAgCEBRrNNySFERWI75mTZs-zG4b_YCAJzucCF5QFpRMTKSxkrENeltOpttm7geWlg3Z-x5TxyJC4_KKw8L_l7x_Xr8AQ&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://xofu8.wpym.xyz/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=d3f010eb-0335-4544-92e3-80e46926cd37&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638791917658115408.98d69f9d-eb1e-4f52-a2fd-c0535c45e2c9&state=DctLFoAgCEBRrNNySFERWI75mTZs-zG4b_YCAJzucCF5QFpRMTKSxkrENeltOpttm7geWlg3Z-x5TxyJC4_KKw8L_l7x_Xr8AQ&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://xofu8.wpym.xyz/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=d3f010eb-0335-4544-92e3-80e46926cd37&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638791917658115408.98d69f9d-eb1e-4f52-a2fd-c0535c45e2c9&state=DctLFoAgCEBRrNNySFERWI75mTZs-zG4b_YCAJzucCF5QFpRMTKSxkrENeltOpttm7geWlg3Z-x5TxyJC4_KKw8L_l7x_Xr8AQ&sso_reload=true	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 142.251.167.104:443 -> 192.168.2.6:49697 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.251.40.110:443 -> 192.168.2.6:49698 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.251.41.1:443 -> 192.168.2.6:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.251.40.110:443 -> 192.168.2.6:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.251.40.193:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.95.41:443 -> 192.168.2.6:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.95.41:443 -> 192.168.2.6:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.19.230.21:443 -> 192.168.2.6:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.94.41:443 -> 192.168.2.6:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.19.229.21:443 -> 192.168.2.6:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.94.41:443 -> 192.168.2.6:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.19.230.21:443 -> 192.168.2.6:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.19.230.21:443 -> 192.168.2.6:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.94.41:443 -> 192.168.2.6:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.209.72.31:443 -> 192.168.2.6:49783 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.55.235.240:443 -> 192.168.2.6:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49799 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49798 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.209.72.206:443 -> 192.168.2.6:49803 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49804 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49808 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49809 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49811 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49816 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49818 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49819 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49817 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49814 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49821 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.72.110:443 -> 192.168.2.6:49824 version: TLS 1.2

Networking

Performs DNS queries to domains with low reputation

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: meheff.wpym.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: meheff.wpym.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: meheff.wpym.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: meheff.wpym.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: meheff.wpym.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: meheff.wpym.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: mejeff.wpym.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: mejeff.wpym.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: mejeff.wpym.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: xofu8.wpym.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: xofu8.wpym.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: jrhte.wpym.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: jrhte.wpym.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: htejre.wpym.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: htejre.wpym.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: hrvetbr.wpym.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: hrvetbr.wpym.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: xofu8.wpym.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: xofu8.wpym.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: htejre.wpym.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: htejre.wpym.xyz

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.99
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.99
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.99
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.99
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.99
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.215
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.215
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.99
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.99
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /presentation/d/e/2PACX-1vQ7Dkd_WRbgSfshqD4oLNlUmDxTYPUSUb2tLr0qsjIwZ7fwYeWMIoyLCuLiIiL3T8QaBj2et0IIqqkz/pub?start=false&loop=false&delayms=3000 HTTP/1.1Host: docs.google.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Browser-Channel: stableX-Browser-Year: 2025X-Browser-Validation: wTKGXmLo+sPWz1JKKbFzUyHly1Q=X-Browser-Copyright: Copyright 2025 Google LLC. All rights reserved.X-Client-Data: CO6MywE=Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/presentation/client/css/4105792792-viewer_css_ltr.css HTTP/1.1Host: docs.google.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1X-Client-Data: CO6MywE=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://docs.google.com/presentation/d/e/2PACX-1vQ7Dkd_WRbgSfshqD4oLNlUmDxTYPUSUb2tLr0qsjIwZ7fwYeWMIoyLCuLiIiL3T8QaBj2et0IIqqkz/pub?start=false&loop=false&delayms=3000Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=522=JLEqbqBzyEKyaFeMjriwHG0jyctQIODOa69zzL-GqkCCAV77XkzhK73WM-GrFqNFu9GXYOrB_Cq0fyWgNFw71PUfDyA1jcOh1sghls_Ypkqn2v2-EU0tBDm1nuR2tuljWZA72G-mtsLlJZ5FqRTDUbBd4HJOZCHhfKN6fjTs56ce1rKDO8X1tCJ8yrnifKF7rUNdOp4; GFE_RTT=224
Source: global traffic	HTTP traffic detected: GET /slidesz/AGV_vUdJaErXIJ55hdglvmfjSbJPFW0UxlncOXEIeukK-lpE_5EJ5uh5BaYVcdj_q3_TnTKD5vNdF46nR-OTR94Q5CLCKQzl6Xf2hHM67TsVRaoPZt4GNZxhtsR6gY_0XQ6UqZk=s2048?key=0T76xXlufg2HBrV9SVPofq1l HTTP/1.1Host: lh7-rt.googleusercontent.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CO6MywE=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://docs.google.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/presentation/client/js/1573492039-viewer_integrated_core.js HTTP/1.1Host: docs.google.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /X-Client-Data: CO6MywE=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://docs.google.com/presentation/d/e/2PACX-1vQ7Dkd_WRbgSfshqD4oLNlUmDxTYPUSUb2tLr0qsjIwZ7fwYeWMIoyLCuLiIiL3T8QaBj2et0IIqqkz/pub?start=false&loop=false&delayms=3000Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=522=JLEqbqBzyEKyaFeMjriwHG0jyctQIODOa69zzL-GqkCCAV77XkzhK73WM-GrFqNFu9GXYOrB_Cq0fyWgNFw71PUfDyA1jcOh1sghls_Ypkqn2v2-EU0tBDm1nuR2tuljWZA72G-mtsLlJZ5FqRTDUbBd4HJOZCHhfKN6fjTs56ce1rKDO8X1tCJ8yrnifKF7rUNdOp4; GFE_RTT=224
Source: global traffic	HTTP traffic detected: GET /slidesz/AGV_vUdJaErXIJ55hdglvmfjSbJPFW0UxlncOXEIeukK-lpE_5EJ5uh5BaYVcdj_q3_TnTKD5vNdF46nR-OTR94Q5CLCKQzl6Xf2hHM67TsVRaoPZt4GNZxhtsR6gY_0XQ6UqZk=s2048?key=0T76xXlufg2HBrV9SVPofq1l HTTP/1.1Host: lh7-rt.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /X-Client-Data: CO6MywE=Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/presentation/client/js/1568806778-punch_viewer_worker_binary_viewercore.js HTTP/1.1Host: docs.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /X-Client-Data: CO6MywE=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=522=JLEqbqBzyEKyaFeMjriwHG0jyctQIODOa69zzL-GqkCCAV77XkzhK73WM-GrFqNFu9GXYOrB_Cq0fyWgNFw71PUfDyA1jcOh1sghls_Ypkqn2v2-EU0tBDm1nuR2tuljWZA72G-mtsLlJZ5FqRTDUbBd4HJOZCHhfKN6fjTs56ce1rKDO8X1tCJ8yrnifKF7rUNdOp4
Source: global traffic	HTTP traffic detected: GET /static/presentation/client/js/907711159-viewer_integrated_secondary.js HTTP/1.1Host: docs.google.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /X-Client-Data: CO6MywE=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://docs.google.com/presentation/d/e/2PACX-1vQ7Dkd_WRbgSfshqD4oLNlUmDxTYPUSUb2tLr0qsjIwZ7fwYeWMIoyLCuLiIiL3T8QaBj2et0IIqqkz/pub?start=false&loop=false&delayms=3000&slide=id.pAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=522=JLEqbqBzyEKyaFeMjriwHG0jyctQIODOa69zzL-GqkCCAV77XkzhK73WM-GrFqNFu9GXYOrB_Cq0fyWgNFw71PUfDyA1jcOh1sghls_Ypkqn2v2-EU0tBDm1nuR2tuljWZA72G-mtsLlJZ5FqRTDUbBd4HJOZCHhfKN6fjTs56ce1rKDO8X1tCJ8yrnifKF7rUNdOp4
Source: global traffic	HTTP traffic detected: GET /static/presentation/client/js/764277182-viewer_integrated_help.js HTTP/1.1Host: docs.google.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /X-Client-Data: CO6MywE=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://docs.google.com/presentation/d/e/2PACX-1vQ7Dkd_WRbgSfshqD4oLNlUmDxTYPUSUb2tLr0qsjIwZ7fwYeWMIoyLCuLiIiL3T8QaBj2et0IIqqkz/pub?start=false&loop=false&delayms=3000&slide=id.pAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=522=bhb5wswndd5rkgRSravDVvW6lkZW7W6ficPF1LcfwWew60Y676Dkbbk0LouixBlVQAqog5wegSxGfF2GjeBjrMFgoRP_44_7Z8biOG2FCXIQ3J71CGQs2_KfyBu6rjJLWkqXZOXyhopQTQr53npagBXKevTUI1U3gykH6qnFMPAt9N6DfKdQe-R8FoKiLhGSX9TVwBntosJ1pzs
Source: global traffic	HTTP traffic detected: GET /presentation/manifest.json HTTP/1.1Host: docs.google.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /X-Client-Data: CO6MywE=Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: manifestReferer: https://docs.google.com/presentation/d/e/2PACX-1vQ7Dkd_WRbgSfshqD4oLNlUmDxTYPUSUb2tLr0qsjIwZ7fwYeWMIoyLCuLiIiL3T8QaBj2et0IIqqkz/pub?start=false&loop=false&delayms=3000&slide=id.pAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=522=bhb5wswndd5rkgRSravDVvW6lkZW7W6ficPF1LcfwWew60Y676Dkbbk0LouixBlVQAqog5wegSxGfF2GjeBjrMFgoRP_44_7Z8biOG2FCXIQ3J71CGQs2_KfyBu6rjJLWkqXZOXyhopQTQr53npagBXKevTUI1U3gykH6qnFMPAt9N6DfKdQe-R8FoKiLhGSX9TVwBntosJ1pzs
Source: global traffic	HTTP traffic detected: GET /nrColMBN HTTP/1.1Host: meheff.wpym.xyzConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://docs.google.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/api.js?onload=onloadTurnstileCallback HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://meheff.wpym.xyz/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/b/708f7a809116/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://meheff.wpym.xyz/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /1/api.js HTTP/1.1Host: js.hcaptcha.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://meheff.wpym.xyz/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/r4wwa/0x4AAAAAAA2ptl9BKcGk2BB2/auto/fbE/new/normal/auto/ HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeSec-Fetch-Storage-Access: activeReferer: https://meheff.wpym.xyz/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/cmg/1 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/r4wwa/0x4AAAAAAA2ptl9BKcGk2BB2/auto/fbE/new/normal/auto/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=92a02388286d2361&lang=auto HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/r4wwa/0x4AAAAAAA2ptl9BKcGk2BB2/auto/fbE/new/normal/auto/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /captcha/v1/c1e11bfffe54019b36ca486d59d75ea65128f510/static/hcaptcha.html HTTP/1.1Host: newassets.hcaptcha.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeSec-Fetch-Storage-Access: activeReferer: https://meheff.wpym.xyz/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/cmg/1 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: meheff.wpym.xyzConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://meheff.wpym.xyz/nrColMBNAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: 68ba-73d6=5964312a968d5bf8b4112aeb76102c73361c8cf272c7006e3e95435506daf19e
Source: global traffic	HTTP traffic detected: GET /c/5fef759e34a955dd56ceddd805e6a87d3f7d854c8c695bf797d43331bebfee3f/hsw.js HTTP/1.1Host: newassets.hcaptcha.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://newassets.hcaptcha.com/captcha/v1/c1e11bfffe54019b36ca486d59d75ea65128f510/static/hcaptcha.htmlAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /checksiteconfig?v=c1e11bfffe54019b36ca486d59d75ea65128f510&host=meheff.wpym.xyz&sitekey=234adb2f-52ba-4697-82fa-abecbb14b173&sc=1&swa=1&spst=1 HTTP/1.1Host: api.hcaptcha.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /owa/favicon.ico HTTP/1.1Host: meheff.wpym.xyzConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://meheff.wpym.xyz/nrColMBNAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: 68ba-73d6=5964312a968d5bf8b4112aeb76102c73361c8cf272c7006e3e95435506daf19e
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/1212442583:1743593607:vEnn6mwQ95ke5K7PKXFGNwLCtODIADibp6QTenEhzhc/92a02388286d2361/syp_.SEti7486WnCqG9gsMLBHxYvSA_rvMrkUrBK2Co-1743594942-1.1.1.1-hiZdP5cCpXDZqZ5jFX1duCsIUIGCXFylZ7JqyH8T8R3WvmVSUwC0qzbDeMX9EL9M HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/d/92a02388286d2361/1743594953422/F44c2OL12PSq6bA HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/r4wwa/0x4AAAAAAA2ptl9BKcGk2BB2/auto/fbE/new/normal/auto/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/d/92a02388286d2361/1743594953422/F44c2OL12PSq6bA HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/pat/92a02388286d2361/1743594953425/c8ded0a11fbdbd541bb4fe88002a6f25458edfbafd114552db4fe9412006050a/ZD5VGc0O47vH_tR HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveCache-Control: max-age=0sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/r4wwa/0x4AAAAAAA2ptl9BKcGk2BB2/auto/fbE/new/normal/auto/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /owa/favicon.ico HTTP/1.1Host: meheff.wpym.xyzConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: 68ba-73d6=5964312a968d5bf8b4112aeb76102c73361c8cf272c7006e3e95435506daf19e; ClientId=1F6FD9E23EA648BAA1B3CD86A897DC75; OIDC=1
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/1212442583:1743593607:vEnn6mwQ95ke5K7PKXFGNwLCtODIADibp6QTenEhzhc/92a02388286d2361/syp_.SEti7486WnCqG9gsMLBHxYvSA_rvMrkUrBK2Co-1743594942-1.1.1.1-hiZdP5cCpXDZqZ5jFX1duCsIUIGCXFylZ7JqyH8T8R3WvmVSUwC0qzbDeMX9EL9M HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /nrColMBN?k=NXLG8A0 HTTP/1.1Host: meheff.wpym.xyzConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://meheff.wpym.xyz/nrColMBNAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: 68ba-73d6=5964312a968d5bf8b4112aeb76102c73361c8cf272c7006e3e95435506daf19e; ClientId=1F6FD9E23EA648BAA1B3CD86A897DC75; OIDC=1
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/1212442583:1743593607:vEnn6mwQ95ke5K7PKXFGNwLCtODIADibp6QTenEhzhc/92a02388286d2361/syp_.SEti7486WnCqG9gsMLBHxYvSA_rvMrkUrBK2Co-1743594942-1.1.1.1-hiZdP5cCpXDZqZ5jFX1duCsIUIGCXFylZ7JqyH8T8R3WvmVSUwC0qzbDeMX9EL9M HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /owa/ HTTP/1.1Host: mejeff.wpym.xyzConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://meheff.wpym.xyz/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: 68ba-73d6=5964312a968d5bf8b4112aeb76102c73361c8cf272c7006e3e95435506daf19e
Source: global traffic	HTTP traffic detected: GET /common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=d3f010eb-0335-4544-92e3-80e46926cd37&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638791917658115408.98d69f9d-eb1e-4f52-a2fd-c0535c45e2c9&state=DctLFoAgCEBRrNNySFERWI75mTZs-zG4b_YCAJzucCF5QFpRMTKSxkrENeltOpttm7geWlg3Z-x5TxyJC4_KKw8L_l7x_Xr8AQ HTTP/1.1Host: xofu8.wpym.xyzConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://meheff.wpym.xyz/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: 68ba-73d6=5964312a968d5bf8b4112aeb76102c73361c8cf272c7006e3e95435506daf19e
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/BssoInterrupt_Core_9810YxmrLqOR1rQ4anyNMg2.js HTTP/1.1Host: jrhte.wpym.xyzConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://xofu8.wpym.xyz/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: 68ba-73d6=5964312a968d5bf8b4112aeb76102c73361c8cf272c7006e3e95435506daf19e
Source: global traffic	HTTP traffic detected: GET /common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=d3f010eb-0335-4544-92e3-80e46926cd37&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638791917658115408.98d69f9d-eb1e-4f52-a2fd-c0535c45e2c9&state=DctLFoAgCEBRrNNySFERWI75mTZs-zG4b_YCAJzucCF5QFpRMTKSxkrENeltOpttm7geWlg3Z-x5TxyJC4_KKw8L_l7x_Xr8AQ&sso_reload=true HTTP/1.1Host: xofu8.wpym.xyzConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://xofu8.wpym.xyz/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=d3f010eb-0335-4544-92e3-80e46926cd37&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638791917658115408.98d69f9d-eb1e-4f52-a2fd-c0535c45e2c9&state=DctLFoAgCEBRrNNySFERWI75mTZs-zG4b_YCAJzucCF5QFpRMTKSxkrENeltOpttm7geWlg3Z-x5TxyJC4_KKw8L_l7x_Xr8AQAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: 68ba-73d6=5964312a968d5bf8b4112aeb76102c73361c8cf272c7006e3e95435506daf19e; esctx-85oIgnoPw48=AQABCQEAAABVrSpeuWamRam2jAF1XRQEX9GMKaQ6jbGYSngESuBwI3yclzH1AW8o80rTD5S7JSIsfKWkP0L_vHfLJ5KanzkJvW1ahNDqz6BTUlaV24l7GJMKyu6vfuK55DAQOpz-x3YKMX2w-22JjZ9iwiVDrVyd7rA8i3_7a0XFT16YM1mPxSAA; fpc=Al_Hmr0PvYNEokv2dfrKwy4; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEbFR-Sdsw57h_pTIto1pc51RTPZ2RvAgvOFMtgnkDjMAM2F9hOWBd3NhYdlTWwWPun-4yQlmF3oPrmnMeK21mmDcWtMKp9YiCIxl5tE5FCMjnxWu6ZEPMhOQcGR8g-PUydOW54amwmo2_yL5Xb23oheWB1xVYZg5hfyqIY50xGSsgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: xofu8.wpym.xyzConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://xofu8.wpym.xyz/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=d3f010eb-0335-4544-92e3-80e46926cd37&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638791917658115408.98d69f9d-eb1e-4f52-a2fd-c0535c45e2c9&state=DctLFoAgCEBRrNNySFERWI75mTZs-zG4b_YCAJzucCF5QFpRMTKSxkrENeltOpttm7geWlg3Z-x5TxyJC4_KKw8L_l7x_Xr8AQAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: 68ba-73d6=5964312a968d5bf8b4112aeb76102c73361c8cf272c7006e3e95435506daf19e; esctx-85oIgnoPw48=AQABCQEAAABVrSpeuWamRam2jAF1XRQEX9GMKaQ6jbGYSngESuBwI3yclzH1AW8o80rTD5S7JSIsfKWkP0L_vHfLJ5KanzkJvW1ahNDqz6BTUlaV24l7GJMKyu6vfuK55DAQOpz-x3YKMX2w-22JjZ9iwiVDrVyd7rA8i3_7a0XFT16YM1mPxSAA; fpc=Al_Hmr0PvYNEokv2dfrKwy4; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEbFR-Sdsw57h_pTIto1pc51RTPZ2RvAgvOFMtgnkDjMAM2F9hOWBd3NhYdlTWwWPun-4yQlmF3oPrmnMeK21mmDcWtMKp9YiCIxl5tE5FCMjnxWu6ZEPMhOQcGR8g-PUydOW54amwmo2_yL5Xb23oheWB1xVYZg5hfyqIY50xGSsgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js HTTP/1.1Host: jrhte.wpym.xyzConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://xofu8.wpym.xyz/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: 68ba-73d6=5964312a968d5bf8b4112aeb76102c73361c8cf272c7006e3e95435506daf19e
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/converged.v2.login.min_81imvbluez-v5hbzpkxfcg2.css HTTP/1.1Host: htejre.wpym.xyzConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://xofu8.wpym.xyz/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: 68ba-73d6=5964312a968d5bf8b4112aeb76102c73361c8cf272c7006e3e95435506daf19e
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/ConvergedLogin_PCore_GjP1RdcVSKf6ASC7mgkR1g2.js HTTP/1.1Host: htejre.wpym.xyzConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://xofu8.wpym.xyz/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: 68ba-73d6=5964312a968d5bf8b4112aeb76102c73361c8cf272c7006e3e95435506daf19e
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_1d0daql8my9m71a_2aaxzg2.js HTTP/1.1Host: htejre.wpym.xyzConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://xofu8.wpym.xyz/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: 68ba-73d6=5964312a968d5bf8b4112aeb76102c73361c8cf272c7006e3e95435506daf19e
Source: global traffic	HTTP traffic detected: GET /Me.htm?v=3 HTTP/1.1Host: hrvetbr.wpym.xyzConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://xofu8.wpym.xyz/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: 68ba-73d6=5964312a968d5bf8b4112aeb76102c73361c8cf272c7006e3e95435506daf19e
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js HTTP/1.1Host: htejre.wpym.xyzConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://xofu8.wpym.xyz/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: 68ba-73d6=5964312a968d5bf8b4112aeb76102c73361c8cf272c7006e3e95435506daf19e
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js HTTP/1.1Host: htejre.wpym.xyzConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://xofu8.wpym.xyz/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: 68ba-73d6=5964312a968d5bf8b4112aeb76102c73361c8cf272c7006e3e95435506daf19e
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/frameworksupport.min_oadrnc13magb009k4d20lg2.js HTTP/1.1Host: htejre.wpym.xyzConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://xofu8.wpym.xyz/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: 68ba-73d6=5964312a968d5bf8b4112aeb76102c73361c8cf272c7006e3e95435506daf19e
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/watson.min_q5ptmu8aniymd4ftuqdkda2.js HTTP/1.1Host: htejre.wpym.xyzConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://xofu8.wpym.xyz/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: 68ba-73d6=5964312a968d5bf8b4112aeb76102c73361c8cf272c7006e3e95435506daf19e
Source: global traffic	HTTP traffic detected: GET /owa/prefetch.aspx HTTP/1.1Host: mejeff.wpym.xyzConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: iframeReferer: https://xofu8.wpym.xyz/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: 68ba-73d6=5964312a968d5bf8b4112aeb76102c73361c8cf272c7006e3e95435506daf19e; ClientId=E46BB670B1294E60972BB77C3727EBD6; OIDC=1; OpenIdConnect.nonce.v3.A7lDoigpTWbpd6PAH_qIBGNph4oaBSYSP-CP3NCOjg8=638791917658115408.98d69f9d-eb1e-4f52-a2fd-c0535c45e2c9; X-OWA-RedirectHistory=ArLym14BUA1nWd1x3Qg
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_72a1051aa2aa2943d8c1.js HTTP/1.1Host: htejre.wpym.xyzConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://xofu8.wpym.xyz/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: 68ba-73d6=5964312a968d5bf8b4112aeb76102c73361c8cf272c7006e3e95435506daf19e
Source: global traffic	HTTP traffic detected: GET /owa/prem/15.20.8583.41/scripts/boot.worldwide.0.mouse.js HTTP/1.1Host: r4.res.office365.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleSec-Fetch-Storage-Access: activeReferer: https://mejeff.wpym.xyz/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /common/handlers/watson HTTP/1.1Host: xofu8.wpym.xyzConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: 68ba-73d6=5964312a968d5bf8b4112aeb76102c73361c8cf272c7006e3e95435506daf19e; esctx-85oIgnoPw48=AQABCQEAAABVrSpeuWamRam2jAF1XRQEX9GMKaQ6jbGYSngESuBwI3yclzH1AW8o80rTD5S7JSIsfKWkP0L_vHfLJ5KanzkJvW1ahNDqz6BTUlaV24l7GJMKyu6vfuK55DAQOpz-x3YKMX2w-22JjZ9iwiVDrVyd7rA8i3_7a0XFT16YM1mPxSAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.ATcAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA3AA.AQABGgEAAABVrSpeuWamRam2jAF1XRQE2-hTqoszpL0NFxMxHwS5YUc1-0YLNIcWzHhaqm0-YKTWhwwpdd-gBAvxGvGntuxr63JeDp0fchfKxW8ZI_LwWZZTObGGlNIYMxFjbmJWY8IgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEGKpKCqjkP_GWlZJExaeH5S9mzSZc0v2ZzHjTqg6swjQrQXRuHqFrWDz5R_yL3bd6PriDKfItB4ToiVvNlK0oPBWMKihL1ZKj7jwfOAjvE6ZkGcpcpx4ytfD1WCCg7_rrT4IWEdPeieEE586iMDwMzGOYT0zNsDwPpoYzngV2FKMgAA; esctx-sd3ZhMr8X0=AQABCQEAAABVrSpeuWamRam2jAF1XRQEmjkRSCpHlRePi8tyDkktckH3lP4xrHtXEV06Byjlrjn-4AMyj5XHMkdyHj4p_zaxPINC54YjFrjISKufFtW_uB_MZIt0AsxVCL9HhDk968rgeV86l6_5YJmdhyA8o9LsOCogrHZMVOt6fGm1xSfA1SAA; fpc=Al_Hmr0PvYNEokv2dfrKwy4; MicrosoftApplicationsTelemetryDeviceId=05f1106b-dd01-463d-8706-a0227d8a7e0d; brcap=0
Source: global traffic	HTTP traffic detected: GET /owa/prem/15.20.8583.41/scripts/boot.worldwide.1.mouse.js HTTP/1.1Host: r4.res.office365.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleSec-Fetch-Storage-Access: activeReferer: https://mejeff.wpym.xyz/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/appbackgrounds/49-small_2055002f2daae2ed8f69f03944c0e5d9.jpg HTTP/1.1Host: htejre.wpym.xyzConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://xofu8.wpym.xyz/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: 68ba-73d6=5964312a968d5bf8b4112aeb76102c73361c8cf272c7006e3e95435506daf19e
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/appbackgrounds/49_6ffe0a92d779c878835b40171ffc2e13.jpg HTTP/1.1Host: htejre.wpym.xyzConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://xofu8.wpym.xyz/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: 68ba-73d6=5964312a968d5bf8b4112aeb76102c73361c8cf272c7006e3e95435506daf19e
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/applogos/53_7a3c80bf9694448bac31a9589d2e9e92.png HTTP/1.1Host: htejre.wpym.xyzConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://xofu8.wpym.xyz/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: 68ba-73d6=5964312a968d5bf8b4112aeb76102c73361c8cf272c7006e3e95435506daf19e
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1Host: htejre.wpym.xyzConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://xofu8.wpym.xyz/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: 68ba-73d6=5964312a968d5bf8b4112aeb76102c73361c8cf272c7006e3e95435506daf19e
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: htejre.wpym.xyzConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://xofu8.wpym.xyz/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: 68ba-73d6=5964312a968d5bf8b4112aeb76102c73361c8cf272c7006e3e95435506daf19e
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1Host: htejre.wpym.xyzConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://xofu8.wpym.xyz/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: 68ba-73d6=5964312a968d5bf8b4112aeb76102c73361c8cf272c7006e3e95435506daf19e
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/appbackgrounds/49_6ffe0a92d779c878835b40171ffc2e13.jpg HTTP/1.1Host: htejre.wpym.xyzConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: 68ba-73d6=5964312a968d5bf8b4112aeb76102c73361c8cf272c7006e3e95435506daf19e
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/appbackgrounds/49-small_2055002f2daae2ed8f69f03944c0e5d9.jpg HTTP/1.1Host: htejre.wpym.xyzConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: 68ba-73d6=5964312a968d5bf8b4112aeb76102c73361c8cf272c7006e3e95435506daf19e
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/applogos/53_7a3c80bf9694448bac31a9589d2e9e92.png HTTP/1.1Host: htejre.wpym.xyzConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: 68ba-73d6=5964312a968d5bf8b4112aeb76102c73361c8cf272c7006e3e95435506daf19e
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1Host: htejre.wpym.xyzConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: 68ba-73d6=5964312a968d5bf8b4112aeb76102c73361c8cf272c7006e3e95435506daf19e
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: htejre.wpym.xyzConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: 68ba-73d6=5964312a968d5bf8b4112aeb76102c73361c8cf272c7006e3e95435506daf19e
Source: global traffic	HTTP traffic detected: GET /owa/prem/15.20.8583.41/scripts/boot.worldwide.2.mouse.js HTTP/1.1Host: r4.res.office365.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleSec-Fetch-Storage-Access: activeReferer: https://mejeff.wpym.xyz/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_c4928fb5cff147a39780.js HTTP/1.1Host: htejre.wpym.xyzConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://xofu8.wpym.xyz/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: 68ba-73d6=5964312a968d5bf8b4112aeb76102c73361c8cf272c7006e3e95435506daf19e
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1Host: htejre.wpym.xyzConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: 68ba-73d6=5964312a968d5bf8b4112aeb76102c73361c8cf272c7006e3e95435506daf19e
Source: global traffic	HTTP traffic detected: GET /owa/prem/15.20.8583.41/scripts/boot.worldwide.3.mouse.js HTTP/1.1Host: r4.res.office365.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleSec-Fetch-Storage-Access: activeReferer: https://mejeff.wpym.xyz/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /owa/prem/15.20.8583.41/resources/images/0/sprite1.mouse.png HTTP/1.1Host: r4.res.office365.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleSec-Fetch-Storage-Access: activeReferer: https://mejeff.wpym.xyz/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /owa/prem/15.20.8583.41/resources/images/0/sprite1.mouse.css HTTP/1.1Host: r4.res.office365.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleSec-Fetch-Storage-Access: activeReferer: https://mejeff.wpym.xyz/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /r/gsr1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: /If-Modified-Since: Tue, 07 Jan 2025 07:28:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog
Source: global traffic	HTTP traffic detected: GET /r/r4.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: /If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog

Source: chromecache_130.3.dr

String found in binary or memory: function Lhb(a,c){Mhb(a);var e=new Hhb(c,a.D);c==5?a.C.callback(e):(a.B.onload=r(),a.B.onerror=r(),xo(a.B),a.D>=3?a.C.callback(e):Khb(a))}function Mhb(a){clearTimeout(a.F);a.F=null;clearTimeout(a.G);a.G=null}Ihb.prototype.getStatus=function(){return this.C&&et(this.C)?this.C.getValue():new Hhb(1,this.D)};var Nhb=qi(["https://www.youtube.com/iframe_api"]),Ohb=qi([Dia]);function YJ(a,c){a=a===void 0?this.H:a;c=c===void 0?this.J:c;this.G=a;this.I=c;if(Gi._docs_yt_api_preloaded){var e;b:{a=this.I();c=oi(Phb);for(var f=c.next();!f.done;f=c.next())if(f=f.value,a===f.toString()){a=f;break b}a=null}a=(e=a)!=null?e:Qhb}else a=Qhb;this.F=a;this.C=this.G(this.F);(e=jo(document,Ija))&&xo(e);this.B=Gi._docs_yt_api_preloaded?2:0;this.D=[]} equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: docs.google.com
Source: global traffic	DNS traffic detected: DNS query: lh7-rt.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: meheff.wpym.xyz
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: js.hcaptcha.com
Source: global traffic	DNS traffic detected: DNS query: newassets.hcaptcha.com
Source: global traffic	DNS traffic detected: DNS query: api.hcaptcha.com
Source: global traffic	DNS traffic detected: DNS query: mejeff.wpym.xyz
Source: global traffic	DNS traffic detected: DNS query: xofu8.wpym.xyz
Source: global traffic	DNS traffic detected: DNS query: jrhte.wpym.xyz
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: htejre.wpym.xyz
Source: global traffic	DNS traffic detected: DNS query: hrvetbr.wpym.xyz
Source: global traffic	DNS traffic detected: DNS query: identity.nel.measure.office.net
Source: global traffic	DNS traffic detected: DNS query: r4.res.office365.com
Source: global traffic	DNS traffic detected: DNS query: beacons.gcp.gvt2.com
Source: global traffic	DNS traffic detected: DNS query: google.com

Source: unknown

HTTP traffic detected: POST /presentation/d/e/2PACX-1vQ7Dkd_WRbgSfshqD4oLNlUmDxTYPUSUb2tLr0qsjIwZ7fwYeWMIoyLCuLiIiL3T8QaBj2et0IIqqkz/web-reports?bl=editors.presentations-frontend_20250325.02_p4&app=6&clss=1&context=eJwNzntUzekaB_C33-99H1KpdrW77i33WzopKaeS2ntHddyHd-NgMmlkklCmZphJx20ylttpkhy7kZRSTIORkWbcTu7hrNwZjia6uEdx1Pn-8VnPWs93fdfz9Khz0byfzvqDNZNsAEm2ASzdJTvVQ7IVNpKVw8-2khU6SKbXSPbOWbKBLpKdhgOuktVAoZtk4z2Qe0o23UuyLTrJ8mCPXrJFvSWL7yvZiQGSBQ6U7MMQyex8JHOEocMk2-or2drhkiUHSpYBWeGSbYMZkyQrmCLZQRholiwI1BmSOUHdTMn-gNjZks2CG3GSNYJ1vGTu8CpBMuVzyQ4vlOwMjPhCMiM0p-E-dHwpmX26ZDczJXsCl7Mkuw_Gf0j2CQRvlGwcZP8g2Q7on4vfoXO7ZD3z0PsXepC_R7IycD4oWT-4Xy3ZM4i4INlkOH5Fsoug1EmmgW43JHMFx_uS9YadsB9OwjXQP5TMF3IfS1YMQQ2SjYVKOAlnoR6qXkh2DqoczewcZGrNrMTVzI5C8igzq4kysyuQM8fMisA73sz8oG-CmQVAw2Iza4PAFDMzQdFSMzsMaWlmtgYGLTezYHjgcpU1ejUrb0E_pFkZAMqCl0oPiD71UpkMGx-9UnLgnO9r5Sr0jn2tDIb_dW9TuHWbovNvU_rDvRVtSgNkZrYp62FoVpsSAN8ca1PWwuEv3inVsDG0XckBY1i78jdITmhXlsO27HYlH-Z-3aFMON-hTAdTXYcyHiya90oxHM56r1TD24L3SicE9etUwmHz7U5lO0SxLmUC1Hl1KTchKaNLSYXKP5h6DPbttlJt91ipzmApUNRi2HVaUS2qqhbDiMGqGgrvpqhqF8ROU9WpcGGVql6HgHWqOhqONKjqCZjVg6sJ0OrN1TYY9Pyv3A9-ehbCqyDrZQjPBs-2EN4XXCeG8nm5oXwh6MpDeX-wagrlDzzCeCOMCA7joXAxN4zfgNh-o_lUcNwUzt2hrS6cfwRn8xjuBTOTx3CzLoJ_Cg_HRfAWELER3A6ymiP4VhjbGsEngkdkJO8DTRsi-Xvovj-SO4BVeSS3hidaA38Bk0cb-AzYMcnATSkGPh7ULw3cBhpWGHgrLD9g4N_AjEoDj4Os3kaeDS82GDn73sgnlRi5GV6fM_IP0Al03shXwGoIumjk4TANZkMRlIPTKyP3hHV6E98EAT4mHgK_JZp4LbQuMfE28Flu4iPgeLWJn4bn50z8HYhrJm4HFY9M_Ahs_9PEC6DBO4q3wuPAKN4C2z6N4vmwyGUcD5k2jhvgg4jmKkXzd5po3gXD3aN5KNR2i-F10Gkdw6lHDB_WN4Zfn2gRXVMsottUi2j5xSLewJo3BWIjGA78KJKcdotUOPzVbtHoXCieQ9rdQrESHj4vFE_hRNIecRbo8R7RE1qWFYk3ULW6SPwOeZ57xY-wq3qv2AeJg4vFEtjmUywKYXh5sRgFL_UlogPiZ5SIJPA9XCJGQnBuqTBA1U-l4neofFoqjsGzD6XiLYjOUmEHiZ5lYgkcHVYmToEutkz0h0UTykQa5MeXiUJoXFkmXsHTnDLxEhpKykQrFGTvF2Xgd2W_GAPrhpaLTTDyswoxGlYurhBbRjeJPBg5uUlEwd_Tm8SvG5vEyfImcR48bzWJvpA7u1lYYO6cZtHtXLPQQOb5ZrEeHt1qFk1Qf6dZ3Ae_8BYRDG-rWkQnBJxsESFwOa9V1MOsHa3iM6hhz8QVWP7tK_E1-HS3oRGwYLMNpcOM9zY0B0b1tCW_ZFsKhuxcW9oKp_JtqRb27bSlCjhxwpYO1dnScRj7py1JOMnt6DwM22JHYXD8kB2dhl1H7WgvXG-2o5vwz009aSecqOlJZ2HimZ4kodLfno7BywR7egsfd9mTsNhTToM9fXB3INXDgexWOZAL6IscaACsPeJANu0O5ABThzjSLPgl0pFqoH6WI90H_3JHelfpSF1wN0RDD6HZqKHXYIjTUCw8KdfQCwg4ix2E12noATy2d6IWsAQ5UTGsCHai1dA01omWxjnRHfgvRKY7UQzQVUzoke9MGrhU60z3YOY9Z5oHW1udKRcmaFxoOlT5udDlSBe6DvHzXSgJYkpdaApcrnShaQ0uFNZLSyZI7a-lDMjx0dIOOOqnpWo4A-fhGtyAB_AYasK19G-Yk6Sl3sla-kuWloKgI19LVju1FGjRUhjUwiUw7NZSLAw9pSU_CIJQWHRdS2mQ8h8tpcOaO1raCE53teQJM5NcaR5EpLrSlE2u9NtWV6qF9luuxG670sLubvQVnPF2o0sQGutGRviQ60ZsuxuNqXCjcZB-0I1WwoJaN0oBh0J3cgOb6-7kBN9960FbwPidB30CE7M9SEL5GQ-qBO9GDxoEc6M8KR5-iPOkXZC52ZPWQ0aEF30DC2K8aBHsqvKivZBx2otWwcC7XuQD8-550edgstLRNGhXdPQRzkbr6DIEzdZRONz4Xke0SUdamPOrjhLg3lUdNcCKeh2thlEPdFTtq6eTkDpRTxmwpkxPjy7oqeK2nn6Ggud6KoGrHXqqh92zelEx-Cb0ogBY2c2b1kBRojfl13pTIWj9-pDGtrvlwqEacnjxNO-t4mE9KW1eUuKyBfPj-wybH5-YunjpMt-UpfOXzU9OjUtNXJy8bFjC0sXJqfOT4-f6-_kH-gX4B_r6-c9NGfF_LMjCkQ&build-label=editors.presentations-frontend_20250325.02_p4&imp-sid=CLD945qluYwDFfCtqwcdegENvw&is-cached-offline=false

Source: chromecache_130.3.dr	String found in binary or memory: http://csi.gstatic.com/csi
Source: chromecache_123.3.dr	String found in binary or memory: http://feross.org
Source: chromecache_126.3.dr	String found in binary or memory: http://github.com/jquery/globalize
Source: chromecache_105.3.dr	String found in binary or memory: http://gsgd.co.uk/sandbox/jquery/easing/
Source: chromecache_112.3.dr, chromecache_97.3.dr	String found in binary or memory: http://knockoutjs.com/
Source: chromecache_100.3.dr	String found in binary or memory: http://www.broofa.com
Source: chromecache_112.3.dr, chromecache_97.3.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php)
Source: chromecache_130.3.dr	String found in binary or memory: https://accounts.google.com/ServiceLogin
Source: chromecache_130.3.dr	String found in binary or memory: https://angular.dev/license
Source: chromecache_130.3.dr	String found in binary or memory: https://apis.google.com/js/api.js
Source: chromecache_130.3.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/mathjax/
Source: chromecache_107.3.dr	String found in binary or memory: https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback
Source: chromecache_130.3.dr	String found in binary or memory: https://csi.gstatic.com/csi
Source: chromecache_132.3.dr	String found in binary or memory: https://fonts.google.com/license/googlerestricted
Source: chromecache_130.3.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Roboto_old:300
Source: chromecache_132.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/googlesans/v62/4Ua_rENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RF
Source: chromecache_139.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu4WxKOzY.woff2)
Source: chromecache_139.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu4mxK.woff2)
Source: chromecache_139.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu5mxKOzY.woff2)
Source: chromecache_139.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu72xKOzY.woff2)
Source: chromecache_139.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu7GxKOzY.woff2)
Source: chromecache_139.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu7WxKOzY.woff2)
Source: chromecache_139.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu7mxKOzY.woff2)
Source: chromecache_112.3.dr, chromecache_123.3.dr, chromecache_125.3.dr, chromecache_97.3.dr	String found in binary or memory: https://github.com/douglascrockford/JSON-js
Source: chromecache_134.3.dr, chromecache_108.3.dr	String found in binary or memory: https://hcaptcha.com/license
Source: chromecache_130.3.dr	String found in binary or memory: https://itunes.apple.com/app/apple-store/id842842640?pt=9008&ct=docs_mo&mt=8
Source: chromecache_130.3.dr	String found in binary or memory: https://itunes.apple.com/app/apple-store/id842849113?pt=9008&ct=sheets_mo&mt=8
Source: chromecache_130.3.dr	String found in binary or memory: https://itunes.apple.com/app/apple-store/id879478102?pt=9008&ct=slides_mo&mt=8
Source: chromecache_107.3.dr	String found in binary or memory: https://js.hcaptcha.com/1/api.js
Source: chromecache_138.3.dr	String found in binary or memory: https://play.google.com
Source: chromecache_130.3.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_138.3.dr	String found in binary or memory: https://policies.google.com/privacy?hl=en
Source: chromecache_138.3.dr	String found in binary or memory: https://policies.google.com/terms?hl=en
Source: chromecache_130.3.dr	String found in binary or memory: https://ssl.gstatic.com/docs/common/warning.png
Source: chromecache_138.3.dr	String found in binary or memory: https://support.google.com
Source: chromecache_138.3.dr	String found in binary or memory: https://support.google.com/
Source: chromecache_138.3.dr	String found in binary or memory: https://support.google.com/docs/answer/1696717?hl=en
Source: chromecache_138.3.dr	String found in binary or memory: https://support.google.com/drive/?hl=en
Source: chromecache_130.3.dr	String found in binary or memory: https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=
Source: chromecache_138.3.dr	String found in binary or memory: https://www.google.com
Source: chromecache_130.3.dr	String found in binary or memory: https://www.google.com/recaptcha/api.js?trustedtypes=true&render=
Source: chromecache_138.3.dr	String found in binary or memory: https://www.google.com/tools/feedback
Source: chromecache_130.3.dr	String found in binary or memory: https://www.gstatic.com/_/apps-fileview/_/js/
Source: chromecache_138.3.dr	String found in binary or memory: https://www.gstatic.com/feedback/js/help/prod/service/lazy.min.js
Source: chromecache_138.3.dr	String found in binary or memory: https://www.gstatic.com/uservoice/feedback/client/web/
Source: chromecache_100.3.dr	String found in binary or memory: https://www.gstatic.com/video_effects
Source: chromecache_130.3.dr	String found in binary or memory: https://www.youtube.com/iframe_api
Source: chromecache_130.3.dr	String found in binary or memory: https://youtube.googleapis.com
Source: chromecache_130.3.dr	String found in binary or memory: https://youtube.googleapis.com/iframe_api

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49681 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49681
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 142.251.167.104:443 -> 192.168.2.6:49697 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.251.40.110:443 -> 192.168.2.6:49698 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.251.41.1:443 -> 192.168.2.6:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.251.40.110:443 -> 192.168.2.6:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.251.40.193:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.95.41:443 -> 192.168.2.6:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.95.41:443 -> 192.168.2.6:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.19.230.21:443 -> 192.168.2.6:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.94.41:443 -> 192.168.2.6:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.19.229.21:443 -> 192.168.2.6:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.94.41:443 -> 192.168.2.6:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.19.230.21:443 -> 192.168.2.6:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.19.230.21:443 -> 192.168.2.6:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.94.41:443 -> 192.168.2.6:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.209.72.31:443 -> 192.168.2.6:49783 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.55.235.240:443 -> 192.168.2.6:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49799 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49798 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.209.72.206:443 -> 192.168.2.6:49803 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49804 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49808 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49809 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49811 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49816 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49818 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49819 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49817 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49814 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.141.50.41:443 -> 192.168.2.6:49821 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.72.110:443 -> 192.168.2.6:49824 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir4900_230742674

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir4900_230742674

Jump to behavior

Source: classification engine

Classification label: mal88.phis.troj.win@27/90@70/14

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1724,i,6665872760245968715,17813975207059206959,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://docs.google.com/presentation/d/e/2PACX-1vQ7Dkd_WRbgSfshqD4oLNlUmDxTYPUSUb2tLr0qsjIwZ7fwYeWMIoyLCuLiIiL3T8QaBj2et0IIqqkz/pub?start=false&loop=false&delayms=3000"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1724,i,6665872760245968715,17813975207059206959,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Drive-by Compromise	Windows Management Instrumentation	2 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://docs.google.com/presentation/d/e/2PACX-1vQ7Dkd_WRbgSfshqD4oLNlUmDxTYPUSUb2tLr0qsjIwZ7fwYeWMIoyLCuLiIiL3T8QaBj2et0IIqqkz/pub?start=false&loop=false&delayms=3000	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label
https://xofu8.wpym.xyz/favicon.ico	0%	Avira URL Cloud	safe
https://meheff.wpym.xyz/favicon.ico	0%	Avira URL Cloud	safe
https://mejeff.wpym.xyz/owa/prefetch.aspx	0%	Avira URL Cloud	safe
https://xofu8.wpym.xyz/common/instrumentation/reportbssotelemetry?hpgid=6&hpgact=1800&client-request-id=d3f010eb-0335-4544-92e3-80e46926cd37&hpgrequestid=88dd7291-efa0-4fe5-b233-c98e0dbf6800	0%	Avira URL Cloud	safe
https://htejre.wpym.xyz/ests/2.1/content/cdnbundles/watson.min_q5ptmu8aniymd4ftuqdkda2.js	0%	Avira URL Cloud	safe
https://htejre.wpym.xyz/shared/1.0/content/images/applogos/53_7a3c80bf9694448bac31a9589d2e9e92.png	0%	Avira URL Cloud	safe
https://htejre.wpym.xyz/shared/1.0/content/js/ConvergedLogin_PCore_GjP1RdcVSKf6ASC7mgkR1g2.js	0%	Avira URL Cloud	safe
https://htejre.wpym.xyz/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico	0%	Avira URL Cloud	safe
https://htejre.wpym.xyz/shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js	0%	Avira URL Cloud	safe
https://htejre.wpym.xyz/ests/2.1/content/cdnbundles/converged.v2.login.min_81imvbluez-v5hbzpkxfcg2.css	0%	Avira URL Cloud	safe
https://htejre.wpym.xyz/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg	0%	Avira URL Cloud	safe
https://meheff.wpym.xyz/nrColMBN?k=NXLG8A0	0%	Avira URL Cloud	safe
https://htejre.wpym.xyz/shared/1.0/content/images/appbackgrounds/49-small_2055002f2daae2ed8f69f03944c0e5d9.jpg	0%	Avira URL Cloud	safe
https://mejeff.wpym.xyz/owa/	0%	Avira URL Cloud	safe
https://htejre.wpym.xyz/ests/2.1/content/cdnbundles/watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js	0%	Avira URL Cloud	safe
https://jrhte.wpym.xyz/shared/1.0/content/js/BssoInterrupt_Core_9810YxmrLqOR1rQ4anyNMg2.js	0%	Avira URL Cloud	safe
https://htejre.wpym.xyz/ests/2.1/content/cdnbundles/frameworksupport.min_oadrnc13magb009k4d20lg2.js	0%	Avira URL Cloud	safe
https://meheff.wpym.xyz/owa/favicon.ico	0%	Avira URL Cloud	safe
https://htejre.wpym.xyz/shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg	0%	Avira URL Cloud	safe
https://htejre.wpym.xyz/shared/1.0/content/images/appbackgrounds/49_6ffe0a92d779c878835b40171ffc2e13.jpg	0%	Avira URL Cloud	safe
https://jrhte.wpym.xyz/ests/2.1/content/cdnbundles/watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js	0%	Avira URL Cloud	safe
https://htejre.wpym.xyz/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_1d0daql8my9m71a_2aaxzg2.js	0%	Avira URL Cloud	safe
https://xofu8.wpym.xyz/common/handlers/watson	0%	Avira URL Cloud	safe
https://hrvetbr.wpym.xyz/Me.htm?v=3	0%	Avira URL Cloud	safe
https://htejre.wpym.xyz/shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_c4928fb5cff147a39780.js	0%	Avira URL Cloud	safe
https://htejre.wpym.xyz/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_72a1051aa2aa2943d8c1.js	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
s-part-0012.t-0009.t-msedge.net	13.107.246.40	true	false	high
docs.google.com	142.251.40.110	true	false	high
e40491.dscg.akamaiedge.net	23.209.72.206	true	false	high
jrhte.wpym.xyz	209.141.50.41	true	true	unknown
e329293.dscd.akamaiedge.net	23.209.72.31	true	false	high
google.com	142.250.72.110	true	false	high
api.hcaptcha.com	104.19.230.21	true	false	high
beacons-handoff.gcp.gvt2.com	142.250.115.94	true	false	high
a1894.dscb.akamai.net	23.55.235.240	true	false	high
meheff.wpym.xyz	209.141.50.41	true	true	unknown
xofu8.wpym.xyz	209.141.50.41	true	true	unknown
play.google.com	142.250.65.174	true	false	high
js.hcaptcha.com	104.19.230.21	true	false	high
htejre.wpym.xyz	209.141.50.41	true	true	unknown
challenges.cloudflare.com	104.18.95.41	true	false	high
www.google.com	142.251.167.104	true	false	high
mejeff.wpym.xyz	209.141.50.41	true	true	unknown
newassets.hcaptcha.com	104.19.229.21	true	false	high
googlehosted.l.googleusercontent.com	142.251.41.1	true	false	high
hrvetbr.wpym.xyz	209.141.50.41	true	true	unknown
r4.res.office365.com	unknown	unknown	false	high
aadcdn.msftauth.net	unknown	unknown	false	high
beacons.gcp.gvt2.com	unknown	unknown	false	high
identity.nel.measure.office.net	unknown	unknown	false	high
lh7-rt.googleusercontent.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://htejre.wpym.xyz/shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/1212442583:1743593607:vEnn6mwQ95ke5K7PKXFGNwLCtODIADibp6QTenEhzhc/92a02388286d2361/syp_.SEti7486WnCqG9gsMLBHxYvSA_rvMrkUrBK2Co-1743594942-1.1.1.1-hiZdP5cCpXDZqZ5jFX1duCsIUIGCXFylZ7JqyH8T8R3WvmVSUwC0qzbDeMX9EL9M	false		high
https://htejre.wpym.xyz/ests/2.1/content/cdnbundles/converged.v2.login.min_81imvbluez-v5hbzpkxfcg2.css	false	Avira URL Cloud: safe	unknown
https://mejeff.wpym.xyz/owa/prefetch.aspx	false	Avira URL Cloud: safe	unknown
https://r4.res.office365.com/owa/prem/15.20.8583.41/resources/images/0/sprite1.mouse.png	false		high
https://xofu8.wpym.xyz/common/instrumentation/reportbssotelemetry?hpgid=6&hpgact=1800&client-request-id=d3f010eb-0335-4544-92e3-80e46926cd37&hpgrequestid=88dd7291-efa0-4fe5-b233-c98e0dbf6800	false	Avira URL Cloud: safe	unknown
https://xofu8.wpym.xyz/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=d3f010eb-0335-4544-92e3-80e46926cd37&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638791917658115408.98d69f9d-eb1e-4f52-a2fd-c0535c45e2c9&state=DctLFoAgCEBRrNNySFERWI75mTZs-zG4b_YCAJzucCF5QFpRMTKSxkrENeltOpttm7geWlg3Z-x5TxyJC4_KKw8L_l7x_Xr8AQ&sso_reload=true	true		unknown
https://meheff.wpym.xyz/favicon.ico	false	Avira URL Cloud: safe	unknown
https://docs.google.com/presentation/manifest.json	false		high
https://htejre.wpym.xyz/ests/2.1/content/cdnbundles/watson.min_q5ptmu8aniymd4ftuqdkda2.js	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/r4wwa/0x4AAAAAAA2ptl9BKcGk2BB2/auto/fbE/new/normal/auto/	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/d/92a02388286d2361/1743594953422/F44c2OL12PSq6bA	false		high
http://c.pki.goog/r/r4.crl	false		high
https://challenges.cloudflare.com/turnstile/v0/b/708f7a809116/api.js	false		high
https://docs.google.com/static/presentation/client/js/764277182-viewer_integrated_help.js	false		high
https://r4.res.office365.com/owa/prem/15.20.8583.41/scripts/boot.worldwide.2.mouse.js	false		high
https://xofu8.wpym.xyz/favicon.ico	false	Avira URL Cloud: safe	unknown
https://r4.res.office365.com/owa/prem/15.20.8583.41/scripts/boot.worldwide.1.mouse.js	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/cmg/1	false		high
https://js.hcaptcha.com/1/api.js	false		high
https://docs.google.com/presentation/d/e/2PACX-1vQ7Dkd_WRbgSfshqD4oLNlUmDxTYPUSUb2tLr0qsjIwZ7fwYeWMIoyLCuLiIiL3T8QaBj2et0IIqqkz/pub?start=false&loop=false&delayms=3000	false		high
https://htejre.wpym.xyz/shared/1.0/content/images/applogos/53_7a3c80bf9694448bac31a9589d2e9e92.png	false	Avira URL Cloud: safe	unknown
https://htejre.wpym.xyz/shared/1.0/content/js/ConvergedLogin_PCore_GjP1RdcVSKf6ASC7mgkR1g2.js	false	Avira URL Cloud: safe	unknown
http://c.pki.goog/r/gsr1.crl	false		high
https://htejre.wpym.xyz/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico	false	Avira URL Cloud: safe	unknown
https://htejre.wpym.xyz/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg	false	Avira URL Cloud: safe	unknown
https://docs.google.com/static/presentation/client/js/907711159-viewer_integrated_secondary.js	false		high
https://r4.res.office365.com/owa/prem/15.20.8583.41/resources/images/0/sprite1.mouse.css	false		high
https://htejre.wpym.xyz/shared/1.0/content/images/appbackgrounds/49-small_2055002f2daae2ed8f69f03944c0e5d9.jpg	false	Avira URL Cloud: safe	unknown
https://meheff.wpym.xyz/nrColMBN?k=NXLG8A0	false	Avira URL Cloud: safe	unknown
https://htejre.wpym.xyz/ests/2.1/content/cdnbundles/frameworksupport.min_oadrnc13magb009k4d20lg2.js	false	Avira URL Cloud: safe	unknown
https://newassets.hcaptcha.com/c/5fef759e34a955dd56ceddd805e6a87d3f7d854c8c695bf797d43331bebfee3f/hsw.js	false		high
https://api.hcaptcha.com/checksiteconfig?v=c1e11bfffe54019b36ca486d59d75ea65128f510&host=meheff.wpym.xyz&sitekey=234adb2f-52ba-4697-82fa-abecbb14b173&sc=1&swa=1&spst=1	false		high
https://mejeff.wpym.xyz/owa/	false	Avira URL Cloud: safe	unknown
https://lh7-rt.googleusercontent.com/slidesz/AGV_vUdJaErXIJ55hdglvmfjSbJPFW0UxlncOXEIeukK-lpE_5EJ5uh5BaYVcdj_q3_TnTKD5vNdF46nR-OTR94Q5CLCKQzl6Xf2hHM67TsVRaoPZt4GNZxhtsR6gY_0XQ6UqZk=s2048?key=0T76xXlufg2HBrV9SVPofq1l	false		high
https://jrhte.wpym.xyz/shared/1.0/content/js/BssoInterrupt_Core_9810YxmrLqOR1rQ4anyNMg2.js	false	Avira URL Cloud: safe	unknown
https://r4.res.office365.com/owa/prem/15.20.8583.41/scripts/boot.worldwide.0.mouse.js	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=92a02388286d2361&lang=auto	false		high
https://htejre.wpym.xyz/shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg	false	Avira URL Cloud: safe	unknown
https://meheff.wpym.xyz/nrColMBN	true		unknown
https://docs.google.com/presentation/d/e/2PACX-1vQ7Dkd_WRbgSfshqD4oLNlUmDxTYPUSUb2tLr0qsjIwZ7fwYeWMIoyLCuLiIiL3T8QaBj2et0IIqqkz/pub?start=false&loop=false&delayms=3000&slide=id.p	false		high
https://newassets.hcaptcha.com/captcha/v1/c1e11bfffe54019b36ca486d59d75ea65128f510/static/hcaptcha.html	false		high
https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback	false		high
https://xofu8.wpym.xyz/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=d3f010eb-0335-4544-92e3-80e46926cd37&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638791917658115408.98d69f9d-eb1e-4f52-a2fd-c0535c45e2c9&state=DctLFoAgCEBRrNNySFERWI75mTZs-zG4b_YCAJzucCF5QFpRMTKSxkrENeltOpttm7geWlg3Z-x5TxyJC4_KKw8L_l7x_Xr8AQ	false		unknown
https://htejre.wpym.xyz/ests/2.1/content/cdnbundles/watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js	false	Avira URL Cloud: safe	unknown
https://google.com/domainreliability/upload	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/pat/92a02388286d2361/1743594953425/c8ded0a11fbdbd541bb4fe88002a6f25458edfbafd114552db4fe9412006050a/ZD5VGc0O47vH_tR	false		high
https://htejre.wpym.xyz/shared/1.0/content/images/appbackgrounds/49_6ffe0a92d779c878835b40171ffc2e13.jpg	false	Avira URL Cloud: safe	unknown
https://meheff.wpym.xyz/owa/favicon.ico	false	Avira URL Cloud: safe	unknown
https://jrhte.wpym.xyz/ests/2.1/content/cdnbundles/watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js	false	Avira URL Cloud: safe	unknown
https://xofu8.wpym.xyz/common/handlers/watson	false	Avira URL Cloud: safe	unknown
https://docs.google.com/static/presentation/client/js/1573492039-viewer_integrated_core.js	false		high
https://docs.google.com/static/presentation/client/css/4105792792-viewer_css_ltr.css	false		high
https://docs.google.com/static/presentation/client/js/1568806778-punch_viewer_worker_binary_viewercore.js	false		high
https://r4.res.office365.com/owa/prem/15.20.8583.41/scripts/boot.worldwide.3.mouse.js	false		high
https://hrvetbr.wpym.xyz/Me.htm?v=3	false	Avira URL Cloud: safe	unknown
https://htejre.wpym.xyz/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_1d0daql8my9m71a_2aaxzg2.js	false	Avira URL Cloud: safe	unknown
https://htejre.wpym.xyz/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_72a1051aa2aa2943d8c1.js	false	Avira URL Cloud: safe	unknown
https://htejre.wpym.xyz/shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_c4928fb5cff147a39780.js	false	Avira URL Cloud: safe	unknown
https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+wst	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://www.broofa.com	chromecache_100.3.dr	false	high
https://support.google.com	chromecache_138.3.dr	false	high
https://play.google.com	chromecache_138.3.dr	false	high
https://angular.dev/license	chromecache_130.3.dr	false	high
https://www.google.com/recaptcha/api.js?trustedtypes=true&render=	chromecache_130.3.dr	false	high
https://support.google.com/	chromecache_138.3.dr	false	high
https://www.google.com	chromecache_138.3.dr	false	high
https://www.youtube.com/iframe_api	chromecache_130.3.dr	false	high
https://support.google.com/drive/?hl=en	chromecache_138.3.dr	false	high
https://policies.google.com/privacy?hl=en	chromecache_138.3.dr	false	high
http://github.com/jquery/globalize	chromecache_126.3.dr	false	high
https://policies.google.com/terms?hl=en	chromecache_138.3.dr	false	high
https://support.google.com/docs/answer/1696717?hl=en	chromecache_138.3.dr	false	high
https://www.google.com/tools/feedback	chromecache_138.3.dr	false	high
https://hcaptcha.com/license	chromecache_134.3.dr, chromecache_108.3.dr	false	high
https://apis.google.com/js/api.js	chromecache_130.3.dr	false	high
https://cdnjs.cloudflare.com/ajax/libs/mathjax/	chromecache_130.3.dr	false	high
http://knockoutjs.com/	chromecache_112.3.dr, chromecache_97.3.dr	false	high
https://github.com/douglascrockford/JSON-js	chromecache_112.3.dr, chromecache_123.3.dr, chromecache_125.3.dr, chromecache_97.3.dr	false	high
https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=	chromecache_130.3.dr	false	high
http://gsgd.co.uk/sandbox/jquery/easing/	chromecache_105.3.dr	false	high
https://play.google.com/log?format=json&hasfast=true	chromecache_130.3.dr	false	high
http://www.opensource.org/licenses/mit-license.php)	chromecache_112.3.dr, chromecache_97.3.dr	false	high
http://feross.org	chromecache_123.3.dr	false	high
https://fonts.google.com/license/googlerestricted	chromecache_132.3.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.251.41.1	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
104.18.94.41	unknown	United States	13335	CLOUDFLARENETUS	false
142.251.167.104	www.google.com	United States	15169	GOOGLEUS	false
142.251.40.110	docs.google.com	United States	15169	GOOGLEUS	false
209.141.50.41	jrhte.wpym.xyz	United States	53667	PONYNETUS	true
142.251.40.193	unknown	United States	15169	GOOGLEUS	false
104.19.230.21	api.hcaptcha.com	United States	13335	CLOUDFLARENETUS	false
23.209.72.31	e329293.dscd.akamaiedge.net	United States	20940	AKAMAI-ASN1EU	false
104.18.95.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
104.19.229.21	newassets.hcaptcha.com	United States	13335	CLOUDFLARENETUS	false
23.209.72.206	e40491.dscg.akamaiedge.net	United States	20940	AKAMAI-ASN1EU	false
23.55.235.240	a1894.dscb.akamai.net	United States	20940	AKAMAI-ASN1EU	false

Private

IP
192.168.2.7
192.168.2.6

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1654640
Start date and time:	2025-04-02 13:54:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://docs.google.com/presentation/d/e/2PACX-1vQ7Dkd_WRbgSfshqD4oLNlUmDxTYPUSUb2tLr0qsjIwZ7fwYeWMIoyLCuLiIiL3T8QaBj2et0IIqqkz/pub?start=false&loop=false&delayms=3000
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal88.phis.troj.win@27/90@70/14
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe, TextInputHost.exe
Excluded IPs from analysis (whitelisted): 142.250.65.174, 142.250.65.227, 142.251.179.84, 142.250.80.110, 142.251.35.174, 142.251.40.174, 142.250.81.238, 142.251.40.170, 142.250.80.35, 199.232.210.172, 142.251.40.131, 142.251.32.110, 142.251.41.3, 172.217.165.142, 142.250.64.74, 172.217.165.138, 142.251.41.10, 142.250.65.234, 142.251.40.202, 142.251.40.138, 142.250.65.202, 142.250.176.202, 142.251.40.234, 142.251.35.170, 142.250.81.234, 142.251.40.106, 142.250.65.170, 142.250.72.106, 142.251.32.106, 142.251.40.206, 23.204.23.20, 20.109.210.53
Excluded domains from analysis (whitelisted): fonts.googleapis.com, ssl.gstatic.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, fonts.gstatic.com, aadcdnoriginwus2.azureedge.net, ctldl.windowsupdate.com, clientservices.googleapis.com, aadcdn.msauth.net, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, redirector.gvt1.com, update.googleapis.com, aadcdnoriginwus2.afd.azureedge.net, clients.l.google.com, c.pki.goog
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://docs.google.com/presentation/d/e/2PACX-1vQ7Dkd_WRbgSfshqD4oLNlUmDxTYPUSUb2tLr0qsjIwZ7fwYeWMIoyLCuLiIiL3T8QaBj2et0IIqqkz/pub?start=false&loop=false&delayms=3000

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1278)
Category:	downloaded
Size (bytes):	367100
Entropy (8bit):	5.605571670590494
Encrypted:	false
SSDEEP:	6144:ihNv7omQJJ//ZzRMFFEk6F6kA3f61PBh/OxwaWNhsD4malv/s0kHbW02oNcDo:ihNqJRZCfcqGBhWxtEv5E
MD5:	E8250E73AAC81A43B898D84BC8F48935
SHA1:	08DCE561F2B72D310FB4076DEC663363B1C01A28
SHA-256:	B1D35EA5F7EC854BE0430BC46CE7D28CCC51F128654175462878B0C6CBD2A410
SHA-512:	F004FA339D21A6D6C5F40F9FD5387FEF219D34DECF9BC5FF72F05FE59E695C8CBDFBC2F59E1D2C50E09B1E72E3859D126ED720F48BF4521448D8397A4B91BF12
Malicious:	false
Reputation:	low
URL:	https://docs.google.com/static/presentation/client/js/907711159-viewer_integrated_secondary.js
Preview:	cp(Ng);./..Math.uuid.js (v1.4).http://www.broofa.com.mailto:robert@broofa.com.Copyright (c) 2010 Robert Kieffer.Dual licensed under the MIT and GPL licenses../.var nCb=" aria-hidden='true'",oCb=' aria-labelledby="',pCb=" but found ",qCb=' data-idom-class="',rCb=" data-use-native-focus-logic='true'",WO=' jsname="',sCb=" requested by ",XO=" ssk='",tCb=" task: cannot enqueue task before CREATE.",uCb=" task: tasks(s) already in the queue.",vCb=" task: this task already completed.",wCb=" task: this task type is already running.",xCb='" d=""/></svg><svg class="',yCb='" data-progressvalue="',YO='" height="',ZO='" jsaction="',zCb='" jsaction="click:',$O='" jscontroller="',.aP='" jsname="',ACb='" placeholder="',BCb='" role="progressbar" aria-label="',bP='" style="',CCb='" xmlns="http://www.w3.org/2000/svg" jsname="',DCb='"><path jsname="',ECb='"><span class="',FCb='"><svg class="',GCb="(preventDefault=true)",HCb="--progress-value: ",ICb="-visible-label",JCb=".focusSentinel",KCb=".javascriptMa

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 2, 2025 13:55:05.041321039 CEST	53	51952	1.1.1.1	192.168.2.6
Apr 2, 2025 13:55:05.849102020 CEST	53	56300	1.1.1.1	192.168.2.6
Apr 2, 2025 13:55:06.073364019 CEST	53	54803	1.1.1.1	192.168.2.6
Apr 2, 2025 13:55:09.239411116 CEST	53339	53	192.168.2.6	1.1.1.1
Apr 2, 2025 13:55:09.239568949 CEST	52689	53	192.168.2.6	1.1.1.1
Apr 2, 2025 13:55:09.380031109 CEST	53	52689	1.1.1.1	192.168.2.6
Apr 2, 2025 13:55:09.380238056 CEST	53	53339	1.1.1.1	192.168.2.6
Apr 2, 2025 13:55:10.684402943 CEST	61617	53	192.168.2.6	1.1.1.1
Apr 2, 2025 13:55:10.684556961 CEST	55894	53	192.168.2.6	1.1.1.1
Apr 2, 2025 13:55:10.800370932 CEST	53	55894	1.1.1.1	192.168.2.6
Apr 2, 2025 13:55:10.816992998 CEST	53	61617	1.1.1.1	192.168.2.6
Apr 2, 2025 13:55:12.364957094 CEST	60318	53	192.168.2.6	1.1.1.1
Apr 2, 2025 13:55:12.365199089 CEST	50581	53	192.168.2.6	1.1.1.1
Apr 2, 2025 13:55:12.491883039 CEST	53	56313	1.1.1.1	192.168.2.6
Apr 2, 2025 13:55:12.504121065 CEST	53	50581	1.1.1.1	192.168.2.6
Apr 2, 2025 13:55:12.506937981 CEST	53	60318	1.1.1.1	192.168.2.6
Apr 2, 2025 13:55:16.244641066 CEST	51566	53	192.168.2.6	1.1.1.1
Apr 2, 2025 13:55:16.244858027 CEST	64869	53	192.168.2.6	1.1.1.1
Apr 2, 2025 13:55:16.382054090 CEST	53	51566	1.1.1.1	192.168.2.6
Apr 2, 2025 13:55:23.045195103 CEST	53	54215	1.1.1.1	192.168.2.6
Apr 2, 2025 13:55:23.160768986 CEST	59628	53	192.168.2.6	1.1.1.1
Apr 2, 2025 13:55:23.161226988 CEST	61613	53	192.168.2.6	1.1.1.1
Apr 2, 2025 13:55:23.241561890 CEST	53	50259	1.1.1.1	192.168.2.6
Apr 2, 2025 13:55:23.291673899 CEST	53	59628	1.1.1.1	192.168.2.6
Apr 2, 2025 13:55:23.294449091 CEST	53	61613	1.1.1.1	192.168.2.6
Apr 2, 2025 13:55:24.163623095 CEST	53	55268	1.1.1.1	192.168.2.6
Apr 2, 2025 13:55:25.608459949 CEST	64766	53	192.168.2.6	1.1.1.1
Apr 2, 2025 13:55:25.608675957 CEST	65346	53	192.168.2.6	1.1.1.1
Apr 2, 2025 13:55:25.741765976 CEST	53	65346	1.1.1.1	192.168.2.6
Apr 2, 2025 13:55:26.621665955 CEST	50180	53	192.168.2.6	1.1.1.1
Apr 2, 2025 13:55:28.645344019 CEST	53348	53	192.168.2.6	1.1.1.1
Apr 2, 2025 13:55:28.772082090 CEST	53	53348	1.1.1.1	192.168.2.6
Apr 2, 2025 13:55:37.744445086 CEST	60764	53	192.168.2.6	1.1.1.1
Apr 2, 2025 13:55:37.744518042 CEST	58029	53	192.168.2.6	1.1.1.1
Apr 2, 2025 13:55:37.905333042 CEST	53	58029	1.1.1.1	192.168.2.6
Apr 2, 2025 13:55:38.757622004 CEST	57168	53	192.168.2.6	1.1.1.1
Apr 2, 2025 13:55:38.903162956 CEST	53	57168	1.1.1.1	192.168.2.6
Apr 2, 2025 13:55:39.905726910 CEST	51006	53	192.168.2.6	1.1.1.1
Apr 2, 2025 13:55:39.906289101 CEST	65064	53	192.168.2.6	1.1.1.1
Apr 2, 2025 13:55:39.907257080 CEST	57813	53	192.168.2.6	1.1.1.1
Apr 2, 2025 13:55:39.907480001 CEST	53798	53	192.168.2.6	1.1.1.1
Apr 2, 2025 13:55:40.025590897 CEST	53	53798	1.1.1.1	192.168.2.6
Apr 2, 2025 13:55:40.038886070 CEST	53	57813	1.1.1.1	192.168.2.6
Apr 2, 2025 13:55:40.048404932 CEST	53	51006	1.1.1.1	192.168.2.6
Apr 2, 2025 13:55:42.102782011 CEST	55991	53	192.168.2.6	1.1.1.1
Apr 2, 2025 13:55:42.103015900 CEST	60692	53	192.168.2.6	1.1.1.1
Apr 2, 2025 13:55:42.164972067 CEST	53	58920	1.1.1.1	192.168.2.6
Apr 2, 2025 13:55:42.227304935 CEST	53	60692	1.1.1.1	192.168.2.6
Apr 2, 2025 13:55:42.239804029 CEST	53	55991	1.1.1.1	192.168.2.6
Apr 2, 2025 13:55:43.404263020 CEST	60545	53	192.168.2.6	1.1.1.1
Apr 2, 2025 13:55:43.404402018 CEST	61228	53	192.168.2.6	1.1.1.1
Apr 2, 2025 13:55:43.511533022 CEST	53	61228	1.1.1.1	192.168.2.6
Apr 2, 2025 13:55:43.529553890 CEST	53	60545	1.1.1.1	192.168.2.6
Apr 2, 2025 13:55:43.851428032 CEST	57168	53	192.168.2.6	1.1.1.1
Apr 2, 2025 13:55:43.851558924 CEST	49616	53	192.168.2.6	1.1.1.1
Apr 2, 2025 13:55:43.991748095 CEST	53	57168	1.1.1.1	192.168.2.6
Apr 2, 2025 13:55:43.993407011 CEST	53	49616	1.1.1.1	192.168.2.6
Apr 2, 2025 13:55:46.424185991 CEST	60660	53	192.168.2.6	1.1.1.1
Apr 2, 2025 13:55:46.424556017 CEST	62587	53	192.168.2.6	1.1.1.1
Apr 2, 2025 13:55:46.563937902 CEST	53	62587	1.1.1.1	192.168.2.6
Apr 2, 2025 13:55:46.568156004 CEST	53	60660	1.1.1.1	192.168.2.6
Apr 2, 2025 13:55:48.348081112 CEST	57945	53	192.168.2.6	1.1.1.1
Apr 2, 2025 13:55:48.348329067 CEST	63682	53	192.168.2.6	1.1.1.1
Apr 2, 2025 13:55:48.483896971 CEST	53	63682	1.1.1.1	192.168.2.6
Apr 2, 2025 13:55:48.485199928 CEST	53	57945	1.1.1.1	192.168.2.6
Apr 2, 2025 13:55:56.233200073 CEST	65196	53	192.168.2.6	1.1.1.1
Apr 2, 2025 13:55:56.234139919 CEST	59697	53	192.168.2.6	1.1.1.1
Apr 2, 2025 13:55:56.389588118 CEST	53	59697	1.1.1.1	192.168.2.6
Apr 2, 2025 13:55:57.507174015 CEST	49469	53	192.168.2.6	1.1.1.1
Apr 2, 2025 13:55:57.637598991 CEST	57311	53	192.168.2.6	1.1.1.1
Apr 2, 2025 13:55:58.161952019 CEST	53	65196	1.1.1.1	192.168.2.6
Apr 2, 2025 13:55:58.654393911 CEST	57311	53	192.168.2.6	1.1.1.1
Apr 2, 2025 13:55:58.788758039 CEST	53	57311	1.1.1.1	192.168.2.6
Apr 2, 2025 13:56:03.796935081 CEST	60081	53	192.168.2.6	1.1.1.1
Apr 2, 2025 13:56:03.797159910 CEST	51316	53	192.168.2.6	1.1.1.1
Apr 2, 2025 13:56:03.951114893 CEST	53	51316	1.1.1.1	192.168.2.6
Apr 2, 2025 13:56:04.793297052 CEST	53	58937	1.1.1.1	192.168.2.6
Apr 2, 2025 13:56:04.808114052 CEST	55954	53	192.168.2.6	1.1.1.1
Apr 2, 2025 13:56:04.954637051 CEST	53	55954	1.1.1.1	192.168.2.6
Apr 2, 2025 13:56:05.312864065 CEST	53	50193	1.1.1.1	192.168.2.6
Apr 2, 2025 13:56:05.996726990 CEST	138	138	192.168.2.6	192.168.2.255
Apr 2, 2025 13:56:06.183923006 CEST	50887	53	192.168.2.6	1.1.1.1
Apr 2, 2025 13:56:06.184097052 CEST	55280	53	192.168.2.6	1.1.1.1
Apr 2, 2025 13:56:06.314096928 CEST	53	50887	1.1.1.1	192.168.2.6
Apr 2, 2025 13:56:06.317296982 CEST	53	55280	1.1.1.1	192.168.2.6
Apr 2, 2025 13:56:07.555906057 CEST	64375	53	192.168.2.6	1.1.1.1
Apr 2, 2025 13:56:07.555906057 CEST	54188	53	192.168.2.6	1.1.1.1
Apr 2, 2025 13:56:07.690412998 CEST	53	64375	1.1.1.1	192.168.2.6
Apr 2, 2025 13:56:07.696511030 CEST	53	54188	1.1.1.1	192.168.2.6
Apr 2, 2025 13:56:14.169312000 CEST	51399	53	192.168.2.6	1.1.1.1
Apr 2, 2025 13:56:14.169804096 CEST	65021	53	192.168.2.6	1.1.1.1
Apr 2, 2025 13:56:14.307760954 CEST	53	51399	1.1.1.1	192.168.2.6
Apr 2, 2025 13:56:14.312283039 CEST	53	65021	1.1.1.1	192.168.2.6
Apr 2, 2025 13:56:14.314120054 CEST	60384	53	192.168.2.6	1.1.1.1
Apr 2, 2025 13:56:14.314640045 CEST	65144	53	192.168.2.6	1.1.1.1
Apr 2, 2025 13:56:14.418478966 CEST	53	60384	1.1.1.1	192.168.2.6
Apr 2, 2025 13:56:14.430066109 CEST	53	65144	1.1.1.1	192.168.2.6
Apr 2, 2025 13:56:15.483498096 CEST	59925	53	192.168.2.6	1.1.1.1
Apr 2, 2025 13:56:15.484093904 CEST	51427	53	192.168.2.6	1.1.1.1
Apr 2, 2025 13:56:15.586476088 CEST	53	51427	1.1.1.1	192.168.2.6
Apr 2, 2025 13:56:15.640883923 CEST	53	59925	1.1.1.1	192.168.2.6
Apr 2, 2025 13:56:17.678673029 CEST	59199	53	192.168.2.6	1.1.1.1
Apr 2, 2025 13:56:17.810791969 CEST	53	59199	1.1.1.1	192.168.2.6
Apr 2, 2025 13:56:23.115371943 CEST	57984	53	192.168.2.6	1.1.1.1
Apr 2, 2025 13:56:23.115562916 CEST	56774	53	192.168.2.6	1.1.1.1
Apr 2, 2025 13:56:23.236850023 CEST	53	56774	1.1.1.1	192.168.2.6
Apr 2, 2025 13:56:23.237037897 CEST	53	57984	1.1.1.1	192.168.2.6
Apr 2, 2025 13:56:23.541557074 CEST	51464	53	192.168.2.6	1.1.1.1
Apr 2, 2025 13:56:23.541757107 CEST	62095	53	192.168.2.6	1.1.1.1
Apr 2, 2025 13:56:23.646534920 CEST	53	51464	1.1.1.1	192.168.2.6
Apr 2, 2025 13:56:23.676781893 CEST	53	62095	1.1.1.1	192.168.2.6
Apr 2, 2025 13:56:24.087142944 CEST	53716	53	192.168.2.6	1.1.1.1
Apr 2, 2025 13:56:24.087372065 CEST	57714	53	192.168.2.6	1.1.1.1
Apr 2, 2025 13:56:24.216753006 CEST	53	57714	1.1.1.1	192.168.2.6
Apr 2, 2025 13:56:24.217905998 CEST	50306	53	192.168.2.6	1.1.1.1
Apr 2, 2025 13:56:24.218063116 CEST	57943	53	192.168.2.6	1.1.1.1
Apr 2, 2025 13:56:24.223844051 CEST	53	53716	1.1.1.1	192.168.2.6
Apr 2, 2025 13:56:24.320205927 CEST	53	50306	1.1.1.1	192.168.2.6
Apr 2, 2025 13:56:24.321614027 CEST	53	57943	1.1.1.1	192.168.2.6
Apr 2, 2025 13:56:25.011773109 CEST	60545	53	192.168.2.6	1.1.1.1
Apr 2, 2025 13:56:25.012115955 CEST	50199	53	192.168.2.6	1.1.1.1
Apr 2, 2025 13:56:25.114434958 CEST	53	50199	1.1.1.1	192.168.2.6
Apr 2, 2025 13:56:25.114602089 CEST	53	60545	1.1.1.1	192.168.2.6
Apr 2, 2025 13:56:26.025536060 CEST	51901	53	192.168.2.6	1.1.1.1
Apr 2, 2025 13:56:26.025696039 CEST	51138	53	192.168.2.6	1.1.1.1
Apr 2, 2025 13:56:26.124547958 CEST	53	51138	1.1.1.1	192.168.2.6
Apr 2, 2025 13:56:26.161839008 CEST	53	51901	1.1.1.1	192.168.2.6
Apr 2, 2025 13:56:27.330903053 CEST	53603	53	192.168.2.6	1.1.1.1
Apr 2, 2025 13:56:27.331312895 CEST	62203	53	192.168.2.6	1.1.1.1
Apr 2, 2025 13:56:27.452218056 CEST	53	53603	1.1.1.1	192.168.2.6
Apr 2, 2025 13:56:27.466160059 CEST	53	62203	1.1.1.1	192.168.2.6
Apr 2, 2025 13:56:28.053611040 CEST	50228	53	192.168.2.6	1.1.1.1
Apr 2, 2025 13:56:28.160164118 CEST	53	50228	1.1.1.1	192.168.2.6
Apr 2, 2025 13:56:29.068392992 CEST	50228	53	192.168.2.6	1.1.1.1
Apr 2, 2025 13:56:29.197752953 CEST	53	50228	1.1.1.1	192.168.2.6
Apr 2, 2025 13:56:29.789278984 CEST	55274	53	192.168.2.6	1.1.1.1
Apr 2, 2025 13:56:29.789647102 CEST	59492	53	192.168.2.6	1.1.1.1
Apr 2, 2025 13:56:29.929372072 CEST	53	55274	1.1.1.1	192.168.2.6
Apr 2, 2025 13:56:29.930783033 CEST	53	59492	1.1.1.1	192.168.2.6
Apr 2, 2025 13:56:30.069762945 CEST	50228	53	192.168.2.6	1.1.1.1
Apr 2, 2025 13:56:30.205949068 CEST	53	50228	1.1.1.1	192.168.2.6
Apr 2, 2025 13:56:32.084455967 CEST	50228	53	192.168.2.6	1.1.1.1
Apr 2, 2025 13:56:32.206232071 CEST	53	50228	1.1.1.1	192.168.2.6

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2025 13:55:19.945660114 CEST	202	OUT	GET /r/gsr1.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: / If-Modified-Since: Tue, 07 Jan 2025 07:28:00 GMT User-Agent: Microsoft-CryptoAPI/10.0 Host: c.pki.goog
Apr 2, 2025 13:55:20.055509090 CEST	223	IN	HTTP/1.1 304 Not Modified Date: Wed, 02 Apr 2025 11:33:36 GMT Expires: Wed, 02 Apr 2025 12:23:36 GMT Age: 1303 Last-Modified: Tue, 07 Jan 2025 07:28:00 GMT Cache-Control: public, max-age=3000 Vary: Accept-Encoding
Apr 2, 2025 13:55:20.065542936 CEST	200	OUT	GET /r/r4.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: / If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMT User-Agent: Microsoft-CryptoAPI/10.0 Host: c.pki.goog
Apr 2, 2025 13:55:20.171509027 CEST	222	IN	HTTP/1.1 304 Not Modified Date: Wed, 02 Apr 2025 11:43:30 GMT Expires: Wed, 02 Apr 2025 12:33:30 GMT Age: 710 Last-Modified: Thu, 25 Jul 2024 14:48:00 GMT Cache-Control: public, max-age=3000 Vary: Accept-Encoding

Timestamp	Bytes transferred	Direction	Data
2025-04-02 11:55:11 UTC	1004	OUT	GET /presentation/d/e/2PACX-1vQ7Dkd_WRbgSfshqD4oLNlUmDxTYPUSUb2tLr0qsjIwZ7fwYeWMIoyLCuLiIiL3T8QaBj2et0IIqqkz/pub?start=false&loop=false&delayms=3000 HTTP/1.1 Host: docs.google.com Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Browser-Channel: stable X-Browser-Year: 2025 X-Browser-Validation: wTKGXmLo+sPWz1JKKbFzUyHly1Q= X-Browser-Copyright: Copyright 2025 Google LLC. All rights reserved. X-Client-Data: CO6MywE= Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-02 11:55:11 UTC	5182	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 X-Robots-Tag: noindex, nofollow, nosnippet Link: </static/presentation/client/css/4105792792-viewer_css_ltr.css>;rel=preload;as=style;nonce=JG8W3maLmDBY4tmYHfhyiA,</static/presentation/client/js/1573492039-viewer_integrated_core.js>;rel=preload;as=script;nonce=JG8W3maLmDBY4tmYHfhyiA Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 02 Apr 2025 11:55:11 GMT P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Strict-Transport-Security: max-age=31536000; includeSubDomains Origin-Trial: AsBCEoVg8pIwAkst2T88NNY429HzlH4fGwN+ALnF27Zl16u/ZR0Vylgws0om63IHSaH6pHPqY+k1GQ1sheqdhwgAAACGeyJvcmlnaW4iOiJodHRwczovL2dvb2dsZS5jb206NDQzIiwiZmVhdHVyZSI6IkRvY3VtZW50UG9saWN5SW5jbHVkZUpTQ2FsbFN0YWNrc0luQ3Jhc2hSZXBvcnRzIiwiZXhwaXJ5IjoxNzQ5NTEzNjAwLCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Content-Security-Policy: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/docs-tt Content-Security-Policy: base-uri 'self';object-src 'self' blob:;report-uri https://docs.google.com/presentation/cspreport;script-src 'report-sample' 'nonce-JG8W3maLmDBY4tmYHfhyiA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';worker-src 'self' blob: Reporting-Endpoints: default="/presentation/d/e/2PACX-1vQ7Dkd_WRbgSfshqD4oLNlUmDxTYPUSUb2tLr0qsjIwZ7fwYeWMIoyLCuLiIiL3T8QaBj2et0IIqqkz/web-reports?bl=editors.presentations-frontend_20250325.02_p4&app=6&clss=1&context=eJwNzntUzekaB_C33-99H1KpdrW77i33WzopKaeS2ntHddyHd-NgMmlkklCmZphJx20ylttpkhy7kZRSTIORkWbcTu7hrNwZjia6uEdx1Pn-8VnPWs93fdfz9Khz0byfzvqDNZNsAEm2ASzdJTvVQ7IVNpKVw8-2khU6SKbXSPbOWbKBLpKdhgOuktVAoZtk4z2Qe0o23UuyLTrJ8mCPXrJFvSWL7yvZiQGSBQ6U7MMQyex8JHOEocMk2-or2drhkiUHSpYBWeGSbYMZkyQrmCLZQRholiwI1BmSOUHdTMn-gNjZks2CG3GSNYJ1vGTu8CpBMuVzyQ4vlOwMjPhCMiM0p-E-dHwpmX26ZDczJXsCl7Mkuw_Gf0j2CQRvlGwcZP8g2Q7on4vfoXO7ZD3z0PsXepC_R7IycD4oWT-4Xy3ZM4i4INlkOH5Fsoug1EmmgW43JHMFx_uS9YadsB9OwjXQP5TMF3IfS1YMQQ2SjYVKOAlnoR6qXkh2DqoczewcZGrNrMTVzI5C8igzq4kysyuQM8fMisA73sz8oG-CmQVAw2Iza4PAFDMzQdFSMzsMaWlmtgYGLTezYHjgcpU1ejUrb0E_pFkZAMqCl0oPiD71UpkMGx-9UnLgnO9r5Sr0jn2tDIb_dW9TuHWbovNvU_rDvRVtSgNkZrYp62FoVpsSAN8ca1PWwuEv3inVsDG0XckBY1i78jdITmhXlsO27HYlH-Z-3aFMON-hTAdTXYcyHiya90oxHM56r1TD24L3SicE9etUwmHz7U5lO0SxLmUC1Hl1KTchKaNLSYX [TRUNCATED] Document-Policy: include-js-call-stacks-in-crash-reports Referrer-Policy: strict-origin-when-cross-origin X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Set-Cookie: NID=522=JLEqbqBzyEKyaFeMjriwHG0jyctQIODOa69zzL-GqkCCAV77XkzhK73WM-GrFqNFu9GXYOrB_Cq0fyWgNFw71PUfDyA1jcOh1sghls_Ypkqn2v2-EU0tBDm1nuR2tuljWZA72G-mtsLlJZ5FqRTDUbBd4HJOZCHhfKN6fjTs56ce1rKDO8X1tCJ8yrnifKF7rUNdOp4; expires=Thu, 02-Oct-2025 11:55:11 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Set-Cookie: GFE_RTT=224; Domain=.docs.google.com; Expires=Wed, 02-Apr-2025 12:00:11 GMT; Path=/; Secure; Priority=LOW; SameSite=strict Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding x-l2-request-path: l2-managed-4 Connection: close Transfer-Encoding: chunked
2025-04-02 11:55:11 UTC	5182	IN	Data Raw: 33 30 61 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 64 61 74 61 2d 63 61 73 74 2d 61 70 69 2d 65 6e 61 62 6c 65 64 3d 22 74 72 75 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 4a 47 38 57 33 6d 61 4c 6d 44 42 59 34 74 6d 59 48 66 68 79 69 41 22 3e 76 61 72 20 44 4f 43 53 5f 74 69 6d 69 6e 67 3d 7b 7d 3b 20 44 4f 43 53 5f 74 69 6d 69 6e 67 5b 27 70 6c 73 27 5d 3d 6e 65 77 20 44 61 74 65 28 29 2e 67 65 74 54 69 6d 65 28 29 3b 3c 2f 73 63 72 69 70 74 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 44 6f 77 6e 6c 6f 61 64 2d 46 69 6c 65 73 22 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 79 70 65 22 Data Ascii: 30a1<!DOCTYPE html><html data-cast-api-enabled="true" lang="en"><head><script nonce="JG8W3maLmDBY4tmYHfhyiA">var DOCS_timing={}; DOCS_timing['pls']=new Date().getTime();</script><meta property="og:title" content="Download-Files"><meta property="og:type"
2025-04-02 11:55:12 UTC	5182	IN	Data Raw: 2c 6e 75 6c 6c 2c 5c 22 51 76 6e 79 34 62 5c 22 5d 2c 5b 34 35 36 37 37 34 34 35 2c 6e 75 6c 6c 2c 74 72 75 65 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5c 22 72 50 59 6b 38 5c 22 5d 2c 5b 34 35 36 35 38 31 39 38 2c 6e 75 6c 6c 2c 66 61 6c 73 65 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5c 22 76 76 59 35 64 63 5c 22 5d 2c 5b 34 35 36 35 38 39 34 39 2c 6e 75 6c 6c 2c 66 61 6c 73 65 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5c 22 4e 66 53 68 6c 66 5c 22 5d 2c 5b 34 35 36 37 36 37 35 34 2c 6e 75 6c 6c 2c 66 61 6c 73 65 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5c 22 59 77 62 55 38 5c 22 5d 2c 5b 34 35 36 37 38 32 31 35 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5c 22 36 50 53 64 6b 46 59 55 78 30 73 75 4b 31 4e 5a 72 32 4b 30 53 Data Ascii: ,null,\"Qvny4b\"],[45677445,null,true,null,null,null,\"rPYk8\"],[45658198,null,false,null,null,null,\"vvY5dc\"],[45658949,null,false,null,null,null,\"NfShlf\"],[45676754,null,false,null,null,null,\"YwbU8\"],[45678215,null,null,null,\"6PSdkFYUx0suK1NZr2K0S
2025-04-02 11:55:12 UTC	2093	IN	Data Raw: 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 74 6f 6f 6c 73 2f 66 65 65 64 62 61 63 6b 22 2c 22 64 6f 63 73 2d 6f 62 73 49 6d 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 73 73 6c 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 64 6f 63 73 2f 63 6f 6d 6d 6f 6e 2f 6e 65 74 63 68 65 63 6b 2e 67 69 66 22 2c 22 64 6f 63 73 2d 6c 73 6c 74 6d 73 22 3a 32 30 30 30 30 2c 22 6c 73 73 76 22 3a 37 2c 22 64 6f 63 73 2d 6f 66 66 6c 69 6e 65 2d 6f 65 62 70 22 3a 22 2f 6f 66 66 6c 69 6e 65 2f 65 76 65 6e 74 62 75 73 77 6f 72 6b 65 72 2e 6a 73 22 2c 22 64 6f 63 73 2d 6f 66 66 6c 69 6e 65 2d 6e 6e 6f 64 69 22 3a 31 30 30 2c 22 64 6f 63 73 2d 6c 6f 63 61 6c 73 74 6f 72 65 2d 69 6f 72 74 22 3a 31 30 30 30 30 2c 22 64 6f 63 73 2d 6f 66 66 6c 69 6e 65 2d 64 63 6b 22 3a 22 41 49 7a 61 53 79 44 Data Ascii: w.google.com/tools/feedback","docs-obsImUrl":"https://ssl.gstatic.com/docs/common/netcheck.gif","docs-lsltms":20000,"lssv":7,"docs-offline-oebp":"/offline/eventbusworker.js","docs-offline-nnodi":100,"docs-localstore-iort":10000,"docs-offline-dck":"AIzaSyD
2025-04-02 11:55:12 UTC	1220	IN	Data Raw: 38 30 30 30 0d 0a 6f 72 6c 76 22 3a 30 2c 22 64 6f 63 73 2d 65 6f 73 63 22 3a 30 2c 22 64 6f 63 73 2d 65 6f 75 66 6d 22 3a 30 2c 22 64 6f 63 73 2d 65 70 72 66 6e 73 22 3a 31 2c 22 64 6f 63 73 2d 65 73 69 65 63 22 3a 30 2c 22 64 6f 63 73 2d 6c 6f 63 61 6c 73 74 6f 72 65 2d 69 6c 61 74 22 3a 31 30 30 30 30 2c 22 64 6f 63 73 2d 69 6e 74 6c 69 22 3a 31 2c 22 64 6f 63 73 2d 73 77 2d 6e 66 68 6d 73 22 3a 31 30 2c 22 64 6f 63 73 2d 6f 66 66 6c 69 6e 65 2d 6f 75 69 6c 22 3a 5b 5d 2c 22 64 6f 63 73 2d 73 77 2d 65 65 73 70 30 73 72 22 3a 31 2c 22 64 6f 63 73 2d 73 77 2d 65 65 73 73 72 72 22 3a 30 2c 22 64 6f 63 73 2d 65 64 63 6c 63 66 22 3a 31 2c 22 64 6f 63 73 2d 73 77 2d 65 64 64 66 70 63 22 3a 31 2c 22 64 6f 63 73 2d 73 77 2d 65 65 73 70 31 73 72 22 3a 30 2c 22 Data Ascii: 8000orlv":0,"docs-eosc":0,"docs-eoufm":0,"docs-eprfns":1,"docs-esiec":0,"docs-localstore-ilat":10000,"docs-intli":1,"docs-sw-nfhms":10,"docs-offline-ouil":[],"docs-sw-eesp0sr":1,"docs-sw-eessrr":0,"docs-edclcf":1,"docs-sw-eddfpc":1,"docs-sw-eesp1sr":0,"
2025-04-02 11:55:12 UTC	1220	IN	Data Raw: 30 30 32 2c 35 37 32 38 39 34 39 2c 35 37 32 38 39 36 35 2c 35 37 32 39 30 37 36 2c 35 37 32 39 30 39 32 2c 35 37 33 31 38 31 39 2c 35 37 33 31 38 33 35 2c 35 37 33 32 33 34 35 2c 35 37 33 32 33 36 37 2c 35 37 33 34 36 31 36 2c 35 37 33 34 36 33 32 2c 35 37 33 35 31 31 38 2c 35 37 33 35 31 33 34 2c 35 37 33 35 32 33 36 2c 35 37 33 35 32 35 32 2c 35 37 33 37 37 38 34 2c 35 37 33 37 38 30 30 2c 35 37 34 30 31 37 30 2c 35 37 34 30 31 38 36 2c 35 37 34 30 33 32 35 2c 35 37 34 30 33 34 31 2c 35 37 34 30 37 39 38 2c 35 37 34 30 38 31 34 2c 35 37 34 32 30 34 30 2c 35 37 34 32 30 35 36 2c 35 37 34 33 37 37 31 2c 35 37 34 33 37 38 37 2c 35 37 34 36 37 30 38 2c 35 37 34 36 37 32 34 2c 35 37 35 30 32 33 38 2c 35 37 35 30 32 35 34 2c 35 37 35 33 36 36 35 2c 35 37 35 Data Ascii: 002,5728949,5728965,5729076,5729092,5731819,5731835,5732345,5732367,5734616,5734632,5735118,5735134,5735236,5735252,5737784,5737800,5740170,5740186,5740325,5740341,5740798,5740814,5742040,5742056,5743771,5743787,5746708,5746724,5750238,5750254,5753665,575
2025-04-02 11:55:12 UTC	1220	IN	Data Raw: 35 30 35 30 33 38 34 37 2c 35 30 35 31 33 30 35 34 2c 35 30 35 32 39 31 38 33 2c 35 30 35 32 39 31 39 31 2c 35 30 35 33 38 38 30 34 2c 35 30 35 33 38 38 31 32 2c 35 30 35 34 39 34 39 35 2c 35 30 35 34 39 35 30 33 2c 35 30 35 35 30 30 39 31 2c 35 30 35 35 30 30 39 39 2c 35 30 35 36 31 34 38 33 2c 35 30 35 36 31 34 39 31 2c 35 30 35 36 32 38 36 37 2c 35 30 35 36 32 38 37 38 2c 35 30 35 38 37 30 36 32 2c 35 30 35 38 37 30 37 30 2c 35 30 35 39 36 34 34 33 2c 35 30 35 39 36 34 35 34 2c 35 30 36 30 32 32 32 31 2c 35 30 36 30 32 32 32 39 2c 37 30 39 37 31 31 37 36 2c 37 30 39 37 31 31 38 34 2c 37 31 30 33 36 35 39 33 2c 37 31 30 33 36 36 30 31 2c 37 31 30 33 37 33 31 34 2c 37 31 30 33 37 33 32 32 2c 37 31 30 33 38 32 33 35 2c 37 31 30 33 38 32 34 33 2c 37 31 30 Data Ascii: 50503847,50513054,50529183,50529191,50538804,50538812,50549495,50549503,50550091,50550099,50561483,50561491,50562867,50562878,50587062,50587070,50596443,50596454,50602221,50602229,70971176,70971184,71036593,71036601,71037314,71037322,71038235,71038243,710
2025-04-02 11:55:12 UTC	1220	IN	Data Raw: 34 34 31 2c 37 31 38 39 39 34 35 32 2c 37 31 39 36 30 35 32 30 2c 37 31 39 36 30 35 32 38 2c 37 31 39 36 31 30 38 36 2c 37 31 39 36 31 30 39 34 2c 37 31 39 36 37 35 33 33 2c 39 34 33 32 36 37 33 39 2c 39 34 33 32 37 35 35 31 2c 39 34 33 32 37 35 35 39 2c 39 34 33 35 33 33 38 38 2c 39 34 33 35 33 33 39 36 2c 39 34 34 33 34 34 33 37 2c 39 34 34 33 34 34 34 35 2c 39 34 34 38 32 32 34 33 2c 39 34 35 30 37 38 38 34 2c 39 34 35 30 37 38 39 32 2c 39 34 35 33 34 33 32 35 2c 39 34 35 37 33 37 39 39 2c 39 34 35 37 33 38 30 37 2c 39 34 36 32 34 38 38 35 2c 39 34 36 32 34 38 39 33 2c 39 34 36 32 39 38 35 37 2c 39 34 36 32 39 38 36 35 2c 39 34 36 36 31 38 32 32 2c 39 34 36 36 31 38 33 30 2c 39 34 36 39 32 33 35 38 2c 39 34 36 39 32 33 36 36 2c 39 34 37 32 39 31 39 36 Data Ascii: 441,71899452,71960520,71960528,71961086,71961094,71967533,94326739,94327551,94327559,94353388,94353396,94434437,94434445,94482243,94507884,94507892,94534325,94573799,94573807,94624885,94624893,94629857,94629865,94661822,94661830,94692358,94692366,94729196
2025-04-02 11:55:12 UTC	1220	IN	Data Raw: 35 30 33 31 35 36 2c 31 30 31 35 30 33 31 36 34 2c 31 30 31 35 30 38 36 37 39 2c 31 30 31 35 30 38 36 39 35 2c 31 30 31 35 31 36 34 38 32 2c 31 30 31 35 31 36 34 39 30 2c 31 30 31 35 35 32 34 32 39 2c 31 30 31 35 35 32 34 34 35 2c 31 30 31 35 36 31 35 33 32 2c 31 30 31 35 36 31 35 34 30 2c 31 30 31 35 36 32 35 32 36 2c 31 30 31 35 36 32 35 33 34 2c 31 30 31 35 37 35 36 33 35 2c 31 30 31 35 37 35 36 34 30 2c 31 30 31 36 31 37 35 35 36 2c 31 30 31 36 31 37 35 36 34 2c 31 30 31 36 32 39 38 38 36 2c 31 30 31 36 32 39 38 39 34 2c 31 30 31 36 33 31 33 31 31 2c 31 30 31 36 33 31 33 31 39 2c 31 30 31 36 35 39 33 31 34 2c 31 30 31 36 35 39 33 32 32 2c 31 30 31 36 37 32 36 38 39 2c 31 30 31 36 37 32 36 39 34 2c 31 30 31 36 38 37 30 33 37 2c 31 30 31 36 38 37 30 34 Data Ascii: 503156,101503164,101508679,101508695,101516482,101516490,101552429,101552445,101561532,101561540,101562526,101562534,101575635,101575640,101617556,101617564,101629886,101629894,101631311,101631319,101659314,101659322,101672689,101672694,101687037,10168704
2025-04-02 11:55:12 UTC	1220	IN	Data Raw: 31 35 39 32 31 33 2c 31 30 32 31 35 39 32 32 31 2c 31 30 32 31 35 39 34 37 32 2c 31 30 32 31 35 39 34 38 30 2c 31 30 32 31 36 31 32 38 35 2c 31 30 32 31 36 31 32 39 33 2c 31 30 32 31 36 31 34 32 37 2c 31 30 32 31 36 31 34 33 35 2c 31 30 32 31 39 38 33 36 32 2c 31 30 32 31 39 38 33 37 30 2c 31 30 32 32 30 30 33 38 35 2c 31 30 32 32 30 37 33 31 34 2c 31 30 32 32 30 38 31 39 32 2c 31 30 32 32 30 38 32 30 30 2c 31 30 32 32 32 36 34 32 34 2c 31 30 32 32 32 36 34 33 32 2c 31 30 32 32 33 38 33 31 34 2c 31 30 32 32 33 38 33 33 30 2c 31 30 32 32 34 34 35 34 39 2c 31 30 32 32 34 34 35 35 37 2c 31 30 32 32 35 35 34 32 30 2c 31 30 32 32 35 35 34 32 38 2c 31 30 32 32 37 35 30 36 37 2c 31 30 32 32 37 35 30 37 32 2c 31 30 32 32 38 30 37 36 38 2c 31 30 32 32 38 30 37 37 Data Ascii: 159213,102159221,102159472,102159480,102161285,102161293,102161427,102161435,102198362,102198370,102200385,102207314,102208192,102208200,102226424,102226432,102238314,102238330,102244549,102244557,102255420,102255428,102275067,102275072,102280768,10228077
2025-04-02 11:55:12 UTC	1220	IN	Data Raw: 37 32 32 38 30 30 2c 35 37 35 38 34 39 37 2c 35 37 33 35 31 33 34 2c 31 30 32 35 36 34 31 38 31 2c 37 31 36 30 31 31 35 32 2c 31 30 32 36 31 31 38 31 34 2c 31 30 31 34 35 33 33 36 39 2c 35 37 31 35 33 32 31 2c 37 31 35 33 30 32 35 31 2c 39 34 39 34 32 35 31 38 2c 35 37 32 37 32 35 37 2c 31 30 32 31 34 36 36 33 35 2c 35 37 36 30 33 32 37 2c 35 37 31 37 39 30 37 2c 31 30 32 32 33 38 33 33 30 2c 31 30 32 37 38 37 34 39 33 2c 31 30 32 36 31 38 37 35 36 2c 35 37 30 39 32 30 39 2c 37 31 33 38 37 39 31 37 2c 37 31 36 38 39 38 38 38 2c 37 31 36 36 31 31 30 38 2c 31 30 31 37 38 38 32 35 31 2c 35 37 31 32 39 31 33 2c 31 30 32 32 35 35 34 32 38 2c 31 30 31 38 35 38 32 37 33 2c 31 30 31 39 36 32 30 35 38 2c 31 30 31 35 30 38 36 39 35 2c 39 39 34 30 30 31 39 30 2c 39 Data Ascii: 722800,5758497,5735134,102564181,71601152,102611814,101453369,5715321,71530251,94942518,5727257,102146635,5760327,5717907,102238330,102787493,102618756,5709209,71387917,71689888,71661108,101788251,5712913,102255428,101858273,101962058,101508695,99400190,9

Timestamp	Bytes transferred	Direction	Data
2025-04-02 11:55:12 UTC	994	OUT	GET /static/presentation/client/css/4105792792-viewer_css_ltr.css HTTP/1.1 Host: docs.google.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: text/css,/;q=0.1 X-Client-Data: CO6MywE= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://docs.google.com/presentation/d/e/2PACX-1vQ7Dkd_WRbgSfshqD4oLNlUmDxTYPUSUb2tLr0qsjIwZ7fwYeWMIoyLCuLiIiL3T8QaBj2et0IIqqkz/pub?start=false&loop=false&delayms=3000 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: NID=522=JLEqbqBzyEKyaFeMjriwHG0jyctQIODOa69zzL-GqkCCAV77XkzhK73WM-GrFqNFu9GXYOrB_Cq0fyWgNFw71PUfDyA1jcOh1sghls_Ypkqn2v2-EU0tBDm1nuR2tuljWZA72G-mtsLlJZ5FqRTDUbBd4HJOZCHhfKN6fjTs56ce1rKDO8X1tCJ8yrnifKF7rUNdOp4; GFE_RTT=224
2025-04-02 11:55:12 UTC	794	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/docs Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="docs" Report-To: {"group":"docs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/docs"}]} Content-Length: 776239 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon, 31 Mar 2025 15:50:35 GMT Expires: Tue, 31 Mar 2026 15:50:35 GMT Cache-Control: public, max-age=31536000 Last-Modified: Wed, 26 Mar 2025 15:14:55 GMT Content-Type: text/css Vary: Accept-Encoding, Origin Age: 158677 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-04-02 11:55:12 UTC	426	IN	Data Raw: 40 63 68 61 72 73 65 74 20 22 55 54 46 2d 38 22 3b 40 69 6d 70 6f 72 74 20 75 72 6c 28 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 47 6f 6f 67 6c 65 2b 53 61 6e 73 29 3b 2e 61 70 70 73 2d 61 63 74 69 6f 6e 2d 73 68 6f 72 74 63 75 74 2d 69 63 6f 6e 7b 64 69 72 65 63 74 69 6f 6e 3a 6c 74 72 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 6d 69 64 64 6c 65 7d 2e 61 70 70 73 2d 61 63 74 69 6f 6e 2d 73 68 6f 72 74 63 75 74 2d 69 6d 67 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 75 72 6c 28 68 74 74 70 73 3a 2f 2f 73 73 6c 2e 67 73 74 Data Ascii: @charset "UTF-8";@import url(https://fonts.googleapis.com/css?family=Google+Sans);.apps-action-shortcut-icon{direction:ltr;text-align:left;overflow:hidden;position:relative;vertical-align:middle}.apps-action-shortcut-img:before{content:url(https://ssl.gst
2025-04-02 11:55:12 UTC	1220	IN	Data Raw: 74 63 75 74 2d 62 61 63 6b 2d 77 68 69 74 65 7b 6c 65 66 74 3a 30 3b 74 6f 70 3a 2d 32 31 70 78 7d 2e 61 70 70 73 2d 61 63 74 69 6f 6e 2d 73 68 6f 72 74 63 75 74 2d 63 6c 6f 73 65 2d 78 7b 6c 65 66 74 3a 30 3b 74 6f 70 3a 2d 38 34 70 78 7d 2e 61 70 70 73 2d 61 63 74 69 6f 6e 2d 73 68 6f 72 74 63 75 74 2d 73 65 61 72 63 68 7b 6c 65 66 74 3a 30 3b 74 6f 70 3a 2d 34 32 70 78 7d 2e 61 70 70 73 2d 61 63 74 69 6f 6e 2d 73 68 6f 72 74 63 75 74 2d 73 65 61 72 63 68 2d 77 68 69 74 65 7b 6c 65 66 74 3a 30 3b 74 6f 70 3a 30 7d 2e 61 70 70 73 2d 75 69 2d 6d 61 74 65 72 69 61 6c 2d 73 6c 69 64 65 2d 74 6f 67 67 6c 65 2d 63 6f 6e 74 61 69 6e 65 72 7b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 64 69 73 70 6c Data Ascii: tcut-back-white{left:0;top:-21px}.apps-action-shortcut-close-x{left:0;top:-84px}.apps-action-shortcut-search{left:0;top:-42px}.apps-action-shortcut-search-white{left:0;top:0}.apps-ui-material-slide-toggle-container{align-items:center;background:none;displ
2025-04-02 11:55:12 UTC	1220	IN	Data Raw: 2e 61 70 70 73 2d 75 69 2d 6d 61 74 65 72 69 61 6c 2d 73 6c 69 64 65 2d 74 6f 67 67 6c 65 2d 63 6f 6e 74 61 69 6e 65 72 2d 66 6f 63 75 73 65 64 20 2e 61 70 70 73 2d 75 69 2d 6d 61 74 65 72 69 61 6c 2d 73 6c 69 64 65 2d 74 6f 67 67 6c 65 2d 74 68 75 6d 62 7b 62 6f 78 2d 73 68 61 64 6f 77 3a 30 20 30 20 34 70 78 20 72 67 62 61 28 30 2c 30 2c 30 2c 2e 31 34 29 2c 30 20 34 70 78 20 38 70 78 20 72 67 62 61 28 30 2c 30 2c 30 2c 2e 32 38 29 7d 2e 61 70 70 73 2d 75 69 2d 6d 61 74 65 72 69 61 6c 2d 73 6c 69 64 65 2d 74 6f 67 67 6c 65 2d 63 6f 6e 74 61 69 6e 65 72 2d 68 6f 76 65 72 20 2e 61 70 70 73 2d 75 69 2d 6d 61 74 65 72 69 61 6c 2d 73 6c 69 64 65 2d 74 6f 67 67 6c 65 2d 74 68 75 6d 62 7b 62 6f 78 2d 73 68 61 64 6f 77 3a 30 20 30 20 36 70 78 20 72 67 62 61 28 Data Ascii: .apps-ui-material-slide-toggle-container-focused .apps-ui-material-slide-toggle-thumb{box-shadow:0 0 4px rgba(0,0,0,.14),0 4px 8px rgba(0,0,0,.28)}.apps-ui-material-slide-toggle-container-hover .apps-ui-material-slide-toggle-thumb{box-shadow:0 0 6px rgba(
2025-04-02 11:55:12 UTC	1220	IN	Data Raw: 2d 77 69 64 74 68 3a 33 34 70 78 3b 70 61 64 64 69 6e 67 3a 30 7d 2e 6a 66 6b 2d 62 75 74 74 6f 6e 2d 63 6f 6c 6c 61 70 73 65 2d 6c 65 66 74 2c 2e 6a 66 6b 2d 62 75 74 74 6f 6e 2d 63 6f 6c 6c 61 70 73 65 2d 72 69 67 68 74 7b 7a 2d 69 6e 64 65 78 3a 31 7d 2e 6a 66 6b 2d 62 75 74 74 6f 6e 2d 63 6f 6c 6c 61 70 73 65 2d 6c 65 66 74 2e 6a 66 6b 2d 62 75 74 74 6f 6e 2d 64 69 73 61 62 6c 65 64 7b 7a 2d 69 6e 64 65 78 3a 30 7d 2e 6a 66 6b 2d 62 75 74 74 6f 6e 2d 63 68 65 63 6b 65 64 2e 6a 66 6b 2d 62 75 74 74 6f 6e 2d 63 6f 6c 6c 61 70 73 65 2d 6c 65 66 74 2c 2e 6a 66 6b 2d 62 75 74 74 6f 6e 2d 63 68 65 63 6b 65 64 2e 6a 66 6b 2d 62 75 74 74 6f 6e 2d 63 6f 6c 6c 61 70 73 65 2d 72 69 67 68 74 7b 7a 2d 69 6e 64 65 78 3a 32 7d 2e 6a 66 6b 2d 62 75 74 74 6f 6e 2d 63 Data Ascii: -width:34px;padding:0}.jfk-button-collapse-left,.jfk-button-collapse-right{z-index:1}.jfk-button-collapse-left.jfk-button-disabled{z-index:0}.jfk-button-checked.jfk-button-collapse-left,.jfk-button-checked.jfk-button-collapse-right{z-index:2}.jfk-button-c
2025-04-02 11:55:12 UTC	1220	IN	Data Raw: 64 20 74 72 61 6e 73 70 61 72 65 6e 74 3b 6f 75 74 6c 69 6e 65 3a 31 70 78 20 73 6f 6c 69 64 20 23 34 64 39 30 66 65 3b 6f 75 74 6c 69 6e 65 3a 30 20 74 72 61 6e 73 70 61 72 65 6e 74 7d 2e 6a 66 6b 2d 62 75 74 74 6f 6e 2d 61 63 74 69 6f 6e 2e 6a 66 6b 2d 62 75 74 74 6f 6e 2d 63 6c 65 61 72 2d 6f 75 74 6c 69 6e 65 7b 62 6f 78 2d 73 68 61 64 6f 77 3a 6e 6f 6e 65 3b 6f 75 74 6c 69 6e 65 3a 6e 6f 6e 65 7d 2e 6a 66 6b 2d 62 75 74 74 6f 6e 2d 61 63 74 69 6f 6e 3a 61 63 74 69 76 65 7b 62 6f 78 2d 73 68 61 64 6f 77 3a 69 6e 73 65 74 20 30 20 31 70 78 20 32 70 78 20 72 67 62 61 28 30 2c 30 2c 30 2c 2e 33 29 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 33 35 37 61 65 38 3b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 23 32 66 35 62 62 37 3b 62 6f 72 64 65 72 2d 74 Data Ascii: d transparent;outline:1px solid #4d90fe;outline:0 transparent}.jfk-button-action.jfk-button-clear-outline{box-shadow:none;outline:none}.jfk-button-action:active{box-shadow:inset 0 1px 2px rgba(0,0,0,.3);background:#357ae8;border:1px solid #2f5bb7;border-t
2025-04-02 11:55:12 UTC	1220	IN	Data Raw: 65 2e 6a 66 6b 2d 62 75 74 74 6f 6e 2d 63 68 65 63 6b 65 64 7b 62 6f 78 2d 73 68 61 64 6f 77 3a 69 6e 73 65 74 20 30 20 31 70 78 20 32 70 78 20 72 67 62 61 28 30 2c 30 2c 30 2c 2e 31 29 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 65 65 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 74 6f 70 2c 23 65 65 65 2c 23 65 30 65 30 65 30 29 3b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 23 63 63 63 3b 63 6f 6c 6f 72 3a 23 33 33 33 7d 2e 6a 66 6b 2d 62 75 74 74 6f 6e 2d 63 6f 6e 74 72 61 73 74 3a 66 6f 63 75 73 7b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 23 34 64 39 30 66 65 3b 6f 75 74 6c 69 6e 65 3a 6e 6f 6e 65 7d 2e 6a 66 6b 2d 62 75 74 74 6f 6e 2d 63 6f 6e 74 72 61 73 74 2e Data Ascii: e.jfk-button-checked{box-shadow:inset 0 1px 2px rgba(0,0,0,.1);background-color:#eee;background-image:linear-gradient(top,#eee,#e0e0e0);border:1px solid #ccc;color:#333}.jfk-button-contrast:focus{border:1px solid #4d90fe;outline:none}.jfk-button-contrast.
2025-04-02 11:55:12 UTC	1220	IN	Data Raw: 30 20 30 20 31 70 78 20 23 66 66 66 3b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 23 66 66 66 3b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 74 72 61 6e 73 70 61 72 65 6e 74 3b 6f 75 74 6c 69 6e 65 3a 31 70 78 20 73 6f 6c 69 64 20 23 33 64 39 34 30 30 3b 6f 75 74 6c 69 6e 65 3a 30 20 74 72 61 6e 73 70 61 72 65 6e 74 7d 2e 6a 66 6b 2d 62 75 74 74 6f 6e 2d 64 65 66 61 75 6c 74 2e 6a 66 6b 2d 62 75 74 74 6f 6e 2d 63 6c 65 61 72 2d 6f 75 74 6c 69 6e 65 7b 62 6f 78 2d 73 68 61 64 6f 77 3a 6e 6f 6e 65 3b 6f 75 74 6c 69 6e 65 3a 6e 6f 6e 65 7d 2e 6a 66 6b 2d 62 75 74 74 6f 6e 2d 64 65 66 61 75 6c 74 3a 61 63 74 69 76 65 7b 62 6f 78 2d 73 68 61 64 6f 77 3a 69 6e 73 65 74 20 30 20 31 70 78 20 32 70 78 20 72 67 62 61 28 30 2c 30 2c 30 2c 2e 33 29 3b Data Ascii: 0 0 1px #fff;border:1px solid #fff;border:1px solid transparent;outline:1px solid #3d9400;outline:0 transparent}.jfk-button-default.jfk-button-clear-outline{box-shadow:none;outline:none}.jfk-button-default:active{box-shadow:inset 0 1px 2px rgba(0,0,0,.3);
2025-04-02 11:55:12 UTC	1220	IN	Data Raw: 6f 72 3a 23 66 35 66 35 66 35 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 74 6f 70 2c 23 66 35 66 35 66 35 2c 23 66 31 66 31 66 31 29 3b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 23 64 63 64 63 64 63 3b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 72 67 62 61 28 30 2c 30 2c 30 2c 2e 31 29 3b 63 6f 6c 6f 72 3a 23 34 34 34 3b 68 65 69 67 68 74 3a 31 37 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 37 70 78 3b 6d 69 6e 2d 77 69 64 74 68 3a 32 32 70 78 3b 74 65 78 74 2d 73 68 61 64 6f 77 3a 30 20 31 70 78 20 72 67 62 61 28 30 2c 30 2c 30 2c 2e 31 29 7d 2e 6a 66 6b 2d 62 75 74 74 6f 6e 2d 6d 69 6e 69 2e 6a 66 6b 2d 62 75 74 74 6f 6e 2d 63 6c 65 61 72 2d 6f 75 74 6c 69 6e 65 2e 6a 66 6b Data Ascii: or:#f5f5f5;background-image:linear-gradient(top,#f5f5f5,#f1f1f1);border:1px solid #dcdcdc;border:1px solid rgba(0,0,0,.1);color:#444;height:17px;line-height:17px;min-width:22px;text-shadow:0 1px rgba(0,0,0,.1)}.jfk-button-mini.jfk-button-clear-outline.jfk
2025-04-02 11:55:12 UTC	1220	IN	Data Raw: 72 69 6d 61 72 79 2e 6a 66 6b 2d 62 75 74 74 6f 6e 2d 68 6f 76 65 72 7b 62 6f 78 2d 73 68 61 64 6f 77 3a 30 20 31 70 78 20 31 70 78 20 72 67 62 61 28 30 2c 30 2c 30 2c 2e 32 29 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 63 35 33 37 32 37 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 74 6f 70 2c 23 64 64 34 62 33 39 2c 23 63 35 33 37 32 37 29 3b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 23 62 30 32 38 31 61 3b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 2d 63 6f 6c 6f 72 3a 23 61 66 33 30 31 66 7d 2e 6a 66 6b 2d 62 75 74 74 6f 6e 2d 70 72 69 6d 61 72 79 3a 66 6f 63 75 73 7b 62 6f 78 2d 73 68 61 64 6f 77 3a 69 6e 73 65 74 20 30 20 30 20 30 20 31 70 78 20 23 66 66 66 3b 62 6f 72 64 65 Data Ascii: rimary.jfk-button-hover{box-shadow:0 1px 1px rgba(0,0,0,.2);background-color:#c53727;background-image:linear-gradient(top,#dd4b39,#c53727);border:1px solid #b0281a;border-bottom-color:#af301f}.jfk-button-primary:focus{box-shadow:inset 0 0 0 1px #fff;borde
2025-04-02 11:55:12 UTC	1220	IN	Data Raw: 20 32 70 78 20 30 20 72 67 62 61 28 30 2c 30 2c 30 2c 2e 31 29 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 33 39 38 62 66 32 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 74 6f 70 2c 23 33 62 39 33 66 66 2c 23 33 36 38 39 65 65 29 3b 63 6f 6c 6f 72 3a 23 66 66 66 3b 68 65 69 67 68 74 3a 32 37 70 78 7d 2e 6a 66 6b 2d 73 6c 69 64 65 54 6f 67 67 6c 65 2d 6f 66 66 7b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 32 70 78 20 32 70 78 20 30 20 30 7d 2e 6a 66 6b 2d 73 6c 69 64 65 54 6f 67 67 6c 65 2d 74 68 75 6d 62 7b 62 6f 78 2d 73 68 61 64 6f 77 3a 30 20 31 70 78 20 32 70 78 20 30 20 72 67 62 61 28 30 2c 30 2c 30 2c 2e 31 29 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 35 66 35 66 Data Ascii: 2px 0 rgba(0,0,0,.1);background-color:#398bf2;background-image:linear-gradient(top,#3b93ff,#3689ee);color:#fff;height:27px}.jfk-slideToggle-off{border-radius:2px 2px 0 0}.jfk-slideToggle-thumb{box-shadow:0 1px 2px 0 rgba(0,0,0,.1);background-color:#f5f5f

Timestamp	Bytes transferred	Direction	Data
2025-04-02 11:55:12 UTC	831	OUT	GET /slidesz/AGV_vUdJaErXIJ55hdglvmfjSbJPFW0UxlncOXEIeukK-lpE_5EJ5uh5BaYVcdj_q3_TnTKD5vNdF46nR-OTR94Q5CLCKQzl6Xf2hHM67TsVRaoPZt4GNZxhtsR6gY_0XQ6UqZk=s2048?key=0T76xXlufg2HBrV9SVPofq1l HTTP/1.1 Host: lh7-rt.googleusercontent.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CO6MywE= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Referer: https://docs.google.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-02 11:55:13 UTC	467	IN	HTTP/1.1 200 OK Content-Type: image/png Vary: Origin Access-Control-Expose-Headers: Content-Length ETag: "v0" Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: private, max-age=86400, no-transform Content-Disposition: inline;filename="unnamed.png" X-Content-Type-Options: nosniff Date: Wed, 02 Apr 2025 11:55:13 GMT Server: fife Content-Length: 409598 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-04-02 11:55:13 UTC	753	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 03 3b 00 00 01 97 08 06 00 00 00 94 6e 4e 93 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c4 00 00 0e c4 01 95 2b 0e 1b 00 00 ff b2 49 44 41 54 78 5e ec fd 85 92 65 4b 96 e6 79 f6 7b 8c 8c 4c 8f 74 95 c8 bc c3 74 57 66 f7 88 54 cb 4c 0f 74 97 94 f4 73 54 57 25 05 57 06 5e 08 ba cc cc 4c 8e 06 6e ce 64 cc cc 87 c1 d8 cc e9 46 ea 7c ff b5 54 f7 d9 c7 c8 dd 6f 44 64 46 44 5e f3 f8 5c 75 83 1d 73 37 f3 9b b2 7f b9 96 ea f9 6f c2 b7 1f df e8 e3 9f fe e9 9f c2 ef 7e f7 3b 1b 0f e4 77 9e df 69 ae 3b 2c fc 1e b2 fc 13 2f f1 40 1f bc de 91 5f e7 b0 c4 af 6d e1 98 af fc 4f bf b3 7c fd f5 3d 9d ff 3a fc 93 8d ca 3f 69 9e 25 de af f0 f5 7e f7 b5 ce f1 75 e3 fc 77 fa 3c 72 ef de Data Ascii: PNGIHDR;nNgAMAapHYs+IDATx^eKy{LttWfTLtsTW%W^LndF\|ToDdFD^\us7o~;wi;,/@_mO\|=:?i%~uw<r
2025-04-02 11:55:13 UTC	1220	IN	Data Raw: f8 d5 0f ed b8 76 c2 c7 ba c6 ea 97 9c ff 51 a8 7e f1 83 50 ff 42 c7 4a fd 4b 8d 9f 7f 5f a3 ce 29 d5 cf b9 a6 f1 8b ef 29 3a af 54 3f d3 9c 7b 34 af 7d ae f9 67 df b5 b1 c1 f1 17 df d5 79 c2 fc fb 7e 4e d7 eb fa fc 94 9a d2 60 fc ec 3b a1 fe b9 ae 7d ce e8 a9 e9 98 d7 ab ea 35 98 f3 b9 b5 4f ff c1 ee 3d 2e d5 4f 7d cc bf d6 b7 f9 57 90 cf fe c1 fe 4d 55 3a 7e 1d 6a 9d bf 09 55 85 79 b5 eb b7 a1 d2 a5 79 e7 6f 43 b5 fb 49 4b a5 eb 29 8d 4f 85 ca b9 67 34 3e 1b 2a 3d cf 69 fe 5c a8 9d 7f 5e 79 31 54 95 da 85 97 42 55 a9 5d 7c 25 54 95 da a5 57 35 be aa f1 f5 50 51 6a 97 df 0c b5 2b 6f 85 da d5 b7 3d d7 de 51 de 0d 95 ab ef 86 da f5 f7 95 0f 43 9d dc fc 28 d4 6e 28 37 3f 0e 55 a5 d6 f7 49 a8 f7 7e 16 ea fd 5f 84 9a 52 ef ff 2a d4 06 4e 84 fa c0 a9 50 1b 3c Data Ascii: vQ~PBJK_)):T?{4}gy~N`;}5O=.O}WMU:~jUyyoCIK)Og4>=i\^y1TBU]\|%TW5PQj+o=QC(n(7?UI~_RNP<
2025-04-02 11:55:13 UTC	1220	IN	Data Raw: 03 8a 8e b9 06 74 ea 9a e7 b1 03 74 18 0f 62 47 e7 d3 9c d7 d4 6b 01 1e 43 8f 1e 68 6b 60 26 82 e6 a8 24 f0 90 b6 07 e2 6f f3 97 9b 88 9d 6a 87 23 a7 d2 a9 74 08 38 76 fc 84 d0 23 e4 74 3e 21 e8 00 9e a7 43 19 f0 e8 bf cd 8a b0 53 15 74 aa 11 3c 15 c0 d3 f3 a2 00 f4 82 61 a7 7a e1 65 4b e5 c2 2b 42 8e b0 73 f9 b5 50 bd fc 86 a5 c2 28 f0 54 94 ea 95 77 42 fd da 7b a1 7e 15 e8 28 37 3e d0 f8 81 b0 23 f0 f4 0a 39 37 3f 09 b5 de 4f 43 55 d0 a9 f5 7d ae 51 e9 13 76 06 be 54 4e 08 3a e4 64 a8 0d 81 1e 81 67 c8 b1 53 1b ee 10 76 ba 94 6e 81 47 d8 51 c0 4e 03 e8 4c 0a 39 11 3b f5 a9 cb ca 95 50 9b ba a6 51 99 be 11 ea c2 4e 73 b6 57 e9 33 f0 34 e7 34 82 9e 45 81 07 f4 2c 0e 85 c6 d2 88 90 23 f0 08 3b 86 1e 21 a7 b9 34 19 d6 56 a6 34 9f 14 7c a6 6c be 06 7a 04 9e Data Ascii: ttbGkChk`&$oj#t8v#t>!CSt<azeK+BsP(TwB{~(7>#97?OCU}QvTN:dgSvnGQNL9;PQNsW344E,#;!4V4\|lz
2025-04-02 11:55:13 UTC	1220	IN	Data Raw: 9b 56 d9 69 02 9d f9 3e ab ec 34 53 65 67 41 d0 59 a0 ba 33 2c f4 8c 84 ba c0 d3 00 3b 4b 13 a1 11 91 43 ea 2b 20 67 3a 34 14 83 4e 61 2e 34 8a 3e 52 d5 69 16 17 0c 3b 4d 43 cf 4a ac ec 68 04 3a 80 c7 d0 23 e4 d4 8a 61 a3 4e 85 07 f8 50 d5 11 72 18 1b 54 79 ea 61 a3 59 d3 d8 d0 c8 bc a9 68 0e 74 04 9f 8d 35 21 67 5d c0 59 17 68 84 9d 4d cd a9 f2 6c 82 1e c3 cf a6 9f df d2 28 e4 ac 73 bc b9 65 a8 d9 48 a3 21 47 e0 31 f4 f8 08 62 36 77 f7 6c 4e a5 67 53 d8 d9 14 7c bc ea 73 4b 10 f2 0a 0f d5 1d 03 0e 73 ab ec 78 a5 87 ca 0f b8 31 e4 08 3c 06 21 8d 5b 9c 17 58 b6 75 9e 6b 04 d0 70 4c 35 67 47 b1 11 e4 e8 3e ae 59 75 87 e3 04 23 ce eb 1e ab f8 10 bb 97 fb 8e c1 8f ce df be 03 7c 7e 77 e0 be fd f0 e1 9e 84 99 3c 6e 2c 06 1a ee f7 79 3a df 82 8f 63 c6 e0 93 c7 Data Ascii: Vi>4SegAY3,;KC+ g:4Na.4>Ri;MCJh:#aNPrTyaYht5!g]YhMl(seH!G1b6wlNgS\|sKsx1<![XukpL5gG>Yu#\|~w<n,y:c
2025-04-02 11:55:13 UTC	1220	IN	Data Raw: 2a 40 7e df 03 e3 47 e7 bc e2 93 c7 cf bd 0c 3d 06 1f 62 90 89 95 9d 88 97 3b b9 8a 0f 30 31 10 e9 7c 1e 3d d9 35 3d 53 a5 4a 8f a1 47 e7 bd ca 93 12 d1 a3 24 f4 64 f0 d1 7d 09 3d 79 bc a4 e3 fc f9 0c 31 7a 76 7b 58 f4 24 f0 3c 38 7a e2 b3 a6 e6 f9 e7 55 7b 96 8d 79 20 f0 90 43 d1 e3 5f 23 bd 36 f9 43 7d 7c 8b 9d 43 3e f2 3f 48 e2 3f 80 18 fd 8b 69 47 0e bf f3 03 79 f0 1f 4a 7a ad fc d7 38 f0 75 f2 89 5f 33 43 4e fa c5 3f 3a 61 e4 38 e0 e4 63 fd 9a fa 8f 2f b5 a5 65 31 d8 a4 7f f0 1a 75 0e e4 a4 d7 35 cc fc 8e ea 8c 57 69 bc b5 0d e4 50 ae d5 bd 11 3a 8e 1d c7 0d 28 ba 7b f7 b6 fe 83 f5 4a ce 3d 41 07 ec d8 9c f6 b5 88 1d 47 ce fe f5 39 04 e4 a4 b9 b7 b1 dd b3 ca 0e a3 57 77 ee 10 da d6 ac ca 43 fb 1a b8 a1 9a 13 db d8 b6 9b 06 1c 43 0e 6b 75 68 63 a3 aa Data Ascii: *@~G=b;01\|=5=SJG$d}=y1zv{X$<8zU{y C_#6C}\|C>?H?iGyJz8u_3CN?:a8c/e1u5WiP:({J=AG9WwCCkuhc
2025-04-02 11:55:13 UTC	1220	IN	Data Raw: 43 db 1a 95 1b 5a d8 62 1b 1b 55 1d 80 23 f0 38 72 40 0f 6b 74 bc 7d ed 4e 6e 9d 4e aa ec dc 8e e0 b9 45 25 87 ac c7 31 b6 b0 ed 35 0b c2 ce 4a d8 6b ac 6a ee 1b 14 ec 09 3e 8e 9d 25 c7 4e 7d c1 c6 3d 36 25 48 6b 76 0c 3b d3 61 2f ad d9 29 8c 19 76 76 8b 63 11 3b 23 02 0e 1b 14 0c 86 5d 65 67 b9 3f ec ac 38 76 58 af b3 23 ec 50 e1 d9 02 3b 0b d7 0c 3b 5b f3 57 ad 8d 0d ec 6c ce 5e 0a 9b d3 17 c3 e6 cc 85 b0 29 ec 6c 5a 1b 9b 63 67 63 a2 53 e9 08 1b e3 be 39 01 eb 75 36 c7 58 af 73 52 39 21 e8 80 1d 07 0f eb 75 36 84 1d 2a 3a 6c 4e b0 ce 5a 1d 22 e4 ac f7 be 1f 36 6e 6a b4 56 36 5a d8 68 65 7b c7 5a d9 7c 83 02 61 e7 9a 90 c3 26 05 11 3b 8d cb af 86 86 61 e7 95 d0 b8 f8 72 68 50 d5 b9 a8 a4 b5 3a e7 9f d3 e8 d8 f1 3c a9 38 74 3c b4 af 51 d5 f1 36 b6 1a 15 Data Ascii: CZbU#8r@kt}NnNE%15Jkj>%N}=6%Hkv;a/)vvc;#]eg?8vX#P;;[Wl^)lZcgcS9u6XsR9!u6*:lNZ"6njV6Zhe{Z\|a&;arhP:<8t<Q6
2025-04-02 11:55:13 UTC	1220	IN	Data Raw: 6a 0a 3d f5 73 be 5e a7 6e 9b 12 3c 6d 95 9c a6 a0 d3 64 cd 4e 6a 61 eb fc ad 55 75 c0 4e 4d d0 a9 75 fe d2 47 36 25 30 f0 3c 1a 1a 67 1e d3 f8 88 46 cd 4f ff 42 a3 af d9 c9 36 28 38 c5 ee 6b 3f 31 dc d0 b2 d6 88 95 1d 8e ad 8d 8d f3 27 84 1d d6 e8 50 e9 01 3b 6c 44 60 b8 71 e0 18 7c ac b2 03 7a 80 8e 46 6b 65 d3 79 76 65 fb 4a 90 c9 b0 23 b4 28 35 61 a7 22 74 54 23 7a 78 c8 4c 6d 6d 06 1b 70 a1 07 d0 c3 b0 e3 1b 17 70 2f 0f a9 1a e3 0e 6b 8e 18 bf 77 3f 76 0c 3c d9 3d 29 1c 3b 7a 12 78 da d0 c3 78 48 f2 e0 e1 f8 c0 43 f3 b7 f9 f3 4c c2 0e d5 1c ab ee fc ca aa 3c d6 c2 d6 e9 6b 76 ac c2 d3 fd b4 90 43 9e 31 e8 94 34 96 f4 df 6b 39 21 47 29 f7 50 d5 21 2f 85 f2 c5 56 1b 9b ad d5 b9 f8 7a 28 69 2c 5f 7a dd c1 73 45 d0 01 39 c2 0e 15 9e 54 dd a9 5c ff 40 f0 Data Ascii: j=s^n<mdNjaUuNMuG6%0<gFOB6(8k?1'P;lD`q\|zFkeyveJ#(5a"tT#zxLmmpp/kw?v<=);zxxHCL<kvC14k9!G)P!/Vz(i,_zsE9T\@
2025-04-02 11:55:13 UTC	1220	IN	Data Raw: 05 1f 6f 65 b3 aa 0e d5 1d ab f0 bc 1c 4a 17 5e 51 5e f5 ea ce e5 37 34 02 9d b7 04 1e 0f e8 a9 5c 79 57 f0 79 df 2a 3b 69 cd 4e f9 c6 87 a1 7c fd 63 ab ec 94 6f 7c 1a 2a 82 4e f9 a6 57 75 ca 7d 9f 87 b2 c0 53 11 76 2a fd 27 35 9e d4 b1 42 1b db 90 c0 33 dc 11 ca 4a 65 a4 4b 63 97 c6 ee 50 19 15 78 46 7b 04 1e 61 87 08 3b 15 61 87 f6 b5 ea d4 55 e5 4a a8 08 3b d5 29 61 47 d0 a9 4c dd 0c 55 d6 eb 4c 3b 74 aa 73 03 1a 07 85 1c 41 67 61 c8 91 33 af 2c 02 1d c5 c0 33 a1 31 81 67 2a d4 56 a6 35 57 04 9e fa ea 5c a8 59 a8 ea 2c 5a 6a 54 78 84 9d 9a d0 53 2f 2d 29 cb a1 5e 5e 51 56 85 9c 42 a8 81 9d aa d0 03 72 aa e5 50 67 ac 01 9c aa e6 15 8f a0 d3 88 69 0a 39 0d 81 a7 21 f0 34 1a cc 35 0a 3a 36 ae ad 0b 3c eb 36 02 9c e6 da 46 68 0a 3c 4d ab f0 90 ad d0 b4 51 Data Ascii: oeJ^Q^74\yWy;iN\|co\|NWu}Sv'5B3JeKcPxF{a;aUJ;)aGLUL;tsAga3,31gV5W\Y,ZjTxS/-)^^QVBrPgi9!45:6<6Fh<MQ
2025-04-02 11:55:13 UTC	1220	IN	Data Raw: b4 0a 0f eb 74 1c 3b 0d a0 b3 46 75 47 d0 51 7c d4 71 c4 4e 33 62 a7 b9 b1 a3 b9 ce 6d ed e8 78 d7 46 5a dc d6 84 9d b5 ed 18 d0 13 8f ad aa 93 55 77 04 1a aa 3a 9a 03 21 2a 3a 9b 3a 67 f8 d9 01 3d 77 e3 3d 5e ed d9 04 3a c2 8a 83 27 46 73 c0 63 60 b1 0d 0b 88 20 c4 7a 9e 88 9e 04 24 2a 44 56 15 8a b0 f1 ea 0f e8 11 58 32 f8 b4 f0 93 d0 63 b1 56 b7 16 6c ac dd 2d ce bd d5 6d df 75 c5 e0 13 47 d0 93 2a 3e f9 eb c7 b5 b9 e5 81 b3 bf da 43 5a e8 69 af f6 64 e8 21 fa dc fb a1 27 c1 25 9f 76 f4 80 19 7f c6 33 f4 ec bb de ba 87 30 f7 e7 47 43 8f c6 87 43 8f 3f 97 a6 a4 8f fc d3 f4 b1 d1 6f 7a 19 0f f3 2c ed af cf f8 a0 1f ff 6a b0 b3 ff 9b ef df b4 18 fd 74 89 fd 20 f5 ad 26 ad 1f cb 83 7f 1c fb 35 f2 89 5f cf a2 63 ff 07 08 38 72 c8 89 3f d0 a3 c2 eb 1f 00 0e Data Ascii: t;FuGQ\|qN3bmxFZUw:!::g=w=^:'Fsc` z$DVX2cVl-muG*>CZid!'%v30GCC?oz,jt &5_c8r?
2025-04-02 11:55:13 UTC	1220	IN	Data Raw: e1 fe 1f fb 5f bb ed f5 f3 89 5f ab 0d 38 f6 c3 ca 01 87 d8 0f 31 7e ce be a4 d7 3f 80 1c 7d 4e 42 8e ff 03 68 01 27 dd c7 e7 65 ed 69 24 dd 43 c5 86 9d d6 34 07 3a 06 1e a1 c5 37 21 00 47 9a 1b 74 a8 d4 38 6c 7c c7 35 ce 09 46 69 ad 4e ac de 38 70 84 19 8e e3 3a 9d 6c 7d 0e 95 1d c1 26 cd 41 0d 15 9d 3b 3a 36 ec 58 95 47 e0 89 d8 b1 b9 55 75 22 70 a8 e6 80 1b da d6 76 36 bd 65 8d f7 d2 01 3d 1a 39 e6 bd 75 d8 66 da e1 e3 ef ab 63 6b 75 c0 0e c0 89 95 1d 9b b3 4e 67 9d 56 36 a1 67 8d f7 d6 a1 ba 13 37 28 60 43 02 b0 43 fb 5a 7d d9 d6 e9 d0 c6 b6 1b 5b d8 1c 3a f3 06 1d db 85 4d d0 a1 aa c3 2e 6c 3b e5 09 21 67 3c 83 0e 55 9d ed b8 66 87 aa 8e af d9 11 7a ac b2 23 e4 44 e8 a4 aa 0e d0 d9 04 3a 64 d6 b1 b3 39 23 e8 cc c4 8d 09 ec fd 75 e2 5a 9d 29 a0 43 0b Data Ascii: __81~?}NBh'ei$C4:7!Gt8l\|5FiN8p:l}&A;:6XGUu"pv6e=9ufckuNgV6g7(`CCZ}[:M.l;!g<Ufz#D:d9#uZ)C

Timestamp	Bytes transferred	Direction	Data
2025-04-02 11:55:14 UTC	986	OUT	GET /static/presentation/client/js/1573492039-viewer_integrated_core.js HTTP/1.1 Host: docs.google.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / X-Client-Data: CO6MywE= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://docs.google.com/presentation/d/e/2PACX-1vQ7Dkd_WRbgSfshqD4oLNlUmDxTYPUSUb2tLr0qsjIwZ7fwYeWMIoyLCuLiIiL3T8QaBj2et0IIqqkz/pub?start=false&loop=false&delayms=3000 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: NID=522=JLEqbqBzyEKyaFeMjriwHG0jyctQIODOa69zzL-GqkCCAV77XkzhK73WM-GrFqNFu9GXYOrB_Cq0fyWgNFw71PUfDyA1jcOh1sghls_Ypkqn2v2-EU0tBDm1nuR2tuljWZA72G-mtsLlJZ5FqRTDUbBd4HJOZCHhfKN6fjTs56ce1rKDO8X1tCJ8yrnifKF7rUNdOp4; GFE_RTT=224
2025-04-02 11:55:14 UTC	802	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/docs Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="docs" Report-To: {"group":"docs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/docs"}]} Content-Length: 1277386 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon, 31 Mar 2025 12:54:52 GMT Expires: Tue, 31 Mar 2026 12:54:52 GMT Cache-Control: public, max-age=31536000 Last-Modified: Wed, 26 Mar 2025 15:14:55 GMT Content-Type: text/javascript Vary: Accept-Encoding, Origin Age: 169222 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-04-02 11:55:14 UTC	418	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 20 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 28 5b 5d 29 3b 0a 2f 2a 0a 0a 20 43 6f 70 79 72 69 67 68 74 20 54 68 65 20 43 6c 6f 73 75 72 65 20 4c 69 62 72 61 72 79 20 41 75 74 68 6f 72 73 2e 0a 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 0a 2a 2f 0a 2f 2a 0a 0a 20 43 6f 70 79 72 69 67 Data Ascii: function _F_toggles_initialize(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]}_F_toggles_initialize([]);/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0// Copyrig
2025-04-02 11:55:14 UTC	1220	IN	Data Raw: 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 4d 49 54 0a 2a 2f 0a 2f 2a 0a 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 0a 2a 2f 0a 2f 2a 0a 0a 20 43 6f 70 79 72 69 67 68 74 20 32 30 32 34 20 47 6f 6f 67 6c 65 2c 20 49 6e 63 0a 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 4d 49 54 0a 2a 2f 0a 76 61 72 20 61 61 61 3d 27 20 61 72 69 61 2d 64 65 73 63 72 69 62 65 64 62 79 3d 22 27 2c 62 61 61 3d 27 20 61 72 69 61 2d 64 69 73 61 62 6c 65 64 3d 22 74 72 75 65 22 27 2c 61 61 3d 27 20 61 72 69 61 2d 6c 61 62 65 6c 3d 22 27 2c 62 61 3d 27 20 63 6c 61 73 73 3d 22 27 2c 63 61 3d 27 20 69 64 3d 22 27 2c 64 61 3d 22 20 6f 66 20 22 2c 63 61 61 3d 22 20 73 65 63 6f Data Ascii: cense-Identifier: MIT// SPDX-License-Identifier: Apache-2.0// Copyright 2024 Google, Inc SPDX-License-Identifier: MIT*/var aaa=' aria-describedby="',baa=' aria-disabled="true"',aa=' aria-label="',ba=' class="',ca=' id="',da=" of ",caa=" seco
2025-04-02 11:55:14 UTC	1220	IN	Data Raw: 6e 74 65 78 74 22 2c 7a 61 61 3d 22 3e 3c 2f 64 69 76 3e 22 2c 4c 61 3d 27 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 27 2c 41 61 61 3d 22 41 61 42 62 43 63 44 64 45 65 46 66 47 67 48 68 49 69 4a 6a 4b 6b 4c 6c 4d 6d 4e 6e 4f 6f 50 70 51 71 52 72 53 73 54 74 55 75 56 76 57 77 58 78 59 79 5a 7a 5c 75 32 36 33 61 22 2c 4d 61 3d 22 41 62 6f 72 74 45 72 72 6f 72 22 2c 42 61 61 3d 22 41 63 63 65 70 74 20 61 6c 6c 20 73 75 67 67 65 73 74 69 6f 6e 73 22 2c 43 61 61 3d 22 41 63 63 65 70 74 20 73 75 67 67 65 73 74 69 6f 6e 22 2c 44 61 61 3d 22 41 63 74 69 76 69 74 79 20 64 61 73 68 62 6f 61 72 64 22 2c 45 61 61 3d 22 41 64 64 20 63 6f 6d 6d 65 6e 74 22 2c 46 61 61 3d 22 41 64 64 20 63 6f 6d 6d 65 6e 74 20 7c 20 49 6e 73 65 72 74 20 63 6f 6d 6d 65 6e 74 20 7c 7c 7c 22 Data Ascii: ntext",zaa="></div>",La='><div class="',Aaa="AaBbCcDdEeFfGgHhIiJjKkLlMmNnOoPpQqRrSsTtUuVvWwXxYyZz\u263a",Ma="AbortError",Baa="Accept all suggestions",Caa="Accept suggestion",Daa="Activity dashboard",Eaa="Add comment",Faa="Add comment \| Insert comment \|\|\|"
2025-04-02 11:55:14 UTC	1220	IN	Data Raw: 68 72 6f 6d 65 22 2c 56 61 3d 22 43 68 72 6f 6d 69 75 6d 22 2c 64 62 61 3d 22 43 6c 65 61 72 20 66 6f 72 6d 61 74 74 69 6e 67 22 2c 57 61 3d 22 43 6c 6f 73 65 22 2c 65 62 61 3d 22 43 6f 6d 69 63 20 53 61 6e 73 20 4d 53 22 2c 66 62 61 3d 22 43 6f 6d 6d 65 6e 74 73 22 2c 67 62 61 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 2c 58 61 3d 22 43 6f 6e 74 69 6e 75 65 22 2c 59 61 3d 22 43 6f 6e 74 72 6f 6c 22 2c 68 62 61 3d 22 43 6f 70 79 20 6c 69 6e 6b 20 55 52 4c 22 2c 69 62 61 3d 22 43 6f 75 6c 64 20 6e 6f 74 20 70 6c 61 79 20 6d 65 64 69 61 2e 22 2c 5a 61 3d 22 43 74 72 6c 2b 22 2c 6a 62 61 3d 22 43 74 72 6c 2b 41 6c 74 2b 45 6e 74 65 72 22 2c 6b 62 61 3d 22 43 74 72 6c 2b 41 6c 74 2b 53 68 69 66 74 2b 44 22 2c 6c 62 61 3d 22 43 74 72 6c 2b 41 6c 74 2b 53 68 Data Ascii: hrome",Va="Chromium",dba="Clear formatting",Wa="Close",eba="Comic Sans MS",fba="Comments",gba="Content-Type",Xa="Continue",Ya="Control",hba="Copy link URL",iba="Could not play media.",Za="Ctrl+",jba="Ctrl+Alt+Enter",kba="Ctrl+Alt+Shift+D",lba="Ctrl+Alt+Sh
2025-04-02 11:55:14 UTC	1220	IN	Data Raw: 73 65 72 74 20 73 70 65 63 69 61 6c 20 63 68 61 72 61 63 74 65 72 73 22 2c 52 62 61 3d 22 49 6e 73 65 72 74 20 74 65 78 74 20 62 6f 78 22 2c 53 62 61 3d 22 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 22 2c 54 62 61 3d 22 4b 65 79 62 6f 61 72 64 20 73 68 6f 72 74 63 75 74 73 22 2c 0a 6f 62 3d 22 4c 49 4e 4b 22 2c 70 62 3d 22 4d 45 4e 55 22 2c 55 62 61 3d 22 4d 61 6b 65 20 74 77 65 61 6b 73 20 61 6e 64 20 73 68 61 72 65 20 77 69 74 68 20 6f 74 68 65 72 73 20 74 6f 20 65 64 69 74 20 61 74 20 74 68 65 20 73 61 6d 65 20 74 69 6d 65 2e 22 2c 56 62 61 3d 22 4d 65 64 69 61 53 74 72 65 61 6d 54 72 61 63 6b 47 65 6e 65 72 61 74 6f 72 22 2c 71 62 3d 22 4d 65 74 61 22 2c 57 62 61 3d 22 4d 69 63 72 6f 73 6f 66 74 20 45 64 67 65 22 2c 58 62 61 3d 22 4d 69 63 72 Data Ascii: sert special characters",Rba="Insert text box",Sba="Internet Explorer",Tba="Keyboard shortcuts",ob="LINK",pb="MENU",Uba="Make tweaks and share with others to edit at the same time.",Vba="MediaStreamTrackGenerator",qb="Meta",Wba="Microsoft Edge",Xba="Micr
2025-04-02 11:55:14 UTC	1220	IN	Data Raw: 61 3d 22 53 65 63 75 72 69 74 79 45 72 72 6f 72 22 2c 44 63 61 3d 22 53 65 65 20 63 68 61 6e 67 65 73 20 73 69 6e 63 65 20 79 6f 75 20 6c 61 73 74 20 76 69 65 77 65 64 20 74 68 69 73 20 64 6f 63 75 6d 65 6e 74 22 2c 45 63 61 3d 22 53 65 65 20 6e 65 77 20 63 68 61 6e 67 65 73 22 2c 46 63 61 3d 22 53 65 6e 64 4b 65 79 62 6f 61 72 64 45 76 65 6e 74 73 22 2c 47 63 61 3d 22 53 68 61 70 65 73 20 61 6e 64 20 6c 69 6e 65 73 22 2c 44 62 3d 22 53 68 69 66 74 22 2c 48 63 61 3d 22 53 68 6f 77 20 61 6c 6c 20 63 6f 6d 6d 65 6e 74 73 22 2c 49 63 61 3d 22 53 68 6f 77 20 6d 6f 72 65 20 69 6e 66 6f 22 2c 45 62 3d 22 53 69 6c 6b 22 2c 46 62 3d 22 53 6c 69 64 65 20 22 2c 47 62 3d 22 53 70 61 63 65 22 2c 4a 63 61 3d 22 53 74 6f 63 6b 20 26 20 77 65 62 22 2c 4b 63 61 3d 22 53 Data Ascii: a="SecurityError",Dca="See changes since you last viewed this document",Eca="See new changes",Fca="SendKeyboardEvents",Gca="Shapes and lines",Db="Shift",Hca="Show all comments",Ica="Show more info",Eb="Silk",Fb="Slide ",Gb="Space",Jca="Stock & web",Kca="S
2025-04-02 11:55:14 UTC	1220	IN	Data Raw: 62 3d 22 5f 73 65 6c 66 22 2c 4f 62 3d 22 61 61 22 2c 50 62 3d 22 61 62 6f 72 74 22 2c 6b 64 61 3d 22 61 62 6f 75 74 3a 62 6c 61 6e 6b 22 2c 6c 64 61 3d 22 61 62 6f 75 74 3a 69 6e 76 61 6c 69 64 23 7a 43 6c 6f 73 75 72 65 7a 22 2c 6d 64 61 3d 22 61 62 6f 75 74 3a 69 6e 76 61 6c 69 64 23 7a 53 6f 79 7a 22 2c 51 62 3d 22 61 62 73 6f 6c 75 74 65 22 2c 52 62 3d 22 61 63 74 69 6f 6e 22 2c 53 62 3d 22 61 63 74 69 76 65 22 2c 54 62 3d 22 61 63 74 69 76 65 64 65 73 63 65 6e 64 61 6e 74 22 2c 6e 64 61 3d 22 61 63 74 69 76 69 74 79 22 2c 56 62 3d 22 61 66 74 65 72 68 69 64 65 22 2c 57 62 3d 22 61 66 74 65 72 73 68 6f 77 22 2c 0a 6f 64 61 3d 22 61 69 2d 74 65 78 74 2d 67 65 6e 65 72 61 74 6f 72 2d 31 38 22 2c 58 62 3d 22 61 6c 65 72 74 64 69 61 6c 6f 67 22 2c 70 64 Data Ascii: b="_self",Ob="aa",Pb="abort",kda="about:blank",lda="about:invalid#zClosurez",mda="about:invalid#zSoyz",Qb="absolute",Rb="action",Sb="active",Tb="activedescendant",nda="activity",Vb="afterhide",Wb="aftershow",oda="ai-text-generator-18",Xb="alertdialog",pd
2025-04-02 11:55:14 UTC	1220	IN	Data Raw: 62 75 69 6c 64 4c 61 62 65 6c 22 2c 0a 4a 64 61 3d 22 62 75 69 6c 64 69 6e 67 2d 62 6c 6f 63 6b 22 2c 4c 63 3d 22 62 75 74 74 6f 6e 22 2c 4b 64 61 3d 22 63 61 6c 65 6e 64 61 72 2d 74 6f 64 61 79 2d 31 38 78 31 38 22 2c 4d 63 3d 22 63 61 6c 65 6e 64 61 72 2d 74 6f 64 61 79 2d 32 34 78 32 34 22 2c 4c 64 61 3d 22 63 61 6c 65 6e 64 61 72 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 2c 4d 64 61 3d 22 63 61 6e 27 74 20 61 63 63 65 73 73 20 64 65 61 64 20 6f 62 6a 65 63 74 22 2c 4e 63 3d 22 63 61 6e 63 65 6c 22 2c 4e 64 61 3d 22 63 61 6e 6f 6e 69 63 61 6c 22 2c 4f 64 61 3d 22 63 61 6e 70 6c 61 79 22 2c 50 64 61 3d 22 63 61 6e 70 6c 61 79 74 68 72 6f 75 67 68 22 2c 4f 63 3d 22 63 61 70 74 69 6f 6e 73 22 2c 50 63 3d 22 63 61 74 65 67 6f 72 79 22 2c 51 63 3d 22 63 68 61 6e Data Ascii: buildLabel",Jda="building-block",Lc="button",Kda="calendar-today-18x18",Mc="calendar-today-24x24",Lda="calendar.google.com",Mda="can't access dead object",Nc="cancel",Nda="canonical",Oda="canplay",Pda="canplaythrough",Oc="captions",Pc="category",Qc="chan
2025-04-02 11:55:14 UTC	1220	IN	Data Raw: 61 3d 22 64 6f 63 73 2d 61 70 70 72 6f 76 61 6c 73 22 2c 70 65 61 3d 22 64 6f 63 73 2d 61 72 69 61 2d 73 70 65 61 6b 61 62 6c 65 22 2c 71 65 61 3d 22 64 6f 63 73 2d 63 61 6e 63 65 6c 2d 65 64 69 74 2d 61 66 74 65 72 2d 66 61 6b 65 2d 77 61 72 6e 69 6e 67 22 2c 72 65 61 3d 22 64 6f 63 73 2d 63 61 6e 63 65 6c 2d 65 64 69 74 2d 62 69 6e 61 72 79 2d 75 70 73 61 76 65 2d 77 61 72 6e 69 6e 67 2d 65 64 69 74 61 70 70 6c 69 65 72 22 2c 73 65 61 3d 22 64 6f 63 73 2d 63 61 6e 63 65 6c 2d 65 64 69 74 2d 62 69 6e 61 72 79 2d 75 70 73 61 76 65 2d 77 61 72 6e 69 6e 67 2d 6e 6f 6e 2d 65 64 69 74 61 70 70 6c 69 65 72 22 2c 74 65 61 3d 22 64 6f 63 73 2d 63 61 6e 63 65 6c 2d 65 64 69 74 2d 75 6e 73 75 70 70 6f 72 74 65 64 2d 63 6f 6e 74 65 6e 74 2d 77 61 72 6e 69 6e 67 2d Data Ascii: a="docs-approvals",pea="docs-aria-speakable",qea="docs-cancel-edit-after-fake-warning",rea="docs-cancel-edit-binary-upsave-warning-editapplier",sea="docs-cancel-edit-binary-upsave-warning-non-editapplier",tea="docs-cancel-edit-unsupported-content-warning-
2025-04-02 11:55:14 UTC	1220	IN	Data Raw: 6d 66 6f 72 74 61 62 6c 65 22 2c 4f 65 61 3d 22 64 6f 63 73 2d 64 69 73 70 6c 61 79 2d 64 65 6e 73 69 74 79 2d 73 77 69 74 63 68 65 72 2d 64 65 66 61 75 6c 74 22 2c 50 65 61 3d 22 64 6f 63 73 2d 64 69 73 70 6c 61 79 2d 64 65 6e 73 69 74 79 2d 73 77 69 74 63 68 65 72 2d 76 69 65 77 2d 6d 65 6e 75 22 2c 51 65 61 3d 22 64 6f 63 73 2d 64 6f 63 6f 73 2d 61 63 74 69 76 69 74 79 2d 62 6f 78 22 2c 52 65 61 3d 22 64 6f 63 73 2d 64 6f 63 6f 73 2d 73 69 64 65 62 61 72 22 2c 0a 53 65 61 3d 22 64 6f 63 73 2d 64 6f 63 6f 73 2d 73 69 64 65 62 61 72 2d 66 6f 63 75 73 22 2c 54 65 61 3d 22 64 6f 63 73 2d 64 6f 63 73 65 76 65 72 79 77 68 65 72 65 2d 63 6f 70 79 2d 74 6f 2d 67 6f 6f 67 6c 65 2d 64 6f 63 22 2c 55 65 61 3d 22 64 6f 63 73 2d 64 72 69 76 65 2d 76 69 64 65 6f 2d Data Ascii: mfortable",Oea="docs-display-density-switcher-default",Pea="docs-display-density-switcher-view-menu",Qea="docs-docos-activity-box",Rea="docs-docos-sidebar",Sea="docs-docos-sidebar-focus",Tea="docs-docseverywhere-copy-to-google-doc",Uea="docs-drive-video-

Timestamp	Bytes transferred	Direction	Data
2025-04-02 11:55:16 UTC	595	OUT	GET /slidesz/AGV_vUdJaErXIJ55hdglvmfjSbJPFW0UxlncOXEIeukK-lpE_5EJ5uh5BaYVcdj_q3_TnTKD5vNdF46nR-OTR94Q5CLCKQzl6Xf2hHM67TsVRaoPZt4GNZxhtsR6gY_0XQ6UqZk=s2048?key=0T76xXlufg2HBrV9SVPofq1l HTTP/1.1 Host: lh7-rt.googleusercontent.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / X-Client-Data: CO6MywE= Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-02 11:55:17 UTC	467	IN	HTTP/1.1 200 OK Content-Type: image/png Vary: Origin Access-Control-Expose-Headers: Content-Length ETag: "v0" Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: private, max-age=86400, no-transform Content-Disposition: inline;filename="unnamed.png" X-Content-Type-Options: nosniff Date: Wed, 02 Apr 2025 11:55:17 GMT Server: fife Content-Length: 409598 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-04-02 11:55:17 UTC	753	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 03 3b 00 00 01 97 08 06 00 00 00 94 6e 4e 93 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c4 00 00 0e c4 01 95 2b 0e 1b 00 00 ff b2 49 44 41 54 78 5e ec fd 85 92 65 4b 96 e6 79 f6 7b 8c 8c 4c 8f 74 95 c8 bc c3 74 57 66 f7 88 54 cb 4c 0f 74 97 94 f4 73 54 57 25 05 57 06 5e 08 ba cc cc 4c 8e 06 6e ce 64 cc cc 87 c1 d8 cc e9 46 ea 7c ff b5 54 f7 d9 c7 c8 dd 6f 44 64 46 44 5e f3 f8 5c 75 83 1d 73 37 f3 9b b2 7f b9 96 ea f9 6f c2 b7 1f df e8 e3 9f fe e9 9f c2 ef 7e f7 3b 1b 0f e4 77 9e df 69 ae 3b 2c fc 1e b2 fc 13 2f f1 40 1f bc de 91 5f e7 b0 c4 af 6d e1 98 af fc 4f bf b3 7c fd f5 3d 9d ff 3a fc 93 8d ca 3f 69 9e 25 de af f0 f5 7e f7 b5 ce f1 75 e3 fc 77 fa 3c 72 ef de Data Ascii: PNGIHDR;nNgAMAapHYs+IDATx^eKy{LttWfTLtsTW%W^LndF\|ToDdFD^\us7o~;wi;,/@_mO\|=:?i%~uw<r
2025-04-02 11:55:17 UTC	1220	IN	Data Raw: f8 d5 0f ed b8 76 c2 c7 ba c6 ea 97 9c ff 51 a8 7e f1 83 50 ff 42 c7 4a fd 4b 8d 9f 7f 5f a3 ce 29 d5 cf b9 a6 f1 8b ef 29 3a af 54 3f d3 9c 7b 34 af 7d ae f9 67 df b5 b1 c1 f1 17 df d5 79 c2 fc fb 7e 4e d7 eb fa fc 94 9a d2 60 fc ec 3b a1 fe b9 ae 7d ce e8 a9 e9 98 d7 ab ea 35 98 f3 b9 b5 4f ff c1 ee 3d 2e d5 4f 7d cc bf d6 b7 f9 57 90 cf fe c1 fe 4d 55 3a 7e 1d 6a 9d bf 09 55 85 79 b5 eb b7 a1 d2 a5 79 e7 6f 43 b5 fb 49 4b a5 eb 29 8d 4f 85 ca b9 67 34 3e 1b 2a 3d cf 69 fe 5c a8 9d 7f 5e 79 31 54 95 da 85 97 42 55 a9 5d 7c 25 54 95 da a5 57 35 be aa f1 f5 50 51 6a 97 df 0c b5 2b 6f 85 da d5 b7 3d d7 de 51 de 0d 95 ab ef 86 da f5 f7 95 0f 43 9d dc fc 28 d4 6e 28 37 3f 0e 55 a5 d6 f7 49 a8 f7 7e 16 ea fd 5f 84 9a 52 ef ff 2a d4 06 4e 84 fa c0 a9 50 1b 3c Data Ascii: vQ~PBJK_)):T?{4}gy~N`;}5O=.O}WMU:~jUyyoCIK)Og4>=i\^y1TBU]\|%TW5PQj+o=QC(n(7?UI~_RNP<
2025-04-02 11:55:17 UTC	1220	IN	Data Raw: 03 8a 8e b9 06 74 ea 9a e7 b1 03 74 18 0f 62 47 e7 d3 9c d7 d4 6b 01 1e 43 8f 1e 68 6b 60 26 82 e6 a8 24 f0 90 b6 07 e2 6f f3 97 9b 88 9d 6a 87 23 a7 d2 a9 74 08 38 76 fc 84 d0 23 e4 74 3e 21 e8 00 9e a7 43 19 f0 e8 bf cd 8a b0 53 15 74 aa 11 3c 15 c0 d3 f3 a2 00 f4 82 61 a7 7a e1 65 4b e5 c2 2b 42 8e b0 73 f9 b5 50 bd fc 86 a5 c2 28 f0 54 94 ea 95 77 42 fd da 7b a1 7e 15 e8 28 37 3e d0 f8 81 b0 23 f0 f4 0a 39 37 3f 09 b5 de 4f 43 55 d0 a9 f5 7d ae 51 e9 13 76 06 be 54 4e 08 3a e4 64 a8 0d 81 1e 81 67 c8 b1 53 1b ee 10 76 ba 94 6e 81 47 d8 51 c0 4e 03 e8 4c 0a 39 11 3b f5 a9 cb ca 95 50 9b ba a6 51 99 be 11 ea c2 4e 73 b6 57 e9 33 f0 34 e7 34 82 9e 45 81 07 f4 2c 0e 85 c6 d2 88 90 23 f0 08 3b 86 1e 21 a7 b9 34 19 d6 56 a6 34 9f 14 7c a6 6c be 06 7a 04 9e Data Ascii: ttbGkChk`&$oj#t8v#t>!CSt<azeK+BsP(TwB{~(7>#97?OCU}QvTN:dgSvnGQNL9;PQNsW344E,#;!4V4\|lz
2025-04-02 11:55:17 UTC	1220	IN	Data Raw: 9b 56 d9 69 02 9d f9 3e ab ec 34 53 65 67 41 d0 59 a0 ba 33 2c f4 8c 84 ba c0 d3 00 3b 4b 13 a1 11 91 43 ea 2b 20 67 3a 34 14 83 4e 61 2e 34 8a 3e 52 d5 69 16 17 0c 3b 4d 43 cf 4a ac ec 68 04 3a 80 c7 d0 23 e4 d4 8a 61 a3 4e 85 07 f8 50 d5 11 72 18 1b 54 79 ea 61 a3 59 d3 d8 d0 c8 bc a9 68 0e 74 04 9f 8d 35 21 67 5d c0 59 17 68 84 9d 4d cd a9 f2 6c 82 1e c3 cf a6 9f df d2 28 e4 ac 73 bc b9 65 a8 d9 48 a3 21 47 e0 31 f4 f8 08 62 36 77 f7 6c 4e a5 67 53 d8 d9 14 7c bc ea 73 4b 10 f2 0a 0f d5 1d 03 0e 73 ab ec 78 a5 87 ca 0f b8 31 e4 08 3c 06 21 8d 5b 9c 17 58 b6 75 9e 6b 04 d0 70 4c 35 67 47 b1 11 e4 e8 3e ae 59 75 87 e3 04 23 ce eb 1e ab f8 10 bb 97 fb 8e c1 8f ce df be 03 7c 7e 77 e0 be fd f0 e1 9e 84 99 3c 6e 2c 06 1a ee f7 79 3a df 82 8f 63 c6 e0 93 c7 Data Ascii: Vi>4SegAY3,;KC+ g:4Na.4>Ri;MCJh:#aNPrTyaYht5!g]YhMl(seH!G1b6wlNgS\|sKsx1<![XukpL5gG>Yu#\|~w<n,y:c
2025-04-02 11:55:17 UTC	1220	IN	Data Raw: 2a 40 7e df 03 e3 47 e7 bc e2 93 c7 cf bd 0c 3d 06 1f 62 90 89 95 9d 88 97 3b b9 8a 0f 30 31 10 e9 7c 1e 3d d9 35 3d 53 a5 4a 8f a1 47 e7 bd ca 93 12 d1 a3 24 f4 64 f0 d1 7d 09 3d 79 bc a4 e3 fc f9 0c 31 7a 76 7b 58 f4 24 f0 3c 38 7a e2 b3 a6 e6 f9 e7 55 7b 96 8d 79 20 f0 90 43 d1 e3 5f 23 bd 36 f9 43 7d 7c 8b 9d 43 3e f2 3f 48 e2 3f 80 18 fd 8b 69 47 0e bf f3 03 79 f0 1f 4a 7a ad fc d7 38 f0 75 f2 89 5f 33 43 4e fa c5 3f 3a 61 e4 38 e0 e4 63 fd 9a fa 8f 2f b5 a5 65 31 d8 a4 7f f0 1a 75 0e e4 a4 d7 35 cc fc 8e ea 8c 57 69 bc b5 0d e4 50 ae d5 bd 11 3a 8e 1d c7 0d 28 ba 7b f7 b6 fe 83 f5 4a ce 3d 41 07 ec d8 9c f6 b5 88 1d 47 ce fe f5 39 04 e4 a4 b9 b7 b1 dd b3 ca 0e a3 57 77 ee 10 da d6 ac ca 43 fb 1a b8 a1 9a 13 db d8 b6 9b 06 1c 43 0e 6b 75 68 63 a3 aa Data Ascii: *@~G=b;01\|=5=SJG$d}=y1zv{X$<8zU{y C_#6C}\|C>?H?iGyJz8u_3CN?:a8c/e1u5WiP:({J=AG9WwCCkuhc
2025-04-02 11:55:17 UTC	1220	IN	Data Raw: 43 db 1a 95 1b 5a d8 62 1b 1b 55 1d 80 23 f0 38 72 40 0f 6b 74 bc 7d ed 4e 6e 9d 4e aa ec dc 8e e0 b9 45 25 87 ac c7 31 b6 b0 ed 35 0b c2 ce 4a d8 6b ac 6a ee 1b 14 ec 09 3e 8e 9d 25 c7 4e 7d c1 c6 3d 36 25 48 6b 76 0c 3b d3 61 2f ad d9 29 8c 19 76 76 8b 63 11 3b 23 02 0e 1b 14 0c 86 5d 65 67 b9 3f ec ac 38 76 58 af b3 23 ec 50 e1 d9 02 3b 0b d7 0c 3b 5b f3 57 ad 8d 0d ec 6c ce 5e 0a 9b d3 17 c3 e6 cc 85 b0 29 ec 6c 5a 1b 9b 63 67 63 a2 53 e9 08 1b e3 be 39 01 eb 75 36 c7 58 af 73 52 39 21 e8 80 1d 07 0f eb 75 36 84 1d 2a 3a 6c 4e b0 ce 5a 1d 22 e4 ac f7 be 1f 36 6e 6a b4 56 36 5a d8 68 65 7b c7 5a d9 7c 83 02 61 e7 9a 90 c3 26 05 11 3b 8d cb af 86 86 61 e7 95 d0 b8 f8 72 68 50 d5 b9 a8 a4 b5 3a e7 9f d3 e8 d8 f1 3c a9 38 74 3c b4 af 51 d5 f1 36 b6 1a 15 Data Ascii: CZbU#8r@kt}NnNE%15Jkj>%N}=6%Hkv;a/)vvc;#]eg?8vX#P;;[Wl^)lZcgcS9u6XsR9!u6*:lNZ"6njV6Zhe{Z\|a&;arhP:<8t<Q6
2025-04-02 11:55:17 UTC	1220	IN	Data Raw: 6a 0a 3d f5 73 be 5e a7 6e 9b 12 3c 6d 95 9c a6 a0 d3 64 cd 4e 6a 61 eb fc ad 55 75 c0 4e 4d d0 a9 75 fe d2 47 36 25 30 f0 3c 1a 1a 67 1e d3 f8 88 46 cd 4f ff 42 a3 af d9 c9 36 28 38 c5 ee 6b 3f 31 dc d0 b2 d6 88 95 1d 8e ad 8d 8d f3 27 84 1d d6 e8 50 e9 01 3b 6c 44 60 b8 71 e0 18 7c ac b2 03 7a 80 8e 46 6b 65 d3 79 76 65 fb 4a 90 c9 b0 23 b4 28 35 61 a7 22 74 54 23 7a 78 c8 4c 6d 6d 06 1b 70 a1 07 d0 c3 b0 e3 1b 17 70 2f 0f a9 1a e3 0e 6b 8e 18 bf 77 3f 76 0c 3c d9 3d 29 1c 3b 7a 12 78 da d0 c3 78 48 f2 e0 e1 f8 c0 43 f3 b7 f9 f3 4c c2 0e d5 1c ab ee fc ca aa 3c d6 c2 d6 e9 6b 76 ac c2 d3 fd b4 90 43 9e 31 e8 94 34 96 f4 df 6b 39 21 47 29 f7 50 d5 21 2f 85 f2 c5 56 1b 9b ad d5 b9 f8 7a 28 69 2c 5f 7a dd c1 73 45 d0 01 39 c2 0e 15 9e 54 dd a9 5c ff 40 f0 Data Ascii: j=s^n<mdNjaUuNMuG6%0<gFOB6(8k?1'P;lD`q\|zFkeyveJ#(5a"tT#zxLmmpp/kw?v<=);zxxHCL<kvC14k9!G)P!/Vz(i,_zsE9T\@
2025-04-02 11:55:17 UTC	1220	IN	Data Raw: 05 1f 6f 65 b3 aa 0e d5 1d ab f0 bc 1c 4a 17 5e 51 5e f5 ea ce e5 37 34 02 9d b7 04 1e 0f e8 a9 5c 79 57 f0 79 df 2a 3b 69 cd 4e f9 c6 87 a1 7c fd 63 ab ec 94 6f 7c 1a 2a 82 4e f9 a6 57 75 ca 7d 9f 87 b2 c0 53 11 76 2a fd 27 35 9e d4 b1 42 1b db 90 c0 33 dc 11 ca 4a 65 a4 4b 63 97 c6 ee 50 19 15 78 46 7b 04 1e 61 87 08 3b 15 61 87 f6 b5 ea d4 55 e5 4a a8 08 3b d5 29 61 47 d0 a9 4c dd 0c 55 d6 eb 4c 3b 74 aa 73 03 1a 07 85 1c 41 67 61 c8 91 33 af 2c 02 1d c5 c0 33 a1 31 81 67 2a d4 56 a6 35 57 04 9e fa ea 5c a8 59 a8 ea 2c 5a 6a 54 78 84 9d 9a d0 53 2f 2d 29 cb a1 5e 5e 51 56 85 9c 42 a8 81 9d aa d0 03 72 aa e5 50 67 ac 01 9c aa e6 15 8f a0 d3 88 69 0a 39 0d 81 a7 21 f0 34 1a cc 35 0a 3a 36 ae ad 0b 3c eb 36 02 9c e6 da 46 68 0a 3c 4d ab f0 90 ad d0 b4 51 Data Ascii: oeJ^Q^74\yWy;iN\|co\|NWu}Sv'5B3JeKcPxF{a;aUJ;)aGLUL;tsAga3,31gV5W\Y,ZjTxS/-)^^QVBrPgi9!45:6<6Fh<MQ
2025-04-02 11:55:17 UTC	1220	IN	Data Raw: b4 0a 0f eb 74 1c 3b 0d a0 b3 46 75 47 d0 51 7c d4 71 c4 4e 33 62 a7 b9 b1 a3 b9 ce 6d ed e8 78 d7 46 5a dc d6 84 9d b5 ed 18 d0 13 8f ad aa 93 55 77 04 1a aa 3a 9a 03 21 2a 3a 9b 3a 67 f8 d9 01 3d 77 e3 3d 5e ed d9 04 3a c2 8a 83 27 46 73 c0 63 60 b1 0d 0b 88 20 c4 7a 9e 88 9e 04 24 2a 44 56 15 8a b0 f1 ea 0f e8 11 58 32 f8 b4 f0 93 d0 63 b1 56 b7 16 6c ac dd 2d ce bd d5 6d df 75 c5 e0 13 47 d0 93 2a 3e f9 eb c7 b5 b9 e5 81 b3 bf da 43 5a e8 69 af f6 64 e8 21 fa dc fb a1 27 c1 25 9f 76 f4 80 19 7f c6 33 f4 ec bb de ba 87 30 f7 e7 47 43 8f c6 87 43 8f 3f 97 a6 a4 8f fc d3 f4 b1 d1 6f 7a 19 0f f3 2c ed af cf f8 a0 1f ff 6a b0 b3 ff 9b ef df b4 18 fd 74 89 fd 20 f5 ad 26 ad 1f cb 83 7f 1c fb 35 f2 89 5f cf a2 63 ff 07 08 38 72 c8 89 3f d0 a3 c2 eb 1f 00 0e Data Ascii: t;FuGQ\|qN3bmxFZUw:!::g=w=^:'Fsc` z$DVX2cVl-muG*>CZid!'%v30GCC?oz,jt &5_c8r?
2025-04-02 11:55:17 UTC	1220	IN	Data Raw: e1 fe 1f fb 5f bb ed f5 f3 89 5f ab 0d 38 f6 c3 ca 01 87 d8 0f 31 7e ce be a4 d7 3f 80 1c 7d 4e 42 8e ff 03 68 01 27 dd c7 e7 65 ed 69 24 dd 43 c5 86 9d d6 34 07 3a 06 1e a1 c5 37 21 00 47 9a 1b 74 a8 d4 38 6c 7c c7 35 ce 09 46 69 ad 4e ac de 38 70 84 19 8e e3 3a 9d 6c 7d 0e 95 1d c1 26 cd 41 0d 15 9d 3b 3a 36 ec 58 95 47 e0 89 d8 b1 b9 55 75 22 70 a8 e6 80 1b da d6 76 36 bd 65 8d f7 d2 01 3d 1a 39 e6 bd 75 d8 66 da e1 e3 ef ab 63 6b 75 c0 0e c0 89 95 1d 9b b3 4e 67 9d 56 36 a1 67 8d f7 d6 a1 ba 13 37 28 60 43 02 b0 43 fb 5a 7d d9 d6 e9 d0 c6 b6 1b 5b d8 1c 3a f3 06 1d db 85 4d d0 a1 aa c3 2e 6c 3b e5 09 21 67 3c 83 0e 55 9d ed b8 66 87 aa 8e af d9 11 7a ac b2 23 e4 44 e8 a4 aa 0e d0 d9 04 3a 64 d6 b1 b3 39 23 e8 cc c4 8d 09 ec fd 75 e2 5a 9d 29 a0 43 0b Data Ascii: __81~?}NBh'ei$C4:7!Gt8l\|5FiN8p:l}&A;:6XGUu"pv6e=9ufckuNgV6g7(`CCZ}[:M.l;!g<Ufz#D:d9#uZ)C

Timestamp	Bytes transferred	Direction	Data
2025-04-02 11:55:23 UTC	679	OUT	GET /static/presentation/client/js/1568806778-punch_viewer_worker_binary_viewercore.js HTTP/1.1 Host: docs.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / X-Client-Data: CO6MywE= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: NID=522=JLEqbqBzyEKyaFeMjriwHG0jyctQIODOa69zzL-GqkCCAV77XkzhK73WM-GrFqNFu9GXYOrB_Cq0fyWgNFw71PUfDyA1jcOh1sghls_Ypkqn2v2-EU0tBDm1nuR2tuljWZA72G-mtsLlJZ5FqRTDUbBd4HJOZCHhfKN6fjTs56ce1rKDO8X1tCJ8yrnifKF7rUNdOp4
2025-04-02 11:55:23 UTC	800	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/docs Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="docs" Report-To: {"group":"docs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/docs"}]} Content-Length: 32528 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon, 31 Mar 2025 15:50:36 GMT Expires: Tue, 31 Mar 2026 15:50:36 GMT Cache-Control: public, max-age=31536000 Last-Modified: Wed, 26 Mar 2025 19:29:52 GMT Content-Type: text/javascript Vary: Accept-Encoding, Origin Age: 158687 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-04-02 11:55:23 UTC	420	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 20 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 28 5b 5d 29 3b 0a 66 75 6e 63 74 69 6f 6e 20 6d 28 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 7d 66 75 6e 63 74 69 6f 6e 20 6e 28 61 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 5b 61 5d 7d 7d 76 61 72 20 71 3b 66 75 6e 63 74 69 6f 6e 20 Data Ascii: function _F_toggles_initialize(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]}_F_toggles_initialize([]);function m(){return function(){}}function n(a){return function(){return this[a]}}var q;function
2025-04-02 11:55:23 UTC	1220	IN	Data Raw: 61 2c 62 2c 63 29 7b 69 66 28 61 3d 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 7c 7c 61 3d 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 66 75 6e 63 74 69 6f 6e 20 63 61 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e Data Ascii: a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};function ca(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.len
2025-04-02 11:55:23 UTC	1220	IN	Data Raw: 6e 20 65 61 28 61 61 28 74 68 69 73 29 29 7d 7d 29 7d 72 65 74 75 72 6e 20 61 7d 29 3b 66 75 6e 63 74 69 6f 6e 20 65 61 28 61 29 7b 61 3d 7b 6e 65 78 74 3a 61 7d 3b 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 7d 3b 72 65 74 75 72 6e 20 61 7d 0a 76 61 72 20 66 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 3f 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 66 75 6e 63 74 69 6f 6e 20 62 28 29 7b 7d 62 2e 70 72 6f 74 6f 74 79 70 65 3d 61 3b 72 65 74 75 72 6e 20 6e 65 77 20 62 7d 2c 68 61 3b 69 66 28 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 3d 3d 22 66 75 Data Ascii: n ea(aa(this))}})}return a});function ea(a){a={next:a};a[Symbol.iterator]=function(){return this};return a}var fa=typeof Object.create=="function"?Object.create:function(a){function b(){}b.prototype=a;return new b},ha;if(typeof Object.setPrototypeOf=="fu
2025-04-02 11:55:23 UTC	1220	IN	Data Raw: 6e 28 61 29 7b 66 75 6e 63 74 69 6f 6e 20 62 28 68 29 7b 74 68 69 73 2e 67 3d 28 67 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 68 29 7b 68 3d 75 28 68 29 3b 66 6f 72 28 76 61 72 20 6c 3b 21 28 6c 3d 68 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6c 3d 6c 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6c 5b 30 5d 2c 6c 5b 31 5d 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 63 28 29 7b 7d 66 75 6e 63 74 69 6f 6e 20 64 28 68 29 7b 76 61 72 20 6c 3d 74 79 70 65 6f 66 20 68 3b 72 65 74 75 72 6e 20 6c 3d 3d 3d 22 6f 62 6a 65 63 74 22 26 26 68 21 3d 3d 6e 75 6c 6c 7c 7c 6c 3d 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 7d 66 75 6e 63 74 69 6f 6e 20 65 28 68 29 7b 69 66 28 21 76 28 68 2c 6b 29 29 7b 76 61 72 20 6c 3d 6e 65 Data Ascii: n(a){function b(h){this.g=(g+=Math.random()+1).toString();if(h){h=u(h);for(var l;!(l=h.next()).done;)l=l.value,this.set(l[0],l[1])}}function c(){}function d(h){var l=typeof h;return l==="object"&&h!==null\|\|l==="function"}function e(h){if(!v(h,k)){var l=ne
2025-04-02 11:55:23 UTC	1220	IN	Data Raw: 67 5b 31 5d 3b 29 6c 3d 6c 2e 43 3b 66 6f 72 28 3b 6c 2e 6e 65 78 74 21 3d 6c 2e 68 65 61 64 3b 29 72 65 74 75 72 6e 20 6c 3d 6c 2e 6e 65 78 74 2c 7b 64 6f 6e 65 3a 21 31 2c 76 61 6c 75 65 3a 68 28 6c 29 7d 3b 6c 3d 6e 75 6c 6c 7d 72 65 74 75 72 6e 7b 64 6f 6e 65 3a 21 30 2c 76 61 6c 75 65 3a 76 6f 69 64 20 30 7d 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 64 28 67 2c 68 29 7b 76 61 72 20 6c 3d 68 26 26 74 79 70 65 6f 66 20 68 3b 6c 3d 3d 22 6f 62 6a 65 63 74 22 7c 7c 6c 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 3f 66 2e 68 61 73 28 68 29 3f 6c 3d 66 2e 67 65 74 28 68 29 3a 28 6c 3d 22 22 2b 20 2b 2b 6b 2c 66 2e 73 65 74 28 68 2c 6c 29 29 3a 6c 3d 22 70 5f 22 2b 68 3b 76 61 72 20 70 3d 67 5b 30 5d 5b 6c 5d 3b 69 66 28 70 26 26 76 28 67 5b 30 5d 2c 6c 29 29 66 6f 72 28 Data Ascii: g[1];)l=l.C;for(;l.next!=l.head;)return l=l.next,{done:!1,value:h(l)};l=null}return{done:!0,value:void 0}})}function d(g,h){var l=h&&typeof h;l=="object"\|\|l=="function"?f.has(h)?l=f.get(h):(l=""+ ++k,f.set(h,l)):l="p_"+h;var p=g[0][l];if(p&&v(g[0],l))for(
2025-04-02 11:55:23 UTC	1220	IN	Data Raw: 64 65 6c 65 74 65 3d 66 75 6e 63 74 69 6f 6e 28 67 29 7b 67 3d 64 28 74 68 69 73 2c 67 29 3b 72 65 74 75 72 6e 20 67 2e 76 26 26 67 2e 6c 69 73 74 3f 28 67 2e 6c 69 73 74 2e 73 70 6c 69 63 65 28 67 2e 69 6e 64 65 78 2c 31 29 2c 67 2e 6c 69 73 74 2e 6c 65 6e 67 74 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 67 2e 69 64 5d 2c 67 2e 76 2e 43 2e 6e 65 78 74 3d 67 2e 76 2e 6e 65 78 74 2c 67 2e 76 2e 6e 65 78 74 2e 43 3d 67 2e 76 2e 43 2c 67 2e 76 2e 68 65 61 64 3d 0a 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 43 3d 62 28 29 3b 74 68 69 73 2e 73 69 7a 65 Data Ascii: delete=function(g){g=d(this,g);return g.v&&g.list?(g.list.splice(g.index,1),g.list.length\|\|delete this[0][g.id],g.v.C.next=g.v.next,g.v.next.C=g.v.C,g.v.head=null,this.size--,!0):!1};e.prototype.clear=function(){this[0]={};this[1]=this[1].C=b();this.size
2025-04-02 11:55:23 UTC	1220	IN	Data Raw: 75 72 6e 20 65 7d 72 28 22 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 65 6e 74 72 69 65 73 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6f 61 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 72 65 74 75 72 6e 5b 62 2c 63 5d 7d 29 7d 7d 29 3b 72 28 22 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 76 61 6c 75 65 73 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6f 61 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 72 65 74 75 72 6e 20 63 7d 29 7d 7d 29 3b 0a 72 28 22 53 74 72 69 6e 67 2e 66 72 6f 6d 43 6f 64 65 50 6f 69 6e 74 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 Data Ascii: urn e}r("Array.prototype.entries",function(a){return a?a:function(){return oa(this,function(b,c){return[b,c]})}});r("Array.prototype.values",function(a){return a?a:function(){return oa(this,function(b,c){return c})}});r("String.fromCodePoint",function(a)
2025-04-02 11:55:23 UTC	1220	IN	Data Raw: 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 61 2e 61 70 70 6c 79 28 62 2c 61 72 67 75 6d 65 6e 74 73 29 7d 7d 0a 66 75 6e 63 74 69 6f 6e 20 78 28 61 2c 62 2c 63 29 7b 78 3d 46 75 6e 63 74 69 6f 6e 2e 70 72 6f 74 6f 74 79 70 65 2e 62 69 6e 64 26 26 46 75 6e 63 74 69 6f 6e 2e 70 72 6f 74 6f 74 79 70 65 2e 62 69 6e 64 2e 74 6f 53 74 72 69 6e 67 28 29 2e 69 6e 64 65 78 4f 66 28 22 6e 61 74 69 76 65 20 63 6f 64 65 22 29 21 3d 2d 31 3f 72 61 3a 73 61 3b 72 65 74 75 72 6e 20 78 2e 61 70 70 6c 79 28 6e 75 6c 6c 2c 61 72 67 75 6d 65 6e 74 73 29 7d 66 75 6e 63 74 69 6f 6e 20 74 61 28 61 2c 62 29 7b 66 75 6e 63 74 69 6f 6e 20 63 28 29 7b 7d 63 2e 70 72 6f 74 6f 74 79 70 65 3d 62 2e 70 72 6f 74 6f 74 79 70 65 3b 61 2e 4a 3d 62 2e 70 72 6f 74 6f 74 79 70 65 3b 61 2e Data Ascii: ction(){return a.apply(b,arguments)}}function x(a,b,c){x=Function.prototype.bind&&Function.prototype.bind.toString().indexOf("native code")!=-1?ra:sa;return x.apply(null,arguments)}function ta(a,b){function c(){}c.prototype=b.prototype;a.J=b.prototype;a.
2025-04-02 11:55:23 UTC	1220	IN	Data Raw: 6e 20 7a 28 22 69 50 68 6f 6e 65 22 29 26 26 21 7a 28 22 69 50 6f 64 22 29 26 26 21 7a 28 22 69 50 61 64 22 29 7d 66 75 6e 63 74 69 6f 6e 20 49 61 28 29 7b 48 61 28 29 7c 7c 7a 28 22 69 50 61 64 22 29 7c 7c 7a 28 22 69 50 6f 64 22 29 7d 3b 7a 28 22 4d 6f 62 69 6c 65 22 29 3b 42 28 29 7c 7c 7a 28 22 4d 61 63 69 6e 74 6f 73 68 22 29 3b 42 28 29 7c 7c 7a 28 22 57 69 6e 64 6f 77 73 22 29 3b 28 42 28 29 3f 79 2e 70 6c 61 74 66 6f 72 6d 3d 3d 3d 22 4c 69 6e 75 78 22 3a 7a 28 22 4c 69 6e 75 78 22 29 29 7c 7c 42 28 29 7c 7c 7a 28 22 43 72 4f 53 22 29 3b 42 28 29 7c 7c 7a 28 22 41 6e 64 72 6f 69 64 22 29 3b 48 61 28 29 3b 7a 28 22 69 50 61 64 22 29 3b 7a 28 22 69 50 6f 64 22 29 3b 49 61 28 29 3b 43 61 28 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2e 69 6e 64 65 Data Ascii: n z("iPhone")&&!z("iPod")&&!z("iPad")}function Ia(){Ha()\|\|z("iPad")\|\|z("iPod")};z("Mobile");B()\|\|z("Macintosh");B()\|\|z("Windows");(B()?y.platform==="Linux":z("Linux"))\|\|B()\|\|z("CrOS");B()\|\|z("Android");Ha();z("iPad");z("iPod");Ia();Ca().toLowerCase().inde
2025-04-02 11:55:23 UTC	1220	IN	Data Raw: 30 29 2e 74 6f 53 74 72 69 6e 67 28 31 36 29 29 7d 3b 66 75 6e 63 74 69 6f 6e 20 57 61 28 29 7b 7d 74 28 57 61 2c 43 29 3b 66 75 6e 63 74 69 6f 6e 20 58 61 28 29 7b 7d 74 28 58 61 2c 57 61 29 3b 66 75 6e 63 74 69 6f 6e 20 59 61 28 29 7b 7d 74 28 59 61 2c 43 29 3b 66 75 6e 63 74 69 6f 6e 20 46 28 61 2c 62 29 7b 61 2e 67 3d 62 3b 5a 61 28 62 2c 61 29 7d 66 75 6e 63 74 69 6f 6e 20 47 28 61 29 7b 61 2e 67 20 69 6e 73 74 61 6e 63 65 6f 66 20 45 72 72 6f 72 26 26 28 45 72 72 6f 72 2e 63 61 70 74 75 72 65 53 74 61 63 6b 54 72 61 63 65 3f 45 72 72 6f 72 2e 63 61 70 74 75 72 65 53 74 61 63 6b 54 72 61 63 65 28 61 2e 67 29 3a 61 2e 67 2e 73 74 61 63 6b 3d 45 72 72 6f 72 28 29 2e 73 74 61 63 6b 29 7d 59 61 2e 70 72 6f 74 6f 74 79 70 65 2e 74 6f 53 74 72 69 6e 67 3d Data Ascii: 0).toString(16))};function Wa(){}t(Wa,C);function Xa(){}t(Xa,Wa);function Ya(){}t(Ya,C);function F(a,b){a.g=b;Za(b,a)}function G(a){a.g instanceof Error&&(Error.captureStackTrace?Error.captureStackTrace(a.g):a.g.stack=Error().stack)}Ya.prototype.toString=

Timestamp	Bytes transferred	Direction	Data
2025-04-02 11:55:23 UTC	3583	OUT	POST /presentation/d/e/2PACX-1vQ7Dkd_WRbgSfshqD4oLNlUmDxTYPUSUb2tLr0qsjIwZ7fwYeWMIoyLCuLiIiL3T8QaBj2et0IIqqkz/web-reports?bl=editors.presentations-frontend_20250325.02_p4&app=6&clss=1&context=eJwNzntUzekaB_C33-99H1KpdrW77i33WzopKaeS2ntHddyHd-NgMmlkklCmZphJx20ylttpkhy7kZRSTIORkWbcTu7hrNwZjia6uEdx1Pn-8VnPWs93fdfz9Khz0byfzvqDNZNsAEm2ASzdJTvVQ7IVNpKVw8-2khU6SKbXSPbOWbKBLpKdhgOuktVAoZtk4z2Qe0o23UuyLTrJ8mCPXrJFvSWL7yvZiQGSBQ6U7MMQyex8JHOEocMk2-or2drhkiUHSpYBWeGSbYMZkyQrmCLZQRholiwI1BmSOUHdTMn-gNjZks2CG3GSNYJ1vGTu8CpBMuVzyQ4vlOwMjPhCMiM0p-E-dHwpmX26ZDczJXsCl7Mkuw_Gf0j2CQRvlGwcZP8g2Q7on4vfoXO7ZD3z0PsXepC_R7IycD4oWT-4Xy3ZM4i4INlkOH5Fsoug1EmmgW43JHMFx_uS9YadsB9OwjXQP5TMF3IfS1YMQQ2SjYVKOAlnoR6qXkh2DqoczewcZGrNrMTVzI5C8igzq4kysyuQM8fMisA73sz8oG-CmQVAw2Iza4PAFDMzQdFSMzsMaWlmtgYGLTezYHjgcpU1ejUrb0E_pFkZAMqCl0oPiD71UpkMGx-9UnLgnO9r5Sr0jn2tDIb_dW9TuHWbovNvU_rDvRVtSgNkZrYp62FoVpsSAN8ca1PWwuEv3inVsDG0XckBY1i78jdITmhXlsO27HYlH-Z-3aFMON-hTAdTXYcyHiya90oxHM56r1TD24L3SicE9etUwmHz7U5lO0SxLmUC1Hl1KTchKaNLSYXKP5h6DPbttlJt91ipzmApUNRi [TRUNCATED] Host: docs.google.com Connection: keep-alive Content-Length: 578 Content-Type: application/reports+json Origin: https://docs.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: NID=522=JLEqbqBzyEKyaFeMjriwHG0jyctQIODOa69zzL-GqkCCAV77XkzhK73WM-GrFqNFu9GXYOrB_Cq0fyWgNFw71PUfDyA1jcOh1sghls_Ypkqn2v2-EU0tBDm1nuR2tuljWZA72G-mtsLlJZ5FqRTDUbBd4HJOZCHhfKN6fjTs56ce1rKDO8X1tCJ8yrnifKF7rUNdOp4; GFE_RTT=224
2025-04-02 11:55:23 UTC	578	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 30 2c 22 62 6f 64 79 22 3a 7b 22 63 6f 6c 75 6d 6e 4e 75 6d 62 65 72 22 3a 32 34 34 2c 22 69 64 22 3a 22 55 6e 6c 6f 61 64 48 61 6e 64 6c 65 72 22 2c 22 6c 69 6e 65 4e 75 6d 62 65 72 22 3a 32 38 39 2c 22 6d 65 73 73 61 67 65 22 3a 22 55 6e 6c 6f 61 64 20 65 76 65 6e 74 20 6c 69 73 74 65 6e 65 72 73 20 61 72 65 20 64 65 70 72 65 63 61 74 65 64 20 61 6e 64 20 77 69 6c 6c 20 62 65 20 72 65 6d 6f 76 65 64 2e 22 2c 22 73 6f 75 72 63 65 46 69 6c 65 22 3a 22 68 74 74 70 73 3a 2f 2f 64 6f 63 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 74 61 74 69 63 2f 70 72 65 73 65 6e 74 61 74 69 6f 6e 2f 63 6c 69 65 6e 74 2f 6a 73 2f 31 35 37 33 34 39 32 30 33 39 2d 76 69 65 77 65 72 5f 69 6e 74 65 67 72 61 74 65 64 5f 63 6f 72 65 2e 6a 73 22 7d 2c 22 74 Data Ascii: [{"age":0,"body":{"columnNumber":244,"id":"UnloadHandler","lineNumber":289,"message":"Unload event listeners are deprecated and will be removed.","sourceFile":"https://docs.google.com/static/presentation/client/js/1573492039-viewer_integrated_core.js"},"t
2025-04-02 11:55:24 UTC	972	IN	HTTP/1.1 204 No Content Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 02 Apr 2025 11:55:23 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/docs-tt Content-Security-Policy: base-uri 'self';object-src 'self' blob:;report-uri https://docs.google.com/presentation/cspreport;script-src 'report-sample' 'nonce-wspQUShwYeCFpX7mbt38vQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';worker-src 'self' blob: Origin-Trial: AsBCEoVg8pIwAkst2T88NNY429HzlH4fGwN+ALnF27Zl16u/ZR0Vylgws0om63IHSaH6pHPqY+k1GQ1sheqdhwgAAACGeyJvcmlnaW4iOiJodHRwczovL2dvb2dsZS5jb206NDQzIiwiZmVhdHVyZSI6IkRvY3VtZW50UG9saWN5SW5jbHVkZUpTQ2FsbFN0YWNrc0luQ3Jhc2hSZXBvcnRzIiwiZXhwaXJ5IjoxNzQ5NTEzNjAwLCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-l2-request-path: l2-managed-4 Connection: close

Timestamp	Bytes transferred	Direction	Data
2025-04-02 11:55:26 UTC	988	OUT	GET /static/presentation/client/js/907711159-viewer_integrated_secondary.js HTTP/1.1 Host: docs.google.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / X-Client-Data: CO6MywE= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://docs.google.com/presentation/d/e/2PACX-1vQ7Dkd_WRbgSfshqD4oLNlUmDxTYPUSUb2tLr0qsjIwZ7fwYeWMIoyLCuLiIiL3T8QaBj2et0IIqqkz/pub?start=false&loop=false&delayms=3000&slide=id.p Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: NID=522=JLEqbqBzyEKyaFeMjriwHG0jyctQIODOa69zzL-GqkCCAV77XkzhK73WM-GrFqNFu9GXYOrB_Cq0fyWgNFw71PUfDyA1jcOh1sghls_Ypkqn2v2-EU0tBDm1nuR2tuljWZA72G-mtsLlJZ5FqRTDUbBd4HJOZCHhfKN6fjTs56ce1rKDO8X1tCJ8yrnifKF7rUNdOp4
2025-04-02 11:55:27 UTC	801	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/docs Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="docs" Report-To: {"group":"docs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/docs"}]} Content-Length: 367100 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon, 31 Mar 2025 15:50:36 GMT Expires: Tue, 31 Mar 2026 15:50:36 GMT Cache-Control: public, max-age=31536000 Last-Modified: Wed, 26 Mar 2025 15:14:55 GMT Content-Type: text/javascript Vary: Accept-Encoding, Origin Age: 158690 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-04-02 11:55:27 UTC	419	IN	Data Raw: 63 70 28 4e 67 29 3b 0a 2f 2a 0a 0a 4d 61 74 68 2e 75 75 69 64 2e 6a 73 20 28 76 31 2e 34 29 0a 68 74 74 70 3a 2f 2f 77 77 77 2e 62 72 6f 6f 66 61 2e 63 6f 6d 0a 6d 61 69 6c 74 6f 3a 72 6f 62 65 72 74 40 62 72 6f 6f 66 61 2e 63 6f 6d 0a 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 32 30 31 30 20 52 6f 62 65 72 74 20 4b 69 65 66 66 65 72 0a 44 75 61 6c 20 6c 69 63 65 6e 73 65 64 20 75 6e 64 65 72 20 74 68 65 20 4d 49 54 20 61 6e 64 20 47 50 4c 20 6c 69 63 65 6e 73 65 73 2e 0a 2a 2f 0a 76 61 72 20 6e 43 62 3d 22 20 61 72 69 61 2d 68 69 64 64 65 6e 3d 27 74 72 75 65 27 22 2c 6f 43 62 3d 27 20 61 72 69 61 2d 6c 61 62 65 6c 6c 65 64 62 79 3d 22 27 2c 70 43 62 3d 22 20 62 75 74 20 66 6f 75 6e 64 20 22 2c 71 43 62 3d 27 20 64 61 74 61 2d 69 64 6f 6d 2d 63 6c 61 73 Data Ascii: cp(Ng);/Math.uuid.js (v1.4)http://www.broofa.commailto:robert@broofa.comCopyright (c) 2010 Robert KiefferDual licensed under the MIT and GPL licenses./var nCb=" aria-hidden='true'",oCb=' aria-labelledby="',pCb=" but found ",qCb=' data-idom-clas
2025-04-02 11:55:27 UTC	1220	IN	Data Raw: 61 6c 72 65 61 64 79 20 69 6e 20 74 68 65 20 71 75 65 75 65 2e 22 2c 76 43 62 3d 22 20 74 61 73 6b 3a 20 74 68 69 73 20 74 61 73 6b 20 61 6c 72 65 61 64 79 20 63 6f 6d 70 6c 65 74 65 64 2e 22 2c 77 43 62 3d 22 20 74 61 73 6b 3a 20 74 68 69 73 20 74 61 73 6b 20 74 79 70 65 20 69 73 20 61 6c 72 65 61 64 79 20 72 75 6e 6e 69 6e 67 2e 22 2c 78 43 62 3d 27 22 20 64 3d 22 22 2f 3e 3c 2f 73 76 67 3e 3c 73 76 67 20 63 6c 61 73 73 3d 22 27 2c 79 43 62 3d 27 22 20 64 61 74 61 2d 70 72 6f 67 72 65 73 73 76 61 6c 75 65 3d 22 27 2c 59 4f 3d 27 22 20 68 65 69 67 68 74 3d 22 27 2c 5a 4f 3d 27 22 20 6a 73 61 63 74 69 6f 6e 3d 22 27 2c 7a 43 62 3d 27 22 20 6a 73 61 63 74 69 6f 6e 3d 22 63 6c 69 63 6b 3a 27 2c 24 4f 3d 27 22 20 6a 73 63 6f 6e 74 72 6f 6c 6c 65 72 3d 22 27 Data Ascii: already in the queue.",vCb=" task: this task already completed.",wCb=" task: this task type is already running.",xCb='" d=""/></svg><svg class="',yCb='" data-progressvalue="',YO='" height="',ZO='" jsaction="',zCb='" jsaction="click:',$O='" jscontroller="'
2025-04-02 11:55:27 UTC	1220	IN	Data Raw: 20 79 6f 75 72 20 63 61 6d 65 72 61 22 2c 62 44 62 3d 22 43 61 6e 27 74 20 66 69 6e 64 20 79 6f 75 72 20 6d 69 63 72 6f 70 68 6f 6e 65 22 2c 0a 6c 50 3d 22 43 61 6e 6e 6f 74 20 65 6e 71 75 65 75 65 20 61 20 22 2c 63 44 62 3d 22 43 68 65 63 6b 20 79 6f 75 72 20 73 79 73 74 65 6d 20 73 65 74 74 69 6e 67 73 20 74 6f 20 6d 61 6b 65 20 73 75 72 65 20 74 68 61 74 20 61 20 63 61 6d 65 72 61 20 69 73 20 61 76 61 69 6c 61 62 6c 65 2e 20 49 66 20 6e 6f 74 2c 20 70 6c 75 67 20 6f 6e 65 20 69 6e 2e 20 59 6f 75 20 6d 69 67 68 74 20 74 68 65 6e 20 6e 65 65 64 20 74 6f 20 72 65 73 74 61 72 74 20 79 6f 75 72 20 62 72 6f 77 73 65 72 2e 22 2c 64 44 62 3d 22 43 68 65 63 6b 20 79 6f 75 72 20 73 79 73 74 65 6d 20 73 65 74 74 69 6e 67 73 20 74 6f 20 6d 61 6b 65 20 73 75 72 65 Data Ascii: your camera",bDb="Can't find your microphone",lP="Cannot enqueue a ",cDb="Check your system settings to make sure that a camera is available. If not, plug one in. You might then need to restart your browser.",dDb="Check your system settings to make sure
2025-04-02 11:55:27 UTC	1220	IN	Data Raw: 2c 77 44 62 3d 22 53 39 67 55 72 66 22 2c 48 50 3d 22 53 49 4e 47 4c 45 5f 53 45 4c 45 43 54 5f 4e 4f 5f 43 4f 4e 54 52 4f 4c 22 2c 49 50 3d 22 53 49 4e 47 4c 45 5f 53 45 4c 45 43 54 5f 52 41 44 49 4f 22 2c 4a 50 3d 22 53 51 70 4c 32 63 22 2c 4b 50 3d 22 53 54 41 52 54 22 2c 78 44 62 3d 22 53 65 74 74 69 6e 67 73 22 2c 79 44 62 3d 22 53 74 61 72 74 20 72 65 63 6f 72 64 69 6e 67 22 2c 4c 50 3d 22 54 4f 55 43 48 22 2c 4d 50 3d 22 54 4f 55 43 48 5f 44 45 4c 41 59 22 2c 7a 44 62 3d 22 54 68 69 73 20 62 72 6f 77 73 65 72 20 64 6f 65 73 20 6e 6f 74 20 73 75 70 70 6f 72 74 20 63 61 6d 65 72 61 20 62 6c 75 72 2e 20 50 6c 65 61 73 65 20 75 70 64 61 74 65 20 79 6f 75 72 20 62 72 6f 77 73 65 72 20 74 6f 20 74 68 65 20 6c 61 74 65 73 74 20 76 65 72 73 69 6f 6e 2e 22 Data Ascii: ,wDb="S9gUrf",HP="SINGLE_SELECT_NO_CONTROL",IP="SINGLE_SELECT_RADIO",JP="SQpL2c",KP="START",xDb="Settings",yDb="Start recording",LP="TOUCH",MP="TOUCH_DELAY",zDb="This browser does not support camera blur. Please update your browser to the latest version."
2025-04-02 11:55:27 UTC	1220	IN	Data Raw: 61 74 61 2d 61 72 69 61 2d 6c 61 62 65 6c 2d 6f 66 66 22 2c 62 45 62 3d 22 64 61 74 61 2d 61 72 69 61 2d 6c 61 62 65 6c 2d 6f 6e 22 2c 63 45 62 3d 22 64 61 74 61 2d 64 69 73 61 62 6c 65 2d 65 6e 74 65 72 2d 74 6f 2d 63 6c 6f 73 65 22 2c 64 45 62 3d 22 64 61 74 61 2d 64 69 73 61 62 6c 65 2d 65 73 63 2d 74 6f 2d 63 6c 6f 73 65 22 2c 65 45 62 3d 22 64 61 74 61 2d 64 69 73 61 62 6c 65 2d 69 64 6f 6d 22 2c 66 45 62 3d 22 64 61 74 61 2d 64 69 73 61 62 6c 65 2d 73 63 72 69 6d 2d 63 6c 69 63 6b 2d 74 6f 2d 63 6c 6f 73 65 22 2c 67 45 62 3d 22 64 61 74 61 2d 69 64 6f 6d 2d 63 6c 61 73 73 22 2c 0a 67 51 3d 22 64 61 74 61 2d 69 6e 64 65 74 65 72 6d 69 6e 61 74 65 22 2c 68 51 3d 22 64 61 74 61 2d 6d 64 63 2d 64 69 61 6c 6f 67 2d 61 63 74 69 6f 6e 22 2c 68 45 62 3d 27 Data Ascii: ata-aria-label-off",bEb="data-aria-label-on",cEb="data-disable-enter-to-close",dEb="data-disable-esc-to-close",eEb="data-disable-idom",fEb="data-disable-scrim-click-to-close",gEb="data-idom-class",gQ="data-indeterminate",hQ="data-mdc-dialog-action",hEb='
2025-04-02 11:55:27 UTC	1220	IN	Data Raw: 3d 22 6a 61 76 61 73 63 72 69 70 74 4d 61 74 65 72 69 61 6c 64 65 73 69 67 6e 47 6d 33 57 69 7a 42 75 74 74 6f 6e 44 72 6f 70 64 6f 77 6e 46 69 6c 6c 65 64 54 6f 6e 61 6c 2d 62 75 74 74 6f 6e 22 2c 0a 4c 45 62 3d 22 6a 61 76 61 73 63 72 69 70 74 4d 61 74 65 72 69 61 6c 64 65 73 69 67 6e 47 6d 33 57 69 7a 42 75 74 74 6f 6e 44 72 6f 70 64 6f 77 6e 4f 75 74 6c 69 6e 65 64 2d 62 75 74 74 6f 6e 22 2c 4d 45 62 3d 22 6a 61 76 61 73 63 72 69 70 74 4d 61 74 65 72 69 61 6c 64 65 73 69 67 6e 47 6d 33 57 69 7a 42 75 74 74 6f 6e 44 72 6f 70 64 6f 77 6e 54 65 78 74 2d 62 75 74 74 6f 6e 22 2c 4e 45 62 3d 22 6a 61 76 61 73 63 72 69 70 74 4d 61 74 65 72 69 61 6c 64 65 73 69 67 6e 47 6d 33 57 69 7a 42 75 74 74 6f 6e 46 69 6c 6c 65 64 2d 62 75 74 74 6f 6e 22 2c 4f 45 62 3d Data Ascii: ="javascriptMaterialdesignGm3WizButtonDropdownFilledTonal-button",LEb="javascriptMaterialdesignGm3WizButtonDropdownOutlined-button",MEb="javascriptMaterialdesignGm3WizButtonDropdownText-button",NEb="javascriptMaterialdesignGm3WizButtonFilled-button",OEb=
2025-04-02 11:55:27 UTC	1220	IN	Data Raw: 61 74 65 72 69 61 6c 64 65 73 69 67 6e 47 6d 33 57 69 7a 42 75 74 74 6f 6e 50 72 6f 67 72 65 73 73 4f 75 74 6c 69 6e 65 64 2d 62 75 74 74 6f 6e 22 2c 63 46 62 3d 22 6a 61 76 61 73 63 72 69 70 74 4d 61 74 65 72 69 61 6c 64 65 73 69 67 6e 47 6d 33 57 69 7a 42 75 74 74 6f 6e 50 72 6f 67 72 65 73 73 54 65 78 74 2d 62 75 74 74 6f 6e 22 2c 64 46 62 3d 22 6a 61 76 61 73 63 72 69 70 74 4d 61 74 65 72 69 61 6c 64 65 73 69 67 6e 47 6d 33 57 69 7a 42 75 74 74 6f 6e 54 65 78 74 2d 62 75 74 74 6f 6e 22 2c 65 46 62 3d 22 6a 61 76 61 73 63 72 69 70 74 4d 61 74 65 72 69 61 6c 64 65 73 69 67 6e 47 6d 33 57 69 7a 42 75 74 74 6f 6e 54 65 78 74 2d 62 75 74 74 6f 6e 2d 2d 69 63 6f 6e 2d 6c 65 61 64 69 6e 67 22 2c 66 46 62 3d 22 6a 61 76 61 73 63 72 69 70 74 4d 61 74 65 72 69 Data Ascii: aterialdesignGm3WizButtonProgressOutlined-button",cFb="javascriptMaterialdesignGm3WizButtonProgressText-button",dFb="javascriptMaterialdesignGm3WizButtonText-button",eFb="javascriptMaterialdesignGm3WizButtonText-button--icon-leading",fFb="javascriptMateri
2025-04-02 11:55:27 UTC	1220	IN	Data Raw: 65 73 69 67 6e 47 6d 33 57 69 7a 43 69 72 63 75 6c 61 72 50 72 6f 67 72 65 73 73 2d 63 69 72 63 75 6c 61 72 2d 70 72 6f 67 72 65 73 73 5f 5f 63 6f 6e 74 61 69 6e 65 72 22 2c 74 46 62 3d 22 6a 61 76 61 73 63 72 69 70 74 4d 61 74 65 72 69 61 6c 64 65 73 69 67 6e 47 6d 33 57 69 7a 43 69 72 63 75 6c 61 72 50 72 6f 67 72 65 73 73 2d 63 69 72 63 75 6c 61 72 2d 70 72 6f 67 72 65 73 73 5f 5f 74 72 61 63 6b 22 2c 75 46 62 3d 22 6a 61 76 61 73 63 72 69 70 74 4d 61 74 65 72 69 61 6c 64 65 73 69 67 6e 47 6d 33 57 69 7a 43 69 72 63 75 6c 61 72 50 72 6f 67 72 65 73 73 2d 63 69 72 63 75 6c 61 72 2d 70 72 6f 67 72 65 73 73 5f 5f 77 72 61 70 70 65 72 22 2c 76 46 62 3d 0a 22 6a 61 76 61 73 63 72 69 70 74 4d 61 74 65 72 69 61 6c 64 65 73 69 67 6e 47 6d 33 57 69 7a 44 61 74 Data Ascii: esignGm3WizCircularProgress-circular-progress__container",tFb="javascriptMaterialdesignGm3WizCircularProgress-circular-progress__track",uFb="javascriptMaterialdesignGm3WizCircularProgress-circular-progress__wrapper",vFb="javascriptMaterialdesignGm3WizDat
2025-04-02 11:55:27 UTC	1220	IN	Data Raw: 61 63 65 22 2c 4b 46 62 3d 22 6a 61 76 61 73 63 72 69 70 74 4d 61 74 65 72 69 61 6c 64 65 73 69 67 6e 47 6d 33 57 69 7a 44 69 61 6c 6f 67 2d 64 69 61 6c 6f 67 5f 5f 73 75 72 66 61 63 65 2d 73 63 72 69 6d 2d 2d 68 69 64 69 6e 67 22 2c 0a 4c 46 62 3d 22 6a 61 76 61 73 63 72 69 70 74 4d 61 74 65 72 69 61 6c 64 65 73 69 67 6e 47 6d 33 57 69 7a 44 69 61 6c 6f 67 2d 64 69 61 6c 6f 67 5f 5f 73 75 72 66 61 63 65 2d 73 63 72 69 6d 2d 2d 73 68 6f 77 69 6e 67 22 2c 4d 46 62 3d 22 6a 61 76 61 73 63 72 69 70 74 4d 61 74 65 72 69 61 6c 64 65 73 69 67 6e 47 6d 33 57 69 7a 44 69 61 6c 6f 67 2d 64 69 61 6c 6f 67 5f 5f 73 75 72 66 61 63 65 2d 73 63 72 69 6d 2d 2d 73 68 6f 77 6e 22 2c 4e 46 62 3d 22 6a 61 76 61 73 63 72 69 70 74 4d 61 74 65 72 69 61 6c 64 65 73 69 67 6e 47 Data Ascii: ace",KFb="javascriptMaterialdesignGm3WizDialog-dialog__surface-scrim--hiding",LFb="javascriptMaterialdesignGm3WizDialog-dialog__surface-scrim--showing",MFb="javascriptMaterialdesignGm3WizDialog-dialog__surface-scrim--shown",NFb="javascriptMaterialdesignG
2025-04-02 11:55:27 UTC	1220	IN	Data Raw: 7a 4c 69 6e 65 61 72 50 72 6f 67 72 65 73 73 2d 6c 69 6e 65 61 72 2d 70 72 6f 67 72 65 73 73 2d 2d 63 6c 6f 73 65 64 2d 61 6e 69 6d 61 74 69 6f 6e 2d 6f 66 66 22 2c 62 47 62 3d 22 6a 61 76 61 73 63 72 69 70 74 4d 61 74 65 72 69 61 6c 64 65 73 69 67 6e 47 6d 33 57 69 7a 4c 69 6e 65 61 72 50 72 6f 67 72 65 73 73 2d 6c 69 6e 65 61 72 2d 70 72 6f 67 72 65 73 73 2d 2d 69 6e 64 65 74 65 72 6d 69 6e 61 74 65 22 2c 63 47 62 3d 22 6a 61 76 61 73 63 72 69 70 74 4d 61 74 65 72 69 61 6c 64 65 73 69 67 6e 47 6d 33 57 69 7a 4c 69 6e 65 61 72 50 72 6f 67 72 65 73 73 2d 6c 69 6e 65 61 72 2d 70 72 6f 67 72 65 73 73 5f 5f 61 63 74 69 76 65 2d 69 6e 64 69 63 61 74 6f 72 22 2c 64 47 62 3d 22 6a 61 76 61 73 63 72 69 70 74 4d 61 74 65 72 69 61 6c 64 65 73 69 67 6e 47 6d 33 57 Data Ascii: zLinearProgress-linear-progress--closed-animation-off",bGb="javascriptMaterialdesignGm3WizLinearProgress-linear-progress--indeterminate",cGb="javascriptMaterialdesignGm3WizLinearProgress-linear-progress__active-indicator",dGb="javascriptMaterialdesignGm3W

Timestamp	Bytes transferred	Direction	Data
2025-04-02 11:55:30 UTC	991	OUT	GET /static/presentation/client/js/764277182-viewer_integrated_help.js HTTP/1.1 Host: docs.google.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / X-Client-Data: CO6MywE= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://docs.google.com/presentation/d/e/2PACX-1vQ7Dkd_WRbgSfshqD4oLNlUmDxTYPUSUb2tLr0qsjIwZ7fwYeWMIoyLCuLiIiL3T8QaBj2et0IIqqkz/pub?start=false&loop=false&delayms=3000&slide=id.p Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: NID=522=bhb5wswndd5rkgRSravDVvW6lkZW7W6ficPF1LcfwWew60Y676Dkbbk0LouixBlVQAqog5wegSxGfF2GjeBjrMFgoRP_44_7Z8biOG2FCXIQ3J71CGQs2_KfyBu6rjJLWkqXZOXyhopQTQr53npagBXKevTUI1U3gykH6qnFMPAt9N6DfKdQe-R8FoKiLhGSX9TVwBntosJ1pzs
2025-04-02 11:55:30 UTC	800	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/docs Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="docs" Report-To: {"group":"docs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/docs"}]} Content-Length: 55187 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon, 31 Mar 2025 15:50:36 GMT Expires: Tue, 31 Mar 2026 15:50:36 GMT Cache-Control: public, max-age=31536000 Last-Modified: Wed, 26 Mar 2025 15:14:55 GMT Content-Type: text/javascript Vary: Accept-Encoding, Origin Age: 158694 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-04-02 11:55:30 UTC	420	IN	Data Raw: 63 70 28 77 65 29 3b 0a 76 61 72 20 24 37 62 3d 22 20 61 70 70 73 2d 61 63 74 69 6f 6e 64 61 74 61 77 69 64 67 65 74 2d 63 6f 6e 74 65 6e 74 2d 65 6c 65 6d 65 6e 74 22 2c 61 38 62 3d 27 22 20 74 61 62 69 6e 64 65 78 3d 22 30 22 20 72 6f 6c 65 3d 22 62 75 74 74 6f 6e 22 3e 27 2c 62 38 62 3d 27 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 32 34 20 32 34 22 20 66 6f 63 75 73 61 62 6c 65 3d 22 66 61 6c 73 65 22 20 66 69 6c 6c 3d 22 27 2c 63 38 62 3d 22 43 6f 6d 70 61 74 69 62 6c 65 20 73 70 72 65 61 64 73 68 65 65 74 20 73 68 6f 72 74 63 75 74 22 2c 64 38 62 3d 22 44 75 70 6c 69 63 61 74 65 46 6f 72 6d 45 72 72 6f 72 22 2c 65 38 62 3d 22 53 65 61 72 63 68 20 6b 65 79 62 6f 61 72 64 20 73 68 6f 72 74 63 75 74 73 22 2c 66 38 62 3d 22 61 70 70 73 2d 61 63 74 69 Data Ascii: cp(we);var $7b=" apps-actiondatawidget-content-element",a8b='" tabindex="0" role="button">',b8b='" viewBox="0 0 24 24" focusable="false" fill="',c8b="Compatible spreadsheet shortcut",d8b="DuplicateFormError",e8b="Search keyboard shortcuts",f8b="apps-acti
2025-04-02 11:55:30 UTC	1220	IN	Data Raw: 72 2d 6c 69 6e 6b 22 2c 6a 38 62 3d 22 61 70 70 73 2d 73 68 6f 72 74 63 75 74 73 68 65 6c 70 63 6f 6e 74 65 6e 74 69 6d 70 6c 2d 69 6e 70 75 74 22 2c 6b 38 62 3d 22 61 70 70 73 2d 73 68 6f 72 74 63 75 74 73 68 65 6c 70 63 6f 6e 74 65 6e 74 69 6d 70 6c 2d 6c 69 6e 6b 22 2c 0a 6c 38 62 3d 22 61 70 70 73 2d 73 68 6f 72 74 63 75 74 73 68 65 6c 70 63 6f 6e 74 65 6e 74 69 6d 70 6c 2d 6f 76 65 72 72 69 64 65 2d 62 61 6e 6e 65 72 22 2c 6d 38 62 3d 22 61 70 70 73 2d 73 68 6f 72 74 63 75 74 73 68 65 6c 70 63 6f 6e 74 65 6e 74 69 6d 70 6c 2d 6f 76 65 72 72 69 64 65 2d 62 75 74 74 6f 6e 2d 63 6f 6e 74 61 69 6e 65 72 22 2c 6e 38 62 3d 22 61 70 70 73 2d 73 68 6f 72 74 63 75 74 73 68 65 6c 70 63 6f 6e 74 65 6e 74 69 6d 70 6c 2d 6f 76 65 72 72 69 64 65 2d 6c 61 62 65 6c Data Ascii: r-link",j8b="apps-shortcutshelpcontentimpl-input",k8b="apps-shortcutshelpcontentimpl-link",l8b="apps-shortcutshelpcontentimpl-override-banner",m8b="apps-shortcutshelpcontentimpl-override-button-container",n8b="apps-shortcutshelpcontentimpl-override-label
2025-04-02 11:55:30 UTC	1220	IN	Data Raw: 2c 6f 50 61 29 29 3b 69 66 28 21 61 29 72 65 74 75 72 6e 5b 5d 3b 76 61 72 20 63 3d 5b 5d 2c 65 3d 28 47 38 62 28 29 2c 46 38 62 29 3b 61 3d 57 43 61 28 61 2e 73 70 6c 69 74 28 65 29 29 3b 66 6f 72 28 65 3d 30 3b 65 3c 61 2e 6c 65 6e 67 74 68 3b 65 2b 2b 29 7b 76 61 72 20 66 3d 61 5b 65 5d 3b 66 26 26 63 2e 70 75 73 68 28 51 6c 28 66 29 29 7d 72 65 74 75 72 6e 20 63 7d 29 3b 58 41 2e 70 72 6f 74 6f 74 79 70 65 2e 55 45 3d 6d 52 28 38 33 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6a 42 28 74 68 69 73 2c 28 4d 41 28 29 2c 6c 50 61 29 29 7c 7c 22 22 7d 29 3b 68 42 2e 70 72 6f 74 6f 74 79 70 65 2e 78 73 3d 6d 52 28 38 32 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3d 74 68 69 73 2e 55 45 28 29 3b 72 65 74 75 72 6e 20 61 3f 61 3a 28 61 3d Data Ascii: ,oPa));if(!a)return[];var c=[],e=(G8b(),F8b);a=WCa(a.split(e));for(e=0;e<a.length;e++){var f=a[e];f&&c.push(Ql(f))}return c});XA.prototype.UE=mR(83,function(){return jB(this,(MA(),lPa))\|\|""});hB.prototype.xs=mR(82,function(){var a=this.UE();return a?a:(a=
2025-04-02 11:55:30 UTC	1220	IN	Data Raw: 73 65 28 29 3b 74 68 69 73 2e 43 2e 64 69 73 70 6f 73 65 28 29 3b 74 68 69 73 2e 42 3d 7b 7d 7d 3b 7a 2e 67 65 74 49 64 3d 77 28 22 4a 62 22 29 3b 0a 7a 2e 69 73 45 6e 61 62 6c 65 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 21 21 74 68 69 73 2e 44 64 28 54 64 29 7d 3b 7a 2e 47 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 63 29 7b 63 3d 63 7c 7c 65 64 3b 76 61 72 20 65 3d 21 30 3b 69 66 28 61 29 7b 64 65 6c 65 74 65 20 74 68 69 73 2e 46 5b 63 5d 3b 66 6f 72 28 76 61 72 20 66 20 69 6e 20 74 68 69 73 2e 46 29 7b 65 3d 21 31 3b 62 72 65 61 6b 7d 7d 65 6c 73 65 20 74 68 69 73 2e 46 5b 63 5d 3d 21 30 2c 65 3d 21 31 3b 74 68 69 73 2e 53 64 28 54 64 2c 65 29 7d 3b 7a 2e 4c 53 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 21 21 74 68 69 73 2e 44 64 Data Ascii: se();this.C.dispose();this.B={}};z.getId=w("Jb");z.isEnabled=function(){return!!this.Dd(Td)};z.Ga=function(a,c){c=c\|\|ed;var e=!0;if(a){delete this.F[c];for(var f in this.F){e=!1;break}}else this.F[c]=!0,e=!1;this.Sd(Td,e)};z.LS=function(){return!!this.Dd
2025-04-02 11:55:31 UTC	1220	IN	Data Raw: 6e 5b 5d 7d 3b 7a 2e 66 69 72 65 41 63 74 69 6f 6e 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 63 2c 65 2c 66 29 7b 69 66 28 74 68 69 73 2e 69 73 45 6e 61 62 6c 65 64 28 29 26 26 5a 6c 28 4b 38 62 29 29 7b 76 61 72 20 67 3d 74 68 69 73 2e 42 2e 73 65 6c 65 63 74 65 64 2c 68 3d 74 68 69 73 2e 42 5b 44 68 5d 3b 67 21 3d 6e 75 6c 6c 26 26 68 26 26 74 68 69 73 2e 73 65 74 53 65 6c 65 63 74 65 64 28 21 67 29 3b 74 68 69 73 2e 44 2e 55 78 28 52 62 2c 61 2c 63 29 3b 74 68 69 73 2e 43 2e 42 2e 55 78 28 65 50 61 2e 74 6f 53 74 72 69 6e 67 28 29 2c 6e 65 77 20 24 4f 61 28 61 2c 63 2c 65 2c 66 29 29 7d 7d 3b 0a 7a 2e 73 75 62 73 63 72 69 62 65 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 63 2c 65 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 44 2e 73 75 62 73 63 72 69 62 65 28 61 2c 63 Data Ascii: n[]};z.fireAction=function(a,c,e,f){if(this.isEnabled()&&Zl(K8b)){var g=this.B.selected,h=this.B[Dh];g!=null&&h&&this.setSelected(!g);this.D.Ux(Rb,a,c);this.C.B.Ux(ePa.toString(),new $Oa(a,c,e,f))}};z.subscribe=function(a,c,e){return this.D.subscribe(a,c
2025-04-02 11:55:31 UTC	1220	IN	Data Raw: 63 74 69 6f 6e 20 56 38 62 28 61 29 7b 74 68 69 73 2e 42 3d 61 3b 61 2e 74 68 65 6e 28 51 69 28 72 28 29 2c 74 68 69 73 29 2c 72 28 29 2c 74 68 69 73 29 7d 66 75 6e 63 74 69 6f 6e 20 57 38 62 28 61 2c 63 2c 65 29 7b 61 2e 42 2e 74 68 65 6e 28 66 75 6e 63 74 69 6f 6e 28 66 29 7b 76 61 72 20 67 3d 66 5b 63 5d 3b 69 66 28 21 67 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 6c 6c 60 22 2b 63 29 3b 72 65 74 75 72 6e 20 67 2e 61 70 70 6c 79 28 66 2c 65 29 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 58 38 62 28 61 2c 63 2c 65 29 7b 66 6f 72 28 76 61 72 20 66 3d 41 72 72 61 79 28 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 2d 32 29 2c 67 3d 32 3b 67 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 67 2b 2b 29 66 5b 67 2d 32 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 67 5d Data Ascii: ction V8b(a){this.B=a;a.then(Qi(r(),this),r(),this)}function W8b(a,c,e){a.B.then(function(f){var g=f[c];if(!g)throw Error("ll`"+c);return g.apply(f,e)})}function X8b(a,c,e){for(var f=Array(arguments.length-2),g=2;g<arguments.length;g++)f[g-2]=arguments[g]
2025-04-02 11:55:31 UTC	1220	IN	Data Raw: 24 38 62 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 41 69 28 66 75 6e 63 74 69 6f 6e 28 63 29 7b 69 66 28 63 2e 42 3d 3d 31 29 72 65 74 75 72 6e 20 74 79 70 65 6f 66 20 64 6f 63 75 6d 65 6e 74 3d 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 7c 7c 64 6f 63 75 6d 65 6e 74 2e 72 65 71 75 65 73 74 53 74 6f 72 61 67 65 41 63 63 65 73 73 46 6f 72 3d 3d 3d 76 6f 69 64 20 30 7c 7c 6e 61 76 69 67 61 74 6f 72 2e 70 65 72 6d 69 73 73 69 6f 6e 73 3d 3d 3d 76 6f 69 64 20 30 7c 7c 6e 61 76 69 67 61 74 6f 72 2e 70 65 72 6d 69 73 73 69 6f 6e 73 2e 71 75 65 72 79 3d 3d 3d 76 6f 69 64 20 30 7c 7c 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 6e 61 6d 65 2e 6d 61 74 63 68 28 22 2e 2b 5c 5c 2e 67 6f 6f 67 6c 65 5c 5c 2e 63 6f 6d 24 22 29 3f 63 2e 72 65 74 75 72 6e 28 50 72 Data Ascii: $8b(function(){return Ai(function(c){if(c.B==1)return typeof document==="undefined"\|\|document.requestStorageAccessFor===void 0\|\|navigator.permissions===void 0\|\|navigator.permissions.query===void 0\|\|location.hostname.match(".+\\.google\\.com$")?c.return(Pr
2025-04-02 11:55:31 UTC	1220	IN	Data Raw: 67 73 74 61 74 69 63 2e 63 6f 6d 2f 66 65 65 64 62 61 63 6b 2f 6a 73 2f 68 65 6c 70 2f 70 72 6f 64 2f 73 65 72 76 69 63 65 2f 6c 61 7a 79 2e 6d 69 6e 2e 6a 73 22 29 3b 66 75 6e 63 74 69 6f 6e 20 66 39 62 28 29 7b 55 70 2e 63 61 6c 6c 28 74 68 69 73 29 3b 74 68 69 73 2e 42 3d 7b 7d 7d 42 28 66 39 62 2c 55 70 29 3b 7a 3d 66 39 62 2e 70 72 6f 74 6f 74 79 70 65 3b 7a 2e 79 72 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 42 5b 61 5d 7c 7c 6e 75 6c 6c 7d 3b 7a 2e 56 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 63 3d 74 68 69 73 2e 79 72 28 61 29 3b 69 66 28 21 63 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 51 63 60 22 2b 61 29 3b 72 65 74 75 72 6e 20 63 7d 3b 7a 2e 67 6e 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 66 6f 72 28 76 61 Data Ascii: gstatic.com/feedback/js/help/prod/service/lazy.min.js");function f9b(){Up.call(this);this.B={}}B(f9b,Up);z=f9b.prototype;z.yr=function(a){return this.B[a]\|\|null};z.V=function(a){var c=this.yr(a);if(!c)throw Error("Qc`"+a);return c};z.gn=function(a){for(va
2025-04-02 11:55:31 UTC	1220	IN	Data Raw: 28 29 3a 2e 38 2c 68 3d 30 3b 68 3c 66 2e 6c 65 6e 67 74 68 3b 68 2b 2b 29 7b 76 61 72 20 6c 3d 66 5b 68 5d 3b 76 61 72 20 6e 3d 61 3b 76 61 72 20 70 3d 63 3b 69 66 28 6e 3d 6e 39 62 28 6e 29 29 69 66 28 70 26 26 70 2e 43 28 29 29 7b 6c 3d 70 53 28 6c 2e 78 73 28 29 2c 6c 2e 62 41 28 29 29 3b 66 6f 72 28 76 61 72 20 71 3d 70 3d 30 3b 71 3c 6c 2e 6c 65 6e 67 74 68 3b 71 2b 2b 29 7b 76 61 72 20 75 3d 6e 39 62 28 6c 5b 71 5d 29 3b 75 3d 31 2d 54 38 62 28 75 2c 6e 29 2f 4d 61 74 68 2e 6d 61 78 28 75 2e 6c 65 6e 67 74 68 2c 6e 2e 6c 65 6e 67 74 68 29 3b 70 3d 70 3e 75 3f 70 3a 75 7d 6e 3d 70 7d 65 6c 73 65 20 6e 3d 70 39 62 28 6c 2c 6e 29 3b 65 6c 73 65 20 6e 3d 30 3b 6e 3e 3d 67 26 26 65 2e 70 75 73 68 28 6e 65 77 20 67 39 62 28 66 5b 68 5d 2c 7b 63 6f 6e 66 Data Ascii: ():.8,h=0;h<f.length;h++){var l=f[h];var n=a;var p=c;if(n=n9b(n))if(p&&p.C()){l=pS(l.xs(),l.bA());for(var q=p=0;q<l.length;q++){var u=n9b(l[q]);u=1-T8b(u,n)/Math.max(u.length,n.length);p=p>u?p:u}n=p}else n=p9b(l,n);else n=0;n>=g&&e.push(new g9b(f[h],{conf
2025-04-02 11:55:31 UTC	1220	IN	Data Raw: 72 22 29 2b 69 61 2b 43 79 28 63 2e 74 69 74 6c 65 29 2b 22 3c 2f 68 33 3e 3c 2f 74 68 3e 3c 2f 74 72 3e 22 3a 22 22 29 3b 63 3d 63 2e 73 68 6f 72 74 63 75 74 73 3b 66 6f 72 28 76 61 72 20 65 3d 63 2e 6c 65 6e 67 74 68 2c 66 3d 30 3b 66 3c 65 3b 66 2b 2b 29 7b 76 61 72 20 67 3d 63 5b 66 5d 3b 61 2b 3d 27 3c 74 72 3e 3c 74 64 20 63 6c 61 73 73 3d 22 27 2b 54 28 22 61 70 70 73 2d 61 63 74 69 6f 6e 64 61 74 61 77 69 64 67 65 74 2d 73 68 6f 72 74 63 75 74 2d 64 65 73 63 22 29 2b 54 28 24 37 62 29 2b 69 61 2b 43 79 28 67 2e 64 65 73 63 72 69 70 74 69 6f 6e 29 2b 27 3c 2f 74 64 3e 3c 74 64 20 63 6c 61 73 73 3d 22 27 2b 54 28 22 61 70 70 73 2d 61 63 74 69 6f 6e 64 61 74 61 77 69 64 67 65 74 2d 73 68 6f 72 74 63 75 74 2d 6b 65 79 22 29 2b 54 28 24 37 62 29 2b 69 Data Ascii: r")+ia+Cy(c.title)+"</h3></th></tr>":"");c=c.shortcuts;for(var e=c.length,f=0;f<e;f++){var g=c[f];a+='<tr><td class="'+T("apps-actiondatawidget-shortcut-desc")+T($7b)+ia+Cy(g.description)+'</td><td class="'+T("apps-actiondatawidget-shortcut-key")+T($7b)+i

Timestamp	Bytes transferred	Direction	Data
2025-04-02 11:55:32 UTC	951	OUT	GET /presentation/manifest.json HTTP/1.1 Host: docs.google.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / X-Client-Data: CO6MywE= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: manifest Referer: https://docs.google.com/presentation/d/e/2PACX-1vQ7Dkd_WRbgSfshqD4oLNlUmDxTYPUSUb2tLr0qsjIwZ7fwYeWMIoyLCuLiIiL3T8QaBj2et0IIqqkz/pub?start=false&loop=false&delayms=3000&slide=id.p Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: NID=522=bhb5wswndd5rkgRSravDVvW6lkZW7W6ficPF1LcfwWew60Y676Dkbbk0LouixBlVQAqog5wegSxGfF2GjeBjrMFgoRP_44_7Z8biOG2FCXIQ3J71CGQs2_KfyBu6rjJLWkqXZOXyhopQTQr53npagBXKevTUI1U3gykH6qnFMPAt9N6DfKdQe-R8FoKiLhGSX9TVwBntosJ1pzs
2025-04-02 11:55:32 UTC	4177	IN	HTTP/1.1 200 OK Content-Type: application/manifest+json; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 02 Apr 2025 11:55:32 GMT Cross-Origin-Resource-Policy: same-origin Transfer-Encoding: chunked Content-Security-Policy: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/docs-tt Content-Security-Policy: base-uri 'self';object-src 'self' blob:;report-uri https://docs.google.com/presentation/cspreport;script-src 'report-sample' 'nonce-Gea-Bjc6LQODavJcJndbRA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';worker-src 'self' blob: Origin-Trial: AsBCEoVg8pIwAkst2T88NNY429HzlH4fGwN+ALnF27Zl16u/ZR0Vylgws0om63IHSaH6pHPqY+k1GQ1sheqdhwgAAACGeyJvcmlnaW4iOiJodHRwczovL2dvb2dsZS5jb206NDQzIiwiZmVhdHVyZSI6IkRvY3VtZW50UG9saWN5SW5jbHVkZUpTQ2FsbFN0YWNrc0luQ3Jhc2hSZXBvcnRzIiwiZXhwaXJ5IjoxNzQ5NTEzNjAwLCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Reporting-Endpoints: default="/presentation/web-reports?bl=editors.presentations-frontend_20250325.02_p4&context=eJwNzntUzekaB_DX7_e-j6hUu9ql2lsuuaaTknIqqb13VIdchnfHwWSqkUluZTSDoeM2GcftNCGnGpUixTQYGWnG7eQezsqd4WjQBSFdHDXfPz7rWev7rO96np73HTUd05kH9GCSDSTJNkGuhWRnekq2wlKyUvjJSrJ8W8n0GslaHSQb5CjZWTjkJFkV5DtLNsEFe1fJprtJtk0n2S4o0Eu2oK9kcf0lOzVQMr9Bkn0YKpm1p2R2MGy4ZOtHSJbsJ1kapIdItgNiJkmWN0WywzDILJk_qDGS2UPNDMl-h6hZks2EW7GSPYMecZL1hjcJkimfS3Z0vmTnYOQXkhmhIRW3of1LyWyWS3Z7tWTP4Wq6ZA_B-A_JPoGAzZKNh4zvJdsNHln4Gzp3StZrF3r_Rg-yCyQrAYfDkg2Ah5WSvYTQS5JNhpPXJLsMSo1kGuh-SzInsHsoWV_YAwfhNNwA_WPJvCDrqWRF4F8n2Tgoh9NwHmqh4rVkF6DCzswuwGqtmRU7mdlxSB5tZlXhZnYNMmebWSG4x5mZN_RPMDNfqFtoZi3gt8jMTFC4xMyOQmqqma2DwcvMLAAeOV5nz9walPegH9qgDARlXrPSEyLONCuTYfOTN0omXPB6q1yHvlFvlSHwf4sWhfdoUXQ-LYoHPFjRotTB6tUtykYYlt6i-MKqEy3Kejj6RatSCZuD2pRMMAa3KX-D5IQ2ZRnsyGhTsmHO1-3KxIvtynQw1bQrEyBX06EUwdH0DqUS3ud1KJ3gP6BTCYGtdzuVnRDOupSJUOPWpdyGpLQuJQXKf2fqCdi_t5tqVdBNdYDcPEUtgpyzipqrqmoRjByiqkHQOkVVuyBqmqpOhUtrVPUm-G5Q1TFwrE5VT8HMnlxNgCZ3rrbA4Fd_5d7w48tAXgH [TRUNCATED] Document-Policy: include-js-call-stacks-in-crash-reports X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-l2-request-path: l2-managed-4 Connection: close
2025-04-02 11:55:32 UTC	502	IN	Data Raw: 31 45 46 0d 0a 7b 22 73 63 6f 70 65 22 3a 22 2f 70 72 65 73 65 6e 74 61 74 69 6f 6e 2f 22 2c 22 64 69 73 70 6c 61 79 22 3a 22 62 72 6f 77 73 65 72 22 2c 22 6e 61 6d 65 22 3a 22 53 6c 69 64 65 73 22 2c 22 73 74 61 72 74 5f 75 72 6c 22 3a 22 2f 70 72 65 73 65 6e 74 61 74 69 6f 6e 2f 3f 75 73 70 5c 75 30 30 33 64 69 6e 73 74 61 6c 6c 65 64 5f 77 65 62 61 70 70 22 2c 22 69 64 22 3a 22 2f 70 72 65 73 65 6e 74 61 74 69 6f 6e 2f 3f 75 73 70 5c 75 30 30 33 64 69 6e 73 74 61 6c 6c 65 64 5f 77 65 62 61 70 70 22 2c 22 69 63 6f 6e 73 22 3a 5b 7b 22 73 69 7a 65 73 22 3a 22 31 36 78 31 36 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 2f 2f 73 73 6c 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 64 6f 63 73 2f 70 72 65 73 65 6e 74 61 74 69 6f 6e 73 2f 69 6d 61 67 65 73 2f 66 61 Data Ascii: 1EF{"scope":"/presentation/","display":"browser","name":"Slides","start_url":"/presentation/?usp\u003dinstalled_webapp","id":"/presentation/?usp\u003dinstalled_webapp","icons":[{"sizes":"16x16","src":"https://ssl.gstatic.com/docs/presentations/images/fa
2025-04-02 11:55:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-04-02 11:55:39 UTC	714	OUT	GET /nrColMBN HTTP/1.1 Host: meheff.wpym.xyz Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: https://docs.google.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-02 11:55:39 UTC	17	IN	HTTP/1.1 200 OK
2025-04-02 11:55:39 UTC	19	IN	Data Raw: 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a Data Ascii: Connection: close
2025-04-02 11:55:39 UTC	25	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 0d 0a Data Ascii: Content-Type: text/html
2025-04-02 11:55:39 UTC	152	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 36 38 62 61 2d 37 33 64 36 3d 35 39 36 34 33 31 32 61 39 36 38 64 35 62 66 38 62 34 31 31 32 61 65 62 37 36 31 30 32 63 37 33 33 36 31 63 38 63 66 32 37 32 63 37 30 30 36 65 33 65 39 35 34 33 35 35 30 36 64 61 66 31 39 65 3b 20 50 61 74 68 3d 2f 3b 20 44 6f 6d 61 69 6e 3d 77 70 79 6d 2e 78 79 7a 3b 20 45 78 70 69 72 65 73 3d 57 65 64 2c 20 30 32 20 41 70 72 20 32 30 32 35 20 31 32 3a 35 35 3a 33 37 20 47 4d 54 0d 0a Data Ascii: Set-Cookie: 68ba-73d6=5964312a968d5bf8b4112aeb76102c73361c8cf272c7006e3e95435506daf19e; Path=/; Domain=wpym.xyz; Expires=Wed, 02 Apr 2025 12:55:37 GMT
2025-04-02 11:55:39 UTC	28	IN	Data Raw: 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a Data Ascii: Transfer-Encoding: chunked
2025-04-02 11:55:39 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2025-04-02 11:55:39 UTC	6	IN	Data Raw: 34 65 63 31 0d 0a Data Ascii: 4ec1
2025-04-02 11:55:39 UTC	16384	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0d 0a 20 20 20 20 3c 21 2d 2d 20 23 72 65 67 69 6f 6e 28 63 6f 6c 6c 61 70 73 65 64 29 2d 2d 3e 0d 0a 20 20 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 2a 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 68 74 6d 6c 20 7b 0d 0a 20 20 20 20 Data Ascii: <!DOCTYPE html><html lang="en-US"> ... #region(collapsed)--> <head> <style> * { box-sizing: border-box; margin: 0; padding: 0; } html {
2025-04-02 11:55:39 UTC	3777	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 74 75 72 6e 73 74 69 6c 65 2e 72 65 6e 64 65 72 28 22 23 74 75 72 6e 73 74 69 6c 65 43 61 70 74 63 68 61 22 2c 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 69 74 65 6b 65 79 3a 20 22 30 78 34 41 41 41 41 41 41 41 32 70 74 6c 39 42 4b 63 47 6b 32 42 42 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 61 6c 6c 62 61 63 6b 3a 20 76 65 72 69 66 79 43 61 6c 6c 62 61 63 6b 5f 43 46 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 65 78 70 69 72 65 64 2d 63 61 6c 6c 62 61 63 6b 22 3a 20 72 65 66 72 65 73 68 43 61 6c 6c 42 61 63 6b 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 2f 20 22 65 72 72 6f 72 2d 63 61 6c 6c 62 61 63 Data Ascii: turnstile.render("#turnstileCaptcha", { sitekey: "0x4AAAAAAA2ptl9BKcGk2BB2", callback: verifyCallback_CF, "expired-callback": refreshCallBack, // "error-callbac
2025-04-02 11:55:39 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2025-04-02 11:55:39 UTC	3	IN	Data Raw: 30 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-04-02 11:55:40 UTC	615	OUT	GET /turnstile/v0/api.js?onload=onloadTurnstileCallback HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://meheff.wpym.xyz/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-02 11:55:40 UTC	386	IN	HTTP/1.1 302 Found Date: Wed, 02 Apr 2025 11:55:40 GMT Content-Length: 0 Connection: close access-control-allow-origin: * cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=300, public cross-origin-resource-policy: cross-origin location: /turnstile/v0/b/708f7a809116/api.js Server: cloudflare CF-RAY: 92a0237a9c62659d-EWR alt-svc: h3=":443"; ma=86400

Timestamp	Bytes transferred	Direction	Data
2025-04-02 11:55:40 UTC	599	OUT	GET /turnstile/v0/b/708f7a809116/api.js HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://meheff.wpym.xyz/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-02 11:55:41 UTC	471	IN	HTTP/1.1 200 OK Date: Wed, 02 Apr 2025 11:55:41 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 48123 Connection: close accept-ranges: bytes last-modified: Tue, 18 Mar 2025 12:36:20 GMT cache-control: max-age=31536000, stale-if-error=10800, stale-while-revalidate=31536000, public access-control-allow-origin: * cross-origin-resource-policy: cross-origin Server: cloudflare CF-RAY: 92a0237e5c08f3e6-EWR alt-svc: h3=":443"; ma=86400
2025-04-02 11:55:41 UTC	898	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 6a 74 28 65 2c 74 2c 61 2c 6f 2c 63 2c 6c 2c 76 29 7b 74 72 79 7b 76 61 72 20 68 3d 65 5b 6c 5d 28 76 29 2c 73 3d 68 2e 76 61 6c 75 65 7d 63 61 74 63 68 28 70 29 7b 61 28 70 29 3b 72 65 74 75 72 6e 7d 68 2e 64 6f 6e 65 3f 74 28 73 29 3a 50 72 6f 6d 69 73 65 2e 72 65 73 6f 6c 76 65 28 73 29 2e 74 68 65 6e 28 6f 2c 63 29 7d 66 75 6e 63 74 69 6f 6e 20 71 74 28 65 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 74 68 69 73 2c 61 3d 61 72 67 75 6d 65 6e 74 73 3b 72 65 74 75 72 6e 20 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 6f 2c 63 29 7b 76 61 72 20 6c 3d 65 2e 61 70 70 6c 79 28 74 2c 61 29 3b 66 75 6e 63 74 Data Ascii: "use strict";(function(){function jt(e,t,a,o,c,l,v){try{var h=e[l](v),s=h.value}catch(p){a(p);return}h.done?t(s):Promise.resolve(s).then(o,c)}function qt(e){return function(){var t=this,a=arguments;return new Promise(function(o,c){var l=e.apply(t,a);funct
2025-04-02 11:55:41 UTC	1369	IN	Data Raw: 20 65 7d 66 75 6e 63 74 69 6f 6e 20 49 72 28 65 2c 74 29 7b 76 61 72 20 61 3d 4f 62 6a 65 63 74 2e 6b 65 79 73 28 65 29 3b 69 66 28 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 29 7b 76 61 72 20 6f 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 28 65 29 3b 74 26 26 28 6f 3d 6f 2e 66 69 6c 74 65 72 28 66 75 6e 63 74 69 6f 6e 28 63 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 28 65 2c 63 29 2e 65 6e 75 6d 65 72 61 62 6c 65 7d 29 29 2c 61 2e 70 75 73 68 2e 61 70 70 6c 79 28 61 2c 6f 29 7d 72 65 74 75 72 6e 20 61 7d 66 75 6e 63 74 69 6f 6e 20 69 74 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 74 3d 74 21 3d 6e 75 Data Ascii: e}function Ir(e,t){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);t&&(o=o.filter(function(c){return Object.getOwnPropertyDescriptor(e,c).enumerable})),a.push.apply(a,o)}return a}function it(e,t){return t=t!=nu
2025-04-02 11:55:41 UTC	1369	IN	Data Raw: 72 61 79 24 2f 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 6f 74 28 65 2c 74 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 49 65 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 7a 74 28 65 29 7c 7c 42 74 28 65 2c 74 29 7c 7c 58 74 28 65 2c 74 29 7c 7c 47 74 28 29 7d 66 75 6e 63 74 69 6f 6e 20 46 28 65 29 7b 22 40 73 77 63 2f 68 65 6c 70 65 72 73 20 2d 20 74 79 70 65 6f 66 22 3b 72 65 74 75 72 6e 20 65 26 26 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 3d 3d 53 79 6d 62 6f 6c 3f 22 73 79 6d 62 6f 6c 22 3a 74 79 70 65 6f 66 20 65 7d 66 75 6e 63 74 69 6f 6e 20 50 65 28 65 2c 74 29 7b 76 61 72 20 61 3d 7b 6c 61 62 65 6c 3a 30 2c 73 65 6e 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 6c 5b 30 Data Ascii: ray$/.test(a))return ot(e,t)}}function Ie(e,t){return zt(e)\|\|Bt(e,t)\|\|Xt(e,t)\|\|Gt()}function F(e){"@swc/helpers - typeof";return e&&typeof Symbol!="undefined"&&e.constructor===Symbol?"symbol":typeof e}function Pe(e,t){var a={label:0,sent:function(){if(l[0
2025-04-02 11:55:41 UTC	1369	IN	Data Raw: 74 69 6f 6e 3a 22 54 75 72 6e 73 74 69 6c 65 27 73 20 61 70 69 2e 6a 73 20 77 61 73 20 6c 6f 61 64 65 64 2c 20 62 75 74 20 74 68 65 20 69 66 72 61 6d 65 20 75 6e 64 65 72 20 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 6c 6f 61 64 65 64 2e 20 48 61 73 20 74 68 65 20 76 69 73 69 74 6f 72 20 62 6c 6f 63 6b 65 64 20 73 6f 6d 65 20 70 61 72 74 73 20 6f 66 20 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 20 6f 72 20 61 72 65 20 74 68 65 79 20 73 65 6c 66 2d 68 6f 73 74 69 6e 67 20 61 70 69 2e 6a 73 3f 22 7d 3b 76 61 72 20 51 74 3d 33 30 30 30 32 30 3b 76 61 72 20 57 65 3d 33 30 30 30 33 30 3b 76 61 72 20 55 65 3d 33 30 30 30 33 31 3b 76 61 72 20 71 3b 28 66 75 Data Ascii: tion:"Turnstile's api.js was loaded, but the iframe under challenges.cloudflare.com could not be loaded. Has the visitor blocked some parts of challenges.cloudflare.com or are they self-hosting api.js?"};var Qt=300020;var We=300030;var Ue=300031;var q;(fu
2025-04-02 11:55:41 UTC	1369	IN	Data Raw: 61 6e 75 61 6c 22 2c 65 2e 41 75 74 6f 3d 22 61 75 74 6f 22 7d 29 28 5a 7c 7c 28 5a 3d 7b 7d 29 29 3b 76 61 72 20 63 65 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 4e 65 76 65 72 3d 22 6e 65 76 65 72 22 2c 65 2e 4d 61 6e 75 61 6c 3d 22 6d 61 6e 75 61 6c 22 2c 65 2e 41 75 74 6f 3d 22 61 75 74 6f 22 7d 29 28 63 65 7c 7c 28 63 65 3d 7b 7d 29 29 3b 76 61 72 20 51 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 41 6c 77 61 79 73 3d 22 61 6c 77 61 79 73 22 2c 65 2e 45 78 65 63 75 74 65 3d 22 65 78 65 63 75 74 65 22 2c 65 2e 49 6e 74 65 72 61 63 74 69 6f 6e 4f 6e 6c 79 3d 22 69 6e 74 65 72 61 63 74 69 6f 6e 2d 6f 6e 6c 79 22 7d 29 28 51 7c 7c 28 51 3d 7b 7d 29 29 3b 76 61 72 20 6d 65 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 52 65 6e 64 65 72 3d 22 72 Data Ascii: anual",e.Auto="auto"})(Z\|\|(Z={}));var ce;(function(e){e.Never="never",e.Manual="manual",e.Auto="auto"})(ce\|\|(ce={}));var Q;(function(e){e.Always="always",e.Execute="execute",e.InteractionOnly="interaction-only"})(Q\|\|(Q={}));var me;(function(e){e.Render="r
2025-04-02 11:55:41 UTC	1369	IN	Data Raw: 74 69 6f 6e 20 70 74 28 65 29 7b 72 65 74 75 72 6e 20 4c 28 5b 4d 2e 4e 6f 72 6d 61 6c 2c 4d 2e 43 6f 6d 70 61 63 74 2c 4d 2e 49 6e 76 69 73 69 62 6c 65 2c 4d 2e 46 6c 65 78 69 62 6c 65 5d 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 76 74 28 65 29 7b 72 65 74 75 72 6e 20 4c 28 5b 22 61 75 74 6f 22 2c 22 6d 61 6e 75 61 6c 22 2c 22 6e 65 76 65 72 22 5d 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 6d 74 28 65 29 7b 72 65 74 75 72 6e 20 4c 28 5b 22 61 75 74 6f 22 2c 22 6d 61 6e 75 61 6c 22 2c 22 6e 65 76 65 72 22 5d 2c 65 29 7d 76 61 72 20 4e 72 3d 2f 5e 5b 61 2d 7a 5d 7b 32 2c 33 7d 28 5b 2d 5f 5d 5b 61 2d 7a 5d 7b 32 7d 29 3f 24 2f 69 3b 66 75 6e 63 74 69 6f 6e 20 67 74 28 65 29 7b 72 65 74 75 72 6e 20 65 3d 3d 3d 22 61 75 74 6f 22 7c 7c 4e 72 2e 74 65 73 74 28 65 29 Data Ascii: tion pt(e){return L([M.Normal,M.Compact,M.Invisible,M.Flexible],e)}function vt(e){return L(["auto","manual","never"],e)}function mt(e){return L(["auto","manual","never"],e)}var Nr=/^[a-z]{2,3}([-_][a-z]{2})?$/i;function gt(e){return e==="auto"\|\|Nr.test(e)
2025-04-02 11:55:41 UTC	1369	IN	Data Raw: 22 72 6f 2d 72 6f 22 5d 3b 66 75 6e 63 74 69 6f 6e 20 54 74 28 65 2c 74 29 7b 76 61 72 20 61 3d 22 68 74 74 70 73 3a 2f 2f 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 22 3b 69 66 28 74 29 7b 76 61 72 20 6f 3b 61 3d 28 6f 3d 65 5b 22 62 61 73 65 2d 75 72 6c 22 5d 29 21 3d 3d 6e 75 6c 6c 26 26 6f 21 3d 3d 76 6f 69 64 20 30 3f 6f 3a 61 7d 72 65 74 75 72 6e 20 61 7d 66 75 6e 63 74 69 6f 6e 20 52 74 28 65 2c 74 2c 61 2c 6f 2c 63 2c 6c 2c 76 2c 68 29 7b 76 61 72 20 73 3d 54 74 28 61 2c 63 29 2c 70 3d 6c 3f 22 68 2f 22 2e 63 6f 6e 63 61 74 28 6c 2c 22 2f 22 29 3a 22 22 2c 5f 3d 68 3f 22 3f 22 2e 63 6f 6e 63 61 74 28 68 29 3a 22 22 2c 41 3d 61 5b 22 66 65 65 64 62 61 63 6b 2d 65 6e 61 62 6c 65 64 22 5d 3d 3d 3d 21 31 3f 22 66 62 44 Data Ascii: "ro-ro"];function Tt(e,t){var a="https://challenges.cloudflare.com";if(t){var o;a=(o=e["base-url"])!==null&&o!==void 0?o:a}return a}function Rt(e,t,a,o,c,l,v,h){var s=Tt(a,c),p=l?"h/".concat(l,"/"):"",_=h?"?".concat(h):"",A=a["feedback-enabled"]===!1?"fbD
2025-04-02 11:55:42 UTC	1369	IN	Data Raw: 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 7c 7c 66 75 6e 63 74 69 6f 6e 28 6f 2c 63 29 7b 72 65 74 75 72 6e 20 6f 2e 5f 5f 70 72 6f 74 6f 5f 5f 3d 63 2c 6f 7d 2c 65 65 28 65 2c 74 29 7d 66 75 6e 63 74 69 6f 6e 20 75 72 28 65 2c 74 29 7b 69 66 28 74 79 70 65 6f 66 20 74 21 3d 22 66 75 6e 63 74 69 6f 6e 22 26 26 74 21 3d 3d 6e 75 6c 6c 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 53 75 70 65 72 20 65 78 70 72 65 73 73 69 6f 6e 20 6d 75 73 74 20 65 69 74 68 65 72 20 62 65 20 6e 75 6c 6c 20 6f 72 20 61 20 66 75 6e 63 74 69 6f 6e 22 29 3b 65 2e 70 72 6f 74 6f 74 79 70 65 3d 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 28 74 26 26 74 2e 70 72 6f 74 6f 74 79 70 65 2c 7b 63 6f 6e 73 74 72 75 63 74 6f 72 3a 7b 76 61 6c 75 65 3a 65 2c 77 72 69 74 Data Ascii: .setPrototypeOf\|\|function(o,c){return o.__proto__=c,o},ee(e,t)}function ur(e,t){if(typeof t!="function"&&t!==null)throw new TypeError("Super expression must either be null or a function");e.prototype=Object.create(t&&t.prototype,{constructor:{value:e,writ
2025-04-02 11:55:42 UTC	1369	IN	Data Raw: 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 7d 7d 29 2c 65 65 28 63 2c 6f 29 7d 2c 47 65 28 65 29 7d 66 75 6e 63 74 69 6f 6e 20 73 72 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 74 26 26 28 46 28 74 29 3d 3d 3d 22 6f 62 6a 65 63 74 22 7c 7c 74 79 70 65 6f 66 20 74 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 29 3f 74 3a 7a 65 28 65 29 7d 66 75 6e 63 74 69 6f 6e 20 64 72 28 65 29 7b 76 61 72 20 74 3d 42 65 28 29 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6f 3d 6c 65 28 65 29 2c 63 3b 69 66 28 74 29 7b 76 61 72 20 6c 3d 6c 65 28 74 68 69 73 29 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3b 63 3d 52 65 66 6c 65 63 74 2e 63 6f 6e 73 74 72 75 63 74 28 6f 2c 61 72 67 75 6d 65 6e 74 73 2c 6c 29 7d 65 6c 73 65 20 63 3d 6f 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 Data Ascii: nfigurable:!0}}),ee(c,o)},Ge(e)}function sr(e,t){return t&&(F(t)==="object"\|\|typeof t=="function")?t:ze(e)}function dr(e){var t=Be();return function(){var o=le(e),c;if(t){var l=le(this).constructor;c=Reflect.construct(o,arguments,l)}else c=o.apply(this,ar
2025-04-02 11:55:42 UTC	1369	IN	Data Raw: 74 69 6f 6e 28 65 2c 74 2c 61 29 7b 76 61 72 20 6f 3d 54 74 28 74 2e 70 61 72 61 6d 73 2c 21 31 29 2c 63 3d 22 68 2f 22 2e 63 6f 6e 63 61 74 28 22 62 22 2c 22 2f 22 29 2c 6c 2c 76 2c 68 3d 22 22 2e 63 6f 6e 63 61 74 28 6f 2c 22 2f 63 64 6e 2d 63 67 69 2f 63 68 61 6c 6c 65 6e 67 65 2d 70 6c 61 74 66 6f 72 6d 2f 22 29 2e 63 6f 6e 63 61 74 28 63 2c 22 66 65 65 64 62 61 63 6b 2d 72 65 70 6f 72 74 73 2f 22 29 2e 63 6f 6e 63 61 74 28 58 65 28 65 29 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 74 2e 64 69 73 70 6c 61 79 4c 61 6e 67 75 61 67 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 28 76 3d 74 2e 70 61 72 61 6d 73 2e 74 68 65 6d 65 29 21 3d 3d 6e 75 6c 6c 26 26 76 21 3d 3d 76 6f 69 64 20 30 3f 76 3a 74 2e 74 68 65 6d 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 61 29 3b Data Ascii: tion(e,t,a){var o=Tt(t.params,!1),c="h/".concat("b","/"),l,v,h="".concat(o,"/cdn-cgi/challenge-platform/").concat(c,"feedback-reports/").concat(Xe(e),"/").concat(t.displayLanguage,"/").concat((v=t.params.theme)!==null&&v!==void 0?v:t.theme,"/").concat(a);

Timestamp	Bytes transferred	Direction	Data
2025-04-02 11:55:41 UTC	563	OUT	GET /1/api.js HTTP/1.1 Host: js.hcaptcha.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://meheff.wpym.xyz/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-02 11:55:41 UTC	507	IN	HTTP/1.1 200 OK Date: Wed, 02 Apr 2025 11:55:41 GMT Content-Type: application/javascript Content-Length: 208515 Connection: close CF-Ray: 92a0237fea127b0e-EWR CF-Cache-Status: HIT Access-Control-Allow-Origin: * Cache-Control: max-age=300 ETag: W/"75b123d9961d4d99f9b87a14745309a2" Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin alt-svc: h3=":443"; ma=86400 Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff Server: cloudflare
2025-04-02 11:55:41 UTC	862	IN	Data Raw: 2f 2a 20 7b 20 22 76 65 72 73 69 6f 6e 22 3a 20 22 31 22 2c 20 22 68 61 73 68 22 3a 20 22 4d 45 55 43 49 43 51 56 47 54 56 52 43 76 66 47 54 56 6d 51 41 66 66 78 55 74 74 4c 58 4a 6f 72 57 78 67 43 53 44 71 50 34 50 4d 2f 79 79 46 7a 41 69 45 41 6d 56 72 30 65 6d 77 57 73 6d 4c 42 38 4d 67 48 4c 69 68 4b 75 6f 41 76 4e 4e 56 6b 70 56 59 64 74 75 38 71 71 32 2f 4e 51 56 6b 3d 22 20 7d 20 2a 2f 0a 2f 2a 20 68 74 74 70 73 3a 2f 2f 68 63 61 70 74 63 68 61 2e 63 6f 6d 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 65 28 65 29 7b 76 61 72 20 74 3d 74 68 69 73 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3b 72 65 74 75 72 6e 20 74 68 69 73 2e 74 68 65 6e 28 28 66 75 6e 63 74 69 6f Data Ascii: /* { "version": "1", "hash": "MEUCICQVGTVRCvfGTVmQAffxUttLXJorWxgCSDqP4PM/yyFzAiEAmVr0emwWsmLB8MgHLihKuoAvNNVkpVYdtu8qq2/NQVk=" } // https://hcaptcha.com/license */!function(){"use strict";function e(e){var t=this.constructor;return this.then((functio
2025-04-02 11:55:41 UTC	1369	IN	Data Raw: 29 29 7d 72 5b 65 5d 3d 7b 73 74 61 74 75 73 3a 22 66 75 6c 66 69 6c 6c 65 64 22 2c 76 61 6c 75 65 3a 6e 7d 2c 30 3d 3d 2d 2d 69 26 26 74 28 72 29 7d 66 6f 72 28 76 61 72 20 61 3d 30 3b 61 3c 72 2e 6c 65 6e 67 74 68 3b 61 2b 2b 29 6f 28 61 2c 72 5b 61 5d 29 7d 29 29 7d 76 61 72 20 6e 3d 73 65 74 54 69 6d 65 6f 75 74 2c 72 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 73 65 74 49 6d 6d 65 64 69 61 74 65 3f 73 65 74 49 6d 6d 65 64 69 61 74 65 3a 6e 75 6c 6c 3b 66 75 6e 63 74 69 6f 6e 20 69 28 65 29 7b 72 65 74 75 72 6e 20 42 6f 6f 6c 65 61 6e 28 65 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 65 2e 6c 65 6e 67 74 68 29 7d 66 75 6e 63 74 69 6f 6e 20 6f 28 29 7b 7d 66 75 6e 63 74 69 6f 6e 20 61 28 65 29 7b 69 66 28 21 28 Data Ascii: ))}r[e]={status:"fulfilled",value:n},0==--i&&t(r)}for(var a=0;a<r.length;a++)o(a,r[a])}))}var n=setTimeout,r="undefined"!=typeof setImmediate?setImmediate:null;function i(e){return Boolean(e&&"undefined"!=typeof e.length)}function o(){}function a(e){if(!(
2025-04-02 11:55:41 UTC	1369	IN	Data Raw: 65 66 65 72 72 65 64 73 3d 6e 75 6c 6c 7d 66 75 6e 63 74 69 6f 6e 20 68 28 65 2c 74 2c 6e 29 7b 74 68 69 73 2e 6f 6e 46 75 6c 66 69 6c 6c 65 64 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 65 3f 65 3a 6e 75 6c 6c 2c 74 68 69 73 2e 6f 6e 52 65 6a 65 63 74 65 64 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 74 3f 74 3a 6e 75 6c 6c 2c 74 68 69 73 2e 70 72 6f 6d 69 73 65 3d 6e 7d 66 75 6e 63 74 69 6f 6e 20 64 28 65 2c 74 29 7b 76 61 72 20 6e 3d 21 31 3b 74 72 79 7b 65 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 6e 7c 7c 28 6e 3d 21 30 2c 63 28 74 2c 65 29 29 7d 29 2c 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 6e 7c 7c 28 6e 3d 21 30 2c 6c 28 74 2c 65 29 29 7d 29 29 7d 63 61 74 63 68 28 72 29 7b 69 66 28 6e 29 72 65 74 75 72 6e 3b 6e 3d Data Ascii: eferreds=null}function h(e,t,n){this.onFulfilled="function"==typeof e?e:null,this.onRejected="function"==typeof t?t:null,this.promise=n}function d(e,t){var n=!1;try{e((function(e){n\|\|(n=!0,c(t,e))}),(function(e){n\|\|(n=!0,l(t,e))}))}catch(r){if(n)return;n=
2025-04-02 11:55:41 UTC	1369	IN	Data Raw: 72 6e 28 22 50 6f 73 73 69 62 6c 65 20 55 6e 68 61 6e 64 6c 65 64 20 50 72 6f 6d 69 73 65 20 52 65 6a 65 63 74 69 6f 6e 3a 22 2c 65 29 7d 3b 76 61 72 20 70 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 73 65 6c 66 29 72 65 74 75 72 6e 20 73 65 6c 66 3b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 29 72 65 74 75 72 6e 20 77 69 6e 64 6f 77 3b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 29 72 65 74 75 72 6e 20 67 6c 6f 62 61 6c 3b 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 75 6e 61 62 6c 65 20 74 6f 20 6c 6f 63 61 74 65 20 67 6c 6f 62 61 6c 20 6f 62 6a 65 63 74 22 29 7d 28 29 3b 66 75 6e 63 74 69 6f 6e 20 66 Data Ascii: rn("Possible Unhandled Promise Rejection:",e)};var p=function(){if("undefined"!=typeof self)return self;if("undefined"!=typeof window)return window;if("undefined"!=typeof global)return global;throw new Error("unable to locate global object")}();function f
2025-04-02 11:55:41 UTC	1369	IN	Data Raw: 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 6c 61 62 65 6c 73 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 45 5b 74 5d 3d 65 7d 29 29 7d 29 29 7d 29 29 3b 76 61 72 20 56 2c 6b 3d 7b 22 55 54 46 2d 38 22 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 55 28 65 29 7d 7d 2c 78 3d 7b 22 55 54 46 2d 38 22 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 43 28 65 29 7d 7d 2c 53 3d 22 75 74 66 2d 38 22 3b 66 75 6e 63 74 69 6f 6e 20 54 28 65 2c 74 29 7b 69 66 28 21 28 74 68 69 73 20 69 6e 73 74 61 6e 63 65 6f 66 20 54 29 29 74 68 72 6f 77 20 54 79 70 65 45 72 72 6f 72 28 22 43 61 6c 6c 65 64 20 61 73 20 61 20 66 75 6e 63 74 69 6f 6e 2e 20 44 69 64 20 79 6f 75 20 66 6f 72 67 65 74 20 27 6e 65 77 27 3f 22 Data Ascii: nction(e){e.labels.forEach((function(t){E[t]=e}))}))}));var V,k={"UTF-8":function(e){return new U(e)}},x={"UTF-8":function(e){return new C(e)}},S="utf-8";function T(e,t){if(!(this instanceof T))throw TypeError("Called as a function. Did you forget 'new'?"
2025-04-02 11:55:41 UTC	1369	IN	Data Raw: 20 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 7c 7c 28 74 68 69 73 2e 65 6e 63 6f 64 69 6e 67 3d 6e 2e 5f 65 6e 63 6f 64 69 6e 67 2e 6e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 2c 6e 7d 66 75 6e 63 74 69 6f 6e 20 43 28 65 29 7b 76 61 72 20 74 3d 65 2e 66 61 74 61 6c 2c 6e 3d 30 2c 72 3d 30 2c 69 3d 30 2c 6f 3d 31 32 38 2c 61 3d 31 39 31 3b 74 68 69 73 2e 68 61 6e 64 6c 65 72 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 73 29 7b 69 66 28 73 3d 3d 3d 67 26 26 30 21 3d 3d 69 29 72 65 74 75 72 6e 20 69 3d 30 2c 62 28 74 29 3b 69 66 28 73 3d 3d 3d 67 29 72 65 74 75 72 6e 20 77 3b 69 66 28 30 3d 3d 3d 69 29 7b 69 66 28 66 28 73 2c 30 2c 31 32 37 29 29 72 65 74 75 72 6e 20 73 3b 69 66 28 66 28 73 2c 31 39 34 2c 32 32 33 29 29 69 3d 31 2c Data Ascii: Object.defineProperty\|\|(this.encoding=n._encoding.name.toLowerCase()),n}function C(e){var t=e.fatal,n=0,r=0,i=0,o=128,a=191;this.handler=function(e,s){if(s===g&&0!==i)return i=0,b(t);if(s===g)return w;if(0===i){if(f(s,0,127))return s;if(f(s,194,223))i=1,
2025-04-02 11:55:41 UTC	1369	IN	Data Raw: 73 2e 5f 64 6f 5f 6e 6f 74 5f 66 6c 75 73 68 7c 7c 28 74 68 69 73 2e 5f 64 65 63 6f 64 65 72 3d 78 5b 74 68 69 73 2e 5f 65 6e 63 6f 64 69 6e 67 2e 6e 61 6d 65 5d 28 7b 66 61 74 61 6c 3a 22 66 61 74 61 6c 22 3d 3d 3d 74 68 69 73 2e 5f 65 72 72 6f 72 5f 6d 6f 64 65 7d 29 2c 74 68 69 73 2e 5f 42 4f 4d 73 65 65 6e 3d 21 31 29 2c 74 68 69 73 2e 5f 64 6f 5f 6e 6f 74 5f 66 6c 75 73 68 3d 42 6f 6f 6c 65 61 6e 28 74 2e 73 74 72 65 61 6d 29 3b 66 6f 72 28 76 61 72 20 72 2c 69 3d 6e 65 77 20 76 28 6e 29 2c 6f 3d 5b 5d 3b 3b 29 7b 76 61 72 20 61 3d 69 2e 72 65 61 64 28 29 3b 69 66 28 61 3d 3d 3d 67 29 62 72 65 61 6b 3b 69 66 28 28 72 3d 74 68 69 73 2e 5f 64 65 63 6f 64 65 72 2e 68 61 6e 64 6c 65 72 28 69 2c 61 29 29 3d 3d 3d 77 29 62 72 65 61 6b 3b 6e 75 6c 6c 21 3d Data Ascii: s._do_not_flush\|\|(this._decoder=x[this._encoding.name]({fatal:"fatal"===this._error_mode}),this._BOMseen=!1),this._do_not_flush=Boolean(t.stream);for(var r,i=new v(n),o=[];;){var a=i.read();if(a===g)break;if((r=this._decoder.handler(i,a))===w)break;null!=
2025-04-02 11:55:41 UTC	1369	IN	Data Raw: 37 33 34 33 29 69 2e 70 75 73 68 28 36 35 35 33 33 29 3b 65 6c 73 65 20 69 66 28 6f 3e 3d 35 35 32 39 36 26 26 6f 3c 3d 35 36 33 31 39 29 69 66 28 72 3d 3d 3d 6e 2d 31 29 69 2e 70 75 73 68 28 36 35 35 33 33 29 3b 65 6c 73 65 7b 76 61 72 20 61 3d 74 2e 63 68 61 72 43 6f 64 65 41 74 28 72 2b 31 29 3b 69 66 28 61 3e 3d 35 36 33 32 30 26 26 61 3c 3d 35 37 33 34 33 29 7b 76 61 72 20 73 3d 31 30 32 33 26 6f 2c 63 3d 31 30 32 33 26 61 3b 69 2e 70 75 73 68 28 36 35 35 33 36 2b 28 73 3c 3c 31 30 29 2b 63 29 2c 72 2b 3d 31 7d 65 6c 73 65 20 69 2e 70 75 73 68 28 36 35 35 33 33 29 7d 72 2b 3d 31 7d 72 65 74 75 72 6e 20 69 7d 28 65 29 29 2c 69 3d 5b 5d 3b 3b 29 7b 76 61 72 20 6f 3d 72 2e 72 65 61 64 28 29 3b 69 66 28 6f 3d 3d 3d 67 29 62 72 65 61 6b 3b 69 66 28 28 6e Data Ascii: 7343)i.push(65533);else if(o>=55296&&o<=56319)if(r===n-1)i.push(65533);else{var a=t.charCodeAt(r+1);if(a>=56320&&a<=57343){var s=1023&o,c=1023&a;i.push(65536+(s<<10)+c),r+=1}else i.push(65533)}r+=1}return i}(e)),i=[];;){var o=r.read();if(o===g)break;if((n
2025-04-02 11:55:41 UTC	1369	IN	Data Raw: 72 65 61 6b 3b 63 61 73 65 22 75 6e 77 72 61 70 4b 65 79 22 3a 6c 3d 62 5b 34 5d 2c 75 3d 62 5b 35 5d 2c 68 3d 62 5b 36 5d 2c 62 5b 32 5d 3d 63 2e 5f 6b 65 79 7d 69 66 28 22 67 65 6e 65 72 61 74 65 4b 65 79 22 3d 3d 3d 65 26 26 22 48 4d 41 43 22 3d 3d 3d 6c 2e 6e 61 6d 65 26 26 6c 2e 68 61 73 68 29 72 65 74 75 72 6e 20 6c 2e 6c 65 6e 67 74 68 3d 6c 2e 6c 65 6e 67 74 68 7c 7c 7b 22 53 48 41 2d 31 22 3a 35 31 32 2c 22 53 48 41 2d 32 35 36 22 3a 35 31 32 2c 22 53 48 41 2d 33 38 34 22 3a 31 30 32 34 2c 22 53 48 41 2d 35 31 32 22 3a 31 30 32 34 7d 5b 6c 2e 68 61 73 68 2e 6e 61 6d 65 5d 2c 6e 2e 69 6d 70 6f 72 74 4b 65 79 28 22 72 61 77 22 2c 74 2e 67 65 74 52 61 6e 64 6f 6d 56 61 6c 75 65 73 28 6e 65 77 20 55 69 6e 74 38 41 72 72 61 79 28 6c 2e 6c 65 6e 67 74 Data Ascii: reak;case"unwrapKey":l=b[4],u=b[5],h=b[6],b[2]=c._key}if("generateKey"===e&&"HMAC"===l.name&&l.hash)return l.length=l.length\|\|{"SHA-1":512,"SHA-256":512,"SHA-384":1024,"SHA-512":1024}[l.hash.name],n.importKey("raw",t.getRandomValues(new Uint8Array(l.lengt
2025-04-02 11:55:41 UTC	1369	IN	Data Raw: 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 22 48 4d 41 43 22 3d 3d 3d 6c 2e 6e 61 6d 65 26 26 28 6c 2e 6c 65 6e 67 74 68 7c 7c 28 6c 2e 6c 65 6e 67 74 68 3d 38 2a 65 2e 61 6c 67 6f 72 69 74 68 6d 2e 6c 65 6e 67 74 68 29 29 2c 30 3d 3d 6c 2e 6e 61 6d 65 2e 73 65 61 72 63 68 28 22 52 53 41 22 29 26 26 28 6c 2e 6d 6f 64 75 6c 75 73 4c 65 6e 67 74 68 7c 7c 28 6c 2e 6d 6f 64 75 6c 75 73 4c 65 6e 67 74 68 3d 28 65 2e 70 75 62 6c 69 63 4b 65 79 7c 7c 65 29 2e 61 6c 67 6f 72 69 74 68 6d 2e 6d 6f 64 75 6c 75 73 4c 65 6e 67 74 68 29 2c 6c 2e 70 75 62 6c 69 63 45 78 70 6f 6e 65 6e 74 7c 7c 28 6c 2e 70 75 62 6c 69 63 45 78 70 6f 6e 65 6e 74 3d 28 65 2e 70 75 62 6c 69 63 4b 65 79 7c 7c 65 29 2e 61 6c 67 6f 72 69 74 68 6d 2e 70 75 62 6c 69 63 45 78 70 6f 6e 65 6e 74 Data Ascii: ction(e){return"HMAC"===l.name&&(l.length\|\|(l.length=8*e.algorithm.length)),0==l.name.search("RSA")&&(l.modulusLength\|\|(l.modulusLength=(e.publicKey\|\|e).algorithm.modulusLength),l.publicExponent\|\|(l.publicExponent=(e.publicKey\|\|e).algorithm.publicExponent

Timestamp	Bytes transferred	Direction	Data
2025-04-02 11:55:42 UTC	840	OUT	GET /cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/r4wwa/0x4AAAAAAA2ptl9BKcGk2BB2/auto/fbE/new/normal/auto/ HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Sec-Fetch-Storage-Access: active Referer: https://meheff.wpym.xyz/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-02 11:55:43 UTC	1297	IN	HTTP/1.1 200 OK Date: Wed, 02 Apr 2025 11:55:42 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 28103 Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=() content-security-policy: default-src 'none'; script-src 'nonce-t61KcMCnTXJW4vMv' 'unsafe-eval'; script-src-attr 'none'; worker-src blob:; style-src 'unsafe-inline'; img-src 'self'; connect-src 'self'; frame-src 'self' blob:; child-src 'self' blob:; form-action 'none'; base-uri 'self'; sandbox allow-same-origin allow-scripts allow-popups allow-forms cross-origin-embedder-policy: require-corp cross-origin-opener-policy: same-origin cross-origin-resource-policy: cross-origin origin-agent-cluster: ?1 accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
2025-04-02 11:55:43 UTC	411	IN	Data Raw: 63 72 69 74 69 63 61 6c 2d 63 68 3a 20 53 65 63 2d 43 48 2d 55 41 2d 42 69 74 6e 65 73 73 2c 20 53 65 63 2d 43 48 2d 55 41 2d 41 72 63 68 2c 20 53 65 63 2d 43 48 2d 55 41 2d 4d 6f 62 69 6c 65 2c 20 53 65 63 2d 43 48 2d 55 41 2d 4d 6f 64 65 6c 2c 20 53 65 63 2d 43 48 2d 55 41 2d 50 6c 61 74 66 6f 72 6d 2d 56 65 72 73 69 6f 6e 2c 20 53 65 63 2d 43 48 2d 55 41 2d 46 75 6c 6c 2d 56 65 72 73 69 6f 6e 2d 4c 69 73 74 2c 20 53 65 63 2d 43 48 2d 55 41 2d 50 6c 61 74 66 6f 72 6d 2c 20 53 65 63 2d 43 48 2d 55 41 2c 20 55 41 2d 42 69 74 6e 65 73 73 2c 20 55 41 2d 41 72 63 68 2c 20 55 41 2d 46 75 6c 6c 2d 56 65 72 73 69 6f 6e 2c 20 55 41 2d 4d 6f 62 69 6c 65 2c 20 55 41 2d 4d 6f 64 65 6c 2c 20 55 41 2d 50 6c 61 74 66 6f 72 6d 2d 56 65 72 73 69 6f 6e 2c 20 55 41 2d 50 Data Ascii: critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-P
2025-04-02 11:55:43 UTC	1030	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 22 20 63 6f 6e 74 65 6e 74 3d 22 64 65 66 61 75 6c 74 2d 73 72 63 20 26 23 78 32 37 3b 6e 6f 6e 65 26 23 78 32 37 3b 3b 20 73 63 72 69 70 74 2d 73 72 63 20 26 23 78 32 37 3b 6e 6f 6e 63 65 2d 74 36 31 4b 63 4d 43 6e 54 58 4a 57 34 76 4d 76 26 23 78 32 37 3b 20 26 23 78 32 37 3b 75 6e 73 61 66 65 2d Data Ascii: <!DOCTYPE HTML><html lang="en-US"><head> <meta http-equiv="x-ua-compatible" content="IE=Edge,chrome=1"> <meta http-equiv="content-security-policy" content="default-src 'none'; script-src 'nonce-t61KcMCnTXJW4vMv' 'unsafe-
2025-04-02 11:55:43 UTC	1369	IN	Data Raw: 6d 65 73 20 66 69 6c 6c 66 61 69 6c 7b 74 6f 7b 62 6f 78 2d 73 68 61 64 6f 77 3a 69 6e 73 65 74 20 30 20 33 30 70 78 20 30 20 30 20 23 64 65 31 33 30 33 7d 7d 40 6b 65 79 66 72 61 6d 65 73 20 66 69 6c 6c 66 61 69 6c 2d 6f 66 66 6c 61 62 65 6c 7b 74 6f 7b 62 6f 78 2d 73 68 61 64 6f 77 3a 69 6e 73 65 74 20 30 20 30 20 30 20 33 30 70 78 20 23 32 33 32 33 32 33 7d 7d 40 6b 65 79 66 72 61 6d 65 73 20 66 69 6c 6c 66 61 69 6c 2d 6f 66 66 6c 61 62 65 6c 2d 64 61 72 6b 7b 74 6f 7b 62 6f 78 2d 73 68 61 64 6f 77 3a 69 6e 73 65 74 20 30 20 30 20 30 20 33 30 70 78 20 23 66 66 66 7d 7d 40 6b 65 79 66 72 61 6d 65 73 20 73 63 61 6c 65 2d 75 70 2d 63 65 6e 74 65 72 7b 30 25 7b 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 2e 30 31 29 7d 74 6f 7b 74 72 61 6e 73 66 6f 72 Data Ascii: mes fillfail{to{box-shadow:inset 0 30px 0 0 #de1303}}@keyframes fillfail-offlabel{to{box-shadow:inset 0 0 0 30px #232323}}@keyframes fillfail-offlabel-dark{to{box-shadow:inset 0 0 0 30px #fff}}@keyframes scale-up-center{0%{transform:scale(.01)}to{transfor
2025-04-02 11:55:43 UTC	1369	IN	Data Raw: 61 6c 69 67 6e 3a 72 69 67 68 74 7d 23 6f 76 65 72 72 75 6e 2d 69 2c 23 73 70 69 6e 6e 65 72 2d 69 7b 61 6e 69 6d 61 74 69 6f 6e 3a 73 70 69 6e 20 35 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 68 65 69 67 68 74 3a 33 30 70 78 3b 77 69 64 74 68 3a 33 30 70 78 7d 23 66 61 69 6c 2d 69 7b 61 6e 69 6d 61 74 69 6f 6e 3a 73 63 61 6c 65 2d 75 70 2d 63 65 6e 74 65 72 20 2e 36 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 2e 35 35 2c 2e 30 38 35 2c 2e 36 38 2c 2e 35 33 29 20 62 6f 74 68 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 69 6e 73 65 74 20 30 20 30 20 30 20 23 64 65 31 33 30 33 7d 23 66 61 69 6c 2d 69 2c 23 73 75 63 63 65 73 73 2d 69 7b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 35 30 25 3b 64 69 73 70 6c 61 79 3a 66 Data Ascii: align:right}#overrun-i,#spinner-i{animation:spin 5s linear infinite;display:flex;height:30px;width:30px}#fail-i{animation:scale-up-center .6s cubic-bezier(.55,.085,.68,.53) both;box-shadow:inset 0 0 0 #de1303}#fail-i,#success-i{border-radius:50%;display:f
2025-04-02 11:55:43 UTC	1369	IN	Data Raw: 68 61 64 6f 77 3a 69 6e 73 65 74 20 30 20 30 20 30 20 23 30 61 61 39 33 37 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 2e 73 75 63 63 65 73 73 2d 63 69 72 63 6c 65 7b 73 74 72 6f 6b 65 3a 23 30 61 61 39 33 37 3b 66 69 6c 6c 3a 23 30 61 61 39 33 37 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 2e 65 78 70 69 72 65 64 2d 63 69 72 63 6c 65 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 2e 74 69 6d 65 6f 75 74 2d 63 69 72 63 6c 65 7b 73 74 72 6f 6b 65 2d 64 61 73 68 61 72 72 61 79 3a 31 36 36 3b 73 74 72 6f 6b 65 2d 64 61 73 68 6f 66 66 73 65 74 3a 31 36 36 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 32 3b 73 74 72 6f 6b 65 2d 6d 69 74 65 72 6c 69 6d 69 74 3a 31 30 3b 73 74 72 6f 6b 65 3a 23 39 39 39 3b 66 69 6c 6c 3a 23 39 39 39 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 65 78 70 Data Ascii: hadow:inset 0 0 0 #0aa937}.theme-dark .success-circle{stroke:#0aa937;fill:#0aa937}.theme-dark .expired-circle,.theme-dark .timeout-circle{stroke-dasharray:166;stroke-dashoffset:166;stroke-width:2;stroke-miterlimit:10;stroke:#999;fill:#999}.theme-dark #exp
2025-04-02 11:55:43 UTC	1369	IN	Data Raw: 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 68 31 7b 63 6f 6c 6f 72 3a 23 66 66 66 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 69 74 6c 65 7b 63 6f 6c 6f 72 3a 23 66 66 61 32 39 39 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 69 74 6c 65 20 61 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 69 74 6c 65 20 61 3a 6c 69 6e 6b 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 69 74 6c 65 20 61 3a 76 69 73 69 74 65 64 7b 63 6f 6c 6f 72 3a 23 62 62 62 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 69 74 6c 65 20 61 3a 61 63 74 69 76 65 2c Data Ascii: }.theme-dark h1{color:#fff}.theme-dark #challenge-error-title{color:#ffa299}.theme-dark #challenge-error-title a,.theme-dark #challenge-error-title a:link,.theme-dark #challenge-error-title a:visited{color:#bbb}.theme-dark #challenge-error-title a:active,
2025-04-02 11:55:43 UTC	1369	IN	Data Raw: 65 73 68 2d 6c 69 6e 6b 3a 61 63 74 69 76 65 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 74 69 6d 65 6f 75 74 2d 72 65 66 72 65 73 68 2d 6c 69 6e 6b 3a 66 6f 63 75 73 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 74 69 6d 65 6f 75 74 2d 72 65 66 72 65 73 68 2d 6c 69 6e 6b 3a 68 6f 76 65 72 7b 63 6f 6c 6f 72 3a 23 39 34 39 34 39 34 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 2e 6f 76 65 72 6c 61 79 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 66 66 61 32 39 39 3b 63 6f 6c 6f 72 3a 23 66 66 61 32 39 39 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 2e 65 72 72 6f 72 2d 6d 65 73 73 61 67 65 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 2e 65 72 72 6f 72 2d 6d 65 73 73 61 67 65 20 61 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 2e 65 72 72 6f 72 2d 6d 65 73 73 61 67 65 20 61 3a 6c 69 6e 6b Data Ascii: esh-link:active,.theme-dark #timeout-refresh-link:focus,.theme-dark #timeout-refresh-link:hover{color:#949494}.theme-dark .overlay{border-color:#ffa299;color:#ffa299}.theme-dark .error-message,.theme-dark .error-message a,.theme-dark .error-message a:link
2025-04-02 11:55:43 UTC	1369	IN	Data Raw: 3a 63 68 65 63 6b 65 64 7e 2e 63 62 2d 69 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 35 70 78 3b 6f 70 61 63 69 74 79 3a 31 3b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 30 64 65 67 29 20 73 63 61 6c 65 28 31 29 7d 2e 63 62 2d 6c 62 20 69 6e 70 75 74 3a 63 68 65 63 6b 65 64 7e 2e 63 62 2d 69 3a 61 66 74 65 72 7b 62 6f 72 64 65 72 3a 73 6f 6c 69 64 20 23 63 34 34 64 30 65 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 30 3b 62 6f 72 64 65 72 2d 77 69 64 74 68 3a 30 20 34 70 78 20 34 70 78 20 30 3b 68 65 69 67 68 74 3a 31 32 70 78 3b 6c 65 66 74 3a 35 70 78 3b 74 6f 70 3a 30 3b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 34 35 64 65 67 29 20 73 63 61 6c 65 28 31 29 3b 77 69 64 Data Ascii: :checked~.cb-i{background-color:#fff;border-radius:5px;opacity:1;transform:rotate(0deg) scale(1)}.cb-lb input:checked~.cb-i:after{border:solid #c44d0e;border-radius:0;border-width:0 4px 4px 0;height:12px;left:5px;top:0;transform:rotate(45deg) scale(1);wid
2025-04-02 11:55:43 UTC	1369	IN	Data Raw: 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 20 73 70 61 63 65 2d 65 76 65 6e 6c 79 3b 76 69 73 69 62 69 6c 69 74 79 3a 76 69 73 69 62 6c 65 7d 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 23 65 78 70 69 72 65 64 2d 74 65 78 74 2c 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 23 6f 76 65 72 72 75 6e 2d 74 65 78 74 2c 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 23 74 69 6d 65 6f 75 74 2d 74 65 78 74 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 23 65 78 70 69 72 65 64 2d 72 65 66 72 65 73 68 2d 6c 69 6e 6b 2c 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 23 74 69 6d 65 6f 75 74 2d 72 65 66 72 65 73 68 2d 6c 69 6e 6b 2c 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 2e 65 72 72 6f 72 2d 6d 65 73 73 61 67 65 20 61 7b 6d 61 72 67 69 6e 3a 30 Data Ascii: ontent:center space-evenly;visibility:visible}.size-compact #expired-text,.size-compact #overrun-text,.size-compact #timeout-text{display:block}.size-compact #expired-refresh-link,.size-compact #timeout-refresh-link,.size-compact .error-message a{margin:0
2025-04-02 11:55:43 UTC	1369	IN	Data Raw: 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 30 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 31 36 70 78 7d 23 74 65 72 6d 73 7b 63 6f 6c 6f 72 3a 23 32 33 32 33 32 33 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 66 6c 65 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 38 70 78 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 66 6c 65 78 2d 65 6e 64 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 30 70 78 7d 23 74 65 72 6d 73 20 2e 6c 69 6e 6b 2d 73 70 61 63 65 72 7b 6d 61 72 67 69 6e 3a 30 20 2e 32 72 65 6d 7d 23 74 65 72 6d 73 20 61 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 7d 23 74 65 72 6d 73 20 61 2c 23 74 65 72 6d 73 20 61 3a 6c 69 6e 6b 2c 23 74 65 72 6d 73 20 61 3a 76 69 73 69 74 65 64 7b 63 6f Data Ascii: {margin-left:0;margin-right:16px}#terms{color:#232323;display:inline-flex;font-size:8px;font-style:normal;justify-content:flex-end;line-height:10px}#terms .link-spacer{margin:0 .2rem}#terms a{display:inline-block}#terms a,#terms a:link,#terms a:visited{co

Timestamp	Bytes transferred	Direction	Data
2025-04-02 11:55:43 UTC	784	OUT	GET /cdn-cgi/challenge-platform/h/b/cmg/1 HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/r4wwa/0x4AAAAAAA2ptl9BKcGk2BB2/auto/fbE/new/normal/auto/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-02 11:55:43 UTC	240	IN	HTTP/1.1 200 OK Date: Wed, 02 Apr 2025 11:55:43 GMT Content-Type: image/png Content-Length: 61 Connection: close cache-control: max-age=2629800, public Server: cloudflare CF-RAY: 92a0238e7d6260e6-EWR alt-svc: h3=":443"; ma=86400
2025-04-02 11:55:43 UTC	61	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 02 00 00 00 02 08 02 00 00 00 fd d4 9a 73 00 00 00 04 49 44 41 54 00 00 00 01 9d 24 d7 91 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRsIDAT$IENDB`

Timestamp	Bytes transferred	Direction	Data
2025-04-02 11:55:44 UTC	772	OUT	GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=92a02388286d2361&lang=auto HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/r4wwa/0x4AAAAAAA2ptl9BKcGk2BB2/auto/fbE/new/normal/auto/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-02 11:55:44 UTC	331	IN	HTTP/1.1 200 OK Date: Wed, 02 Apr 2025 11:55:44 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 116777 Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Server: cloudflare CF-RAY: 92a023926c9b4343-EWR alt-svc: h3=":443"; ma=86400
2025-04-02 11:55:44 UTC	1038	IN	Data Raw: 77 69 6e 64 6f 77 2e 5f 63 66 5f 63 68 6c 5f 6f 70 74 2e 43 75 55 53 37 3d 7b 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 63 68 61 6c 6c 65 6e 67 65 2e 74 65 72 6d 73 22 3a 22 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 25 32 46 77 65 62 73 69 74 65 2d 74 65 72 6d 73 25 32 46 22 2c 22 63 68 61 6c 6c 65 6e 67 65 2e 70 72 69 76 61 63 79 5f 6c 69 6e 6b 22 3a 22 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 25 32 46 70 72 69 76 61 63 79 70 6f 6c 69 63 79 25 32 46 22 2c 22 63 68 61 6c 6c 65 6e 67 65 2e 73 75 70 70 6f 72 74 65 64 5f 62 72 6f 77 73 65 72 73 22 3a 22 68 74 74 70 73 25 33 41 25 32 46 25 32 46 64 65 76 65 6c 6f 70 65 72 73 2e 63 6c 6f 75 64 66 6c 61 72 Data Ascii: window._cf_chl_opt.CuUS7={"metadata":{"challenge.terms":"https%3A%2F%2Fwww.cloudflare.com%2Fwebsite-terms%2F","challenge.privacy_link":"https%3A%2F%2Fwww.cloudflare.com%2Fprivacypolicy%2F","challenge.supported_browsers":"https%3A%2F%2Fdevelopers.cloudflar
2025-04-02 11:55:44 UTC	1369	IN	Data Raw: 3a 22 49 6e 76 61 6c 69 64 25 32 30 64 6f 6d 61 69 6e 2e 25 32 30 43 6f 6e 74 61 63 74 25 32 30 74 68 65 25 32 30 53 69 74 65 25 32 30 41 64 6d 69 6e 69 73 74 72 61 74 6f 72 25 32 30 69 66 25 32 30 74 68 69 73 25 32 30 70 72 6f 62 6c 65 6d 25 32 30 70 65 72 73 69 73 74 73 2e 22 2c 22 74 69 6d 65 5f 63 68 65 63 6b 5f 63 61 63 68 65 64 5f 77 61 72 6e 69 6e 67 22 3a 22 59 6f 75 72 25 32 30 64 65 76 69 63 65 25 32 30 63 6c 6f 63 6b 25 32 30 69 73 25 32 30 73 65 74 25 32 30 74 6f 25 32 30 61 25 32 30 77 72 6f 6e 67 25 32 30 74 69 6d 65 25 32 30 6f 72 25 32 30 74 68 69 73 25 32 30 63 68 61 6c 6c 65 6e 67 65 25 32 30 70 61 67 65 25 32 30 77 61 73 25 32 30 61 63 63 69 64 65 6e 74 61 6c 6c 79 25 32 30 63 61 63 68 65 64 25 32 30 62 79 25 32 30 61 6e 25 32 30 69 6e Data Ascii: :"Invalid%20domain.%20Contact%20the%20Site%20Administrator%20if%20this%20problem%20persists.","time_check_cached_warning":"Your%20device%20clock%20is%20set%20to%20a%20wrong%20time%20or%20this%20challenge%20page%20was%20accidentally%20cached%20by%20an%20in
2025-04-02 11:55:44 UTC	1369	IN	Data Raw: 6c 65 5f 6f 76 65 72 72 75 6e 5f 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 53 74 75 63 6b 25 32 30 68 65 72 65 25 33 46 22 7d 2c 22 70 6f 6c 79 66 69 6c 6c 73 22 3a 7b 22 66 65 65 64 62 61 63 6b 5f 72 65 70 6f 72 74 5f 61 75 78 5f 73 75 62 74 69 74 6c 65 22 3a 66 61 6c 73 65 2c 22 66 65 65 64 62 61 63 6b 5f 72 65 70 6f 72 74 5f 6f 75 74 70 75 74 5f 73 75 62 74 69 74 6c 65 22 3a 66 61 6c 73 65 2c 22 66 65 65 64 62 61 63 6b 5f 72 65 70 6f 72 74 5f 67 75 69 64 65 6c 69 6e 65 22 3a 66 61 6c 73 65 7d 2c 22 72 74 6c 22 3a 66 61 6c 73 65 2c 22 6c 61 6e 67 22 3a 22 65 6e 2d 75 73 22 7d 3b 7e 66 75 6e 63 74 69 6f 6e 28 67 4a 2c 65 4d 2c 65 4e 2c 65 51 2c 65 52 2c 66 68 2c 66 6b 2c 66 6e 2c 66 70 2c 66 71 2c 66 72 2c 66 44 2c 66 50 2c 66 56 2c 66 57 2c 66 58 2c 67 Data Ascii: le_overrun_description":"Stuck%20here%3F"},"polyfills":{"feedback_report_aux_subtitle":false,"feedback_report_output_subtitle":false,"feedback_report_guideline":false},"rtl":false,"lang":"en-us"};~function(gJ,eM,eN,eQ,eR,fh,fk,fn,fp,fq,fr,fD,fP,fV,fW,fX,g
2025-04-02 11:55:45 UTC	1369	IN	Data Raw: 37 37 29 5d 3d 68 67 28 31 38 30 31 29 2c 65 3d 64 2c 66 3d 31 2c 67 3d 31 65 33 2a 65 4d 5b 68 67 28 31 35 30 34 29 5d 5b 68 67 28 35 35 39 29 5d 28 32 2e 32 3c 3c 66 2c 33 32 29 2c 65 4d 5b 68 67 28 31 32 35 30 29 5d 28 66 75 6e 63 74 69 6f 6e 28 68 68 29 7b 68 68 3d 68 67 2c 65 4d 5b 65 5b 68 68 28 31 37 31 34 29 5d 5d 26 26 28 65 4d 5b 68 68 28 31 30 32 31 29 5d 5b 68 68 28 31 34 36 38 29 5d 28 29 2c 65 4d 5b 68 68 28 31 30 32 31 29 5d 5b 68 68 28 39 35 38 29 5d 28 29 2c 65 4d 5b 68 68 28 31 34 31 32 29 5d 3d 21 21 5b 5d 2c 65 4d 5b 68 68 28 31 33 36 33 29 5d 5b 68 68 28 35 34 31 29 5d 28 7b 27 73 6f 75 72 63 65 27 3a 65 5b 68 68 28 31 34 34 36 29 5d 2c 27 77 69 64 67 65 74 49 64 27 3a 65 4d 5b 68 68 28 31 31 31 35 29 5d 5b 68 68 28 31 37 39 31 29 5d Data Ascii: 77)]=hg(1801),e=d,f=1,g=1e3*eM[hg(1504)][hg(559)](2.2<<f,32),eM[hg(1250)](function(hh){hh=hg,eM[e[hh(1714)]]&&(eM[hh(1021)][hh(1468)](),eM[hh(1021)][hh(958)](),eM[hh(1412)]=!![],eM[hh(1363)][hh(541)]({'source':e[hh(1446)],'widgetId':eM[hh(1115)][hh(1791)]
2025-04-02 11:55:45 UTC	1369	IN	Data Raw: 5b 68 69 28 37 31 34 29 5d 3d 65 4d 5b 68 69 28 31 31 31 35 29 5d 5b 68 69 28 37 31 34 29 5d 2c 42 5b 68 69 28 37 31 30 29 5d 3d 65 4d 5b 68 69 28 31 31 31 35 29 5d 5b 68 69 28 37 31 30 29 5d 2c 42 5b 68 69 28 37 36 30 29 5d 3d 65 4d 5b 68 69 28 31 31 31 35 29 5d 5b 68 69 28 31 35 33 38 29 5d 2c 42 29 3b 63 6f 6e 74 69 6e 75 65 3b 63 61 73 65 27 39 27 3a 6e 5b 68 69 28 36 31 30 29 5d 3d 35 65 33 3b 63 6f 6e 74 69 6e 75 65 3b 63 61 73 65 27 31 30 27 3a 44 3d 69 7c 7c 68 69 28 31 38 37 30 29 3b 63 6f 6e 74 69 6e 75 65 7d 62 72 65 61 6b 7d 7d 63 61 74 63 68 28 45 29 7b 7d 7d 2c 65 4d 5b 67 4a 28 35 37 37 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 68 6a 2c 66 2c 67 2c 68 2c 69 2c 6a 2c 6b 2c 6c 2c 6d 2c 6e 2c 6f 29 7b 28 68 6a 3d 67 4a 2c 66 3d 7b 7d 2c 66 5b Data Ascii: [hi(714)]=eM[hi(1115)][hi(714)],B[hi(710)]=eM[hi(1115)][hi(710)],B[hi(760)]=eM[hi(1115)][hi(1538)],B);continue;case'9':n[hi(610)]=5e3;continue;case'10':D=i\|\|hi(1870);continue}break}}catch(E){}},eM[gJ(577)]=function(e,hj,f,g,h,i,j,k,l,m,n,o){(hj=gJ,f={},f[
2025-04-02 11:55:45 UTC	1369	IN	Data Raw: 4a 2c 64 3d 7b 27 50 4a 65 78 7a 27 3a 69 37 28 31 37 36 35 29 2c 27 77 46 66 71 72 27 3a 66 75 6e 63 74 69 6f 6e 28 66 2c 67 29 7b 72 65 74 75 72 6e 20 66 3d 3d 3d 67 7d 2c 27 79 4f 6f 55 47 27 3a 66 75 6e 63 74 69 6f 6e 28 66 2c 67 29 7b 72 65 74 75 72 6e 20 66 28 67 29 7d 7d 2c 65 3d 63 5b 69 37 28 37 33 32 29 5d 2c 65 26 26 65 5b 69 37 28 36 34 34 29 5d 3d 3d 3d 64 5b 69 37 28 37 39 38 29 5d 26 26 65 5b 69 37 28 31 36 37 35 29 5d 3d 3d 3d 69 37 28 39 37 36 29 29 7b 69 66 28 69 37 28 37 33 39 29 21 3d 3d 69 37 28 37 33 39 29 29 72 65 74 75 72 6e 20 74 68 69 73 5b 69 37 28 31 37 33 34 29 5d 3d 21 21 5b 5d 2c 74 68 69 73 5b 69 37 28 31 37 33 34 29 5d 3b 65 6c 73 65 20 66 56 3d 73 65 74 49 6e 74 65 72 76 61 6c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 67 6c 28 Data Ascii: J,d={'PJexz':i7(1765),'wFfqr':function(f,g){return f===g},'yOoUG':function(f,g){return f(g)}},e=c[i7(732)],e&&e[i7(644)]===d[i7(798)]&&e[i7(1675)]===i7(976)){if(i7(739)!==i7(739))return this[i7(1734)]=!![],this[i7(1734)];else fV=setInterval(function(){gl(
2025-04-02 11:55:45 UTC	1369	IN	Data Raw: 2c 27 43 69 4f 67 64 27 3a 66 75 6e 63 74 69 6f 6e 28 47 2c 48 29 7b 72 65 74 75 72 6e 20 48 3d 3d 3d 47 7d 2c 27 6f 74 72 4b 61 27 3a 66 75 6e 63 74 69 6f 6e 28 47 2c 48 29 7b 72 65 74 75 72 6e 20 47 2b 48 7d 2c 27 69 6c 78 53 6c 27 3a 66 75 6e 63 74 69 6f 6e 28 47 2c 48 29 7b 72 65 74 75 72 6e 20 47 2b 48 7d 2c 27 43 4f 4e 61 6a 27 3a 66 75 6e 63 74 69 6f 6e 28 47 2c 48 29 7b 72 65 74 75 72 6e 20 47 3c 48 7d 2c 27 48 6d 76 4f 42 27 3a 66 75 6e 63 74 69 6f 6e 28 47 2c 48 29 7b 72 65 74 75 72 6e 20 48 3d 3d 3d 47 7d 2c 27 4f 50 68 79 53 27 3a 66 75 6e 63 74 69 6f 6e 28 47 2c 48 29 7b 72 65 74 75 72 6e 20 47 3d 3d 3d 48 7d 2c 27 77 79 56 6b 57 27 3a 66 75 6e 63 74 69 6f 6e 28 47 2c 48 2c 49 29 7b 72 65 74 75 72 6e 20 47 28 48 2c 49 29 7d 7d 2c 6e 75 6c 6c Data Ascii: ,'CiOgd':function(G,H){return H===G},'otrKa':function(G,H){return G+H},'ilxSl':function(G,H){return G+H},'CONaj':function(G,H){return G<H},'HmvOB':function(G,H){return H===G},'OPhyS':function(G,H){return G===H},'wyVkW':function(G,H,I){return G(H,I)}},null
2025-04-02 11:55:45 UTC	1369	IN	Data Raw: 6f 5d 29 7c 7c 68 5b 6e 5d 5b 69 52 28 31 30 31 38 29 5d 28 6b 5b 69 52 28 35 39 36 29 5d 28 27 6f 2e 27 2c 69 5b 6c 5b 6d 5d 5d 5b 6f 5d 29 29 29 2c 6f 2b 2b 29 3b 7d 65 6c 73 65 20 68 5b 6e 5d 3d 69 5b 6c 5b 6d 5d 5d 5b 69 52 28 31 37 32 38 29 5d 28 66 75 6e 63 74 69 6f 6e 28 73 2c 69 53 2c 78 2c 42 2c 43 29 7b 69 66 28 69 53 3d 69 52 2c 69 53 28 35 37 33 29 3d 3d 3d 6b 5b 69 53 28 31 30 31 36 29 5d 29 78 3d 7b 7d 2c 78 5b 69 53 28 39 31 37 29 5d 3d 69 53 28 31 30 37 36 29 2c 42 3d 6a 5b 69 53 28 35 32 30 29 5d 5b 69 53 28 31 31 34 38 29 5d 28 6e 65 77 20 78 5b 28 69 53 28 38 33 34 29 29 5d 28 5b 69 53 28 31 37 32 31 29 5d 2c 78 29 29 2c 43 3d 6e 65 77 20 69 5b 28 69 53 28 31 38 33 31 29 29 5d 28 42 29 2c 6a 5b 69 53 28 35 32 30 29 5d 5b 69 53 28 31 33 Data Ascii: o])\|\|h[n][iR(1018)](k[iR(596)]('o.',i[l[m]][o]))),o++);}else h[n]=i[l[m]][iR(1728)](function(s,iS,x,B,C){if(iS=iR,iS(573)===k[iS(1016)])x={},x[iS(917)]=iS(1076),B=j[iS(520)][iS(1148)](new x[(iS(834))]([iS(1721)],x)),C=new i[(iS(1831))](B),j[iS(520)][iS(13
2025-04-02 11:55:45 UTC	1369	IN	Data Raw: 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 69 3d 3d 68 7d 2c 27 6d 70 43 74 6d 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 2d 69 7d 2c 27 41 7a 4c 76 73 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 2d 69 7d 2c 27 71 4d 6d 59 62 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 26 69 7d 2c 27 47 62 4b 58 74 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 3d 3d 69 7d 2c 27 45 58 43 51 56 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 3c 69 7d 2c 27 6f 41 42 55 76 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 3c 3c 69 7d 2c 27 77 54 4d 71 74 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 Data Ascii: tion(h,i){return i==h},'mpCtm':function(h,i){return h-i},'AzLvs':function(h,i){return h-i},'qMmYb':function(h,i){return h&i},'GbKXt':function(h,i){return h==i},'EXCQV':function(h,i){return h<i},'oABUv':function(h,i){return h<<i},'wTMqt':function(h,i){retu
2025-04-02 11:55:45 UTC	1369	IN	Data Raw: 5d 28 30 29 29 7b 66 6f 72 28 73 3d 30 3b 73 3c 46 3b 48 3c 3c 3d 31 2c 64 5b 6a 46 28 31 37 31 38 29 5d 28 49 2c 64 5b 6a 46 28 31 30 35 39 29 5d 28 6a 2c 31 29 29 3f 28 49 3d 30 2c 47 5b 6a 46 28 31 30 31 38 29 5d 28 64 5b 6a 46 28 38 33 39 29 5d 28 6f 2c 48 29 29 2c 48 3d 30 29 3a 49 2b 2b 2c 73 2b 2b 29 3b 66 6f 72 28 4d 3d 43 5b 6a 46 28 31 38 38 31 29 5d 28 30 29 2c 73 3d 30 3b 38 3e 73 3b 48 3d 64 5b 6a 46 28 31 35 30 33 29 5d 28 64 5b 6a 46 28 31 30 34 39 29 5d 28 48 2c 31 29 2c 31 26 4d 29 2c 49 3d 3d 6a 2d 31 3f 28 49 3d 30 2c 47 5b 6a 46 28 31 30 31 38 29 5d 28 6f 28 48 29 29 2c 48 3d 30 29 3a 49 2b 2b 2c 4d 3e 3e 3d 31 2c 73 2b 2b 29 3b 7d 65 6c 73 65 7b 66 6f 72 28 4d 3d 31 2c 73 3d 30 3b 73 3c 46 3b 48 3d 4d 7c 48 3c 3c 31 2c 64 5b 6a 46 28 Data Ascii: ](0)){for(s=0;s<F;H<<=1,d[jF(1718)](I,d[jF(1059)](j,1))?(I=0,G[jF(1018)](d[jF(839)](o,H)),H=0):I++,s++);for(M=C[jF(1881)](0),s=0;8>s;H=d[jF(1503)](d[jF(1049)](H,1),1&M),I==j-1?(I=0,G[jF(1018)](o(H)),H=0):I++,M>>=1,s++);}else{for(M=1,s=0;s<F;H=M\|H<<1,d[jF(

Timestamp	Bytes transferred	Direction	Data
2025-04-02 11:55:44 UTC	797	OUT	GET /captcha/v1/c1e11bfffe54019b36ca486d59d75ea65128f510/static/hcaptcha.html HTTP/1.1 Host: newassets.hcaptcha.com Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Sec-Fetch-Storage-Access: active Referer: https://meheff.wpym.xyz/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-02 11:55:44 UTC	572	IN	HTTP/1.1 200 OK Date: Wed, 02 Apr 2025 11:55:44 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Cache-Control: max-age=3600 vary: accept-encoding vary: Origin alt-svc: h3=":443"; ma=86400 CF-Cache-Status: HIT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Content-Security-Policy: report-uri https://sentry.hcaptcha.com/api/6/security/?sentry_key=30910f52569b4c17b1081ead2dae43b4&sentry_environment=prod&sentry_release=csp1; Server: cloudflare CF-RAY: 92a023958b43a67e-EWR
2025-04-02 11:55:44 UTC	797	IN	Data Raw: 37 64 35 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 61 74 61 2d 69 64 3d 22 68 63 61 70 74 63 68 61 2d 66 72 61 6d 65 2d 63 31 65 31 31 62 66 66 66 65 35 34 30 31 39 62 33 36 63 61 34 38 36 64 35 39 64 37 35 65 61 36 35 31 32 38 66 35 31 30 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 68 43 61 70 74 63 68 61 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d Data Ascii: 7d58<!DOCTYPE html><html lang="en" data-id="hcaptcha-frame-c1e11bfffe54019b36ca486d59d75ea65128f510"><head> <title>hCaptcha</title> <meta charset="utf-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <meta http-equiv="Content-
2025-04-02 11:55:44 UTC	1369	IN	Data Raw: 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 20 32 30 70 78 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 7d 62 75 74 74 6f 6e 3a 66 6f 63 75 73 2c 69 6e 70 75 74 3a 66 6f 63 75 73 2c 73 65 6c 65 63 74 3a 66 6f 63 75 73 2c 74 65 78 74 61 72 65 61 3a 66 6f 63 75 73 7b 6f 75 74 6c 69 6e 65 3a 30 7d 3a 66 6f 63 75 73 7b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 6f 75 74 6c 69 6e 65 3a 30 7d 74 65 78 74 61 72 65 61 7b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 6f 76 65 72 66 6c 6f 77 3a 61 75 74 6f 3b 6f 75 74 6c 69 6e 65 3a 30 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 68 61 64 6f 77 3a 6e 6f 6e 65 3b 2d 6d 6f 7a 2d 62 6f 78 2d 73 68 61 64 6f 77 3a 6e 6f 6e 65 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 6e 6f 6e 65 3b 72 65 73 69 7a 65 3a 6e 6f 6e 65 7d 2e 6e 6f 2d 73 65 6c 65 63 74 69 Data Ascii: n:0;padding:15px 20px;border:none}button:focus,input:focus,select:focus,textarea:focus{outline:0}:focus{border:none;outline:0}textarea{border:none;overflow:auto;outline:0;-webkit-box-shadow:none;-moz-box-shadow:none;box-shadow:none;resize:none}.no-selecti
2025-04-02 11:55:44 UTC	1369	IN	Data Raw: 69 66 28 21 74 7c 7c 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 74 79 70 65 6f 66 20 74 2e 6c 65 6e 67 74 68 29 72 65 74 75 72 6e 20 69 28 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 74 79 70 65 6f 66 20 74 2b 22 20 22 2b 74 2b 22 20 69 73 20 6e 6f 74 20 69 74 65 72 61 62 6c 65 28 63 61 6e 6e 6f 74 20 72 65 61 64 20 70 72 6f 70 65 72 74 79 20 53 79 6d 62 6f 6c 28 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 29 29 22 29 29 3b 76 61 72 20 6e 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 73 6c 69 63 65 2e 63 61 6c 6c 28 74 29 3b 69 66 28 30 3d 3d 3d 6e 2e 6c 65 6e 67 74 68 29 72 65 74 75 72 6e 20 65 28 5b 5d 29 3b 76 61 72 20 6f 3d 6e 2e 6c 65 6e 67 74 68 3b 66 75 6e 63 74 69 6f 6e 20 72 28 74 2c 69 29 7b 69 66 28 69 26 26 28 22 6f 62 6a 65 63 74 22 3d 3d 74 Data Ascii: if(!t\|\|"undefined"==typeof t.length)return i(new TypeError(typeof t+" "+t+" is not iterable(cannot read property Symbol(Symbol.iterator))"));var n=Array.prototype.slice.call(t);if(0===n.length)return e([]);var o=n.length;function r(t,i){if(i&&("object"==t
2025-04-02 11:55:44 UTC	1369	IN	Data Raw: 20 69 6e 73 74 61 6e 63 65 6f 66 20 73 29 72 65 74 75 72 6e 20 74 2e 5f 73 74 61 74 65 3d 33 2c 74 2e 5f 76 61 6c 75 65 3d 65 2c 76 6f 69 64 20 68 28 74 29 3b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 69 29 72 65 74 75 72 6e 20 76 6f 69 64 20 66 28 28 6e 3d 69 2c 6f 3d 65 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 6e 2e 61 70 70 6c 79 28 6f 2c 61 72 67 75 6d 65 6e 74 73 29 7d 29 2c 74 29 7d 74 2e 5f 73 74 61 74 65 3d 31 2c 74 2e 5f 76 61 6c 75 65 3d 65 2c 68 28 74 29 7d 63 61 74 63 68 28 72 29 7b 63 28 74 2c 72 29 7d 76 61 72 20 6e 2c 6f 7d 66 75 6e 63 74 69 6f 6e 20 63 28 74 2c 65 29 7b 74 2e 5f 73 74 61 74 65 3d 32 2c 74 2e 5f 76 61 6c 75 65 3d 65 2c 68 28 74 29 7d 66 75 6e 63 74 69 6f 6e 20 68 28 74 29 7b 32 3d 3d 3d 74 2e 5f 73 74 61 Data Ascii: instanceof s)return t._state=3,t._value=e,void h(t);if("function"==typeof i)return void f((n=i,o=e,function(){n.apply(o,arguments)}),t)}t._state=1,t._value=e,h(t)}catch(r){c(t,r)}var n,o}function c(t,e){t._state=2,t._value=e,h(t)}function h(t){2===t._sta
2025-04-02 11:55:44 UTC	1369	IN	Data Raw: 3d 3d 3d 73 3f 74 3a 6e 65 77 20 73 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 28 74 29 7d 29 29 7d 2c 73 2e 72 65 6a 65 63 74 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 73 28 28 66 75 6e 63 74 69 6f 6e 28 65 2c 69 29 7b 69 28 74 29 7d 29 29 7d 2c 73 2e 72 61 63 65 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 73 28 28 66 75 6e 63 74 69 6f 6e 28 65 2c 69 29 7b 69 66 28 21 6f 28 74 29 29 72 65 74 75 72 6e 20 69 28 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 50 72 6f 6d 69 73 65 2e 72 61 63 65 20 61 63 63 65 70 74 73 20 61 6e 20 61 72 72 61 79 22 29 29 3b 66 6f 72 28 76 61 72 20 6e 3d 30 2c 72 3d 74 2e 6c 65 6e 67 74 68 3b 6e 3c 72 3b 6e 2b 2b 29 73 2e 72 65 73 6f 6c 76 65 28 74 5b 6e 5d 29 2e 74 68 Data Ascii: ===s?t:new s((function(e){e(t)}))},s.reject=function(t){return new s((function(e,i){i(t)}))},s.race=function(t){return new s((function(e,i){if(!o(t))return i(new TypeError("Promise.race accepts an array"));for(var n=0,r=t.length;n<r;n++)s.resolve(t[n]).th
2025-04-02 11:55:44 UTC	1369	IN	Data Raw: 72 72 61 79 28 74 29 29 66 6f 72 28 76 61 72 20 65 3d 74 3b 65 2e 6c 65 6e 67 74 68 3b 29 74 68 69 73 2e 74 6f 6b 65 6e 73 2e 75 6e 73 68 69 66 74 28 65 2e 73 68 69 66 74 28 29 29 3b 65 6c 73 65 20 74 68 69 73 2e 74 6f 6b 65 6e 73 2e 75 6e 73 68 69 66 74 28 74 29 7d 7d 3b 76 61 72 20 76 3d 2d 31 3b 66 75 6e 63 74 69 6f 6e 20 77 28 74 2c 65 29 7b 69 66 28 74 29 74 68 72 6f 77 20 54 79 70 65 45 72 72 6f 72 28 22 44 65 63 6f 64 65 72 20 65 72 72 6f 72 22 29 3b 72 65 74 75 72 6e 20 65 7c 7c 36 35 35 33 33 7d 66 75 6e 63 74 69 6f 6e 20 78 28 74 29 7b 72 65 74 75 72 6e 20 74 3d 53 74 72 69 6e 67 28 74 29 2e 74 72 69 6d 28 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2c 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 Data Ascii: rray(t))for(var e=t;e.length;)this.tokens.unshift(e.shift());else this.tokens.unshift(t)}};var v=-1;function w(t,e){if(t)throw TypeError("Decoder error");return e\|\|65533}function x(t){return t=String(t).trim().toLowerCase(),Object.prototype.hasOwnProperty
2025-04-02 11:55:44 UTC	1369	IN	Data Raw: 22 29 3b 65 3d 79 28 65 29 2c 74 68 69 73 2e 5f 65 6e 63 6f 64 69 6e 67 3d 6e 75 6c 6c 2c 74 68 69 73 2e 5f 65 6e 63 6f 64 65 72 3d 6e 75 6c 6c 2c 74 68 69 73 2e 5f 64 6f 5f 6e 6f 74 5f 66 6c 75 73 68 3d 21 31 2c 74 68 69 73 2e 5f 66 61 74 61 6c 3d 65 2e 66 61 74 61 6c 3f 22 66 61 74 61 6c 22 3a 22 72 65 70 6c 61 63 65 6d 65 6e 74 22 3b 76 61 72 20 69 3d 74 68 69 73 3b 69 66 28 65 2e 4e 4f 4e 53 54 41 4e 44 41 52 44 5f 61 6c 6c 6f 77 4c 65 67 61 63 79 45 6e 63 6f 64 69 6e 67 29 7b 76 61 72 20 6e 3d 78 28 74 3d 74 21 3d 3d 75 6e 64 65 66 69 6e 65 64 3f 53 74 72 69 6e 67 28 74 29 3a 56 29 3b 69 66 28 6e 75 6c 6c 3d 3d 3d 6e 7c 7c 22 72 65 70 6c 61 63 65 6d 65 6e 74 22 3d 3d 3d 6e 2e 6e 61 6d 65 29 74 68 72 6f 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 55 6e Data Ascii: ");e=y(e),this._encoding=null,this._encoder=null,this._do_not_flush=!1,this._fatal=e.fatal?"fatal":"replacement";var i=this;if(e.NONSTANDARD_allowLegacyEncoding){var n=x(t=t!==undefined?String(t):V);if(null===n\|\|"replacement"===n.name)throw RangeError("Un
2025-04-02 11:55:44 UTC	1369	IN	Data Raw: 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 53 2e 70 72 6f 74 6f 74 79 70 65 2c 22 66 61 74 61 6c 22 2c 7b 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 22 66 61 74 61 6c 22 3d 3d 3d 74 68 69 73 2e 5f 65 72 72 6f 72 5f 6d 6f 64 65 7d 7d 29 2c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 53 2e 70 72 6f 74 6f 74 79 70 65 2c 22 69 67 6e 6f 72 65 42 4f 4d 22 2c 7b 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 5f 69 67 6e 6f 72 65 42 4f 4d 7d 7d 29 29 2c 53 2e 70 72 6f 74 6f 74 79 70 65 2e 64 65 63 6f 64 65 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 69 3b 69 3d 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 74 26 26 74 20 69 6e 73 74 61 6e 63 65 6f 66 20 41 72 72 Data Ascii: t.defineProperty(S.prototype,"fatal",{get:function(){return"fatal"===this._error_mode}}),Object.defineProperty(S.prototype,"ignoreBOM",{get:function(){return this._ignoreBOM}})),S.prototype.decode=function(t,e){var i;i="object"==typeof t&&t instanceof Arr
2025-04-02 11:55:44 UTC	1369	IN	Data Raw: 70 72 6f 74 6f 74 79 70 65 2c 22 65 6e 63 6f 64 69 6e 67 22 2c 7b 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 5f 65 6e 63 6f 64 69 6e 67 2e 6e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 7d 7d 29 2c 41 2e 70 72 6f 74 6f 74 79 70 65 2e 65 6e 63 6f 64 65 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 74 3d 74 3d 3d 3d 75 6e 64 65 66 69 6e 65 64 3f 22 22 3a 53 74 72 69 6e 67 28 74 29 2c 65 3d 79 28 65 29 2c 74 68 69 73 2e 5f 64 6f 5f 6e 6f 74 5f 66 6c 75 73 68 7c 7c 28 74 68 69 73 2e 5f 65 6e 63 6f 64 65 72 3d 45 5b 74 68 69 73 2e 5f 65 6e 63 6f 64 69 6e 67 2e 6e 61 6d 65 5d 28 7b 66 61 74 61 6c 3a 22 66 61 74 61 6c 22 3d 3d 3d 74 68 69 73 2e 5f 66 61 74 61 6c 7d 29 29 2c 74 68 69 73 2e 5f 64 6f 5f 6e 6f 74 5f 66 6c Data Ascii: prototype,"encoding",{get:function(){return this._encoding.name.toLowerCase()}}),A.prototype.encode=function(t,e){t=t===undefined?"":String(t),e=y(e),this._do_not_flush\|\|(this._encoder=E[this._encoding.name]({fatal:"fatal"===this._fatal})),this._do_not_fl
2025-04-02 11:55:44 UTC	1369	IN	Data Raw: 49 68 76 63 4e 41 51 45 42 3a 22 31 2e 32 2e 38 34 30 2e 31 31 33 35 34 39 2e 31 2e 31 2e 31 22 7d 2c 63 3d 7b 22 31 2e 32 2e 38 34 30 2e 31 31 33 35 34 39 2e 31 2e 31 2e 31 22 3a 22 4b 6f 5a 49 68 76 63 4e 41 51 45 42 22 7d 3b 69 66 28 5b 22 67 65 6e 65 72 61 74 65 4b 65 79 22 2c 22 69 6d 70 6f 72 74 4b 65 79 22 2c 22 75 6e 77 72 61 70 4b 65 79 22 5d 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 6e 3d 69 5b 74 5d 3b 69 5b 74 5d 3d 66 75 6e 63 74 69 6f 6e 28 6f 2c 72 2c 6c 29 7b 76 61 72 20 63 2c 68 2c 75 2c 64 2c 77 3d 5b 5d 2e 73 6c 69 63 65 2e 63 61 6c 6c 28 61 72 67 75 6d 65 6e 74 73 29 3b 73 77 69 74 63 68 28 74 29 7b 63 61 73 65 22 67 65 6e 65 72 61 74 65 4b 65 79 22 3a 63 3d 79 28 6f 29 2c 68 3d 72 2c 75 3d 6c 3b 62 Data Ascii: IhvcNAQEB:"1.2.840.113549.1.1.1"},c={"1.2.840.113549.1.1.1":"KoZIhvcNAQEB"};if(["generateKey","importKey","unwrapKey"].forEach((function(t){var n=i[t];i[t]=function(o,r,l){var c,h,u,d,w=[].slice.call(arguments);switch(t){case"generateKey":c=y(o),h=r,u=l;b

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://docs.google.com/presentation/d/e/2PACX-1vQ7Dkd_WRbgSfshqD4oLNlUmDxTYPUSUb2tLr0qsjIwZ7fwYeWMIoyLCuLiIiL3T8QaBj2et0IIqqkz/pub?start=false&loop=false&delayms=3000

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 114

Chrome Cache Entry: 115

Chrome Cache Entry: 116

Chrome Cache Entry: 117

Chrome Cache Entry: 118

Chrome Cache Entry: 119

Chrome Cache Entry: 120

Chrome Cache Entry: 121

Chrome Cache Entry: 122

Chrome Cache Entry: 123

Chrome Cache Entry: 124

Chrome Cache Entry: 125

Chrome Cache Entry: 126

Windows Analysis Report
https://docs.google.com/presentation/d/e/2PACX-1vQ7Dkd_WRbgSfshqD4oLNlUmDxTYPUSUb2tLr0qsjIwZ7fwYeWMIoyLCuLiIiL3T8QaBj2et0IIqqkz/pub?start=false&loop=false&delayms=3000

Timestamp	Bytes transferred	Direction	Data
2025-04-02 11:55:46 UTC	685	OUT	GET /favicon.ico HTTP/1.1 Host: meheff.wpym.xyz Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://meheff.wpym.xyz/nrColMBN Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: 68ba-73d6=5964312a968d5bf8b4112aeb76102c73361c8cf272c7006e3e95435506daf19e
2025-04-02 11:55:47 UTC	20	IN	HTTP/1.1 302 Found
2025-04-02 11:55:47 UTC	55	IN	Data Raw: 41 6c 74 2d 53 76 63 3a 20 68 33 3d 22 3a 34 34 33 22 3b 6d 61 3d 32 35 39 32 30 30 30 2c 68 33 2d 32 39 3d 22 3a 34 34 33 22 3b 6d 61 3d 32 35 39 32 30 30 30 0d 0a Data Ascii: Alt-Svc: h3=":443";ma=2592000,h3-29=":443";ma=2592000
2025-04-02 11:55:47 UTC	19	IN	Data Raw: 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a Data Ascii: Connection: close
2025-04-02 11:55:47 UTC	40	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a Data Ascii: Content-Type: text/html; charset=utf-8
2025-04-02 11:55:47 UTC	37	IN	Data Raw: 44 61 74 65 3a 20 57 65 64 2c 20 30 32 20 41 70 72 20 32 30 32 35 20 31 31 3a 35 35 3a 34 36 20 47 4d 54 0d 0a Data Ascii: Date: Wed, 02 Apr 2025 11:55:46 GMT
2025-04-02 11:55:47 UTC	51	IN	Data Raw: 4c 6f 63 61 74 69 6f 6e 3a 20 68 74 74 70 73 3a 2f 2f 6d 65 68 65 66 66 2e 77 70 79 6d 2e 78 79 7a 2f 6f 77 61 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 0d 0a Data Ascii: Location: https://meheff.wpym.xyz/owa/favicon.ico
2025-04-02 11:55:47 UTC	33	IN	Data Raw: 4d 73 2d 43 76 3a 20 77 31 77 63 4f 58 75 49 77 6b 52 78 38 2f 31 50 4f 43 31 49 63 77 2e 30 0d 0a Data Ascii: Ms-Cv: w1wcOXuIwkRx8/1POC1Icw.0
2025-04-02 11:55:47 UTC	50	IN	Data Raw: 52 65 71 75 65 73 74 2d 49 64 3a 20 33 39 31 63 35 63 63 33 2d 38 38 37 62 2d 34 34 63 32 2d 37 31 66 33 2d 66 64 34 66 33 38 32 64 34 38 37 33 0d 0a Data Ascii: Request-Id: 391c5cc3-887b-44c2-71f3-fd4f382d4873
2025-04-02 11:55:47 UTC	28	IN	Data Raw: 53 65 72 76 65 72 3a 20 4d 69 63 72 6f 73 6f 66 74 2d 49 49 53 2f 31 30 2e 30 0d 0a Data Ascii: Server: Microsoft-IIS/10.0
2025-04-02 11:55:47 UTC	28	IN	Data Raw: 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a Data Ascii: Transfer-Encoding: chunked
2025-04-02 11:55:47 UTC	18	IN	Data Raw: 58 2d 46 65 65 66 7a 69 6e 66 6f 3a 20 53 4a 43 0d 0a Data Ascii: X-Feefzinfo: SJC

Timestamp	Bytes transferred	Direction	Data
2025-04-02 11:55:48 UTC	799	OUT	POST /checksiteconfig?v=c1e11bfffe54019b36ca486d59d75ea65128f510&host=meheff.wpym.xyz&sitekey=234adb2f-52ba-4697-82fa-abecbb14b173&sc=1&swa=1&spst=1 HTTP/1.1 Host: api.hcaptcha.com Connection: keep-alive Content-Length: 0 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: application/json sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: text/plain sec-ch-ua-mobile: ?0 Origin: https://newassets.hcaptcha.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Referer: https://newassets.hcaptcha.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-02 11:55:48 UTC	587	IN	HTTP/1.1 200 OK Date: Wed, 02 Apr 2025 11:55:48 GMT Content-Type: application/json Content-Length: 776 Connection: close Access-Control-Allow-Origin: https://newassets.hcaptcha.com Vary: Origin, Accept-Encoding Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: Cache-Control, Content-Type, DNT, Referer, User-Agent Access-Control-Allow-Methods: GET, HEAD, POST, OPTIONS Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 92a023aa0ed84544-EWR alt-svc: h3=":443"; ma=86400
2025-04-02 11:55:48 UTC	776	IN	Data Raw: 7b 22 66 65 61 74 75 72 65 73 22 3a 7b 22 65 6e 63 5f 67 65 74 5f 72 65 71 22 3a 74 72 75 65 7d 2c 22 63 22 3a 7b 22 74 79 70 65 22 3a 22 68 73 77 22 2c 22 72 65 71 22 3a 22 65 79 4a 30 65 58 41 69 4f 69 4a 4b 56 31 51 69 4c 43 4a 68 62 47 63 69 4f 69 4a 49 55 7a 49 31 4e 69 4a 39 2e 65 79 4a 6d 49 6a 6f 77 4c 43 4a 7a 49 6a 6f 79 4c 43 4a 30 49 6a 6f 69 64 79 49 73 49 6d 51 69 4f 69 4a 50 65 56 4e 51 5a 46 6c 32 55 6e 52 4d 63 32 52 47 55 45 64 4b 64 56 70 48 65 55 78 78 56 30 6c 77 55 6c 46 5a 52 69 74 32 51 6b 46 46 4e 57 6b 31 53 6c 42 6b 54 79 39 53 61 57 59 76 53 54 42 58 5a 46 64 58 5a 7a 41 77 4e 47 35 79 4f 55 49 33 56 7a 42 34 63 44 6c 6e 52 6c 6c 30 5a 33 6f 32 4f 56 4a 49 62 45 39 4c 4e 56 64 50 5a 46 41 31 51 31 55 33 55 32 4e 75 51 7a 45 30 Data Ascii: {"features":{"enc_get_req":true},"c":{"type":"hsw","req":"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJmIjowLCJzIjoyLCJ0IjoidyIsImQiOiJPeVNQZFl2UnRMc2RGUEdKdVpHeUxxV0lwUlFZRit2QkFFNWk1SlBkTy9SaWYvSTBXZFdXZzAwNG5yOUI3VzB4cDlnRll0Z3o2OVJIbE9LNVdPZFA1Q1U3U2NuQzE0

Timestamp	Bytes transferred	Direction	Data
2025-04-02 11:55:48 UTC	715	OUT	GET /c/5fef759e34a955dd56ceddd805e6a87d3f7d854c8c695bf797d43331bebfee3f/hsw.js HTTP/1.1 Host: newassets.hcaptcha.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://newassets.hcaptcha.com/captcha/v1/c1e11bfffe54019b36ca486d59d75ea65128f510/static/hcaptcha.html Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-02 11:55:48 UTC	462	IN	HTTP/1.1 200 OK Date: Wed, 02 Apr 2025 11:55:48 GMT Content-Type: application/javascript Transfer-Encoding: chunked Connection: close Cache-Control: max-age=3024000 etag: W/"7bd876c8f9f3642a65f0c04e462ef689" vary: accept-encoding vary: Origin alt-svc: h3=":443"; ma=86400 CF-Cache-Status: HIT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 92a023ae3a148ce9-EWR
2025-04-02 11:55:48 UTC	907	IN	Data Raw: 37 64 63 36 0d 0a 76 61 72 20 68 73 77 3d 66 75 6e 63 74 69 6f 6e 20 4b 58 61 4b 59 6d 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 64 72 3d 66 75 6e 63 74 69 6f 6e 28 64 65 2c 63 47 2c 72 67 2c 74 5a 29 7b 72 65 74 75 72 6e 20 74 68 69 73 20 69 6e 73 74 61 6e 63 65 6f 66 20 64 72 3f 28 74 68 69 73 2e 72 65 6d 61 69 6e 64 65 72 3d 6e 75 6c 6c 2c 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 64 65 3f 44 77 2e 63 61 6c 6c 28 74 68 69 73 2c 64 65 2c 63 47 29 3a 76 6f 69 64 20 30 3d 3d 3d 63 47 3f 44 4a 2e 63 61 6c 6c 28 74 68 69 73 2c 64 65 29 3a 76 6f 69 64 20 42 77 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 29 3a 6e 65 77 20 64 72 28 64 65 2c 63 47 2c 72 67 2c 74 5a 29 7d 2c 44 4a 3d 66 75 6e 63 74 69 6f 6e 28 64 Data Ascii: 7dc6var hsw=function KXaKYm(){"use strict";var dr=function(de,cG,rg,tZ){return this instanceof dr?(this.remainder=null,"string"==typeof de?Dw.call(this,de,cG):void 0===cG?DJ.call(this,de):void Bw.apply(this,arguments)):new dr(de,cG,rg,tZ)},DJ=function(d
2025-04-02 11:55:48 UTC	1369	IN	Data Raw: 2e 75 62 5b 64 77 28 32 33 35 29 5d 7c 7c 28 56 4a 3d 6a 78 28 49 6e 74 33 32 41 72 72 61 79 2c 79 43 2e 75 62 5b 64 77 28 64 72 29 5d 29 29 2c 56 4a 7d 2c 70 5a 3d 66 75 6e 63 74 69 6f 6e 28 64 72 2c 44 4a 2c 64 65 29 7b 79 43 2e 4f 62 28 64 72 2c 44 4a 2c 44 76 28 64 65 29 29 7d 3b 76 61 72 20 76 4c 3d 66 75 6e 63 74 69 6f 6e 28 64 72 29 7b 66 6f 72 28 44 4a 3d 55 63 2c 64 65 3d 6e 65 77 20 41 72 72 61 79 28 64 72 5b 44 4a 28 33 35 33 29 5d 29 2c 63 47 3d 30 2c 72 67 3d 64 72 5b 44 4a 28 33 35 33 29 5d 2c 76 6f 69 64 20 30 3b 63 47 3c 72 67 3b 63 47 2b 2b 29 7b 76 61 72 20 44 4a 3b 76 61 72 20 64 65 3b 76 61 72 20 63 47 3b 76 61 72 20 72 67 3b 64 65 5b 63 47 5d 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 64 72 5b 63 47 5d 29 7d 72 65 Data Ascii: .ub[dw(235)]\|\|(VJ=jx(Int32Array,yC.ub[dw(dr)])),VJ},pZ=function(dr,DJ,de){yC.Ob(dr,DJ,Dv(de))};var vL=function(dr){for(DJ=Uc,de=new Array(dr[DJ(353)]),cG=0,rg=dr[DJ(353)],void 0;cG<rg;cG++){var DJ;var de;var cG;var rg;de[cG]=String.fromCharCode(dr[cG])}re
2025-04-02 11:55:48 UTC	1369	IN	Data Raw: 58 4c 42 77 76 55 44 65 6a 35 73 77 71 22 2c 22 41 67 66 5a 71 78 72 30 43 4d 4c 49 44 78 72 4c 22 2c 22 7a 32 76 30 71 32 39 55 44 67 76 34 44 61 22 2c 22 44 67 39 65 79 78 72 48 76 76 6a 6d 22 2c 22 7a 67 66 30 79 71 22 2c 22 42 33 6a 50 7a 32 4c 55 22 2c 22 43 67 58 31 7a 32 4c 55 43 57 22 2c 22 43 67 58 48 44 67 7a 56 43 4d 30 22 2c 22 44 78 6e 4c 43 4b 66 4e 7a 77 35 30 22 2c 22 42 67 66 55 7a 33 76 48 7a 32 75 22 2c 22 7a 32 76 30 72 77 35 30 43 4d 4c 4c 43 30 6a 35 76 68 4c 57 7a 71 22 2c 22 41 77 35 50 44 67 4c 48 44 67 39 59 76 68 4c 57 7a 71 22 2c 22 79 78 7a 48 41 77 58 78 41 77 72 30 41 61 22 2c 22 79 78 7a 48 41 77 58 69 7a 77 4c 4e 41 68 71 22 2c 22 44 32 4c 4b 44 67 47 22 2c 22 41 67 76 50 7a 32 48 30 22 2c 22 79 32 39 53 42 33 6a 65 7a 78 Data Ascii: XLBwvUDej5swq","AgfZqxr0CMLIDxrL","z2v0q29UDgv4Da","Dg9eyxrHvvjm","zgf0yq","B3jPz2LU","CgX1z2LUCW","CgXHDgzVCM0","DxnLCKfNzw50","BgfUz3vHz2u","z2v0rw50CMLLC0j5vhLWzq","Aw5PDgLHDg9YvhLWzq","yxzHAwXxAwr0Aa","yxzHAwXizwLNAhq","D2LKDgG","AgvPz2H0","y29SB3jezx
2025-04-02 11:55:48 UTC	1369	IN	Data Raw: 4a 29 7b 76 61 72 20 64 65 3b 76 61 72 20 63 47 3d 43 4b 3b 76 61 72 20 72 67 3d 64 72 5b 63 47 28 70 63 29 5d 28 44 4a 29 3b 69 66 28 72 67 29 7b 76 61 72 20 74 5a 3d 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 72 67 29 7c 7c 72 67 20 69 6e 73 74 61 6e 63 65 6f 66 20 49 6e 74 33 32 41 72 72 61 79 7c 7c 72 67 20 69 6e 73 74 61 6e 63 65 6f 66 20 46 6c 6f 61 74 33 32 41 72 72 61 79 3b 69 66 28 74 5a 3f 28 47 58 5b 63 47 28 37 34 32 29 5d 5b 63 47 28 38 36 39 29 5d 28 47 58 2c 72 67 29 2c 68 68 5b 63 47 28 44 6b 29 5d 28 64 4a 28 5b 5d 2c 72 67 2c 21 30 29 29 29 3a 28 63 47 28 35 37 39 29 3d 3d 74 79 70 65 6f 66 20 72 67 26 26 47 58 5b 63 47 28 37 34 32 29 5d 28 72 67 29 2c 68 68 5b 63 47 28 37 34 32 29 5d 28 72 67 29 29 2c 21 47 6c 29 72 65 74 75 72 6e 3b 76 Data Ascii: J){var de;var cG=CK;var rg=dr[cG(pc)](DJ);if(rg){var tZ=Array.isArray(rg)\|\|rg instanceof Int32Array\|\|rg instanceof Float32Array;if(tZ?(GX[cG(742)][cG(869)](GX,rg),hh[cG(Dk)](dJ([],rg,!0))):(cG(579)==typeof rg&&GX[cG(742)](rg),hh[cG(742)](rg)),!Gl)return;v
2025-04-02 11:55:49 UTC	1369	IN	Data Raw: 3d 3d 64 77 28 32 35 34 29 29 7b 76 61 72 20 44 24 3d 64 72 5b 64 77 28 32 35 35 29 5d 3b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 44 24 3f 64 77 28 64 65 29 3a 64 77 28 63 47 29 2b 44 24 2b 22 29 22 7d 69 66 28 44 6b 3d 3d 64 77 28 72 67 29 29 7b 76 61 72 20 4c 74 3d 64 72 5b 64 77 28 32 35 39 29 5d 3b 72 65 74 75 72 6e 20 74 79 70 65 6f 66 20 4c 74 3d 3d 64 77 28 32 35 33 29 26 26 4c 74 5b 64 77 28 32 34 36 29 5d 3e 30 3f 64 77 28 32 36 30 29 2b 4c 74 2b 22 29 22 3a 64 77 28 32 36 31 29 7d 69 66 28 41 72 72 61 79 5b 64 77 28 74 5a 29 5d 28 64 72 29 29 7b 76 61 72 20 5f 75 3d 64 72 5b 64 77 28 70 5a 29 5d 3b 76 61 72 20 43 55 3d 22 5b 22 3b 5f 75 3e 30 26 26 28 43 55 2b 3d 70 63 28 64 72 5b 30 5d 29 29 3b 66 6f 72 28 76 61 72 20 6c 65 3d 31 3b 6c 65 3c 5f Data Ascii: ==dw(254)){var D$=dr[dw(255)];return null==D$?dw(de):dw(cG)+D$+")"}if(Dk==dw(rg)){var Lt=dr[dw(259)];return typeof Lt==dw(253)&&Lt[dw(246)]>0?dw(260)+Lt+")":dw(261)}if(Array[dw(tZ)](dr)){var _u=dr[dw(pZ)];var CU="[";_u>0&&(CU+=pc(dr[0]));for(var le=1;le<_
2025-04-02 11:55:49 UTC	1369	IN	Data Raw: 29 72 65 74 75 72 6e 20 6c 65 28 70 63 29 3b 69 66 28 70 5a 3d 5b 5d 2c 22 5b 6f 62 6a 65 63 74 20 41 72 72 61 79 5d 22 3d 3d 3d 4f 62 6a 65 63 74 5b 6c 65 28 44 6b 29 5d 2e 74 6f 53 74 72 69 6e 67 5b 6c 65 28 44 24 29 5d 28 66 67 29 29 7b 66 6f 72 28 74 5a 3d 66 67 5b 6c 65 28 4c 74 29 5d 2c 64 65 3d 30 3b 64 65 3c 74 5a 3b 64 65 2b 3d 31 29 70 5a 5b 64 65 5d 3d 5f 75 28 64 65 2c 66 67 29 7c 7c 22 6e 75 6c 6c 22 3b 72 65 74 75 72 6e 20 72 67 3d 30 3d 3d 3d 70 5a 2e 6c 65 6e 67 74 68 3f 22 5b 5d 22 3a 22 5b 22 2b 70 5a 5b 6c 65 28 33 33 30 29 5d 28 22 2c 22 29 2b 22 5d 22 7d 66 6f 72 28 63 47 20 69 6e 20 66 67 29 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 5b 6c 65 28 36 37 39 29 5d 2e 63 61 6c 6c 28 66 67 2c 63 47 29 26 26 28 72 67 3d 5f 75 28 63 47 Data Ascii: )return le(pc);if(pZ=[],"[object Array]"===Object[le(Dk)].toString[le(D$)](fg)){for(tZ=fg[le(Lt)],de=0;de<tZ;de+=1)pZ[de]=_u(de,fg)\|\|"null";return rg=0===pZ.length?"[]":"["+pZ[le(330)](",")+"]"}for(cG in fg)Object.prototype[le(679)].call(fg,cG)&&(rg=_u(cG
2025-04-02 11:55:49 UTC	1369	IN	Data Raw: 79 7c 7c 64 72 20 69 6e 73 74 61 6e 63 65 6f 66 20 55 69 6e 74 38 41 72 72 61 79 7c 7c 64 72 20 69 6e 73 74 61 6e 63 65 6f 66 20 55 69 6e 74 38 43 6c 61 6d 70 65 64 41 72 72 61 79 7c 7c 64 72 20 69 6e 73 74 61 6e 63 65 6f 66 20 49 6e 74 31 36 41 72 72 61 79 7c 7c 64 72 20 69 6e 73 74 61 6e 63 65 6f 66 20 55 69 6e 74 31 36 41 72 72 61 79 7c 7c 64 72 20 69 6e 73 74 61 6e 63 65 6f 66 20 49 6e 74 33 32 41 72 72 61 79 7c 7c 64 72 20 69 6e 73 74 61 6e 63 65 6f 66 20 55 69 6e 74 33 32 41 72 72 61 79 7c 7c 64 72 20 69 6e 73 74 61 6e 63 65 6f 66 20 46 6c 6f 61 74 33 32 41 72 72 61 79 7c 7c 64 72 20 69 6e 73 74 61 6e 63 65 6f 66 20 46 6c 6f 61 74 36 34 41 72 72 61 79 7d 2c 68 3a 66 67 3d 3d 74 72 75 65 3f 22 5f 22 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 64 Data Ascii: y\|\|dr instanceof Uint8Array\|\|dr instanceof Uint8ClampedArray\|\|dr instanceof Int16Array\|\|dr instanceof Uint16Array\|\|dr instanceof Int32Array\|\|dr instanceof Uint32Array\|\|dr instanceof Float32Array\|\|dr instanceof Float64Array},h:fg==true?"_":function(){var d
2025-04-02 11:55:49 UTC	1369	IN	Data Raw: 6f 72 61 67 65 2e 73 65 74 49 74 65 6d 28 71 65 2c 71 65 29 2c 6c 6f 63 61 6c 53 74 6f 72 61 67 65 5b 61 4c 28 38 39 30 29 5d 28 71 65 29 3b 74 72 79 7b 22 6f 70 65 6e 44 61 74 61 62 61 73 65 22 69 6e 20 77 69 6e 64 6f 77 26 26 6f 70 65 6e 44 61 74 61 62 61 73 65 28 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 29 2c 43 59 28 21 31 29 7d 63 61 74 63 68 28 64 72 29 7b 43 59 28 21 30 29 7d 7d 63 61 74 63 68 28 64 72 29 7b 43 59 28 21 30 29 7d 77 69 6e 64 6f 77 5b 61 4c 28 35 36 32 29 5d 5b 61 4c 28 33 32 38 29 5d 28 71 65 2c 31 29 5b 61 4c 28 64 65 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 64 72 29 7b 76 61 72 20 44 4a 3b 76 61 72 20 64 65 3d 61 4c 3b 76 61 72 20 76 4c 3d 6e 75 6c 6c 3d 3d 3d 28 44 4a 3d 64 72 2e 74 61 72 67 65 74 29 7c 7c 76 6f 69 64 Data Ascii: orage.setItem(qe,qe),localStorage[aL(890)](qe);try{"openDatabase"in window&&openDatabase(null,null,null,null),CY(!1)}catch(dr){CY(!0)}}catch(dr){CY(!0)}window[aL(562)][aL(328)](qe,1)[aL(de)]=function(dr){var DJ;var de=aL;var vL=null===(DJ=dr.target)\|\|void
2025-04-02 11:55:49 UTC	1369	IN	Data Raw: 44 4a 29 5d 28 29 5b 63 47 28 64 65 29 5d 29 7d 63 61 74 63 68 28 64 72 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 7d 7d 2c 21 44 6b 3f 66 75 6e 63 74 69 6f 6e 28 64 72 2c 44 4a 29 7b 72 65 74 75 72 6e 20 35 37 7c 64 72 7d 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 64 72 3d 55 63 3b 72 65 74 75 72 6e 20 64 72 28 37 33 37 29 21 3d 74 79 70 65 6f 66 20 70 65 72 66 6f 72 6d 61 6e 63 65 26 26 64 72 28 33 32 32 29 3d 3d 74 79 70 65 6f 66 20 70 65 72 66 6f 72 6d 61 6e 63 65 5b 64 72 28 38 38 37 29 5d 3f 70 65 72 66 6f 72 6d 61 6e 63 65 5b 64 72 28 38 38 37 29 5d 28 29 3a 44 61 74 65 5b 64 72 28 38 38 37 29 5d 28 29 7d 2c 21 70 7a 3f 66 61 6c 73 65 3a 66 75 6e 63 74 69 6f 6e 28 64 72 2c 44 4a 29 7b 76 61 72 20 64 65 3b 74 72 79 7b 72 65 74 75 72 6e 20 6e 75 6c Data Ascii: DJ)]()[cG(de)])}catch(dr){return null}},!Dk?function(dr,DJ){return 57\|dr}:function(){var dr=Uc;return dr(737)!=typeof performance&&dr(322)==typeof performance[dr(887)]?performance[dr(887)]():Date[dr(887)]()},!pz?false:function(dr,DJ){var de;try{return nul
2025-04-02 11:55:49 UTC	1369	IN	Data Raw: 67 29 5d 2c 71 65 5b 76 4c 28 74 5a 29 5d 5d 2c 43 59 26 26 5b 43 59 5b 76 4c 28 33 32 30 29 5d 2c 43 59 2e 72 61 6e 67 65 4d 61 78 2c 43 59 5b 76 4c 28 70 5a 29 5d 5d 2c 61 4c 26 26 5b 61 4c 5b 76 4c 28 33 32 30 29 5d 2c 61 4c 5b 76 4c 28 36 33 37 29 5d 2c 61 4c 5b 76 4c 28 38 32 39 29 5d 5d 2c 43 4c 26 26 5b 43 4c 2e 70 72 65 63 69 73 69 6f 6e 2c 43 4c 2e 72 61 6e 67 65 4d 61 78 2c 43 4c 2e 72 61 6e 67 65 4d 69 6e 5d 5d 7d 2c 47 6e 3d 66 75 6e 63 74 69 6f 6e 28 64 72 29 7b 76 61 72 20 44 4a 3d 37 33 32 3b 76 61 72 20 64 65 3d 36 32 30 3b 76 61 72 20 63 47 3d 38 36 36 3b 76 61 72 20 72 67 3d 55 63 3b 72 65 74 75 72 6e 20 50 55 2e 6c 61 73 74 49 6e 64 65 78 3d 30 2c 50 55 5b 72 67 28 33 34 37 29 5d 28 64 72 29 3f 22 5c 22 22 2b 64 72 5b 72 67 28 34 34 35 Data Ascii: g)],qe[vL(tZ)]],CY&&[CY[vL(320)],CY.rangeMax,CY[vL(pZ)]],aL&&[aL[vL(320)],aL[vL(637)],aL[vL(829)]],CL&&[CL.precision,CL.rangeMax,CL.rangeMin]]},Gn=function(dr){var DJ=732;var de=620;var cG=866;var rg=Uc;return PU.lastIndex=0,PU[rg(347)](dr)?"\""+dr[rg(445

Timestamp	Bytes transferred	Direction	Data
2025-04-02 11:55:48 UTC	522	OUT	GET /checksiteconfig?v=c1e11bfffe54019b36ca486d59d75ea65128f510&host=meheff.wpym.xyz&sitekey=234adb2f-52ba-4697-82fa-abecbb14b173&sc=1&swa=1&spst=1 HTTP/1.1 Host: api.hcaptcha.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-02 11:55:50 UTC	526	IN	HTTP/1.1 200 OK Date: Wed, 02 Apr 2025 11:55:49 GMT Content-Type: application/json Content-Length: 776 Connection: close Vary: Origin, Accept-Encoding Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: Cache-Control, Content-Type, DNT, Referer, User-Agent Access-Control-Allow-Methods: GET, HEAD, POST, OPTIONS Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 92a023af180ec3eb-EWR alt-svc: h3=":443"; ma=86400
2025-04-02 11:55:50 UTC	776	IN	Data Raw: 7b 22 66 65 61 74 75 72 65 73 22 3a 7b 22 65 6e 63 5f 67 65 74 5f 72 65 71 22 3a 74 72 75 65 7d 2c 22 63 22 3a 7b 22 74 79 70 65 22 3a 22 68 73 77 22 2c 22 72 65 71 22 3a 22 65 79 4a 30 65 58 41 69 4f 69 4a 4b 56 31 51 69 4c 43 4a 68 62 47 63 69 4f 69 4a 49 55 7a 49 31 4e 69 4a 39 2e 65 79 4a 6d 49 6a 6f 77 4c 43 4a 7a 49 6a 6f 79 4c 43 4a 30 49 6a 6f 69 64 79 49 73 49 6d 51 69 4f 69 4a 68 54 79 39 69 52 56 49 35 4e 32 68 5a 62 56 6b 35 64 44 5a 68 4e 57 68 4a 4d 57 68 75 62 6b 31 4a 63 44 52 35 4e 55 4d 32 53 6d 56 50 52 6e 4a 53 52 48 46 31 62 32 5a 33 4c 31 4e 75 64 30 74 32 56 46 68 35 52 32 78 6d 5a 55 52 75 65 46 5a 75 52 57 4e 30 61 57 64 56 63 6d 45 30 51 58 42 79 51 33 6c 75 64 6b 31 72 61 43 39 72 62 6d 5a 68 56 6c 4d 35 4b 79 74 7a 54 6a 42 4c Data Ascii: {"features":{"enc_get_req":true},"c":{"type":"hsw","req":"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJmIjowLCJzIjoyLCJ0IjoidyIsImQiOiJhTy9iRVI5N2hZbVk5dDZhNWhJMWhubk1JcDR5NUM2SmVPRnJSRHF1b2Z3L1Nud0t2VFh5R2xmZURueFZuRWN0aWdVcmE0QXByQ3ludk1raC9rbmZhVlM5KytzTjBL

Timestamp	Bytes transferred	Direction	Data
2025-04-02 11:55:48 UTC	1191	OUT	POST /cdn-cgi/challenge-platform/h/b/flow/ov1/1212442583:1743593607:vEnn6mwQ95ke5K7PKXFGNwLCtODIADibp6QTenEhzhc/92a02388286d2361/syp_.SEti7486WnCqG9gsMLBHxYvSA_rvMrkUrBK2Co-1743594942-1.1.1.1-hiZdP5cCpXDZqZ5jFX1duCsIUIGCXFylZ7JqyH8T8R3WvmVSUwC0qzbDeMX9EL9M HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive Content-Length: 3335 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: text/plain;charset=UTF-8 cf-chl: syp_.SEti7486WnCqG9gsMLBHxYvSA_rvMrkUrBK2Co-1743594942-1.1.1.1-hiZdP5cCpXDZqZ5jFX1duCsIUIGCXFylZ7JqyH8T8R3WvmVSUwC0qzbDeMX9EL9M cf-chl-ra: 0 sec-ch-ua-mobile: ?0 Accept: / Origin: https://challenges.cloudflare.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/r4wwa/0x4AAAAAAA2ptl9BKcGk2BB2/auto/fbE/new/normal/auto/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-02 11:55:48 UTC	3335	OUT	Data Raw: 2d 4a 6d 5a 58 5a 67 5a 4b 5a 6d 5a 75 24 61 48 24 61 44 5a 24 53 6e 76 57 51 24 59 61 57 61 73 77 53 2b 4f 52 61 4d 33 76 5a 65 52 6e 33 61 74 61 37 52 57 76 36 52 71 67 39 36 61 59 52 2b 36 61 47 61 2d 46 5a 61 58 33 5a 61 7a 2b 61 7a 50 4a 71 54 61 4b 6d 56 33 33 36 2b 52 6e 63 61 30 53 6e 73 61 4b 41 30 56 42 61 54 5a 71 4f 61 70 4c 47 43 38 61 6e 67 32 24 4a 2b 54 5a 6e 39 61 45 4c 33 6c 4c 33 4e 5a 6c 53 4f 62 70 39 61 6d 77 31 2b 61 24 37 37 2b 77 76 4e 36 4c 62 2b 61 6e 67 39 36 4a 4a 69 54 4a 5a 34 36 44 53 62 43 50 62 49 42 52 76 61 54 4b 5a 37 4b 57 6d 30 67 71 52 61 37 6d 61 63 42 5a 7a 61 57 76 67 61 57 4b 54 6c 4c 52 61 6a 5a 6e 37 7a 7a 33 61 48 41 4c 4d 35 4b 6d 7a 63 31 6d 53 61 33 76 61 73 5a 24 65 7a 6e 2b 53 47 61 71 54 7a 52 4a 61 46 Data Ascii: -JmZXZgZKZmZu$aH$aDZ$SnvWQ$YaWaswS+ORaM3vZeRn3ata7RWv6Rqg96aYR+6aGa-FZaX3Zaz+azPJqTaKmV336+Rnca0SnsaKA0VBaTZqOapLGC8ang2$J+TZn9aEL3lL3NZlSObp9amw1+a$77+wvN6Lb+ang96JJiTJZ46DSbCPbIBRvaTKZ7KWm0gqRa7macBZzaWvgaWKTlLRajZn7zz3aHALM5Kmzc1mSa3vasZ$ezn+SGaqTzRJaF
2025-04-02 11:55:49 UTC	1051	IN	HTTP/1.1 200 OK Date: Wed, 02 Apr 2025 11:55:49 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 228856 Connection: close cf-chl-gen: XzhTwGCzVPf5CNz+JBQvc7Z4nPj9a5n40DLJmJ8UXvVX3gkPMctxxb3PVUKG75tcnsVtuRgavNC89phAUrp4/plDXQN/zLD9QYu+7PHgGlMensmHCS86xDR+RwF5sGQNiRqDXbSZ8hOqFE44seMuPDqrY4f1fvRbKAAGaH5dDD3vfIWOF4/MYzXPB9Cot7N82apLWfsdbK2PgTAh/8B4TeuUZaUE39Ok+fMVHJEnn3rHDiRzOPTdIGgBHTHo2YuyweXAvMnyKRbwLmM/8h976rD9y8FhciKi/lDOH5pUIps0VEigaKLYtH5c91xBrlkADz54/DsMfvVUo4t0O6KywsLjqpomrohjR3rFCg5LqCIGo3iflnwvdbr9xuEathiYVrEk3a8N08PnB0RlyC2pd4lR4pOeOgKDDOZfi7RCm6S1312JSPiHZyGUfxtjlwxhZhhyn7a6pbW7w87zgBnXJjAHFj4EaLyIJ7BwrzsOwX9ndFCKknSv1iRnJ2kjP3yvhwsMg1qf18GQkPiQQkm1ZTq+b1iDI+/NVdc4iti55ZAmNAJmL7mAz+e4MwRJL7WM1x/3CchrS/5TM4lyDHxHRj8k4K2sQFJETTYAJy4J6h8M/hDopxhAD6TYHzx7uowOljglEySw/qzMmiensmxbzwkfrxcDBr4dGjjSU7bdq5gmT8WTQCNIH2ynDJl+OSX4oOy4fHe4apgiYZFGT5ilhxhQv4EIPwmYUx2LsdEey8WDBRV5Xnm3Htwy3ZHsJHHON5280Dsaev1bosSeapTvjA==$FLl/vCosRWKInMbL4MRFrw== Server: cloudflare CF-RAY: 92a023af48082363-EWR alt-svc: h3=":443"; ma=86400
2025-04-02 11:55:49 UTC	318	IN	Data Raw: 6b 35 54 47 6b 34 4f 33 77 37 69 61 75 71 50 4a 71 71 69 6e 78 6f 36 6f 76 71 57 4f 77 73 72 49 6d 4a 71 6d 30 37 6e 51 76 73 32 38 76 2b 54 46 31 4b 4f 70 79 62 71 72 76 36 37 73 36 38 44 67 38 75 4c 65 73 50 62 59 75 50 66 62 37 4e 37 4d 30 2b 6a 4f 39 2b 54 57 78 4e 47 35 39 66 59 46 79 2f 67 50 78 74 63 4f 42 77 63 54 46 65 77 55 7a 75 7a 57 45 78 63 47 36 65 30 61 46 65 48 75 39 50 34 6b 48 66 77 5a 35 42 2f 39 4c 67 7a 39 4b 67 2f 78 41 42 50 2b 4a 43 67 58 41 79 67 36 44 78 6f 38 4f 52 59 63 49 42 49 2b 45 77 59 66 49 53 4e 41 41 78 31 42 4b 6a 78 48 44 6b 4e 4e 4a 52 41 30 4d 69 6f 56 4c 45 30 56 56 6c 41 58 4e 55 70 56 5a 45 52 58 4c 69 4d 2b 4e 47 51 64 51 6b 6f 36 4a 30 56 68 63 6c 78 4e 4c 7a 5a 69 4b 6b 56 4c 61 6a 56 56 58 58 31 68 65 31 46 Data Ascii: k5TGk4O3w7iauqPJqqinxo6ovqWOwsrImJqm07nQvs28v+TF1KOpybqrv67s68Dg8uLesPbYuPfb7N7M0+jO9+TWxNG59fYFy/gPxtcOBwcTFewUzuzWExcG6e0aFeHu9P4kHfwZ5B/9Lgz9Kg/xABP+JCgXAyg6Dxo8ORYcIBI+EwYfISNAAx1BKjxHDkNNJRA0MioVLE0VVlAXNUpVZERXLiM+NGQdQko6J0VhclxNLzZiKkVLajVVXX1he1F
2025-04-02 11:55:49 UTC	1369	IN	Data Raw: 2b 55 69 49 75 7a 67 71 2b 4d 6b 4c 4f 7a 74 72 4b 33 77 4c 71 51 75 37 36 39 76 73 54 45 6f 5a 2b 45 78 38 7a 48 6a 49 4b 44 6b 5a 32 55 30 70 4b 77 71 4c 6d 5a 79 72 65 76 78 72 71 59 32 4d 79 64 76 37 4c 64 30 73 50 47 33 61 47 69 31 39 76 6a 7a 4d 50 76 78 38 37 52 72 38 6e 32 71 39 72 49 79 4f 76 65 31 38 6e 62 30 50 7a 56 35 73 57 35 31 75 41 46 39 51 48 75 79 41 66 67 7a 4f 66 53 41 2f 54 33 44 77 4d 4f 48 4f 51 49 48 65 37 73 46 51 33 32 36 2b 2f 2b 46 66 76 31 47 66 59 4b 2b 76 59 62 37 53 41 47 49 43 34 42 4a 50 55 6d 41 67 49 58 4b 41 77 57 2b 2f 6f 2f 50 54 34 6b 4a 43 51 37 4f 52 45 41 53 52 55 4e 53 6b 52 51 44 79 59 67 44 69 46 45 4e 54 6b 51 45 45 30 31 4b 79 59 59 48 6c 41 74 46 56 42 68 4f 6a 70 52 52 7a 63 6a 59 32 4e 73 52 69 38 35 58 Data Ascii: +UiIuzgq+MkLOztrK3wLqQu769vsTEoZ+Ex8zHjIKDkZ2U0pKwqLmZyrevxrqY2Mydv7Ld0sPG3aGi19vjzMPvx87Rr8n2q9rIyOve18nb0PzV5sW51uAF9QHuyAfgzOfSA/T3DwMOHOQIHe7sFQ326+/+Ffv1GfYK+vYb7SAGIC4BJPUmAgIXKAwW+/o/PT4kJCQ7OREASRUNSkRQDyYgDiFENTkQEE01KyYYHlAtFVBhOjpRRzcjY2NsRi85X
2025-04-02 11:55:49 UTC	1369	IN	Data Raw: 33 75 4c 79 32 65 37 79 2f 75 6e 2f 41 77 72 36 44 78 4d 58 43 68 38 6a 49 71 59 4f 4a 6a 61 62 52 30 6f 57 6f 76 36 33 55 31 36 53 6b 32 37 4b 38 32 4c 6d 53 79 37 4f 39 30 4d 47 31 77 64 54 46 74 63 58 59 79 4b 54 4a 33 4d 76 54 78 66 58 6d 33 37 53 71 32 4d 54 30 78 2f 6e 57 31 62 37 39 75 64 55 41 2f 66 72 46 78 41 6e 48 2f 41 66 48 2b 66 66 6a 45 38 37 64 36 4f 44 75 47 66 44 75 44 77 6e 5a 37 42 77 62 44 64 50 61 36 39 30 59 46 78 30 4a 47 65 55 58 36 43 34 46 2f 53 44 74 37 2f 73 6a 46 52 50 33 44 52 6f 32 4a 42 44 35 46 68 30 30 51 2f 34 61 49 41 49 6f 4b 53 6b 39 49 44 63 71 4b 77 73 6e 45 44 78 43 4c 68 42 4d 46 55 30 56 56 6a 67 33 4f 68 59 58 4b 78 73 76 4f 6a 39 53 50 54 68 70 51 44 30 33 62 57 6f 35 4f 58 46 75 50 44 4e 54 4b 32 64 78 4e 6b Data Ascii: 3uLy2e7y/un/Awr6DxMXCh8jIqYOJjabR0oWov63U16Sk27K82LmSy7O90MG1wdTFtcXYyKTJ3MvTxfXm37Sq2MT0x/nW1b79udUA/frFxAnH/AfH+ffjE87d6ODuGfDuDwnZ7BwbDdPa690YFx0JGeUX6C4F/SDt7/sjFRP3DRo2JBD5Fh00Q/4aIAIoKSk9IDcqKwsnEDxCLhBMFU0VVjg3OhYXKxsvOj9SPThpQD03bWo5OXFuPDNTK2dxNk
2025-04-02 11:55:49 UTC	1369	IN	Data Raw: 76 33 36 33 6c 4d 47 64 6c 4d 57 77 68 34 71 64 70 58 2b 6a 74 37 44 4c 70 36 6d 77 71 37 4b 58 79 4d 53 30 72 71 2f 51 74 74 69 37 75 35 72 45 31 38 47 2f 35 39 2b 67 76 38 69 72 37 73 54 63 32 74 48 44 37 4f 44 71 31 37 48 6c 37 73 6a 46 2f 64 58 50 75 62 7a 79 31 39 65 36 31 51 44 56 43 4f 4c 39 35 76 66 75 2f 75 34 48 43 41 2f 6d 43 65 55 52 31 51 2f 70 30 39 59 5a 33 52 72 7a 41 41 44 34 46 66 44 39 39 52 37 79 46 68 6e 7a 36 79 73 70 42 4f 34 76 4e 44 51 55 45 7a 67 59 45 69 6b 53 44 79 73 51 4b 52 67 4a 47 51 37 35 41 6a 51 57 43 45 4d 32 43 51 49 44 41 43 6f 47 53 69 34 70 4d 7a 5a 4c 56 53 63 32 46 7a 4d 71 48 55 39 63 53 56 6b 59 4c 46 35 57 4d 56 49 39 4e 43 67 36 52 6d 30 74 54 6a 34 73 57 6e 51 2f 59 56 4e 47 53 46 56 44 65 6e 70 37 4e 46 35 Data Ascii: v363lMGdlMWwh4qdpX+jt7DLp6mwq7KXyMS0rq/Qtti7u5rE18G/59+gv8ir7sTc2tHD7ODq17Hl7sjF/dXPubzy19e61QDVCOL95vfu/u4HCA/mCeUR1Q/p09YZ3RrzAAD4FfD99R7yFhnz6yspBO4vNDQUEzgYEikSDysQKRgJGQ75AjQWCEM2CQIDACoGSi4pMzZLVSc2FzMqHU9cSVkYLF5WMVI9NCg6Rm0tTj4sWnQ/YVNGSFVDenp7NF5
2025-04-02 11:55:49 UTC	1369	IN	Data Raw: 4a 43 48 6c 62 6e 45 75 59 50 46 6e 4b 36 5a 70 63 2b 72 71 4c 36 58 75 63 33 55 70 4b 7a 56 73 71 36 7a 71 39 57 39 6d 39 2f 43 7a 2b 44 6f 75 4e 57 6e 35 4e 76 75 37 2b 62 51 73 63 33 6f 78 4c 2f 51 73 75 2b 79 37 76 66 6f 74 64 58 71 38 51 58 68 2b 4f 59 4a 34 4f 54 31 2b 66 58 49 35 75 72 50 7a 4e 76 4c 36 75 7a 74 42 74 48 5a 36 42 41 57 43 65 33 7a 48 78 76 68 47 77 4d 44 45 65 44 66 43 2f 51 68 4b 43 49 77 4a 4f 34 4a 38 44 4d 76 45 67 55 44 43 7a 4d 54 46 52 62 38 44 7a 45 51 2f 51 38 74 49 41 49 78 48 78 49 6a 52 6b 59 49 42 79 55 36 48 55 6b 71 45 7a 39 44 4b 78 64 54 4a 54 45 62 4d 42 5a 4d 45 6a 64 6a 58 56 35 69 56 7a 59 7a 4a 79 6c 44 61 6c 34 37 54 56 31 4b 53 30 68 50 59 45 64 4e 54 57 73 30 4e 32 74 32 53 6e 70 57 61 7a 35 77 59 30 56 63 Data Ascii: JCHlbnEuYPFnK6Zpc+rqL6Xuc3UpKzVsq6zq9W9m9/Cz+DouNWn5Nvu7+bQsc3oxL/Qsu+y7vfotdXq8QXh+OYJ4OT1+fXI5urPzNvL6uztBtHZ6BAWCe3zHxvhGwMDEeDfC/QhKCIwJO4J8DMvEgUDCzMTFRb8DzEQ/Q8tIAIxHxIjRkYIByU6HUkqEz9DKxdTJTEbMBZMEjdjXV5iVzYzJylDal47TV1KS0hPYEdNTWs0N2t2SnpWaz5wY0Vc
2025-04-02 11:55:49 UTC	1369	IN	Data Raw: 43 4a 7a 73 36 44 69 4a 2b 6f 71 36 53 6d 73 38 4f 6c 6d 39 66 50 76 36 6a 4d 75 64 75 30 73 4c 57 35 79 4c 65 6a 76 4b 65 6f 35 4d 47 72 35 38 37 44 72 38 58 4b 78 37 50 4b 36 38 62 49 31 75 62 53 33 73 2f 5a 34 66 4b 2b 78 4e 50 59 31 2b 54 30 41 4f 6a 33 39 2b 6a 61 7a 2b 45 4e 44 73 73 4e 36 78 54 51 32 66 49 58 38 4f 67 55 49 66 62 72 33 77 41 68 35 76 4c 33 2b 42 63 6a 4b 64 38 50 48 69 66 76 48 75 30 54 41 79 59 6b 45 51 55 70 46 54 49 73 38 42 74 43 44 44 41 41 49 77 45 76 45 43 45 41 4e 51 5a 42 48 7a 38 38 50 79 46 45 4c 53 52 4d 46 6a 4d 30 4c 45 63 33 46 52 34 5a 4b 78 73 76 55 44 39 53 50 55 52 70 51 44 31 44 62 57 6f 35 52 58 46 75 50 55 56 31 63 6b 46 46 65 58 5a 46 52 58 31 36 53 44 39 66 4e 33 4e 39 51 6c 68 5a 51 6f 65 48 50 45 46 59 59 Data Ascii: CJzs6DiJ+oq6Sms8Olm9fPv6jMudu0sLW5yLejvKeo5MGr587Dr8XKx7PK68bI1ubS3s/Z4fK+xNPY1+T0AOj39+jaz+ENDssN6xTQ2fIX8OgUIfbr3wAh5vL3+BcjKd8PHifvHu0TAyYkEQUpFTIs8BtCDDAAIwEvECEANQZBHz88PyFELSRMFjM0LEc3FR4ZKxsvUD9SPURpQD1DbWo5RXFuPUV1ckFFeXZFRX16SD9fN3N9QlhZQoeHPEFYY
2025-04-02 11:55:49 UTC	1369	IN	Data Raw: 64 77 36 47 69 6d 4e 72 47 75 38 62 55 75 39 2f 4b 7a 4b 37 4e 31 65 53 37 75 39 2b 6c 77 63 72 6c 33 73 62 68 35 38 2f 42 30 38 62 66 34 4f 4b 7a 2b 64 44 4a 35 4e 7a 50 39 4f 72 52 7a 2f 62 74 32 41 58 43 30 39 50 49 32 4e 7a 4a 43 65 62 4a 43 68 48 79 33 38 7a 57 47 41 58 71 2b 50 6f 50 46 42 76 72 45 65 73 59 46 42 6a 77 34 52 37 6e 49 53 63 62 44 52 30 72 36 6a 45 65 2f 43 59 31 49 41 34 6b 38 76 6b 73 47 44 37 34 4b 51 6b 42 48 54 42 46 2f 42 6c 48 2b 55 55 7a 50 54 55 6d 54 44 74 49 54 79 63 4e 51 56 56 51 4c 69 77 51 4a 56 41 32 54 43 67 62 4d 43 31 58 58 79 30 31 57 57 49 68 57 56 49 31 4e 57 4d 2f 53 55 35 6e 55 32 70 6d 5a 56 5a 4e 5a 47 34 32 61 31 68 61 56 6d 74 4a 62 46 77 39 68 54 31 5a 68 7a 71 46 63 33 31 31 5a 6f 78 37 69 49 68 6d 53 57 Data Ascii: dw6GimNrGu8bUu9/KzK7N1eS7u9+lwcrl3sbh58/B08bf4OKz+dDJ5NzP9OrRz/bt2AXC09PI2NzJCebJChHy38zWGAXq+PoPFBvrEesYFBjw4R7nIScbDR0r6jEe/CY1IA4k8vksGD74KQkBHTBF/BlH+UUzPTUmTDtITycNQVVQLiwQJVA2TCgbMC1XXy01WWIhWVI1NWM/SU5nU2pmZVZNZG42a1haVmtJbFw9hT1ZhzqFc311Zox7iIhmSW
2025-04-02 11:55:49 UTC	1369	IN	Data Raw: 6d 73 57 5a 79 5a 48 63 6e 39 7a 64 34 64 61 31 73 71 61 6f 77 75 6e 6b 71 4d 50 49 37 62 7a 50 70 62 2f 6d 77 2b 37 47 37 65 7a 35 74 2f 54 78 37 50 72 79 39 66 66 51 41 2f 72 36 35 50 37 38 2f 63 4d 44 41 51 6a 48 42 77 55 4b 79 77 73 4a 44 63 38 50 44 52 6a 54 45 78 45 62 31 78 63 56 48 74 73 62 47 53 48 66 48 78 30 73 46 51 2f 35 41 2b 77 77 38 51 49 43 4e 50 45 49 41 69 6b 74 46 41 6b 38 47 6b 41 31 50 66 67 68 42 44 63 64 4a 54 49 70 50 6b 77 37 48 54 41 4b 4f 69 46 52 51 54 49 2f 53 30 73 51 55 53 38 53 4c 79 68 4f 4e 54 73 61 55 6a 31 44 4d 46 56 65 53 44 67 37 53 46 6c 4d 54 45 6f 39 4d 55 46 76 4c 6d 46 4b 5a 6a 46 31 5a 79 35 39 50 58 78 73 67 48 32 43 63 58 31 37 66 48 55 2f 68 34 6c 38 64 6f 31 50 66 58 39 69 66 33 35 32 54 31 5a 53 64 34 2b Data Ascii: msWZyZHcn9zd4da1sqaowunkqMPI7bzPpb/mw+7G7ez5t/Tx7Pry9ffQA/r65P78/cMDAQjHBwUKywsJDc8PDRjTExEb1xcVHtsbGSHfHx0sFQ/5A+ww8QICNPEIAiktFAk8GkA1PfghBDcdJTIpPkw7HTAKOiFRQTI/S0sQUS8SLyhONTsaUj1DMFVeSDg7SFlMTEo9MUFvLmFKZjF1Zy59PXxsgH2CcX17fHU/h4l8do1PfX9if352T1ZSd4+
2025-04-02 11:55:49 UTC	1369	IN	Data Raw: 65 4b 56 75 4d 2b 39 35 4f 65 30 74 62 2b 6b 78 71 37 72 72 39 6e 70 32 37 48 65 78 50 61 30 30 2b 2f 57 32 64 62 71 75 72 72 74 31 64 69 2f 41 74 44 6a 77 76 6b 42 42 2b 62 6c 35 41 45 4c 2f 42 4d 49 46 4f 37 55 36 2b 44 30 43 50 55 63 39 68 4c 36 43 39 33 65 49 78 49 62 48 76 33 79 41 2f 34 4c 36 2b 59 59 43 51 6f 6c 49 67 73 32 38 51 62 31 43 44 73 76 4a 76 6a 7a 2b 53 6e 37 48 78 6f 38 2f 6b 45 53 45 78 6b 6a 51 55 31 42 42 68 35 43 45 53 38 74 55 56 42 52 4c 46 63 55 57 78 56 4e 58 44 4a 51 48 69 70 67 48 53 30 38 4f 42 38 77 4a 69 67 2f 53 7a 78 47 52 46 6f 6f 50 30 67 7a 4d 33 56 69 4b 6e 55 34 64 58 5a 36 62 30 35 4c 50 30 46 62 67 6d 4a 45 68 45 52 34 58 47 71 49 67 6f 46 64 59 55 4f 43 68 70 4a 6c 68 59 79 46 56 48 61 4a 62 59 64 61 69 48 39 67 Data Ascii: eKVuM+95Oe0tb+kxq7rr9np27HexPa00+/W2dbqurrt1di/AtDjwvkBB+bl5AEL/BMIFO7U6+D0CPUc9hL6C93eIxIbHv3yA/4L6+YYCQolIgs28Qb1CDsvJvjz+Sn7Hxo8/kESExkjQU1BBh5CES8tUVBRLFcUWxVNXDJQHipgHS08OB8wJig/SzxGRFooP0gzM3ViKnU4dXZ6b05LP0FbgmJEhER4XGqIgoFdYUOChpJlhYyFVHaJbYdaiH9g

Timestamp	Bytes transferred	Direction	Data
2025-04-02 11:55:49 UTC	689	OUT	GET /owa/favicon.ico HTTP/1.1 Host: meheff.wpym.xyz Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://meheff.wpym.xyz/nrColMBN Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: 68ba-73d6=5964312a968d5bf8b4112aeb76102c73361c8cf272c7006e3e95435506daf19e
2025-04-02 11:55:54 UTC	17	IN	HTTP/1.1 200 OK
2025-04-02 11:55:54 UTC	22	IN	Data Raw: 41 63 63 65 70 74 2d 52 61 6e 67 65 73 3a 20 62 79 74 65 73 0d 0a Data Ascii: Accept-Ranges: bytes
2025-04-02 11:55:54 UTC	55	IN	Data Raw: 41 6c 74 2d 53 76 63 3a 20 68 33 3d 22 3a 34 34 33 22 3b 6d 61 3d 32 35 39 32 30 30 30 2c 68 33 2d 32 39 3d 22 3a 34 34 33 22 3b 6d 61 3d 32 35 39 32 30 30 30 0d 0a Data Ascii: Alt-Svc: h3=":443";ma=2592000,h3-29=":443";ma=2592000
2025-04-02 11:55:54 UTC	39	IN	Data Raw: 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 70 75 62 6c 69 63 2c 6d 61 78 2d 61 67 65 3d 32 35 39 32 30 30 30 0d 0a Data Ascii: Cache-Control: public,max-age=2592000
2025-04-02 11:55:54 UTC	19	IN	Data Raw: 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a Data Ascii: Connection: close
2025-04-02 11:55:54 UTC	28	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 0d 0a Data Ascii: Content-Type: image/x-icon
2025-04-02 11:55:54 UTC	37	IN	Data Raw: 44 61 74 65 3a 20 57 65 64 2c 20 30 32 20 41 70 72 20 32 30 32 35 20 31 31 3a 35 35 3a 34 39 20 47 4d 54 0d 0a Data Ascii: Date: Wed, 02 Apr 2025 11:55:49 GMT
2025-04-02 11:55:54 UTC	25	IN	Data Raw: 45 74 61 67 3a 20 22 30 35 66 38 38 32 61 32 61 30 64 62 31 3a 30 22 0d 0a Data Ascii: Etag: "05f882a2a0db1:0"
2025-04-02 11:55:54 UTC	46	IN	Data Raw: 4c 61 73 74 2d 4d 6f 64 69 66 69 65 64 3a 20 53 61 74 2c 20 32 39 20 4d 61 72 20 32 30 32 35 20 31 32 3a 30 32 3a 35 38 20 47 4d 54 0d 0a Data Ascii: Last-Modified: Sat, 29 Mar 2025 12:02:58 GMT
2025-04-02 11:55:54 UTC	127	IN	Data Raw: 4e 65 6c 3a 20 7b 22 72 65 70 6f 72 74 5f 74 6f 22 3a 22 4e 65 6c 4f 66 66 69 63 65 55 70 6c 6f 61 64 31 22 2c 22 6d 61 78 5f 61 67 65 22 3a 37 32 30 30 2c 22 69 6e 63 6c 75 64 65 5f 73 75 62 64 6f 6d 61 69 6e 73 22 3a 74 72 75 65 2c 22 66 61 69 6c 75 72 65 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 75 63 63 65 73 73 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2e 30 31 7d 0d 0a Data Ascii: Nel: {"report_to":"NelOfficeUpload1","max_age":7200,"include_subdomains":true,"failure_fraction":1.0,"success_fraction":0.01}
2025-04-02 11:55:54 UTC	238	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 67 72 6f 75 70 22 3a 22 4e 65 6c 4f 66 66 69 63 65 55 70 6c 6f 61 64 31 22 2c 22 6d 61 78 5f 61 67 65 22 3a 37 32 30 30 2c 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 65 78 6f 2e 6e 65 6c 2e 6d 65 61 73 75 72 65 2e 6f 66 66 69 63 65 2e 6e 65 74 2f 61 70 69 2f 72 65 70 6f 72 74 3f 54 65 6e 61 6e 74 49 64 3d 26 46 72 6f 6e 74 45 6e 64 3d 43 61 66 65 26 44 65 73 74 69 6e 61 74 69 6f 6e 45 6e 64 70 6f 69 6e 74 3d 53 4a 43 26 52 65 6d 6f 74 65 49 50 3d 32 30 39 2e 31 34 31 2e 35 30 2e 34 31 26 45 6e 76 69 72 6f 6e 6d 65 6e 74 3d 4d 54 22 7d 5d 2c 22 69 6e 63 6c 75 64 65 5f 73 75 62 64 6f 6d 61 69 6e 73 22 3a 74 72 75 65 7d 0d 0a Data Ascii: Report-To: {"group":"NelOfficeUpload1","max_age":7200,"endpoints":[{"url":"https://exo.nel.measure.office.net/api/report?TenantId=&FrontEnd=Cafe&DestinationEndpoint=SJC&RemoteIP=209.141.50.41&Environment=MT"}],"include_subdomains":true}

Timestamp	Bytes transferred	Direction	Data
2025-04-02 11:55:53 UTC	1191	OUT	POST /cdn-cgi/challenge-platform/h/b/flow/ov1/1212442583:1743593607:vEnn6mwQ95ke5K7PKXFGNwLCtODIADibp6QTenEhzhc/92a02388286d2361/syp_.SEti7486WnCqG9gsMLBHxYvSA_rvMrkUrBK2Co-1743594942-1.1.1.1-hiZdP5cCpXDZqZ5jFX1duCsIUIGCXFylZ7JqyH8T8R3WvmVSUwC0qzbDeMX9EL9M HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive Content-Length: 3335 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: text/plain;charset=UTF-8 cf-chl: syp_.SEti7486WnCqG9gsMLBHxYvSA_rvMrkUrBK2Co-1743594942-1.1.1.1-hiZdP5cCpXDZqZ5jFX1duCsIUIGCXFylZ7JqyH8T8R3WvmVSUwC0qzbDeMX9EL9M cf-chl-ra: 1 sec-ch-ua-mobile: ?0 Accept: / Origin: https://challenges.cloudflare.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/r4wwa/0x4AAAAAAA2ptl9BKcGk2BB2/auto/fbE/new/normal/auto/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-02 11:55:53 UTC	3335	OUT	Data Raw: 2d 4a 6d 5a 58 5a 67 5a 4b 5a 6d 5a 75 24 61 48 24 61 44 5a 24 53 6e 76 57 51 24 59 61 57 61 73 77 53 2b 4f 52 61 4d 33 76 5a 65 52 6e 33 61 74 61 37 52 57 76 36 52 71 67 39 36 61 59 52 2b 36 61 47 61 2d 46 5a 61 58 33 5a 61 7a 2b 61 7a 50 4a 71 54 61 4b 6d 56 33 33 36 2b 52 6e 63 61 30 53 6e 73 61 4b 41 30 56 42 61 54 5a 71 4f 61 70 4c 47 43 38 61 6e 67 32 24 4a 2b 54 5a 6e 39 61 45 4c 33 6c 4c 33 4e 5a 6c 53 4f 62 70 39 61 6d 77 31 2b 61 24 37 37 2b 77 76 4e 36 4c 62 2b 61 6e 67 39 36 4a 4a 69 54 4a 5a 34 36 44 53 62 43 50 62 49 42 52 76 61 54 4b 5a 37 4b 57 6d 30 67 71 52 61 37 6d 61 63 42 5a 7a 61 57 76 67 61 57 4b 54 6c 4c 52 61 6a 5a 6e 37 7a 7a 33 61 48 41 4c 4d 35 4b 6d 7a 63 31 6d 53 61 33 76 61 73 5a 24 65 7a 6e 2b 53 47 61 71 54 7a 52 4a 61 46 Data Ascii: -JmZXZgZKZmZu$aH$aDZ$SnvWQ$YaWaswS+ORaM3vZeRn3ata7RWv6Rqg96aYR+6aGa-FZaX3Zaz+azPJqTaKmV336+Rnca0SnsaKA0VBaTZqOapLGC8ang2$J+TZn9aEL3lL3NZlSObp9amw1+a$77+wvN6Lb+ang96JJiTJZ46DSbCPbIBRvaTKZ7KWm0gqRa7macBZzaWvgaWKTlLRajZn7zz3aHALM5Kmzc1mSa3vasZ$ezn+SGaqTzRJaF
2025-04-02 11:55:53 UTC	1051	IN	HTTP/1.1 200 OK Date: Wed, 02 Apr 2025 11:55:53 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 228616 Connection: close cf-chl-gen: P0gDiDzTFzrp09EY4i2a9KNZ2YMdjSuYVPokUje1dw1R8wQ7+ca2ejR84L+y2P0vpXB+WRYuVUT+WVr5OUm9PL6NPEaPKGXCyF8+OIm8wsYtPjRVizztLvmNmSbdkej40Z9hPVgvQP7GxDS5TexbRNRgALNBZkPxEMBZGKC58l491xDKnCGhGqB++bmqbwGczMQ6AX4XmHh4Srylaxgzj/vTKnEgCfSJCHz7YWh0tNHILFt83P3QBBpm6QRRv+aShEiwZUOIAmeSBYECCryLReTU9l6zWnn/JE9JVukT15dbapo9GRIXbp17hVPmfzAx/g+hVeQGYQ9/9cJYR7NlzA4hil+LEDkI0iHJNZhgv0xUgZ8tT6/l64e8a2k1nSWY1E+II742LfPqoqJexh5SMiq/CT02RCCDm6KkAoI+Yqnd0LQd6cfOkL70YK7g1XYOGI49H5768ET6LICpKNDOP71LvxTERokGEjtGrwjBFtEL1xVBW7//qZd+ByiS+GmiO6/VspqbI1S85wbU1XlDwXGCD20f9rCQ4QWcXG1uVAd0T2/kT7ynKRZuA82F6zXqy3kGHNqg/25kQ+nE+eSYRCszwIURjnacZChDfp1Nk21TSHs/h6SYyWEBPL4G2NOog2kqiRkzfG+InZ0Q46zoQELKMKV27kB+Z+M4OD6uMPC1NulCJ0hLq4hq0d2Q9YKtInnNCnq5IDYuOt1fKAzL7yzZfRY/mqP/cISbx1fHxhbBNZNmblmLZ4SZmS/UbdsCyfhCRMW+liWedE6XBcbjqQ==$I8u8CRvbtY8gFQXC6QNnng== Server: cloudflare CF-RAY: 92a023c9fb8e4315-EWR alt-svc: h3=":443"; ma=86400
2025-04-02 11:55:53 UTC	318	IN	Data Raw: 6b 35 54 47 6b 34 4f 33 77 37 69 61 75 71 50 4a 71 71 69 6e 78 6f 36 6f 76 71 57 4f 77 73 72 49 6d 4a 71 6d 30 37 6e 51 76 73 32 38 76 2b 54 46 31 4b 4f 70 79 62 71 72 76 36 37 73 36 38 44 67 38 75 4c 65 73 50 62 59 75 50 66 62 37 4e 37 4d 30 2b 6a 4f 39 2b 54 57 78 4e 47 35 39 66 59 46 79 2f 67 50 78 74 63 4f 42 77 63 54 46 65 77 55 7a 75 7a 57 45 78 63 47 36 65 30 61 46 65 48 75 39 50 34 6b 48 66 77 5a 35 42 2f 39 4c 67 7a 39 4b 67 2f 78 41 42 50 2b 4a 43 67 58 41 79 67 36 44 78 6f 38 4f 52 59 63 49 42 49 2b 45 77 59 66 49 53 4e 41 41 78 31 42 4b 6a 78 48 44 6b 4e 4e 4a 52 41 30 4d 69 6f 56 4c 45 30 56 56 6c 41 58 4e 55 70 56 5a 45 52 58 4c 69 4d 2b 4e 47 51 64 51 6b 6f 36 4a 30 56 68 63 6c 78 4e 4c 7a 5a 69 4b 6b 56 4c 61 6a 56 56 58 58 31 68 65 31 46 Data Ascii: k5TGk4O3w7iauqPJqqinxo6ovqWOwsrImJqm07nQvs28v+TF1KOpybqrv67s68Dg8uLesPbYuPfb7N7M0+jO9+TWxNG59fYFy/gPxtcOBwcTFewUzuzWExcG6e0aFeHu9P4kHfwZ5B/9Lgz9Kg/xABP+JCgXAyg6Dxo8ORYcIBI+EwYfISNAAx1BKjxHDkNNJRA0MioVLE0VVlAXNUpVZERXLiM+NGQdQko6J0VhclxNLzZiKkVLajVVXX1he1F
2025-04-02 11:55:53 UTC	1369	IN	Data Raw: 2b 55 69 49 75 7a 67 71 2b 4d 6b 4c 4f 7a 74 72 4b 33 77 4c 71 51 75 37 36 39 76 73 54 45 6f 5a 2b 45 78 38 7a 48 6a 49 4b 44 6b 5a 32 55 30 70 4b 77 71 4c 6d 5a 79 72 65 76 78 72 71 59 32 4d 79 64 76 37 4c 64 30 73 50 47 33 61 47 69 31 39 76 6a 7a 4d 50 76 78 38 37 52 72 38 6e 32 71 39 72 49 79 4f 76 65 31 38 6e 62 30 50 7a 56 35 73 57 35 31 75 41 46 39 51 48 75 79 41 66 67 7a 4f 66 53 41 2f 54 33 44 77 4d 4f 48 4f 51 49 48 65 37 73 46 51 33 32 36 2b 2f 2b 46 66 76 31 47 66 59 4b 2b 76 59 62 37 53 41 47 49 43 34 42 4a 50 55 6d 41 67 49 58 4b 41 77 57 2b 2f 6f 2f 50 54 34 6b 4a 43 51 37 4f 52 45 41 53 52 55 4e 53 6b 52 51 44 79 59 67 44 69 46 45 4e 54 6b 51 45 45 30 31 4b 79 59 59 48 6c 41 74 46 56 42 68 4f 6a 70 52 52 7a 63 6a 59 32 4e 73 52 69 38 35 58 Data Ascii: +UiIuzgq+MkLOztrK3wLqQu769vsTEoZ+Ex8zHjIKDkZ2U0pKwqLmZyrevxrqY2Mydv7Ld0sPG3aGi19vjzMPvx87Rr8n2q9rIyOve18nb0PzV5sW51uAF9QHuyAfgzOfSA/T3DwMOHOQIHe7sFQ326+/+Ffv1GfYK+vYb7SAGIC4BJPUmAgIXKAwW+/o/PT4kJCQ7OREASRUNSkRQDyYgDiFENTkQEE01KyYYHlAtFVBhOjpRRzcjY2NsRi85X
2025-04-02 11:55:53 UTC	1369	IN	Data Raw: 33 75 4c 79 32 65 37 79 2f 75 6e 2f 41 77 72 36 44 78 4d 58 43 68 38 6a 49 71 59 4f 4a 6a 61 62 52 30 6f 57 6f 76 36 33 55 31 36 53 6b 32 37 4b 38 32 4c 6d 53 79 37 4f 39 30 4d 47 31 77 64 54 46 74 63 58 59 79 4b 54 4a 33 4d 76 54 78 66 58 6d 33 37 53 71 32 4d 54 30 78 2f 6e 57 31 62 37 39 75 64 55 41 2f 66 72 46 78 41 6e 48 2f 41 66 48 2b 66 66 6a 45 38 37 64 36 4f 44 75 47 66 44 75 44 77 6e 5a 37 42 77 62 44 64 50 61 36 39 30 59 46 78 30 4a 47 65 55 58 36 43 34 46 2f 53 44 74 37 2f 73 6a 46 52 50 33 44 52 6f 32 4a 42 44 35 46 68 30 30 51 2f 34 61 49 41 49 6f 4b 53 6b 39 49 44 63 71 4b 77 73 6e 45 44 78 43 4c 68 42 4d 46 55 30 56 56 6a 67 33 4f 68 59 58 4b 78 73 76 4f 6a 39 53 50 54 68 70 51 44 30 33 62 57 6f 35 4f 58 46 75 50 44 4e 54 4b 32 64 78 4e 6b Data Ascii: 3uLy2e7y/un/Awr6DxMXCh8jIqYOJjabR0oWov63U16Sk27K82LmSy7O90MG1wdTFtcXYyKTJ3MvTxfXm37Sq2MT0x/nW1b79udUA/frFxAnH/AfH+ffjE87d6ODuGfDuDwnZ7BwbDdPa690YFx0JGeUX6C4F/SDt7/sjFRP3DRo2JBD5Fh00Q/4aIAIoKSk9IDcqKwsnEDxCLhBMFU0VVjg3OhYXKxsvOj9SPThpQD03bWo5OXFuPDNTK2dxNk
2025-04-02 11:55:53 UTC	1369	IN	Data Raw: 76 33 36 33 6c 4d 47 64 6c 4d 57 77 68 34 71 64 70 58 2b 6a 74 37 44 4c 70 36 6d 77 71 37 4b 58 79 4d 53 30 72 71 2f 51 74 74 69 37 75 35 72 45 31 38 47 2f 35 39 2b 67 76 38 69 72 37 73 54 63 32 74 48 44 37 4f 44 71 31 37 48 6c 37 73 6a 46 2f 64 58 50 75 62 7a 79 31 39 65 36 31 51 44 56 43 4f 4c 39 35 76 66 75 2f 75 34 48 43 41 2f 6d 43 65 55 52 31 51 2f 70 30 39 59 5a 33 52 72 7a 41 41 44 34 46 66 44 39 39 52 37 79 46 68 6e 7a 36 79 73 70 42 4f 34 76 4e 44 51 55 45 7a 67 59 45 69 6b 53 44 79 73 51 4b 52 67 4a 47 51 37 35 41 6a 51 57 43 45 4d 32 43 51 49 44 41 43 6f 47 53 69 34 70 4d 7a 5a 4c 56 53 63 32 46 7a 4d 71 48 55 39 63 53 56 6b 59 4c 46 35 57 4d 56 49 39 4e 43 67 36 52 6d 30 74 54 6a 34 73 57 6e 51 2f 59 56 4e 47 53 46 56 44 65 6e 70 37 4e 46 35 Data Ascii: v363lMGdlMWwh4qdpX+jt7DLp6mwq7KXyMS0rq/Qtti7u5rE18G/59+gv8ir7sTc2tHD7ODq17Hl7sjF/dXPubzy19e61QDVCOL95vfu/u4HCA/mCeUR1Q/p09YZ3RrzAAD4FfD99R7yFhnz6yspBO4vNDQUEzgYEikSDysQKRgJGQ75AjQWCEM2CQIDACoGSi4pMzZLVSc2FzMqHU9cSVkYLF5WMVI9NCg6Rm0tTj4sWnQ/YVNGSFVDenp7NF5
2025-04-02 11:55:53 UTC	1369	IN	Data Raw: 4a 43 48 6c 62 6e 45 75 59 50 46 6e 4b 36 5a 70 63 2b 72 71 4c 36 58 75 63 33 55 70 4b 7a 56 73 71 36 7a 71 39 57 39 6d 39 2f 43 7a 2b 44 6f 75 4e 57 6e 35 4e 76 75 37 2b 62 51 73 63 33 6f 78 4c 2f 51 73 75 2b 79 37 76 66 6f 74 64 58 71 38 51 58 68 2b 4f 59 4a 34 4f 54 31 2b 66 58 49 35 75 72 50 7a 4e 76 4c 36 75 7a 74 42 74 48 5a 36 42 41 57 43 65 33 7a 48 78 76 68 47 77 4d 44 45 65 44 66 43 2f 51 68 4b 43 49 77 4a 4f 34 4a 38 44 4d 76 45 67 55 44 43 7a 4d 54 46 52 62 38 44 7a 45 51 2f 51 38 74 49 41 49 78 48 78 49 6a 52 6b 59 49 42 79 55 36 48 55 6b 71 45 7a 39 44 4b 78 64 54 4a 54 45 62 4d 42 5a 4d 45 6a 64 6a 58 56 35 69 56 7a 59 7a 4a 79 6c 44 61 6c 34 37 54 56 31 4b 53 30 68 50 59 45 64 4e 54 57 73 30 4e 32 74 32 53 6e 70 57 61 7a 35 77 59 30 56 63 Data Ascii: JCHlbnEuYPFnK6Zpc+rqL6Xuc3UpKzVsq6zq9W9m9/Cz+DouNWn5Nvu7+bQsc3oxL/Qsu+y7vfotdXq8QXh+OYJ4OT1+fXI5urPzNvL6uztBtHZ6BAWCe3zHxvhGwMDEeDfC/QhKCIwJO4J8DMvEgUDCzMTFRb8DzEQ/Q8tIAIxHxIjRkYIByU6HUkqEz9DKxdTJTEbMBZMEjdjXV5iVzYzJylDal47TV1KS0hPYEdNTWs0N2t2SnpWaz5wY0Vc
2025-04-02 11:55:53 UTC	1369	IN	Data Raw: 43 4a 7a 73 36 44 69 4a 2b 6f 71 36 53 6d 73 38 4f 6c 6d 39 66 50 76 36 6a 4d 75 64 75 30 73 4c 57 35 79 4c 65 6a 76 4b 65 6f 35 4d 47 72 35 38 37 44 72 38 58 4b 78 37 50 4b 36 38 62 49 31 75 62 53 33 73 2f 5a 34 66 4b 2b 78 4e 50 59 31 2b 54 30 41 4f 6a 33 39 2b 6a 61 7a 2b 45 4e 44 73 73 4e 36 78 54 51 32 66 49 58 38 4f 67 55 49 66 62 72 33 77 41 68 35 76 4c 33 2b 42 63 6a 4b 64 38 50 48 69 66 76 48 75 30 54 41 79 59 6b 45 51 55 70 46 54 49 73 38 42 74 43 44 44 41 41 49 77 45 76 45 43 45 41 4e 51 5a 42 48 7a 38 38 50 79 46 45 4c 53 52 4d 46 6a 4d 30 4c 45 63 33 46 52 34 5a 4b 78 73 76 55 44 39 53 50 55 52 70 51 44 31 44 62 57 6f 35 52 58 46 75 50 55 56 31 63 6b 46 46 65 58 5a 46 52 58 31 36 53 44 39 66 4e 33 4e 39 51 6c 68 5a 51 6f 65 48 50 45 46 59 59 Data Ascii: CJzs6DiJ+oq6Sms8Olm9fPv6jMudu0sLW5yLejvKeo5MGr587Dr8XKx7PK68bI1ubS3s/Z4fK+xNPY1+T0AOj39+jaz+ENDssN6xTQ2fIX8OgUIfbr3wAh5vL3+BcjKd8PHifvHu0TAyYkEQUpFTIs8BtCDDAAIwEvECEANQZBHz88PyFELSRMFjM0LEc3FR4ZKxsvUD9SPURpQD1DbWo5RXFuPUV1ckFFeXZFRX16SD9fN3N9QlhZQoeHPEFYY
2025-04-02 11:55:53 UTC	1369	IN	Data Raw: 64 77 36 47 69 6d 4e 72 47 75 38 62 55 75 39 2f 4b 7a 4b 37 4e 31 65 53 37 75 39 2b 6c 77 63 72 6c 33 73 62 68 35 38 2f 42 30 38 62 66 34 4f 4b 7a 2b 64 44 4a 35 4e 7a 50 39 4f 72 52 7a 2f 62 74 32 41 58 43 30 39 50 49 32 4e 7a 4a 43 65 62 4a 43 68 48 79 33 38 7a 57 47 41 58 71 2b 50 6f 50 46 42 76 72 45 65 73 59 46 42 6a 77 34 52 37 6e 49 53 63 62 44 52 30 72 36 6a 45 65 2f 43 59 31 49 41 34 6b 38 76 6b 73 47 44 37 34 4b 51 6b 42 48 54 42 46 2f 42 6c 48 2b 55 55 7a 50 54 55 6d 54 44 74 49 54 79 63 4e 51 56 56 51 4c 69 77 51 4a 56 41 32 54 43 67 62 4d 43 31 58 58 79 30 31 57 57 49 68 57 56 49 31 4e 57 4d 2f 53 55 35 6e 55 32 70 6d 5a 56 5a 4e 5a 47 34 32 61 31 68 61 56 6d 74 4a 62 46 77 39 68 54 31 5a 68 7a 71 46 63 33 31 31 5a 6f 78 37 69 49 68 6d 53 57 Data Ascii: dw6GimNrGu8bUu9/KzK7N1eS7u9+lwcrl3sbh58/B08bf4OKz+dDJ5NzP9OrRz/bt2AXC09PI2NzJCebJChHy38zWGAXq+PoPFBvrEesYFBjw4R7nIScbDR0r6jEe/CY1IA4k8vksGD74KQkBHTBF/BlH+UUzPTUmTDtITycNQVVQLiwQJVA2TCgbMC1XXy01WWIhWVI1NWM/SU5nU2pmZVZNZG42a1haVmtJbFw9hT1ZhzqFc311Zox7iIhmSW
2025-04-02 11:55:53 UTC	1369	IN	Data Raw: 6d 73 57 5a 79 5a 48 63 6e 39 7a 64 34 64 61 31 73 71 61 6f 77 75 6e 6b 71 4d 50 49 37 62 7a 50 70 62 2f 6d 77 2b 37 47 37 65 7a 35 74 2f 54 78 37 50 72 79 39 66 66 51 41 2f 72 36 35 50 37 38 2f 63 4d 44 41 51 6a 48 42 77 55 4b 79 77 73 4a 44 63 38 50 44 52 6a 54 45 78 45 62 31 78 63 56 48 74 73 62 47 53 48 66 48 78 30 73 46 51 2f 35 41 2b 77 77 38 51 49 43 4e 50 45 49 41 69 6b 74 46 41 6b 38 47 6b 41 31 50 66 67 68 42 44 63 64 4a 54 49 70 50 6b 77 37 48 54 41 4b 4f 69 46 52 51 54 49 2f 53 30 73 51 55 53 38 53 4c 79 68 4f 4e 54 73 61 55 6a 31 44 4d 46 56 65 53 44 67 37 53 46 6c 4d 54 45 6f 39 4d 55 46 76 4c 6d 46 4b 5a 6a 46 31 5a 79 35 39 50 58 78 73 67 48 32 43 63 58 31 37 66 48 55 2f 68 34 6c 38 64 6f 31 50 66 58 39 69 66 33 35 32 54 31 5a 53 64 34 2b Data Ascii: msWZyZHcn9zd4da1sqaowunkqMPI7bzPpb/mw+7G7ez5t/Tx7Pry9ffQA/r65P78/cMDAQjHBwUKywsJDc8PDRjTExEb1xcVHtsbGSHfHx0sFQ/5A+ww8QICNPEIAiktFAk8GkA1PfghBDcdJTIpPkw7HTAKOiFRQTI/S0sQUS8SLyhONTsaUj1DMFVeSDg7SFlMTEo9MUFvLmFKZjF1Zy59PXxsgH2CcX17fHU/h4l8do1PfX9if352T1ZSd4+
2025-04-02 11:55:53 UTC	1369	IN	Data Raw: 65 4b 56 75 4d 2b 39 35 4f 65 30 74 62 2b 6b 78 71 37 72 72 39 6e 70 32 37 48 65 78 50 61 30 30 2b 2f 57 32 64 62 71 75 72 72 74 31 64 69 2f 41 74 44 6a 77 76 6b 42 42 2b 62 6c 35 41 45 4c 2f 42 4d 49 46 4f 37 55 36 2b 44 30 43 50 55 63 39 68 4c 36 43 39 33 65 49 78 49 62 48 76 33 79 41 2f 34 4c 36 2b 59 59 43 51 6f 6c 49 67 73 32 38 51 62 31 43 44 73 76 4a 76 6a 7a 2b 53 6e 37 48 78 6f 38 2f 6b 45 53 45 78 6b 6a 51 55 31 42 42 68 35 43 45 53 38 74 55 56 42 52 4c 46 63 55 57 78 56 4e 58 44 4a 51 48 69 70 67 48 53 30 38 4f 42 38 77 4a 69 67 2f 53 7a 78 47 52 46 6f 6f 50 30 67 7a 4d 33 56 69 4b 6e 55 34 64 58 5a 36 62 30 35 4c 50 30 46 62 67 6d 4a 45 68 45 52 34 58 47 71 49 67 6f 46 64 59 55 4f 43 68 70 4a 6c 68 59 79 46 56 48 61 4a 62 59 64 61 69 48 39 67 Data Ascii: eKVuM+95Oe0tb+kxq7rr9np27HexPa00+/W2dbqurrt1di/AtDjwvkBB+bl5AEL/BMIFO7U6+D0CPUc9hL6C93eIxIbHv3yA/4L6+YYCQolIgs28Qb1CDsvJvjz+Sn7Hxo8/kESExkjQU1BBh5CES8tUVBRLFcUWxVNXDJQHipgHS08OB8wJig/SzxGRFooP0gzM3ViKnU4dXZ6b05LP0FbgmJEhER4XGqIgoFdYUOChpJlhYyFVHaJbYdaiH9g

Timestamp	Bytes transferred	Direction	Data
2025-04-02 11:55:55 UTC	639	OUT	GET /cdn-cgi/challenge-platform/h/b/flow/ov1/1212442583:1743593607:vEnn6mwQ95ke5K7PKXFGNwLCtODIADibp6QTenEhzhc/92a02388286d2361/syp_.SEti7486WnCqG9gsMLBHxYvSA_rvMrkUrBK2Co-1743594942-1.1.1.1-hiZdP5cCpXDZqZ5jFX1duCsIUIGCXFylZ7JqyH8T8R3WvmVSUwC0qzbDeMX9EL9M HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-02 11:55:55 UTC	442	IN	HTTP/1.1 400 Bad Request Date: Wed, 02 Apr 2025 11:55:55 GMT Content-Type: application/json Content-Length: 14 Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 cf-chl-out: 30pa6DNh4wM/mzDrNSqb4V4hPa93VFY/O8g2lSpBVCzplQDjTXF6a5KAFDOgXGEmE4nbsf48hm+A/hnBG5YaDA==$pMxAUVwrz7/DxPs+VO9NcQ== Server: cloudflare CF-RAY: 92a023d768aecb3a-EWR alt-svc: h3=":443"; ma=86400
2025-04-02 11:55:55 UTC	14	IN	Data Raw: 7b 22 65 72 72 22 3a 31 30 30 32 38 30 7d Data Ascii: {"err":100280}

Timestamp	Bytes transferred	Direction	Data
2025-04-02 11:55:56 UTC	827	OUT	GET /cdn-cgi/challenge-platform/h/b/d/92a02388286d2361/1743594953422/F44c2OL12PSq6bA HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/r4wwa/0x4AAAAAAA2ptl9BKcGk2BB2/auto/fbE/new/normal/auto/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-02 11:55:56 UTC	200	IN	HTTP/1.1 200 OK Date: Wed, 02 Apr 2025 11:55:56 GMT Content-Type: image/png Content-Length: 61 Connection: close Server: cloudflare CF-RAY: 92a023deff51cef2-EWR alt-svc: h3=":443"; ma=86400
2025-04-02 11:55:56 UTC	61	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 4e 00 00 00 21 08 02 00 00 00 f8 6a 0a c5 00 00 00 04 49 44 41 54 00 00 00 01 9d 24 d7 91 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRN!jIDAT$IENDB`

Timestamp	Bytes transferred	Direction	Data
2025-04-02 11:55:57 UTC	468	OUT	GET /cdn-cgi/challenge-platform/h/b/d/92a02388286d2361/1743594953422/F44c2OL12PSq6bA HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-02 11:55:57 UTC	200	IN	HTTP/1.1 200 OK Date: Wed, 02 Apr 2025 11:55:57 GMT Content-Type: image/png Content-Length: 61 Connection: close Server: cloudflare CF-RAY: 92a023e4ad027b0e-EWR alt-svc: h3=":443"; ma=86400
2025-04-02 11:55:57 UTC	61	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 4e 00 00 00 21 08 02 00 00 00 f8 6a 0a c5 00 00 00 04 49 44 41 54 00 00 00 01 9d 24 d7 91 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRN!jIDAT$IENDB`